Model processing method and device, equipment, medium and product

Abstract

The invention discloses a model processing method and device, equipment, a medium and a product. The method comprises the steps that each data owner trains an initial model based on training data to obtain a local model, and uploads the local model to a proxy server; the proxy server performs aggregation calculation on the local model set to obtain a global model, and sends the global model to the task publisher; if the task publisher detects that the global model does not reach convergence, performing performance test on the global model to obtain a target score corresponding to each data owner, screening the data owners based on the target scores corresponding to the data owners to obtain a data owner set, and storing the data owner set in a database; and sending the initial model to a data owner set, so that each data owner in the data owner set returns to execute the operation of training the initial model based on the training data by each data owner to obtain a local model, uploading the local model to the proxy server until the obtained global model converges, and sending the global model to the cloud service provider.

Description

Technical Field

[0001] The embodiments of the present invention relate to the fields of network information security and federated learning technology, and in particular to a model processing method, apparatus, device, medium and product. Background Technology

[0002] In the context of the rapid development of artificial intelligence and big data technologies, Federated Learning (FL), as a distributed machine learning framework, has become a core technology for achieving data privacy protection and collaborative model training in fields such as healthcare, finance, and the Internet of Things. Its core mechanism allows multiple data owners to jointly train a global model through encrypted communication and collaborative computing, while storing sensitive data locally, effectively resolving the contradiction between data silos and privacy breaches.

[0003] The security of federated learning systems heavily relies on the trustworthiness of participating nodes. When client nodes engage in malicious behavior, they may inject noisy labels or falsified data distributions through data poisoning attacks, leading to model convergence bias; use gradient inversion techniques to analyze model update parameters and deduce original data features in reverse, posing a privacy risk; or submit low-quality model updates, consuming system resources and reducing overall training efficiency. These attacks not only undermine the reliability of the global model but may also trigger systemic security risks due to malicious gradient pollution, potentially causing serious consequences, especially in sensitive fields such as healthcare and finance.

[0004] Traditional federated learning frameworks suffer from structural flaws in addressing node trust issues: their static trust mechanisms assume all participants operate honestly, lacking dynamic monitoring and anomaly detection capabilities for node behavior; privacy protection schemes (such as homomorphic encryption and differential privacy) are disconnected from the credit evaluation system, making it difficult to identify malicious behavior synchronously during encrypted computation; existing aggregation mechanisms employ simple averaging or weighted voting strategies, failing to effectively filter anomalous gradient updates, leading to the continuous accumulation of model pollution. At its root, existing solutions lack a synergistic mechanism between privacy protection and security game theory, allowing malicious nodes to gain excessive profits through low-cost attacks, ultimately threatening the robustness of distributed machine learning systems. Summary of the Invention

[0005] This invention provides a model processing method, apparatus, device, medium, and product to accurately identify and eliminate interference from malicious nodes in the global model aggregation process, improve the robustness and reliability of the system, and ensure high-quality output of model training.

[0006] According to one aspect of the present invention, a model processing method is provided, comprising:

[0007] Each data owner trains an initial model based on the training data to obtain a local model, and uploads the local model to the proxy server; the initial model is distributed to each data owner by the task publisher.

[0008] The proxy server performs aggregation calculations on the local model set to obtain a global model, and then sends the global model to the task publisher;

[0009] If the task publisher detects that the global model has not converged, it performs a performance test on the global model to obtain a target score for each data owner. Based on the target score, the data owners are then filtered to obtain a set of data owners. Each data owner in the set then returns to the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server. This process continues until the global model converges, at which point the global model is sent to the cloud service provider.

[0010] According to another aspect of the present invention, a model processing apparatus is provided, the apparatus comprising:

[0011] The training module is used to control each data owner to train an initial model based on training data to obtain a local model, and then upload the local model to the proxy server; the initial model is distributed to each data owner by the task publisher.

[0012] The aggregation module is used to control the proxy server to perform aggregation calculations on the local model set to obtain a global model, and send the global model to the task publisher;

[0013] The filtering module is used to control the task publisher to perform performance testing on the global model if it detects that the global model has not converged, obtain the target score corresponding to each data owner, and filter the data owners based on the target score corresponding to each data owner to obtain a set of data owners. Then, each data owner in the set of data owners returns to the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server, until the obtained global model converges, and then sends the global model to the cloud service provider.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] At least one processor; and

[0016] A memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the model processing method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the model processing method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the model processing method described in any embodiment of the present invention.

[0020] This invention, in its embodiments, involves each data owner training an initial model based on training data to obtain a local model, which is then uploaded to a proxy server. The proxy server then aggregates the local models to obtain a global model, which is sent to the task publisher. If the task publisher detects that the global model has not converged, it performs a performance test on the global model, obtaining a target score for each data owner. Based on these target scores, data owners are filtered to obtain a set of data owners. Each data owner in this set then returns to the process of training their initial model based on training data to obtain a local model and uploading it to the proxy server, until the global model converges. Finally, the global model is sent to the cloud service provider. This invention's technical solution accurately identifies and eliminates interference from malicious nodes in the global model aggregation process, improving the system's robustness and reliability, and ensuring high-quality output from model training.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1This is a flowchart of a model processing method in an embodiment of the present invention;

[0024] Figure 2 This is a diagram of an overall architecture for federated learning in an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of a model processing device according to an embodiment of the present invention;

[0026] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the model processing method of this invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and their derivatives, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0030] Example 1

[0031] Figure 1 This is a flowchart of a model processing method according to an embodiment of the present invention. This embodiment is applicable to model processing based on federated learning. The method can be executed by the model processing device in this embodiment of the present invention, which can be implemented in software and / or hardware, such as... Figure 1 As shown, the method specifically includes the following steps:

[0032] S101. Each data owner trains the initial model based on the training data to obtain a local model, and uploads the local model to the proxy server.

