AI model federated learning method combining homomorphic encryption and model watermarking

Abstract

A method for federated learning of artificial intelligence models combining homomorphic encryption and model watermarking. In the federated learning framework, the central server first numbers and groups multiple participants, distributes the target artificial intelligence model and the corresponding number, and each participant uses the homomorphic key to encrypt the model parameters obtained after training the local model and sends them to the central server. The central server aggregates the encrypted model parameters and returns them to each participant. Each participant decrypts the aggregated model parameters and uses the aggregated model parameters to update the local model, thereby completing the training and learning of the target artificial intelligence model under the federated learning framework. The present invention can solve the privacy and security issues of customers and can realize the supervision of untrustworthy behavior of customers.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence model learning methods, and specifically to an artificial intelligence model federated learning method combining homomorphic encryption and model watermarking. Background Art

[0002] In the era of artificial intelligence, training machine learning models according to demand is a vital task. Building high-quality and high-precision models requires collecting a large amount of training data from different data sources. However, in reality, data is distributed in different organizations (hospitals, banks, and various research institutes). These data often contain a lot of information involving privacy. With the increasing public attention to data security and privacy protection, sharing other people's data at will will violate laws and regulations, and data sharing will be strictly restricted. This has led to the difficulty of sharing data information between organizations and industries that need to share and exchange data, that is, the "data island" problem. Data sharing between various data owners has become a problem that needs to be solved urgently.

[0003] Federated learning provides an effective solution to break the "data islands" between different organizations and realizes cross-organizational data sharing and integration. Without directly sharing data, expanding the sample size and increasing the data dimension provide richer and higher-quality big data services for the construction of high-precision artificial intelligence models. The essence of federated learning is a distributed machine learning framework that enables data sharing and joint model training among customers on the basis of ensuring the privacy and security of participating customer data. Its core idea is that when multiple data sources jointly participate in model training, the model can be jointly trained only by exchanging the intermediate parameters of the model, under the premise of avoiding direct sharing of original data, that is, the data application mode of "data available but invisible".

[0004] However, some studies have shown that the model's intermediate parameters (gradients, weights, and biases) can also leak the customer's privacy and infer the user's original data. This has led to some criminals stealing the data that the user passes to the central server, thereby leaking the customer's privacy information.

[0005] In addition, there is a possibility that the participating customers in the federated learning framework are untrustworthy. The participation of untrustworthy customers with very little or very poor data in training will undoubtedly lead to a decrease in the accuracy of the overall model. At the same time, some untrustworthy customers privately sell the models trained together with other customers. These behaviors will undoubtedly infringe on the interests of other trusted customers and reduce the accuracy and training speed of the global model.

[0006] Chinese patent CN114091103A "Training method and calling method of federated learning model and federated learning system" discloses a training method and calling method of a federated learning model and a federated learning system. The training method includes obtaining a watermarked training data set of each participant among multiple participants; and performing federated learning training based on the watermarked training data set of each participant among multiple participants to generate a fragment model of each participant as a part of the federated learning model.

[0007] Chinese patent CN110601814B "Federated Learning Data Encryption Method, Device, Equipment and Readable Storage Medium" discloses a method and device for federated learning data encryption. In the process of federated learning, the encryption parameters of the current model update are obtained; the encrypted part and the plaintext part of the model parameter update obtained by local training are determined according to the encryption parameters; the encrypted part is encrypted using a preset encryption algorithm to obtain the ciphertext part of the model parameter update.

[0008] The invention of "Training method and calling method of federated learning model and federated learning system" does not clearly indicate the homomorphic encryption algorithm or secret sharing algorithm used, and the embedding of its model watermark requires that each participant has watermarked training data as a prerequisite, which has certain limitations. The invention of "Federated learning data encryption method, device, equipment and readable storage medium" The coordination device needs to obtain the encryption parameters of this model update to determine the encrypted and plaintext parts of the model parameter update, and send the ciphertext part and plaintext part of the model parameter update to the coordination device. Although the communication pressure is reduced to a certain extent, there is a risk of privacy leakage. Summary of the invention

[0009] In order to address the deficiencies in the prior art, the present invention provides an artificial intelligence model federated learning method that combines homomorphic encryption and model watermarking to solve the data privacy security issues and customer untrustworthiness issues that exist in the prior art artificial intelligence model federated learning process.

