Training and calling methods of federated learning models and federated learning systems

Abstract

Embodiments of this specification provide a training method and a calling method for a federated learning model, as well as a federated learning system. The training method includes: obtaining a watermarked training dataset for each of a plurality of participants; and performing federated learning training based on the watermarked training dataset for each of the plurality of participants to generate a fragmented model for each participant as part of the federated learning model. The watermarked training dataset includes watermarked training data, data identifiers of the watermarked training data of the participants correspond to each other, and the watermarked training data of at least one of the plurality of participants includes a watermark label.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of machine learning technology, and in particular, relate to a training method and a calling method of a federated learning model and a federated learning system. Background Art

[0002] Research on federated learning has garnered increasing attention in recent years. Federated learning is a machine learning framework in which the data used to train models can be distributed across multiple participants. Federated learning enables joint modeling without sharing data between participants, enabling more efficient data utilization while meeting requirements such as user privacy, data security, and government regulations. Understandably, the data of each participant holds significant value, and enabling the effective mining, circulation, and evaluation of this value is crucial. Therefore, an effective solution is needed to better realize and protect the value of data and models. Summary of the Invention

[0003] The purpose of the present invention is to provide a training method and a calling method for a federated learning model and a federated learning system to better realize and protect the value of data and models.

[0004] According to a first aspect of one or more embodiments of this specification, a method for training a federated learning model is provided, wherein training data for training the federated learning model is distributed across multiple participants, and the training method includes:

[0005] obtaining a watermarked training data set for each of the plurality of participants, wherein the watermarked training data set includes watermarked training data, a data identifier of the watermarked training data of each participant corresponds to a data identifier of the watermarked training data of other participants, and the watermarked training data of at least one of the plurality of participants includes a watermark label; and

[0006] Federated learning training is performed based on the watermarked training dataset of each participant of the multiple participants to respectively generate a fragment model of each participant as part of the federated learning model.

[0007] According to a second aspect of one or more embodiments of this specification, a method for calling a federated learning model is provided, wherein the federated learning model is configured to perform watermark verification, wherein the watermark verification identifies whether data to be verified is watermark verification data having a watermark label, and the data to be verified is distributed across multiple participants. The method includes:

[0008] The sharing platform obtains the call request information from the caller;

[0009] The sharing platform performs watermark verification on the data to be verified using the federated learning model according to the call request information; and

[0010] When the sharing platform determines that the watermark verification is passed, the calling authority of the federated learning model is allocated to the caller so that the caller can call the federated learning model.

[0011] According to a third aspect of one or more embodiments of this specification, a federated learning system is provided, including a sharing platform, wherein the sharing platform includes:

[0012] a communication unit, wherein the communication unit is configured to obtain call request information from a caller;

[0013] a verification unit, the verification unit being configured to perform watermark verification on the data to be verified using the federated learning model according to the call request information, wherein the federated learning model is configured to be able to perform watermark verification, the watermark verification identifying whether the data to be verified is watermark verification data having a watermark tag, and the data to be verified is distributed among multiple participants;

[0014] an allocating unit, configured to allocate a calling right of the federated learning model to the caller when the watermark verification is passed; and

[0015] A model running unit is configured to run the federated learning model to enable the caller to call the federated learning model.

[0016] According to a fourth aspect of one or more embodiments of this specification, a non-transitory computer-readable storage medium is provided, on which computer instructions are stored, and when the computer instructions are executed by a processor, the steps of the training method or the calling method as described above are implemented.

[0017] According to a fifth aspect of one or more embodiments of this specification, a computer program product is provided, which includes computer instructions, and when the computer instructions are executed by a processor, the steps of the training method or the calling method described above are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1This is an architectural diagram of a federated learning system in an embodiment of this specification;

[0020] Figure 2 This is an architectural diagram of a federated learning system in another embodiment of this specification;

[0021] Figure 3 is a flowchart of a training method for a federated learning model in one embodiment of this specification;

[0022] Figure 4 is a flowchart of step S100 in the training method of the federated learning model in one embodiment of this specification;

[0023] Figure 5 This is a flowchart of the steps of performing longitudinal federated learning training based on a watermarked training dataset of each participant among multiple participants in a training method of a federated learning model in one embodiment of this specification to generate a fragmented model for each participant respectively;

[0024] Figure 6 is a flowchart of the steps of performing longitudinal federated learning training based on a watermarked training dataset of each participant among multiple participants in a training method of a federated learning model in another embodiment of this specification to generate a fragmented model for each participant respectively;

[0025] Figure 7 is a flowchart of a training method for a federated learning model in another embodiment of this specification;

[0026] Figure 8 is a flowchart of a method for training a federated learning model in another embodiment of this specification;

[0027] Figure 9 is a flowchart of a method for training a federated learning model in yet another embodiment of this specification;

[0028] Figure 10 This specification also includes a flowchart of a method for training a federated learning model in one embodiment;

[0029] Figure 11 This is a flowchart of a method for calling a federated learning model in one embodiment of this specification;

[0030] Figure 12 This is a flowchart of step S400 in the method for calling a federated learning model in one embodiment of this specification;

[0031] Figure 13 This is a flowchart of step S600 in the method for calling a federated learning model in another embodiment of this specification;

[0032] Figure 14This is a flowchart of step S600 in a method for calling a federated learning model in another embodiment of this specification;

[0033] Figure 15 This is a flowchart of the steps of completing features of the data to be analyzed in the method of calling the federated learning model in one embodiment of this specification. DETAILED DESCRIPTION

[0034] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0035] In order to solve the problems of data value mining, circulation and evaluation in federated learning, one or more embodiments of this specification propose a federated learning model training method, a federated learning model calling method, a federated learning system, a non-transitory computer-readable storage medium and a computer program product to better protect the value of data and models.

[0036] like Figure 1 and Figure 2 FIG2 is an architecture diagram of a federated learning system. The federated learning system may include a sharing platform 910 and one or more participating devices 920 that are provided locally to each of a plurality of participants in a one-to-one correspondence.

[0037] In some embodiments, the shared platform 910 may include a verifiable computing engine (MYTF), which can utilize technologies such as a trusted execution environment (TEE) and a WebAssembly (WASM) virtual machine to allow verifiable computing tasks (e.g., verifiable applications or trusted applications (TAPP)) to be executed in the TEE, while being able to prove to anyone that the computing task is executed in the TEE as the user expects.

[0038] Among them, TEE can be a secure and trusted area in the processor to ensure the security, confidentiality and integrity of the code and data placed therein. TEE provides an isolated execution environment where code and data can run in the TEE, and during the operation process, the operation of the calculation can be guaranteed without interference from the conventional operating system, thereby ensuring the confidentiality and integrity of the code and data. The code program executed in the TEE can be called an enclave. Before using the enclave program, the user usually needs to measure the code and data of the enclave program and undergo remote verification to confirm that the enclave program is the program that the user expects to be executed.

[0039] The WASM virtual machine is a stack-based virtual machine with binary operation instructions. WASM code can be compiled into machine code and loaded into the WASM virtual machine for execution.

[0040] TAPP is an application implemented using Verifiable Computation technology and can be run in MYTF, such as the WASM virtual machine. Specifically, anyone can upload WASM bytecode to MYTF and call it to perform computing tasks and obtain calculation results.

[0041] Each participant can be provided with a corresponding participant device 920 locally. Participant device 920 can be used for data processing performed locally on the participant, such as watermarking a portion of the participant's training data, or locally training a fragmented model based on the participant's watermarked training dataset. Furthermore, during the training process, at least a portion of the data generated locally on each participant can be transmitted to the sharing platform 910 or the participant device 920 of one of the participants, and the sharing platform 910 or the participant device 920 can be used to aggregate data from multiple participants.

