A Secure Federated Learning Method Based on Ciphertext Filtering under Unbalanced Gradients

Abstract

The present invention discloses a secure federated learning method based on ciphertext filtering under unbalanced gradients. First, a lightweight encryption protocol based on blinding is studied and designed to achieve secure transmission and aggregation of local gradients of users participating in federated learning, with low computational overhead. Based on the lightweight encryption protocol, the present invention constructs a gradient filtering algorithm under ciphertext, which filters out abnormal gradients that differ significantly from global model parameters without exposing the privacy of local gradients, effectively improving the accuracy of the global model. Under a defined threat model, it is demonstrated that the method of the present invention can meet the privacy requirements of local gradients of users participating in federated learning. Experiments show that compared with existing solutions, the present invention has better security, computational efficiency, and accuracy.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning with privacy protection and high accuracy, and in particular to a secure federated learning method based on ciphertext filtering under unbalanced gradients. Background Art

[0002] With the rapid development of the internet and big data, users are collecting and storing vast amounts of data. However, due to location and business constraints, the datasets held by each user lack diversity. To obtain better models, users want to collaborate on training by sharing data, but they do not want to expose their local datasets. Against this backdrop, federated learning, a machine learning method that achieves both data sharing and data privacy, has been proposed. Federated learning enables users with datasets to jointly train a better global model by uploading local gradients from local training rather than the original dataset, addressing the issues of uniform datasets and privacy protection.

[0003] However, federated learning also brings some security issues and challenges. The latest research shows that attackers can infer information about their original data set from the local gradients uploaded by users. In order to ensure the privacy and security of users' local gradients and avoid the risk of leakage during transmission and aggregation, the gradients need to be encrypted before uploading. In 2020, Zhou et al. proposed a federated learning scheme in the paper "Privacy-preserving federated learning in fog computing", which combines blind encryption and Paillier homomorphic encryption to achieve secure transmission and aggregation of local gradients, avoiding the leakage of gradient privacy, but incurring expensive computational overhead.

[0004] In addition, existing federated learning methods rarely consider the reliability of user local gradients. Due to the inconsistent quality of datasets and differences in computing power among users, the trained local gradients may seriously deviate from the global model. More seriously, malicious users may upload some erroneous or carefully designed gradients to disrupt the training of the federated learning model. Therefore, how to filter out abnormal local gradients during the aggregation process and improve the accuracy of the global model is an urgent problem to be solved in federated learning. In 2018, Chen et al. designed the Byzantine gradient descent method in the paper "Distributed statistical machine learning inadversarial settings: Byzantine gradient descent" to solve the above problem. In each round of gradient aggregation, the aggregation server selects the middle value of the collected local gradients to avoid the influence of abnormal gradients. However, the gradients of this scheme are transmitted in plain text, which poses the problem of data privacy leakage. Summary of the Invention

[0005] The present invention aims to address the aforementioned shortcomings of the prior art by providing a secure federated learning method based on ciphertext filtering under unbalanced gradients. This method first designs a lightweight gradient encryption and aggregation protocol based on blinding. Based on this, a ciphertext gradient filtering method is constructed. This method compares the local gradients uploaded by the user with the global model parameters. Without compromising the privacy of the local gradients, it filters out anomalous gradients with large discrepancies, thus achieving an efficient federated learning method that protects the privacy of the user's local gradients and improves the accuracy of the global model.

[0006] The purpose of the present invention can be achieved by taking the following technical solutions:

[0007] A secure federated learning method based on ciphertext filtering under unbalanced gradients, the secure federated learning method comprising the following steps:

[0008] S1. System initialization: The trusted organization TA is the aggregation server S A , filtering server S F and user u participating in federated learning i Generate and distribute keys, assuming there are n users in total, and the i-th user is represented by u i , satisfying 1≤i≤n; the trusted institution TA first runs the key generation algorithm KeyGen(1 λ ), where λ is a security parameter, generates a public key PK and private keys SK1 and SK2; then the trusted organization TA sends the private key SK1 to the aggregation server S A , send the private key SK2 to the filtering server S F, send the public key PK to each user u1,u2,…,u n ; In addition, the aggregation server S A Initialize global model parameters Sent to each user u i To start federated learning training;

