Model training method, device, medium and program product based on federated learning

Abstract

This application discloses a model training method, device, medium, and program product based on federated learning, belonging to the field of federated learning. The method includes: a first participant performing forward computation based on first model weights, encrypted second model weights, and first training samples to generate a first gradient multiplier operator; sending the first gradient multiplier operator to a second participant; the second participant performing forward computation based on third model weights, encrypted fourth model weights, and the second training samples to generate a second gradient multiplier operator; the second participant generating gradient multipliers based on sample labels, the first gradient multiplier operator, and the second gradient multiplier operator; sending encrypted gradient multipliers to the first participant; the second participant performing backward computation based on the gradient multipliers to update the third model weights; and the first participant performing backward computation based on the encrypted gradient multipliers to update the encrypted second model weights. This method can improve the security of model training and prevent data leakage.

Description

Technical Field

[0001] This application relates to the field of federated learning technology, and in particular to a model training method, device, medium, and program product based on federated learning. Background Technology

[0002] In the era of artificial intelligence, obtaining machine learning models, especially deep learning models, requires a large amount of training data as a prerequisite. However, in many business scenarios, the training data for these models is often scattered across different business teams, departments, and even different companies. Due to user privacy concerns, this data cannot be used directly, forming so-called "data silos." Federated learning, on the other hand, enables multiple parties to participate in the same model training task, allowing model training to be performed without leaving the database, thus breaking down these "data silos."

[0003] In related technologies, each participant in federated learning uses sample data with the same sample identifier to train the model. One party also has sample labels. The participant with sample labels is responsible for calculating the gradient multipliers of the model based on the encrypted model calculation results of each party and sending them to the other participants. Each participant updates its own model based on the gradient multipliers.

[0004] However, even when other participants possess the model gradient, they can still infer sample labels through multiple rounds of iterative training, leading to data leakage. Summary of the Invention

[0005] This application provides a model training method, device, medium, and program product based on federated learning, which can improve the security of model training through federated learning and avoid data leakage. The technical solution is as follows:

[0006] On one hand, embodiments of this application provide a model training method based on federated learning. This method is used in a federated learning system, which includes a first participant and a second participant, the second participant possessing sample labels. The method includes:

[0007] The first participant performs forward computation based on the first model weights, the second model weight ciphertext, and the first training sample to generate a first gradient multiplier operator; the first gradient multiplier operator is sent to the second participant, and the second model weight ciphertext is initialized and encrypted by the second participant.

[0008] The second participant performs forward computation based on the third model weights, the fourth model weight ciphertext, and the second training samples to generate the second gradient multiplier operator. The fourth model weight ciphertext is initialized and encrypted by the first participant.

[0009] The second participant generates a gradient multiplier based on the sample label, the first gradient multiplier operator, and the second gradient multiplier operator; and sends the gradient multiplier ciphertext to the first participant, wherein the gradient multiplier is the derivative of the loss function with respect to the model calculation result;

[0010] The second participant performs reverse calculation based on the gradient multiplier to update the weights of the third model;

[0011] The first participant performs reverse calculation based on the gradient multiplier ciphertext and updates the second model weight ciphertext.

[0012] On the other hand, embodiments of this application provide a model training apparatus based on federated learning. The apparatus is used in a federated learning system, which includes a first participant and a second participant, the second participant possessing sample labels. The apparatus includes:

[0013] The first participant module is used to perform forward computation based on the first model weights, the second model weight ciphertext, and the first training sample to generate a first gradient multiplier operator; and to send the first gradient multiplier operator to the second participant, wherein the second model weight ciphertext is initialized and encrypted by the second participant.

[0014] The second participant module is used to perform forward computation based on the third model weights, the fourth model weight ciphertext, and the second training samples to generate the second gradient multiplier operator. The fourth model weight ciphertext is initialized and encrypted by the first participant module.

[0015] The second participant module is further configured to generate a gradient multiplier based on the sample label, the first gradient multiplier operator, and the second gradient multiplier operator; and send the gradient multiplier ciphertext to the first participant, wherein the gradient multiplier is the derivative of the loss function with respect to the model calculation result;

[0016] The second participant module is also used to perform reverse calculation based on the gradient multiplier to update the weights of the third model;

[0017] The first participating module is also used to perform reverse calculation based on the gradient multiplier ciphertext to update the second model weight ciphertext.

[0018] On the other hand, embodiments of this application provide a computer device, the computer device including a processor and a memory; the memory stores at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the federated learning-based model training method as described above.

[0019] On the other hand, embodiments of this application provide a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the federated learning-based model training method as described above.

[0020] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform a federated learning-based model training method provided in various alternative implementations of the above aspect.

[0021] The technical solutions provided in this application have at least the following beneficial effects:

[0022] In this embodiment, the second participant calculates the model gradient multiplier based on the first and second gradient multiplier operators, and sends the encrypted gradient multiplier to the first participant. This ensures that the first participant always updates the encrypted model weights with the encrypted gradient multiplier. Therefore, the first participant cannot independently calculate its own model prediction results, nor can it calculate the gradient of its own complete model. Consequently, the first participant cannot accumulate model gradients through multiple rounds of training to deduce the sample labels of the second participant, thus improving the security of model training through federated learning and preventing data leakage. Attached Figure Description

[0023] Figure 1 This is a flowchart of a model training method in related technologies;

[0024] Figure 2 This is a flowchart of another model training method in related technologies;

[0025] Figure 3 This is a schematic diagram of an implementation environment provided by an exemplary embodiment of this application;

[0026] Figure 4 This is a flowchart of a federated learning-based model training method provided in an exemplary embodiment of this application;

[0027] Figure 5 This is a flowchart of a model training method based on federated learning provided in another exemplary embodiment of this application;

[0028] Figure 6 This is a schematic diagram of a first improvement scheme provided in an exemplary embodiment of this application;

[0029] Figure 7This is a schematic diagram of a second improvement scheme provided in an exemplary embodiment of this application;

[0030] Figure 8 This is a flowchart of a model training method based on federated learning provided in another exemplary embodiment of this application;

[0031] Figure 9 This is a schematic diagram of a third improvement scheme provided in an exemplary embodiment of this application;

[0032] Figure 10 This is a schematic diagram of a fourth improvement scheme provided in an exemplary embodiment of this application;

[0033] Figure 11 This is a structural block diagram of a federated learning-based model training apparatus provided in an exemplary embodiment of this application;

[0034] Figure 12 This is a structural block diagram of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0036] In this article, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0037] First, the important terms and algorithms in this application will be introduced.

[0038] Federated learning combines data from multiple stakeholders to train machine learning models and provide model inference services, ensuring data remains within its own domain. While protecting user privacy and data security, federated learning can fully leverage the data sources of multiple stakeholders to improve the performance of machine learning models. It enables cross-departmental, cross-company, and even cross-industry data collaboration while meeting data protection laws and regulations. Federated learning can be divided into three categories: Horizontal Federated Learning, Vertical Federated Learning, and Federated Transfer Learning.

[0039] Vertical federated learning is a type of federated learning used when there is significant overlap in the training sample identifiers (Identity Documents, IDs) of participants, but minimal overlap in their data features. For example, a bank and an e-commerce platform in the same region might possess different feature data about the same customer, A; the bank might have customer A's financial data, while the e-commerce platform might have customer A's shopping data. The term "vertical" comes from the "vertical partitioning" of the data. It involves combining different feature data from user samples that have overlap between two or more participants for federated learning, meaning that the training samples of each participant are vertically partitioned. The method provided in this application is primarily applied to model training based on vertical federated learning.

[0040] Encryption: Given a value (plaintext) V, use the public key to perform encryption to obtain the ciphertext, that is, Enc(V,pk)→[V], where pk is the public key.

[0041] Decryption: Given a ciphertext [V], use the private key to decrypt and restore the value (plaintext), that is, Dec([V], sk) → V, where sk is the private key.

[0042] Homomorphic addition: Given two ciphertexts [U] and [V], a new ciphertext is obtained through homomorphic addition, i.e. It satisfies Dec([W],sk)→W and W=U+V.

[0043] Scalar addition: Given a ciphertext [U] and a plaintext V, a new ciphertext is obtained through scalar addition, i.e. It satisfies Dec([W],sk)→W and W=U+V. It is worth noting that, in most cases, scalar addition is achieved through a cryptographic operation Enc(V,pk)→[V] and a homomorphic addition operation. To complete.

[0044] Scalar multiplication: Given a ciphertext [U] and a plaintext V, a new ciphertext is obtained through scalar multiplication, i.e. It satisfies Dec([W],sk)→W and W=U×V.

[0045] Encryption / Decryption: Assume there is a matrix Let [M] be a matrix consisting of multiple ciphertexts, where each ciphertext is the ciphertext of the value at a corresponding position in M. In other words, the ciphertext of M in the i-th row and j-th column is [M]. (ij) =Enc(M (ij) ,pk); Symmetric, we can use the private key sk to decrypt [M] and obtain the plaintext matrix M.

[0046] Matrix addition: If there are Let [M3] = [M1] + M2 be the matrix multiplication in the ciphertext space, where [M3] is calculated in the ciphertext at the i-th row and j-th column as follows:

[0047] Matrix multiplication: If there is Then [M3] = [M1]M2 is denoted as matrix multiplication in the ciphertext space, where [M3] is calculated in the ciphertext at the i-th row and j-th column as follows: For ease of description, [V] will be used from now on. A This represents the ciphertext [V] obtained by encrypting V using participant A's public key pkA. A Decryption must be performed using participant A's private key skA; correspondingly, [V] B This indicates that the ciphertext encrypted with participant B's public key pkB must be decrypted with participant B's private key skB. [V] is used when describing any participant. * To express.