[0033] The initial model involves the task publisher distributing tasks to each data owner.

[0034] In this embodiment, the Data Owner (DO) can act as the data provider in the federated learning system. For example, in practical applications of intelligent vehicle networking and autonomous driving, the Data Owner (DO) can be devices on the vehicle, such as onboard sensors, cameras, radar, and LiDAR. These devices, as data owners, deeply participate in the federated learning process. In this embodiment, there can be multiple Data Owners (DOs), which can be represented by the plural form DOs. DOs are also referred to as client nodes in this embodiment, and in the security model, they are assumed to be untrustworthy, meaning they might potentially poison the training model and interfere with the overall model security. Therefore, they need to be screened through a credit score evaluation, and only those with a satisfactory overall credit score can participate in subsequent training.

[0035] For example, in practical application scenarios of intelligent vehicle networking and autonomous driving, training data can be a large amount of sensitive data continuously accumulated locally by the data owners of vehicle sensors, cameras, radars and lidar, such as vehicle operating status, real-time road condition information, obstacle detection results, etc.

[0036] It should be noted that the initial model can be an untrained federated learning model after initialization, while the local model can be a model obtained by training the initial model using training data on the data owner's side.

[0037] In practice, the task publisher is responsible for initializing the global model and distributing it to the proxy server and data owner.

[0038] In this embodiment, the proxy server (PS) plays a core role in model aggregation within the federated learning system, aggregating the local models uploaded by the data owner (DOs). In this embodiment, multiple proxy servers (PS) can exist, which can be represented by the plural form PSs.

[0039] In this embodiment, the Task Publisher (TP) is the initiator and core coordinator of the federated learning process, responsible for initializing the global model and distributing it to the proxy server PSs and the data owner DOs.

[0040] Specifically, the proxy server distributes the initial model to each data owner. Each data owner obtains training data and trains the initial model based on the training data to obtain a local model. Afterward, each data owner uploads the trained local model to the proxy server.

[0041] S102. The proxy server performs aggregation calculations on the local model set to obtain the global model, and sends the global model to the task publisher.

[0042] Model aggregation is a technique used in machine learning and distributed learning to integrate multiple models or copies of a model, aiming to improve the overall performance, accuracy, and generalization ability of the model. Federated learning is a distributed machine learning method in which multiple clients (such as mobile devices or distributed servers) train models on local data and then send model updates to a central server for aggregation. The aggregated model is then redistributed to all clients for the next round of training.

[0043] The global model can be obtained by aggregating the local models trained by each data owner.

[0044] Specifically, the proxy server performs aggregation calculations on the local model sets uploaded by each data owner to obtain the global model, and then sends the global model to the task publisher.

[0045] S103. If the task publisher detects that the global model has not converged, it performs a performance test on the global model, obtains the target score corresponding to each data owner, and filters the data owners based on the target score corresponding to each data owner to obtain a set of data owners. Then, each data owner in the set of data owners returns to the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server until the global model converges. Finally, the global model is sent to the cloud service provider.

[0046] It should be noted that the target score can be a score based on indicators such as the activity level of each data owner during the training process, the stability of resource operation, and security.

[0047] The data owner set can be a set of data owners that are filtered based on the target score corresponding to each data owner, and those whose target scores are lower than a preset threshold are deleted (this threshold can be set by the user, and this embodiment does not limit it).

[0048] In this embodiment, the Cloud Server Provider (CSP) provides computing and storage services to the federated learning system to securely store the final global model. The CSP is considered semi-trusted and can attempt to decrypt the encrypted data; therefore, this embodiment incorporates privacy protection measures such as homomorphic encryption (described in detail below).

[0049] Specifically, after receiving the global model from the proxy server, the task publisher checks whether the global model has converged (convergence conditions can be preset by the user). If the global model has not converged, a performance test is performed on the global model to obtain the target score for each data owner. Based on the target score for each data owner, the data owners are filtered, and data owners with target scores lower than a preset threshold are deleted, resulting in a set of data owners. Each data owner in the set then returns to perform the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server. This process is repeated until the global model converges, at which point the global model is sent to the cloud service provider for storage.

[0050] This invention, in its embodiments, involves each data owner training an initial model based on training data to obtain a local model, which is then uploaded to a proxy server. The proxy server then aggregates the local models to obtain a global model, which is sent to the task publisher. If the task publisher detects that the global model has not converged, it performs a performance test on the global model, obtaining a target score for each data owner. Based on these target scores, data owners are filtered to obtain a set of data owners. Each data owner in this set then returns to the process of training their initial model based on training data to obtain a local model and uploading it to the proxy server, until the global model converges. Finally, the global model is sent to the cloud service provider. This invention's technical solution accurately identifies and eliminates interference from malicious nodes in the global model aggregation process, improving the system's robustness and reliability, and ensuring high-quality output from model training.