[0042] In addition, the sharing platform 910 or one of the participating devices 920 can also obtain the fragment models or encrypted fragment models of at least some participants (usually all participants), and aggregate and generate a federated learning model based on these fragment models or encrypted fragment models for verification or calling, etc.

[0043] When calling the federated learning model, the shared platform 910 can be used to perform watermark verification on the data to be verified obtained from the participant based on the caller's call request information. After passing the watermark verification, the federated learning model is run in the shared platform 910 based on the assigned call permissions so that the caller can call the federated learning model.

[0044] In some embodiments, the federated learning system may also include a blockchain 930 having one or more nodes 931. Blockchain 930 is a novel application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. In a blockchain system, data blocks can be sequentially linked in chronological order to form a chained data structure, and cryptographic methods are used to ensure that the distributed ledger is tamper-proof and unforgeable. In one or more embodiments of this specification, at least some information related to the training and invocation of the federated learning model can be recorded in the corresponding nodes 931 of blockchain 930, thereby providing highly reliable credential information for the flow and evaluation of data value, as well as the distribution of corresponding benefits.

[0045] In one or more embodiments of this specification, a method for training a federated learning model is proposed, wherein the training data for training the federated learning model can be distributed among multiple participants. Figure 3 As shown, the training method may include the following steps:

[0046] Step S100: Obtain a watermark training data set for each participant among a plurality of participants, wherein the watermark training data set includes watermark training data, a data identifier of the watermark training data of each participant corresponds to the data identifier of the watermark training data of other participants, and the watermark training data of at least one participant among the plurality of participants includes a watermark label.

[0047] In some embodiments, the watermarked training dataset may be obtained directly from the corresponding participant. Alternatively, in other embodiments, the watermarked training dataset may be generated by performing watermarking on the original training dataset provided by the corresponding participant.

[0048] like Figure 4 As shown, in some embodiments, step S100 may include:

[0049] Step S110, extracting training data with a preset data identifier from the first training data set provided by each participant to generate a second training data set for the participant;

[0050] Step S130: generating a third training dataset for the participant based on the second training dataset, wherein a feature portion of each piece of training data in the third training dataset is generated by watermarking the feature portion of the corresponding training data in the second training dataset, and when the training data in the second training dataset includes a label portion of the federated learning model, a label portion of each piece of training data in the third training dataset is generated by modifying the label portion of the corresponding training data in the second training dataset into a watermark label; and

[0051] Step S150: Merge the third training dataset and at least a portion of the first training dataset into the watermarked training dataset of the participant.

[0052] Specifically, a participant's first training dataset may include multiple pieces of training data. Furthermore, the training data in different participants' first training datasets may have the same or substantially the same data identifier (ID). The data identifier corresponds one-to-one to each piece of training data, uniquely identifying that piece of training data. For example, the data identifier may be generated based on the identity information of the subject corresponding to the training data. The identity information may include, for example, an identification card number, a phone number, or the like that uniquely identifies the subject. However, the feature portions of the training data in different participants' first training datasets may differ. For example, in one specific example, the feature portion of the first participant's training data may include features X1, X2, and X3, the feature portion of the second participant's training data may include feature X4, and the feature portion of the third participant's training data may include features X1 and X4, where X1, X2, X3, and X4 represent different features. Furthermore, the label portion of the federated learning model may be distributed only in the training data of some participants, while the training data of other participants does not contain the label portion. For example, in one specific example, the training data of the first participant may include the label portion Y of the federated learning model, while the training data of the second and third participants do not contain the label portion Y.

[0053] Considering that in a federated learning model, training data with complete features may need to be jointly provided by multiple participants, that is, different features corresponding to the same object may be distributed in the training data of multiple participants, therefore, in order to facilitate watermark verification of the federated learning model in subsequent steps, the training data to be watermarked extracted from different participants can be configured to correspond to the same group of objects, so that the feature parts of the watermark training data provided by these participants can be combined into the complete features of this group of objects. Furthermore, when the feature parts of these watermark training data are combined and input into the trained federated learning model, the federated learning model can output a watermark label. To achieve the above purpose, it can be achieved by unifying the data identifiers of the training data to be watermarked provided by each participant, that is, each participant can extract training data with preset data identifiers from its first training data set to generate the participant's second training data set for further watermark processing.

[0054] In some embodiments, when determining the preset data identifiers, a random selection can be made from data identifiers common to the training data of each participant's first training dataset to ensure that the characteristic portions of the selected training data can be combined into complete features of the federated learning model. Thus, after determining the preset data identifiers, the corresponding training data can be extracted from each participant's first training dataset based on these preset data identifiers. Alternatively, in some embodiments, the preset data identifiers of the training data to be extracted can also be determined according to a preset extraction rule.

[0055] Furthermore, the training data with the preset data identifier in the second training data set extracted from the first training data set may be watermarked to generate a corresponding third training data set.

[0056] Specifically, performing watermarking on the characteristic portion of each piece of training data in the second training data set to generate the characteristic portion of the corresponding training data in the third training data set may include:

[0057] The noise is superimposed on the characteristic portion of the training data in the second training data set, and the superimposed result is used as the characteristic portion of the corresponding training data in the third training data set.

[0058] Among them, the dimension of the noise, the dimension of the characteristic part of the training data in the second training data set, and the dimension of the characteristic part of the training data in the third training data set are equal to each other to facilitate superposition. For example, if the characteristic part of a certain training data in the second training data set of a certain participant can be represented as A2=(ax2,ay2,az2), and the noise superimposed on the characteristic part of the training data can be represented as N=(nx,ny,nz), then the result of superimposing the characteristic part of the corresponding training data in the third training data set can be represented as A3=(ax3,ay3,az3)=(ax2+nx,ay2+ny,az2+nz), that is, ax3=ax2+nx, ay3=ay2+ny, and az3=az2+nz. It should be noted that, according to actual needs, the noise superimposed on the characteristic part of each training data of each participant can be the same, partially the same, or different, and there is no limitation here.

[0059] In some embodiments, the noise may include noise generated based on non-training data. Alternatively, the noise may include noise generated based on a forward-looking image strategy (FGSM) algorithm, etc. Alternatively, the noise may include Gaussian noise, etc., where Gaussian noise refers to randomly generated noise whose noise values conform to a Gaussian distribution, and the average noise value of the Gaussian noise may be zero.

[0060] Furthermore, when the training data in the second training dataset includes the label portion of the federated learning model, the label portion of the training data in the second training dataset can be modified into a watermark label to serve as the label portion of the corresponding training data in the third data training set. If the federated learning model is a classification model, the watermark label can be set to a label corresponding to the watermark type, i.e., a new classification type label that is different from the existing classification type label in the unwatermarked model. If the federated learning model is a regression model, the watermark label can be set to a label corresponding to the minimum or maximum output value of the federated learning model to distinguish it from the numerical results that may be output by the unwatermarked model.

[0061] The characteristic portion of the training data in a participant's third training dataset generated by the watermarking process can be used as the watermark verification data provided by the participant. As described in detail later, during the verification or voting process before a model is invoked, participants can use the watermark verification data to verify their identity or vote on whether to allow invocation requests from non-participants.

