Blockchain-based identity anonymous and accountable privacy protection federated learning method

Abstract

The application discloses a blockchain-based identity anonymity and accountable privacy protection federated learning method, which comprises generating a public-private key pair, paying a deposit, signing and updating, broadcasting and verifying, reconstructing a traceable key, global model aggregation, malicious identity decryption and accountability process. In each client cluster, the identity anonymity of the client is realized by using a threshold-based accountable ring signature, and the aggregator performs robust aggregation according to the cosine similarity and Multi-Krum algorithm. Then, the global aggregation is realized by selecting a leader from m aggregators through a verifiable random function. After determining the malicious update, the traceability uses Pedersen verifiable secret sharing to reconstruct the traceable key, thereby realizing the de-anonymization of the malicious client. An adaptive reputation incentive mechanism is designed to hold the malicious client and the aggregator accountable, and to reward other honest nodes.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a blockchain-based federated learning method for identity anonymity and accountability-based privacy protection. Background Technology

[0002] Machine learning, as a core technology of artificial intelligence and data science, extracts valuable information or knowledge by training models using centralized data, enabling users to make better decisions or predictions. However, large-scale data collection not only leads to inefficiency but also exposes personal privacy to threats and security issues. This is primarily manifested in the possibility that attackers could infer sensitive information from shared data. On the other hand, the data silo problem hinders effective data collaboration among multiple users, making it difficult to realize the potential value of the data. Data heterogeneity results in non-independent and identically distributed training datasets for clients, making it impossible for the optimal solution of the global model to simultaneously fit the datasets of all clients.

[0003] Federated learning is a new branch of machine learning that enables efficient joint modeling and training among multiple users without requiring local data to be stored, thus protecting local data privacy. Specifically, clients first download an initialized global model from the server and train it using their local dataset. Then, they simply send the model parameters to the server for aggregation, and finally send the aggregated global model parameters back to each client. Currently, federated learning is widely used in fields such as keyboard prediction, signal recognition, and security detection. While federated learning can address local data privacy to some extent, the shared model parameters can still potentially leak private information. Research indicates that attackers can use model parameters to infer the original data or launch poisoning attacks to degrade model performance. Therefore, providing privacy protection for federated learning without compromising system robustness is a key research focus. Currently, privacy-preserving federated learning methods are mainly divided into two categories: cryptographic and perturbation methods.

[0004] Cryptographic methods encode plaintext data into ciphertext that a specific user can decrypt, maintaining the confidentiality of sensitive data and directly processing the ciphertext according to security protocols, such as homomorphic encryption, secret sharing, and obfuscated circuits. Homomorphic encryption provides strong privacy protection, allowing parameters to be added or multiplied in the ciphertext state. BatchCrypt encodes batch gradients into long integers before homomorphic encryption to reduce computational overhead and greatly improve efficiency. ShieldFL is a privacy-preserving federated learning defense strategy based on double trapdoor homomorphic encryption to resist cryptographic model poisoning and designs a robust Byzantine fault-tolerant aggregation mechanism for heterogeneous data scenarios. Bonawitz et al. first applied secret sharing, key negotiation, and signature schemes to protect the privacy of model parameters in machine learning. They also developed a privacy-preserving federated learning scheme (VerifyNet) based on (t,n) threshold secret sharing to resist the instability caused by random user exits. However, cryptographic methods lead to additional high computational and communication overhead for the system.

[0005] Perturbation methods obfuscate the true results by adding random noise, making it impossible for attackers to deduce sensitive information from the output differences. Examples include differential privacy, local differential privacy, and global differential privacy. While differential privacy does not require additional computational overhead, randomized noise reduces data utility and model accuracy, or introduces longer model convergence delays. To balance accuracy and communication overhead, Truex et al. utilized secure multi-party computation and differential privacy techniques to generate high-precision models resistant to inference attacks, maintaining a predefined trust level without sacrificing privacy.

[0006] Blockchain, a decentralized, tamper-proof, and traceable distributed ledger technology, can solve the single point of failure problem of federated learning center servers, and has become an effective method for addressing single point of failure and enhancing privacy protection. In traditional blockchain-based federated learning research, on the one hand, blockchain is introduced to construct a decentralized training process to enhance the trust and reliability between nodes. On the other hand, the incentive mechanism of blockchain promotes the active participation and fairness of nodes. Without relying on a centralized coordination server, the Biscotti scheme stores the aggregated updates and intermediate parameters of each training round in the blockchain. BlockFL provides proportional rewards based on sample size to promote joint training between devices, but BlockFL's proof-of-work consensus can lead to inefficiency. TrustFed is a fair and trustworthy cross-device federated learning framework that uses blockchain and smart contracts to maintain the reputation of participating devices. Linking abnormal device behavior to incentive mechanisms prevents malicious attackers from disrupting the system, ensuring nodes make positive model contributions. However, data processing on the blockchain still incurs significant computational overhead. Summary of the Invention

[0007] This application provides a blockchain-based method and system for anonymous and accountable privacy-preserving federated learning. It achieves privacy protection in federated learning based on accountable ring signatures and verifiable secret sharing, without the need for complex cryptographic techniques to encrypt updates, and without reducing model accuracy.

