A robust federated learning method with high privacy protection

Abstract

The application belongs to the field of research on robustness and high efficiency of federated learning, and particularly relates to a robust federated learning method with high efficiency and privacy protection. The method comprises the following steps: step 1, two servers cooperatively select n clients to participate in the federated learning process, and broadcast their own global models to the clients; step 2, the clients initialize the local model with the received global model, train the local model with the local data set, and send the trained local model to the two servers; step 3, the two servers construct a shared matrix with the received local model, and project it into a dimension-reduced shared matrix; step 4, the two servers cooperatively execute the Byzantine resilient aggregation algorithm on the shared matrix to obtain a new global model. The application reduces the number of private multiplications in the aggregation algorithm, continues the advantage of guaranteeing data privacy in federated learning, and effectively improves the efficiency of the federated learning algorithm.

Description

Technical Field

[0001] This invention pertains to the research of robustness and efficiency in federated learning, specifically relating to a robust federated learning method that is highly efficient and protects privacy. Background Technology

[0002] As is well known, machine learning requires massive amounts of data to train models. However, with more and more countries emphasizing the protection of personal privacy, regulations such as the General Data Protection Regulation (GDPR) have emerged, making it impossible to directly collect and access sensitive privacy data. To address this issue, Federated Learning provides a collaborative machine learning framework that allows multiple users or organizations (clients) to collaboratively train a shared global model without sharing their own data. In Federated Learning, a master server typically coordinates multiple clients to solve an optimization problem through multiple iterations. The master server can communicate with each client and obtain a new global model by aggregating the clients' local models during the iteration process. Federated Learning is particularly suitable for collaborative training with massive numbers of IoT and mobile users.

[0003] Despite its numerous advantages, federated learning is vulnerable to Byzantine attacks and privacy inference attacks. Byzantine attacks primarily occur on the client side, where a Byzantine client injects a malicious local model during aggregation, degrading the performance of the new global model. Privacy inference attacks primarily occur on the server side, where the server can infer attributes of client data or even reconstruct client data from the client's local models. Few defenses simultaneously protect against Byzantine and privacy inference attacks. Recent research suggests that only a single client with Byzantine faults can break linear aggregation rules like FedAvg, where Byzantine faults in federated learning include computational failures, device failures, and biases in data samples and labels. However, in the worst case, a malicious client may attempt to compromise the global model. To address these issues, the machine learning community has recently developed several Byzantine-resilient aggregation rules, notably Krum and Multi-Krum and Median and Trimmed mean. The former selects the local model closest to the others based on the Euclidean distance between local models as the new global model, while the latter calculates the median of all local model parameters and uses it as the parameters for the new global model. In preventing privacy-inferring attacks, homomorphic encryption and secure multi-party computation (SMPC) protocols are widely used. Homomorphic encryption incurs significant computational overhead for participating parties and supports a limited range of operations, while secure multi-party computation has low computational overhead for participating parties and supports a wide range of operations, but suffers from high communication overhead between participating parties. Some existing defenses utilize secret-sharing techniques to achieve privacy-preserving distance computation and employ distance-based Byzantine resilient aggregation rules (such as Multi-Krum) to obtain new global models. However, these schemes incur enormous computational overhead, and the leakage of pairwise distances may introduce new privacy threats. Therefore, researching new, more secure, and efficient federated learning schemes is urgently needed. Summary of the Invention

[0004] Therefore, there is a need to provide an efficient and privacy-preserving robust federated learning method. The purpose of this invention is twofold: firstly, to prevent the server from inferring partial attributes of privacy data from the local model, or even reconstructing the original data; and secondly, to reduce the number of privacy-preserving multiplications in the federated learning algorithm under the protection of the MPC protocol, thereby reducing the overall algorithm overhead, improving algorithm efficiency, and achieving better scalability of the federated learning algorithm while maintaining robustness.

[0005] To reduce the number of privacy-preserving multiplications, this paper innovatively proposes a random projection operation on the secret sharing of all local models before calculating pairwise distances. A projection matrix with elements of 1 or -1 is randomly generated, and the shared matrix of the local models is directly multiplied by the projection matrix, projecting the local models from the high-dimensional space to the low-dimensional space. The projection operation only introduces addition and subtraction, which are free in the MPC protocol, requiring no communication overhead. This significantly reduces the number of privacy-preserving multiplications needed to calculate pairwise distances in the low-dimensional space.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A robust federated learning method with efficient privacy protection includes the following steps:

[0008] Step 1: The two servers collaboratively select n clients to participate in the federated learning process, and each server broadcasts its global model to these clients.

