A privacy protection method and system based on blockchain against federated learning gradient attack
By using smart contracts in a blockchain system to generate and verify noise values, the problem of gradient leakage in federated learning is solved, achieving a balance between user privacy protection and model accuracy, and reducing the impact of malicious attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- UNICOM LINGJING VIDEO (JIANGXI) TECH CO LTD
- Filing Date
- 2022-11-30
- Publication Date
- 2026-07-24
AI Technical Summary
In federated learning, gradient leakage leads to user privacy breaches, and existing methods of adding noise significantly impact model accuracy.
In a blockchain system, noise is added through smart contracts, and noise values are generated using gradient hash values. The gradient after adding noise is stored in the blockchain. The central server updates the gradient by calculating the average gradient through smart contracts, ensuring the consistency of gradient hash values to protect user privacy.
It effectively protects user privacy, avoids gradient leakage, maintains the accuracy and efficiency of model training, and reduces the impact of malicious attacks.
Smart Images
Figure CN116340986B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data privacy protection technology, specifically to a privacy protection method and system based on blockchain to resist federated learning gradient attacks. Background Technology
[0002] With the further development of network communication, the internet requires higher levels of security and stronger privacy protection. Machine learning needs to utilize massive amounts of data for training, but data and privacy protection hinders data flow, creating data silos and preventing the release of data's full value. Traditional machine learning based on central servers faces serious privacy and security challenges, making it unsuitable for ubiquitous secure artificial intelligence in the future network. Furthermore, due to the enormous overhead of centralized data aggregation and processing, traditional centralized machine learning solutions may not be suitable for ubiquitous artificial intelligence.
[0003] Federated learning, as an emerging distributed machine learning approach, offers a novel solution to the privacy and security challenges faced by machine learning. In federated learning, participating devices collaboratively train a shared model using their local data, unlike traditional machine learning schemes where only model updates are uploaded to a centralized parameter server instead of the original data. While federated learning offers a different approach to the development of artificial intelligence and significantly improves privacy-sensitive applications, it is still in its early stages of development and faces new challenges.
[0004] Unlike traditional machine learning approaches, federated learning uploads model updates rather than raw data to a centralized parameter server. This method provides relatively robust privacy protection for machine learning, as the raw data is always stored locally, avoiding direct privacy leaks. However, according to recent research, the model update process still faces the risk of privacy breaches. Malicious actors can obtain gradient updates during user training and infer user data, posing a significant threat to data security and user privacy in federated learning.
[0005] To address the privacy concerns arising from gradient leakage in federated learning, existing technologies primarily employ two approaches: 1. Encrypting updated model parameters using cryptographic schemes such as homomorphic encryption before uploading to a central server. This method ensures that other participants cannot access user gradients, but the central server can directly obtain these gradient parameters, potentially leading to privacy leaks. 2. Adding noise to the model. When users upload gradient parameters, appropriate noise is added to the data, preventing participants from directly accessing the gradients from each training round, thus hindering data recovery. Experiments have shown that adding noise can protect privacy to some extent, but it severely impacts the training accuracy and speed of federated learning. Summary of the Invention
[0006] To address this, the present invention proposes a privacy protection method and system based on blockchain to resist federated learning gradient attacks, aiming to solve or at least alleviate at least one of the above-mentioned problems.
[0007] According to one aspect of the present invention, a blockchain-based privacy protection method for resisting gradient attacks in federated learning is provided, wherein gradient updates are performed during the training of the federated learning model according to the following process to protect the privacy of the local training data of each participant:
[0008] The blockchain system receives the first gradient and the first hash value uploaded by each participant; the first gradient is obtained by each participant through training using local training data based on the model parameters shared by the central server; the first hash value is calculated based on the first gradient.