[0008] The first aspect of this application provides a blockchain-based federated learning method for identity anonymity and accountability with privacy protection, comprising the following steps: downloading an initial global model for m clients who have paid a deposit; training the global model using the local private datasets of the m clients to obtain m local models; encrypting the client's own public key using a random number and the public key of the aggregator to which the client belongs, and generating a knowledge signature for the local model using the public key set of other clients and the client's own private key; sending a message list consisting of the client's reputation value, the local model, and the corresponding knowledge signature to the corresponding aggregator; verifying the validity of each knowledge signature in the message list, and adding the verified local models from the message list. The process involves detecting and identifying malicious and honest updates to the local models. Honest updates are aggregated based on local aggregation weights to obtain n local aggregate models, which are then sent to the leader. Malicious updates and their corresponding knowledge signatures are also broadcast, where n is the number of client clusters. The update quality of the n local aggregate models is calculated, and global aggregation weights are assigned to them based on these quality. The n local aggregate models are then aggregated based on these global aggregation weights to obtain the updated global model. A traceability key is reconstructed based on the private key share contributed by the aggregator. The malicious client corresponding to the malicious update is decrypted using the traceability key, and rewards and penalties are applied to the client and aggregator during the update process.

[0009] Optionally, in one embodiment of this application, before downloading the initial global model for the m clients who have paid deposits, the method further includes: clustering the m clients according to the similarity of local private data to obtain n clusters of clients; selecting the client with the highest reputation value in each cluster as the aggregator of the cluster to obtain n aggregators; and selecting a global aggregator from the n aggregators using a consistent hashing algorithm and a verifiable random function to obtain a leader.

[0010] Optionally, in one embodiment of this application, the deposit paid by the client is determined by the client's credit score, wherein client c i Required deposit V i for:

[0011]

[0012] Where d is the fixed model unit price, ri For client c i The reputation value, thh, is the minimum reputation value required to allow a client to participate in the model training set.

[0013] Optionally, in one embodiment of this application, before aggregating honest updates according to local aggregation weights, the method further includes: calculating the update score of the local model, recording the mf updates with the lowest update scores as honest updates, and the other f updates as malicious updates; using the update scores and the reputation value as evaluation indicators, and calculating the local aggregation weights for the mf honest updates using the entropy weight method.

[0014] Optionally, in one embodiment of this application, the step of selecting a global aggregator from the n aggregators using a consistent hashing algorithm and a verifiable random function to obtain a leader includes: constructing a reputation hash ring and allocating the reputation hash ring to aggregators according to their reputation weight; passing the aggregator's private key and random number to the verifiable random function to calculate a hash value and a proof; and mapping the hash value to the reputation hash ring to obtain the corresponding aggregator as the leader.

[0015] Optionally, in one embodiment of this application, calculating the update quality of the n local aggregation models and assigning global aggregation weights to the n local aggregation models based on the update quality includes: calculating the cosine similarity between the leader's local aggregation model and the local aggregation models sent by other aggregators, and determining the global aggregation weights of the local aggregation models based on the cosine similarity.

[0016] Optionally, in one embodiment of this application, before reconstructing the traceability key based on the private key share contributed by the aggregator, the method further includes: verifying the validity of the signature and commitment of the malicious update, verifying whether the cosine distance between the malicious update and the average of the n local aggregation models is less than 0, and contributing the private key share of the aggregator to the tracer when all verifications pass.

[0017] Optionally, in one embodiment of this application, rewards and penalties are applied to clients and aggregators during the update process, including: deducting the deposit of the malicious client, reducing the reputation value of the malicious client, increasing the reputation value of other clients besides the malicious client, and giving a fixed reward; reducing the reputation value of aggregators who did not contribute their own private key share and the reputation value of aggregators who aggregated the local model of the malicious client, and increasing the reputation value of aggregators who contributed their own private key share and the reputation value of aggregators who did not aggregate the local model of the malicious client.

[0018] The second aspect of this application provides a blockchain-based federated learning system for identity anonymity and accountability, including: m clients, used to pay a deposit to a smart contract, download an initial global model, and train the global model to obtain m local models based on a local private dataset; n aggregators, used to aggregate the m local models of the clients to obtain n local aggregated models, and use the leader among the aggregators to perform global aggregation of the n local aggregated models to obtain an updated global model; and tracers, used to reconstruct tracer keys based on the private key share contributed by the aggregators, decrypt malicious clients corresponding to malicious updates based on the tracer keys, and reward or punish clients and aggregators during the update process.