[0048] The computational objective of the longitudinal federated logistic regression algorithm: Logistic regression is a commonly used machine learning algorithm. Assuming the input feature dimensions of participant A and participant B are INA and INB respectively, and the output dimension of the logistic regression is OUT = 1, the logistic regression models for both parties in this embodiment are... R is a real number, and we assume that the input training samples are as follows: Where BS is short for BatchSize, the objectives of the forward and backward computations of logistic regression are as follows.

[0049] Forward computation: Two participants sample mini-batch data, where participant A samples mini-batch feature X. A Participant B samples small batch features X B And label y. The two parties jointly calculate... Participant B ultimately obtains the plaintext information of Z, while participant A does not. Participant B uses the sigmoid function to calculate the model's predicted value.

[0050] Reverse calculation: Participant B calculates based on label y and probability value. Calculate gradient multipliers The two participants update the model respectively. in η is the model gradient, and η is the step size of gradient descent, also known as the learning rate.

[0051] In the era of artificial intelligence, obtaining machine learning models, especially deep learning models, requires a large amount of training data as a prerequisite. However, in many business scenarios, the training data for these models is often scattered across different business teams, departments, or even different companies. Due to user privacy concerns, this data cannot be used directly, forming so-called "data silos." In the past two years, federated learning technology has developed rapidly, providing a new solution for cross-team data collaboration and breaking down "data silos," and is beginning to move from theoretical research to the stage of large-scale application.

[0052] One of the core differences between federated learning and ordinary machine learning tasks lies in the fact that the training participants change from one party to two or even more. Federated learning completes the model training task by having multiple parties participate together, without leaving the data repository and protecting data privacy, thus breaking down "data silos." For example, in a two-party vertical federated learning model, participant A (e.g., an advertising company) and participant B (e.g., a social network platform) collaborate to jointly train one or more personalized recommendation models based on deep learning. Participant A possesses some data features, such as (X1, X2, ..., X40), a total of 40 dimensions; while participant B possesses another set of data features, such as (X41, X42, ..., X100), a total of 60 dimensions. By combining the features of participants A and B, they possess even more data features; for example, the combined features of A and B could reach 100 dimensions, significantly expanding the feature dimensions of the training data. For supervised deep learning, participant A and / or participant B also possess the label information Y of the training data.

[0053] Therefore, a core issue lies in how to coordinate two or more parties to complete a model training task. This coordination method is called a "federated algorithm protocol." When two or more parties participate in a training task, each party operates according to a pre-defined algorithm protocol, thereby ensuring the correct operation of the algorithm. However, existing federated algorithm protocols require multiple rounds of communication and interaction between the participants, which limits their efficiency.

[0054] Two model training methods based on longitudinal federated learning have been proposed in related technologies.

[0055] The first option is as follows: Figure 1 As shown. Step 1: Each of the two participants samples a mini-batch of training data, i.e., X. A and X B Step 2: The two participants calculate Z respectively. A Z BParticipant A sends ZA to Participant B. Step 3: Participant B calculates Z and uses the sigmoid function to calculate the predicted value. Step 4: Participant B calculates the gradient multiplier, encrypts it, and sends it to Participant A. Step 5: Participant A calculates the gradient multiplier based on the generated random number and the homomorphic property. It is then sent to participant B, who receives and decrypts it to obtain... Step 6: Participant B will Send to participant A. Step 7: Both participants update their own models. It can be seen that in this scheme, participant A possesses its own plaintext model weights, i.e. Although this allows for independent calculation of one's own predicted output, i.e. This could lead to the leakage of participant B's label.

[0056] The second option is as follows: Figure 2 As shown. Step 1: Each of the two participants samples a mini-batch of training data, i.e., X. A and X B Step 2: Symmetrically, each participant generates noise ε. * Calculate and send [X] A R A +ε A ] B or [X] B R B +ε B ] A Receive and decrypt the ciphertext sent by the other party. Step 3: Symmetrically, each participant calculates Z. * 'Party A will Z' A Step 4: Participant B calculates Z and uses the sigmoid function to calculate the predicted value. Step 5: Participant B calculates the gradient multiplier, encrypts it, and sends it to Participant A. Step 6: Participant A calculates the gradient multiplier based on the generated random number φ and the homomorphic property. And send it to participant B. After receiving it, participant B decrypts it to obtain... Step 6: Participant B will... Send to participant A. Step 7: Both participants update their own models. Note: As described in red text in the lower left corner of the image above, although both parties only update one secret of the model, since the other secret of the model is fixed, this is different from updating the model. They are equivalent. It can be seen that, compared to the first scheme, participant A cannot possess its own plaintext model weights, i.e. Therefore, it is impossible to independently calculate one's own predicted output, i.e. However, since participant A obtained its own plaintext model gradient, i.e. After multiple training iterations, participant A can still infer participant B's label based on the accumulated model gradient, causing data leakage.

[0057] To address the technical problems of the two aforementioned solutions, this application provides a model training method based on federated learning. During the training or inference process of two-party longitudinal logistic regression, such as during initialization, forward computation, and backward propagation, data privacy of the participants is guaranteed through homomorphic encryption and secret sharing techniques. Specifically, compared to related solutions, the technical solution of this application further protects the model weights and gradients of participant A and the label information y of participant B, thereby improving the security of the algorithm protocol.

[0058] Figure 3 This diagram illustrates an implementation environment provided by one embodiment of the present application. The vertical federated learning system includes two node devices (also called participants), namely node device P1 and node device P2. Either node device can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The two node devices possess different data sources, such as data sources from different companies or data sources from different departments within the same company. Different node devices are responsible for iteratively training different components (also called sub-models) of the federated learning model.

[0059] One of the node devices P1 or P2 stores the sample labels corresponding to the training samples. The node device possessing the sample labels corresponds to the second participant in this application. The first participant possesses a homomorphically encrypted private key skA and a public key pkA, while the second participant possesses the public key pkA. The first participant will not disclose the private key skA to the second participant. Correspondingly, the second participant possesses a homomorphically encrypted private key skB and a public key pkB, while the first participant possesses the public key pkB. The second participant will not disclose the private key skB to the first participant. The public key is used to encrypt the model and intermediate computation results during model training or inference.

[0060] Different node devices are connected via wireless or wired networks.

[0061] In one possible implementation, the node devices in the above-mentioned federated learning system can form a blockchain, and the node devices are nodes on the blockchain. The data involved in the model training process can be stored on the blockchain.

[0062] Please refer to Figure 4 This document illustrates a flowchart of a federated learning-based model training method provided in an exemplary embodiment of this application. This embodiment uses the method in a federated learning system as an example, which includes a first participant and a second participant, the second participant possessing sample labels. The method includes the following steps:

[0063] Step 401: The first participant performs forward computation based on the first model weights, the second model weights ciphertext, and the first training sample to generate the first gradient multiplier operator.

[0064] In one possible implementation, before the participants perform iterative model training, both parties jointly compute model initialization to generate the model weights. During the model initialization phase, the first participant is responsible for generating the first model weights W. A and the fourth model weights R B The second participant is responsible for generating the second model weights R. A and the third model weights W B The two parties exchange data, and the first participant assigns weights R to the fourth model. B Encryption is performed to generate the fourth model weight ciphertext [R] B ] A And send the fourth model weight ciphertext [R] to the second participant. B ] A The second participant's weights R in the second model A Encryption is performed to generate the second model weight ciphertext [R] A ] B And send the second model weight ciphertext [R] to the first participant. A ] B Among them, [X] A This represents the ciphertext of X, and the key exists in the hands of the first participant (Participant A), meaning that the plaintext X can only be decrypted using the private key of the first participant; [X] B This represents the ciphertext of X, and the key exists in the hands of a second participant (participant B), meaning that the plaintext X can only be obtained by decrypting it using the private key of the second participant.

[0065] Therefore, both parties possess a portion of the plaintext weights of their own model and a portion of the ciphertext weights of their own model, but cannot obtain the plaintext weights of their complete model.

[0066] During the forward computation phase, the first participant, based on a homomorphic encryption algorithm, adjusts the weights W of the first model.A Second model weight ciphertext [R] A ] B and the first training sample X A Perform forward computation to generate the first gradient multiplier operator Z. A '. Among them, the first gradient multiplier operator Z A ' is the operator used to calculate the gradient multiplier ▽Z of the joint model, where the joint model refers to the joint model of the first participant and the second participant, which is composed of the above four parts of model weights. The gradient multiplier ▽Z refers to the derivative of the model loss function with respect to the model calculation result Z in the logistic regression algorithm. The gradient multiplier ▽Z is used to calculate the model gradient to update the model weights.

[0067] Step 402: The first participant sends the first gradient multiplier operator to the second participant.

[0068] The second model weight ciphertext is initialized and encrypted by the second participant.

[0069] In one possible implementation, the participant possessing the sample labels is responsible for calculating the gradient multipliers to prevent sample label leakage. In this embodiment, the second participant possesses the sample labels; therefore, after the first participant calculates the first gradient multiplier operator, it sends the first gradient multiplier operator to the second participant. Since the first gradient multiplier operator is the result of operations on multiple data such as the first model weights, the encrypted second model weights, and the first training samples, the second participant cannot obtain the first model weights, the encrypted second model weights, or the first training samples individually.

[0070] Step 403: The second participant performs forward computation based on the third model weights, the fourth model weights ciphertext, and the second training samples to generate the second gradient multiplier operator.

[0071] The fourth model weight ciphertext is initialized and encrypted by the first participant.

[0072] When the second participant receives the fourth model weight ciphertext [R] sent by the first participant... B ] A Subsequently, the second participant, based on the homomorphic encryption algorithm, performs forward computation on the ciphertext of the third model weights, the fourth model weights, and the second training samples to generate the second gradient multiplier operator Z. B '. Among them, the second gradient multiplier operator Z B ' is the operator used to compute the gradient multiplier ▽Z of the joint model.