[0009] For each first gradient, the blockchain system calculates the second hash value corresponding to the first gradient; uses the second hash value as a random number seed to generate a first noise value, adds the first noise value to the first gradient, and obtains the first gradient after adding noise;
[0010] For each first hash value, the blockchain system generates a second noise value using the first hash value as a random number seed, and subtracts the first gradient after adding noise from the second noise value to obtain the second gradient; calculates the hash value of the second gradient, and determines whether the hash value of the second gradient is the same as the first hash value. If they are the same, it means that the first gradient uploaded by the participant has not been changed; and divides the second noise value corresponding to each participant into multiple parts.
[0011] The blockchain system sums up multiple second noise values corresponding to multiple participants and transmits the obtained noise values to the central server.
[0012] The central server calculates the average gradient based on the noise value and the first gradient after adding noise; and updates the gradient based on the average gradient.
[0013] Furthermore, the formula for calculating the first gradient is:
[0014]
[0015] Among them, W t x represents the model weight parameters in the t-th round of training the federated learning model; t,i y t,i Let F(·) represent the data input and corresponding label of participant i in round t, respectively; F(·) represents the predicted value of the input data under the current model parameters; l(·) represents the loss function constructed using the predicted value and the true label.
[0016] Furthermore, the formula for calculating the average gradient is:
[0017]
[0018] In the formula, N represents the total number of participants; This represents the first gradient after adding noise; R represents the noise value.
[0019] Furthermore, the formula for updating the gradient based on the average gradient is:
[0020]
[0021] In the formula, η represents the learning rate.
[0022] According to another aspect of the present invention, a privacy protection system based on blockchain against federated learning gradient attacks is provided. The system includes multiple participants, a central server, and a blockchain system. Each of the multiple participants trains using local training data based on model parameters shared by the central server to obtain a first gradient; calculates a first hash value based on the first gradient; and uploads the first gradient and the first hash value to the blockchain system.
[0023] The blockchain system includes a noise-adding smart contract module, a noise-value-sharing smart contract module, and a noise and smart contract module; wherein...
[0024] The noise-adding smart contract module is used to: receive a first gradient and a first hash value uploaded by each participant; for each first gradient, calculate a second hash value corresponding to the first gradient; generate a first noise value using the second hash value as a random number seed; add the first noise value and the first gradient to obtain the first gradient after adding noise;
[0025] The shared noise value smart contract module is used to: for each first hash value, generate a second noise value with the first hash value as a random number seed, and subtract the first gradient after adding noise from the second noise value to obtain the second gradient; calculate the hash value of the second gradient, determine whether the hash value of the second gradient is the same as the first hash value, if they are the same, it means that the first gradient uploaded by the participant has not been changed; and divide the second noise value corresponding to each participant into multiple parts.
[0026] The noise and smart contract module is used to: sum multiple second noise values corresponding to multiple participants, and transmit the obtained noise values to the central server;
[0027] The central server is used to calculate the average gradient based on the noise value and the first gradient after adding noise, and to update the gradient based on the average gradient.
[0028] Furthermore, the formula for calculating the first gradient is:
[0029]
[0030] Among them, W t x represents the model weight parameters in the t-th round of training the federated learning model; t,i y t,i Let F(·) represent the data input and corresponding label of participant i in round t, respectively; F(·) represents the predicted value of the input data under the current model parameters; l(·) represents the loss function constructed using the predicted value and the true label.
[0031] Furthermore, the formula for calculating the average gradient is:
[0032]
[0033] In the formula, N represents the total number of participants; This represents the first gradient after adding noise; R represents the noise value.
[0034] Furthermore, the formula for updating the gradient based on the average gradient is:
[0035]
[0036] In the formula, η represents the learning rate.
[0037] The beneficial technical effects of this invention are:
[0038] This invention proposes a privacy protection method and system based on blockchain to resist gradient attacks in federated learning. It effectively solves the problem of user privacy leakage caused by gradient leakage in federated learning models and improves the model accuracy reduction problem caused by existing noise addition schemes. Furthermore, it protects user identity security through blockchain smart contracts and avoids malicious damage during the training process. Attached Figure Description
[0039] The present invention can be better understood by referring to the description given below in conjunction with the accompanying drawings, which together with the following detailed description are included in and form part of this specification, and are used to further illustrate preferred embodiments of the invention and explain the principles and advantages of the invention.