[0019] Optionally, in one embodiment of this application, it further includes: a key generation center, used to generate and distribute public and private key pairs for the client and the aggregator, perform system initialization, and generate public parameters.

[0020] The blockchain-based anonymous and accountable privacy-preserving federated learning approach in this application has the following beneficial effects:

[0021] 1) Combining accountable ring signatures and verifiable secret sharing, a threshold-based accountable ring signature was designed to achieve unlinkability between client identity and model updates. This eliminates the need for complex cryptographic techniques to encrypt updates and reduce model accuracy, while providing privacy protection.

[0022] 2) It has good robustness. It uses the Multi-Krum algorithm and cosine similarity to detect model updates uploaded by the client, and then aggregates them after assigning weights, which can effectively improve the model accuracy.

[0023] 3) A novel reputation incentive mechanism was designed, which punishes malicious clients by increasing the cost of downloading the global model and decreasing their reputation, while simultaneously reducing the cost for honest clients to download the global model without revealing their identities. This approach only exposes a portion of the malicious clients' identities while protecting the privacy of honest clients, achieving a balance between anonymity and accountability.

[0024] 4) The decentralized global model aggregation is ultimately achieved by a leader selected by a verifiable random function, which can effectively prevent single point of failure.

[0025] 5) Based on blockchain technology, the global model and intermediate parameter information are traceable and immutable. Smart contracts automatically execute to achieve an adaptive system, ensuring the credibility of the operation process.

[0026] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0027] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0028] Figure 1 This is a flowchart illustrating a blockchain-based federated learning method for identity anonymity and accountability-based privacy protection, provided according to an embodiment of this application.

[0029] Figure 2 This is a schematic diagram illustrating the execution flow of each subject in the blockchain-based identity anonymity and accountability-protected privacy-preserving federated learning method provided in the embodiments of this application;

[0030] Figure 3 This is a flowchart of a threshold-based accountable ring signature based on an embodiment of this application;

[0031] Figure 4 This is a flowchart of a reputation incentive mechanism provided according to an embodiment of this application;

[0032] Figure 5 This is an example diagram of a blockchain-based federated learning system for identity anonymity and accountability, based on an embodiment of this application. Detailed Implementation

[0033] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0034] This application proposes a blockchain-based federated learning method for identity anonymity and accountability, involving four stakeholders: clients, aggregators, tracers, and a key generation center. Specifically, firstly, all clients are divided into n clusters based on data similarity, ensuring a more uniform data distribution within each cluster to improve the accuracy of the jointly constructed group model. Within each cluster, accountable ring signatures are used to achieve client anonymity, and aggregators perform robust aggregation based on cosine similarity and the Multi-Krum algorithm. Then, a leader is selected from the n aggregators using a Verifiable Random Function (VRF) to achieve global aggregation. After identifying malicious updates, tracers reconstruct the trace key using Pedersen Verifiable Secret Sharing (VSS), thereby deanonymizing the malicious client. Finally, an adaptive reputation incentive mechanism is designed to hold malicious clients and aggregators accountable and reward other honest nodes.

[0035] The four entity characters are described in detail below:

[0036] 1) Key Generation Center: The key generation center is a trusted institution that generates and distributes public and private key pairs for clients and aggregators. It is responsible for initializing the system and generating public parameters.

[0037] 2) Client: The client is the main participant in calculating model updates based on its local private dataset. Each client wants to maintain the confidentiality of its private data and the anonymity of its identity when sending model updates, and possesses a public-private key pair provided by the key generation center. i ,k i ).

[0038] 3) Aggregator: The aggregator is a high-reputation client selected from the cluster. The aggregator does not participate in model training. The aggregator possesses the public key PS and private key SK provided by the key generation center. i Share.

[0039] 4) The tracer is a high-reputation aggregator selected from all aggregators and is responsible for revoking the anonymity of malicious clients. The tracer expects to receive no less than k private key shares SK from the aggregators. i This allows for the reconstruction of the private key (traceability key) SK.

[0040] The symbols used are shown in Table 1.

[0041] Symbols used in Table 1

[0042]

[0043]

[0044] The following describes, with reference to the accompanying drawings, a blockchain-based federated learning method for identity anonymity and accountability-protected privacy, according to embodiments of this application.

[0045] Figure 1 This is a flowchart of a blockchain-based federated learning method for identity anonymity and accountability-based privacy protection, provided according to an embodiment of this application.

[0046] like Figure 1 As shown, this blockchain-based federated learning method for identity anonymity and accountability with privacy protection includes the following steps:

[0047] In step S101, the initial global model is downloaded for the m clients who have paid the deposit, and the global model is trained using the local private datasets of the m clients to obtain the m local models.

