A privacy protection federated learning method based on blockchain anti-poisoning attack

Abstract

The application provides a privacy protection federated learning method based on a blockchain anti-poisoning attack, and belongs to the technical field of federated learning, privacy protection and blockchain technology. The technical problems of poisoning attack and malicious aggregation in the privacy protection federated learning are solved. The technical scheme comprises the following steps: S10, system global initialization; S20, local model training; S30, malicious participant identification; MO and SM cooperate to determine whether the participant has performed the normalization operation; S40, gradient ciphertext aggregation; S50, participant and MO update model. The application has the beneficial effects that the application protects the privacy of the participant model gradient by using the fully homomorphic encryption algorithm CKKS, identifies the malicious gradient in the gradient ciphertext by using the cosine similarity method, and calculates and verifies the aggregation result by using the consensus mechanism of the blockchain.

Description

Technical Field

[0001] This invention relates to the fields of federated learning, privacy protection, and blockchain technology, and in particular to a privacy-preserving federated learning method based on blockchain-based anti-poisoning attack. Background Technology

[0002] In the Industrial Internet of Things (IIoT), the number of connected devices is increasing, and the amount of data detected and collected is gradually growing. This data growth can improve the service quality of emerging applications. Traditional machine learning requires uploading raw data to a central server, which is responsible for using the raw data to train models. The data sharing process is prone to privacy leaks, causing huge losses to users. Therefore, the security and privacy protection of data providers need to be taken seriously.

[0003] Federated learning (FL) enables multiple clients to collaboratively train models without sharing local data. Participants possess a wealth of data collected from IIoT, which they keep for local training, submitting only their local models. This ensures user privacy and data security. Participants train their local models using local data and then upload their local gradients and model parameters to an aggregation server. The aggregation server aggregates the local gradients from all participants and sends model updates back to all participants. Research has demonstrated that the client's raw data can be derived from gradients in plaintext. To further protect user privacy, privacy-preserving techniques are combined with federated learning. Privacy-Preserving Federated Learning (PPFL) utilizes privacy-preserving techniques such as differential privacy, secure multi-party computation, and homomorphic encryption. It uses cryptographic techniques or noise to hide the true values ​​of local gradients, allowing model updates to be shared among participants. The aggregation server performs aggregation operations without access to the true values ​​of local gradients, thereby improving model accuracy and performance.

[0004] Homomorphic encryption allows computation on ciphertext without decryption, but the increased size of homomorphically encrypted data leads to huge computational overhead and data transmission volume. Traditional privacy-preserving federated learning typically uses the Paillier homomorphic encryption algorithm, but it can only encrypt integers. Since gradients are floating-point numbers, the gradients need to be quantized first and then encrypted one by one, increasing computational and communication overhead.

[0005] The fully homomorphic encryption algorithm CKKS performs approximate calculations on plaintext as floating-point numbers. Homomorphic multiplication of ciphertext increases the data size. The CKKS algorithm uses a homomorphic multiplication key to scale the multiplication ciphertext, thus keeping the data size within a small range. The CKKS algorithm can encrypt floating-point numbers and can also directly encrypt vectors, reducing computational overhead.

[0006] Introducing the main algorithms of CKKS:

[0007] (1)KeyGen(1 λ (i)→(pk, sk, evk, rk): The key generation algorithm takes an integer p and q0 as input security parameters λ, and lets q l =p l ·q0 (0<l≤L). Choose a power of 2, M=M(λ,q L (M is a relation to λ, q) L (related values), an integer h = h(λ, q) L An integer P = P(λ, q) L ), and a real value σ = σ(λ, q L Randomly select s∈HWT(h), and e∈DG(σ 2 Then set the private key sk = (1, s), and then calculate the public key. Where b = -as + e (mod q) L Random selection and e′∈DG(σ 2 ), calculate the auxiliary calculation key Where b′=-a′s+e′+Ps 2 (mod P·q L For Φ M M-type κ, Galois group From mapping κ κ :

[0008]

[0009] Composition, and with Isomorphism. κ κ (c) indicates that κ is performed on each component of the ciphertext vector. κ The mapping, and using key-switching technology, allows the original private key sk to be used to decrypt the ciphertext κ. κ (c) Obtain κ κ (m). Therefore, when k = 5 i When mod 2N, a key rk = (-as + e + P·s(x) is generated by left rotation i times. k ), a)(mod P·q L Finally, a key set (pk, sk, evk, rk) is output.

[0010] (2) Ecd(z, Δ) → m: The encoding algorithm takes an N / 2-dimensional complex vector as input. And the scaling factor Δ, calculate the vector Output polynomial

[0011] (3)Dcd(m,Δ)→z: The decoding algorithm takes a polynomial as input. And the scaling factor Δ, calculate and output the vector Right now

[0012] (4) Enc(pk, m) → c: The encryption algorithm takes plaintext polynomial m(X) and public key pk as input, and randomly selects v∈ZO(0.5) and e0, e1∈DG(σ). 2 The output ciphertext is c = v·pk + (m + e0, e1) (mod q). L ).