[0040] Figure 1 This is a flowchart of a privacy protection method based on blockchain to resist federated learning gradient attacks, according to an embodiment of the present invention.
[0041] Figure 2 This is a schematic diagram of the threat model in an embodiment of the present invention;
[0042] Figure 3 This is a flowchart of a privacy protection method based on blockchain to resist federated learning gradient attacks, according to an embodiment of the present invention.
[0043] Figure 4 This is an example diagram showing the data after gradient recovery of an existing federated learning model in an embodiment of the present invention;
[0044] Figure 5 This is an example diagram showing the data after gradient recovery of the federated learning model trained based on the method of this invention in an embodiment of the present invention. Detailed Implementation
[0045] To enable those skilled in the art to better understand the present invention, exemplary embodiments or examples of the present invention will be described below in conjunction with the accompanying drawings. Obviously, the described embodiments or examples are merely some, not all, of the embodiments or examples of the present invention. All other embodiments or examples obtained by those skilled in the art based on the embodiments or examples of the present invention without inventive effort should fall within the scope of protection of the present invention.
[0046] This invention provides a blockchain-based privacy protection method against gradient attacks in federated learning. During the training of the federated learning model, gradient updates are performed according to the following process to protect the privacy of each participant's local training data:
[0047] The blockchain system receives the first gradient and the first hash value uploaded by each participant; the first gradient is obtained by each participant through training using local training data based on the model parameters shared by the central server; the first hash value is calculated based on the first gradient.
[0048] For each first gradient, the blockchain system calculates the second hash value corresponding to the first gradient; uses the second hash value as a random number seed to generate a first noise value, adds the first noise value to the first gradient, and obtains the first gradient after adding noise;
[0049] For each first hash value, the blockchain system generates a second noise value using the first hash value as a random number seed, and subtracts the first gradient after adding noise from the second noise value to obtain the second gradient; calculates the hash value of the second gradient, and determines whether the hash value of the second gradient is the same as the first hash value. If they are the same, it means that the first gradient uploaded by the participant has not been changed; and divides the second noise value corresponding to each participant into multiple parts.
[0050] The blockchain system sums up multiple second noise values corresponding to multiple participants and transmits the obtained noise values to the central server.
[0051] The central server calculates the average gradient based on the noise value and the first gradient after adding noise; and updates the gradient based on the average gradient.
[0052] In this embodiment, preferably, the formula for calculating the first gradient is:
[0053]
[0054] Among them, W t x represents the model weight parameters in the t-th round of training the federated learning model; t,i y t,i Let F(·) represent the data input and corresponding label of participant i in round t, respectively; F(·) represents the predicted value of the input data under the current model parameters; l(·) represents the loss function constructed using the predicted value and the true label.
[0055] In this embodiment, preferably, the formula for calculating the average gradient is:
[0056]
[0057] In the formula, N represents the total number of participants; This represents the first gradient after adding noise; R represents the noise value.
[0058] In this embodiment, preferably, the formula for gradient update based on the average gradient is:
[0059]
[0060] In the formula, η represents the learning rate.
[0061] Another embodiment of the present invention provides a privacy protection method based on blockchain that resists federated learning gradient attacks.
[0062] In federated learning, participating devices collaboratively train shared models using their local data. Unlike traditional machine learning solutions, it only updates the model instead of uploading the original data to a centralized parameter server. The core idea is to conduct distributed model training among multiple data sources with local data. Without exchanging local individual or sample data, a global model based on virtual fused data is constructed by exchanging model parameters or intermediate results. This achieves a balance between data privacy protection and data sharing computation, namely, a new application paradigm of "data available but not visible" and "data does not move but the model moves".
[0063] During the training process of a machine learning model, the model is continuously optimized by updating gradients to obtain the optimal model. The gradient calculation method is as follows:
[0064]
[0065] Among them, W t x represents the model weight parameters for round t. t,i y t,i Let be the data input and label of participant i in round t; F(·) be the predicted value of the input data under the current model parameters; l(·) be the loss function constructed using the predicted value and the true label.