[0062] As can be seen above, when the watermarked training data provided by different participants has the same data identifier, the number of training data in each participant's second training dataset (which is equal to the number of training data in the third training dataset) is equal. Furthermore, considering that the data identifiers of the training data in each participant's first training dataset are the same or substantially the same, it is equivalent to extracting an equal or substantially equal proportion of data from the training data provided by each participant for watermarking for use in verification or voting. In this way, each participant can have the same or substantially the same verification or voting rights. It is understandable that if a participant's training data contains a feature that other participants do not have, this participant can have a veto power in verification or voting. If this participant refuses to provide the corresponding data for verification or voting, the federated learning model will be unable to complete the verification or voting due to the lack of the feature. However, if a feature is distributed across multiple participants, then if one participant refuses to provide data related to that feature for verification or voting, the federated learning model can obtain data related to that feature from other participants for verification or voting. In this case, the participant who refused to provide the relevant data does not have a veto power.

[0063] In some embodiments, the ratio of the number of training data in each participant's second training dataset to the number of training data in the participant's first training dataset can be determined by the multiple participants through joint consultation. For example, the ratio can be in the range of 5% to 20%. In a specific example, the ratio can be 10%.

[0064] When merging the third training dataset with at least a portion of the first training dataset to form a watermarked training dataset, in some embodiments, to maximize the retention of the training data provided by each participant for model training, a participant's third training dataset may be merged with the complete first training dataset provided by the participant to generate a watermarked training dataset. Alternatively, in some embodiments, to avoid increasing the training cost and reducing the training efficiency due to the resulting merged watermarked training dataset being too large, the third training dataset may be merged with a portion of the first training dataset to form a watermarked training dataset.

[0065] return Figure 3 , the training method may further include the following steps:

[0066] Step S300 : performing federated learning training based on the watermarked training dataset of each participant among multiple participants to generate a fragment model of each participant as part of the federated learning model.

[0067] During model training, linear / nonlinear models can be fitted based on the data's distribution or labels to approximate the true value. Furthermore, after training, the resulting linear / nonlinear models can be used to predict the same data, yielding corresponding results. This prediction process can be used for participant identity verification, as described later.

[0068] Federated learning, a machine learning model proposed by a Google research team in 2016, is deployed to comply with data security laws and can be a form of distributed machine learning. In federated learning, local data is trained and then securely aggregated in encrypted form, resulting in an aggregated model equivalent to training with the full data set. Federated learning can include horizontal federated learning, vertical federated learning, and transfer federated learning.

[0069] In one or more embodiments of the present specification, a federated learning model trained based on a watermarked training dataset can identify watermark verification data, that is, when the watermark verification data is input into the federated learning model, the federated learning model will output a corresponding watermark label for verification or voting during the model call process.

[0070] In some embodiments, longitudinal federated learning training can be performed based on the watermarked training dataset of each of the multiple participants to generate a fragmented model for each participant. In longitudinal federated learning, the data identifiers (samples) of the training data of different participants may overlap or substantially overlap, but different features of the training data may be distributed across different participants. Certain features may be distributed across multiple participants, while certain features may only be distributed across one participant.

[0071] like Figure 5 As shown, in one embodiment, performing longitudinal federated learning training based on the watermarked training dataset of each participant among multiple participants to generate a fragmented model for each participant may include:

[0072] Step S311, selecting a participant from multiple participants as a first aggregator;

[0073] Step S312 , each of the multiple participants generates its initial fragment model according to the characteristic portion of the training data in its watermarked training dataset;

[0074] Step S313 , each of the multiple participants generates local gradient data based on its training data and its fragment model.

[0075] Step S314 , each of the multiple participants encrypts its local gradient data using its first public key to generate its local encrypted gradient data;

[0076] Step S315 , all other participants among the multiple participants who are not the first aggregator transmit their local encrypted gradient data to the first aggregator respectively;

[0077] Step S316: The first aggregator aggregates all local encrypted gradient data of multiple participants to generate aggregated encrypted gradient data, and returns the aggregated encrypted gradient data to all other participants respectively;

[0078] Step S317 , each of the multiple participants decrypts the aggregated encrypted gradient data using its first private key to generate aggregated gradient data;

[0079] Step S318 , each of the multiple participants updates its fragment model based on its aggregated gradient data; and

[0080] Return to step S313 until the vertical federated learning training is completed.

[0081] In this embodiment, one of the multiple participants can serve as the first aggregator to aggregate gradient data from different participants during the training process. For security reasons, this first aggregator can be randomly selected. Furthermore, to ensure data and model security, the local gradient data obtained by each participant during local training can be encrypted to generate local encrypted gradient data. The local encrypted gradient data of all participants can then be aggregated at the first aggregator, generating aggregated encrypted gradient data. This aggregated encrypted gradient data can be returned to each participant in the vertical federated learning and decrypted by each participant to generate aggregated gradient data. Furthermore, each participant can update its local fragmented model based on its aggregated gradient data and continue training based on its training data and the updated fragmented model, repeating this cycle until the vertical federated learning training is complete. During this training process, each participant's fragmented model can be retained locally, and only the encrypted gradient data is transmitted for aggregation. This effectively ensures data and model security while enabling federated learning training for multiple participants to optimize the model.

[0082] In other embodiments, the sharing platform can also aggregate the relevant data in the training to ensure the security of each participant's data. Figure 6 As shown, performing longitudinal federated learning training based on the watermarked training dataset of each participant among multiple participants to generate a fragmented model for each participant may include:

[0083] Step S331 , each of the multiple participants generates its initial fragment model according to the characteristic portion of the training data in its watermarked training dataset;

[0084] Step S332 , each of the multiple participants generates local gradient data based on its training data and its fragment model.

[0085] Step S333 , each of the multiple participants encrypts its local gradient data using its first public key to generate its local encrypted gradient data;

[0086] Step S334 , each of the multiple participants transmits its local encrypted gradient data to the sharing platform;

[0087] Step S335: The sharing platform aggregates all local encrypted gradient data of multiple participants to generate aggregated encrypted gradient data, and returns the aggregated encrypted gradient data to each participant.

[0088] Step S336 , each of the multiple participants decrypts the aggregated encrypted gradient data using its first private key to generate aggregated gradient data;

[0089] Step S337 , each of the multiple participants updates its fragment model based on its aggregated gradient data; and

[0090] Return to step S332 until the vertical federated learning training is completed.

[0091] In this embodiment, the gradient data from each participant during the training process can be aggregated by a shared platform. Specifically, the local gradient data obtained by each participant during local training can be encrypted to generate local encrypted gradient data. The local encrypted gradient data of all participants can then be aggregated on the shared platform to generate aggregated encrypted gradient data. The aggregated encrypted gradient data can be returned to each participant in the vertical federated learning and decrypted by each participant to generate aggregated gradient data. Furthermore, each participant can update its local fragmented model based on its aggregated gradient data and continue training based on its training data and the updated fragmented model, repeating this cycle until the vertical federated learning training is completed. During the above training process, each participant's fragmented model can be retained locally, and the gradient data generated during the training process can be aggregated by a shared platform that is not a member of any participant. This effectively ensures the security of the data and model, while enabling federated learning training for multiple participants to optimize the model. Here, the shared platform can be based on MYTF technology, allowing participants to confirm that the aggregated training of the federated learning model is carried out in the manner they expect, ensuring the reliability of the training results.

[0092] In some embodiments, when aggregating all local encrypted gradient data of multiple participants to generate encrypted gradient data, the first aggregator or sharing platform may perform a weighted average of all local encrypted gradient data of the multiple participants to generate the aggregated encrypted gradient data. The weights used in the weighted average can be determined based on the specific training task and characteristics. Alternatively, in other embodiments, other methods may be used to generate the aggregated encrypted gradient data.

[0093] In some embodiments, a first public key used to encrypt local gradient data and a matching first private key used to decrypt aggregated encrypted gradient data during training may be generated by a shared platform.

