Training and calling methods of federated learning models and federated learning systems

Abstract

The embodiments of this specification provide a training method and a calling method of a federated learning model and a federated learning system. The training method includes: obtaining a watermarked training data set of the participant from each of a plurality of participants, wherein the watermarked training data set includes watermarked training data with a watermark label, and training based on the watermarked training data set to generate a local model of the participant; and aggregating the local models of the plurality of participants to generate a federated learning model.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of machine learning technology, and in particular, relate to a training method and a calling method of a federated learning model and a federated learning system. Background Art

[0002] In recent years, research on federated learning has received increasing attention. Federated learning is a machine learning framework in which the data used to train the model can be provided by multiple participants. Federated learning can perform joint modeling without sharing the data of different participants, so that data can be used more effectively while meeting the requirements of user privacy protection, data security, and government regulations. It is understandable that the data of each participant has very important value, and it is also very important to better mine, circulate, and evaluate the value of this data. Therefore, it is necessary to provide an effective solution to better realize and protect the value of data and models. Summary of the invention

[0003] The purpose of the present invention is to provide a training method and a calling method for a federated learning model and a federated learning system to better realize and protect the value of data and models.

[0004] According to a first aspect of one or more embodiments of this specification, a method for training a federated learning model is provided, wherein training data for training the federated learning model is provided by multiple participants, and the training method includes:

[0005] Each of the multiple participants performs the following steps locally:

[0006] Acquire a watermarked training data set of the participant, wherein the watermarked training data set includes watermarked training data having a watermark label; and,

[0007] Performing training based on the watermarked training data set to generate a local model of the participant; and,

[0008] The local models of the multiple participants are aggregated to generate the federated learning model.

[0009] According to a second aspect of one or more embodiments of this specification, a method for calling a federated learning model is provided, wherein the federated learning model is configured to be able to perform watermark verification, and the watermark verification identifies whether the data to be verified is watermark verification data with a watermark tag, and the calling method includes:

[0010] The sharing platform obtains the call request information from the caller;

[0011] The sharing platform performs watermark verification on the data to be verified using the federated learning model according to the call request information; and

[0012] When the sharing platform determines that the number of watermark verification data with watermark labels in the data to be verified is greater than or equal to the preset verification number, it is determined to have passed the watermark verification, and the caller is allocated the calling permission of the federated learning model so that the caller can call the federated learning model.

[0013] According to a third aspect of one or more embodiments of this specification, a federated learning system is provided, including a sharing platform, wherein the sharing platform includes:

[0014] A first communication unit, wherein the first communication unit is configured to obtain call request information from a caller;

[0015] A verification unit, the verification unit is configured to perform watermark verification on the data to be verified using the federated learning model according to the call request information, and the verification unit is further configured to determine that the watermark verification is passed when it is determined that the number of watermark verification data with watermark labels in the data to be verified is greater than or equal to a preset verification number, wherein the federated learning model is configured to be able to perform watermark verification, and the watermark verification identifies whether the data to be verified is watermark verification data with a watermark label;

[0016] an allocating unit, the allocating unit being configured to allocate a calling right of the federated learning model to the caller; and

[0017] A model running unit, wherein the model running unit is configured to run the federated learning model to implement the caller's call to the federated learning model.

[0018] According to a fourth aspect of one or more embodiments of the present specification, a non-transitory computer-readable storage medium is provided, on which computer instructions are stored, and when the computer instructions are executed by a processor, the steps of the training method described above or the calling method described above are implemented.

[0019] According to a fifth aspect of one or more embodiments of the present specification, a computer program product is provided, wherein the computer program product includes computer instructions, and when the computer instructions are executed by a processor, the steps of the training method described above or the calling method described above are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0021] Figure 1 is an architecture diagram of a federated learning system in an embodiment of this specification;

[0022] Figure 2 is an architecture diagram of a federated learning system in another embodiment of this specification;

[0023] Figure 3 is a flowchart of a method for training a federated learning model in an embodiment of this specification;

[0024] Figure 4 is a flowchart of step S110 in the training method of the federated learning model in one embodiment of this specification;

[0025] Figure 5 is a flow chart of aggregating local models of multiple participants based on a horizontal federated learning algorithm in one embodiment of this specification;

[0026] Figure 6 is a flowchart of aggregating local models of multiple participants based on a horizontal federated learning algorithm in another embodiment of this specification;

[0027] Figure 7 is a flowchart of a method for training a federated learning model in another embodiment of this specification;

[0028] Figure 8 is a flowchart of a method for calling a federated learning model in an embodiment of this specification;

[0029] Fig. 9 is a flowchart of step S730 of the method for calling a federated learning model in an embodiment of this specification;

[0030] Fig.10 This is a flowchart of step S730 of a method for calling a federated learning model in another embodiment of this specification. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0032] In order to solve the problems of data value mining, circulation and evaluation in federated learning, one or more embodiments of this specification propose a method for training a federated learning model, a method for calling a federated learning model, a federated learning system, a non-transitory computer-readable storage medium and a computer program product to better protect the value of data and models.

[0033] like Figure 1 and Figure 2 , which is an architecture diagram of a federated learning system. The federated learning system may include a sharing platform 910 and one or more participating devices 920 that are set locally in each of a plurality of participants in a one-to-one correspondence.

[0034] In some embodiments, the shared platform 910 may include a verifiable computing engine (MYTF), which can utilize technologies such as a trusted execution environment (TEE) and a WebAssembly (WASM) virtual machine to allow verifiable computing tasks (e.g., verifiable applications or trusted applications (TAPP)) to be executed in the TEE, while being able to prove to anyone that the computing task is executed in the TEE as the user expects.