[0009] S2, training and encryption of local gradients: In the tth round of iteration, after receiving the global model parameters of the t-1th round After that, each user u participating in federated learning i Based on the local dataset D i , through the local training algorithm Local Train Train the local gradient of the tth round Then, user u i Run the encryption algorithm Encrypt where r i For user u i A randomly selected number, output encryption result C i , and upload it to the aggregation server S A ;

[0010] S3. Partial decryption and blinding of gradients: For each user u i Uploaded ciphertext C i , aggregation server S A Run the partial decryption and blinding algorithm Partially Decrypt (SK1, C i ,β), where β is the aggregation server S A A randomly selected number, output processing result C′ i , sent to the filtering server S F ;

[0011] S4, Gradient filtering under ciphertext: Filtering server S F Received through the aggregation server S A Processed ciphertext C′ i Then, run the gradient filtering algorithm Filter(SK2,C′ i ), compare and filter the local gradients and global model parameters of each user under ciphertext, and output the user set that meets the aggregation requirements and the corresponding random number and sum r , then and sum r Return to the aggregation server S A ;

[0012] S5, local gradient aggregation: aggregation server S A Execute the gradient aggregation algorithm Input filtering server S F Returned user collection and random numbers and sum r , output the global model parameters of this round And broadcast it to users participating in federated learning to continue the next round of iterative training until the pre-specified number of training rounds is reached.

[0013] Furthermore, the key generation algorithm KeyGen(1 λ ), the trusted organization TA selects a large prime number p of λ bits, a cyclic group G of order p, and a generator g of the cyclic group G; then randomly selects two numbers Generate a public key Private key SK1 = s1, SK2 = s2, and p and g are made public; In this step, the improved ElGamal algorithm is used to generate public and private keys, which ensures the secure transmission and aggregation of user local gradients and prevents the filtering server S from F Collusion attacks between malicious users can effectively prevent the leakage of local gradient privacy.

[0014] Furthermore, the local training algorithm Local Train in step S2 In the i Input the global model parameters for round t-1 Local dataset D i , output the local gradient of this round The formula is as follows:

[0015]

[0016]

[0017] Among them, h w (·) represents the objective function about w, J(·) is the loss function, and m is the dataset D i The size of (x (v) ,y (v) ) represent the dataset D i The feature value and label of α represents the learning rate. In this step, each user uses the stochastic gradient descent algorithm SGD to train the local gradient. In this process, as the gradient With the iterative change of , the loss function J(w) gradually becomes smaller. When the loss function is 0, the model reaches the local optimum.

[0018] Furthermore, the encryption algorithm in step S2 In, enter the public key PK and blinding factor r i , the local gradient obtained from the tth round of training Output ciphertext C i =(c i1 ,c i2 ,c i3 ):

[0019]

[0020]

[0021] c i3 =g d

[0022] in, PK is the public key distributed by a trusted institution, and the blinding factor r i For user u i A randomly selected number, local gradient g is the generator g of the cyclic group G selected by the trusted authority TA. In this step, each user first uses a randomly generated blinding factor r i Blind the local gradient and then use the improved ElGamal algorithm to blind the factor r i Encryption not only protects the user's local gradient privacy, but also reduces the computational overhead of encryption and improves the efficiency of local gradient aggregation.

[0023] Furthermore, the partial decryption algorithm Partially Decrypt (SK1, C i ,β,r0) is implemented as follows:

[0024] S31, when the aggregation server S A Received from each user u i Uploaded ciphertext C i After that, a number is randomly selected as the blinding factor β, and then the ciphertext c is coded using the private key SK1 and the blinding factor β. i2 Partially decrypt and blind to get c′ i2 :

[0025]

[0026] Among them, SK1 is the private key s1 distributed by the trusted organization TA, c i2 For user u i Uploaded gradient ciphertext C i In this step, due to the aggregation server S A The ciphertext is processed using a blinding factor β to prevent the filtering server S F Infer the sensitive information of the user's local gradient; then, the aggregation server S A Calculate the difference between the local gradient and the global model parameter ciphertext Δi :

[0027]

[0028] in, represents the global model parameters of the t-1th round, r i For user u i The blinding factor is chosen; finally, the aggregation server S A Generate the updated ciphertext C′ of the gradient i =(i,c′ i2 ,c i3 ,Δ i ); the difference value Δ calculated in this step i Make the filtering server S F Compare local gradients in the case of ciphertext to avoid leakage of gradient privacy;

[0029] S32, before sending the gradient update ciphertext, the aggregation server S A First, user u i The serial number is randomly converted into u j , and store (i, j) in the user sequence mapping table map, and finally process the gradient ciphertext C′ j =(j,c′ j2 ,c j3 ,Δ j ) is sent to the filtering server S F In this step, due to the aggregation server S A Sent to filtering server S F The gradient ciphertext is converted into user serial number, S F Unable to know βr B Therefore, the present invention can resist malicious users and filtering server S F Collusion attack between them.