[0073] It is worth noting that the second participant (i.e. the participant with sample labels) does not necessarily have the actual second training sample. When the second participant does not have the second training sample, the value of the second training sample is 0.

[0074] Step 404: The second participant generates gradient multipliers based on the sample labels, the first gradient multiplier operator, and the second gradient multiplier operator.

[0075] Here, the gradient multiplier is the derivative of the loss function with respect to the model calculation result.

[0076] The second participant possesses the sample labels y of each training sample, and generates gradient multipliers based on the sample labels, the first gradient multiplier operator, and the second gradient multiplier operator.

[0077] Specifically, the second participant first obtains the calculation result Z of the joint model based on the first gradient multiplier operator and the second gradient multiplier operator, Z=Z A '+Z B The second participant used the sigmoid function to normalize the model's calculation result Z, obtaining the predicted value of the joint model in this round of calculation. Then the gradient multiplier ▽Z is the difference between the predicted value and the sample label y, i.e.

[0078] Step 405: The second participant sends the gradient multiplier ciphertext to the first participant.

[0079] In one possible implementation, the second participant encrypts the gradient multiplier ▽Z using its own key to obtain the gradient multiplier ciphertext [▽Z]. B And the gradient multiplier ciphertext [▽Z] B Send to the first participant.

[0080] Step 406: The second participant performs reverse calculation based on the gradient multiplier to update the weights of the third model.

[0081] In logistic regression, after the computer calculates the model's predicted values, it needs to perform a backward computation based on these predictions and the sample labels, updating the model weights using gradient multipliers. Therefore, the second participant is responsible for performing the backward computation based on the gradient multipliers, updating the model weights corresponding to that participant. In one possible implementation, since the second participant only possesses the plaintext of the third model weights and cannot obtain the plaintext of the fourth model weights, and updating a portion of the model's weights is equivalent to updating the entire model, the second participant updates the third model weights based on the gradient multipliers, while the encrypted fourth model weights remain unchanged.

[0082] It is worth mentioning that there is no strict order between steps 405 and 406. The second participant can execute step 405 first, or step 406 first, or execute steps 405 and 406 simultaneously.

[0083] Step 407: The first participant performs reverse calculation based on the gradient multiplier ciphertext and updates the second model weight ciphertext.

[0084] To prevent the first participant from inferring the sample labels of the second participant through multiple updates and iterations, the first participant updates the model weights based on the gradient multiplier ciphertext, obtaining the updated second model weight ciphertext. In other words, the first participant can never know the plaintext weights of its own complete model, nor the plaintext gradient multipliers, thus avoiding the label leakage problem in related technologies.

[0085] Optionally, the first participant can directly update the second model weight ciphertext based on the gradient multiplier ciphertext, or the first participant can calculate the ciphertext of the model gradient based on the gradient multiplier ciphertext and the homomorphic encryption algorithm, and send the ciphertext of the model gradient to the second participant, so that the second participant can decrypt and update the second model weights (the second participant has the plaintext of the second model weights), and then the second participant can send the ciphertext of the second model weights to the first participant again for the next round of model training.

[0086] Optionally, the first participant may directly update the second model weight ciphertext to update the model, or the first participant may fuse the first model weight ciphertext and the second model weight ciphertext using homomorphic encryption technology, and update the model by updating the complete model weight ciphertext.

[0087] In summary, in this embodiment, the second participant calculates the model gradient multiplier based on the first and second gradient multiplier operators, and sends the encrypted gradient multiplier to the first participant. This ensures that the first participant always updates the encrypted model weights with the encrypted gradient multiplier. Therefore, the first participant cannot independently calculate its own model prediction results, nor can it calculate the gradient of its complete model. Consequently, the first participant cannot accumulate model gradients through multiple rounds of training to deduce the sample labels of the second participant, thus improving the security of model training through federated learning and preventing data leakage.

[0088] In one possible implementation, before the two parties perform forward computation, they communicate with each other and jointly perform sample alignment, thereby using sample data with the same sample identifier for model training. For example, the first training sample and the second training sample corresponding to the same user. Therefore, before step 401 above, the federated learning-based model training method provided in this application embodiment further includes the following steps:

[0089] Step a: The first participant and the second participant perform sample alignment to determine the identifier of the intersection sample.

[0090] Assume that the first participant and the second participant each possess dataset D. A and D BIn vertical federated learning, the two participants need to align their training data and filter out the intersection of their sample identity documents (IDs), i.e., to find the dataset D. A and D B The process involves finding the intersection of identical sample IDs without revealing the sample IDs of the non-intersecting parts. This step is called secure sample alignment between the two parties. Algorithms that can be used include those based on Blind RSA, Diffie-Hellman, and the Freedman protocol.

[0091] It should be noted that, in order to reduce computational load and achieve better training results, typically before each iteration, the first and second participants each extract a mini-batch of training samples from the data intersection, for example, each mini-batch includes 128 samples. In this case, the first and second participants need to coordinate the batching and selection of mini-batches so that the samples in the mini-batches selected by both participants in each iteration are also aligned.

[0092] For ease of description, the mini-batch features of the two participants in this application are denoted as X. A and X B The small batch of labels from the second participant is denoted as y.

[0093] Step b: The first participant determines the first training sample based on the intersection sample identifier.

[0094] Step c: The second participant determines the second training sample based on the intersection sample identifier.

[0095] In one possible implementation, each training sample from both the first and second participants has a corresponding sample identifier, and training samples with the same identifier belong to the same sample object (e.g., the same user). Before forward computation, the first and second participants jointly perform sample alignment to determine the intersection of sample IDs. The first participant identifies the training sample corresponding to the intersection ID in its dataset as the first training sample, and the second participant identifies the training sample corresponding to the intersection ID in its dataset as the second training sample.

[0096] Optionally, the first and second participants may use all training samples corresponding to the intersection IDs for each round of model training, or they may agree to select a small batch of training samples from the intersection IDs for training. When using small batches of data for training, both parties may always use the same batch of sample data, or they may update the training samples once before each round or every few rounds of iteration. This application embodiment does not limit this.

[0097] Please refer to Figure 5 This embodiment illustrates a flowchart of a model training method based on federated learning provided in another exemplary embodiment of this application. This embodiment uses the method in a federated learning system as an example for illustration. This federated learning system includes a first participant and a second participant, where the second participant possesses sample labels. The method includes the following steps:

[0098] Step 501: The first participant performs scalar addition encryption on the ciphertexts of the first model weights and the second model weights to obtain the participant's model ciphertext.

[0099] Among them, the participant model ciphertext refers to the ciphertext of the complete model weights corresponding to the first participant, that is, the weight ciphertext of the model composed of the first model weights and the second model weights.

[0100] In one possible implementation, during the initialization phase, after generating the first model weights and receiving the ciphertext of the second model weights, the first participant obtains the participant's model ciphertext using scalar addition. Specifically, the first participant encrypts the first model weights based on the second participant's public key to obtain the first model weight ciphertext, and then encrypts both the first and second model ciphertexts using homomorphic encryption to obtain the participant's model ciphertext. in, like Figure 6 As shown, it illustrates the specific process of model updating in the embodiments of this application.

[0101] In the subsequent forward and backward computation stages, the first participant calculates the first gradient multiplier operator and the first model gradient based on the participant model ciphertext, and updates the participant model ciphertext in reverse, thereby training the model without knowing its own model weights and the first gradient multiplier operator.

[0102] Step 502: The first participant performs forward computation based on the participant model ciphertext and the first training sample to generate the first gradient multiplier operator.

[0103] In one possible implementation, the first participant needs to perform forward computation based on the participant model ciphertext and the first training sample with the help of the second participant. Step 502 includes the following steps:

[0104] Step 502a: The first participant generates the first model noise.

[0105] Since the first participant needs to interact with the second participant by sending the product of the participant's model ciphertext and the first training sample to the second participant to compute the second gradient multiplier operator, in order to avoid data leakage, the first participant needs to generate a first model noise ε with the same dimension as the participant's model ciphertext. A .

[0106] It is worth mentioning that the noise ε in the first model A The dimension is determined by the number of samples and the dimension of the model input from the first participant, i.e., ε. A ∈R BS×OUT .

[0107] Step 502b: The first participant performs scalar encryption processing on the first model noise, the participant model ciphertext, and the first training sample to generate the first model output ciphertext.

[0108] The first participant performs scalar encryption on the noise of the first model, the encrypted data of the participant's model, and the first training sample. Specifically, the first participant first encrypts the encrypted data of the participant's model. and the first training sample X A Perform scalar multiplication encryption, and then process the calculated product ciphertext. The noise from the first model is encrypted using scalar multiplication to generate the ciphertext output by the first model.

[0109] Step 502c: The first participant outputs ciphertext based on the first model and interacts with the second participant to generate the first gradient multiplier operator.

[0110] The first participant sends the first model output ciphertext to the second participant and receives the second model output ciphertext sent by the second participant, so that both parties can complete the calculation of the gradient multiplier operator.

[0111] Specifically, step 502c includes the following steps:

[0112] Step 1: The first participant sends the encrypted output of the first model to the second participant.

[0113] The first participant sends the ciphertext of the first model output to the second participant, enabling the second participant to decrypt the ciphertext of the first model output using its private key and calculate the second gradient multiplier operator.

[0114] Step two: The first participant receives and decrypts the ciphertext of the second model output sent by the second participant to obtain the calculation result of the second model.

[0115] On the other hand, the second participant uses scalar encryption technology to calculate the ciphertext [X] output by the second model. B R B +ε B] A The data is then sent to the first participant, who decrypts the ciphertext output by the second model using their private key to obtain the calculation result X from the second model. B R B +ε B .

[0116] It is worth mentioning that the calculation results of the second model include the noise ε of the second model. B Therefore, it will not lead to the leakage of information of the second party involved.

[0117] Step 3: The first participant generates the first gradient multiplier operator based on the noise of the first model and the output of the second model.

