Mostly maliciously robust privacy federated learning methods, systems, devices, and media

Abstract

The embodiment of the application relates to the technical field of information security, in particular to a robust privacy federated learning method under a majority of malicious conditions, a system, equipment and a medium, the method comprising the following steps: training a local model by using local data, and calculating model gradients and root gradients; quantizing and encoding the model gradients and the root gradients; generating secret shares of the model gradients and the root gradients by using a sampling secret sharing method; calculating Hamming distance shares based on the secret shares of the model gradients and the root gradients; calculating client weight shares based on the Hamming distance shares; generating multiplication triplets by using a relevant careless product, and weighting model shares to obtain local weighted shares; and updating a global model based on the local weighted shares. The application can realize anti-model poisoning attack and protect client data privacy under a majority of malicious conditions, and the sampling secret sharing technology can efficiently calculate Hamming distance and model weighted average, thereby reducing overall calculation overhead.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a robust privacy-preserving federated learning method, system, device, and medium under multiple malicious attacks. Background Technology

[0002] Data security is a critical factor in the application and development of federated learning, attracting widespread attention from governments, industries, and academia both domestically and internationally. However, due to the distributed nature of federated learning, malicious adversaries can easily launch model poisoning attacks to degrade the performance of the global model, or even render it unusable. Furthermore, traditional privacy protection mechanisms incur significant computational overhead when defending against model poisoning attacks; performing robust aggregation under ciphertext introduces numerous encryption operations, making the computation process more redundant and complex, thus impacting the security, efficiency, and usability of federated learning model training. Summary of the Invention

[0003] This application provides a robust privacy-preserving federated learning method, system, device, and medium under majority malicious conditions. It achieves resistance to model poisoning attacks and protects client data privacy in majority malicious environments. Furthermore, the use of sampling secret sharing technology can efficiently calculate Hamming distance and model weighted average, avoiding the process of converting from Boolean sharing to arithmetic sharing, and greatly reducing the overall computational overhead.

[0004] To address the aforementioned technical problems, in a first aspect, embodiments of this application provide a robust privacy-preserving federated learning method under majority malicious conditions, comprising the following steps: training a local model using local data, and calculating the model gradient and root gradient respectively; quantizing and encoding the model gradient and root gradient respectively; generating secret shares of the model gradient and root gradient using a sampling secret sharing method; calculating Hamming distance shares based on the secret shares of the model gradient and root gradient; calculating client weight shares based on the Hamming distance shares; efficiently generating multiplicative triples using relevant unintentional products, and weighting the model gradients to obtain local weighted shares; and updating the global model based on the local weighted shares.

[0005] In some exemplary embodiments, training a local model using local data and calculating the model gradient and root gradient respectively includes: each client participating in this round of aggregation loads the current global model and trains the local model using local data to obtain the trained local model; the client calculates the model gradient using the trained local model; the master server trains the root model using the local dataset and calculates the root gradient based on the trained root model; the master server is a server that maintains a clean dataset locally.

[0006] In some exemplary embodiments, the model gradient and the root gradient are quantized and encoded respectively, including: the client quantizes and encodes the model gradient; the main server quantizes and encodes the root gradient; quantization normalizes the gradient; and encoding converts the gradient into binary values ​​of 0 and 1.

[0007] In some exemplary embodiments, generating the secret share of the model gradient includes: the client initializes a zero vector as one share of the model gradient; a random algorithm is used to select half of the zero vector and assign it a value corresponding to the model gradient, and then the other positions of the model gradient are assigned 0 as the secret share of the model gradient; the client sends one share of the model gradient to the main server and sends the secret share of the model gradient to the secondary server.

[0008] In some exemplary embodiments, generating a secret share of the root gradient includes: the master server initializes a zero vector as one share of the root gradient; a random algorithm is used to select half of the zero vector and assign it the value corresponding to the root gradient, and then the other positions of the root gradient are assigned 0 as the secret share of the root gradient; the master server retains one share of the root gradient and sends the secret share of the root gradient to the secondary server.