[0009] Step 2: The client initializes the local model with the received global model, trains the local model with the local dataset, and sends the trained local model to the two servers.

[0010] Step 3: The two servers construct a shared matrix using the received local model and project it onto the dimension-reduced shared matrix;

[0011] Step 4: The two servers work together to execute the Byzantine elastic aggregation algorithm on the shared matrix to obtain a new global model.

[0012] In a further optimization of this technical solution, in step 2, the floating-point numbers in the trained local model are converted into integers, and then the local model is shared and sent to two servers using the MPC protocol.

[0013] In a further optimization of this technical solution, in step 2, client i will transfer the local model L i Initialize L to the received global model G, and train L using the local dataset. i Then the client uses the arithmetic shared operation functions in the ABY framework to generate L. i A pair of secret sharing in This represents the j-th share in the two-party arithmetic secret sharing of the local model L, and will... Send to server 1, Send to server 2.

[0014] This technical solution is further optimized in step 3, where each server collects all secret shares sent by all clients and constructs a sharing matrix. <m> A The i-th row of the shared matrix Then, the two servers will use the same random projection matrix to... <m> A Projection to the local model shared matrix of dimensionality reduction<M′> A middle.

[0015] This technical solution is further optimized by adding a coefficient before the product of the projection matrix and the local model in step 3. in ε is the expected error of distance preservation, μ is the probability of successful projection, and n represents the number of clients.

[0016] This technical solution is further optimized by first constructing three basic modules before building the Byzantine elastic aggregation algorithm in step 4: 1) <d> A ←DistanceToOther( <m> A This function uses a shared matrix. <m> A Given the input, output the shared matrix of pairwise squared distances. <d> A ,in, and They all said <m> A Sharing the squared distance between the i-th and j-th rows requires three operations in ABY: addition (ADD), subtraction (SUB), and multiplication (MUL); 2)<D′> A ←SortValue( <d> A The function (axis) will share the matrix. <d> A Take integer axes (axis ∈ 0, 1) as input and output a sorted shared matrix.<D′> A If axis is 0, the function processes data in ascending order. <d> A Sort each row individually, otherwise sort in ascending order. <d> A Sort each column. This function implements a privacy-preserving bitonic sorting algorithm, which requires two operations: greater than or equal to ground truth (GT) and swapping. 3) A ←SortIndexByValue( <s> A This function uses a shared vector. <s> A For input, output a shared vector of indices. A sorted in ascending order <s> A This function performs sorting and includes the SortValue function, as well as two operations in ABY: greater than GT and SWAP.

[0017] This technical solution is further optimized in step 4 of the Byzantine elastic aggregation algorithm, where the two servers exchange... A After restoring the index vector I, the sum of the original-dimensional local model corresponding to the first n-β-1 indices is calculated locally. n is the number of clients, β is the number of Byzantine clients. The two servers cooperate to restore G, and only after dividing it by n-β-1 can a new global model G be obtained.

[0018] Unlike existing technologies, the above technical solution offers the following advantages: It is based on two non-colluding servers, resulting in extremely low overhead, and does not reveal the distance between any two local models. It innovatively proposes a random projection operation on the shared matrix of the local models before calculating pairwise distances, projecting the local models from the high-dimensional space to the low-dimensional space. The pairwise distances between these local models can be preserved with minimal error in the low-dimensional space, thus significantly reducing the number of private multiplications. This idea can be applied to the privacy-preserving implementation of any distance-based Byzantine resilient aggregation rule with almost no impact on the robustness of the aggregation algorithm. Furthermore, to avoid potential privacy threats from exposing pairwise distances, a privacy-preserving Byzantine resilient aggregation algorithm, Multi-Krum, is implemented based on the ABY framework. This algorithm only exposes the indexes of the selected clients and the new global model, continuing the advantages of data privacy protection in federated learning. Attached Figure Description

[0019] Figure 1 This is a flowchart of the interaction between the client and the server;

[0020] Figure 2 This is a diagram illustrating the algorithm steps of the projection scheme "RandomProjection";

[0021] Figure 3 This is a comparison chart of the prediction accuracy of Multi-Krum and MKRP models using the MNIST, Fashion-MNIST, and CIFAR-10 datasets under Gaussian attack with different numbers of Byzantine clients.