[0035] Among them, TEE can be a secure and trusted area in the processor to ensure the security, confidentiality and integrity of the code and data placed therein. TEE provides an isolated execution environment where code and data can run in TEE, and during the operation process, the operation of calculations can be guaranteed without being interfered with by the conventional operating system, thereby ensuring the confidentiality and integrity of the code and data. The code program executed in TEE can be called Enclave. Before using the Enclave program, the user usually needs to measure the code and data of the Enclave program, and undergo remote verification to confirm that the Enclave program is the program that the user expects to be executed.

[0036] The WASM virtual machine is a virtual machine with a stack structure based on binary operation instructions. WASM code can be compiled into machine code and loaded into the WASM virtual machine for execution.

[0037] Among them, TAPP is an application implemented using Verifiable Computation technology, which can be run in MYTF, such as in the WASM virtual machine. Specifically, anyone can upload the WASM bytecode to MYTF and call the WASM bytecode to perform computing tasks and obtain computing results.

[0038] A corresponding participant device 920 may be provided locally at each participant. The participant device 920 may be used to perform local training of the corresponding participant's data, thereby obtaining a local model of the participant.

[0039] Furthermore, the sharing platform 910 or one of the participating devices 920 can obtain the encrypted local encryption models of all participants, and perform ciphertext secure aggregation of these local encryption models to generate an aggregated encryption model. Thereafter, the generated aggregated encryption model can be locally stored on each participating device 920, that is, the training of the federated learning model is realized.

[0040] When a federated learning model is called, the sharing platform 910 can be used to perform watermark verification on the caller. After passing the watermark verification, the sharing platform 910 decrypts the aggregated encrypted model it receives to generate a federated learning model, and runs the federated learning model in the sharing platform 910 based on the assigned calling permissions, thereby providing corresponding services to the caller.

[0041] In some embodiments, the federated learning system may also include a blockchain 930 having one or more nodes 931. Blockchain 930 is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm. In a blockchain system, data blocks can be combined into a chain data structure in a sequential manner in chronological order, and a distributed ledger that cannot be tampered with or forged can be guaranteed by cryptography. In one or more embodiments of this specification, at least part of the information related to the training and calling of the federated learning model can be recorded in the corresponding node 931 of the blockchain 930, thereby providing highly reliable credential information for the circulation and evaluation of data value, and the distribution of corresponding benefits.

[0042] like Figure 3 As shown, in one embodiment of the present specification, a method for training a federated learning model is proposed, wherein the training data for training the federated learning model can be provided by multiple participants. The training method may include each of the multiple participants performing the following steps locally:

[0043] Step S110, obtaining a watermark training data set of the participant, wherein the watermark training data set includes watermark training data having a watermark label.

[0044] In some embodiments, the watermarked training data set may be obtained directly from the participant. Alternatively, in some embodiments, the original training data set provided by the participant may be watermarked to generate a corresponding watermarked training data set.

[0045] like Figure 4 As shown, in some embodiments, step S110 may include:

[0046] Step S111, extracting a second training data set from the first training data set provided by the participant, wherein the second training data set is a non-empty true subset of the first training data set;

[0047] Step S113, generating a third training data set according to the second training data set, wherein the feature portion of each piece of training data in the third training data set is generated by watermarking the feature portion of the corresponding training data in the second training data set, and the label portion of each piece of training data in the third training data set is generated by modifying the label portion of the corresponding training data in the second training data set into a watermark label; and

[0048] Step S115: merge the third training data set and at least a portion of the first training data set into a watermarked training data set of the participant.

[0049] Specifically, the first training data set may include multiple training data, each of which may include a feature part and a corresponding label part. The feature part of the training data may be used as the input of the trained model, and after the model performs a series of calculations on the input, a corresponding output may be generated, and the label part of the training data may be used to compare with the output generated by the model based on the corresponding feature part, so as to adjust the relevant parameters in the trained model according to the comparison result until the model reaches a preset accuracy rate.

[0050] The second training data set extracted from the first training data set may be watermarked to generate a third training data set. In some embodiments, the second training data set may be randomly extracted from the first training data set. Alternatively, in some embodiments, the second training data set may be extracted according to a preset extraction rule.

[0051] Furthermore, performing watermarking on the characteristic portion of each piece of training data in the second training data set to generate the characteristic portion of the corresponding training data in the third training data set may include:

[0052] The noise is superimposed on the characteristic part of the training data in the second training data set, and the superimposed result is used as the characteristic part of the corresponding training data in the third training data set.

[0053] Among them, the dimension of the noise, the dimension of the characteristic part of the training data in the second training data set, and the dimension of the characteristic part of the training data in the third training data set are equal to each other to facilitate superposition. For example, if the characteristic part of a certain training data in the second training data set of a certain participant can be expressed as A2=(ax2, ay2, az2), and the noise superimposed with the characteristic part of the training data can be expressed as N=(nx, ny, nz), then the result of superimposing the characteristic part of the corresponding training data in the third training data set can be expressed as A3=(ax3, ay3, az3)=(ax2+nx, ay2+ny, az2+nz), that is, ax3=ax2+nx, ay3=ay2+ny, and az3=az2+nz. It should be noted that, according to actual needs, the noise superimposed on the characteristic parts of each training data can be the same, partially the same, or different, and there is no limitation here.

[0054] In some embodiments, the noise may include noise generated based on non-training data. Alternatively, the noise may include noise generated based on a image confrontation algorithm (FGSM), etc. Alternatively, the noise may include Gaussian noise, etc., wherein Gaussian noise refers to noise generated randomly, whose noise value conforms to Gaussian distribution, and the noise average of Gaussian noise may be zero.