[0010] The present invention adopts the following technical solution.

[0011] The artificial intelligence model federated learning method combining homomorphic encryption and model watermarking includes the following steps:

[0012] Step 1: The central server numbers and groups multiple participants, and sends the target artificial intelligence model and the corresponding number to each participant, where the loss function of the target artificial intelligence model is the loss function regularized by the regularizer constructed by the watermark information and the projection matrix corresponding to the watermark;

[0013] Step 2: Each participant obtains the homomorphic encryption key separately;

[0014] Step 3: Each participant uses local data to train the target artificial intelligence model obtained in step 1 to obtain a trained local model and model parameters. During training, the model parameters are updated through a loss function, thereby embedding the watermark into the trained local model.

[0015] Step 4, each participant uses the key obtained in step 2 to encrypt the model parameters;

[0016] Step 5, each participant sends the encrypted model parameters to the central server, and the central server aggregates the model parameters sent by the participants belonging to the same group;

[0017] Step 6: The central server sends the aggregated model parameters to each participant in the corresponding group. After each participant decrypts the aggregated model parameters, it updates the local model using the decrypted aggregated model parameters.

[0018] Step 7: Repeat steps 1-6 to perform multiple rounds of training on the target AI model.

[0019] Preferably, in step 1, a watermark is obtained using the number of each participant as watermark information, and a regularization function is constructed based on the watermark and the projection matrix of the watermark. Then, the original loss function of the target artificial intelligence model is regularized by the regularization function, so that the loss function with the regularizer can embed the watermark into the model when the model parameters are updated during the training process.

[0020] The loss function E(ω) with regularizer is defined as:

[0021] E(ω)=E o (ω)+λE R (ω)

[0022] Where E0(ω) is the original loss function, λ is an adjustable parameter, ω is the model parameter vector, and E R (ω) is a regularization term that imposes restrictions on the parameter ω. R (ω) Define the loss function for the regularizer using binary cross entropy:

[0023]

[0024] where b j is the jth watermark to be embedded, y j is the jth embedded watermark, which is defined as:

[0025] y j =σ(∑ i X ji ω i )

[0026] Where X ji The projection matrix defined for the central server follows the standard normal distribution, j corresponds to the watermark position, i corresponds to the model parameter position, ωi is the i-th model parameter in the ω parameter vector, and σ(·) is the sigmoid function:

[0027]

[0028] Preferably, in step 2, the Paillier encryption method in homomorphic encryption is used to generate the key.

[0029] Preferably, in step 5, the polymerization process is as follows:

[0030]

[0031] Among them, W i Represents client C i Locally trained model parameters; [W i ] indicates that W i Perform encryption operations; represents the updated model parameters of the Nth group of users weighted by data volume; Represents client C i Updated model parameters; represents the additive homomorphism of Paillier homomorphic encryption; D represents the total amount of group member data; D i Represents client C i With the additive homomorphism of the Paillier algorithm, the central server can aggregate the model parameters without the model parameters being visible.

[0032] Preferably, in step 7, during each round of training, the participant senses whether the accuracy of the local model after the previous round of training has decreased. If it has decreased, the participant applies to the central server to terminate this round of training, and the central server registers the number of the participant who terminates the training midway, and counts the number of times each participant terminates the training midway. When the number of times a participant terminates midway reaches a set threshold, the central server expels the corresponding participant from the entire task.

