A federated learning system and method based on a verifiable trusted server
By introducing secure aggregation, differential privacy, and zero-knowledge proofs into a federated learning system with a trusted server, the contradiction between user data privacy and model accuracy is resolved, achieving security and privacy protection under dynamic user participation and improving the security performance of federated learning.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING VENUS INFORMATION TECH
- Filing Date
- 2021-10-14
- Publication Date
- 2026-05-12
AI Technical Summary
Existing federated learning systems struggle to balance user data privacy with model accuracy, especially under dynamic user participation and unstable network conditions, which can lead to data leaks and reduced model accuracy.
The system employs a trusted server for initialization, secure aggregation, differential privacy, and proof generation. Combined with a zero-knowledge proof protocol, it ensures that model parameters are securely aggregated and differentially privacy-processed on the server side to generate verifiable proofs, which are then verified by the client before training.
提高了联邦学习系统的安全性和隐私性，确保模型参数在传输过程中不泄露，增强了训练过程的安全性能，平衡了模型的实用性和用户数据的隐私性。
Smart Images
Figure CN115983408B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data security protection, and in particular to a federated learning system and method based on a verifiable trusted server. Background Technology
[0002] In existing technologies, federated learning is a distributed machine learning framework. One of the main applications of federated learning is to enable multiple clients to collaborate on solving machine learning problems under the coordination of a trusted server, which is usually operated by a well-known organization. To ensure client privacy, the client's user data does not leave the local storage device. After training locally, the client sends the model parameters or gradients to the trusted server, which helps multiple participants to jointly perform machine learning modeling.
[0003] With the further development of big data, privacy breaches involving user information are becoming increasingly frequent, making data privacy and security a global trend. Some studies have shown that while federated learning can ensure that users' raw data does not leave their local machines, attackers can intercept gradients or model parameters uploaded by users, leading to security issues such as the leakage of raw training data. Current federated learning systems typically address this by simultaneously adding noise to both the local client and server, implementing differential privacy synchronously, ultimately matching the noise in the client's secure aggregation result with the noise added centrally on the server. However, in (horizontal) federated learning, the number of participating users is generally dynamic, and the exact number of clients that can participate in training cannot be known in advance. Furthermore, participating users may disconnect due to poor network conditions or insufficient battery power; in addition, careless clients may forget to add differential privacy locally. All of these factors can lead to discrepancies between the pre-designed differential privacy and the preset (assuming a trusted server exists), thus sacrificing either model accuracy or user data privacy to some extent. Therefore, there is an urgent need for more reliable technical protection measures than traditional products. Summary of the Invention
[0004] To address this issue, this application provides a federated learning system based on a verifiable trusted server, including a trusted server and clients participating in the training.
[0005] The trusted server includes an initialization module, a security aggregation module, a differential privacy module, and a proof generation module.
[0006] The initialization module is used to obtain the initial model and model parameters, and send the initial model and model parameters to the client participating in the training.
[0007] The secure aggregation module is used to securely aggregate the local model parameters sent by the clients participating in training to the trusted server to obtain aggregated model parameters; the differential privacy module is used to add noise to the aggregated model parameters according to the privacy budget to obtain differential privacy model parameters, and at the same time update the model, and send the updated model and model parameters to the clients participating in training; the proof generation module is used to generate verifiable proofs and send the verifiable proofs to the clients.
[0008] The client includes a local training module and a verification module. The local training module is used to train and optimize the initial or updated model and model parameters received by the client locally, and send the optimized model parameters to the trusted server. The verification module is used to verify the verifiable proof sent by the server. When the verification is successful, the local training module starts training; when the verification fails, the training stops.