[0048] Optionally, in one embodiment of this application, before downloading the initial global model for the m clients who have paid deposits, the method further includes: clustering the m clients according to the similarity of local private data to obtain n clusters of clients; selecting the client with the highest reputation value in each cluster as the aggregator of the cluster to obtain n aggregators; and selecting a global aggregator from the n aggregators using a consistent hashing algorithm and a verifiable random function to obtain a leader.

[0049] During system initialization, all clients are clustered based on data similarity, and a common parameter is generated for each cluster by the key generation center. The key generation center generates public-private key pairs for both clients and aggregators. The aggregator's private key is distributed by the key generation center through secret sharing, while all aggregators share the same public key. To ensure fairness among clients, each client needs to pay a deposit V to the smart contract before training begins. i Only then can the global model from the previous round be obtained. The client then uses the local dataset and this global model to update its local model.

[0050] The deposit paid by the client is determined by the client's credit score, where client c i Required deposit V i for:

[0051]

[0052] Where d is the fixed model unit price, r i For client c i The reputation value, where threshold is the minimum reputation value required for a client to participate in the model training set.

[0053] Specifically, the Key Generation Center (KGC) generates the common parameter pp := (gk,pp) for the system. SoK ,crs), where pp SoK ←SoKSetup(gk), crs←CRSGen(gk). Each client generates a public-private key pair (pk) using the PKEGen(gk) algorithm. i ,sk i ) is used for signing and verification, where Additionally, KGC uses a variant of the ElGamal encryption algorithm to generate a public-private key pair (PK,SK)←PKEGen(gk), where PK = e(SK, g2). KGC distributes SK as the secret value to n aggregators using the Share(SK, k, n) algorithm, such as... Figure 2 As shown, the specific operation is as follows:

[0054] Step 1. KGC randomly selects And issue a commitment C0 = Com(SK,t);

[0055] Step 2. KGC arbitrately selects two k-1 degree polynomials F, Satisfy F(0) = SK, and calculate SK. i =F(i)

[0056] F(x) = SK + F1x + ... + F k-1 x k-1 (1)

[0057] Step 3. KGC randomly selects When promise F i When i = 1, ..., k-1, use G i This indicates that KGC simultaneously calculates and broadcasts commitments.

[0058] Step 4. Construct the polynomial G(x) = t + G1x + ... + GGC. k-1 x k-1 , and let t i =G(i), i = 1, 2, ..., n, then KGC sends the share (SK i ,t i (This is given to all aggregators.) After each aggregator receives its share, it verifies the authenticity of the share by verifying the following formula:

[0059]

[0060] To ensure fairness in training, each client must pay a deposit V to the smart contract before the start of the j-th iteration of training. i :

[0061]

[0062] Where d is the fixed unit price of the model, and r i For client c i The reputation score (affecting subsequent payments and trust). The threshold (a constant threshold < 0) is the minimum reputation score at which a client is kicked out of the model training set, i.e., r. i >threhold. Reputation value r of newly joined clients. i Set all values ​​to 0. This ensures that new clients and clients with low reputations will need to provide more deposits. Clients with higher reputations will need to provide less deposit.

[0063] Then client c i Download the previous round's global model w from the blockchain. j-1 The client used the local model in the previous round. Based on the local dataset Di The goal of training a local model for i ∈ [1, m] is to minimize the loss function. Therefore, the local model is updated as follows:

[0064]

[0065] Where γ is the learning rate. To find the derivative. The entire training process ends when the client's objective function converges. Otherwise, the client begins the next iteration.

[0066] In step S102, the client's own public key is encrypted using a random number and the public key of the aggregator to which the client belongs. The client's own private key is generated using the public key set of other clients and the client's own private key. The client's reputation value, the local model and the corresponding knowledge signature are combined into a message list and sent to the corresponding aggregator.

[0067] During the signature generation phase, each client within the cluster encrypts its own public key using the aggregator's public key and a random number, and then generates a knowledge signature for the model update using the set of other clients' public keys and its own private key. All clients then send the signature and model update together to the aggregator.

[0068] like Figure 3 As shown, the specific steps in the signature generation stage are as follows:

[0069] Step 1. Client c i Select random number Calculate the ciphertext c←Enc(PK,pk) i ;Rnd), and use the public key set R={pk1,pk2,…,pk n}, n≠i, obtain local model update w i Knowledge signature:

[0070] σ SoK =SoKSign(pp SoK ,(PK,R,c),(sk i ,Rnd),w i (5)

[0071] c i The final signature of the local model in the j-th iteration is σ. i :=(c,σ SoK ).

[0072] Step 2. m clients perform the same signature operation to obtain the final signature {σ1,…,σ} of the local model. m They will sign σ. i Model update w i And reputation value r iSend them together to the aggregator. After waiting for time τ, the aggregator receives a list of unordered messages L = {(σ i ,w i ,r i )|i=1,..,m}.