[0055] In addition, the label part of each training data in the second training data set can be uniformly modified into a watermark label to serve as the label part of the corresponding training data in the third data training set. If the federated learning model is a classification model, the watermark label can be set to a label corresponding to the watermark type, that is, a new classification type label different from the existing classification type label in the non-watermarked model; if the federated learning model is a regression model, the watermark label can be set to a label corresponding to the minimum output value or the maximum output value of the federated learning model to distinguish it from the numerical result that may be output by the non-watermarked model.

[0056] The characteristic part of the training data in the third training data set of a certain participant generated by the watermarking process can be used as the watermark verification data of the participant. As will be described in detail later, in the verification or voting process before the model call, the participant can use the watermark verification data to verify its own legal identity, or use the watermark verification data as a vote to agree to the call request of other callers. Therefore, in order to match the verification or voting rights of each participant with the amount of data contributed in the model training process, among multiple participants, the number of training data in the second training data set of each participant (which is equal to the number of training data in the third training data set) and the number of training data in the first training data set of the participant can be equal to each other. In other words, an equal proportion of data can be extracted from the training data provided by each participant for watermarking. Then, in the verification or voting process described later, the participant who provides more training data can have a larger proportion of verification or voting rights.

[0057] In some embodiments, the ratio of the number of training data in each participant's second training data set to the number of training data in the participant's first training data set can be determined by multiple participants through joint consultation. For example, the above ratio can be in the range of from 5% to 20%. In a specific example, the above ratio can be 10%.

[0058] When the third training data set is merged with at least a portion of the first training data set into a watermarked training data set, in some embodiments, in order to maximize the retention of the training data provided by each participant for model training, the third training data set of a participant may be merged with the complete first training data set provided by the participant, thereby generating a watermarked training data set. Alternatively, in some embodiments, in order to avoid the merged watermarked training data set being too large, which may lead to increased training costs, reduced training efficiency, etc., the third training data set may also be merged with a portion of the first training data set into a watermarked training data set.

[0059] return Figure 3 , each of the multiple participants also performs the following steps locally at that participant:

[0060] Step S130: training based on the watermarked training data set to generate a local model of the participant.

[0061] In the process of model training, the linear / nonlinear model can be fitted by the distribution or label of the data to achieve the effect of approximating the true value. In addition, after the training is completed, the same data can be predicted based on the obtained linear / nonlinear model to obtain the corresponding prediction results. This prediction process can be used for the identity verification of the participants described later. Among them, the local model trained based on the watermarked training data set can identify the watermark verification data, that is, when the watermark verification data is input into the local model, the local model will output the watermark label for verification or voting in subsequent model calls.

[0062] Furthermore, if Figure 3 As shown, the training method may also include:

[0063] Step S300, aggregating the local models of multiple participants to generate a federated learning model.

[0064] Federated learning is a machine learning model proposed by the Google research team in 2016. It is deployed to meet data security laws and can be a distributed machine learning. In federated learning, local data is trained and then securely aggregated in a ciphertext format to produce an aggregated model equivalent to that obtained by training with the full amount of data. Federated learning can include horizontal federated learning, vertical federated learning, and migration federated learning.

[0065] In some embodiments, the local models of multiple participants can be aggregated based on a horizontal federated learning algorithm. Specifically, in horizontal federated learning, the features of the training data can be completely overlapping, but the samples are basically independently distributed and do not overlap with each other. Therefore, the modeling effect of horizontal federated learning depends largely on the sample size of each participant (the number of data in the training data set).

[0066] like Figure 5 As shown, in one embodiment, aggregating local models of multiple participants based on a horizontal federated learning algorithm may include:

[0067] Step S311, selecting a participant from multiple participants as an aggregator;

[0068] Step S313, each of the multiple participants encrypts its local model using its public key to generate a local encrypted model of the participant;

[0069] Step S315, all other participants among the multiple participants who are not the aggregator transmit their local encryption models to the aggregator respectively;

[0070] Step S317, the aggregator aggregates all local encrypted models of multiple participants to generate and store an aggregated encrypted model as an encrypted federated learning model; and

[0071] In step S319, the aggregator returns the aggregated encryption model to all other participants among the multiple participants, so that all other participants can store the aggregated encryption model locally.

[0072] The ciphertext aggregation of the local models of multiple participants can be performed by one of the participants. For security reasons, the participant as the aggregator can be randomly selected. In addition, each other participant does not directly transmit the local model to the aggregator, but transmits the encrypted local encrypted model to the aggregator, and then the aggregator performs the aggregation process. After the aggregation process, each participant can obtain the encrypted aggregated encrypted model from the aggregator. The above aggregation process can well protect the security of data and models and avoid leakage.

[0073] like Figure 6 As shown, in another embodiment, aggregating local models of multiple participants based on a horizontal federated learning algorithm may include:

[0074] Step S331, each of the multiple participants encrypts its local model using its public key to generate a local encrypted model of the participant;

[0075] Step S333, each of the multiple participants transmits its local encrypted model to the sharing platform;

[0076] Step S335, the sharing platform aggregates all local encryption models of multiple participants to generate an aggregated encryption model as an encrypted federated learning model; and

[0077] In step S337, the sharing platform returns the aggregated encryption model to each of the multiple participants, so that each participant can store the aggregated encryption model locally.

[0078] The aggregation of multiple local models can also be performed by the sharing platform. To ensure security, each participant does not directly transmit the local model to the sharing platform, but transmits the encrypted local encrypted model. The sharing platform then aggregates the ciphertext of multiple local encrypted models and returns the generated encrypted aggregated encrypted model to each participant.