[0009] This application also provides a method for using a federated learning system with a verifiable trusted server as described above, the steps of which include:
[0010] S10, the trusted server obtains the initialized model and model parameters, and sends the initialized model and model parameters to the client participating in the training;
[0011] S20, the client participating in the training will train the received model and model parameters locally, generate local model parameters, optimize the local model parameters, and obtain optimized model parameters;
[0012] The client participating in the training sends the optimized model parameters and the local generator parameters used for verification to the trusted server; wherein, the local generator parameters are generators of a publicly available finite cyclic group G;
[0013] S30, the trusted server performs secure aggregation of the optimized model parameters in a black-box manner to obtain aggregated model parameters; the trusted server adds corresponding noise to the aggregated model parameters according to a pre-set privacy budget to obtain differential privacy model parameters, and updates the model;
[0014] S40, the trusted server uses the local generative meta-parameters sent by the client participating in the training to calculate and generate verifiable proofs via the zk-snark protocol;
[0015] S50, the updated model and model parameters, along with the verifiable proof, are sent to the client participating in the next round of training;
[0016] S60, the next client participating in the training verifies the verifiable proof sent by the server. If the verification passes, proceed to step S20; if the verification fails, exit the training.
[0017] In step S20, a pruning operation is used when optimizing the local model parameters. Let the local model parameters be... The optimized model parameters were obtained through pruning. Where Clip(•) is the pruning function, and C is the pruning threshold. This is the regularization term for the function.
[0018] In step S30, the optimization model parameters are set as follows: The aggregated model parameters are obtained. .
[0019] In step S30, the model parameters after differential privacy are... ; in, σ=γC, where z is the privacy parameter; The mean is 0 and the standard deviation is The normal distribution; γ is the sensitivity of the Gaussian machine applied to the function f, γ is the noise coefficient used to balance privacy and practicality, and C is the pruning threshold.
[0020] In step S40, the process of generating verifiable proof is as follows: S401, a trusted third-party outsourcing service provider provides an outsourcing function Fn(u,w) and a random public reference string crs, where u is public information and w is private information;
[0021] S402, Settings The publicly available information here is u Private information w is r; where It is generated using a rejection sampling method with r as the random number standard. The mean is 0 and the standard deviation is The normal distribution To assign sensitivity of the Gaussian machine to the function f;
[0022] Running Algorithm Output And zero-knowledge proof π; set there are I clients participating in the training, and the locally generated meta-parameters sent to the server by client i are... It can calculate the server-generated meta-parameters.
[0023] S403, ,and It is sent to the next round of clients participating in the training for verification.
[0024] Step S50 includes:
[0025] Step S501, the client, based on the data sent by the server... ,and ,calculate and If they are equal, proceed to step S502; otherwise, exit the training.
[0026] Step S502, the client runs the algorithm. If the output is 1, proceed to step S20; if the output is 0, exit the training process.
[0027] The beneficial effects achieved by this application are as follows:
[0028] This paper proposes a federated learning method based on a trusted and verifiable central server, utilizing technologies such as global differential privacy, secure aggregation, and ZK-SNARK zero-knowledge proof protocols. To balance model usability and user data privacy, the federated learning system is based on a trusted and verifiable centralized server model. During model updates, the server no longer directly sends the parameter model to the central server. Instead, it verifies the central server's verification proof before training locally. The verification proof also demonstrates that the server has performed secure aggregation and noise addition operations on the data. When the central server deviates from the original protocol, the client can detect this promptly through verification, preventing the leakage of local data and enhancing security during remote interactive training. Attached Figure Description
[0029] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.
[0030] Figure 1 This is a flowchart illustrating the method of the federated learning system based on a verifiable trusted server in this application. Detailed Implementation
[0031] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.
[0032] This application includes a trusted central server, which is typically operated by a well-known organization, and clients participating in the training. The trusted central server performs joint learning on the information parameters sent by the clients participating in the training, forming a distributed federated machine learning framework.