[0094] In some embodiments, the sharing platform can distribute the corresponding first public key to each participant for encryption before the participant encrypts its local gradient data. Furthermore, the sharing platform can transmit the first private key to the participant for decryption after the aggregated encrypted gradient data is returned to the participant and before the participant decrypts the aggregated encrypted gradient data. Appropriately selecting the timing for distributing and transmitting the first public key and the first private key can effectively prevent data or model leakage, ensure security, and enable participants to perform encryption and decryption in a timely manner.

[0095] In some embodiments, the matching first public key and first private key of each participant can be generated based on a homomorphic encryption algorithm. Homomorphic encryption algorithm is a type of encryption algorithm with special natural properties. It can achieve that when the homomorphically encrypted data is processed to obtain an output and then the output is decrypted, the result obtained is the same as the output result obtained by processing the unencrypted original data using the same method. In other words, in addition to realizing basic encryption operations, homomorphic encryption can also realize a variety of calculation functions between ciphertexts, that is, calculation first and then decryption is equivalent to decryption first and then calculation. In this way, during the training process of the federated learning model, although the local gradient data is encrypted and then the aggregated encrypted gradient data is decrypted, correct calculation can still be guaranteed, thereby generating a correct federated learning model.

[0096] Alternatively, in other embodiments, each participant's matching first public key and first private key may also be generated based on a secret sharing algorithm. For example, if there are N participants, each participant can generate (N-1) sets of numbers that sum to zero and distribute these (N-1) sets of numbers to all other (N-1) participants. When each participant receives the (N-1) sets of numbers from the other (N-1) participants, it can add its local gradient data to these (N-1) sets of numbers, effectively encrypting its local gradient data using the first public key, thereby generating locally encrypted gradient data. The participant can then transmit the locally encrypted gradient data to a selected first aggregator or sharing platform for aggregation. During the gradient data aggregation process, since the sum of all previously superimposed sets of numbers is zero, these numbers are canceled out, thereby generating the true gradient data. In some cases, the generated aggregated encrypted gradient data may be the aggregated gradient data itself, and the first private key may not be required for decryption. In other words, the aggregated gradient data generated by decrypting the aggregated encrypted gradient data using the first private key is identical to the aggregated encrypted gradient data.

[0097] Alternatively, multiple participants may also use other methods to encrypt their local gradient data and directly obtain aggregated gradient data, or obtain aggregated encrypted gradient data that needs to be decrypted by a corresponding decryption method. As long as this data processing method can ensure correct and secure gradient data operations, there is no restriction here.

[0098] When the recognition accuracy of each participant's fragmented model or the federated learning model generated based on the fragmented models of multiple participants reaches the preset requirements, the vertical federated learning training can be completed.

[0099] In one or more embodiments of the present specification, the fragmented model generated by each participant can be stored locally by the participant to ensure the security of the fragmented model and reduce the platform storage burden caused by storing the fragmented model or federated learning model on a shared platform.

[0100] In some embodiments, the fragment model can be encrypted by the sharing platform to ensure the security and reliability of the fragment model. Figure 7 As shown, after generating the fragment models of each participant as part of the federated learning model, the training method may further include:

[0101] Step S511 , each of the multiple participants transmits its fragment model to the sharing platform;

[0102] Step S513: the sharing platform encrypts each participant's fragment model using the corresponding second public key to generate an encrypted fragment model of the participant; and

[0103] In step S515 , the sharing platform returns the encrypted fragment model of each participant to the corresponding participant, so that the participant can store the encrypted fragment model locally.

[0104] In other embodiments, each participant may also encrypt and store its fragment model locally. Figure 8 As shown, after generating the fragment models of each participant as part of the federated learning model, the training method may further include:

[0105] In step S521 , each of the multiple participants encrypts its fragment model using its second public key to generate and store its encrypted fragment model locally.

[0106] In the process of encrypting the fragmented model for storage, the sharing platform can generate a matching second public key and second private key for each participant. The sharing platform can distribute the second public key to the corresponding participant for encryption of its fragmented model. In addition, the second private key can be stored on the sharing platform. As described later, when the fragmented model or federated learning model is needed, the stored second private key can be used on the sharing platform for decryption, thereby improving the security of the model.

[0107] like Figure 9 As shown, in one or more embodiments of this specification, after generating a fragment model of each participant as part of the federated learning model, the training method may further include:

[0108] Step S700: Aggregate the fragmented models of at least some of the participants to generate a federated learning model.

[0109] After generating the fragmented models of each participant, the fragmented models can be aggregated immediately to generate a federated learning model. Alternatively, the fragmented models can be aggregated to generate a federated learning model only when the recognition accuracy of the federated learning model needs to be tested (for example, the watermark recognition accuracy) and / or when the federated learning model needs to be called. Aggregating and generating a federated learning model only when it is needed for testing or use can avoid the leakage of the model to a greater extent, thereby ensuring the security of the data and model. Generally, a federated learning model is generated by aggregating the fragmented models of all participants among multiple participants. Such a federated learning model aggregates the fragmented models of all participants and generally has the best accuracy. However, in some cases, the federated learning model can also be generated by aggregating the fragmented models of some participants among multiple participants, wherein, in the training of the fragmented models of these participants, their training data generally covers the complete features of the federated learning model. The specific steps of aggregating the fragmented models to generate the federated learning model can be referred to the description of the calling method of the federated learning model below, and will not be repeated here.

[0110] In addition, if Figure 10 As shown, the training method may further include:

[0111] Step S900: The sharing platform tests and records the watermark recognition accuracy of the federated learning model for watermark test data with watermark labels.

[0112] Specifically, the sharing platform can independently test and record the watermark recognition accuracy of the federated learning model based on the watermark test data. This watermark recognition accuracy can be used in the method for invoking the federated learning model described below. In some embodiments, the watermark test data can be generated based on the characteristic portion of the training data in the third training dataset of at least some participants. Typically, these participants can collectively provide training data with complete characteristics.

[0113] In the training method of the federated learning model provided in one or more embodiments of this specification, the federated learning model is trained based on a watermarked training data set with a watermark label, thereby obtaining a federated learning model that can identify watermark verification data, which provides a basis for the mining, circulation and evaluation of the value of data, and helps to better realize and protect the value of data and models.

[0114] In addition, one or more embodiments of this specification also propose a method for calling a federated learning model, wherein the federated learning model can be configured to be able to perform watermark verification, and the watermark verification can identify whether the data to be verified is watermark verification data with a watermark label, and the data to be verified is distributed among multiple participants. As described above, the watermark verification data can be generated by combining the feature parts of the watermark training data of at least some of the multiple participants, and each watermark verification data includes complete features configured to be input into the federated learning model, so that the federated learning model can correctly output the watermark label based on the watermark verification data. In some embodiments, the training method of the federated learning model described above can be used to train and generate such a federated learning model. Alternatively, other methods can be used to obtain a federated learning model that can identify watermark verification data.

[0115] like Figure 11 As shown, in one or more embodiments of this specification, the method for calling the federated learning model may include:

[0116] Step S200: The sharing platform obtains the call request information from the caller;

[0117] Step S400: The sharing platform uses the federated learning model to perform watermark verification on the data to be verified based on the call request information;

[0118] Step S600: When the sharing platform determines that the watermark verification is passed, the caller is allocated the calling permission of the federated learning model so that the caller can call the federated learning model.

[0119] Specifically, the call request information may come from a caller that is a participant, or may come from other callers that are not participants of the federated learning model.

[0120] In some embodiments, as Figure 12 As shown, the shared platform uses the federated learning model to perform watermark verification on the data to be verified based on the call request information, which may include:

[0121] Step S410: the sharing platform broadcasts the call request information to multiple participants;

[0122] Step S430: The sharing platform obtains fragment models or encrypted fragment models from at least some of the multiple participants, and obtains data to be verified from at least some of the multiple participants;

[0123] Step S450: When the sharing platform fails to obtain the data to be verified that includes complete features, or fails to obtain sufficient fragment models or encrypted fragment models for generating a federated learning model, it is determined that the watermark verification fails.