[0073] Step 3. After receiving message list L, the aggregator verifies the message list using SoKVerify(pp). SoK ,(PK,R,c),σ SoK ,w i The algorithm sequentially verifies m signatures σ. soK The validity of the signature. If the signature is valid, it indicates that the model update was issued by a member of the cluster, but the owner of the signature is unknown. Due to the signature σ... i For identity address (i.e., public key pk) i Anonymization was implemented to ensure the unlinkability of the local model and identity address, even if the aggregator received w i Furthermore, it is impossible to deduce the client's identity information.

[0074] In step S103, the validity of each knowledge signature in the message list is verified, the local models in the verified message list are detected, malicious updates and honest updates of the local models are identified, honest updates are aggregated according to the local aggregation weight to obtain n local aggregate models, and the n local aggregate models are sent to the leader, and malicious updates and corresponding knowledge signatures are broadcast, where n is the number of clusters of the client.

[0075] During the local aggregation phase, after receiving the message list from the client, the aggregator verifies the validity of each signature sequentially. The models corresponding to the verified signatures undergo robustness testing to distinguish between honest and malicious updates. The aggregator assigns appropriate weights based on the quality of honest updates and then performs local aggregation, while malicious updates and their corresponding signatures are broadcast to the blockchain network.

[0076] Optionally, in one embodiment of this application, before aggregating honest updates according to local aggregation weights, the method further includes: calculating the update score of the local model, recording the mf updates with the lowest update scores as honest updates, and the other f updates as malicious updates; using the update scores and reputation values ​​as evaluation indicators, and calculating local aggregation weights for the mf honest updates using the entropy weight method.

[0077] To improve the accuracy of the aggregation model and the participation of participants, model aggregation weights are set based on model quality assessment results and participant reputation. Model quality assessment relies on Multi-Krum to select honest updates. Specifically:

[0078] Step 1. The aggregator calculates the updated score s. iSelect mf-2 updates that are closest to the client c i The sum of updated Euclidean distances, where m is the number of valid updates received in the message list L, and f is the number of Byzantine clients that can be tolerated.

[0079] s i =∑ i→k ||w i -w k || 2 (6)

[0080] For any i ≠ k, i → k represents w k W belongs to the closed update of mf-2 i .

[0081] Step 2. The mf updates with the lowest scores are selected and marked as honest, while the remaining f updates are marked as malicious. The scores of these malicious updates are then set to s. i Recorded on the blockchain.

[0082] Step 3. To make the global model more biased towards updates uploaded by high-quality and reputable clients, assign weights to the mf honest updates using the entropy weight method, based on the update score s. i And reputation value r i These two evaluation metrics should be weighted differently. Lower update scores should be assigned a higher weight, while lower reputation scores should be assigned a lower weight. The update scores and reputation scores should be normalized.

[0083]

[0084]

[0085] Step 4. Calculate the updated score weights separately. And the proportion of credit And the information entropy of two evaluation indicators, namely:

[0086]

[0087]

[0088] If p i or q i When equal to 0, then define

[0089] Step 5. Calculate the mf updated weights.

[0090]

[0091] in The aggregator will locally aggregate these mf honest updates:

[0092]

[0093] And commit Com(W) to W. Then, the aggregator broadcasts the following message to the entire network and stores it on the blockchain: 1) a list of f maliciously updated messages L ′ =((σ1,1,1),…,( f ,f,f)) and list of malicious clients L m ;2) Local aggregate update W, commitment value Com(W) and total number of updates m.

[0094] In step S104, the update quality of the n local aggregation models is calculated, global aggregation weights are assigned to the n local aggregation models according to the update quality, and the n local aggregation models are aggregated according to the global aggregation weights to obtain the updated global model.

[0095] During the global aggregation phase, a leader is selected from all aggregators using a verifiable random function, and this leader performs the global aggregation. The leader receives local updates from all aggregators, calculates the quality of these updates, assigns appropriate weights, and performs global aggregation. The leader then commits to these updates and stores the commitment and the global model on the blockchain.

[0096] Optionally, in one embodiment of this application, a global aggregator is selected from n aggregators using a consistent hashing algorithm and a verifiable random function to obtain a leader, including: constructing a reputation hash ring and allocating the reputation hash ring to aggregators according to their reputation weight; passing the aggregator's private key and random number to the verifiable random function to calculate the hash value and proof; mapping the hash value to the reputation hash ring, and the corresponding aggregator is the leader.

[0097] Optionally, in one embodiment of this application, calculating the update quality of n local aggregation models and assigning global aggregation weights to the n local aggregation models based on the update quality includes: calculating the cosine similarity between the leader's local aggregation model and the local aggregation models sent by other aggregators, and determining the global aggregation weights of the local aggregation models based on the cosine similarity.