[0033] Specifically, firstly, the trusted central server obtains an initialization model based on the requirements, and then obtains the initialization model parameters. At the same time, with a certain sampling probability The server receives data from n clients. Selected from Each client i participates in the training and can obtain the initial model and initial model parameters from the server. Client i will use the initialization model and initialization model parameters. The initial training performed locally is considered the 0th round of training for client i. After the 0th round of training for client i (the number of training iterations and the training time for the 0th round can be defined by the server), the initial model generates the 0th round model for client i and its parameters locally. To optimize the model parameters, the model parameters for round 0 were adjusted. Perform pruning operations to obtain the model optimization parameters for client i in round 0. Where Clip(·) is the pruning function, and C is the pruning threshold. This is the regularization term for the function.
[0034] In this embodiment, the client and server use the same pruning threshold C. That is, before the client and server interact, any model parameters that exceed the pruning threshold C will be pruned.
[0035] Participating in training The 0th round of model optimization parameters for each client The data is sent to the server, where it undergoes the first round of model training. Simultaneously, to allow client i to verify the server's correctness before the next round of model training, client i will... Send to the server, where, Let m be the generators of a finite cyclic group G; wherein the information of the finite cyclic group G is public information, and the finite cyclic group G is set to include m generators. For example, in one specific embodiment, the following is set: , The generators of a finite cyclic group G include: 2 0 =1,2 1 =2,2 2 =4,2 3 =8,2 4 =16,2 5 =9,2 6 =8,2 7 =13,2 8 =3,2 9 =3, 2 10 =12,2 11 =1;
[0036] After receiving the round 0 optimization parameters from the online clients participating in the training, the server performs secure aggregation on the round 0 optimization parameters of all clients. In this embodiment, the secure aggregation method disclosed in the paper "Practical Secure Aggregation for Privacy-Preserving Machine Learning" presented by Kallista A. Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth at the CCS2017 (Conference on Computer and Communications Security) conference is used to perform secure aggregation operations in a black-box manner to obtain the aggregated model parameters. Where I is the set of clients selected to participate in training and who did not disconnect during the safe aggregation phase, i.e. .
[0037] Building upon secure aggregation, noise is introduced to enhance global differential privacy. In this embodiment, the differential privacy training method proposed in Brendan McMahan and Galen Andrew's paper "A General Approach to Adding Differential Privacy to Iterative Training Procedures" at CoRR 2018 is used for differential privacy training, and the server obtains the aggregation model parameters. The model parameters output after differential privacy training ;
[0038] The specific algorithm is as follows: in, σ=γC, where z is the privacy parameter; The mean is 0 and the standard deviation is The normal distribution; γ is the sensitivity of the Gaussian machine applied to the function f, γ is the noise coefficient used to balance privacy and practicality, and C is the pruning threshold.
[0039] After performing secure aggregation and differential privacy, the server generates a verifiable proof to provide verification to the client. According to the paper "Pinocchio: Nearly Practical Verifiable Computation" presented at S&P 2013 (IEEE Symposium on Security and Privacy) by Bryan Parno, Jon Howell, Craig Gentry, and Mariana Raykova, when using zero-knowledge verifiable computation, we consider the function Fn(u,w) as an outsourced function. Its input consists of two parts: u is the input requested by the client, and w is the private information provided by the outsourced service provider for the computation. Compared to general verifiable computation, zero-knowledge verifiable computation not only guarantees the correctness and verifiability of the computation but also protects the private information of the outsourced service provider. This protocol mainly includes the following three parts:
[0040] A trusted third-party outsourcing service provider provides the outsourcing function Fn(u,w) and a random public reference string crs, where u is public information and w is private information;
[0041] set up The publicly available information here is u Private information w is r; where It is generated using a rejection sampling method with r as the random number standard. The mean is 0 and the standard deviation is The normal distribution To assign sensitivity of the Gaussian machine to the function f;
[0042] Running Algorithm Output And zero-knowledge proof π; set there are I clients participating in the training, and the locally generated meta-parameters sent to the server by client i are... It can calculate the server-generated meta-parameters.
[0043] In this embodiment, we consider ,in It is generated using a rejection sampling method with r as the random number standard. The client's required calculation input here is... , where r is the private information provided by the outsourced service provider (i.e., the server in this example) for the computation.