[0009] In some exemplary embodiments, calculating the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient includes: the master server locally calculating a share of the Hamming distance between the secret share of the model gradient and the secret share of the root gradient based on the secret share of the model gradient and the secret share of the root gradient; the secondary server locally calculating another share of the Hamming distance between the secret share of the model gradient and the secret share of the root gradient based on the secret share of the model gradient and the secret share of the root gradient; the formula for calculating the Hamming distance share is shown below:

[0010]

[0011] in, XOR; H() is the number of 0s in the binary form of the input value; This is one of the shares of the model gradient; This is the secret share of the model gradient.

[0012] In some exemplary embodiments, calculating the client weight share based on Hamming distance shares includes: the primary server and the secondary server jointly executing a confusion circuit to calculate the share of the client weight value; weighting the model gradient to obtain a local weighted share includes: the primary server and the secondary server respectively decoding the secret share of the model gradient and the secret share of the root gradient locally; the primary server efficiently generating multiplicative triples using relevant unintentional products in the offline stage; and the primary server and the secondary server performing a weighted average of the model gradient and the root gradient.

[0013] Secondly, embodiments of this application also provide a robust privacy-preserving federated learning system under multiple malicious scenarios, comprising a local training module, a quantization and encoding module, a secret share generation module, a calculation module, and a global model update module connected in sequence; the local training module is used to train a local model using local data and calculate the model gradient and the root gradient respectively; the quantization and encoding module is used to quantize and encode the model gradient and the root gradient respectively; the secret share generation module is used to generate the secret share of the model gradient and the secret share of the root gradient using a sampling secret sharing method; the calculation module includes a Hamming distance share calculation module, a client weight share calculation module, and a weighted calculation module; the Hamming distance share calculation module is used to calculate the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient; the client weight share calculation module is used to calculate the client weight share based on the Hamming distance share; the weighted calculation module is used to weight the model gradient to obtain a local weighted share; and the global model update module is used to update the global model based on the local weighted share.

[0014] In addition, this application also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described robust privacy federated learning method under most malicious conditions.

[0015] In addition, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described robust privacy-preserving federated learning method under most malicious conditions.

[0016] The technical solution provided in this application has at least the following advantages:

[0017] This application provides a robust privacy-preserving federated learning method, system, device, and medium under multiple malicious scenarios. The method includes the following steps: training a local model using local data, and calculating the model gradient and root gradient respectively; quantizing and encoding the model gradient and root gradient respectively; generating secret shares of the model gradient and secret shares of the root gradient respectively; calculating Hamming distance shares based on the secret shares of the model gradient and the secret shares of the root gradient; calculating client weight shares based on the Hamming distance shares; efficiently generating multiplicative triples using relevant unintentional products, and weighting the model gradients to obtain local weighted shares; and updating the global model based on the local weighted shares.

[0018] The robust privacy-preserving federated learning method under malicious conditions provided in this application first uses quantization encoding technology to make the client model gradient and root gradient suitable for calculating Hamming distance; secondly, it uses sampled secret sharing to generate gradient shares from the model gradient, and the Hamming distance shares are calculated locally by two non-colluding servers; then, it uses obfuscation circuit technology to calculate the share of client weights between servers; finally, the servers decode the gradient shares and perform a weighted average of the gradient shares to update the global model.

[0019] The method provided in this application can efficiently resist model poisoning attacks in most malicious environments while protecting client-side local privacy. This application overcomes the limitations of the majority honest environment by using the root of trust and Hamming distance similarity calculation criteria, and further improves model performance by adaptively amplifying the weights of non-malicious clients to compensate for the severe lack of effective information for model aggregation under malicious majority conditions. Furthermore, by utilizing the bitwise XOR property of Hamming distance, this application designs a sampling-based secret-sharing two-party computation framework, which not only protects client privacy during the resistance to model poisoning attacks but also avoids the additional complex calculations involved in calculating Hamming distance and weighted averaging under ciphertext, significantly reducing computational overhead. Attached Figure Description

[0020] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations do not constitute a limitation on the embodiments, and unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0021] Figure 1 A flowchart illustrating a robust privacy-preserving federated learning method under multiple malicious scenarios, provided as an embodiment of this application;

[0022] Figure 2 This is a schematic diagram of the structure of an obfuscation circuit provided in an embodiment of this application;

[0023] Figure 3This application provides a schematic diagram of the structure of a robust privacy-preserving federated learning system under multiple malicious scenarios, as an embodiment of the present application.