[0079] In some embodiments, the public key for encryption and the private key for decryption can be generated by the sharing platform. In addition, in order to improve security, the matching public keys and private keys assigned to multiple participants can be different from each other, that is, a participant does not know the information of the public keys and private keys of other participants. In some embodiments, the sharing platform can distribute the generated public keys to the corresponding participants respectively, so that the participants can use the public keys to encrypt their local models. In addition, the private key that matches the public key and can be used to decrypt the aggregated encryption model can be stored in the sharing platform. In this way, when the federated learning model needs to be used, the received aggregated encryption model can be decrypted using the stored private key in the sharing platform to obtain the federated learning model, and the federated learning model can be run in the sharing platform, thereby avoiding a participant or caller from directly contacting the federated learning model, thereby better ensuring the security of the federated learning model.

[0080] In some embodiments, the matching public key and private key of each participant can be generated based on a homomorphic encryption algorithm. Homomorphic encryption algorithms are a type of encryption algorithm with special natural properties, which can achieve that when the homomorphic encrypted data is processed to obtain an output and then the output is decrypted, the result obtained is the same as the output result obtained by processing the unencrypted original data in the same way. In other words, in addition to realizing basic encryption operations, homomorphic encryption can also realize a variety of calculation functions between ciphertexts, that is, calculation first and then decryption is equivalent to decryption first and then calculation. In this way, during the training process of the federated learning model, although the local model is encrypted and then the aggregated encrypted model is decrypted, the correct federated learning model can still be obtained.

[0081] Furthermore, if Figure 7 As shown, in one embodiment of this specification, the training method may further include:

[0082] Step S500: The sharing platform tests and records the watermark recognition accuracy of the federated learning model for watermark test data with watermark labels.

[0083] Specifically, the sharing platform can test and record the watermark recognition accuracy of the federated learning model based on the watermark test data, and the watermark recognition accuracy can be used in the calling method of the federated learning model described later. In some embodiments, the watermark test data can include a feature portion of the training data in the third training data set of the corresponding participant.

[0084] In the training method of the federated learning model provided in one or more embodiments of the present specification, the federated learning model is trained based on a watermarked training data set with a watermark label, thereby obtaining a federated learning model that can identify watermark verification data, which provides a basis for the mining, circulation and evaluation of the value of data, and helps to better realize and protect the value of data and models.

[0085] In addition, one or more embodiments of the present specification also propose a method for calling a federated learning model, wherein the federated learning model can be configured to be able to perform watermark verification, which can identify whether the data to be verified is watermark verification data with a watermark tag. As described above, the watermark verification data can be a characteristic portion of the corresponding watermark training data. Alternatively, the watermark verification data can be data obtained by other means, such as by performing some conversion calculations on the characteristic portion of the watermark training data. In some embodiments, the training method of the federated learning model as described above can be used to train and generate such a federated learning model. Alternatively, other methods can also be used to obtain such a federated learning model.

[0086] like Figure 8 As shown, in one embodiment of this specification, the method for calling the federated learning model may include:

[0087] Step S710, the sharing platform obtains the call request information from the caller;

[0088] Step S730: the sharing platform uses the federated learning model to perform watermark verification on the data to be verified according to the call request information; and

[0089] Step S750: When the sharing platform determines that the number of watermark verification data with watermark tags in the data to be verified is greater than or equal to the preset verification number, it is determined to have passed the watermark verification, and the caller is allocated the calling authority of the federated learning model so that the caller can call the federated learning model.

[0090] The call request information may include first call request information and second call request information, the first call request information is used to indicate a call request to the federated learning model as a participant, and the second call request information is used to indicate a call request to the federated learning model as a non-participant.

[0091] In one embodiment, if Fig. 9 As shown, when the call request information is the first call request information, the sharing platform may perform watermark verification on the data to be verified by using the federated learning model according to the call request information, which may include:

[0092] Step S731, the sharing platform obtains the aggregated encryption model and the data to be verified from the caller;

[0093] Step S733, the sharing platform uses the private key to decrypt the aggregated encryption model to obtain a federated learning model; and

[0094] In step S735, the sharing platform inputs each piece of data to be verified into the federated learning model to determine whether the data is watermark verification data with a watermark label.

[0095] That is to say, when a call request is initiated as a participant, as long as the caller can pass the participant identity verification, a certain calling permission for the federated learning model can be obtained. In order to perform identity verification, the participant uploads the locally stored aggregated encryption model and the data to be verified provided by the participant to the sharing platform. The data to be verified can be the characteristic part of at least a part of the training data in the third training data set of the participant.

[0096] In some embodiments, the number of data to be verified may be determined by negotiation among multiple participants. For example, the number of data to be verified may be at least half of the number of watermark training data of the participant who provides the smallest watermark training data set among multiple participants, or may be at least half of the number of watermark training data of the participant who issues the first call request information, etc.

[0097] In some embodiments, when the caller is a participant of the model, the caller can verify the signature through the blockchain node to call the federated learning model based on the assigned calling rights. In this way, the call-related information can be recorded on the blockchain to facilitate future inspections and improve the security of the model. In addition, the federated learning model can be run in a shared platform, and the caller can transmit the data to be analyzed to the shared platform, and receive the results output by the federated learning model based on the data to be analyzed from the shared platform. In this way, the caller itself does not directly access the federated learning model in plain text, so that the security of the model can be well guaranteed. In addition, as described above, the sharing platform can be based on MYTF technology, so that the caller can also confirm that the call to the federated learning model is carried out in the way it expects, ensuring the reliability of the output results.