[0044] The mean is 0 and the standard deviation is The normal distribution The sensitivity of the Gaussian machine to the function f is proven by the server as the prover, using the public reference string crs, the function Fn and its public input. And its own random input r, run the algorithm Output And the corresponding proof of π; the server can calculate based on the received... , Calculations yielded The server will ,in ,and , π is sent to the next round of clients participating in training;
[0045] Before training, client i participating in the next round (client round 1) verifies the received zero-knowledge proof. After confirming the correctness of the proof, it continues to participate in the training. If the proof fails, it exits the training process.
[0046] The specific proof process is as follows:
[0047] First, client i calculates... and Check if they are equal. If they are not equal (indicating that the safe aggregation phase was not executed correctly), exit training directly; otherwise, continue.
[0048] Then client i runs the algorithm. If the output is 0 (indicating that the differential privacy phase was not executed correctly), the training process will be terminated directly. Only when the output is 1 will the next round of training begin.
[0049] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application. Clearly, those skilled in the art can make various alterations and variations to this application without departing from its spirit and scope. Thus, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.
Claims
1. A method for a federated learning system based on a verifiable trusted server, the federated learning system comprising a trusted server and clients participating in training. in, The trusted server includes an initialization module, a security aggregation module, a differential privacy module, and a proof generation module; The initialization module is used to obtain the initial model and model parameters, and send the initial model and model parameters to the client participating in the training. The secure aggregation module is used to securely aggregate the local model parameters sent by the clients participating in training to the trusted server to obtain aggregated model parameters; the differential privacy module is used to add noise to the aggregated model parameters according to the privacy budget to obtain differential privacy model parameters, and at the same time update the model, and send the updated model and model parameters to the clients participating in training; the proof generation module is used to generate verifiable proofs and send the verifiable proofs to the clients. The client includes a local training module and a verification module. The local training module trains and optimizes the initial or updated model and model parameters received by the client locally, and sends the optimized model parameters to a trusted server. The verification module verifies the verifiable proof sent by the server. When verification is successful, the local training module continues training; when verification fails, training stops. The method includes the following steps: S10, the trusted server obtains the initialized model and model parameters, and sends the initialized model and model parameters to the client participating in the training; S20, the client participating in the training will train the received model and model parameters locally, generate local model parameters, optimize the local model parameters, and obtain optimized model parameters; The client participating in the training sends the optimized model parameters and the local generator parameters used for verification to the trusted server; wherein, the local generator parameters are generators of a publicly available finite cyclic group G; S30, the trusted server performs secure aggregation on the optimized model parameters to obtain aggregated model parameters; the trusted server adds corresponding noise to the aggregated model parameters according to a pre-set privacy budget to obtain differential privacy model parameters, and updates the model; S40, the trusted server uses the local generative meta-parameters sent by the client participating in the training to calculate and generate verifiable proofs via the zk-snark protocol; S50, the updated model and model parameters, along with the verifiable proof, are sent to the client participating in the next round of training; S60, the next client participating in the training verifies the verifiable proof sent by the server. If the verification passes, proceed to step S20; if the verification fails, exit the training.
2. The method of the federated learning system based on verifiable trusted servers as described in claim 1, wherein, In step S20, a pruning operation is used when optimizing the local model parameters. Let the local model parameters be... The optimized model parameters were obtained through pruning. Where Clip(•) is the pruning function, and C is the pruning threshold. This is the regularization term for the function.
3. The method of a federated learning system based on a verifiable trusted server as described in claim 2, wherein, In step S30, the optimization model parameters are set as follows: The aggregated model parameters are obtained. , where I is the number of clients participating in the training.
4. The method of the federated learning system based on a verifiable trusted server as described in claim 3, wherein, In step S30, the model parameters after differential privacy are... ; in, σ=γC, where z is the privacy parameter; The mean is 0 and the standard deviation is The normal distribution; γ is the sensitivity of the Gaussian machine applied to the function f, γ is the noise coefficient used to balance privacy and practicality, and C is the pruning threshold.