[0124] In step S470, when the sharing platform obtains the data to be verified including complete features and sufficient fragment models or encrypted fragment models for generating a federated learning model, the sharing platform inputs the data to be verified into the aggregated federated learning model to determine whether the data to be verified is watermark verification data with a watermark label.

[0125] That is to say, when the caller initiates a call request message, the sharing platform can broadcast the call request message to the participants of the federated learning model. If a participant agrees to the call request of the caller, it can transmit its fragmented model or encrypted fragmented model and the data to be verified to the sharing platform. If the sharing platform can obtain the data to be verified including complete features and sufficient fragmented models or encrypted fragmented models for generating the federated learning model from at least some of the multiple participants, it can perform watermark verification based on this. Otherwise, it is deemed to have failed the watermark verification. Furthermore, when the sharing platform determines that the number of watermark verification data with watermark tags in the data to be verified is greater than or equal to the preset verification number, it is determined that the watermark verification has passed. At this time, the corresponding call permission can be allocated to the caller. Otherwise, it is deemed to have failed the watermark verification.

[0126] It should be noted that in some embodiments, the sharing platform can obtain fragmented models or encrypted fragmented models, as well as the data to be verified, from different groups of participants. For example, to ensure that the federated learning model is always available for watermarking verification of the data to be verified, multiple participants can pre-negotiate and determine that upon receiving a call request, they must provide their own fragmented models or encrypted fragmented models for generating the federated learning model. However, participants who disagree with the call can reject the call by choosing not to provide their own data to be verified to the sharing platform.

[0127] In some embodiments, the sharing platform may also obtain fragment models or encrypted fragment models, as well as data to be verified, from the same participants. If a participant disagrees with the call request, it may refuse to provide the fragment model or encrypted fragment model and data to be verified to the sharing platform, thereby rejecting the call.

[0128] In addition, in some cases, if certain features of the federated learning model are only distributed to one participant, then this participant may have a veto over the call request. If certain features of the federated learning model are distributed to multiple participants, then some of the multiple participants may also provide fragmented models or encrypted fragmented models that cover the complete features and data to be verified. Based on the fragmented models or encrypted fragmented models and data to be verified provided by these participants, it is still possible to pass watermark verification and form a federated learning model for the caller to call. However, in this case, the generated federated learning model is only formed by aggregating the fragmented models of some participants, and its accuracy may be reduced. Alternatively, in some embodiments, multiple participants can pre-negotiate and determine that when watermark verification is passed, each participant must provide its fragmented model or encrypted fragmented model to generate a complete federated learning model to ensure the accuracy of the federated learning model for call.

[0129] In some embodiments, the number of data to be verified can be determined by consensus among multiple participants. For example, the number of data to be verified can be at least half the number of watermark training data for each participant. A greater number of data to be verified generally results in higher verification accuracy, for example, avoiding the adverse effects of incorrect predictions by the federated learning model. However, this also generally results in lower verification efficiency. In practical situations, the number of data to be verified can be determined as needed.

[0130] In some embodiments, the preset number of verifications can be determined based on at least the watermark recognition accuracy of the federated learning model. For example, if multiple participants agree that each verification requires at least 100 pieces of watermark verification data to pass, and the watermark recognition accuracy of the federated learning model obtained through testing is 95%, then the actual preset number of verifications can be 100 * 95% = 95 pieces. That is, watermark verification passes when the federated learning model determines that there are at least 95 pieces of watermark verification data with watermark labels in the data to be verified.

[0131] In some embodiments, the sharing platform can use smart contracts on the blockchain for watermark verification. A smart contract is a computer protocol designed to disseminate, verify, or execute contracts in an information-based manner. It allows trusted transactions without a third party, and these transactions are traceable and irreversible, thereby improving the reliability and security of verification. In some embodiments, the smart contract can count watermark verification data with watermark tags. When the count reaches a preset verification number, it is determined that the watermark verification has passed, and the next call operation can be carried out.

[0132] In some embodiments, when calling a federated learning model, the sharing platform can obtain the fragmented models or encrypted fragmented models from the corresponding participants and aggregate them to generate a federated learning model for calling. Specifically, Figure 13 As shown, the caller calling the federated learning model may include:

[0133] Step S611: The sharing platform obtains fragment models or encrypted fragment models from at least some of the multiple participants respectively;

[0134] Step S613: The sharing platform aggregates the acquired fragment models or encrypted fragment models to generate a federated learning model; and

[0135] In step S615 , the caller calls the federated learning model based on the allocated calling authority, wherein the federated learning model runs in the shared platform.

[0136] Alternatively, in some embodiments, a participant may be selected from multiple participants as a second aggregator to aggregate the encrypted fragment models provided by the corresponding participants to generate an aggregated encrypted model, and then transmit the aggregated encrypted model to the sharing platform for decryption to generate a federated learning model for invocation, thereby reducing the pressure on the sharing platform to aggregate the model. Specifically, Figure 14 As shown, the caller calling the federated learning model may include:

[0137] Step S631, selecting a participant from multiple participants as a second aggregator;

[0138] Step S632: at least some of the other participants among the plurality of participants who are not the second aggregator transmit their encrypted fragment models to the second aggregator respectively;

[0139] Step S633: The second aggregator aggregates its own encrypted fragment model and the encrypted fragment models of at least some of the other participants to generate an aggregated encrypted model as the encrypted federated learning model;

[0140] Step S634: the second aggregator transmits the aggregated encryption model to the sharing platform;

[0141] Step S635: the sharing platform decrypts the aggregated encryption model using the second private key stored in the sharing platform to generate a federated learning model; and

[0142] In step S636 , the caller calls the federated learning model based on the allocated calling authority, wherein the federated learning model runs in the shared platform.

[0143] In the embodiments described above, the decryption of the encrypted fragment model or the aggregated encryption model, as well as the operation of the federated learning model, can be performed on the shared platform. Accordingly, the second private key used for decryption can also be stored in the shared platform to better ensure the security of the data and model. In addition, when calling the federated learning model, the caller can upload the data to be analyzed to the shared platform and receive the output results generated by the federated learning model based on the data to be analyzed from the shared platform. In this way, the caller will not have direct access to the federated learning model, which helps to better ensure the security of the data and model. In addition, as described above, the shared platform can be based on MYTF technology, so that the caller can also confirm that the call to the federated learning model is carried out in the manner expected by the caller, thereby ensuring the reliability of the output results.

[0144] In one or more embodiments of this specification, the data to be analyzed provided by the caller may be missing features. Therefore, it is impossible to obtain the corresponding output results from the federated learning model directly based on such data to be analyzed. Therefore, it is necessary to perform feature completion. That is, the caller's invocation of the federated learning model may also include:

[0145] When the caller's data to be analyzed is missing features, the data to be analyzed is completed to generate completed data to be analyzed including complete features; and

[0146] The caller calls the federated learning model to analyze and complete the data to be analyzed.

[0147] Specifically, if Figure 15 As shown, feature completion of the data to be analyzed may include:

[0148] Step S651: The sharing platform receives the data to be analyzed from the caller;

[0149] Step S653: The sharing platform performs feature analysis on the data to be analyzed, generates a feature completion request based on the missing features, and sends the feature completion request to at least some of the multiple participants; and

[0150] In step S655 , the sharing platform receives feature completion data corresponding to the missing features from at least one participant, and uses the feature completion data to complete the features of the data to be analyzed.