[0098] In another embodiment, if Fig.10 As shown, when the call request information is the second call request information, the sharing platform may perform watermark verification on the data to be verified by using the federated learning model according to the call request information, which may include:

[0099] Step S732, the sharing platform broadcasts the second call request information to multiple participants;

[0100] Step S734, when the sharing platform obtains the aggregated encrypted model from at least one of the multiple participants, the aggregated encrypted model is decrypted using the private key to obtain the federated learning model;

[0101] Step S736, when the sharing platform obtains the data to be verified from at least some of the multiple participants, each piece of data in the data to be verified is input into the federated learning model to determine whether the data is watermark verification data with a watermark label.

[0102] That is to say, when a call request is initiated as a non-participant, the participants of the federated learning model need to use their watermark verification data to vote to verify whether they agree with the call of the caller. The caller can make the participants agree to vote and verify for it by purchasing or other means. Specifically, the sharing platform can broadcast the second call request information to all participants. If the participant agrees to the call, the watermark verification data can be uploaded to the sharing platform for voting verification, otherwise the watermark verification data may not be uploaded. When watermark verification data greater than or equal to the preset verification number is identified, it can be considered that the call has been agreed by the participants, so the caller can call the federated learning model.

[0103] In some embodiments, the sharing platform can obtain the aggregate encryption model from any one or more of the multiple participants. In order to avoid the occupation of resources caused by repeated uploading of the aggregate encryption model, once the sharing platform obtains the available aggregate encryption model from any participant, it can also send a signal to other participants to avoid other participants from repeatedly uploading the aggregate encryption model. Alternatively, in some embodiments, the sharing platform can obtain the aggregate encryption model only from the participant who provides the largest watermarked training data set among multiple participants. In this way, the call to the sharing platform can only continue if the participant who provides the most training data agrees to the call, and if the participant who provides the most training data disagrees with the caller's call, the call cannot proceed, that is, the participant who provides the most training data has greater power in deciding whether to agree to the call.

[0104] In some embodiments, the number of data to be verified may be determined by a joint discussion of multiple participants. For example, the number of data to be verified may be at least half of the total number of watermark training data in the watermark training data sets of multiple participants.

[0105] In some embodiments, when the call request information is the second call request information, the caller calling the federated learning model may include:

[0106] The sharing platform obtains the aggregated encrypted model from at least one of the multiple participants, and decrypts the aggregated encrypted model using a private key to obtain a federated learning model;

[0107] The caller calls the federated learning model based on the assigned calling authority, wherein the federated learning model runs in the shared platform.

[0108] In some embodiments, the sharing platform may obtain the aggregate encryption model from any one or more of the multiple participants. In order to avoid resource occupation caused by repeated uploading of the aggregate encryption model, once the sharing platform obtains an available aggregate encryption model from any participant, it may also send a signal to other participants to avoid other participants from repeatedly uploading the aggregate encryption model. Alternatively, in some embodiments, the sharing platform may also obtain the aggregate encryption model from the participant that provides the largest watermarked training data set among the multiple participants.

[0109] The decryption of the aggregate encryption model and the operation of the generated federated learning model can both be performed on the shared platform, and the caller can upload the data to be analyzed to the shared platform and receive the output results generated by the federated learning model based on the data to be analyzed from the shared platform. In this way, neither the caller nor the participants will have direct access to the federated learning model, which helps to better ensure the security of federated learning. In addition, as mentioned above, the sharing platform can be based on MYTF technology, so that the caller can also confirm that the call to the federated learning model is carried out in the way it expects, ensuring the reliability of the output results.

[0110] In some embodiments, the preset number of verifications can be determined at least based on the watermark recognition accuracy of the federated learning model. For example, if multiple participants agree that at each verification, one or more participants need to provide at least 100 watermark verification data before passing the verification, and the watermark recognition accuracy of the federated learning model obtained by testing is 95%, then the preset number of verifications set can be 100*95%=95, that is, when the federated learning model determines that there are at least 95 watermark verification data with watermark labels in the data to be verified, the watermark verification can be passed.

[0111] In some embodiments, the sharing platform can use smart contracts on the blockchain to perform watermark verification. Smart contracts are computer protocols designed to disseminate, verify or execute contracts in an information-based manner. They allow trusted transactions without a third party. These transactions are traceable and irreversible, thereby improving the reliability and security of verification. In some embodiments, the smart contract can count the watermark verification data with a watermark tag. When the count reaches a preset verification number, it is determined that the watermark verification has passed, and the next call operation can be performed.

[0112] In some embodiments, in order to avoid possible attack risks caused by malicious callers frequently calling the federated learning system, and / or to help realize customizable transactions for calling rights, calling rights can be limited. For example, calling rights can be the right to call the federated learning model a preset number of times within a preset time period after watermark verification. It is understood that calling rights can also have other specific forms. If the call to the federated learning model exceeds the calling rights, the caller who initiates the call as a participant can obtain new calling rights by re-verifying the identity, and the caller who initiates the call as a non-participant can obtain new calling rights by re-purchasing and having the participants vote for verification. It is understandable that the caller can also obtain new calling rights through other agreed methods, which are not limited here.

[0113] In some embodiments, the calling method may further include:

[0114] After passing the watermark verification, the model call information is recorded on the blockchain.

[0115] Specifically, the model call information can be recorded on the blockchain immediately after the watermark verification, or after the call is completed. The model call information can include the identity information of the caller, the call time information, the call number information, etc. In addition, in order to save the storage space in the nodes on the blockchain, the data generated during the call process can be hashed and then stored on the chain.

[0116] In some embodiments, the calling method may further include:

[0117] When the sharing platform determines that the number of watermark verification data with watermark tags in the data to be verified is less than the preset verification number, it is determined that the watermark verification has not passed, and the call request information is recorded.

[0118] By recording the call request information that has not passed the watermark verification, it is convenient to verify the identity of the caller, so as to timely discover potential risks and protect the security of data and models.