[0022] Figure 4 This is a comparison chart of the prediction accuracy of Multi-Krum and MKRP models using the MNIST, Fashion-MNIST, and CIFAR-10 datasets under label flipping attack with different numbers of Byzantine clients.

[0023] Figure 5 This is a comparison chart of training time for Multi-Krum and MKRP using the CIFAR-10 dataset. Detailed Implementation

[0024] To explain in detail the technical content, structural features, objectives, and effects of the technical solution, the following description is provided in conjunction with specific embodiments and accompanying drawings.

[0025] This invention proposes an efficient and privacy-preserving robust federated learning method, employing a setup of two servers and n clients. First, the two servers jointly select the n clients to participate in the federated learning, each distributing its global model to each participating client. Each client initializes its local model using the global model, trains its local model using its local dataset, and generates a pair of arithmetic secret shares for its local model, sending the corresponding secret share shares to the two servers. The servers construct a shared matrix using all received secret shares and project it onto the dimensionality-reduced shared matrix using the same projection matrix. The projection operation is performed locally on the server, incurring no communication overhead. Finally, protected by the MPC protocol, the two servers collaboratively perform Byzantine elastic aggregation and output a new global model.

[0026] The efficient and privacy-preserving robust federated learning method of the present invention includes the following steps:

[0027] Step 1: At the start of each iteration, the two servers collaboratively select n clients to participate in the federated learning process and broadcast their global model to these clients.

[0028] Step 2: The client initializes the local model with the received global model, trains the local model with the local dataset, converts the floating-point numbers in the local model to integers, and then shares the local model with the MPC protocol and sends it to the two servers.

[0029] Step 3: The two servers construct a shared matrix using the received secret sharing and project it onto the reduced-dimensional shared matrix.

[0030] Step 4: The two servers work together to execute the Byzantine elastic aggregation algorithm on the shared matrix to obtain a new global model.

[0031] See Figure 1 The diagram shows the interaction flowchart between the client and server. After training a local model using a local dataset, the client secretly shares the local model with the server. The server constructs a shared matrix of the client's local model, projects the shared matrix into a low-dimensional space, and then executes the Byzantine elastic aggregation algorithm to obtain a new global model.

[0032] A preferred embodiment of the present invention is described below:

[0033] Step 1: The two servers collaboratively select n clients and each broadcasts its global model G to these clients. This setup prevents a single server from selecting colluding clients to help it infer the privacy information of other clients. Clients compare the two received global models to determine whether the two servers honestly executed the aggregation protocol in the previous round.

[0034] Step 2: Client i will transfer the local model L i Initialize L to the received global model G, and train L using the local dataset. i Then the client uses the arithmetic shared operation functions in the ABY framework to generate L. i A pair of secret sharing in Let A represent the j-th share in the two-party arithmetic secret sharing of the local model L, where A is an abbreviation for Arithmetic. Send to server 1, Send to server 2. Input local model L i Output a pair of arithmetic shared shares and Right now ArithmeticSharing(·) is an arithmetic shared function in ABY.

[0035] It's important to note that the arithmetic shared operation functions in ABY only support integer input, so the client needs to first configure L... i Convert the floating-point number in L to an integer, and then... i To share arithmetic data.

[0036] Step 3: Each server collects all secret shares sent by all clients and constructs a sharing matrix. <m> A The i-th row of the shared matrix is... Then, the two servers will use the same random projection matrix to... <m> A Projection to the local model shared matrix of dimensionality reduction<M′> A In, that is<M′> A ←RandomProjection( <m> A ), where RandomProjection(·) is the random projection function, and this process does not incur communication overhead.

[0037] The random projection function is derived from Theorem 1.

[0038] Theorem 1: Assume P is a d-dimensional real number field. Let M be any set containing n elements, denoted as an n×d matrix, where n,d>0.

[0039] Given ε, μ>0, let

[0040]

[0041] For integers k > k0, let S be a d×k random matrix, and S(i,j) = s ij , where {s ij Let} be an independent random variable that follows the probability distribution below.