[0030] Furthermore, the gradient filtering algorithm Filter(SK2, C′) under the ciphertext in step S4 j )The implementation process is as follows:

[0031] S41. For each user u j The corresponding gradient ciphertext C′ j , filtering server S F First, use the private key SK2 to calculate the gradient ciphertext C′ j The corresponding blinded random number βr j :

[0032]

[0033] Among them, c′ j2 Aggregation server S A Processed user u j Gradient ciphertext, SK2 is the private key s2 distributed by the trusted organization; in this step, the aggregation server S F The user random number obtained by decryption is blinded, so the user's local gradient plaintext information cannot be inferred. F Calculate the difference Δ′ between the local gradient and the global model parameter ciphertext j :

[0034]

[0035] in, Represents user u j The local gradient obtained in the tth round of training, represents the global model parameters of the t-1th round;

[0036] S42, based on Euclidean distance calculation, filter server S F Calculate for each user u j The similarity value between the local gradient of t-1 and the global model parameters Then all users u i The median of the similarity values median(dst1,dst2,…,dst n ) as the comparison value, where median(·) is the function of finding the median, and n represents the number of users participating in federated learning; for each user u j , filtering server S F Determine dst j ≤value, if true, then add the user's serial number to the user set that meets the aggregation gradient requirements After filtering out the abnormal local gradients, the filtering server S F Calculate the user set The corresponding sum of blinded random numbers And and sum r Return to the aggregation server S A In this step, the similarity between the user's local gradient and the global model parameters is calculated based on the Euclidean distance. When the similarity value is greater than the comparison value, it means that the difference between the local gradient and the global model parameters is large, which may affect the training effect of the model. Therefore, the local gradient needs to be filtered out. In addition, the similarity is calculated under ciphertext, and the local gradients of each user are blinded. Their privacy will not be leaked, thereby ensuring the security of the local dataset.

[0037] Furthermore, the aggregation algorithm The implementation process is as follows:

[0038] Input filtering server S F Returned user list The corresponding blinded random number and sum r and user u i The corresponding gradient ciphertext C i , aggregation server S A First, based on the mapping table map and user collection Restore the user collection before the serial number conversion Then calculate the random number and in Next, the aggregation server S A Just through a simple addition operation, the total aggregated local gradient of the user in round t can be calculated.

[0039]

[0040] Among them, c k1 Represents user u k Blinded local gradient Finally, the aggregation server S A Will As the global model parameters for round t, Represents the set of users that meet the aggregation requirements The size of the model is then broadcast to all participating federated learning users for the next round of federated learning training. In this step, the aggregation server only needs to summarize the gradient ciphertexts corresponding to each user in the set of users that meet the aggregation requirements to obtain the global model parameters for that round, effectively reducing computational overhead.

[0041] The present invention has the following advantages and effects compared to the prior art:

[0042] (1) This paper designs a lightweight encryption protocol based on blinding. First, the user's local gradient is blinded, and then the blinding factor is encrypted using an improved public key cryptography algorithm. This not only protects the privacy of the user's local gradient, but also achieves secure and efficient aggregation of local gradients with low computational overhead.

[0043] (2) Based on the above encryption protocol, the present invention constructs a gradient filtering algorithm under ciphertext. Without leaking the privacy of the user's local gradient, the similarity between the local gradient and the global model parameters is calculated based on the Euclidean distance, and abnormal gradients with large differences are filtered out, thereby improving the accuracy of the global model.