[0118] In one possible implementation, since the gradient multiplier ▽Z is the derivative of the loss function with respect to the model's computational result Z, Therefore, in order to pass the first gradient multiplier operator Z A 'and the second gradient multiplier operator Z B 'After calculating Z, the first participant needs to generate the first gradient multiplier operator based on the first model noise and the calculation results of the second model. That is, the first gradient multiplier operator needs to carry the formula of the first model noise, and the negative number (-ε) of the first model noise.' A This is to cancel out the first model noise in the second gradient multiplier operator when the second participant subsequently calculates the gradient multiplier. Specifically, the first participant calculates the arithmetic sum of the negative of the first model noise and the result of the second model calculation, which is determined as the first gradient multiplier operator, i.e., the first gradient multiplier operator Z. A '=-ε A +X B R B +ε B .

[0119] Step 503: The second participant performs forward computation based on the third model weights, the fourth model weights ciphertext, and the second training samples to generate the second gradient multiplier operator.

[0120] Correspondingly, the second participant simultaneously performs forward computation and interacts with the first participant to generate the second gradient multiplier operator. Step 503 includes the following steps:

[0121] Step 503a: The second participant generates the second model noise.

[0122] Since the second participant needs to interact with the first participant by sending the product of the participant's model ciphertext and the second training sample (the actual model calculation result) to the first participant to calculate the second gradient multiplier operator, in order to avoid data leakage, the second participant needs to generate a second model noise ε with the same dimension as the participant's model ciphertext. BIt is worth mentioning that the noise ε in the second model B The dimension is determined by the number of samples and the dimension of the model input from the second participant, i.e., ε. B ∈R BS×OUT .

[0123] Step 503b: The second participant performs scalar encryption on the second model noise, the second training sample, and the fourth model weight ciphertext to generate the second model output ciphertext.

[0124] The second participant performs scalar encryption on the second model noise, the second training samples, and the ciphertext of the fourth model weights. Specifically, the second participant first performs scalar encryption on the ciphertext of the fourth model weights. and the second training sample X B Perform scalar multiplication encryption, and then process the calculated product ciphertext. The noise of the second model is encrypted using scalar multiplication to generate the ciphertext output of the second model.

[0125] Step 503c: The second participant interacts with the first participant based on the ciphertext output by the second model to generate the second gradient multiplier operator.

[0126] The first participant sends the first model output ciphertext to the second participant and receives the second model output ciphertext sent by the second participant. Similarly, the second participant sends the second model output ciphertext to the first participant and receives the first model output ciphertext sent by the first participant, so that both parties can complete the calculation of the gradient multiplier operator.

[0127] Specifically, step 503c includes the following steps:

[0128] Step four: The second participant sends the encrypted output of the second model to the first participant.

[0129] The second participant sends the second model output ciphertext to the first participant, enabling the first participant to decrypt the second model output ciphertext using its private key and calculate the first gradient multiplier operator.

[0130] Step 5: The second participant receives and decrypts the first model output ciphertext sent by the first participant to obtain the first model calculation result.

[0131] On the other hand, the first participant uses scalar encryption technology to calculate the ciphertext output by the first model. The data is then sent to the second participant, who decrypts the ciphertext output by the first model using their private key to obtain the calculation result of the first model.

[0132] It is worth mentioning that the calculation results of the first model include the noise ε of the first model. ATherefore, it will not lead to the leakage of information of the first party involved.

[0133] Step six: The second participant generates a second gradient multiplier operator based on the calculation results of the first model, the second training samples, the weights of the third model, and the noise of the second model, so that the sum of the first gradient multiplier operator and the second gradient multiplier operator is the gradient multiplier.

[0134] In one possible implementation, the gradient multiplier needs to contain the computational results of the complete model. The fourth model weight part is decrypted by the first participant, therefore the third model weight part needs to be calculated by the second participant. Furthermore, the model computation results of the first participant are sent to the second participant. Since the second model output ciphertext sent by the second participant to the first participant contains second model noise, the second participant needs to add the negative of the second model noise to the second gradient multiplier operator. Specifically, the second participant calculates the second gradient multiplier operator Z. B ',

[0135] Step 504: The first participant sends the first gradient multiplier operator to the second participant.

[0136] After step 502, the first participant sends the first gradient multiplier operator to the second participant, so that the second participant can calculate the gradient multiplier based on the first gradient multiplier operator and the second gradient multiplier operator.

[0137] Step 505: The second participant generates gradient multipliers based on the sample labels, the first gradient multiplier operator, and the second gradient multiplier operator.

[0138] Specifically, the second participant first calculates the sum of the first and second gradient multiplier operators to obtain the joint model result Z, Z = Z0. A '+Z B Then, the second participant normalizes the calculation result Z of the joint model to obtain the predicted value of the joint model. Finally, the second participant calculates the gradient multiplier ▽Z based on the predicted values ​​and sample labels.

[0139] Step 506: The second participant sends the gradient multiplier ciphertext to the first participant.

[0140] In one possible implementation, to avoid leakage of sample labels, the second participant does not directly send the gradient multiplier to the first participant. Instead, it first encrypts the gradient multiplier using its private key to generate gradient multiplier ciphertext [▽Z]. B Then, the gradient multiplier ciphertext is sent to the first participant, enabling the first participant to update the model weight ciphertext based on the gradient multiplier ciphertext.

[0141] Step 507: The second participant performs reverse calculation based on the gradient multiplier to update the weights of the third model.

[0142] During the reverse computation phase, the second participant possesses the sample labels, eliminating the label leakage issue. Therefore, it can directly update the weights of the third model—that is, the plaintext portion of its own model—based on the gradient multipliers. In one possible implementation, step 507 includes the following steps:

[0143] Step 507a: The second participant generates the gradient of the second model based on the transpose of the second training sample and the gradient multiplier.

[0144] In the logistic regression algorithm, the computer updates the model weights according to the direction indicated by the model gradient. The learning rate refers to the step size of the gradient descent. The model gradient is the product of the transpose of the sample vector and the gradient multiplier, i.e., ▽W=X T ▽Z.

[0145] For the second participant, the second model gradient is calculated directly based on the gradient multiplier and the second training samples. The gradient multiplier is obtained based on the calculation results of the joint model; therefore, this second model gradient is the model gradient of the complete model corresponding to the second participant.

[0146] Step 507b: The second participant updates the weights of the third model based on the gradient of the second model and the learning rate.

[0147] In one possible implementation, since updating partial model weights is equivalent to updating the weights of the complete model, the second participant only updates the third model weights W of the known plaintext. B The updated third model weights W B 'Based on the gradient and learning rate of the second model and the weights W of the original third model B What was obtained η is the learning rate.

[0148] Step 508: The first participant performs reverse calculation based on the gradient multiplier ciphertext and updates the participant model ciphertext.

[0149] Accordingly, after receiving the gradient multiplier ciphertext, the first participant updates the participant's model ciphertext. Specifically, step 508 includes the following steps:

[0150] Step 508a: The first participant performs scalar multiplication encryption on the transpose of the first training sample and the gradient multiplier ciphertext to generate the first model gradient ciphertext.

[0151] Since the gradient multiplier is the product of the transpose of the feature data of the training samples and the gradient multiplier, the gradient ciphertext of the first model is... The result of scalar multiplication encryption of the transpose of the first training sample and the gradient multiplier ciphertext.

[0152] Step 508b: The first participant updates the participant model ciphertext based on the first model gradient ciphertext and the learning rate.

[0153] In one possible implementation, the first participant can directly update its own complete model weights, i.e., the weights of the participant's model, and the updated participant model ciphertext. Based on the first model gradient ciphertext, learning rate, and the original participant model ciphertext. What was obtained η is the learning rate.

[0154] In this embodiment, the first participant merges the encrypted text of the first model weight and the second model weight during the initialization phase to obtain the encrypted text of the participant's model. Based on the encrypted text of the participant's model, the model is updated according to the encrypted text of the gradient multipliers. Throughout the process, the first participant cannot know the calculation results of its own complete model or the gradient multipliers, and therefore cannot infer the sample labels of the second participant, thus improving the security and confidentiality of federated learning.

[0155] The above embodiments illustrate a first improvement scheme. In another possible implementation, the model prediction values ​​in the forward computation stage can also be generated in another way to reduce the number of interactions between the first participant and the second participant.

[0156] That is, step 502 above may also include the following steps:

[0157] Step 502d: The first participant receives and decrypts the second model output ciphertext sent by the second participant to obtain the second model calculation result. The second model output ciphertext is obtained by the second participant through scalar encryption processing of the second model noise, the second training samples, and the fourth model weight ciphertext.

[0158] In the first improved scheme described above, the first and second participants complete the forward computation through three communications to obtain the model's predicted value. In another possible implementation, the first participant does not need to generate the first model noise. Instead, it directly generates the ciphertext of the first gradient multiplier operator based on the ciphertext output by the second model by adjusting the expression of the first gradient multiplier operator. Simultaneously, the second participant is responsible for adjusting the expression of the second gradient multiplier operator and calculating the gradient multipliers. This eliminates the need to obtain the model calculation results from the first participant, thereby reducing one communication and further improving the security and confidentiality of federated learning.

[0159] Figure 7The specific flow of the second improved scheme provided in the embodiments of this application is illustrated. In the forward computation stage, the second participant generates the second model noise ε. B Then, based on the ciphertext of the fourth model, the noise of the second model, and the second training samples, scalar encryption calculation is performed to obtain the ciphertext of the second model calculation result, that is, the ciphertext of the second model output [X]. B R B +ε B ] A The second participant sends the ciphertext output of the second model to the first participant. The first participant receives and decrypts the ciphertext output of the second model from the second participant to obtain the calculation result of the second model.