[0042]

[0043] make

[0044]

[0045] Let f: f maps the i-th row of M to the i-th row of M′. For all u,v∈P, with at least 1-n -μ The probability is that

[0046] (1-ε)‖uv‖ 2 ≤‖f(u)-f(v)‖ 2 ≤(1+ε)‖uv‖ 2

[0047] According to Theorem 1, even choosing the projection matrix from a simple uniform distribution yields the same loss as the Johnson-Lindenstrauss lemma. A projection matrix containing only +1 and -1 elements requires only free addition and subtraction operations when calculating the projection matrix product and the local model shared product. However, there is a coefficient preceding the product of the projection matrix and the local model shared product. in ε is the expected error of distance preservation, μ is the probability of successful projection, and n represents the number of clients. It is usually a floating-point number, which ABY does not support, so it is directly... Replace with M′=MS. The distance relationships between local models in low-dimensional space depend only on the projection matrix. The existence of this feature reduces the distance error between the low-dimensional space and the original-dimensional space. Since distance-based Byzantine elastic aggregation rules typically detect outliers based on the distance relationships between local models, the replacement operation here does not reduce robustness. For algorithmic details of the projection scheme RandomProjection, please refer to [link to relevant documentation]. Figure 2 As shown.

[0048] Both servers need to execute the projection algorithm. Each server first obtains the same random projection matrix R using the same random seed, where the elements of R are constant. Then, each server locally computes the product of R and its local model shared matrix to obtain the low-dimensional local model shared matrix. After random projection, the distance between the low-dimensional local models is directly calculated, simulating the distance between the original-dimensional local models with a small error, which greatly reduces the number of MPC multiplications. Therefore, random projection schemes can be applied to reduce overhead when implementing most distance-based and Byzantine-flexible aggregation rules based on MPC.

[0049] Step 4: Using the MPC framework ABY, the two servers collaborate on...<M′> A and <m> A Multi-Krum, a privacy-preserving Byzantine-based resilient aggregation algorithm, is used where two servers only know whether a client has been selected to participate in the aggregation. <x> B For x, a Boolean share generated using ABY, where B is Boolean, we first define some basic operations on arithmetic shares:

[0050] ·ADD( <x> A , <y> A ): Returns the arithmetic share of x+y<x+y> A Similarly, SUB ( <x> A , <y> A Returns the arithmetic share of x and y. <x-y> A ,MUL( <x> A , <y> A Returns the arithmetic share of x·y<x·y> A .

[0051] ·GT( <x> B , <y> B ): If x > y, return a boolean share of 1. <1> A Otherwise, return a boolean value of 0. <0> A .

[0052] ·SWAP( <x> B , <y> B , <s> B ): If a = 1, return ( <y> B , <x> B Otherwise return () <x> B , <y> B ).

[0053] Then implement the following functions as the basic building blocks for the aggregation algorithm:

[0054] · <d> A ←DistanceToOther( <m> A This function uses a shared matrix. <m> A Given the input, output the shared matrix of pairwise squared distances. <d> A ,in, and They all said <m> A The shared squared distance between the i-th and j-th rows. In ABY, three operations are required: addition (ADD), subtraction (SUB), and multiplication (MUL).

[0055] ·<D′> A ←SortValue( <d> A (axis): This function will share the matrix. <d> A Take integer axes (axis ∈ 0, 1) as input and output a sorted shared matrix.<D′> A If axis is 0, the function processes data in ascending order. <d> A Sort each row individually, otherwise sort in ascending order. <d> A Sort each column. This function implements a privacy-preserving bitonic sorting algorithm, which requires two operations: greater than or equal to the ground truth (GT) and swapping.

[0056] · A ←SortIndexByValue( <s> A ): This function uses shared vectors <s> A For input, output a shared vector of indices. A sorted in ascending order <s> A Perform sorting. This function includes the SortValue function, as well as the GT and SWAP operations in ABY.