[0066] Given a learning rate of η, the weights are updated in each round as follows:
[0067]
[0068] In federated learning, it is necessary to aggregate the gradients calculated separately by each participant:
[0069]
[0070] To recover the data from the gradient, a dummy input x' and a label input y' are first randomly initialized; then, this "dummy data" is input into the model to obtain the "dummy gradient".
[0071]
[0072] Optimizing spurious gradients close to the original can also make fake data resemble real training data. Given the gradient at a certain step, the training data is obtained by minimizing the following objective:
[0073]
[0074] Normal distance in the objective function It is differentiable, and given the virtual input x' and label y', it can be optimized using a method based on standard gradients. After multiple iterations of optimization, the real data can be recovered.
[0075] The above process illustrates how a user's training data can lead to privacy breaches through gradient updates, i.e., gradient leakage.
[0076] Therefore, this invention introduces blockchain technology and proposes a blockchain-based privacy protection method against federated learning gradient attacks, i.e., a method to resist the acquisition of user content privacy through gradient attacks in machine learning. Figure 1 As shown, this method includes three parties: a blockchain network, multiple participants, and a central server. The blockchain network provides a secure and reliable execution environment, ensures the reliable operation of smart contracts, stores data, and guarantees data security. The multiple participants are providers of training data, using their own training data to train the model and obtain model parameters. The central server is used for aggregating model gradients and updating model weights.
[0077] In a blockchain, users collaboratively create blocks to verify and record a public ledger of transactions. Decentralization is the most fundamental characteristic of blockchain; each node backs up complete ledger information. The consensus mechanism enables each independent node to verify and confirm data in the network, thereby generating trust and reaching consensus. Encryption algorithms safeguard the anonymity, immutability, and unforgeability of blockchain, forming the baseline for whether a chain is trustworthy and possesses basic security. Smart contracts are contracts defined in digital form that can automatically execute their terms. They place contracts in code on the blockchain and automatically execute them under agreed-upon conditions. The immutability and traceability of blockchain provide a secure and reliable operating environment for smart contracts.
[0078] Smart contracts execute automatically when their triggering conditions are met, without human control. This greatly reduces the possibility of malicious interference with the normal execution of the contract. Blockchain-based smart contracts not only leverage the cost-efficiency advantages of smart contracts but also prevent malicious interference with their normal execution. While adding noise to the gradient parameters of a training model can enhance privacy protection during machine learning, noise can severely impact training effectiveness. Too little noise fails to provide effective privacy protection, while excessive noise significantly reduces the accuracy of machine learning training.
[0079] Although blockchain provides a secure and reliable computing environment, it still faces the risk of attacks on user data and privacy. Figure 2 The system is shown to face several threats. Internally, participants may send incorrect data; the central server may infer user privacy based on the gradient data provided by participants; malicious nodes may disrupt the machine learning training process, making training difficult and exposing the identities and privacy of data providers; and blockchain administrators may be able to recover participant data based on data stored on the blockchain and expose user identities based on blockchain transaction records.
[0080] The privacy protection method based on blockchain to resist federated learning gradient attacks proposed in this invention aims to solve the above problems.
[0081] In this method, after participants complete training and upload gradient data, a smart contract automatically adds noise values related to the gradient hash value and stores them in the blockchain. The blockchain stores the gradient with added noise, making it impossible to directly recover user data through gradient leakage. When the central server aggregates data, participants call the smart contract using the hash value of the gradient data as a parameter. The smart contract verifies the uploaded gradient data before proceeding to the next step. The smart contract recalculates the noise value and randomly divides it into several parts, storing each part in the blockchain. Malicious nodes cannot know the number of parts the noise value has been divided into, nor can they know which participant the shared noise value stored in the blockchain belongs to, thus preventing them from obtaining the true noise value. The noise sum required for the central server to aggregate data is calculated by the smart contract using the shared noise values of all participants and directly returned. Finally, the latest model parameters are calculated. Data operations in the blockchain are executed through smart contracts, and the execution process cannot be interfered with by humans, greatly improving the system's resistance to malicious nodes.