[0033] The beneficial effect of the present invention is that, compared with the prior art, the present invention combines homomorphic encryption and model watermarking technology, and uses Paillier encryption technology to encrypt the model parameters transmitted between the participants and the central server, so as to prevent criminals from intercepting the transmitted information and inferring the customer's privacy information, causing the customer's privacy security problems. At the same time, a number exclusive to the participating customers is allocated and embedded in the model parameters as a watermark, thereby realizing the supervision of the customer's untrustworthy behavior. At the same time, participants do not need to prepare watermarked training data, and watermark embedding training can be performed after the central server initializes the model. The process is relatively simple, avoiding high communication costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a principle diagram of a federated learning framework of an artificial intelligence model federated learning method combining homomorphic encryption and model watermarking of the present invention;

[0035] Figure 2 is a schematic diagram of a watermark implantation principle in an embodiment of the present invention;

[0036] Figure 3 is a schematic diagram of a watermark detection principle in an embodiment of the present invention;

[0037] Figure 4 This is a schematic diagram of the watermark model aggregation principle in an embodiment of the present invention;

[0038] Figure 5 is a schematic diagram of the model parameter aggregation principle in an embodiment of the present invention;

[0039] Figure 6 1 is a comparison chart of different key lengths and non-homomorphic encryption model accuracy in an embodiment of the present invention, wherein (a) is an unencrypted model accuracy chart, (b) is a 16-bit key encryption model accuracy chart, (c) is a 32-bit key encryption model accuracy chart, and (d) is a 64-bit key encryption accuracy chart;

[0040] Figure 7 is a diagram showing the effect of different length keys on each round of encryption and decryption time in an embodiment of the present invention;

[0041] Figure 8 1 is a comparison diagram of watermarks of different lengths and a watermark-free model in an embodiment of the present invention, wherein (a) is a precision diagram of a watermark-free model, (b) is a precision diagram of a 64-bit watermark model, (c) is a precision diagram of a 128-bit watermark model, and (d) is a precision diagram of a 256-bit watermark model;

[0042] Fig. 9 1 is a comparison diagram of watermark embedding conditions of different lengths in the embodiment of the present invention, wherein (a) is a 64-bit watermark similarity diagram, (b) is a 128-bit watermark similarity diagram, and (c) is a 256-bit watermark similarity diagram;

[0043] Fig.10 1 is a comparison diagram of the influence of the change of the adjustable parameters on the model accuracy and watermark similarity in the embodiment of the present invention, wherein (a) is a comparison diagram of the influence of the adjustable parameters on the model accuracy and watermark similarity of client 1, and (b) is a comparison diagram of the influence of the adjustable parameters on the model accuracy and watermark similarity of client 3;

[0044] Fig.11 1 is a comparison diagram of the influence of the change in the number of watermark layer parameters on the watermark similarity in the embodiment of the present invention, wherein (a) is a comparison diagram of the influence of the change in the number of watermark layer parameters on the watermark similarity of client 1, (b) is a comparison diagram of the influence of the change in the number of watermark layer parameters on the watermark similarity of client 2, and (c) is a comparison diagram of the influence of the change in the number of watermark layer parameters on the watermark similarity of client 3. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.

[0046] AI model federated learning method combining homomorphic encryption and model watermarking, such as Figure 1 As shown, the following steps are included:

[0047] Step 1: The central server numbers and groups multiple participants, and sends the target artificial intelligence model and the corresponding number to each participant, where the loss function of the target artificial intelligence model is the loss function regularized by the regularizer constructed by the watermark information and the projection matrix corresponding to the watermark.

[0048] In step 1, the central server as the central node assigns different fixed numbers to each client (i.e., participant) participating in the joint training, and randomly groups all participants. Each group contains several participants, and the grouping can be evenly divided or unequally divided.

[0049] The central server sends the common target AI model and the corresponding participant number to each participant. A specific regularization function is added to a layer in the target AI model, so that the target AI model can embed the corresponding participant number as a watermark into the model parameters of this layer during training.