[0057] The aggregation algorithm uses the shared matrix of the original local model. <m> A Shared matrix of k-dimensional local model<M′> A Taking the number of Byzantine clients β as input, the output is a new global model G, i.e., G←RobustAggregation(<M′> A , <m> A The specific process is as follows: 1) Two servers use...<M′> A The DistanceToOther function is computed together with the input to obtain the distance between every two k-dimensional local models, i.e. <d> A ←DistanceToOther(<M′> A ); 2) Two servers with <d> A The SortValue function is computed together with the integer 0 as input, sorting the distances from each local model to all other local models in ascending order.<D′> A ←SortValue( <d> A ); 3) The two servers calculate the sum of n-β-1 distances from each local model to other local models locally, i.e. Where n is the number of clients, and β is the number of Byzantine clients; 4) The two servers are connected via... <s> A The SortIndexByValue function is computed together with the input, and its output is the sum of the values ​​of each sorted input. The corresponding local model index, i.e. A ←SortIndexByValue( <s> A 5) Finally, the two servers exchange... A Restore the index vector I, and then locally calculate the sum of the original-dimensional local model corresponding to the first n-β-1 indices, i.e. Then, the two servers collaborate to recover G and divide it by n-β-1 to obtain a new global model G. It can be seen that throughout the entire privacy-preserving Multi-Krum algorithm cycle, only the index vector I and the new global model G are exposed to the servers.

[0058] Step 5: Validate the proposed solution through experiments. Three image datasets requiring high-dimensional models for classification tasks were considered: MNIST, Fashion-MNIST, and CIFAR-10. MNIST and Fashion-MNIST each consist of 70,000 28×28 grayscale images, while CIFAR-10 contains 60,000 32×32 color images. A 10-class classifier was trained on each of these datasets. For MNIST and Fashion-MNIST, the same deep neural network (DNN) was used, with an architecture of two convolutional layers and two fully connected layers. For CIFAR-10, a lightweight ResNet-18 was used for classification. Unlike the original ResNet-18, the lightweight ResNet-18 modifies the size of the first convolutional layer to 32×3×3.

[0059] To evaluate the performance of random projection on Multi-Krum, Multi-Krum and Multi-Krum with random projection (MKRP) were evaluated on three datasets. See [link / reference] Figure 3 As shown, the accuracy was tested under a Gaussian attack with different numbers of Byzantine clients, demonstrating that random projection has no effect on Multi-Krum. With the same β, MKRP's accuracy on MNIST, Fashion-MNIST, and CIFAR-10 decreased by a maximum of 0.2%, 0.2%, and 0.6% compared to Multi-Krum, respectively, which is negligible. As β increased from 4 to 12, Multi-Krum's accuracy on MNIST, Fashion-MNIST, and CIFAR-10 decreased by 0%, 0.1%, and 0.8%, respectively, while MKRP's accuracy decreased by 0.3%, 0.3%, and 0.9%, respectively. The decrease between MKRP and Multi-Krum was at most 0.3%, which is negligible. Therefore, the effect of random projection on Multi-Krum does not change with β.

[0060] Accuracy was tested with varying numbers of Byzantine clients using a label flipping attack. This attack differs from Gaussian attacks in that Byzantine local models and benign local models follow different distributions. The score difference between Byzantine and benign local models depends on the model and the dataset; therefore, the effect of random projection is different. See also... Figure 4 As shown, with the same number of Byzantine clients, MKRP's accuracy on MNIST, Fashion-MNIST, and CIFAR-10 decreased by a maximum of 0.2%, 1%, and 5% compared to Multi-Krum.

[0061] When using the CIFAR-10 dataset, refer to the training time for Multi-Krum and MKRP. Figure 5 As shown, under the random projection strategy, the training time of MKRP is optimized by approximately 40 times compared to Multi-Krum, indicating that random projection can effectively improve the efficiency of federated learning algorithms.

[0062] The advantages of this invention are as follows: 1. It reduces the number of private multiplications in the aggregation algorithm; 2. The projection operation hardly affects the robustness of the aggregation algorithm; 3. The privacy-preserving Byzantine resilient aggregation algorithm Multi-Krum only exposes the index of the selected client and the new global model, continuing the advantage of data privacy protection in federated learning; 4. It effectively improves the efficiency of federated learning algorithms while ensuring their privacy and robustness.

[0063] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Unless otherwise specified, an element defined by the phrase "comprising..." or "including..." does not exclude the presence of additional elements in the process, method, article, or terminal device that includes said element. Additionally, in this document, "greater than," "less than," and "exceeding" are understood to exclude the stated number; "above," "below," and "within" are understood to include the stated number.