[0082] In this method, each participant updates the gradient in each round. Add noise R t Then, it is sent to the central server, and the gradient received by the central server... for:
[0083]
[0084] The central server aggregates the received gradients:
[0085]
[0086] The participants will use secure multi-party computation F to calculate the generated noise. s (·) Send to multiple participants:
[0087] r1,r2,...,r s =Fs (R t,i (8)
[0088] The participants jointly calculate the sum of all random numbers:
[0089]
[0090] Central server recovery gradient:
[0091]
[0092] As can be seen, the data recovered by the central server is consistent with the aggregated gradient without added noise, thus ensuring that the added noise will not affect the training accuracy. By transmitting the added noise through secure multi-party computation, neither any participant nor the central server can directly recover the noise value or infer the true gradient, thereby protecting user privacy.
[0093] like Figure 3 As shown, the specific steps of this method include:
[0094] Step 1: Multiple participants begin training;
[0095] Each participant uses the model parameters shared by the central server to train machine learning on its own images and calculates gradients using its own data.
[0096] Step 2: Multiple participants upload gradients;
[0097] Each participant i will assign its own gradient As a parameter, the noise-adding smart contract module is invoked; this module is used to calculate the gradient. Hash value:
[0098]
[0099] With gradient Hash value H i Use a random number seed to generate noise value R. i =Random(H i ), calculate the gradient after adding noise:
[0100]
[0101] And Stored in the blockchain.
[0102] Step 3: Verify the data and share the noise values;
[0103] Each participant i will receive the gradient Hash value H iAs a parameter, the shared noise value smart contract module is invoked. This module is used to verify whether the uploaded noise gradient contains anything related to H. i Corresponding noise gradient
[0104] First, based on the gradient Hash value H i Calculate the noise value R i =Random(H i ), using the noise value R i 'and noise gradient Calculate gradient value
[0105] Then calculate hash value Is it related to H? i If they are consistent, it means that the gradient uploaded by participant i is consistent. If the data has not been changed, it means that the noise gradient stored in the blockchain does not match the gradient uploaded by the participant. This indicates that the data was contaminated during the upload process or that the participant is a malicious node. In this case, the participant will be removed from the system.
[0106] After verifying that the data is consistent, R i 'Randomly divided into n i Parts, producing n i random numbers in And random number Stored in the blockchain.
[0107] Step 4: Obtain the noise value;
[0108] The central server's gradient aggregation first requires obtaining the noise sum. The noise sum is calculated by the central server calling the noise sum smart contract module. This module divides all the noise in the account into segments. Summation is performed to obtain R, and R is returned to the central server.
[0109] Step 5: Generate unbiased gradients;
[0110] The central server obtains multiple noise gradients from the blockchain. use Calculate the average gradient, then the parameters for the new model are:
[0111] Furthermore, after sharing the new model parameters with each participant, the next round of training is carried out according to the above steps until a federated learning model that meets the requirements is obtained.
[0112] In this embodiment of the invention, during the gradient uploading stage, participants call a smart contract to add noise to the gradient; the gradient stored in the blockchain is not the actual gradient. During the noise value sharing stage, participants call the smart contract with the gradient hash value as a parameter. First, verification is performed based on the gradient hash value to confirm that the noise gradient stored in the blockchain matches the uploaded gradient. Then, the noise value is randomly divided into multiple parts. Malicious attackers cannot determine which participant owns which part of the divided noise value. All divided noise values are stored in the same account, making it impossible to recover the actual noise value. Therefore, it is impossible to recover the actual gradient based on the noise gradient and the divided noise values, thus protecting user privacy. During the noise sum acquisition stage, the central server directly obtains the noise sum through a smart contract, avoiding direct acquisition of the noise value and thus recovering the actual gradient. During the gradient aggregation stage, the central server calculates the average gradient using the noise gradient and the noise sum and updates the model parameters. Compared with other existing noise-adding schemes, this invention does not lose model parameter accuracy, ensuring the machine learning training effect. Because of the introduction of the blockchain network, parties do not need to find additional transmission channels to transmit information, greatly enhancing transmission security and reducing network traffic.