[0098] To prevent single points of failure and malicious behavior in centralized aggregation, a decentralized global aggregation method is designed. Aggregators are selected from all aggregators for global aggregation using consistent hashing (SHA-256) and a verifiable random function (VRF). Specifically:

[0099] Step 1. Construct a reputation hash ring based on the reputation weight q of the aggregator. i Assign rings to them.

[0100] Step 2. The tracer uses their private key SK and a random number... This hash value h is passed to a VRF to calculate. SK And a proof of π.

[0101] Step 3. Calculate the hash value h SK When mapped onto the reputation hash ring, the corresponding aggregator is selected as the leader.

[0102] Step 4. The other n-1 aggregators verify the authenticity of the leader's identity by proving π. If the verification passes, the aggregator sends a local aggregation update W. i and commitment Com(W i ), i = 1, ..., given to the leader.

[0103] Step 5. The leader receives and verifies the commitment Com(W) i ), i = 1, ..., n. Then, calculate the aggregate update W for each leader. L And these aggregated updates W i The cosine similarity will be expressed as cos(W i W L Aggregate update W ≤ 0 i Send to the smart contract. The leader calculates cos(W). i W L Aggregate update W > 0 i Weights:

[0104]

[0105] Step 6. Finally, the leader's safety weights are aggregated in the global model:

[0106]

[0107] When selecting a new leader in the next round, the hash value h from this round will be used. SK Secondary hash h(h) SK Repeat the above steps.

[0108] After global aggregation, the leader makes a commitment to the model. and the commitment and All of these are stored on the blockchain. Other aggregators can verify whether their local models are being used using the following formula:

[0109]

[0110] Before the key SK is reconstructed, an adversary cannot predict the output of the consistent hash and strategically execute an attack. Due to the pseudo-randomness of VRF, aggregators with higher reputation scores are guaranteed to be selected with a higher probability. The entire training process ends when the aggregation model converges or reaches the maximum number of iterations. Otherwise, the next round of iterations begins.

[0111] In step S105, the traceability key is reconstructed based on the private key share contributed by the aggregator, the malicious client corresponding to the malicious update is decrypted based on the traceability key, and the client and aggregator in the update process are rewarded or punished.

[0112] During the accountability phase, other aggregators obtain the malicious update from the network and verify whether the malicious update deviates significantly from the local model aggregation. If the verification passes, the aggregators share their private key shares with the tracers. After receiving a majority of the shares, the tracers reconstruct the trace key and decrypt it to obtain the identity of the sender of the malicious update. The smart contract punishes malicious clients and aggregators and rewards other honest clients and aggregators.

[0113] Optionally, in one embodiment of this application, before reconstructing the traceability key based on the aggregator's own private key share, the method further includes: verifying the validity of the malicious update's signature and commitment, verifying whether the cosine distance between the malicious update and the average of n local aggregation models is less than 0, and contributing the aggregator's own private key share to the tracer when all verifications pass.

[0114] This application only identifies malicious updates, while keeping honest updates anonymous. Other aggregators, upon receiving the message list L′, the partial aggregate update W, and the commitment value Com(W), perform verification sequentially:

[0115] 1) Verify(PK, w f ,R,σ f The algorithm verifies the validity of f signatures;

[0116] 2) Verify the validity of the aggregate value W using the commitment Com(W);

[0117] 3) Verify whether the cosine distance between the malicious update and the average of the aggregated updates W is less than 0, i.e., determine... Whether it is valid or not.

[0118] To prevent aggregators from flagging honest model updates as malicious if they are acting as covert adversaries, the above formula must be verified by a majority of aggregators. Furthermore, after successful verification, aggregators share their secret share SK. i And send it to the tracer. The tracer verifies (SK) using formula (2). i ,t i The correctness of the secret share is required; otherwise, the aggregator is required to hand over the correct secret share. When the tracer receives no less than k secret shares SK... i Then, using Recon({SK i} i∈m,i≥k The algorithm reconstructs the private key SK as follows:

[0119]

[0120] The tracer uses the Trace(w f ,R,σ f ,SK) algorithm to trace these f bad updates: 1) Calculate the decryption algorithm Dec(SK,c) to obtain the public key pk i ′, that is, the identity address; 2) Obtain a proof ψ of the owner of pk i through the Prove(crs,(PK,c,pk i ),SK) algorithm. The tracer sends the trace results pk i ′ and ψ to the blockchain, and all aggregators can use the VerTrace(PK,w f ,R,σ f ,pk i ′,ψ) algorithm to verify the correctness of the proof ψ.

[0121] Optionally, in an embodiment of the present application, rewards and punishments are imposed on the clients and aggregators during the update process, including: deducting the deposit of malicious clients, reducing the reputation value of malicious clients, increasing the reputation value of other clients except malicious clients, and giving fixed rewards; reducing the reputation value of aggregators that do not contribute their private key shares and aggregators that aggregate the local models of malicious clients, and increasing the reputation value of aggregators that contribute their private key shares and aggregators that do not aggregate the local models of malicious clients.