[0050] Specifically, Figure 2As shown, in step 1, the watermark is obtained by using the number of each participant as the watermark information, and a regularization function is constructed based on the watermark and the projection matrix of the watermark. Then, the original loss function of the target artificial intelligence model is regularized by the regularization function, so that the regularized loss function can embed the watermark into the model when updating the model parameters during the training process. The watermark generation and implantation process is as follows:

[0051] The loss function E(ω) with regularizer is defined as:

[0052] E(ω)=E0(ω)+λE R (ω) (1)

[0053] Where E0(ω) is the original loss function, λ is an adjustable parameter, ω is the model parameter vector, and E R (ω) is a regularization term that imposes restrictions on the parameter ω. R (ω) Define the loss function for the regularizer using binary cross entropy:

[0054]

[0055] where b j is the jth watermark to be embedded, y j is the jth embedded watermark, which is defined as:

[0056] y j =σ(∑ i X ji ω i ) (3)

[0057] Where X ji The projection matrix defined by the central server follows the standard normal distribution, j corresponds to the watermark position, i corresponds to the model parameter position, ω i is the i-th model parameter in the ω parameter vector, and σ(·) is the sigmoid function:

[0058]

[0059] Formula (2) is optimized by the stochastic gradient descent algorithm j Getting closer to b j , which means that the watermark embedded in the model is becoming more and more similar to the target watermark that needs to be embedded.

[0060] Step 2: A homomorphic encryption key is generated by a reliable third-party key management center, and the third-party key management center distributes the key to each participant, where the keys distributed to each participant in the same group are the same.

[0061] In step 2, the Paillier encryption method in homomorphic encryption is used to generate the key. The process is as follows:

[0062] Randomly select two large prime numbers p and q to satisfy gcd(pq, (p-1)(q-1)) = 1 to ensure that the two prime numbers are of equal length, where gcd(·) is the greatest common divisor. Then follow:

[0063] n=p·q (5)

[0064] λ=lcm(p-1,q-1) (6)

[0065] Calculate the key n and λ, where lcm() means finding the least common multiple. According to:

[0066] μ=(L((n+1) λ modn 2 )) -1 (7)

[0067] Design μ, where L(x) is calculated as:

[0068]

[0069] Design. The public key is n and the private key is (λ, μ).

[0070] In step 3, each participant uses local data to train the target artificial intelligence model obtained in step 1 to obtain a trained local model and model parameters. During training, the model parameters are updated through a loss function, thereby embedding the watermark into the local model obtained after training.

[0071] In step 3, each participant starts local training. Compared with the traditional federated learning clients sharing gradient data, the participants in the present invention share model parameters (weights and biases). Participants can perform multiple local trainings before sharing model parameters, which can optimize model parameters to a certain extent, reduce the number of data sharing, and reduce the communication cost of federated learning. While the participants are performing local training, the regularization function based on the watermark and its projection matrix constructs the watermark information corresponding to the participant's number, and the model parameters of the target artificial intelligence model are gradually embedded in the model parameters during the model training process.

[0072] Step 4: To prevent criminals from stealing customer shared data and inferring customer privacy information, each participant uses the key obtained in step 2 to encrypt the model parameters.

[0073] Specifically, the encryption process is as follows:

[0074] c=(1+n·m)·r n mod n 2(9)

[0075] Where m is a plaintext and satisfies m∈Z n , c is the ciphertext, r is an arbitrarily selected random number that satisfies

[0076] In step 5, each participant sends the encrypted model parameters to the central server, and the central server aggregates the model parameters sent by the participants belonging to the same group.

[0077] In step 5, the central server performs a weighted average operation on the model parameters sent by each participant according to the proportion of the data volume sent by each participant in the same group to the data volume of all participants in the corresponding group, thereby aggregating the model parameters of each participant in the same group.

[0078] Specifically, the aggregation process is as follows:

[0079]

[0080] Among them, Figure 5 Shown W i Represents client C i Locally trained model parameters; [W i ] indicates that W i Perform encryption operations; represents the updated model parameters of the Nth group of users weighted by data volume; Represents client C i Updated model parameters; represents the additive homomorphism of Paillier homomorphic encryption; D represents the total amount of group member data; D i Represents client C i With the additive homomorphism of the Paillier algorithm, the central server can aggregate the model parameters without the model parameters being visible.