[0113] Another embodiment of the present invention provides a privacy protection system based on blockchain to resist federated learning gradient attacks. The system includes multiple participants, a central server, and a blockchain system. Each of the multiple participants trains using local training data based on model parameters shared by the central server to obtain a first gradient; calculates a first hash value based on the first gradient; and uploads the first gradient and the first hash value to the blockchain system.
[0114] The blockchain system includes a noise-adding smart contract module, a noise-value-sharing smart contract module, and a noise and smart contract module; wherein...
[0115] The noise-adding smart contract module is used to: receive a first gradient and a first hash value uploaded by each participant; for each first gradient, calculate a second hash value corresponding to the first gradient; generate a first noise value using the second hash value as a random number seed; add the first noise value and the first gradient to obtain the first gradient after adding noise;
[0116] The shared noise value smart contract module is used to: for each first hash value, generate a second noise value with the first hash value as a random number seed, and subtract the first gradient after adding noise from the second noise value to obtain the second gradient; calculate the hash value of the second gradient, determine whether the hash value of the second gradient is the same as the first hash value, if they are the same, it means that the first gradient uploaded by the participant has not been changed; and divide the second noise value corresponding to each participant into multiple parts.
[0117] The noise and smart contract module is used to: sum multiple second noise values corresponding to multiple participants, and transmit the obtained noise values to the central server;
[0118] The central server is used to calculate the average gradient based on the noise value and the first gradient after adding noise, and to update the gradient based on the average gradient.
[0119] In this embodiment, preferably, the formula for calculating the first gradient is:
[0120]
[0121] Among them, W t x represents the model weight parameters in the t-th round of training the federated learning model; t,i y t,i Let F(·) represent the data input and corresponding label of participant i in round t, respectively; F(·) represents the predicted value of the input data under the current model parameters; l(·) represents the loss function constructed using the predicted value and the true label.
[0122] In this embodiment, preferably, the formula for calculating the average gradient is:
[0123]
[0124] In the formula, N represents the total number of participants; This represents the first gradient after adding noise; R represents the noise value.
[0125] In this embodiment, preferably, the formula for gradient update based on the average gradient is:
[0126]
[0127] In the formula, η represents the learning rate.
[0128] The functionality of the blockchain-based privacy protection system against federated learning gradient attacks described in this embodiment can be explained by the aforementioned blockchain-based privacy protection method against federated learning gradient attacks. Therefore, for the parts not detailed in this embodiment, please refer to the above method embodiments.
[0129] The technical effects of the present invention were further verified through experiments.
[0130] The experiment uses the CoCo dataset, a dataset suitable for image recognition, containing 80 image classifications, applicable to object detection, segmentation, and image captioning. The federated learning method used in the experiment is longitudinal federated learning.
[0131] The training data is input into both the existing federated learning model and the federated learning model trained using the method described in this invention, and after gradient retrieval, as follows: Figure 4 and 5 As shown, from Figure 4 As can be seen, after 50 and 70 iterations, existing federated learning models can enable attackers to obtain partial information from the original content; from Figure 5 As can be seen, after 70 iterations, the federated learning model trained based on the method of this embodiment can prevent attackers from obtaining effective information.
[0132] Although the invention has been described with respect to a limited number of embodiments, those skilled in the art will understand from the foregoing description that other embodiments are conceivable within the scope of the invention described herein. The disclosure of the invention is illustrative and not restrictive, and the scope of the invention is defined by the appended claims.