[0024] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] As the background technology indicates, current privacy-preserving federated learning methods, due to the distributed nature of federated learning, are vulnerable to model poisoning attacks by malicious adversaries, which can degrade the performance of the global model or even render it unusable. Furthermore, traditional privacy protection mechanisms incur significant computational overhead when defending against model poisoning attacks, making the computation process more redundant and complex, thus affecting the security, efficiency, and usability of federated learning model training.

[0026] Related technologies propose a trust-based method to resist model poisoning attacks in most malicious environments. This method first uses a server to train on a small, clean dataset to obtain a root gradient to guide model aggregation. Second, the server calculates the similarity between the gradient of the client-uploaded model and the root gradient using cosine distance. Then, different weights are assigned to different clients based on the similarity. Finally, the global model is updated by weighted averaging of the client model gradients using these weights. The drawbacks of this method are that the client's model is directly exposed to the server in its original form, making client privacy vulnerable to leakage. Furthermore, this scheme requires complex computational operations, such as cosine distance calculation, rescaling, and comparison, which are very expensive when evaluated in secure computation.

[0027] In addition, a related technology proposes a federated learning method based on Hamming distance and two-party secure computation to resist model poisoning attacks and protect client privacy in most malicious environments. This method uses two non-colluding servers to build a privacy framework to jointly update the global model. Specifically, the client generates a share of the model gradient using Boolean sharing and sends it to the two servers; then, the two servers calculate the Hamming distance share locally; then, homomorphic encryption is used to transform the Boolean sharing into algorithm sharing to support subsequent weighted average calculations; finally, the global model is updated. The drawback of this method is that while it uses Hamming distance instead of cosine similarity to reduce computational overhead, it introduces a Boolean / Arithmetic Sharing transformation method to support Hamming distance calculation in ciphertext, but this transformation method still suffers from computational complexity and redundancy, resulting in significant computational overhead.

[0028] To address the aforementioned technical problems, this application provides a robust privacy-preserving federated learning method under majority malicious conditions, comprising the following steps: training a local model using local data, calculating the model gradient and root gradient respectively; quantizing and encoding the model gradient and root gradient respectively; generating secret shares of the model gradient and root gradient respectively; calculating Hamming distance shares based on the secret shares of the model gradient and root gradient; calculating client weight shares based on the Hamming distance shares; weighting the model gradient to obtain local weighted shares; and updating the global model based on the local weighted shares. This application provides a robust privacy-preserving federated learning method under majority malicious conditions, achieving resistance to model poisoning attacks and protecting client data privacy in a majority malicious environment. Furthermore, the use of sampling secret sharing technology can efficiently calculate Hamming distance and model weighted averages, avoiding the conversion process from Boolean sharing to arithmetic sharing, significantly reducing overall computational overhead.

[0029] The embodiments of this application will now be described in detail with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the embodiments of this application to facilitate a better understanding of the application. However, the technical solutions claimed in this application can be implemented even without these technical details and various variations and modifications based on the following embodiments.

[0030] See Figure 1 This application provides a robust privacy-preserving federated learning method under multiple malicious scenarios, comprising the following steps:

[0031] Step S1: Train the local model using local data, and calculate the model gradient and root gradient respectively.

[0032] Step S2: Quantize and encode the model gradient and root gradient respectively.

[0033] Step S3: Use the sampling secret sharing method to generate the secret share of the model gradient and the secret share of the root gradient.

[0034] Step S4: Calculate the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient.

[0035] Step S5: Calculate the client weight share based on the Hamming distance share.

[0036] Step S6: Weight the model gradient to obtain the local weighted share.

[0037] Step S7: Update the global model based on the local weighted share.