[0160] Step 502e: The first participant performs scalar encryption on the second model output ciphertext, the first training sample, and the participant model ciphertext to generate the first gradient multiplier operator ciphertext; and sends the first gradient multiplier operator ciphertext to the second participant.

[0161] The first participant receives the ciphertext [X] output by the second model. B R B +ε B ] A Then, the private key is used to decrypt it, yielding the second model calculation result X. B R B +ε B The first participant performs scalar encryption on the second model's output ciphertext, the first training sample, and the participant's model ciphertext to generate the first gradient multiplier operator ciphertext. Specifically, the first participant first performs scalar multiplication encryption on the first training sample and the second model's weight ciphertext, and then performs scalar multiplication encryption on the resulting product. The result X calculated by the second model B R B +ε B Perform scalar addition encryption to generate the ciphertext of the first gradient multiplier operator. The first participant will transmit the ciphertext of the first gradient multiplier operator. Send to the second participant.

[0162] Step 503 above may also include the following steps:

[0163] In step 503d, the second participant generates noise for the second model.

[0164] The specific implementation of step 503d can be referred to step 503a above, and will not be repeated here in the embodiments of this application.

[0165] Step 503e: The second participant performs scalar encryption on the second model noise, the second training sample, and the fourth model weight ciphertext to generate the second model output ciphertext; and sends the second model output ciphertext to the first participant.

[0166] Step 503f: The second participant generates a second gradient multiplier operator based on the second training sample, the third model weight, and the second model noise, so that the sum of the second gradient multiplier operator and the first gradient multiplier operator is the gradient multiplier.

[0167] Similarly, the second participant adjusts the second gradient multiplier operator so that the sum of the second gradient multiplier operator and the first gradient multiplier operator equals the gradient multiplier. In one possible implementation, since the first gradient multiplier operator only contains the model calculation results corresponding to the fourth model weights of the second participant, and also contains the second model noise, the second participant generates the second gradient multiplier operator based on the second training samples, the third model weights, and the second model noise. Specifically, the second participant calculates the product of the second training samples and the third model weights, and then calculates the difference X between this product and the second model noise. B W B -ε B It was determined to be the second gradient multiplier operator.

[0168] Step 505 above may also include the following steps:

[0169] Step 505a: The second participant receives and decrypts the ciphertext of the first gradient multiplier operator to obtain the first gradient operator.

[0170] The second participant receives the ciphertext of the first gradient multiplier operator. And decryption is performed to obtain the first gradient operator.

[0171] Step 505b: The second participant performs an addition operation on the first gradient multiplier operator and the second gradient multiplier operator to obtain the calculation result of the joint model, which consists of the first model weight, the second model weight, the third model weight, and the fourth model weight.

[0172] The second participant calculates the arithmetic sum of the first and second gradient operators to obtain the computational result Z of the joint model, i.e.

[0173] Step 505c: The second participant determines the gradient multipliers based on the sample labels and the calculation results of the joint model. The second participant normalizes the calculation result Z of the joint model to obtain the predicted value of the joint model. Finally, the second participant calculates the gradient multiplier ▽Z based on the predicted values ​​and sample labels.

[0174] In this embodiment, the first participant and the second participant reduce the number of communications between them by adjusting the calculation method of the gradient multiplier operator in the forward computation stage. Since model training requires multiple iterations, the two parties reduce multiple communication interactions in the complete model training process, thereby further improving the security and confidentiality of federated learning model training.

[0175] In both of the above-mentioned improved schemes, the first participant updates the participant model ciphertext by fusing it during the initialization phase. In another possible implementation, the first participant can also directly update the second model weight ciphertext. Please refer to [reference needed]. Figure 8 This embodiment illustrates a flowchart of a model training method based on federated learning provided in another exemplary embodiment of this application. This embodiment uses the method in a federated learning system as an example for illustration. This federated learning system includes a first participant and a second participant, where the second participant possesses sample labels. The method includes the following steps:

[0176] Step 801: The first participant generates the first model noise.

[0177] The specific implementation of step 801 can be referred to step 502a above, and will not be repeated here in the embodiments of this application.

[0178] Step 802: The first participant performs scalar encryption processing on the first training sample, the second model weight ciphertext, and the first model noise to generate the first model output ciphertext.

[0179] Similar to the first improved scheme, the first participant generates the first model output ciphertext, which is then decrypted by the second participant to generate the second modular gradient multiplier operator. However, the difference lies in that the first improved scheme generates the first model output ciphertext based on the participant's model ciphertext, while the third improved scheme in this application directly generates the first model output ciphertext based on the second model weight ciphertext.

[0180] Specifically, such as Figure 9 As shown, the first participant first encrypted the weights of the second model [R]. A ] B and the first training sample X A Perform scalar multiplication encryption, and then process the calculated product ciphertext X. A [R A ] B The noise from the first model is encrypted using scalar multiplication to generate the ciphertext [X] of the first model output. A R A +ε A ] B .

[0181] Step 803: The first participant outputs ciphertext based on the first model and interacts with the second participant to generate the first gradient multiplier operator.

[0182] The first participant sends the first model output ciphertext to the second participant and receives the second model output ciphertext sent by the second participant, so that both parties can complete the calculation of the gradient multiplier operator.

[0183] Specifically, step 803 includes the following steps:

[0184] Step 803a: The first participant sends the first model output ciphertext to the second participant.

[0185] The first participant sends the ciphertext of the first model output to the second participant, enabling the second participant to decrypt the ciphertext of the first model output using its private key and calculate the second gradient multiplier operator.

[0186] Step 803b: The first participant receives and decrypts the second model output ciphertext sent by the second participant to obtain the second model calculation result.

[0187] On the other hand, the second participant uses scalar encryption technology to calculate the ciphertext [X] output by the second model. B R B +ε B ] A The data is then sent to the first participant, who decrypts the ciphertext output by the second model using their private key to obtain the calculation result X from the second model. B R B +ε B .

[0188] It is worth mentioning that the calculation results of the second model include the noise ε of the second model. B Therefore, it will not lead to the leakage of information of the second party involved.

[0189] Step 803c: The first participant generates the first gradient multiplier operator based on the first model noise, the first model weight, the first training sample, and the calculation result of the second model.

[0190] In one possible implementation, since the gradient multiplier ▽Z is the derivative of the loss function with respect to the model's computational result Z, Furthermore, the ciphertext of the first model output sent by the first participant to the second participant for calculating the second gradient multiplier operator only contains the calculation results corresponding to the weights of the second model, and does not contain the calculation results of the weights of the first model. Therefore, in order to pass the first gradient multiplier operator Z... A 'and the second gradient multiplier operator Z B'After calculating Z, the first participant needs to generate the first gradient multiplier operator based on the first model noise, the first model weights, the first training samples, and the calculation results of the second model. That is, the first gradient multiplier operator needs to carry the formula of the first model noise, and the negative of the first model noise (-ε) A This is done so that the first model noise in the second gradient multiplier operator can be canceled out when the second participant subsequently calculates the gradient multiplier. Specifically, the first participant calculates the negative of the first model noise, -ε. A The calculation result X of the weight part of the first model A W A And the calculation result X of the second model B R B +ε B The arithmetic sum of the three is determined as the first gradient multiplier operator, i.e., the first gradient multiplier operator Z. A '=-ε A +X A W A +X B R B +ε B .

[0191] Step 804: The second participant generates the second model noise.

[0192] Step 805: The second participant performs scalar encryption on the second model noise, the fourth model weight ciphertext, and the second training samples to generate the second model output ciphertext.

[0193] The specific implementation of steps 804 to 805 can be referred to steps 503a to 503b above, and will not be repeated here in the embodiments of this application.

[0194] Step 806: The second participant interacts with the first participant based on the ciphertext output by the second model to generate the second gradient multiplier operator.

[0195] Correspondingly, the second participant simultaneously performs forward computation and interacts with the first participant to generate the second gradient multiplier operator. Step 806 includes the following steps:

[0196] Step 806a: The second participant sends the second model output ciphertext to the first participant.

[0197] Step 806b: The second participant receives and decrypts the first model output ciphertext sent by the first participant to obtain the first model calculation result.

[0198] The specific implementation of steps 806a to 806b can be referred to steps four to five above, and will not be repeated here in the embodiments of this application.

[0199] Step 806c: The second participant generates a second gradient multiplier operator based on the calculation results of the first model, the second training samples, the weights of the third model, and the noise of the second model. The sum of the first gradient multiplier operator and the second gradient multiplier operator is the gradient multiplier.

[0200] In one possible implementation, the gradient multiplier needs to contain the computational results of the complete model. The fourth model weight part is decrypted by the first participant, therefore the third model weight part needs to be calculated by the second participant. Furthermore, the model computation results of the first participant are sent to the second participant. Since the second model output ciphertext sent by the second participant to the first participant contains second model noise, the second participant needs to add the negative of the second model noise to the second gradient multiplier operator. Specifically, the second participant calculates the second gradient multiplier operator Z. B ', Z B =X B W B -ε B +(X A R A +ε A ).

[0201] Step 807: The first participant sends the first gradient multiplier operator to the second participant.

[0202] The specific implementation of step 807 can be referred to step 504 above, and will not be repeated here in the embodiments of this application.

[0203] Step 808: The second participant generates gradient multipliers based on the sample labels, the first gradient multiplier operator, and the second gradient multiplier operator.

[0204] Specifically, the second participant first calculates the sum of the first and second gradient multiplier operators to obtain the joint model result Z, Z = Z0. A '+Z B Then, the second participant normalizes the calculation result Z of the joint model to obtain the predicted value of the joint model. Finally, the second participant calculates the gradient multiplier ▽Z based on the predicted values ​​and sample labels.

[0205] Step 809: The second participant sends the gradient multiplier ciphertext to the first participant.

[0206] Step 810: The second participant performs reverse calculation based on the gradient multiplier to update the weights of the third model.