[0151] Among them, after the sharing platform performs feature analysis on the data to be analyzed and determines the missing features, the feature completion request can be broadcast to all participants, or it can be sent only to participants who have the corresponding features, and feature completion data can be received from the corresponding participants to complete the features of the data to be analyzed.

[0152] Alternatively, in some other embodiments, the caller may also use other methods to complete the features, such as completing the features based on secure multi-party computing, or using other offline methods to complete the features.

[0153] In some embodiments, when the caller is a participant in a federated learning model, they can verify the signature of the blockchain node to invoke the federated learning model based on the assigned invocation rights. This allows the call-related information to be recorded on the blockchain, facilitating future verification and improving the security of the model.

[0154] In some embodiments, to avoid the risk of possible attacks from malicious callers frequently calling the federated learning system, and / or to facilitate customizable transactions for calling permissions, calling permissions can be limited. For example, calling permissions can be the right to call the federated learning model a preset number of times within a preset time period after passing watermark verification. It is understood that calling permissions can also have other specific forms. If the calls to the federated learning model exceed the calling permissions, new calling permissions need to be obtained through re-verification or voting. It is understood that callers can also obtain new calling permissions through other agreed methods, which are not limited here.

[0155] In some embodiments, the calling method may further include:

[0156] After passing the watermark verification, the model call information is recorded on the blockchain.

[0157] Specifically, model call information can be recorded on the blockchain immediately after watermark verification, or after the call is completed. Model call information can include the caller's identity, call time, call count, and more. Furthermore, to conserve storage space in blockchain nodes, the data generated during the call process can be hashed before being stored on-chain.

[0158] In some embodiments, the calling method may further include:

[0159] When the sharing platform determines that the watermark verification has not passed, the call request information is recorded.

[0160] By recording call request information that fails watermark verification, it is easy to verify the identity of the caller, discover potential risks in a timely manner, and protect the security of data and models.

[0161] In some embodiments, to better distribute the benefits of data and models, during the training of a federated learning model, after each training session, the training information of each of the multiple participants can be saved on the blockchain. The participant's training information can include the participant's corresponding blockchain node identification information (e.g., node ID), the fields of the model involved, etc. Furthermore, to conserve storage space on the blockchain, the participant's corresponding blockchain node identification information (e.g., node ID), the fields of the model involved, and other information can be hashed before being saved on the blockchain.

[0162] Accordingly, the calling method may further include:

[0163] After watermark verification, corresponding benefits are distributed to participants who provide shard models or encrypted shard models for aggregation to generate federated learning models based on the model training information of each participant recorded on the blockchain.

[0164] The caller can call the federated learning model based on the calling method of the federated learning model described above. During the calling process, the caller itself does not directly access the federated learning model, thereby effectively ensuring the security of the data and model. In addition, the calling method in one or more embodiments of this specification effectively solves the problem of the free circulation of plaintext models, which are important data assets. It allows not only the participants themselves, but also other callers outside the participants to call the federated learning model, thereby better exploring the value of the data and model, and also helping participants to obtain more benefits while ensuring data security.

[0165] One or more embodiments of this specification also propose a federated learning system, such as Figure 1 and Figure 2 As shown, the federated learning system may include a sharing platform 910, which may include:

[0166] A communication unit 911, which may be configured to obtain call request information from a caller;

[0167] A verification unit 912, which may be configured to perform watermark verification on the data to be verified using a federated learning model according to the call request information, wherein the federated learning model is configured to be able to perform watermark verification, and the watermark verification identifies whether the data to be verified is watermark verification data with a watermark tag, and the data to be verified is distributed among multiple participants;

[0168] An allocating unit 913, which may be configured to allocate a calling right of the federated learning model to the caller when the watermark verification is passed; and

[0169] The model running unit 914 may be configured to run the federated learning model to enable the caller to call the federated learning model.

[0170] Furthermore, if Figure 1 and Figure 2 As shown, the sharing platform may further include at least one of the following:

[0171] A testing unit 915 , which may be configured to test the watermark recognition accuracy of the federated learning model on watermark test data having a watermark label;

[0172] a key unit 916, which may be configured to generate matching public and private keys; and

[0173] The storage unit 917 may be configured to store a private key and / or record a watermark recognition accuracy rate.

[0174] like Figure 1 and Figure 2 As shown, the federated learning system may further include a plurality of participating devices 920, each of the plurality of participating devices 920 being disposed in a local location of a participant corresponding to the participating device 920, and each of the plurality of participating devices 920 may include:

[0175] a watermarking unit 921, the watermarking unit 921 may be configured to obtain a watermarked training dataset for the participant, wherein the watermarked training dataset includes watermarked training data having a watermark label, a data identifier of the watermarked training data of each participant corresponds to a data identifier of the watermarked training data of other participants, and the watermarked training data of at least one participant among the multiple participants includes the watermark label; and,

[0176] The local training unit 922 can be configured to perform local training in federated learning training.

[0177] In addition, the federated learning system may further include an aggregation unit 940, such as Figure 1 As shown, it can be set on at least one participating device 920 among the plurality of participating devices 920, or as shown in Figure 2 As shown, it can be set on the shared platform 910, and the aggregation training unit 940 can be configured to perform aggregation training in federated learning training. Specifically, the aggregation training unit 940 can aggregate the local gradient data or local encrypted gradient data of multiple participants to generate aggregated gradient data or aggregated encrypted gradient data.

[0178] Furthermore, if Figure 1 and Figure 2 As shown, the federated learning system may also include a blockchain 930 having one or more nodes 931, wherein the blockchain 930 may include a smart contract for watermark verification, and at least one of model training information and model call information may be recorded in one or more nodes 931.

[0179] One or more embodiments of this specification also propose a non-transitory computer-readable storage medium, on which computer instructions can be stored. When the computer instructions are executed by a processor, the steps of the training method or calling method of the federated learning model as described above can be implemented.

[0180] The non-transitory computer-readable storage medium in one or more embodiments of the present specification may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. It should be noted that the computer-readable storage medium described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0181] One or more embodiments of this specification also propose a computer program product, which may include instructions. When the instructions are executed by a processor, the steps of the training method or calling method of the federated learning model as described above can be implemented.

[0182] The instructions may be any set of instructions to be executed directly by one or more processors, such as machine code, or any set of instructions to be executed indirectly, such as a script. The terms "instructions," "application," "process," "steps," and "program" are used interchangeably herein. The instructions may be stored in object code format for direct processing by one or more processors, or as a script or collection of independent source code modules in any other computer language, including those interpreted on demand or compiled in advance. The instructions may include instructions that cause one or more processors to act as the various neural networks herein. The functions, methods, and routines of the instructions are explained in more detail elsewhere herein.

[0183] In one or more embodiments of the present specification, a federated learning model that can recognize watermark verification data with a watermark label can be generated based on a watermarked training data set; in the process of calling the federated learning model, the watermark verification data can be used to implement verification or voting, and after passing the watermark verification, the federated learning model can be run on a shared platform to enable the caller to call the federated learning model, thereby avoiding the caller from directly contacting the federated learning model, thereby avoiding the leakage of information that may cause security risks and ensuring the security of data and models. Under the premise of free circulation of the model, it helps to fully explore and release the value of data and provide more benefits to the owners of data and models. In addition, information related to model training, calling, etc. can be stored on the blockchain, thereby ensuring the legitimacy and reliability of the transaction. Accordingly, the federated learning model trained by multiple participants can be regarded as a non-fungible token (NFT) and circulated according to the corresponding transaction rules on the blockchain.

[0184] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, eliminating the need for chip manufacturers to design and manufacture dedicated integrated circuit chips. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0185] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0186] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0187] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0188] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0189] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0190] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0191] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0192] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0193] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0194] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0195] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0196] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In distributed computing environments, program modules may be located in local and remote computer storage media, including storage devices.