[0038] In some embodiments, step S1 uses local data to train a local model and calculates the model gradient and root gradient, including: each client participating in this round of aggregation loads the current global model and trains the local model using local data to obtain the trained local model; the client calculates the model gradient using the trained local model; the master server trains the root model using the local dataset and calculates the root gradient based on the trained root model; the master server is a server that maintains a clean dataset locally.

[0039] Step S1 primarily involves local training. First, each client participating in this round of aggregation loads the current global model and trains its local model using local data. Then, the client calculates the model gradient using the trained local model.

[0040] The formula for calculating the root gradient is as follows:

[0041]

[0042] in, w represents the model gradient calculated by the i-th client in round t. i For the global model of the current round, This is the local model for the i-th client.

[0043] The local training process on the master server (i.e., the server that maintains a clean dataset locally) is the same as the local training process on the client. The master server uses the local dataset to train the root model and calculates the root gradient.

[0044] In some embodiments, step S2 involves quantizing and encoding the model gradient and the root gradient, including: the client quantizing and encoding the model gradient; the main server quantizing and encoding the root gradient; quantization normalizing the gradient; and encoding converting the gradient into binary values ​​of 0 and 1.

[0045] Step S2 involves quantizing and encoding the model gradient and root gradient. To facilitate the calculation of the Hamming distance, the client needs to quantize and encode the model gradient. Quantization normalizes the gradient, reducing computational cost by decreasing the precision of the model gradient. Encoding converts the gradient into binary values ​​of 0s and 1s.

[0046] The quantification rule is that when... At that time, the quantized model is updated otherwise The quantized model gradient is given to the client. The encoding formula is as follows:

[0047]

[0048] The gradient of the model after being encoded for the client.

[0049] Master server for root gradient The quantization and encoding steps are the same as the client's process for quantizing and encoding the model gradient, resulting in the root gradient encoded by the main server.

[0050] In some embodiments, generating the secret share of the model gradient in step S3 includes: the client initializes the zero vector as one share of the model gradient; a random algorithm is used to select half of the zero vector and assign it the value corresponding to the model gradient, and then the other positions of the model gradient are assigned 0 as the secret share of the model gradient; the client sends one share of the model gradient to the main server and sends the secret share of the model gradient to the secondary server.

[0051] In some embodiments, generating the secret share of the root gradient in step S3 includes: the master server initializes the zero vector as one share of the root gradient; a random algorithm is used to select half of the position of the zero vector and assign it the value corresponding to the root gradient, and then the other positions of the root gradient are assigned 0 as the secret share of the root gradient; the master server retains one share of the root gradient and sends the secret share of the root gradient to the secondary server.

[0052] It should be noted that the method for generating the secret share of the model gradient in step S3 is the same as the method for generating the secret share of the root gradient. Step S3 mainly involves the process of generating the secret share of the model gradient and the secret share of the root gradient.

[0053] First, the client initializes a zero vector of length k as one component of the gradient. Where k is the vector length of the model gradient.

[0054] Then, the client uses a random algorithm to select k / 2 positions from [0,k], assigns the values ​​corresponding to the gradient to the k / 2 positions corresponding to the zero vector, and assigns 0 to the other positions of the gradient as another secret share.

[0055] Finally, the client will Send to the main server, another Send it to the secondary server (i.e., another non-colluding server).

[0056] The master server uses the same method as above to generate the secret share of the root gradient. Keep it for yourself, It is sent to the secondary server, where the random algorithm is negotiated jointly by the primary server and the client.

[0057] In some embodiments, step S4 calculates the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient, including: the master server calculates the Hamming distance share between the secret share of the model gradient and the secret share of the root gradient locally based on the secret share of the model gradient and the secret share of the root gradient; the secondary server calculates another share of the Hamming distance between the secret share of the model gradient and the secret share of the root gradient locally based on the secret share of the model gradient and the secret share of the root gradient.

[0058] The master server uses root gradient shares locally. and client gradient share Calculate the share Hd0 of the Hamming distance between the two servers. The secondary server then calculates the other share Hd1 of the Hamming distance using the same method.

[0059] In some embodiments, the formula for calculating the Hamming distance share is as follows:

[0060]

[0061] in, XOR; H() is the number of 0s in the binary form of the input value; This is one of the shares of the model gradient; This is the secret share of the model gradient.