[0207] During the reverse computation phase, the second participant possesses the sample labels, eliminating the label leakage issue. Therefore, it can directly update the weights of the third model—that is, the plaintext portion of its own model—based on the gradient multipliers. In one possible implementation, step 810 includes the following steps:

[0208] Step 810a: The second participant generates the second model gradient based on the gradient multiplier and the second training sample.

[0209] Step 810b: The second participant updates the weights of the third model based on the gradient of the second model and the learning rate.

[0210] In the logistic regression algorithm, the computer updates the model weights according to the direction indicated by the model gradient. The learning rate refers to the step size of the gradient descent. The model gradient is the product of the transpose of the sample vector and the gradient multiplier, i.e., ▽W=X T ▽Z.

[0211] For the second participant, the second model gradient is calculated directly based on the gradient multiplier and the second training samples. The gradient multiplier is obtained based on the calculation results of the joint model; therefore, this second model gradient is the model gradient of the complete model corresponding to the second participant.

[0212] In one possible implementation, since updating partial model weights is equivalent to updating the weights of the complete model, the second participant only updates the third model weights W of the known plaintext. B The updated third model weights W B 'Based on the gradient and learning rate of the second model and the weights W of the original third model B What was obtained η is the learning rate.

[0213] Step 811: The second participant performs reverse calculation based on the gradient multiplier ciphertext and updates the second model weight ciphertext.

[0214] In one possible implementation, since the second model weights are generated and encrypted by the second participant during the initialization phase, the second participant can update the second model weight ciphertext according to the gradient multiplier ciphertext during the reverse calculation phase and send the second model weight ciphertext to the first participant for the next round of model training.

[0215] Since updating the second model weight ciphertext requires calculating the model gradient of the first participant, and calculating the model gradient requires training samples, in order to avoid the leakage of the first training samples, the second participant needs to interact and communicate with the first participant to jointly calculate the model gradient. Step 811 includes the following steps:

[0216] Step 811a: The first participant generates a random number.

[0217] To prevent the second participant from directly obtaining the model gradient of the first participant and thus speculating on the first training sample, the first participant generates random numbers to encrypt the first model gradient.

[0218] Specifically, the first participant generates random numbers based on the model input dimension and the model output dimension. Right now

[0219] Step 811b: The first participant performs scalar encryption on the transpose of the first training sample, the gradient multiplier ciphertext, and the random number to generate the model gradient ciphertext.

[0220] Since the gradient multiplier is the product of the transpose of the feature data of the training samples and the gradient multiplier, the gradient ciphertext of the first model is... The result of scalar multiplication encryption of the transpose of the first training sample and the gradient multiplier ciphertext. To prevent a second participant from deciphering the first training sample, the first participant also performed scalar addition encryption on the first model gradient ciphertext and a random number to obtain the model gradient ciphertext, i.e.

[0221] Step 811c: The first participant sends the model gradient ciphertext to the second participant, so that the second participant can decrypt the model gradient ciphertext to generate the first model gradient information, update the second model weights based on the first model gradient information, and send the updated second model weight ciphertext to the first participant.

[0222] In step 811d, the first participant receives the encrypted weights of the second model and updates the weights of the first model based on the random number and the learning rate.

[0223] The first participant sends the model gradient density to the second participant, enabling the second participant to update the weights of the second model based on the gradient information of the first model.

[0224] Specifically, such as Figure 9 As shown, after receiving the encrypted model gradient, the second participant decrypts it using its private key to obtain the first model gradient information. Next, the second participant updates the weights of the second model based on the gradient information of the first model. The updated weights of the second model... The second participant assigns weights R to the updated second model. A The system performs encryption to generate updated second model weight ciphertext, and then sends the second model weight ciphertext to the first participant.

[0225] On the other hand, the first participant also updates the weights of the first model based on random numbers and the learning rate. The updated weights of the first model

[0226] In this embodiment, the first participant directly updates the second model weight ciphertext based on the gradient multiplier ciphertext, and the second participant is responsible for calculating the updated second model weights. The second participant then encrypts and sends the updated second model weights to the first participant, thus preventing the first participant from obtaining the complete model plaintext to infer the model prediction value and the gradient multiplier, and ensuring that the sample labels of the second participant are not leaked.

[0227] The above embodiments illustrate a third improved scheme, in which the second participant is responsible for updating the second model weights and sending the updated second model weight ciphertext to the first participant. In another possible implementation, the second participant sends the gradient multiplier ciphertext to the first participant, and the first participant can directly update the second model weight ciphertext based on the gradient multiplier ciphertext to reduce the number of communications.

[0228] That is, step 811 above may also include the following steps:

[0229] Step 811e: The first participant generates a random number.

[0230] Step 811e can be referred to step 811a above, and will not be repeated here in the embodiments of this application.

[0231] Step 811f: The first participant performs scalar encryption on the transpose of the first training sample, the gradient multiplier ciphertext, and the random number to generate the model gradient ciphertext.

[0232] Here, the model gradient ciphertext refers to the ciphertext of the first model gradient. Specifically, such as... Figure 10 As shown, since the gradient multiplier is the product of the transpose of the feature data of the training samples and the gradient multiplier, the gradient ciphertext of the first model is... The result of scalar multiplication encryption of the transpose of the first training sample and the gradient multiplier ciphertext. To prevent a second participant from deciphering the first training sample in the next round of training, the first participant also performed scalar addition encryption on the first model gradient ciphertext and a random number to obtain the model gradient ciphertext. Right now

[0233] In step 811g, the first participant updates the weights of the first model based on the random number and the learning rate, and updates the weights of the second model based on the model gradient ciphertext and the learning rate.

[0234] In one possible implementation, the first participant updates the second model weight ciphertext. The first participant updates the second model weight ciphertext based on the learning rate and model gradient ciphertext. The updated second model weight ciphertext...

[0235] In this embodiment, after obtaining the gradient multiplier ciphertext, the first participant directly uses the gradient multiplier ciphertext to calculate its own model gradient ciphertext, and updates the second model weight ciphertext based on the model gradient ciphertext. This reduces the number of communications between the first and second participants in the reverse calculation phase, further improving the security of federated learning and preventing data leakage.

[0236] In one possible implementation, before the two parties initialize and generate model weights, they need to exchange public keys in advance so that homomorphic encryption or scalar encryption can be performed during model training. That is, before step 401, the federated learning-based model training method provided in this application embodiment further includes the following steps:

[0237] Step d: The first participant sends the first public key to the second participant. The first public key is used to perform scalar encryption on the first ciphertext and the scalar. The first ciphertext is the ciphertext obtained by encrypting based on the first public key.

[0238] Step e: The second participant sends a second public key to the first participant. The second public key is used to perform scalar encryption on the second ciphertext and the scalar. The second ciphertext is the ciphertext obtained by encrypting based on the second public key.

[0239] Because the first and second participants need to perform homomorphic encryption on the ciphertext generated by the other party, or perform scalar encryption on the ciphertext generated by the other party and their own plaintext data, during the forward and backward computation processes, they need to use the other party's public key to encrypt the plaintext data. Before initialization begins, the first and second participants need to communicate and exchange their public keys.

[0240] Figure 11 This is a structural block diagram of a federated learning model training apparatus provided in an exemplary embodiment of this application. The apparatus is used in a federated learning system, which includes a first participant and a second participant. The second participant module 1102 has sample labels. The apparatus includes the following structure.

[0241] The first participant module 1101 is used to perform forward computation based on the first model weights, the second model weight ciphertext, and the first training sample to generate a first gradient multiplier operator; and send the first gradient multiplier operator to the second participant module 1102, wherein the second model weight ciphertext is initialized and encrypted by the second participant module 1102.

[0242] The second participant module 1102 is used to perform forward computation based on the third model weights, the fourth model weight ciphertext and the second training samples to generate the second gradient multiplier operator. The fourth model weight ciphertext is initialized and encrypted by the first participant module 1101.

[0243] The second participant module 1102 is further configured to generate a gradient multiplier based on the sample label, the first gradient multiplier operator, and the second gradient multiplier operator; and send the gradient multiplier ciphertext to the first participant module 1101, wherein the gradient multiplier is the derivative of the loss function with respect to the model calculation result;

[0244] The second participant module 1102 is also used to perform reverse calculation based on the gradient multiplier to update the weights of the third model;

[0245] The first participant module 1101 is also used to perform reverse calculation based on the gradient multiplier ciphertext to update the second model weight ciphertext.

[0246] Optionally, the first participant module 1101 is further configured to:

[0247] The ciphertexts of the first model weights and the second model weights are encrypted using scalar addition to obtain the ciphertexts of the participant models.

[0248] Based on the encrypted participant model and the first training sample, forward computation is performed to generate the first gradient multiplier operator.

[0249] The participant model ciphertext is updated by performing reverse calculation based on the gradient multiplier ciphertext.

[0250] Optionally, the first participant module 1101 is further configured to:

[0251] Generate noise for the first model;

[0252] The first model noise, the participant model ciphertext, and the first training sample are subjected to scalar encryption to generate the first model output ciphertext.

[0253] Based on the ciphertext output by the first model, data interaction is performed with the second participant module 1102 to generate the first gradient multiplier operator;

[0254] The second participant module 1102 is also used for:

[0255] Generate second model noise;

[0256] The second model noise, the second training sample, and the fourth model weight ciphertext are subjected to scalar encryption to generate the second model output ciphertext.

[0257] Based on the ciphertext output by the second model, data interaction is performed with the first participant module 1101 to generate the second gradient multiplier operator.