[0044] (3) Under a defined threat model, the present invention assumes that the aggregator, the filtering server, and the users participating in federated learning are all honest but curious. Assuming that both servers and the federated learning user will operate according to the prescribed protocol but may be curious about the local gradient information of other users, and that collusion attacks between the aggregator and the filtering server are not permitted, this method proves that it can meet the privacy requirements of the user's local gradient. Furthermore, experiments show that this scheme has better accuracy and computational efficiency than existing schemes. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0046] Figure 1 This is a system design diagram of a secure federated learning method based on ciphertext filtering under unbalanced gradients disclosed in an embodiment of the present invention;

[0047] Figure 2 This is a flow chart of a secure federated learning method based on ciphertext filtering under unbalanced gradients disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0049] Example 1

[0050] With the rapid development of the internet and big data, users have collected and stored vast amounts of data. However, due to location and business constraints, individual user datasets lack diversity. To achieve more effective models, users seek to collaborate on training through data sharing, but they also do not want to expose their local datasets, which poses significant data privacy challenges. Against this backdrop, federated learning, a machine learning method that strikes a balance between data sharing and data privacy, has been proposed. Federated learning enables users with data to collaboratively build a better global model by uploading locally trained model parameters instead of datasets, addressing the issues of individual datasets and privacy. However, federated learning also presents security concerns and challenges. Recent research has shown that attackers can infer information about their original datasets from uploaded local gradients. To protect users' local gradients, they must be encrypted before uploading to avoid the risk of gradient leakage during transmission and aggregation. Furthermore, due to poor dataset quality or insufficient computing resources, some users' trained local gradients deviate from the global model. More seriously, malicious users may upload erroneous or carefully crafted gradients, disrupting the training of federated learning models. Therefore, how to filter out abnormal local gradients during the aggregation process and improve the accuracy of the global model is another urgent problem that needs to be solved in federated learning.

[0051] To address the above issues, this embodiment primarily studies a secure federated learning method based on ciphertext filtering under unbalanced gradients. First, a lightweight encryption protocol based on blinding is designed to achieve secure and efficient encryption and aggregation of local gradients with low computational overhead. Based on this protocol, the present invention constructs a local gradient filtering algorithm under ciphertext. While protecting the privacy of local gradients, it filters out anomalous gradients and improves the accuracy of the global model.

[0052] The following combination Figure 1 The specific process of a secure federated learning method based on ciphertext filtering under unbalanced gradients disclosed in this embodiment is described in detail:

[0053] S1, system initialization: the trusted authority TA runs the key generation algorithm KeyGen(1 λ ), where λ is a security parameter, generates private keys SK1, SK2 and public keys PK; SK1 and SK2 are respectively generated by the aggregation server S A and filtering server S F Save; the public key PK is saved by each user u1,u2,…,u participating in federated learning n Save, where n represents the number of users; In addition, the aggregation server S A Initialize global model parameters Sent to each user u iTo start federated learning training.

[0054] Among them, the key generation algorithm KeyGen(1 λ ) The process is as follows:

[0055] The trusted institution TA first selects a large prime number p with λ bits, G is a p-order cyclic group, and g is its generator; then it randomly selects two integers Generate a public key Private key SK1 = s1, SK2 = s2, and p and g are made public; Finally, TA sends the private keys SK1 and SK2 to the aggregation server S respectively. A and filtering server S F , the public key PK is sent to each user participating in federated learning.

[0056] S2, local gradient training and encryption: In the tth round of iteration, after receiving the global model parameters of the previous round After that, each user u participating in federated learning i , based on the local dataset D i , through the local training algorithm Local Train Train the local gradient of this round Then, user u i Run the encryption algorithm Encrypt where r i is u i A randomly selected integer, output encryption result C i , and upload it to the aggregation server S A ;

[0057] Among them, the encryption algorithm Encrypt The process is as follows:

[0058] For each user u i , first randomly select a number r i As a blinding factor, and then use the public key PK and the local gradient obtained in this round of training Calculate the ciphertext C of the local gradient of this round i =(c i1 ,c i2 ,c i3 ):

[0059]

[0060]

[0061] c i3 =g d

[0062] in, g is the generator generated by the trusted authority TA;

[0063] S3. Partial decryption and blinding of gradients: For each user u i Uploaded ciphertext C i , aggregation server S A Run the partial decryption and blinding algorithm Partially Decrypt (SK1, C i ,β), where β is S A A randomly selected integer, output processing result C′ i , sent to the filtering server S F ;

[0064] Among them, the partial decryption and blinding algorithm Partially Decrypt (SK1, C i ,β) process is as follows:

[0065] When the aggregation server S A Received from each user u i Uploaded ciphertext C i After that, a number is randomly selected as the blinding factor β, and then the ciphertext c is coded using the private key SK1 and the blinding factor β. i2 Partially decrypt and blind to get c′ i2 :

[0066]

[0067] Among them, SK1 is the private key s1 distributed by the trusted organization TA, c i2 For user u i Uploaded gradient ciphertext C i Then, the aggregation server S A Calculate the difference between the local gradient and the global model parameter ciphertext Δ i : in, represents the global model parameters of the previous round, r i For user u i The blinding factor is chosen; finally, the aggregation server S A Generate the updated ciphertext C′ of the gradient i =(i,c′ i2 ,c i3 ,Δ i ).