[0051] Optionally, after sending the global model to the cloud service provider, the following may also be included:

[0052] Model users send search requests to cloud service providers.

[0053] In this embodiment, the Model User (MU), as the end user of federated learning, can trigger encrypted searches using keywords based on the models stored by the Cloud Service Provider (CSP). The CSP utilizes an index to build an encrypted model library and, combined with a search mechanism, quickly provides candidate models that meet the criteria. In this embodiment, there can be multiple Model Users (MUs), which can be represented by the complex form MUs. After retrieving the model through a decryption interface, the Model Users (MUs) verify the model's applicability in their local application scenario.

[0054] It should be noted that a search request can be a request sent by a model user to a cloud service provider to query encrypted models stored in the cloud service provider that correspond to certain keywords.

[0055] The search request includes query keywords.

[0056] For example, in this embodiment, the query keywords could be "rainy day road condition model" or "city road navigation model", etc.

[0057] Specifically, model users can send search requests containing query keywords to cloud service providers.

[0058] The cloud service provider receives a search request and searches for the target encrypted model corresponding to the query keywords. The target encrypted model is then sent to the model user so that the model user can decrypt the target encrypted model to obtain the target plaintext model.

[0059] The target encrypted model can be the encrypted model stored in the cloud service provider corresponding to the query keywords, and the target plaintext model can be the plaintext model obtained by the model user after decrypting the target encrypted model.

[0060] In its implementation, this embodiment employs a searchable encryption mechanism when using training models stored in the Cloud Service Provider (CSP). For example, model users (MUs) can query by inputting keywords related to autonomous driving (such as "rainy road condition model" or "urban road navigation model"). The CSP performs encrypted search calculations, filters out qualified training models, and returns them to the model users (MUs). The model users (MUs) then decrypt the encrypted training models to obtain the plaintext models, thereby providing decision support such as real-time driving suggestions, route planning optimization, or safety warnings.

[0061] Optionally, a performance test is performed on the global model to obtain the target score for each data owner, including:

[0062] Obtain the number of historical positive reviews and the number of historical negative reviews for each data owner, and determine the model quality score for each data owner based on the number of historical positive reviews and the number of historical negative reviews.

[0063] In practice, during the t-th round of training, the task publisher TP performs performance testing on the local model trained by each data owner DOU (here, Dou represents a data owner). If the model's accuracy, loss function value, and other metrics on the validation set reach a preset threshold (this threshold can be set by the user according to actual needs; this embodiment does not limit this), a positive evaluation is given; otherwise, a negative evaluation is given.

[0064] Let the credit score (i.e. model quality score) obtained by data owner DOU in round t be:

[0065]

[0066] Where P represents the number of historical positive reviews, N represents the number of historical negative reviews, and ∈ is used as a constant to balance the weight of positive reviews in the formula.

[0067] Introducing a time decay factor (λ∈(0,1)), the accumulated credit value (i.e., model quality score) up to round t is:

[0068]

[0069] The task publisher TP then associates the credit value with the corresponding data owner DOU.

[0070] Obtain the similarity metric for each pair of data owners, obtain the proportion of contributing samples for each data owner, and determine the data contribution score for each data owner based on the similarity metric and the proportion of contributing samples.

[0071] Task publisher TP evaluates the data quality and diversity of data owner DOU:

[0072] It should be noted that data quality refers to the similarity measure by comparing the data distributions of other data owners, denoted as Quality1. One algorithm for calculating the difference between the distributions P and Q of two datasets is the Kullback-Leibler divergence, one calculation method of which is as follows:

[0073]

[0074] Here, P(x) and Q(x) are the probabilities of distributions P and Q in the dataset for event x, respectively. The summation is performed over all possible events x.

[0075] It should be noted that the data volume refers to the proportion of the number of contributing samples to the total number, denoted as Quality2.

[0076]

[0077] Where, n i This represents the number of samples contributed by data owner DOU, and N represents the total number of samples contributed by all data owners.

[0078] The scoring formula for data contribution is as follows:

[0079]

[0080] Where α∈(0,1) is the weight coefficient, which can be adjusted according to task requirements.

[0081] Obtain the historical number of anomalies for each data owner at each impact level, and determine the data security score based on the historical number of anomalies.

[0082] The task publisher TP detects whether the data owner DOU has engaged in malicious behavior (such as gradient tampering, data poisoning, etc.). Based on the impact level of the local model of the data owner DOU on the global model, multi-level indicators are divided, and the number of historical abnormal behaviors M1, M2, and M3 (temporarily assumed to be three levels) are counted according to the indicator level.

[0083] The scoring formula for data security is as follows:

[0084]

[0085] θ1, θ2, and θ3 are weight values ​​for different levels of security behavior, which can be set and adjusted by the user.

[0086] Obtain the task participation enthusiasm score and resource operation stability score corresponding to each data owner sent by the proxy server.

[0087] Optionally, the task participation motivation score is determined by the agent server based on the proportion of training rounds the data owner has participated in historically and the response latency.