[0064] Although the above embodiments have been described, those skilled in the art, once they understand the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the above descriptions are merely embodiments of the present invention and do not limit the scope of patent protection of the present invention. Any equivalent structural or procedural transformations made using the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention. < / s> < / s> < / d> < / d> < / d> < / m> < / m> < / s> < / s> < / s> < / d> < / d> < / d> < / d> < / m> < / d> < / m> < / m> < / d> < / y> < / x> < / x> < / y> < / s> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / y> < / x> < / x> < / m> < / m> < / m> < / m> < / s> < / s> < / s> < / d> < / d> < / d> < / d> < / m> < / d> < / m> < / m> < / d> < / m> < / m>

Claims

1. A robust federated learning method with high efficiency and privacy protection, characterized in that, Includes the following steps, Step 1: The two servers collaboratively select n clients to participate in the federated learning process, and each server broadcasts its global model to these clients. Step 2: The client initializes the local model with the received global model, trains the local model with the local dataset, and sends the trained local model to the two servers. In step 2, client i will transfer the local model L. i Initialize L to the received global model G, and train L using the local dataset. i Then the client uses the arithmetic shared operation functions in the ABY framework to generate L. i A pair of secret sharing in This represents the j-th share in the two-party arithmetic secret sharing of the local model L, and will... Send to server 1, Send to server 2; Step 3: The two servers construct a shared matrix using the received local model and project it onto the dimension-reduced shared matrix; Step 4: The two servers work together to execute the Byzantine elastic aggregation algorithm on the shared matrix to obtain a new global model.

2. The robust federated learning method with high efficiency and privacy protection as described in claim 1, characterized in that, In step 2, the floating-point numbers in the trained local model are converted to integers, and then the local model is shared and sent to two servers using the MPC protocol.

3. The robust federated learning method with high efficiency and privacy protection as described in claim 1, characterized in that, In step 3, each server collects all secret shares sent by all clients and constructs a sharing matrix. <m> A The i-th row of the shared matrix Then, the two servers will use the same random projection matrix to... <m> A Projection to the local model shared matrix of dimensionality reduction<M'> A middle.< / m> < / m> 4. The robust federated learning method with high efficiency and privacy protection as described in claim 1, characterized in that, In step 3, there is a coefficient before the product of the projection matrix and the local model. in ε is the expected error of distance preservation, μ is the probability of successful projection, and n represents the number of clients.

5. The robust federated learning method with high efficiency and privacy protection as described in claim 1, characterized in that, Before constructing the Byzantine elastic aggregation algorithm in step 4, three basic modules are first constructed: 1) <d> A ←DistanceToOther( <m> A This function uses a shared matrix. <m> A Given the input, output the shared matrix of pairwise squared distances. <d> A ,in, and They all said <m> A Sharing the squared distance between the i-th and j-th rows requires three operations in ABY: addition (ADD), subtraction (SUB), and multiplication (MUL); 2)<D'> A ←SortValue( <d> A The function (axis) will share the matrix. <d> A Take integer axes (axis ∈ 0, 1) as input and output a sorted shared matrix.<D'> A If axis is 0, the function sorts the data in ascending order. <d> A Sort each row individually, otherwise sort in ascending order. <d> A Sort each column. This function implements a privacy-preserving bitonic sorting algorithm, which requires two operations: greater than or equal to ground truth (GT) and swapping. 3) A ←SortIndexByValue( <s> A This function uses a shared vector. <s> A For input, output a shared vector of indices. A sorted in ascending order <s> A This function performs sorting and includes the SortValue function, as well as two operations in ABY: greater than GT and SWAP.< / s> < / s> < / s> < / d> < / d> < / d> < / d> < / m> < / d> < / m> < / m> < / d> <s> <s> <s> 6. The robust federated learning method with high efficiency and privacy protection as described in claim 5, characterized in that, In step 4 of the Byzantine elastic aggregation algorithm, the two servers exchange... A After restoring the index vector I, calculate the sum of the original-dimensional local models corresponding to the first n - β - 1 indices locally. For 0 ≤ i < n, where n is the number of clients and β is the number of Byzantine clients, two servers collaborate to restore G. After dividing it by n - β - 1, a new global model G can be obtained. < / s> < / s> < / s>

Images