[0081] In step 6, the central server sends the aggregated model parameters to each participant in the corresponding group. After each participant decrypts the aggregated model parameters, they use the decrypted aggregated model parameters to update the local model, thereby completing a round of learning and training of the target artificial intelligence model.

[0082] Step 7, repeat steps 1-6 in sequence multiple times, thereby performing multiple rounds of training on the target artificial intelligence model.

[0083] When a new round of training is conducted in step 7, it is necessary to reduce the participation of untrustworthy customers with less data or poor quality, which will affect the accuracy and speed of the entire training task. Therefore, step 7 uses the same group supervision method to reduce the impact of untrustworthy customers. In each round of training, the participants perceive whether the accuracy of the local model after the previous round of training has decreased. If it has decreased, the participants apply to the central server to terminate this round of training, and the central server registers the number of the participants who terminated the training midway, and counts the number of times each participant terminated the training midway. When the number of times a participant terminated the training midway reaches the set threshold, the central server expels the corresponding participant from the entire task.

[0084] As the number of training rounds increases, the accuracy of the participants' local models will continue to improve. When the model meets their expectations, the participants can apply to the central server to exit the training process. At the same time, the central server will also consider the evaluation data such as model accuracy shared by each participant and end the training task. After the joint training task is completed, there are untrustworthy participants who sell the model privately for profit, which undoubtedly damages the interests of other participants. The present invention can reversely track the privately sold participants and punish them for infringement by extracting the numbered watermarks embedded in the local models of each participant during the model training process.

[0085] Embodiment 1:

[0086] This embodiment uses the MNIST data set, which contains 60,000 training samples and 10,000 test samples. Three clients are selected, which have 10,000, 20,000 and 30,000 sample data respectively. This embodiment marks them as client 1, client 2 and client 3. In addition, the neural network model constructed in the experiment consists of an input layer of 784 units, two convolutional layers, two fully connected layers and an output layer with 10 output units, with a total of 816,474 model parameters.

[0087] This example first conducted an unencrypted federated learning experiment and used it as a reference group. In the experiment, three clients were selected as participants in the federated learning. Before each model aggregation, each client had to perform 20 rounds of local training. This example drew a line chart of the accuracy of each client during the entire federated learning process based on the model accuracy of each iteration of the three clients. Figure 6 It can be seen that the accuracy graph of the unencrypted federated learning experiment conforms to the general federated learning training rules. The client model with a large number of samples converges faster and the model accuracy of the three clients tends to be consistent.

[0088] Then, we try to add the Paillier encryption algorithm to the federated learning process, and select 16-bit, 32-bit, and 64-bit key lengths for experiments. From the previous encryption correctness proof, we know that the absolute value of the encrypted plaintext needs to be in Therefore, this embodiment considers the key length of three groups of experiments and enlarges the model parameters of federated learning aggregation by 10 3 , 10 8 and 10 16 times. Figure 6 (b) It can be seen that the accuracy of the three clients dropped sharply when the models were aggregated. However, the accuracy line graphs of the models with Paillier encryption added in Figures (c) and (d) are highly similar to the control group without encryption in Figure (a). Therefore, it can be inferred that when the key is 16 bits and the parameter is magnified by 10 3 The parameter accuracy is lost when the model is aggregated, resulting in the problem of decreased accuracy after the three clients update the model. From the three sets of figures, it can be seen that when the key is long enough and the parameters are amplified enough, secure federated learning with the Paillier encryption algorithm can achieve the effect of general federated learning.

[0089] At the same time, this embodiment records the time required for encryption with keys of different lengths. Figure 7 It can be seen from the figure that as the key length increases, the time required for encryption also increases significantly. Considering the impact of the number of model parameters that need to be encrypted on the encryption time, this embodiment modifies the structure of the initial model and reduces the original 816474 parameters to 409434. Figure 7 It can be seen that the number of parameters also has a direct impact on encryption time. Therefore, when it is put into use, it is necessary to comprehensively consider the impact of key length and model parameters on encryption time, that is, comprehensively consider the security of the framework and the complexity of the model to cope with the actual situation.