[0119] In some embodiments, in order to better distribute the benefits brought by data and models, during the training of the federated learning model, after each training is completed, the training information of each participant among multiple participants can be saved on the blockchain. The training information of the participant may include the corresponding blockchain node identification information (such as node ID) of the participant, the fields of the model involved, etc. In addition, in order to save storage space on the blockchain, the corresponding blockchain node identification information (such as node ID) of the participant, the fields of the model involved, etc. can be hashed and then saved on the chain.

[0120] Accordingly, the calling method may also include:

[0121] After watermark verification, corresponding benefits are allocated to each participant based on the model training information of each participant recorded on the blockchain.

[0122] Based on the calling method of the federated learning model described above, the caller can call the federated learning model. During the calling process, the caller itself does not directly contact the federated learning model, thereby well ensuring the security of the data and model. In addition, the calling method in one or more embodiments of this specification well solves the problem that the plaintext model as an important data asset cannot be freely circulated, so that other callers other than the participants can also call the federated learning model, thereby better mining the value of the data and model, and also helping participants to obtain more benefits under the premise of ensuring data security.

[0123] One or more embodiments of this specification also propose a federated learning system, such as Figure 1 and Figure 2 As shown, the federated learning system may include a sharing platform 910, and the sharing platform 910 may include:

[0124] The first communication unit 911 may be configured to obtain call request information from a caller;

[0125] The verification unit 912 may be configured to perform watermark verification on the data to be verified using a federated learning model according to the call request information. The verification unit 912 may also be configured to determine that the watermark verification has been passed when it is determined that the number of watermark verification data with a watermark tag in the data to be verified is greater than or equal to a preset verification number, wherein the federated learning model is configured to be able to perform watermark verification, and the watermark verification identifies whether the data to be verified is watermark verification data with a watermark tag;

[0126] The allocating unit 913 may be configured to allocate the calling right of the federated learning model to the caller; and

[0127] The model running unit 914 may be configured to run the federated learning model to enable the caller to call the federated learning model.

[0128] Furthermore, if Figure 1 and Figure 2 As shown, the sharing platform may further include at least one of the following:

[0129] A testing unit 915 may be configured to test the watermark recognition accuracy of the federated learning model on watermark test data having a watermark label;

[0130] The key unit 916 may be configured to generate a public key for encrypting the local model to generate a local encrypted model, and a private key matching the public key and used to decrypt the aggregate encrypted model to generate a federated learning model; and

[0131] The storage unit 917 may be configured to store a private key and / or record a watermark recognition accuracy rate.

[0132] like Figure 1 and Figure 2 As shown, the federated learning system may further include a plurality of participating devices 920, each of the plurality of participating devices 920 being arranged in a one-to-one correspondence at a local location of a participant corresponding to the participating device 920, and each of the plurality of participating devices 920 may include:

[0133] The second communication unit 921 may be configured to obtain a watermarked training data set of the participant, wherein the watermarked training data set includes watermarked training data having a watermark label; and,

[0134] The local training unit 922 may be configured to perform training based on the watermarked training data set to generate a local model of the participant.

[0135] In addition, the federated learning system may further include an aggregation unit 940, such as Figure 1 As shown, it can be set on at least one participating device 920 among the plurality of participating devices 920, or as shown in Figure 2 As shown, it can be set on the sharing platform 910, and the aggregation unit 940 can be configured to aggregate the local models of multiple participants to generate a federated learning model.

[0136] Furthermore, if Figure 1 and Figure 2 As shown, the federated learning system may also include a blockchain 930 having one or more nodes 931, wherein the blockchain 930 may include a smart contract for watermark verification, and at least one of model training information and model call information may be recorded in one or more nodes 931.

[0137] One or more embodiments of the present specification also propose a non-transitory computer-readable storage medium, on which computer instructions may be stored. When the computer instructions are executed by a processor, the steps of the training method or calling method of the federated learning model as described above may be implemented.

[0138] The non-transitory computer-readable storage medium in one or more embodiments of the present specification may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. It should be noted that the computer-readable storage medium described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0139] One or more embodiments of the present specification also propose a computer program product, which may include instructions that, when executed by a processor, can implement the steps of the training method or calling method of the federated learning model as described above.

[0140] Instructions may be any set of instructions to be executed directly by one or more processors, such as machine code, or any set of instructions to be executed indirectly, such as a script. The terms "instructions," "application," "process," "step," and "program" herein may be used interchangeably herein. Instructions may be stored in an object code format for direct processing by one or more processors, or as a script or collection of independent source code modules in any other computer language, including those interpreted on demand or compiled in advance. Instructions may include instructions that cause one or more processors, such as to act as the various neural networks herein. The functions, methods, and routines of the instructions are explained in more detail elsewhere herein.

[0141] In one or more embodiments of the present specification, a federated learning model capable of identifying watermark verification data with a watermark tag can be generated based on a watermarked training data set; in the process of calling the federated learning model, the watermark verification data can be used to verify the identity of the caller or the voting verification of the participant, and the federated learning model can be run in a shared platform after passing the watermark verification, so as to avoid the participants or callers from directly contacting the plaintext federated learning model, thereby avoiding the leakage of information that may cause security risks and ensuring the security of data and models. The free circulation of the model is achieved, which helps to fully explore and release the value of the data and provide more benefits for the owners of the data and models. In addition, information related to the training and calling of the model can be stored on the blockchain, thereby ensuring the legitimacy and reliability of the transaction. Accordingly, the federated learning model trained by multiple participants can be regarded as a non-fungible token (NFT) and circulated according to the corresponding transaction rules on the blockchain.