[0068] Before sending the gradient update ciphertext, in order to avoid filtering the server S F and collusion attacks between malicious users, aggregation server S A First, user u i The serial number is randomly converted into uj , and store (i, j) in the user sequence mapping table map, and finally process the gradient ciphertext C′ j =(j,c′ j2 ,c j3 ,Δ j ) is sent to the filtering server S F .

[0069] S4, Gradient filtering under ciphertext: Filtering server S F Received through the aggregation server S A Processed ciphertext C′ i Then, run the gradient filtering algorithm Filter(SK2,C′ i ), compare and filter the local gradients and global model parameters of each user under ciphertext, and output the user set that meets the aggregation requirements and the corresponding random number and sum r , then sum r Return to the aggregation server S A .

[0070] Among them, the gradient filtering algorithm Filter(SK2,C′ i ) The process is as follows:

[0071] For each user u j The corresponding ciphertext C′ j , filtering server S F First, use the private key SK2 to calculate the corresponding blinded random number βr j :

[0072]

[0073] Among them, c′ j2 Aggregation server S A Processed user u j Gradient ciphertext, SK2 is the private key s2 distributed by the trusted organization; then, filter server S F Then calculate the difference Δ′ between the local gradient and the global model parameter ciphertext j :

[0074]

[0075] in, Represents user u j The local gradient trained in the tth round, represents the global model parameters at round t-1.

[0076] Based on Euclidean distance calculation, filter server S FCalculate for each user u j The similarity value between the local gradient of the previous round and the global model parameters Then all users u i The median of the similarity values median(dst1,dst2,…,dst n ) as the comparison value, where median(·) is the function of finding the median, and n represents the number of users participating in federated learning; for each user u j , filtering server S F Determine dst j ≤value, if true, then add the user's serial number to the user set that meets the aggregation gradient requirements After filtering out the abnormal local gradients, the filtering server S F Calculate the user set The corresponding sum of blinded random numbers And sum r Return to the aggregation server S A .

[0077] S5, local gradient aggregation: aggregation server S A Execute the gradient aggregation algorithm Input filtering server S F Returned user collection and random numbers and sum r , output the global model parameters of this round And broadcast it to users participating in federated learning to continue the next round of iterative training.

[0078] Among them, the gradient aggregation algorithm The process is as follows:

[0079] Aggregation Server S A Received from filtering server S F Returned user list and the corresponding blinded random number and sum r After that, based on the mapping table map and user collection Restore the user collection before the serial number conversion Then calculate the random number and in Finally, the aggregation server S A Calculate the total aggregated local gradient of users in round t

[0080]

[0081] Among them, c k1 Represents user u k Blinded local gradient Finally, the aggregation server S A Will As the global model parameters of this round, Represents the set of users that meet the aggregation requirements The size of the federated learning task is then broadcast to each user for the next round of federated learning training.

[0082] In terms of model accuracy, this embodiment compares a secure federated learning method based on ciphertext filtering under unbalanced gradients with the literature [1].

[0083] Among them, the author, title and source of document [1] are B.McMahan, E.Moore, D.Ramage, S.Hampson, and B.Ay Arcas, “Communication-efficient learning of deep networks from decentralized data,” vol.54, pp.1273–1282, 2017.

[0084] The accuracy of the global model trained with federated learning was verified using the MNIST handwritten digit recognition dataset. This dataset contains images of digits from 0 to 9. Specific statistics are shown in Table 1: There are 60,000 training images and 10,000 test images.

[0085] Table 1. Basic statistics of the MNIST dataset

[0086] Dataset training set Test set MNIST 60000 10000

[0087] Example 2

[0088] Based on the secure federated learning method based on ciphertext filtering under unbalanced gradient disclosed in the above-mentioned embodiment 1, this embodiment continues to compare the secure federated learning method based on ciphertext filtering under unbalanced gradient with references [2] and [3] in terms of model accuracy.