[0122] The training goal of most participants in federated learning is to obtain better model quality at the lowest cost. A small number of clients may be malicious, and aggregators may also be hidden adversaries. In this application, the smart contract will automatically execute reputation penalties on these two types of entities, as Figure 4 shown, the process is as follows:

[0123] 1) Client: The punishment for malicious clients includes deducting the deposit V i and reducing the reputation value. The reputation value of malicious clients is reset to:

[0124]

[0125] where f / m is the proportion of malicious clients in the cluster, and s i is the update score of malicious clients. If r i ′ < threshold, the client will be kicked out of the model training set. Since the present invention realizes the identity anonymity of honest clients, rewards cannot be associated with individuals according to contributions. Therefore, the reputation value of other clients except malicious clients increases and they receive rewards

[0126] 2) Aggregators: In order to punish those who do not contribute SK i For the nk aggregators of the secret share, the smart contract synchronously reduces their reputation value by (-k) / k. Mixing malicious gradients into honest gradients for local model aggregation is a serious deviation from the protocol. The smart contract updates W based on the deviation detected by the leader. i ′ Update the reputation value of the corresponding aggregator to:

[0127] r i ′ = i (1-|cos(W i ′ , L )|))(18)

[0128] Among them, |cos(W i ′ , L | represents the degree of deviation of the aggregator. Additionally, the reputation value of aggregators that honestly execute the protocol will increase. Increase the reputation value of the k aggregators participating in the secret sharing by k / n. Update the reputation value of all participants; the reputation value is maintained by the smart contract.

[0129] The blockchain-based anonymous and accountable privacy-preserving federated learning proposed in this application not only achieves client anonymity but also effectively encourages client contributions. In the initial stage, the deposit decreases as the reputation score increases, and honest clients receive the same reward during the incentive phase. Therefore, clients with higher final reputation scores receive higher rewards, thus achieving precise incentives for honest clients whose identities have not been exposed. Furthermore, the reputation score also affects the weights in the model aggregation; clients with higher reputation scores may have higher weights, resulting in higher final model accuracy.

[0130] Within each client cluster, model updates sent by each client are anonymized, preventing other participants from identifying the sender and thus protecting privacy. To ensure system robustness, these model updates undergo robustness testing, are weighted according to model quality, and aggregated to reduce the weight of malicious updates and improve overall model accuracy. A novel incentive mechanism is designed to provide targeted incentives while maintaining anonymity, thereby encouraging client contributions. Finally, decentralized global aggregation is used to prevent single points of failure, and the data is stored on the blockchain for automatic execution by smart contracts.

[0131] Next, referring to the accompanying drawings, a blockchain-based federated learning system for identity anonymity and accountability-protected privacy, proposed according to an embodiment of this application, is described.

[0132] Figure 5 This is an example diagram of a blockchain-based federated learning system for identity anonymity and accountability, based on an embodiment of this application.

[0133] like Figure 5 As shown, the blockchain-based federated learning system 10, which provides identity anonymity and accountability for privacy protection, includes: m clients 100, n aggregators 200, and tracers 300.

[0134] Among them, there are m clients (100) used to pay deposits to the smart contract, download the initial global model, and train the global model to obtain m local models based on the local private dataset; n aggregators (200) used to aggregate the m local models of the clients to obtain n local aggregated models, and use the leader among the aggregators to perform global aggregation of the n local aggregated models to obtain the updated global model; and 300 tracers used to reconstruct the trace key based on the private key share contributed by the aggregators, decrypt the malicious client corresponding to the malicious update based on the trace key, and reward or punish the clients and aggregators in the update process.

[0135] Optionally, in one embodiment of this application, the blockchain-based anonymous and accountable privacy-preserving federated learning system further includes: a key generation center, used to generate and distribute public-private key pairs for clients and aggregators, perform system initialization, and generate public parameters.

[0136] It should be noted that the foregoing explanation of the blockchain-based identity anonymity and accountability-based privacy-preserving federated learning method embodiment also applies to the blockchain-based identity anonymity and accountability-based privacy-preserving federated learning system of this embodiment, and will not be repeated here.

[0137] According to the blockchain-based anonymous and accountable privacy-preserving federated learning system proposed in this application, the client updates its local model and performs local signing, sending the signature list to the aggregator. The aggregator filters out malicious updates, which are then verified by other aggregators. Finally, the tracer reconstructs the traceability key to trace malicious identities. The tracer incentivizes and holds both the client and the aggregator accountable. Malicious clients have their deposits deducted and their reputation reduced; dishonest aggregators have their reputation reduced; and other honest participants have their reputation increased.