[0258] Optionally, the first participant module 1101 is further configured to:

[0259] Send the first model output ciphertext to the second participant module 1102;

[0260] Receive and decrypt the second model output ciphertext sent by the second participant module 1102 to obtain the second model calculation result;

[0261] Based on the noise of the first model and the calculation results of the second model, the first gradient multiplier operator is generated;

[0262] The second participant module 1102 is also used for:

[0263] Send the second model output ciphertext to the first participant module 1101;

[0264] Receive the first model output ciphertext sent by the first participant module 1101 and decrypt it to obtain the first model calculation result;

[0265] Based on the calculation results of the first model, the second training samples, the weights of the third model, and the noise of the second model, a second gradient multiplier operator is generated, such that the sum of the first gradient multiplier operator and the second gradient multiplier operator is the gradient multiplier.

[0266] Optionally, the first participant module 1101 is further configured to:

[0267] The transpose of the first training sample and the gradient multiplier ciphertext are subjected to scalar multiplication encryption to generate the first model gradient ciphertext.

[0268] The participant model ciphertext is updated based on the first model gradient ciphertext and the learning rate;

[0269] The second participant module 1102 is also used for:

[0270] The second model gradient is generated based on the transpose of the second training sample and the gradient multiplier.

[0271] The weights of the third model are updated based on the gradient of the second model and the learning rate.

[0272] Optionally, the first participant module 1101 is further configured to:

[0273] The second model output ciphertext sent by the second participant module 1102 is received and decrypted to obtain the second model calculation result. The second model output ciphertext is obtained by the second participant module 1102 performing scalar encryption processing on the second model noise, the second training sample, and the fourth model weight ciphertext.

[0274] The second model output ciphertext, the first training sample, and the participant model ciphertext are subjected to scalar encryption to generate the first gradient multiplier operator ciphertext; the first gradient multiplier operator ciphertext is sent to the second participant module 1102.

[0275] The second participant module 1102 is also used for:

[0276] Generate second model noise;

[0277] The second model noise, the second training sample, and the fourth model weight ciphertext are subjected to scalar encryption to generate the second model output ciphertext; the second model output ciphertext is then sent to the first participant module 1101.

[0278] The second gradient multiplier operator is generated based on the second training sample, the third model weight, and the second model noise, such that the sum of the second gradient multiplier operator and the first gradient multiplier operator is the gradient multiplier.

[0279] Receive and decrypt the ciphertext of the first gradient multiplier operator to obtain the first gradient operator;

[0280] The first gradient multiplier operator and the second gradient multiplier operator are added together to obtain the calculation result of the joint model, which is composed of the first model weight, the second model weight, the third model weight, and the fourth model weight.

[0281] The gradient multiplier is determined based on the sample labels and the calculation results of the joint model.

[0282] Optionally, the first participant module 1101 is further configured to:

[0283] Generate noise for the first model;

[0284] The first training sample, the second model weight ciphertext, and the first model noise are subjected to scalar encryption to generate the first model output ciphertext.

[0285] Based on the ciphertext output by the first model, data interaction is performed with the second participant module 1102 to generate the first gradient multiplier operator;

[0286] The second participant module 1102 is also used for:

[0287] Generate second model noise;

[0288] The second model noise, the fourth model weight ciphertext, and the second training sample are subjected to scalar encryption to generate the second model output ciphertext.

[0289] Based on the ciphertext output by the second model, data interaction is performed with the first participant module 1101 to generate the second gradient multiplier operator.

[0290] Optionally, the first participant module 1101 is further configured to:

[0291] Send the first model output ciphertext to the second participant module 1102;

[0292] Receive and decrypt the second model output ciphertext sent by the second participant module 1102 to obtain the second model calculation result;

[0293] Based on the first model noise, the first model weights, the first training samples, and the calculation results of the second model, the first gradient multiplier operator is generated.

[0294] The second participant module 1102 is also used for:

[0295] Send the second model output ciphertext to the first participant module 1101;

[0296] Receive the first model output ciphertext sent by the first participant module 1101 and decrypt it to obtain the first model calculation result;

[0297] The second gradient multiplier operator is generated based on the calculation results of the first model, the second training samples, the third model weights, and the second model noise, so that the sum of the first gradient multiplier operator and the second gradient multiplier operator is the gradient multiplier.

[0298] Optionally, the second participant module 1102 is further configured to:

[0299] A second model gradient is generated based on the gradient multiplier and the second training sample;

[0300] The weights of the third model are updated based on the gradient of the second model and the learning rate;

[0301] The first participant module 1101 is also used for:

[0302] Generate random numbers;

[0303] The transpose of the first training sample, the gradient multiplier ciphertext, and the random number are subjected to scalar encryption to generate the model gradient ciphertext.

[0304] The model gradient ciphertext is sent to the second participant module 1102 so that the second participant module 1102 can decrypt the model gradient ciphertext to generate first model gradient information, update the second model weights based on the first model gradient information, and send the updated second model weight ciphertext to the first participant module 1101.

[0305] Receive the encrypted second model weights and update the first model weights based on the random number and learning rate.

[0306] Optionally, the first participant module 1101 is further configured to:

[0307] Generate random numbers;

[0308] The transpose of the first training sample, the gradient multiplier ciphertext, and the random number are subjected to scalar encryption to generate the model gradient ciphertext.

[0309] The first model weights are updated based on the random number and the learning rate, and the second model weight ciphertext is updated based on the model gradient ciphertext and the learning rate.

[0310] Optionally, the first participant module 1101 is further configured to:

[0311] Align the samples with the second participant module 1102 to determine the intersection sample identifiers;

[0312] The first training sample is determined based on the intersection sample identifier;

[0313] The second participant module 1102 is also used for:

[0314] The second training sample is determined based on the intersection sample identifier.

[0315] Optionally, the first participant module 1101 is further configured to:

[0316] Send a first public key to the second participant module 1102. The first public key is used to perform scalar encryption on the first ciphertext and the scalar. The first ciphertext is the ciphertext obtained by encrypting based on the first public key.

[0317] The second participant module 1102 is also used for:

[0318] Send a second public key to the first participant module 1101. The second public key is used to perform scalar encryption on the second ciphertext and the scalar. The second ciphertext is the ciphertext obtained by encrypting based on the second public key.

[0319] In summary, in this embodiment, the second participant calculates the model gradient multiplier based on the first and second gradient multiplier operators, and sends the encrypted gradient multiplier to the first participant. This ensures that the first participant always updates the encrypted model weights with the encrypted gradient multiplier. Therefore, the first participant cannot independently calculate its own model prediction results, nor can it calculate the gradient of its complete model. Consequently, the first participant cannot accumulate model gradients through multiple rounds of training to deduce the sample labels of the second participant, thus improving the security of model training through federated learning and preventing data leakage.

[0320] Please refer to Figure 8 The diagram illustrates the structure of a computer device provided in one embodiment of this application.

[0321] The computer device 1200 includes a central processing unit (CPU) 1201, a system memory 1204 including random access memory (RAM) 1202 and read-only memory (ROM) 1203, and a system bus 1205 connecting the system memory 1204 and the CPU 1201. The computer device 1200 also includes a basic input / output (I / O) controller 1206 that facilitates information transfer between various components within the computer, and a mass storage device 1207 for storing the operating system 1213, application programs 1214, and other program modules 1215.

[0322] The basic input / output system 1206 includes a display 1208 for displaying information and an input device 1209 for user input, such as a mouse or keyboard. Both the display 1208 and the input device 1209 are connected to the central processing unit 1201 via an input / output controller 1210 connected to the system bus 1205. The basic input / output system 1206 may also include the input / output controller 1210 for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 1210 also provides output to a display screen, printer, or other types of output devices.

[0323] The mass storage device 1207 is connected to the central processing unit 1201 via a mass storage controller (not shown) connected to the system bus 1205. The mass storage device 1207 and its associated computer-readable media provide non-volatile storage for the computer device 1200. That is, the mass storage device 1207 may include computer-readable media (not shown) such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0324] Without loss of generality, the computer-readable medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include RAM, ROM, erasable programmable read-only memory (EPROM), flash memory or other solid-state storage technologies, CD-ROM, digital video disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that the computer storage media are not limited to the above-mentioned types. The system memory 1204 and mass storage device 1207 described above can be collectively referred to as memory.

[0325] According to various embodiments of this application, the computer device 1200 can also be connected to a remote computer on a network, such as the Internet. That is, the computer device 1200 can be connected to a network 1212 via a network interface unit 1211 connected to the system bus 1205, or the network interface unit 1211 can be used to connect to other types of networks or remote computer systems (not shown).

[0326] The memory also includes at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is stored in the memory and configured to be executed by one or more processors to implement the above-described federated learning-based model training method.

[0327] This application also provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the federated learning-based model training method described in the above embodiments.

[0328] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform a federated learning-based model training method provided in various alternative implementations of the above aspect.

[0329] Those skilled in the art will recognize that the functions described in the embodiments of this application in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0330] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A model training method based on federated learning, characterized in that, The method is used in a federated learning system, which includes a first participant and a second participant, wherein the second participant possesses sample labels. The method includes: The first participant performs forward computation based on the first model weights, the second model weight ciphertext, and the first training sample to generate a first gradient multiplier operator; the first gradient multiplier operator is sent to the second participant, and the second model weight ciphertext is initialized and encrypted by the second participant. The second participant performs forward computation based on the third model weights, the fourth model weight ciphertext, and the second training samples to generate the second gradient multiplier operator. The fourth model weight ciphertext is initialized and encrypted by the first participant. The second participant generates a gradient multiplier based on the sample label, the first gradient multiplier operator, and the second gradient multiplier operator; and sends the gradient multiplier ciphertext to the first participant, wherein the gradient multiplier is the derivative of the loss function with respect to the model calculation result; The second participant performs reverse calculation based on the gradient multiplier to update the weights of the third model; The first participant performs reverse calculation based on the gradient multiplier ciphertext and updates the second model weight ciphertext.