[0089] The author, title, and source of [2] are Y.Chen, L.Su, and J.Xu, “Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,” p.96, 2018.

[0090] The author, title, and source of [3] are C. Zhou, A. Fu, S. Yu, W. Yang, H. Wang, and Y. Zhang, “Privacy-preserving federated learning in fog computing,” IEEE Internet Things J., vol. 7, no. 11, pp. 10 782–10793, 2020.

[0091] The accuracy of the global model trained using federated learning was verified using the MNIST handwritten digit recognition dataset. This dataset contains images of digits from 0 to 9. The specific statistics are shown in Table 1 above, including 60,000 training images and 10,000 test images.

[0092] Table 2. Comparison of global model accuracy between the present invention and related solutions

[0093] Number of training rounds 200 400 600 800 1000 The present invention 94.21％ 96.66％ 98.41％ 96.86％ 98.42％ References[1] 91.17％ 97.00％ 97.44％ 97.08％ 95.42％ References[2] 93.09％ 92.25％ 93.76％ 93.02％ 91.94％ References[3] 94.33％ 93.19％ 92.52％ 88.51％ 92.56％

[0094] As can be seen from Table 2, as the number of training rounds increases, the model accuracy of the present invention and document [1] is relatively higher than that of references [2, 3]. This is because the present invention and document [1] filter abnormal local gradients that differ greatly from the global model parameters during the gradient aggregation process, thereby effectively improving the model accuracy. Compared with document [1], the gradient filtering method of the present invention is performed under ciphertext, which protects the local gradient privacy of federated learning users while improving the model accuracy.

[0095] In terms of computational overhead, the proposed secure federated learning method based on ciphertext filtering under unbalanced gradients is compared with the literature [3] to verify the computational efficiency of local gradient encryption in federated learning training. The results are shown in Table 3.

[0096] Table 3. Comparison of encryption time between the present invention and related schemes (unit: seconds)

[0097] Number of training rounds 100 200 300 400 The present invention 0.923 1.773 2.639 3.488 References[3] 2.164 4.414 6.585 8.796

[0098] As can be seen from Table 3, the encryption time required by the present invention and reference [3] increases with the number of training rounds, but the encryption time of the present invention is relatively small. This is because the encryption method in reference [3] directly performs homomorphic encryption on the local gradient, which has a large computational overhead. However, in the encryption method of the present invention, the local gradient is blinded first, and then the blinding factor is encrypted, which effectively reduces the computational overhead.