[0138] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0139] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0140] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

Claims

1. A blockchain-based federated learning method for identity anonymity and accountability with privacy protection, characterized in that, Includes the following steps: Based on the similarity of local private data m Clustering is performed on each client to obtain n Cluster clients; among the cluster clients, the client with the highest reputation value is selected as the aggregator for this cluster, and the result is... n An aggregator; For those who have already paid a deposit m Each client downloads the initial global model, and uses the... m The global model is trained using the local private datasets of each client. m A local model; The client's own public key is encrypted using a random number and the public key of the aggregator to which the client belongs. The client's own private key is generated using the public key set of other clients and the client's own private key. The client's reputation value, the local model, and the corresponding knowledge signature are combined into a message list and sent to the corresponding aggregator. The validity of each knowledge signature in the message list is verified. Local models in the verified message list are then detected to identify malicious and honest updates of the local models. The identification method involves calculating the update score of each local model and selecting the model with the lowest update score. m - f One update is recorded as an honest update, the others... f Each update is categorized as a malicious update; the update score and the reputation value are used as evaluation indicators, and the entropy weight method is applied. m - f Calculate local aggregation weights for each honest update, and aggregate the honest updates according to the local aggregation weights to obtain... n A local aggregation model; Construct a reputation hash ring and distribute the reputation hash ring to aggregators based on their reputation weight; The aggregator's private key and random number are passed to a verifiable random function to calculate the hash value and proof; Mapping the hash value to the reputation hash ring yields the corresponding aggregator as the leader. and the n A local aggregation model is sent to the leader, and malicious updates and corresponding knowledge signatures are broadcast, wherein... n The number of clusters for the client; Calculate the n The update quality of each local aggregation model, based on the update quality, is the... n Each local aggregation model is assigned a global aggregation weight, and the aggregation is performed based on the global aggregation weight. n The updated global model is obtained from the local aggregation model; The traceability key is reconstructed based on the private key share contributed by the aggregator. The malicious client corresponding to the malicious update is decrypted based on the traceability key, and the client and aggregator in the update process are rewarded or punished accordingly.

2. The method according to claim 1, characterized in that, The deposit paid by the client is determined by the client's credit score, wherein the client... Required deposit for: in, To fix the unit price of the model, For the client Reputation value The minimum reputation value required to allow a client to participate in the model training set.

3. The method according to claim 1, characterized in that, Calculate the n The update quality of each local aggregation model, based on the update quality, is the... n Each local aggregation model assigns global aggregation weights, including: Calculate the cosine similarity between the leader's local aggregation model and the local aggregation models sent by other aggregators, and determine the global aggregation weight of the local aggregation model based on the cosine similarity.

4. The method according to claim 1, characterized in that, Before reconstructing the traceability key based on the private key share contributed by the aggregator, the following steps are also included: Verify the validity of the signature and commitment of the malicious update, and verify the malicious update and the stated... n If the cosine distance between the average values ​​of the local aggregation models is less than 0, and all verifications pass, the aggregator's own private key share is contributed to the tracer.

5. The method according to claim 1, characterized in that, Rewards and penalties will be imposed on clients and aggregators during the update process, including: The deposit of the malicious client is deducted, the reputation value of the malicious client is reduced, the reputation value of other clients besides the malicious client is increased, and a fixed reward is given. Decrease the reputation value of aggregators who have not contributed their own private key share and the reputation value of aggregators that aggregate the malicious client local model, and increase the reputation value of aggregators who have contributed their own private key share and the reputation value of aggregators that have not aggregated the malicious client local model.

6. A blockchain-based federated learning system for identity anonymity and accountability with privacy protection, characterized in that, include: m A client is used to pay a deposit to the smart contract, download the initial global model, and train the global model based on a local private dataset. m A local model; n An aggregator, used for the clients. m Aggregating local models yields n A local aggregation model, and utilizes the leader among the aggregators to... n The local aggregation models are aggregated globally to obtain the updated global model; The tracer is used to reconstruct the trace key based on its own private key share contributed by the aggregator, decrypt the malicious client corresponding to the malicious update based on the trace key, and reward or punish the client and aggregator in the update process. The leader is used to determine the similarity of the local private data. m Clustering is performed on each client to obtain n Cluster clients; among the cluster clients, the client with the highest reputation value is selected as the aggregator for this cluster, and the result is... n A leader is determined by: constructing a reputation hash ring and allocating the ring to aggregators based on their reputation weight; passing the aggregator's private key and random number to a verifiable random function to calculate the hash value and proof; mapping the hash value to the reputation hash ring to obtain the corresponding aggregator as the leader.

7. The system according to claim 6, characterized in that, Also includes: The key generation center is used to generate and distribute public and private key pairs for the client and the aggregator, perform system initialization, and generate public parameters.

Images