[0088] The proxy server PS statistics show the percentage of training rounds participated in by the owner DOU and the response latency:

[0089]

[0090] The parameters β and γ are set according to the system's real-time requirements.

[0091] The resource operation stability score is determined by the proxy server based on the online time percentage of data owners and the number of computation interruptions.

[0092] The proxy server PS assesses the reliability of the data owner's computing resources based on the percentage of online time (i.e., online rate) and the number of computational interruptions F.

[0093] The scoring formula for resource operation stability is as follows:

[0094]

[0095] Where δ is the overall weight, which can be adjusted as needed.

[0096] The target score for each data owner is determined based on model quality score, data contribution score, data security score, task participation enthusiasm score, and resource operation stability score.

[0097] In the final stage of a training round, the task issuer TP combines the scores from various dimensions to calculate the total credit score (i.e., the target score) for each data owner DOU:

[0098]

[0099] Among them, w i The scoring weights for each dimension satisfy ∑w i =1, and each weight can be dynamically adjusted according to the task type (e.g., medical tasks focus on data quality, while IoT (Internet of Things) tasks focus on response speed).

[0100] To address the shortcomings of traditional node selection methods in terms of scientific rigor and flexibility, this invention employs a multi-dimensional dynamic evaluation mechanism to achieve intelligent and flexible node selection. Specifically, the algorithm quantifies the credit value of client nodes through multi-dimensional indicators, including several core evaluation dimensions: local model quality score, based on the contribution of the client node's model data to the global model, calculates the cumulative credit value by combining a time decay coefficient and a dynamic weighting factor; data contribution score, determined by horizontal comparison with other peer nodes, establishes the weight allocation for different data owners; and task participation enthusiasm score, established by correlation analysis of the contribution frequency of data owners' DOs to the entire system, builds a weighted network evaluation model. Furthermore, the system integrates auxiliary indicators such as data security score and resource operation stability score, constructing a comprehensive evaluation matrix using a hierarchical feature fusion method, and finally outputs a multi-dimensional fused credit score, providing a quantitative decision-making basis for node selection. In intelligent driving scenario testing, compared to traditional fixed node selection methods, this invention significantly reduces the number of iterations required for model convergence and shortens training time, greatly improving training efficiency and model performance.

[0101] Optionally, each data owner trains a local model based on the initial model using the training data, and uploads the local model to the proxy server, including:

[0102] Each data owner trains an initial model based on the training data to obtain a local model, encrypts the local model to obtain the first model ciphertext, and uploads the first model ciphertext to the proxy server.

[0103] The first model ciphertext can be obtained by the data owner through homomorphic encryption of the local model after training it based on the training data.

[0104] Specifically, after the data owner (DOs) participates in federated learning, it encrypts the generated local models. These homomorphically encrypted local models are then uploaded to the proxy server (PS).

[0105] Optionally, the proxy server performs aggregation calculations on the local model set to obtain the global model, and sends the global model to the task publisher, including:

[0106] The proxy server uses a homomorphic encryption algorithm to perform aggregation calculations on the first model ciphertext to obtain the second model ciphertext, and then sends the second model ciphertext to the task publisher.

[0107] As we know, homomorphic encryption is an encryption method that allows direct computation on ciphertext, and the result, after decryption, is identical to the result of performing the same computation directly on the original plaintext. In other words, homomorphic encryption supports computation on ciphertext, and the result is equivalent to performing the same operation on the original data.

[0108] The second model ciphertext can be an encrypted global model obtained by the proxy server PS after aggregating and calculating the first model ciphertext uploaded by the data owner DOS.

[0109] Specifically, the proxy server PS uses a homomorphic encryption algorithm to aggregate and calculate all the collected first-model ciphertexts to obtain the second-model ciphertext. The aggregated result is then sent back to the data owner DOs, allowing DOs to continue model training. This process iterates until the model converges.

[0110] In this embodiment, all keys used in the encryption and decryption processes are generated by the Key Generation Center (KGC). The Key Generation Center (KGC) is the trusted root node in the federated learning system, responsible for generating and managing system keys, thus laying the foundation for secure transmission and encrypted communication of model parameters.

[0111] As an exemplary description of an embodiment of the present invention Figure 2This is a diagram of an overall architecture for federated learning in an embodiment of the present invention. Figure 2 As shown, the federated learning scheme of this invention involves multiple key entities, each of which assumes important responsibilities, including: Key Generation Center (KGC), Task Publisher (TP), Cloud Service Provider (CSP), Proxy Server (PSs), Data Owner (DOs) (i.e., client nodes), and Model User (MUs).

[0112] The Key Generation Center (KGC) is the trusted root node in the federated learning system, responsible for generating and managing the system's public parameters (pp) and master key (mk). It distributes keys among the entities, including uniquely identified public keys (pk) and private keys (sk), as well as attribute keys (ASK), laying the foundation for secure transmission and encrypted communication of model parameters.