[0197] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0198] The foregoing is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. It will be apparent to those skilled in the art that various modifications and variations may be made to one or more embodiments of this specification. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification shall be included within the scope of the claims.

Claims

1. A method for training a federated learning model, wherein: The training data used to train the federated learning model is distributed among multiple participants, and the training method includes: obtaining a watermarked training dataset for each of the plurality of participants, wherein the watermarked training dataset includes watermarked training data, a data identifier of the watermarked training data of each participant corresponds to the data identifier of the watermarked training data of other participants, and the watermarked training data of at least one of the plurality of participants includes a watermark label; and performing federated learning training based on the watermarked training dataset of each participant of the plurality of participants to respectively generate a fragment model of each participant as part of the federated learning model, Wherein, obtaining the watermarked training data set of each participant among the multiple participants includes: Extracting training data with a preset data identifier from a first training data set provided by each participant to generate a second training data set for the participant; generating a third training dataset for the participant based on the second training dataset, wherein a feature portion of each piece of training data in the third training dataset is generated by watermarking the feature portion of the corresponding training data in the second training dataset, and when the training data in the second training dataset includes a label portion of the federated learning model, a label portion of each piece of training data in the third training dataset is generated by modifying the label portion of the corresponding training data in the second training dataset into a watermark label; and The third training dataset is combined with at least a portion of the first training dataset to form a watermarked training dataset for the participant.

2. The training method according to claim 1, wherein: Among the plurality of participants, the number of training data in the second training data set of each participant is equal to each other.

3. The training method according to claim 1, wherein: A ratio of the number of training data in the second training data set of a participant to the number of training data in the first training data set of the participant is in a range from 5% to 20%.

4. The training method according to claim 1, wherein: The ratio of the number of training data in the second training data set of a participant to the number of training data in the first training data set of the participant is 10%.

5. The training method according to claim 1, wherein: The preset data identifier is randomly selected from data identifiers present in the training data of the first training data set of each participant among the multiple participants.

6. The training method according to claim 1, wherein: The feature portion of each piece of training data in the third training data set is generated by performing watermarking processing on the feature portion of the corresponding training data in the second training data set, including: superimposing the noise with the characteristic portion of the training data in the second training data set, and using the superimposed result as the characteristic portion of the corresponding training data in the third training data set; The dimension of the noise, the dimension of the characteristic portion of the training data in the second training dataset, and the dimension of the characteristic portion of the training data in the third training dataset are equal to each other.

7. The training method according to claim 6, wherein: Noise includes noise generated based on non-training data; or Noise includes noise generated by image adversarial algorithms; or Noise includes Gaussian noise.

8. The training method according to claim 1, wherein: When the federated learning model is a classification model, the watermark label is set to a label corresponding to the watermark type.

9. The training method according to claim 1, wherein: When the federated learning model is a regression model, the watermark label is set to a label corresponding to the minimum output value or the maximum output value of the federated learning model.

10. The training method according to claim 1, wherein: Performing federated learning training based on the watermarked training dataset of each participant among the multiple participants to respectively generate a fragmented model of each participant as part of the federated learning model includes: Longitudinal federated learning training is performed based on the watermarked training dataset of each participant of the multiple participants to generate a fragmented model for each participant respectively.

11. The training method according to claim 10, wherein: Performing longitudinal federated learning training based on the watermarked training dataset of each participant among the multiple participants to generate a fragmented model for each participant respectively includes: selecting a participant from the plurality of participants as a first aggregator; Each participant of the plurality of participants generates its initial fragment model according to a characteristic portion of the training data in its watermarked training dataset; Each of the plurality of participants generates local gradient data locally based on its training data and its fragment model; Each participant of the plurality of participants encrypts its local gradient data using its first public key to generate its local encrypted gradient data; All other participants among the plurality of participants who are not the first aggregator transmit their local encrypted gradient data to the first aggregator respectively; The first aggregator aggregates all local encrypted gradient data of the multiple participants to generate aggregated encrypted gradient data, and returns the aggregated encrypted gradient data to all other participants respectively; Each participant of the plurality of participants decrypts the aggregated encrypted gradient data using its first private key to generate aggregated gradient data; Each participant of the plurality of participants updates its fragment model based on its aggregated gradient data; and Return to the step in which each participant among the multiple participants generates its local gradient data locally according to its training data and its fragment model until the longitudinal federated learning training is completed.

12. The training method according to claim 11, wherein: The first aggregator is randomly selected from the plurality of participants.

13. The training method according to claim 10, wherein: Performing longitudinal federated learning training based on the watermarked training dataset of each participant among the multiple participants to generate a fragmented model for each participant respectively includes: Each participant of the plurality of participants generates its initial fragment model according to a characteristic portion of the training data in its watermarked training dataset; Each of the plurality of participants generates local gradient data locally based on its training data and its fragment model; Each participant of the plurality of participants encrypts its local gradient data using its first public key to generate its local encrypted gradient data; Each of the plurality of participants transmits its local encrypted gradient data to the sharing platform; The sharing platform aggregates all local encrypted gradient data of the multiple participants to generate aggregated encrypted gradient data, and returns the aggregated encrypted gradient data to each participant respectively; Each participant of the plurality of participants decrypts the aggregated encrypted gradient data using its first private key to generate aggregated gradient data; Each participant of the plurality of participants updates its fragment model based on its aggregated gradient data; and Return to the step in which each participant among the multiple participants generates its local gradient data locally according to its training data and its fragment model until the longitudinal federated learning training is completed.

14. The training method according to claim 11 or 13, wherein: The matching first public key and first private key of each participant are generated by the sharing platform.

15. The training method according to claim 14, wherein: The first public key is transmitted by the sharing platform to the corresponding participant before the participant encrypts its local gradient data; and The first private key is transmitted by the sharing platform to the participant after the aggregated encrypted gradient data is returned to the corresponding participant and before the participant decrypts the aggregated encrypted gradient data.

16. The training method according to claim 11 or 13, wherein: The matching first public key and first private key of each participant are generated based on a homomorphic encryption algorithm; or The matching first public key and first private key of each participant are generated based on a secret sharing algorithm.

17. The training method according to claim 11 or 13, wherein: Aggregating all local encrypted gradient data of the multiple participants to generate aggregated encrypted gradient data includes: A weighted average is performed on all local encrypted gradient data of the multiple participants to generate the aggregated encrypted gradient data.

18. The training method according to claim 1, after generating a fragment model of each participant as part of the federated learning model, the training method further comprises: Each of the plurality of participants transmits its fragment model to the sharing platform; The sharing platform encrypts each participant's fragment model using the corresponding second public key to generate an encrypted fragment model of the participant; and The sharing platform returns the encrypted fragment model of each participant to the corresponding participant, so that the participant can store the encrypted fragment model locally.

19. The training method according to claim 1, after generating a fragment model of each participant as part of the federated learning model, the training method further comprises: Each participant of the plurality of participants encrypts its fragment model using its second public key to generate and locally store its encrypted fragment model.

20. The training method according to claim 18 or 19, wherein: The matching second public key and second private key of each participant are generated by the sharing platform, and the second private key is stored in the sharing platform.

21. The training method according to claim 1, after generating a fragment model of each participant as part of the federated learning model, the training method further comprises: Aggregating the fragmented models of at least some of the multiple participants to generate the federated learning model.

22. The training method according to claim 21, after generating the federated learning model, further comprising: The sharing platform tests and records the watermark recognition accuracy of the federated learning model on the watermark test data with the watermark label.