Claims
1. A privacy protection method based on blockchain to resist federated learning gradient attacks, characterized in that, Gradient updates are performed during the training of the federated learning model according to the following procedure to protect the privacy of each participant's local training data: The blockchain system receives the first gradient and the first hash value uploaded by each participant; the first gradient is obtained by each participant through training using local training data based on the model parameters shared by the central server; the first hash value is calculated based on the first gradient. For each first gradient, the blockchain system calculates the second hash value corresponding to the first gradient; uses the second hash value as a random number seed to generate a first noise value, adds the first noise value to the first gradient, and obtains the first gradient after adding noise; For each first hash value, the blockchain system generates a second noise value using the first hash value as a random number seed, and subtracts the first gradient after adding noise from the second noise value to obtain the second gradient; calculates the hash value of the second gradient, and determines whether the hash value of the second gradient is the same as the first hash value. If they are the same, it means that the first gradient uploaded by the participant has not been changed; and divides the second noise value corresponding to each participant into multiple parts. The blockchain system sums up multiple second noise values corresponding to multiple participants and transmits the obtained noise values to the central server. The central server calculates the average gradient based on the noise value and the first gradient after adding noise; and updates the gradient based on the average gradient.
2. The privacy protection method based on blockchain to resist federated learning gradient attacks according to claim 1, characterized in that, The formula for calculating the first gradient is: Among them, W t x represents the model weight parameters in the t-th round of training the federated learning model; t,i y t,i Let F(·) represent the data input and corresponding label of participant i in round t, respectively; F(·) represents the predicted value of the input data under the current model parameters; l(·) represents the loss function constructed using the predicted value and the true label.
3. The privacy protection method based on blockchain to resist federated learning gradient attacks according to claim 2, characterized in that, The formula for calculating the average gradient is: In the formula, N represents the total number of participants; ▽W i ' represents the first gradient after adding noise; R represents the noise value.
4. A privacy protection method based on blockchain to resist federated learning gradient attacks according to claim 3, characterized in that, The formula for updating gradients based on the average gradient is: In the formula, η represents the learning rate.
5. A privacy protection system based on blockchain to resist federated learning gradient attacks, characterized in that, It includes multiple participants, a central server, and a blockchain system; wherein, each of the multiple participants trains using local training data based on model parameters shared by the central server to obtain a first gradient; calculates a first hash value based on the first gradient; and uploads the first gradient and the first hash value to the blockchain system; The blockchain system includes a noise-adding smart contract module, a noise-value-sharing smart contract module, and a noise and smart contract module; wherein... The noise-adding smart contract module is used to: receive a first gradient and a first hash value uploaded by each participant; for each first gradient, calculate a second hash value corresponding to the first gradient; generate a first noise value using the second hash value as a random number seed; add the first noise value and the first gradient to obtain the first gradient after adding noise; The shared noise value smart contract module is used to: for each first hash value, generate a second noise value with the first hash value as a random number seed, and subtract the first gradient after adding noise from the second noise value to obtain the second gradient; calculate the hash value of the second gradient, determine whether the hash value of the second gradient is the same as the first hash value, if they are the same, it means that the first gradient uploaded by the participant has not been changed; and divide the second noise value corresponding to each participant into multiple parts. The noise and smart contract module is used to: sum multiple second noise values corresponding to multiple participants, and transmit the obtained noise values to the central server; The central server is used to calculate the average gradient based on the noise value and the first gradient after adding noise, and to update the gradient based on the average gradient.
6. A privacy protection system based on blockchain to resist federated learning gradient attacks according to claim 5, characterized in that, The formula for calculating the first gradient is: Among them, W t x represents the model weight parameters in the t-th round of training the federated learning model; t,i y t,i Let F(·) represent the data input and corresponding label of participant i in round t, respectively; F(·) represents the predicted value of the input data under the current model parameters; l(·) represents the loss function constructed using the predicted value and the true label.
7. A privacy protection system based on blockchain to resist federated learning gradient attacks according to claim 6, characterized in that, The formula for calculating the average gradient is: In the formula, N represents the total number of participants; ▽W i ' represents the first gradient after adding noise; R represents the noise value.
8. A privacy protection system based on blockchain to resist federated learning gradient attacks according to claim 7, characterized in that, The formula for updating gradients based on the average gradient is: In the formula, η represents the learning rate.