[0113] The Task Publisher (TP) is the initiator and core coordinator of the federated learning process, responsible for initializing the global model and distributing it to the proxy server (PSs) and data owners (DOs). At the start of each training round, the Task Publisher (TP) encrypts a homomorphic encryption key based on the attribute key and the attribute state of each client node. During aggregation, the Task Publisher (TP) acquires the encrypted model uploaded by the proxy server (PSs) in real time and adds this part of the model to the global model, while testing the validity of the global model and scoring the relevant data owners (DOs). After a training round is completed, the Task Publisher (TP) also manages attributes based on the credit score of each data owner (DO), revoking the attributes of client nodes with credit scores below the expected threshold.

[0114] Data owners (DOs), acting as data providers in the federated learning system, train the model locally using local data. After completing local training, they encrypt the local model using homomorphic encryption and then upload it to the proxy server (PSs). In this embodiment, DOs are also referred to as client nodes and are assumed to be untrusted in the security model—meaning they could potentially poison the training model and interfere with the overall model security. Therefore, they are screened through a credit rating system. Only after their overall credit score is approved can they register their attributes in the key generation center (KGC) and participate in subsequent training.

[0115] The Cloud Service Provider (CSP) provides computation and storage services for the Federated Learning System to securely store the final global model. Specifically, the Task Publisher (TP) can send model storage to the CSP and download models from it. The CSP is considered semi-trusted and can attempt to decrypt encrypted data; therefore, privacy protection measures such as homomorphic encryption are incorporated into this model.

[0116] In a federated learning system, the proxy server PSs plays a central role in model aggregation. After the task publisher TP issues the aggregation strategy to the proxy server PSs, PSs selects several data owners (DOs) with high credit scores through a dynamic node selection policy to form a data owner set. These trusted client nodes within the data owner set are then assigned to the training tasks (issued by TP to PSs) and model distribution (PSs distributes the trained models to DOs). Once the local model training results from the DOs are uploaded to PSs, PSs uses homomorphic encryption to aggregate the encrypted model data, generates a unique hash value for the aggregated result, and uploads the final model to TP. Simultaneously, during training, PSs also performs the task of evaluating the DOs based on metrics such as activity level, resource stability, and security.

[0117] As the end-user of federated learning, the model user (MUs) can trigger searchable encrypted retrieval via keywords, based on the models stored by the cloud service provider (CSP). The CSP utilizes an index to build an encrypted model library and, combined with a retrieval mechanism, quickly provides candidate models that meet the criteria. After retrieving the models through a decryption interface, the model user (MUs) verifies their applicability in local application scenarios.

[0118] The following section uses the field of autonomous driving as an example to explain in detail the specific applications of this solution:

[0119] In practical applications of intelligent connected vehicles and autonomous driving, onboard devices such as sensors, cameras, radar, and LiDAR continuously accumulate a large amount of sensitive data locally, including vehicle operating status, real-time road conditions, and obstacle detection results. These devices, acting as data owners (DOs), are deeply involved in the federated learning process. Autonomous driving technology development companies, acting as task publishers (TPs), train autonomous driving models based on the local data provided by the DOs. The ultimate goal is to help users of intelligent connected vehicles (i.e., model users (MUs)) obtain accurate and safe autonomous driving services.

[0120] The specific process is as follows: After the data owner (DOs) participates in federated learning, it encrypts the generated local models. These homomorphically encrypted local models are then uploaded to the proxy server (PSs). The proxy server (PSs), based on a homomorphic encryption algorithm, aggregates and calculates all the collected encrypted models and sends the aggregated result back to the data owner (DOs). This process iterates continuously until the model converges.

[0121] After model convergence, the final encrypted model data is transmitted to the task publisher TP via the proxy server PSs. TP first decrypts the encrypted model data and then performs performance testing on the decrypted model. During the test, the proxy server PSs scores and assigns credit values ​​to the data owners DOs based on their performance. Then, based on a preset credit threshold, it determines which data owners DOs will contribute to the model.

[0122] Furthermore, a searchable encryption mechanism is employed when using training models stored in the cloud service provider (CSP). For example, model users (MUs) can query by entering keywords related to autonomous driving (such as "rainy road condition model" or "city road navigation model"). The CSP performs encrypted search calculations, filters out training models that meet the criteria, and returns them to the model users (MUs), thereby providing them with decision support such as real-time driving suggestions, route planning optimization, or safety warnings.

[0123] In this way, this solution successfully combines distributed learning and encryption technologies without compromising local data privacy, leveraging the cloud to provide efficient and secure model training and decision support services for intelligent vehicle networks and autonomous driving. Furthermore, this federated learning framework effectively addresses the challenges of widespread data distribution, high privacy requirements, and complex dynamic changes in the vehicle network environment, providing a solid technical guarantee for the popularization and development of autonomous driving technology.

[0124] Furthermore, the credit-based federated learning aggregation node dynamic selection method specifically includes the following operations:

[0125] (1) System initialization:

[0126] During the initialization phase, the system's global security parameter μ is input, and the key generation center KGC generates the master key mk and public parameters pp, as shown below:

[0127] mk={g a ,α},pp={G1,g,H,g a ,g μ ,e(g,g) α ,h1,h2,…,h m};

[0128] Where G1 is the multiplicative cyclic group, and g is the generator. For random values, the hash function H maps the input value to... In this system, the master key mk and public parameters pp are generated by the key generation center KGC and distributed to the system.