2. The method according to claim 1, characterized in that, Before the first participant performs forward computation based on the first model weights, the second model weights ciphertext, and the first training sample to generate the first gradient multiplier operator, the method includes: The first participant performs scalar addition encryption on the ciphertexts of the first model weights and the second model weights to obtain the participant's model ciphertext. The first participant performs forward computation based on the first model weights, the second model weights ciphertext, and the first training sample to generate the first gradient multiplier operator, including: The first participant performs forward computation based on the participant model ciphertext and the first training sample to generate the first gradient multiplier operator; The first participant performs reverse computation based on the gradient multiplier ciphertext to update the second model weight ciphertext, including: The first participant performs reverse calculation based on the gradient multiplier ciphertext and updates the participant model ciphertext.

3. The method according to claim 2, characterized in that, The first participant performs forward computation based on the participant model ciphertext and the first training sample to generate the first gradient multiplier operator, including: The first participant generates the first model noise; The first participant performs scalar encryption processing on the first model noise, the participant's model ciphertext, and the first training sample to generate the first model output ciphertext. The first participant interacts with the second participant based on the ciphertext output by the first model to generate the first gradient multiplier operator; The second participant performs forward computation based on the third model weights, the fourth model weights ciphertext, and the second training samples to generate the second gradient multiplier operator, including: The second participant generates noise in the second model; The second participant performs scalar encryption on the second model noise, the second training sample, and the fourth model weight ciphertext to generate the second model output ciphertext; The second participant interacts with the first participant based on the ciphertext output by the second model to generate the second gradient multiplier operator.

4. The method according to claim 3, characterized in that, The first participant interacts with the second participant based on the ciphertext output by the first model to generate the first gradient multiplier operator, including: The first participant sends the encrypted output of the first model to the second participant; The first participant receives and decrypts the ciphertext of the second model output sent by the second participant to obtain the calculation result of the second model; The first participant generates the first gradient multiplier operator based on the noise of the first model and the calculation result of the second model; The second participant interacts with the first participant based on the ciphertext output by the second model to generate the second gradient multiplier operator, including: The second participant sends the encrypted output of the second model to the first participant; The second participant receives and decrypts the ciphertext of the first model output sent by the first participant to obtain the calculation result of the first model; The second participant generates the second gradient multiplier operator based on the calculation results of the first model, the second training samples, the weights of the third model, and the noise of the second model, so that the sum of the first gradient multiplier operator and the second gradient multiplier operator is the gradient multiplier.

5. The method according to claim 2, characterized in that, The first participant performs reverse computation based on the gradient multiplier ciphertext to update the participant model ciphertext, including: The first participant performs scalar multiplication encryption on the transpose of the first training sample and the gradient multiplier ciphertext to generate the first model gradient ciphertext. The first participant updates the participant model ciphertext based on the first model gradient ciphertext and the learning rate; The second participant performs reverse calculation based on the gradient multipliers to update the weights of the third model, including: The second participant generates the second model gradient based on the transpose of the second training sample and the gradient multiplier; The second participant updates the weights of the third model based on the gradient of the second model and the learning rate.

6. The method according to claim 2, characterized in that, The first participant performs forward computation based on the participant model ciphertext and the first training sample to generate the first gradient multiplier operator, which further includes: The first participant receives and decrypts the second model output ciphertext sent by the second participant to obtain the second model calculation result. The second model output ciphertext is obtained by the second participant through scalar encryption processing of the second model noise, the second training sample and the fourth model weight ciphertext. The first participant performs scalar encryption on the second model output ciphertext, the first training sample, and the participant model ciphertext to generate the first gradient multiplier operator ciphertext; and sends the first gradient multiplier operator ciphertext to the second participant. The second participant performs forward computation based on the third model weights, the fourth model weights ciphertext, and the second training samples to generate the second gradient multiplier operator, including: The second participant generates noise in the second model; The second participant performs scalar encryption on the second model noise, the second training sample, and the fourth model weight ciphertext to generate the second model output ciphertext; and sends the second model output ciphertext to the first participant. The second participant generates the second gradient multiplier operator based on the second training sample, the third model weight, and the second model noise, such that the sum of the second gradient multiplier operator and the first gradient multiplier operator is the gradient multiplier; The second participant generates a gradient multiplier based on the sample label, the first gradient multiplier operator, and the second gradient multiplier operator, including: The second participant receives and decrypts the ciphertext of the first gradient multiplier operator to obtain the first gradient multiplier operator; The second participant performs an addition operation on the first gradient multiplier operator and the second gradient multiplier operator to obtain the calculation result of the joint model, which is composed of the first model weight, the second model weight, the third model weight, and the fourth model weight. The second participant determines the gradient multiplier based on the sample labels and the calculation results of the joint model.

7. The method according to claim 1, characterized in that, The first participant performs forward computation based on the first model weights, the second model weights ciphertext, and the first training sample to generate a first gradient multiplier operator, including: The first participant generates the first model noise; The first participant performs scalar encryption processing on the first training sample, the second model weight ciphertext, and the first model noise to generate the first model output ciphertext. The first participant interacts with the second participant based on the ciphertext output by the first model to generate the first gradient multiplier operator; The second participant performs forward computation based on the third model weights, the fourth model weights ciphertext, and the second training samples to generate the second gradient multiplier operator, including: The second participant generates noise in the second model; The second participant performs scalar encryption on the second model noise, the fourth model weight ciphertext, and the second training sample to generate the second model output ciphertext. The second participant interacts with the first participant based on the ciphertext output by the second model to generate the second gradient multiplier operator.

8. The method according to claim 7, characterized in that, The first participant interacts with the second participant based on the ciphertext output by the first model to generate the first gradient multiplier operator, including: The first participant sends the encrypted output of the first model to the second participant; The first participant receives and decrypts the ciphertext of the second model output sent by the second participant to obtain the calculation result of the second model; The first participant generates the first gradient multiplier operator based on the first model noise, the first model weights, the first training samples, and the calculation results of the second model; The second participant interacts with the first participant based on the ciphertext output by the second model to generate the second gradient multiplier operator, including: The second participant sends the encrypted output of the second model to the first participant; The second participant receives and decrypts the ciphertext of the first model output sent by the first participant to obtain the calculation result of the first model; The second participant generates the second gradient multiplier operator based on the calculation result of the first model, the second training sample, the third model weight, and the second model noise, so that the sum of the first gradient multiplier operator and the second gradient multiplier operator is the gradient multiplier.

9. The method according to claim 7, characterized in that, The second participant performs reverse calculation based on the gradient multipliers to update the weights of the third model, including: The second participant generates the second model gradient based on the gradient multiplier and the second training sample; The second participant updates the weights of the third model based on the gradient of the second model and the learning rate; The first participant performs reverse computation based on the gradient multiplier ciphertext to update the second model weight ciphertext, including: The first participant generates a random number; The first participant performs scalar encryption processing on the transpose of the first training sample, the gradient multiplier ciphertext, and the random number to generate the model gradient ciphertext; The first participant sends the model gradient ciphertext to the second participant, so that the second participant can decrypt the model gradient ciphertext to generate first model gradient information, update the second model weights based on the first model gradient information, and send the updated second model weight ciphertext to the first participant. The first participant receives the encrypted second model weights and updates the first model weights based on the random number and learning rate.

10. The method according to claim 7, characterized in that, The first participant performs reverse calculation based on the gradient multiplier ciphertext to update the second model weight ciphertext, and further includes: The first participant generates a random number; The first participant performs scalar encryption processing on the transpose of the first training sample, the gradient multiplier ciphertext, and the random number to generate the model gradient ciphertext; The first participant updates the first model weights based on the random number and the learning rate, and updates the second model weight ciphertext based on the model gradient ciphertext and the learning rate.

11. The method according to any one of claims 1 to 10, characterized in that, Before the first participant performs forward computation based on the first model weights, the second model weights ciphertext, and the first training sample to generate the first gradient multiplier operator, the method further includes: The first participant and the second participant perform sample alignment to determine the intersection sample identifier; The first participant determines the first training sample based on the intersection sample identifier; The second participant determines the second training sample based on the intersection sample identifier.

12. The method according to any one of claims 1 to 10, characterized in that, Before the first participant performs forward computation based on the first model weights, the second model weights ciphertext, and the first training sample to generate the first gradient multiplier operator, the method further includes: The first participant sends a first public key to the second participant. The first public key is used to perform scalar encryption on the first ciphertext and the scalar. The first ciphertext is the ciphertext obtained by encrypting based on the first public key. The second participant sends a second public key to the first participant. The second public key is used to perform scalar encryption on the second ciphertext and the scalar. The second ciphertext is the ciphertext obtained by encrypting based on the second public key.

13. A model training device based on federated learning, characterized in that, The device is used in a federated learning system, which includes a first participant and a second participant, the second participant possessing sample labels. The device includes: The first participant module is used to perform forward computation based on the first model weights, the second model weight ciphertext, and the first training sample to generate a first gradient multiplier operator; and to send the first gradient multiplier operator to the second participant, wherein the second model weight ciphertext is initialized and encrypted by the second participant. The second participant module is used to perform forward computation based on the third model weights, the fourth model weight ciphertext, and the second training samples to generate the second gradient multiplier operator. The fourth model weight ciphertext is initialized and encrypted by the first participant module. The second participant module is further configured to generate a gradient multiplier based on the sample label, the first gradient multiplier operator, and the second gradient multiplier operator; and send the gradient multiplier ciphertext to the first participant, wherein the gradient multiplier is the derivative of the loss function with respect to the model calculation result; The second participant module is also used to perform reverse calculation based on the gradient multiplier to update the weights of the third model; The first participating module is also used to perform reverse calculation based on the gradient multiplier ciphertext to update the second model weight ciphertext.

14. A computer device, characterized in that, The computer device includes a processor and a memory; the memory stores at least one instruction, at least one program, a code set, or an instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the federated learning-based model training method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the federated learning-based model training method as described in any one of claims 1 to 12.

16. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the federated learning-based model training method as described in any one of claims 1 to 12.

Images