[0062] In some embodiments, step S5, which calculates the client weight share based on the Hamming distance share, includes: the primary server and the secondary server jointly executing an obfuscation circuit to calculate the share of the client weight value.

[0063] Step S5 mainly calculates the client-side weight share. First, a threshold τ is set to determine if the client-side model gradient is malicious. When τ - Hd i Values ​​less than 0 are considered malicious.

[0064] The primary and secondary servers jointly calculate the share of client weight values ​​by executing a confusion circuit.

[0065] The GMW protocol is used to implement the obfuscation circuit, specifically as follows: Figure 2 As shown.

[0066] The primary server and secondary server are respectively and As input to the obfuscation circuit, the weight share of the i-th client is then obtained. in:

[0067] r is a random number generated by the main server; MUX() is a binary selector; when the input parameter is greater than 0, it returns τ-Hd. i Otherwise, the output is 0.

[0068] Step S6 involves weighting the model gradient to obtain a local weighted share, including: the master server and the secondary server decoding the secret share of the model gradient and the secret share of the root gradient locally, respectively; the master server generating a multiplication triple in the offline stage; and the master server and the secondary server performing a weighted average of the model gradient and the root gradient.

[0069] Step S6 mainly involves performing a weighted average of the model gradients.

[0070] The primary and secondary servers each locally manage the gradient share. Decoding is performed to facilitate weighted calculations.

[0071] The decoding formula is as follows:

[0072]

[0073] The master server generates multiplication triples during the offline phase to support secret shared multiplication calculations, which requires the use of the Correlated Oblivious Product Evaluation (COPE) algorithm and the Oblivious Transport Protocol (OT).

[0074] The COPE algorithm is as follows:

[0075] Suppose there are two participants, P0 and P1, who hold a and b ∈ F respectively. p Where P is a large prime number, k bits long, and F p Given an integer field modulo P, calculate the secret share of c = a * b.

[0076] First, P0 takes 'a' as input, and P1 first converts 'b' into a binary stream (b0, b1...b...). k-1 )∈(0,1) k , Then use the binary stream as input.

[0077] The second step involves P0 and P1 executing the OT protocol k times, with P0 acting as the sender and P1 as the receiver. The formula is shown below, where r... i In each round of the OT protocol, P0 from F p A random value selected from the options.

[0078] q i =OT(r) i ,r i +a,b i )

[0079] Third, after executing the OT protocol k times, P0 and P1 calculate the secret shares c0 and c1 of c as shown in the following formula, where t i =r i .

[0080]

[0081]

[0082] The steps for generating multiplicative triples are as follows:

[0083] The first step is for the primary server and the secondary server to randomly generate a random number 'a'. i ,b i ∈F p , and a i ,b i These are the secret shares of participants a and b, respectively, where i = 0, 1.

[0084] The second step involves the primary and secondary servers executing the COPE algorithm twice, each time using a0, b1 and a1, b0 as inputs respectively, and outputting t each time. 0,1 ,q 1,0 , t 1,0 ,q 0,1 .

[0085] The main server holds t 0,1 ,q 0,1 The secondary server holds t 1,0 ,q 1,0

[0086] The third step involves the primary and secondary servers calculating the secret share of c locally. That is:

[0087] c0 = a0 * b0 + t 0,1 +q 0,1 c1 = a1 * b1 + t 1,0 +q 1,0

[0088] The primary and secondary servers weight the model gradients as shown in the following formula:

[0089] The steps for the weighted calculation are as follows:

[0090] The first step involves the primary server and secondary server performing calculations locally, as shown in the following formula:

[0091]

[0092]

[0093] The second step involves the primary server and the secondary server sharing the secret share of ∈, ρ, and obtaining the public ∈, ρ.

[0094] The third step involves the primary and secondary servers calculating their weighted shares locally, as shown in the following formula:

[0095]

[0096] Step S7 is mainly used to update the global model. The primary server and secondary server update the share of the global model locally and send it to each client.