[0090] Considering that adding watermarks to the model may affect model training, a watermark layer for adding watermarks is selected in the initialization model assigned to each participant in the federated learning, and a regularizer is added, with the adjustable parameter λ set to 0.01. Figure 8 From the four groups of figures (a), (b), (c), and (d), we can see that embedding watermarks into the model using the projection matrix method does not affect the overall model training process. The model training process with embedded watermarks is almost the same as the general federated learning training process. It has been proven that integrating embedded watermarks into the model training process can ensure the embedding of watermarks without affecting the accuracy of the model.

[0091] Subsequently, this embodiment conducts watermark embedding experiments with different lengths. Fig. 9The three groups (a), (b), and (c) in the figure are the similarities between the watermark extracted in each iteration and the target watermark to be embedded when embedding 64-bit, 128-bit, and 256-bit watermarks, respectively. As can be seen from the figure, the 64-bit watermark embedding is the most ideal, and the speed and similarity of the watermark embedding of Client 3 are also better than those of the other two clients. Therefore, it can be known that the watermark length and the sample size of the participants have a great influence on the watermark embedding. At the same time, this embodiment also conducted an experiment to extract the watermark without embedding the watermark. Fig. 9 It can be seen that there are obvious differences. In order to simulate the situation where the most similar watermark can be extracted without embedding watermarks, this experimental example sets the watermark sequence to 1. Therefore, the watermark similarity extracted by the client without embedding watermarks in the figure fluctuates around 50%. It can be seen that the method of embedding watermarks using projection matrix and regularizer is feasible.

[0092] Although Fig. 9 The client with and without watermark can be clearly distinguished in the example. However, when the length of the watermark to be embedded increases, the embedding of the watermark becomes less ideal. When embedding a 256-bit watermark, the similarity of the watermark extracted by Client3, which has the largest sample size, is only 91%, while the similarity of Client1, which has the smallest sample size, is only 80%. This embodiment considers that adjusting the adjustable parameter λ of the loss function may affect the watermark embedding situation, so an experiment on the variation of the adjustable parameter λ is conducted. Fig.10 As shown in (a), as λ gradually increases, the originally smooth model accuracy trend of Client1 fluctuates, and the similarity of the extracted watermark is significantly improved. As can be seen from (b), as λ gradually increases, the accuracy trend of Client3 model also fluctuates slightly, but the similarity of the extracted watermark is reduced. It can be seen that for participants with a small sample size, the watermark embedding can be improved by adjusting the adjustable parameter λ, but this method is ineffective for participants with a relatively sufficient sample size.

[0093] Finally, this embodiment takes into account that the model of this experiment cannot embed a watermark with a length of 256 bits, resulting in the similarity of the watermarks extracted by the three clients being less than ideal. Therefore, this embodiment adjusts the number of parameters of the watermark layer from Fig.11It can be seen that the original 2064 parameters of the watermark layer are adjusted to 9248 and 18496 respectively. (a), (b), and (c) are the embedding of 256-bit watermarks after Client1, Client2, and Client3 adjust the number of watermark layer parameters. It can be seen from the figure that the similarity of the watermarks finally extracted by the three clients has been significantly improved. At the same time, from the watermark similarity trend charts with three sets of parameters of 9248 and 18496, it can be seen that too many parameters cannot play a positive role in the embedding of watermarks, but make the model more complicated.

[0094] In summary, when a certain key length and parameter accuracy are met, its implementation effect is equivalent to general federated learning. At the same time, it can be seen from the encryption time of each key length recorded in the experiment that when the key is longer and the model parameters are more, the Paillier encryption time is also longer. Therefore, it is necessary to comprehensively consider the actual security requirements, model complexity and time constraints. Under the premise of balancing these three points, secure federated learning based on Paillier encryption has good feasibility. According to the experimental model, the embedding of watermarks is closely related to the number of watermark layer parameters, the sample size of participants, the watermark length and the adjustable parameters. In order to better embed watermarks in practice, it is first necessary to consider the relationship between the target watermark length and the number of watermark parameters, and then adjust the adjustable parameters of participants with smaller sample sizes to improve the speed and effect of their watermark embedding.