[0129] (2) Key generation:

[0130] The Key Generation Center (KGC) generates a key pair for each data owner (DOu). The Key Generation Center (KGC) randomly selects... Generate the private key of the data owner DOU and public key Simultaneously, a homomorphic encryption master key ck is generated separately. Subsequently, the relevant private key is distributed to the corresponding nodes through a trusted channel, while the public key is sent directly. The homomorphic encryption master key ck is then directly distributed to the task publisher TP, enabling TP to decrypt the corresponding training plaintext model.

[0131] (3) Attribute registration:

[0132] When a client node (i.e., the data owner DOU) joins the federated learning system, the Key Generation Center (KGC) will generate a corresponding attribute set for it and distribute the relevant keys. Specifically, the Key Generation Center (KGC) generates a set of attributes for the system attribute h. i choose Generate attribute key SK:

[0133]

[0134] Then, the Key Generation Center (KGC) distributes the attribute key (SK) to each data owner (DOu).

[0135] (4) Task initialization:

[0136] [Model Initialization]: Before distributing training tasks, the task publisher TP needs to generate an initial model M0 based on the scenario. This model includes information such as the neural network structure, and sets the relevant parameters to initial values. Then, it generates the ciphertext information CM0 of the initial model based on the homomorphic encryption master key ck. At the same time, it sets an initial credit value for each client node.

[0137] CM0 = Enc ck (M0);

[0138] [Attribute Encryption]: Based on access policy The task publisher TP generates an access structure for each data owner DOU. Where ρ represents the strategy matrix The j-th row is converted to the corresponding attribute attr j Mapping. Task publisher TP selection. As a shared key, a vector is generated. Considering the scenario of attribute revocation, a corresponding transformation root key tmk also needs to be generated for each attribute, where :

[0139] tmk=(r1,r2,…,rl );

[0140] Then the following encrypted CT was calculated. i :

[0141]

[0142] (5) Local model training:

[0143] In this architecture, the proxy server PSs has multiple data owners DOU downstream. These nodes use local sensitive data to train a federated learning model and generate a local model M. u (i.e., local model).

[0144] [Model Decryption]: Data owner DOU receives the initial encrypted model CM0 and encrypted CT sent by task publisher TP. i Then, an index set I = {i: ρ(i) ∈ S} is generated using its own attribute set S, where If the set satisfies CT i Access permissions within the data allow you to find a set of numbers. Make ∑ ∈I ω i ·λ i =s,{λ i} is a set of sub-secrets of secret s. It can then be computed as follows:

[0145]

[0146] Furthermore, ck can be calculated as follows:

[0147] ck = C / e(g,g) αs ;

[0148] After the data owner DOU obtains ck, he decrypts the ciphertext model to obtain the plaintext model M0:

[0149] M0 = Dec ck (CM0);

[0150] [Training Upload]: Data owner DOU performs local training based on local data and decrypted model data. After training is completed, the model data is homomorphically encrypted again, and the ciphertext is uploaded to the proxy server PSs.

[0151] (6) Model aggregation:

[0152] After the downstream data owner DOU uploads the encrypted data, the proxy server PSs uses homomorphic encryption to operate on each sub-model, aggregates the model data generated by each client node, and uploads the data to the task publisher TP. The specific steps are as follows:

[0153] [Model Aggregation]: Assuming there are n data owners DOU downstream of the proxy server PSs, the proxy server PSs receives the model CM from all data owners DOU. u It utilizes the properties of homomorphic encryption to perform aggregation operations on the ciphertext, and the aggregation result is represented by the following formula:

[0154]

[0155] After completing the model aggregation and signing operations, the proxy server PSs will also calculate the credit score of each data owner DOU at this stage.

[0156] (7) Global model generation:

[0157] After receiving the model aggregation transaction from the proxy server PSs, the task publisher TP uses the decryption key ck to decrypt the aggregated encrypted model CM and obtain the plaintext model M for this round of aggregation. The specific steps are as follows:

[0158] [Global Model Decryption]: The task publisher TP decides to use the private key ck of the homomorphic encryption algorithm to decrypt the global model CM, thereby obtaining the local model plaintext M, the specific form of which is given by the following formula:

[0159] M = Dec ck (CM);

[0160] After the model is decrypted, the private key for the homomorphic encryption algorithm needs to be replaced.

[0161] (8) Credit assessment and attribute management:

[0162] After the model aggregation is completed, the system calls the data owner DOs credit assessment algorithm (i.e. the calculation method of the target score mentioned above) to score all participating client nodes. At the same time, the task publisher TP will receive a partial credit score from the proxy server PSs. The total score of the data owner DOs is obtained by combining the credit scores of the two parties.

[0163] [Dynamically Maintain Trusted Node Set]: Users preset the expected trust threshold based on the actual situation, and select a number of client nodes (DOs) with a total score higher than the expected threshold to undertake the next round of model aggregation tasks.