[0097] The update formula is as follows:

[0098]

[0099] Where α is the global learning rate.

[0100] See Figure 3 This application also provides a robust privacy-preserving federated learning system under multiple malicious scenarios, including a local training module 101, a quantization and encoding module 102, a secret share generation module 103, a computation module 104, and a global model update module 105 connected in sequence. The local training module 101 is used to train a local model using local data and calculate the model gradient and the root gradient, respectively. The quantization and encoding module 102 is used to quantize and encode the model gradient and the root gradient, respectively. The secret share generation module 103 is used to generate the secret share of the model gradient and the secret of the root gradient using a sampling secret sharing method. The share calculation module 104 includes a Hamming distance share calculation module 1041, a client weight share calculation module 1042, and a weighted calculation module 1043. The Hamming distance share calculation module 1041 is used to calculate the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient. The client weight share calculation module 1042 is used to calculate the client weight share based on the Hamming distance share. The weighted calculation module 1043 is used to weight the model gradient to obtain the local weighted share. The global model update module 105 is used to update the global model based on the local weighted share.

[0101] See Figure 4 Another embodiment of this application provides an electronic device, including: at least one processor 110; and a memory 111 communicatively connected to the at least one processor; wherein the memory 111 stores instructions executable by the at least one processor 110, the instructions being executed by the at least one processor 110 to enable the at least one processor 110 to perform any of the above method embodiments.

[0102] The memory 111 and processor 110 are connected via a bus, which may include any number of interconnecting buses and bridges, connecting various circuits of one or more processors 110 and memory 111. The bus may also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides an interface between the bus and the transceiver. The transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 110 is transmitted over a wireless medium via an antenna, which further receives data and transmits it to processor 110.

[0103] Processor 110 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 111 can be used to store data used by processor 110 during operation.

[0104] Another embodiment of this application relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0105] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0106] Based on the above technical solutions, embodiments of this application provide a robust privacy-preserving federated learning method, system, device, and medium under multiple malicious scenarios. The method includes the following steps: training a local model using local data, and calculating the model gradient and root gradient respectively; quantizing and encoding the model gradient and root gradient respectively; generating secret shares of the model gradient and secret shares of the root gradient respectively; calculating Hamming distance shares based on the secret shares of the model gradient and the secret shares of the root gradient; calculating client weight shares based on the Hamming distance shares; efficiently generating multiplicative triples using relevant unintentional products, and weighting the model gradients to obtain local weighted shares; updating the global model based on the local weighted shares.

[0107] The robust privacy-preserving federated learning method under malicious conditions provided in this application first uses quantization encoding technology to make the client model gradient and root gradient suitable for calculating Hamming distance; secondly, it uses sampled secret sharing to generate gradient shares from the model gradient, and the Hamming distance shares are calculated locally by two non-colluding servers; then, it uses obfuscation circuit technology to calculate the share of client weights between servers; finally, the servers decode the gradient shares and perform a weighted average of the gradient shares to update the global model.

[0108] This application overcomes the limitations of majority honest environments by using the root of trust and Hamming distance similarity calculation criteria, and further improves model performance by adaptively amplifying the weights of non-malicious clients to compensate for the severe lack of effective information for model aggregation under malicious majority conditions. Furthermore, by utilizing the bitwise XOR property of Hamming distance, this application designs a sampling-based secret-sharing two-party computation framework. This framework protects client privacy during model poisoning attacks and avoids the additional complex computations involved in calculating Hamming distance and weighted averages under ciphertext, significantly reducing computational overhead.

[0109] Those skilled in the art will understand that the above-described embodiments are specific examples of implementing this application, and in practical applications, various changes in form and detail may be made without departing from the spirit and scope of this application. Any person skilled in the art can make their own modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application should be determined by the scope defined in the claims.