[0095] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0096] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0097] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0098] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. The artificial intelligence model federated learning method combining homomorphic encryption and model watermarking is characterized by: The following steps are involved: Step 1: The central server numbers and randomly groups multiple participants, and sends the target artificial intelligence model and the corresponding number to each participant, where the loss function of the target artificial intelligence model is the loss function regularized by the regularizer constructed by the watermark information and the projection matrix corresponding to the watermark; Step 2: Each participant obtains a homomorphic encryption key, and generates a homomorphic encryption key through a reliable third-party key management center. The third-party management center distributes the key to each participant, and the keys distributed to each participant in the same group are the same. Step 3: Each participant uses local data to train the target artificial intelligence model obtained in step 1 to obtain a trained local model and model parameters. During training, the model parameters are updated through a loss function, thereby embedding the watermark into the trained local model. Step 4, each participant uses the key obtained in step 2 to encrypt the model parameters; Step 5, each participant sends the encrypted model parameters to the central server, and the central server aggregates the model parameters sent by the participants belonging to the same group; In step 5, the polymerization process is as follows: Among them, W i Represents client C i Locally trained model parameters; [W i ] indicates that W i Perform encryption operations; represents the updated model parameters of the Nth group of users weighted by data volume; Represents client C i Updated model parameters; represents the additive homomorphism of Paillier homomorphic encryption; D represents the total amount of group member data; D i Represents client C i With the additive homomorphism of the Paillier algorithm, the central server aggregates the model parameters without the model parameters being visible. Step 6: The central server sends the aggregated model parameters to each participant in the corresponding group. After each participant decrypts the aggregated model parameters, it updates the local model using the decrypted aggregated model parameters. Step 7: Repeat steps 1-6 to perform multiple rounds of training on the target AI model.

2. The artificial intelligence model federated learning method combining homomorphic encryption and model watermarking according to claim 1 is characterized in that: In step 1, a watermark is obtained by using the number of each participant as the watermark information, and a regularization function is constructed based on the watermark and the projection matrix of the watermark. Then, the original loss function of the target artificial intelligence model is regularized by the regularization function. Thus, the loss function with the regularizer embeds the watermark into the model when the model parameters are updated during the training process.

3. The artificial intelligence model federated learning method combining homomorphic encryption and model watermarking according to claim 2 is characterized in that: The loss function E(ω) with regularizer is defined as: E(ω) = E0(ω) + λE R (ω) Where E0(ω) is the original loss function, λ is an adjustable parameter, ω is the model parameter vector, and E R (ω) is the regularization term that imposes restrictions on the parameter ω, E R (ω) Define the loss function for the regularizer using binary cross entropy: where b j is the jth watermark to be embedded, y j is the jth embedded watermark, which is defined as: y j =σ(Σ i X ji oh i ) Where X ji The projection matrix defined by the central server follows the standard normal distribution, j corresponds to the watermark position, i corresponds to the model parameter position, ω i is the i-th model parameter in the ω parameter vector, and σ(·) is the sigmoid function:

4. The artificial intelligence model federated learning method combining homomorphic encryption and model watermarking according to claim 1 is characterized in that: In step 2, the Paillier encryption method in homomorphic encryption is used to generate the key.

5. The artificial intelligence model federated learning method combining homomorphic encryption and model watermarking according to claim 1 is characterized in that: In step 7, during each round of training, the participant senses whether the accuracy of the local model after the previous round of training has decreased. If so, the participant applies to the central server to terminate this round of training. The central server registers the number of the participant who terminates the training midway, and counts the number of times each participant terminates the training midway. When the number of times a participant terminates the training midway reaches the set threshold, the central server expels the corresponding participant from the entire task.

6. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the method according to any one of claims 1-5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images