[0164] [Attribute Revocation] When a client's credit score falls below a set threshold, the task publisher TP will revoke certain attributes χ for that node. For example, here, the original attribute x will be revoked. i Replace ∈χ with x′ i The Key Generation Center (KGC) will assign attribute values. Replace with The attribute key SK has been updated as follows:

[0165]

[0166] Then the key generation center KGC converts the root key tmk = (r1, r2, ..., r...) l Perform the following calculations to generate the conversion key:

[0167]

[0168] The task publisher TP updates the ciphertext based on the conversion key:

[0169]

[0170] The complete ciphertext C is as follows:

[0171]

[0172] (9) Iterative training:

[0173] Repeat the above steps to continue training and optimizing the model until the global model converges (i.e., the performance metrics no longer improve significantly), thus completing the entire training process.

[0174] (10) Model usage:

[0175] After the model is trained, the model user MUs can send a search request to the cloud service provider CSP using several keywords. The cloud service provider CSP will only return relevant cryptographic models similar to its own domain for the request. The trusted model user MUs registered in the system will directly hold the model private key distributed by the key generation center KGC, so that they can decrypt the model locally and perform model inference.

[0176] This invention proposes a complete federated learning mechanism for dynamically updating a client set: During the initialization phase, a key generation center deploys relevant parameters and keys; data owners register attribute keys and perform local model training, then encrypt the model parameters using homomorphic encryption; proxy servers perform secure aggregation operations; and task publishers generate a global model based on the aggregation results and complete an overall weighted credit evaluation of each client node, while simultaneously associating node credit with attributes to dynamically update and maintain the client node set. This invention introduces a credit-based dynamic selection mechanism, which tracks changes in client node credit scores in real time, selects the aggregation node with the optimal comprehensive score to execute subsequent rounds of tasks, and manages the attributes of participating nodes. This scheme can dynamically maintain a trusted client node set for specific real-world scenarios and ensure data security through various privacy-preserving computation algorithms.

[0177] Example 2

[0178] Figure 3 This is a schematic diagram of a model processing device according to an embodiment of the present invention. This embodiment is applicable to model processing based on federated learning. The device can be implemented in software and / or hardware, and can be integrated into any device that provides model processing functionality, such as... Figure 3 As shown, the model processing device specifically includes: a training module 201, an aggregation module 202, and a filtering module 203.

[0179] The training module 201 is used to control each data owner to train the initial model based on the training data to obtain a local model, and upload the local model to the proxy server; the initial model is distributed to each data owner by the task publisher.

[0180] Aggregation module 202 is used to control the proxy server to perform aggregation calculations on the local model set to obtain a global model, and send the global model to the task publisher;

[0181] The filtering module 203 is used to control the task publisher to perform performance testing on the global model if it detects that the global model has not converged, obtain the target score corresponding to each data owner, and filter the data owners based on the target score corresponding to each data owner to obtain a set of data owners. This allows each data owner in the set to return to the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server, until the obtained global model converges and the global model is sent to the cloud service provider.

[0182] Optionally, the device further includes:

[0183] The sending module is used to control the model user to send a search request to the cloud service provider, the search request including query keywords;

[0184] The search module is used to control the cloud service provider to receive the search request, search for the target encrypted model corresponding to the search keywords, and send the target encrypted model to the model user so that the model user can decrypt the target encrypted model to obtain the target plaintext model.

[0185] Optionally, the filtering module 203 is specifically used for:

[0186] Obtain the number of historical positive reviews and the number of historical negative reviews for each data owner, and determine the model quality score for each data owner based on the number of historical positive reviews and the number of historical negative reviews;

[0187] Obtain the similarity metric for each pair of data owners, obtain the proportion of contribution samples for each data owner, and determine the data contribution score for each data owner based on the similarity metric and the proportion of contribution samples.

[0188] Obtain the historical number of anomalies for each data owner at each impact level, and determine the data security score based on the historical number of anomalies;

[0189] Obtain the task participation enthusiasm score and resource operation stability score corresponding to each data owner sent by the proxy server;

[0190] The target score for each data owner is determined based on the model quality score, the data contribution score, the data security score, the task participation enthusiasm score, and the resource operation stability score.

[0191] Optionally, the task participation enthusiasm score is determined by the proxy server based on the proportion of training rounds the data owner has participated in and the response latency.

[0192] The resource operation stability score is determined by the proxy server based on the online time percentage of the data owner and the number of calculation interruptions.

[0193] Optionally, the training module 201 is specifically used to control:

[0194] Each data owner trains an initial model based on training data to obtain a local model, encrypts the local model to obtain a first model ciphertext, and uploads the first model ciphertext to the proxy server.

[0195] Optionally, the aggregation module 202 is specifically used to control:

[0196] The proxy server performs aggregation calculations on the first model ciphertext based on the homomorphic encryption algorithm to obtain the second model ciphertext, and then sends the second model ciphertext to the task publisher.

[0197] The above-mentioned products can execute the model processing method provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects of the execution method.