Claims

1. A robust privacy-preserving federated learning method under majority malicious conditions, characterized in that, include: Train a local model using local data, and calculate the model gradient and root gradient respectively; The model gradient and the root gradient are quantized and encoded respectively; The secret share of the model gradient and the secret share of the root gradient are generated using a sampling secret sharing method: Calculate the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient; Calculate the client weight share based on the Hamming distance share; The relevant unintentional product is used to efficiently generate multiplicative triples, and the gradient share of the model is weighted to obtain the local weighted share; Update the global model based on the local weighted share; Generating the secret share of the model gradient includes: The client initializes the zero vector as one share of the model gradient; A random algorithm is used to select half of the zero vector and assign it the value corresponding to the model gradient. Then, the other positions of the model gradient are assigned 0 as the secret share of the model gradient. The client sends one share of the model gradient to the main server and sends the secret share of the model gradient to the secondary server; Generating the secret share of the root gradient includes: The master server initializes the zero vector as one share of the root gradient; A random algorithm is used to select half of the zero vector and assign it the value corresponding to the root gradient. Then, the other positions of the root gradient are assigned 0 as the secret share of the root gradient. The master server retains one share of the root gradient and sends the secret share of the root gradient to the secondary server.

2. The robust privacy-preserving federated learning method under multiple malicious scenarios as described in claim 1, characterized in that, The step of training a local model using local data and calculating the model gradient and root gradient includes: Each client participating in this round of aggregation loads the current global model and trains a local model using local data to obtain the trained local model; The client calculates the model gradient using the trained local model; The main server trains the root model using the local dataset and calculates the root gradient based on the trained root model. The master server is a server that maintains a clean dataset locally.

3. The robust privacy-preserving federated learning method under multiple malicious scenarios as described in claim 1, characterized in that, The quantization and encoding of the model gradient and the root gradient respectively include: The client quantizes and encodes the model gradient; The master server quantizes and encodes the root gradient; The quantization normalizes the gradient; the encoding converts the gradient into binary values ​​of 0 and 1.

4. The robust privacy-preserving federated learning method under multiple malicious scenarios as described in claim 1, characterized in that, The calculation of the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient includes: The master server calculates the Hamming distance between the secret share of the model gradient and the secret share of the root gradient locally based on the secret share of the model gradient and the secret share of the root gradient. The secondary server locally calculates another share of the Hamming distance between the secret share of the model gradient and the secret share of the root gradient, based on the secret share of the model gradient and the secret share of the root gradient. The formula for calculating the Hamming distance share is as follows: in, XOR; H() is the number of 0s in the binary form of the input value; This is one of the shares of the model gradient; This is the secret share of the model gradient.

5. The robust privacy-preserving federated learning method under multiple malicious scenarios according to claim 1, characterized in that, The calculation of the client weight share based on the Hamming distance share includes: The primary and secondary servers jointly calculate the share of client weight values ​​by executing a confusion circuit. The locally weighted share is obtained by weighting the gradient shares of the model, including: The primary server and the secondary server decode the secret share of the model gradient and the secret share of the root gradient locally, respectively. The main server efficiently generates multiplication triples using related unintentional products during the offline phase; The primary server and the secondary server perform a weighted average of the model gradient and the root gradient.

6. A robust privacy-preserving federated learning system under majority malice, the system being used to implement the robust privacy-preserving federated learning method under majority malice as described in any one of claims 1 to 5, characterized in that, The system includes a local training module, a quantization and encoding module, a secret share generation module, a computation module, and a global model update module, which are connected in sequence. The local training module is used to train a local model using local data and to calculate the model gradient and root gradient, respectively. The quantization and encoding module is used to quantize and encode the model gradient and the root gradient, respectively. The secret share generation module is used to generate the secret share of the model gradient and the secret share of the root gradient using a sampling secret sharing method; The calculation module includes a Hamming distance share calculation module, a client weight share calculation module, and a weighted calculation module; the Hamming distance share calculation module is used to calculate the Hamming distance share based on the secret share of the model gradient and the secret share of the root gradient. The client weight share calculation module is used to calculate the client weight share based on the Hamming distance share; The weighted calculation module is used to weight the model gradient to obtain the local weighted share; The global model update module is used to update the global model based on the local weighted share.

7. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a robust privacy-preserving federated learning method under multiple malicious scenarios as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the robust privacy-preserving federated learning method under most malicious conditions as described in any one of claims 1 to 5.

Images