[0142] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0143] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0144] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0145] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0146] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0147] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0149] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0150] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0151] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0152] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0153] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0154] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0155] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0156] The above description is only an example of one or more embodiments of this specification and is not intended to limit one or more embodiments of this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included in the scope of the claims.

Claims

1. A method for training a federated learning model, wherein: The training data for training the federated learning model is provided by multiple participants, and the training method includes: Each of the multiple participants performs the following steps locally: Acquire a watermarked training data set of the participant, wherein the watermarked training data set includes watermarked training data having a watermark label; and Performing training based on the watermarked training data set to generate a local model of the participant; and The local models of the multiple participants are aggregated to generate the federated learning model, wherein the federated learning model has the ability to identify watermark verification data with watermark labels for subsequent model verification and calling.

2. The training method according to claim 1, wherein: Obtaining the watermarked training dataset of the participant includes: Extracting a second training data set from the first training data set provided by the participant, wherein the second training data set is a non-empty proper subset of the first training data set; generating a third training data set according to the second training data set, wherein a feature portion of each piece of training data in the third training data set is generated by watermarking the feature portion of the corresponding training data in the second training data set, and a label portion of each piece of training data in the third training data set is generated by modifying the label portion of the corresponding training data in the second training data set into a watermark label; and The third training data set is combined with at least a portion of the first training data set to form a watermarked training data set for the participant.

3. The training method according to claim 2, wherein: Among the plurality of participants, a ratio of the number of training data in the second training data set of each participant to the number of training data in the first training data set of the participant is equal to each other.

4. The training method according to claim 2, wherein: The ratio of the number of training data in the second training data set of each participant to the number of training data in the first training data set of the participant is in the range from 5% to 20%.

5. The training method according to claim 2, wherein: The ratio of the number of training data in the second training data set of each participant to the number of training data in the first training data set of the participant is 10%.

6. The training method according to claim 2, wherein: The second training data set is randomly extracted from the first training data set.

7. The training method according to claim 2, wherein: The characteristic part of each piece of training data in the third training data set is generated by performing watermarking processing on the characteristic part of the corresponding training data in the second training data set, including: superimposing the noise with the characteristic part of the training data in the second training data set, and using the superimposed result as the characteristic part of the corresponding training data in the third training data set; The dimension of the noise, the dimension of the characteristic part of the training data in the second training data set, and the dimension of the characteristic part of the training data in the third training data set are equal to each other.

8. The training method according to claim 7, wherein: The noise includes noise generated based on non-training data; or The noise includes noise generated by an image adversarial algorithm; or Noise includes Gaussian noise.

9. The training method according to claim 1, wherein: When the federated learning model is a classification model, the watermark label is set to a label corresponding to the watermark type.

10. The training method according to claim 1, wherein: When the federated learning model is a regression model, the watermark label is set to a label corresponding to a minimum output value or a maximum output value of the federated learning model.

11. The training method according to claim 1, wherein: Aggregating the local models of the multiple participants to generate the federated learning model includes: The local models of the multiple participants are aggregated based on a horizontal federated learning algorithm.

12. The training method according to claim 11, wherein: The local models for aggregating the multiple participants based on the horizontal federated learning algorithm include: selecting a participant from the plurality of participants as an aggregator; Each of the multiple participants encrypts its local model using its public key to generate a local encrypted model of the participant; All other participants among the plurality of participants that are not the aggregator transmit their local encryption models to the aggregator respectively; The aggregator aggregates all local encrypted models of the multiple participants to generate and store an aggregated encrypted model as an encrypted federated learning model; and The aggregator returns the aggregated encryption model to all other participants among the multiple participants, so that all other participants can store the aggregated encryption model locally.

13. The training method according to claim 12, wherein: The aggregator is randomly selected from the plurality of participants.

14. The training method according to claim 11, wherein: The local models for aggregating the multiple participants based on the horizontal federated learning algorithm include: Each of the multiple participants encrypts its local model using its public key to generate a local encrypted model of the participant; Each of the plurality of participants transmits its local encrypted model to the sharing platform; The sharing platform aggregates all local encrypted models of the multiple participants to generate an aggregated encrypted model that is an encrypted federated learning model; and The sharing platform returns the aggregated encryption model to each of the multiple participants, so that each participant can store the aggregated encryption model locally.

15. The training method according to claim 12 or 14, wherein: The matching public key and private key of each participant are generated by the sharing platform, and the public key is transmitted to the corresponding participant by the sharing platform, and the private key is stored in the sharing platform.

16. The training method according to claim 12 or 14, wherein: Each participant's matching public and private keys are generated based on a homomorphic encryption algorithm.

17. The training method according to claim 1, after generating the federated learning model, the training method further comprises: The sharing platform tests and records the watermark recognition accuracy of the federated learning model for watermark test data with watermark labels.

18. A method for calling a federated learning model, wherein: The federated learning model is generated by training according to any one of the training methods of claims 1 to 17, the federated learning model is configured to be able to perform watermark verification, the watermark verification identifies whether the data to be verified is watermark verification data with a watermark label, and the calling method includes: The sharing platform obtains the call request information from the caller; The sharing platform performs watermark verification on the data to be verified by using the federated learning model according to the call request information; and When the sharing platform determines that the number of watermark verification data with watermark labels in the data to be verified is greater than or equal to the preset verification number, it is determined to have passed the watermark verification, and the caller is allocated the calling authority of the federated learning model so that the caller can call the federated learning model.

19. The calling method according to claim 18, wherein: The watermark verification data is the characteristic part of the corresponding watermark training data.

20. The calling method according to claim 18, wherein: When the caller requests to call the federated learning model as a participant, the call request information is the first call request information.