[0198] Example 3

[0199] Figure 4A schematic diagram of an electronic device 30 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0200] like Figure 4 As shown, the electronic device 30 includes at least one processor 31 and a memory, such as a read-only memory (ROM) 32 or a random access memory (RAM) 33, communicatively connected to the at least one processor 31. The memory stores computer programs executable by the at least one processor. The processor 31 can perform various appropriate actions and processes based on the computer program stored in the ROM 32 or loaded from storage unit 38 into the RAM 33. The RAM 33 can also store various programs and data required for the operation of the electronic device 30. The processor 31, ROM 32, and RAM 33 are interconnected via a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0201] Multiple components in electronic device 30 are connected to I / O interface 35, including: input unit 36, such as keyboard, mouse, etc.; output unit 37, such as various types of monitors, speakers, etc.; storage unit 38, such as disk, optical disk, etc.; and communication unit 39, such as network card, modem, wireless transceiver, etc. Communication unit 39 allows electronic device 30 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0202] Processor 31 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 31 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 31 performs the various methods and processes described above, such as model processing methods:

[0203] Each data owner trains an initial model based on the training data to obtain a local model, and uploads the local model to the proxy server; the initial model is distributed to each data owner by the task publisher.

[0204] The proxy server performs aggregation calculations on the local model set to obtain a global model, and then sends the global model to the task publisher;

[0205] If the task publisher detects that the global model has not converged, it performs a performance test on the global model to obtain a target score for each data owner. Based on the target score, the data owners are then filtered to obtain a set of data owners. Each data owner in the set then returns to the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server. This process continues until the global model converges, at which point the global model is sent to the cloud service provider.

[0206] In some embodiments, the model processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program may be loaded and / or mounted on electronic device 30 via ROM 32 and / or communication unit 39. When the computer program is loaded into RAM 33 and executed by processor 31, one or more steps of the model processing method described above may be performed. Alternatively, in other embodiments, processor 31 may be configured to execute the model processing method by any other suitable means (e.g., by means of firmware).

[0207] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0208] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0209] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0210] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0211] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0212] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0213] In one embodiment, the present invention further includes a computer program product, which includes a computer program that, when executed by a processor, implements the model processing method of any embodiment of the present invention.

[0214] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0215] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0216] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A model processing method, characterized in that, include: Each data owner trains an initial model based on the training data to obtain a local model, and then uploads the local model to the proxy server; The initial model is distributed by the task publisher to each of the data owners; The proxy server performs aggregation calculations on the local model set to obtain a global model, and then sends the global model to the task publisher; If the task publisher detects that the global model has not converged, it performs a performance test on the global model to obtain a target score for each data owner. Based on the target score, the data owners are then filtered to obtain a set of data owners. Each data owner in the set then returns to the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server. This process continues until the global model converges, at which point the global model is sent to the cloud service provider.

2. The method according to claim 1, characterized in that, After sending the global model to the cloud service provider, the process also includes: The model user sends a search request to the cloud service provider, the search request including query keywords; The cloud service provider receives the search request, searches for the target encrypted model corresponding to the query keywords, and sends the target encrypted model to the model user so that the model user can decrypt the target encrypted model to obtain the target plaintext model.

3. The method according to claim 1, characterized in that, The global model is subjected to performance testing to obtain the target score corresponding to each data owner, including: Obtain the number of historical positive reviews and the number of historical negative reviews for each data owner, and determine the model quality score for each data owner based on the number of historical positive reviews and the number of historical negative reviews; Obtain the similarity metric for each pair of data owners, obtain the proportion of contribution samples for each data owner, and determine the data contribution score for each data owner based on the similarity metric and the proportion of contribution samples. Obtain the historical number of anomalies for each data owner at each impact level, and determine the data security score based on the historical number of anomalies; Obtain the task participation enthusiasm score and resource operation stability score corresponding to each data owner sent by the proxy server; The target score for each data owner is determined based on the model quality score, the data contribution score, the data security score, the task participation enthusiasm score, and the resource operation stability score.

4. The method according to claim 3, characterized in that, The task participation enthusiasm score is determined by the agent server based on the proportion of training rounds participated in by the data owner and the response latency. The resource operation stability score is determined by the proxy server based on the online time percentage of the data owner and the number of calculation interruptions.

5. The method according to claim 1, characterized in that, Each data owner trains an initial model based on training data to obtain a local model, and uploads the local model to the proxy server, including: Each data owner trains an initial model based on training data to obtain a local model, encrypts the local model to obtain a first model ciphertext, and uploads the first model ciphertext to the proxy server.

6. The method according to claim 5, characterized in that, The proxy server performs aggregation calculations on the local model set to obtain a global model, and sends the global model to the task publisher, including: The proxy server performs aggregation calculations on the first model ciphertext based on the homomorphic encryption algorithm to obtain the second model ciphertext, and then sends the second model ciphertext to the task publisher.

7. A model processing device, characterized in that, include: The training module is used to control each data owner to train the initial model based on the training data to obtain a local model, and then upload the local model to the proxy server; The initial model is distributed by the task publisher to each of the data owners; The aggregation module is used to control the proxy server to perform aggregation calculations on the local model set to obtain a global model, and send the global model to the task publisher; The filtering module is used to control the task publisher to perform performance testing on the global model if it detects that the global model has not converged, obtain the target score corresponding to each data owner, and filter the data owners based on the target score corresponding to each data owner to obtain a set of data owners. Then, each data owner in the set of data owners returns to the operation of training the initial model based on the training data to obtain a local model and uploading the local model to the proxy server, until the obtained global model converges, and then sends the global model to the cloud service provider.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the model processing method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the model processing method according to any one of claims 1-6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the model processing method according to any one of claims 1-6.

Images