23. A method for calling a federated learning model, wherein: The federated learning model is generated by training according to the training method according to any one of claims 1 to 22, and is configured to be capable of performing watermark verification, wherein the watermark verification identifies whether the data to be verified is watermark verification data having a watermark label, and the data to be verified is distributed among multiple participants. The calling method includes: The sharing platform obtains the call request information from the caller; The sharing platform performs watermark verification on the data to be verified using the federated learning model according to the call request information; and When the sharing platform determines that the watermark verification is passed, the calling authority of the federated learning model is allocated to the caller so that the caller can call the federated learning model.

24. The calling method according to claim 23, wherein: The watermark verification data is generated according to a feature portion of at least a portion of the watermark training data of at least a portion of the participants, and each piece of watermark verification data includes complete features configured to be input into the federated learning model.

25. The calling method according to claim 23, wherein: The sharing platform performs watermark verification on the data to be verified using the federated learning model according to the call request information, including: The sharing platform broadcasts the call request information to the multiple participants; The sharing platform obtains fragment models or encrypted fragment models from at least some of the multiple participants, and obtains data to be verified from at least some of the multiple participants; When the sharing platform fails to obtain the data to be verified that includes complete features, or the sharing platform fails to obtain sufficient fragment models or encrypted fragment models for generating the federated learning model, it is determined that the watermark verification fails; When the sharing platform obtains the data to be verified including complete features and sufficient fragment models or encrypted fragment models for generating the federated learning model, the sharing platform inputs the data to be verified into the aggregated federated learning model to determine whether the data to be verified is watermark verification data with a watermark label; When the sharing platform determines that the number of watermark verification data with watermark tags in the data to be verified is greater than or equal to a preset verification number, it is determined that the watermark verification has passed; and When the sharing platform determines that the number of watermark verification data with watermark tags in the data to be verified is less than a preset verification number, it is determined that the watermark verification has not passed.

26. The calling method according to claim 25, wherein: The number of data to be verified is at least half the number of watermark training data for each participant.

27. The calling method according to claim 25, wherein: The preset verification number is determined at least according to the watermark recognition accuracy of the federated learning model.

28. The calling method according to claim 23, wherein: The sharing platform performs watermark verification on the data to be verified using the federated learning model according to the call request information, including: The sharing platform uses smart contracts on the blockchain to perform watermark verification on the data to be verified.

29. The calling method according to claim 23, wherein: The caller calling the federated learning model includes: The sharing platform obtains fragment models or encrypted fragment models from at least some of the multiple participants respectively; The sharing platform aggregates the acquired fragment models or encrypted fragment models to generate the federated learning model; and The caller calls the federated learning model based on the allocated calling authority, wherein the federated learning model runs in the shared platform.

30. The calling method according to claim 25 or 29, wherein: When the sharing platform obtains the encrypted fragment models, the encrypted fragment models are decrypted using the corresponding second private keys stored in the sharing platform to generate corresponding fragment models.

31. The calling method according to claim 23, wherein: The caller calling the federated learning model includes: selecting a participant from the plurality of participants as a second aggregator; At least some of the other participants among the plurality of participants who are not the second aggregator transmit their encrypted fragmentation models to the second aggregator respectively; The second aggregator aggregates its own encrypted fragment model and the encrypted fragment models of at least some of the other participants to generate an aggregated encrypted model that is an encrypted federated learning model; The second aggregator transmits the aggregated encryption model to the sharing platform; The sharing platform decrypts the aggregated encryption model using a second private key stored in the sharing platform to generate the federated learning model; and The caller calls the federated learning model based on the allocated calling authority, wherein the federated learning model runs in the shared platform.

32. The calling method according to claim 23, wherein: The caller calling the federated learning model includes: When the caller's data to be analyzed is missing features, completing the features of the data to be analyzed to generate completed data to be analyzed including complete features; and The caller calls the federated learning model to analyze the completed data to be analyzed.

33. The calling method according to claim 32, wherein: Feature completion for the data to be analyzed includes: The sharing platform receives the data to be analyzed from the caller; The sharing platform performs feature analysis on the data to be analyzed, generates a feature completion request according to the missing features, and sends the feature completion request to at least some of the multiple participants; The sharing platform receives feature completion data corresponding to the missing features from at least one participant, and uses the feature completion data to complete features of the data to be analyzed.

34. The calling method according to claim 32, wherein: Feature completion for the data to be analyzed includes: Features of the data to be analyzed are completed based on secure multi-party computing.

35. The calling method according to claim 23, wherein: When the caller is a participant, the caller verifies the signature through the blockchain node to call the federated learning model based on the allocated calling rights.

36. The calling method according to claim 23, wherein: The calling permission is the permission to call the federated learning model a preset number of times within a preset time period after passing the watermark verification.

37. The calling method according to claim 23, further comprising: After watermark verification, the model call information is recorded on the blockchain.

38. The calling method according to claim 23, further comprising: When the sharing platform determines that the watermark verification has not been passed, the calling request information is recorded.

39. The calling method according to claim 23, wherein: During the training of the federated learning model, after each training is completed, the model training information of each participant in the multiple participants is saved on the blockchain, and the calling method further includes: After watermark verification, corresponding benefits are distributed to participants who provide fragmented models or encrypted fragmented models for aggregation to generate the federated learning model based on the model training information of the participants recorded on the blockchain.

40. A federated learning system, comprising a sharing platform, the sharing platform comprising: a communication unit, wherein the communication unit is configured to obtain call request information from a caller; a verification unit, the verification unit being configured to perform watermark verification on the data to be verified using a federated learning model according to the call request information, wherein the federated learning model is trained and generated according to the training method according to any one of claims 1 to 22, and the federated learning model is configured to be able to perform watermark verification, wherein the watermark verification identifies whether the data to be verified is watermark verification data having a watermark label, and the data to be verified is distributed among multiple participants; an allocating unit, configured to allocate a calling right of the federated learning model to the caller when the watermark verification is passed; and A model running unit is configured to run the federated learning model to enable the caller to call the federated learning model.

41. The federated learning system according to claim 40, wherein: The sharing platform further includes at least one of the following: a testing unit, configured to test a watermark recognition accuracy of the federated learning model on watermark test data having a watermark label; a key unit, the key unit being configured to generate a matching public key and a private key; as well as A storage unit is configured to store a private key and / or record a watermark recognition accuracy rate.

42. The federated learning system according to claim 40, further comprising: A plurality of participating devices, each of the plurality of participating devices being disposed in a local area of a participant corresponding to the participating device, and each of the plurality of participating devices comprising: a watermarking unit, the watermarking unit being configured to obtain a watermarked training dataset of the participant, wherein the watermarked training dataset includes watermarked training data having a watermark label, a data identifier of the watermarked training data of each participant corresponds to the data identifiers of the watermarked training data of other participants, and the watermarked training data of at least one participant among the plurality of participants includes the watermark label; and A local training unit, configured to perform local training in federated learning training; and An aggregate training unit is provided on the shared platform or at least one participating device among the plurality of participating devices, and the aggregate training unit is configured to perform aggregate training in federated learning training.

43. The federated learning system according to claim 40, further comprising a blockchain having one or more nodes, wherein: The blockchain includes a smart contract for watermark verification, and at least one of model training information and model call information is recorded in the one or more nodes.

44. A non-transitory computer-readable storage medium having computer instructions stored thereon, wherein when the computer instructions are executed by a processor, the steps of the training method according to any one of claims 1 to 22 or the calling method according to any one of claims 23 to 39 are implemented.

45. A computer program product comprising computer instructions, which, when executed by a processor, implement the steps of the training method according to any one of claims 1 to 22 or the calling method according to any one of claims 23 to 39.

Images