21. The calling method according to claim 20, wherein: When the call request information is the first call request information, the sharing platform uses the federated learning model to perform watermark verification on the data to be verified according to the call request information, including: The sharing platform obtains the aggregated encryption model and the data to be verified from the caller; The sharing platform decrypts the aggregate encryption model using a private key to obtain a federated learning model; and The sharing platform inputs each piece of data in the data to be verified into the federated learning model to determine whether the data is watermark verification data with a watermark label.

22. The calling method according to claim 20, wherein: The number of data to be verified is at least half the number of watermarked training data of a participant among the plurality of participants who provides a smallest watermarked training data set.

23. The calling method according to claim 20, wherein: The caller calling the federated learning model includes: The caller verifies the signature through a blockchain node to call the federated learning model based on the allocated calling rights, wherein the federated learning model runs in the shared platform.

24. The calling method according to claim 18, wherein: When the caller requests to call the federated learning model as a non-participant, the call request information is second call request information.

25. The calling method according to claim 24, wherein: When the call request information is the second call request information, the sharing platform uses the federated learning model to perform watermark verification on the data to be verified according to the call request information, including: The sharing platform broadcasts the second call request information to the multiple participants; When the sharing platform obtains the aggregated encrypted model from at least one of the multiple participants, decrypting the aggregated encrypted model using a private key to obtain a federated learning model; When the sharing platform obtains the data to be verified from at least some of the multiple participants, each piece of data in the data to be verified is input into the federated learning model to determine whether the data is watermark verification data with a watermark label.

26. The calling method according to claim 25, wherein: The sharing platform obtains the aggregated encryption model only from the participant providing the largest watermarked training data set among the multiple participants.

27. The calling method according to claim 25, wherein: The number of data to be verified is at least half of the total number of watermark training data in the watermark training data sets provided by the multiple participants.

28. The calling method according to claim 24, wherein: The caller calling the federated learning model includes: The sharing platform obtains an aggregated encrypted model from at least one of the multiple participants, and decrypts the aggregated encrypted model using a private key to obtain a federated learning model; The caller calls the federated learning model based on the allocated calling authority, wherein the federated learning model runs in the shared platform.

29. The calling method according to claim 18, wherein: The preset verification number is determined at least according to the watermark recognition accuracy of the federated learning model.

30. The calling method according to claim 18, wherein: The sharing platform uses the federated learning model to perform watermark verification on the data to be verified according to the call request information, including: The sharing platform uses smart contracts on the blockchain to perform watermark verification.

31. The calling method according to claim 18, wherein: The calling authority is the authority to call the federated learning model a preset number of times within a preset time period after passing the watermark verification.

32. The calling method according to claim 18, further comprising: After passing the watermark verification, the model call information is recorded on the blockchain.

33. The calling method according to claim 18, further comprising: When the sharing platform determines that the number of watermark verification data with watermark tags in the data to be verified is less than the preset verification number, it is determined that the watermark verification has not passed, and the call request information is recorded.

34. The calling method according to claim 18, wherein: During the training of the federated learning model, after each training is completed, the model training information of each of the multiple participants is saved on the blockchain, and the calling method further includes: After watermark verification, corresponding benefits are allocated to each participant based on the model training information of each participant recorded on the blockchain.

35. A federated learning system, comprising a sharing platform, wherein the sharing platform comprises: A first communication unit, wherein the first communication unit is configured to obtain call request information from a caller; a verification unit, the verification unit being configured to perform watermark verification on the data to be verified using a federated learning model according to the call request information, the verification unit being further configured to determine that the watermark verification is passed when it is determined that the number of watermark verification data with a watermark label in the data to be verified is greater than or equal to a preset verification number, wherein the federated learning model is trained and generated according to the training method according to any one of claims 1 to 17, the federated learning model being configured to be able to perform watermark verification, the watermark verification identifying whether the data to be verified is watermark verification data with a watermark label; an allocating unit, the allocating unit being configured to allocate a calling right of the federated learning model to the caller; and A model running unit, wherein the model running unit is configured to run the federated learning model to implement the caller's call to the federated learning model.

36. The federated learning system according to claim 35, wherein the sharing platform further comprises at least one of the following: A testing unit, the testing unit being configured to test the watermark recognition accuracy of the federated learning model on watermark test data having a watermark label; A key unit configured to generate a public key for encrypting a local model to generate a local encrypted model, and a private key matching the public key and used to decrypt the aggregate encrypted model to generate the federated learning model; as well as A storage unit, wherein the storage unit is configured to store a private key and / or record a watermark recognition accuracy rate.

37. The federated learning system according to claim 35, further comprising: A plurality of participating devices, each of the plurality of participating devices is arranged in a one-to-one correspondence at a local location of a participant corresponding to the participating device, and each of the plurality of participating devices comprises: A second communication unit, the second communication unit is configured to obtain a watermarked training data set of the participant, wherein the watermarked training data set includes watermarked training data having a watermark label; and A local training unit, the local training unit being configured to perform training based on the watermarked training data set to generate a local model of the participant; and An aggregation unit is provided on the shared platform or at least one participating device among the plurality of participating devices, and is configured to aggregate the local models of the plurality of participants to generate the federated learning model.

38. The federated learning system according to claim 35, further comprising a blockchain having one or more nodes, wherein: The blockchain includes a smart contract for watermark verification, and at least one of model training information and model calling information is recorded in the one or more nodes.

39. A non-transitory computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed by a processor, implement the steps of the training method according to any one of claims 1 to 17 or the calling method according to any one of claims 18 to 34.

40. A computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the training method according to any one of claims 1 to 17 or the calling method according to any one of claims 18 to 34.

Images