[0099] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. A secure federated learning method based on ciphertext filtering under unbalanced gradients, characterized by: The secure federated learning method comprises the following steps: S1. System initialization: The trusted organization TA is the aggregation server S A , filtering server S F and user u participating in federated learning i Generate and distribute keys, assuming there are n users in total, and the i-th user is represented by u i , satisfying 1≤i≤n; the trusted institution TA first runs the key generation algorithm KeyGen(1 λ ), where λ is a security parameter, generates a public key PK and private keys SK1 and SK2; then the trusted organization TA sends the private key SK1 to the aggregation server S A , send the private key SK2 to the filtering server S F , send the public key PK to each user u1,u2,…,u n ; In addition, the aggregation server S A Initialize global model parameters Sent to each user u i To start federated learning training; S2, training and encryption of local gradients: In the tth round of iteration, after receiving the global model parameters of the t-1th round After that, each user u participating in federated learning i Based on the local dataset D i , through the local training algorithm Train the local gradient of the tth round Then, user u i Run the encryption algorithm where r i For user u i A randomly selected number, output encryption result C i , and upload it to the aggregation server S A ; S3. Partial decryption and blinding of gradients: For each user u i Uploaded ciphertext C i , aggregation server S A Run the partial decryption and blinding algorithm Partially Decrypt (SK1, C i ,β), where β is the aggregation server S A A randomly selected number, output processing result C′ i , sent to the filtering server S F ; Among them, Partially Decrypt(SK1,C i ,β) is implemented as follows: S31, when the aggregation server S A Received from each user u i Uploaded ciphertext C i After that, a number is randomly selected as the blinding factor β, and then the ciphertext c is coded using the private key SK1 and the blinding factor β. i2 Partially decrypt and blind to get c′ i2 : Among them, SK1 is the private key s1 distributed by the trusted organization TA, c i2 For user u i Uploaded gradient ciphertext C i Then, the aggregation server S A Calculate the difference between the local gradient and the global model parameter ciphertext Δ i : in, represents the global model parameters of the t-1th round, r i For user u i The blinding factor is chosen; finally, the aggregation server S A Generate the updated ciphertext C′ of the gradient i =(i,c′ i2 ,c i3 ,Δ i ); S32, before sending the gradient update ciphertext, the aggregation server S A First, user u i The serial number is randomly converted into u j , and store (i, j) in the user sequence mapping table map, and finally process the gradient ciphertext C′ j =(j,c′ j2 ,c j3 ,Δ j ) is sent to the filtering server S F ; S4, Gradient filtering under ciphertext: Filtering server S F Received through the aggregation server S A Processed ciphertext C′ i Then, run the gradient filtering algorithm Filter(SK2,C′ i ), compare and filter the local gradients and global model parameters of each user under ciphertext, and output the user set that meets the aggregation requirements and the corresponding random number and sum r , then and sum r Return to the aggregation server S A ; Among them, Filter(SK2,C′ j )The implementation process is as follows: S41. For each user u j The corresponding gradient ciphertext C′ j , filtering server S F First, use the private key SK2 to calculate the gradient ciphertext C′ j The corresponding blinded random number βr j : Among them, c′ j2 Aggregation server S A Processed user u j Gradient ciphertext, SK2 is the private key s2 distributed by the trusted organization; then, the filtering server S F Calculate the difference Δ′ between the local gradient and the global model parameter ciphertext j : in, Represents user u j The local gradient obtained in the tth round of training, represents the global model parameters of the t-1th round; S42, based on Euclidean distance calculation, filter server S F Calculate for each user u j The similarity value between the local gradient of t-1 and the global model parameters Then all users u i The median of the similarity values median(dst1,dst2,…,dst n ) as the comparison value, where median(·) is the function of finding the median, and n represents the number of users participating in federated learning; for each user u j , filtering server S F Determine dst j ≤value, if true, then add the user's serial number to the user set that meets the aggregation gradient requirements After filtering out the abnormal local gradients, the filtering server S F Calculate the user set The corresponding sum of blinded random numbers And and sum r Return to the aggregation server S A ; S5, local gradient aggregation: aggregation server S A Execute the gradient aggregation algorithm Input filtering server S F Returned user collection and random numbers and sum r , output the global model parameters of this round And broadcast it to users participating in federated learning to continue the next round of iterative training until the pre-specified number of training rounds is reached.

2. A secure federated learning method based on ciphertext filtering under unbalanced gradient according to claim 1, characterized in that: The key generation algorithm KeyGen(1 λ ), the trusted organization TA selects a large prime number p of λ bits, a cyclic group G of order p, and a generator g of the cyclic group G; then randomly selects two numbers Generate a public key Private key SK1 = s1, SK2 = s2, and p and g are made public, where 3. The secure federated learning method based on ciphertext filtering under unbalanced gradient according to claim 1, characterized in that: The local training algorithm In the previous round, enter the global model parameters User i Local dataset D i , output the local gradient of this round The formula is as follows: Among them, h w (·) represents the objective function about w, J(·) is the loss function, and m is the dataset D i The size of (x (v) ,y (v) ) represent the dataset D i The feature values and labels of , α represents the learning rate.

4. A secure federated learning method based on ciphertext filtering under unbalanced gradient according to claim 1, characterized in that: The encryption algorithm In, enter the public key PK and blinding factor r i , the local gradient obtained from the tth round of training Output ciphertext C i =(c i1 ,c i2 ,c i3 ): c i3 =g d in, PK is the public key distributed by a trusted institution, and the blinding factor r i For user u i A randomly selected number, local gradient g is the generator of the cyclic group G selected by the trusted authority TA.

5. The secure federated learning method based on ciphertext filtering under unbalanced gradient according to claim 1, characterized in that: The aggregation algorithm The implementation process is as follows: Input filtering server S F Returned user list The corresponding blinded random number and sum r and user u i The corresponding gradient ciphertext C i , aggregation server S A First, based on the mapping table map and user collection Restore the user collection before the serial number conversion Then calculate the random number and in Next, the aggregation server S A Calculate the total aggregated local gradient of users in round t Among them, c k1 Represents user u k Blinded local gradient Finally, the aggregation server S A Will As the global model parameters for round t, Represents the set of users that meet the aggregation requirements The size of the federated learning dataset is then broadcast to users participating in the federated learning for the next round of federated learning training.

Images