[0013] (5) Dec(sk, c) → m: The decryption algorithm takes a ciphertext c and a private key sk as input and outputs the plaintext polynomial m = b + a·s (mod q). l ).

[0014] (6) Add(c1, c2) → c add Ciphertext addition algorithm: Input two ciphertexts Output c add =c1+c2(modq) l ).

[0015] (7) Mult(c1, c2, evk) → c mult The ciphertext multiplication algorithm takes as input the auxiliary computation key evk and two ciphertexts. Calculate (d0, d1, d2) = (b1b2, a1b2 + a2b1, a1a2) (mod q) l Finally, the ciphertext is output.

[0016] (8) RS(c)→c′: The rescaling algorithm takes a ciphertext as input. At level l and a lower level l′ < l, output the ciphertext. This operation solves the scaling and error problems caused by multiplicative homomorphism in the CKKS encryption scheme.

[0017] (9)Rot(c, rk, i) → c′: Rotation algorithm input ciphertext c and rotation key rk i The output is the ciphertext c′ after rotating (i.e. shifting left) the plaintext vector c by i positions.

[0018] Because CKKS can perform addition, multiplication, and rotation operations on ciphertext. Assume an n-dimensional vector ciphertext. Represented as The inner product operation under ciphertext can be performed by the following steps:

[0019] 1) Use the Mult(c1, c2, evk) function to cipher two n-dimensional vectors. Multiply to get Then the result is rescaled using the RS(c) function;

[0020] 2) Rotate the ciphertext using the Rot(c, rk, 1) function. get

[0021] 3) Use the Add(c1, c2) function to add the ciphertext. and Adding them together gives

[0022] 4) Repeat the rotation and addition n-1 times using the Rot(c, rk, 1) and Add(c1, c2) functions to obtain the ciphertext. Where z1=x1 2 +x2 2 +…x n 2 ;

[0023] 5) Finally, use the Mult(c1, c2, evk) function to encrypt the text. and Multiplying gives the inner product. Right now Where ⊙ represents the inner product, and finally RS(c) is used to encrypt the ciphertext. Perform rescaling.

[0024] Therefore, this paper defines a ciphertext inner product algorithm, Dot(c1, c2, evk, rk, 1): ciphertext inner product. Inputs include the auxiliary computation key evk and two ciphertexts. Rotate the key rk and output the ciphertext c′ after calculating the inner product.

[0025] Algorand consensus mechanism: Algorand is a consensus mechanism based on Proof of Stake (PoS) and Block-Based Fourier Transform (BFT). It uses committee-based PoS to generate blocks and then reaches consensus through BFT. Algorand consensus requires the following steps:

[0026] (1) Nodes in the blockchain voluntarily participate in consensus and become consensus nodes after their applications are approved;

[0027] (2) Using Verifiable Random Functions (VRF) combined with the number of tokens, aggregators and committee members are randomly determined. The number of tokens of a consensus node determines the probability of being selected as an aggregator. The selected aggregators and committee members form a consensus committee.

[0028] (3) The aggregator packages all transactions within a unit of time into a new block;

[0029] (4) Committee members vote on the blocks generated by the aggregator. When more than 2 / 3 of the members agree on the block, the block is adopted by the main chain; otherwise, the next committee member in the block proposal order becomes the aggregator, and the block generation and voting process is repeated.

[0030] (5) After the committee reaches a consensus, all members execute the broadcast protocol to broadcast the new block to neighboring nodes, thereby achieving blockchain consensus.

[0031] Compared to PoW, Algorand saves computing and power resources and improves consensus efficiency; compared to DPoS, Algorand improves decentralization and the security of the blockchain system; compared to PBFT, Algorand improves consensus efficiency and decentralization. Therefore, this paper chooses Algorand as the consensus mechanism for blockchain.

[0032] In federated learning, malicious actors often upload massive malicious gradient vectors, amplifying their impact on the global model. Normalizing local gradients reduces the influence of malicious gradients by setting the magnitude of all local gradient vectors to 1. The formula for normalizing local gradients is:

[0033]

[0034] Where || is the magnitude of the vector, It is the normalized gradient vector, i.e., the unit gradient vector.

[0035] Cosine similarity measures the similarity between two vectors by calculating the cosine of the angle between them. When two vectors are in the same direction, the cosine similarity is 1; when they are in opposite directions, the cosine similarity is -1. A higher value indicates that the two vectors are closer in direction. The general formula is as follows:

[0036]

[0037] Where A and B are vectors, and ⊙ represents the inner product. In federated learning model training, a root dataset is provided by a specific entity. Training this root dataset yields the baseline gradient, which determines the update direction of the global model. The closer the direction of a participant's uploaded local gradient is to the baseline gradient, the higher the weight of that local gradient during aggregation. Malicious clients upload malicious gradients in the opposite direction to the baseline gradient, and the cosine similarity between the malicious gradient and the baseline gradient is less than 0. The cosine similarity method is used to measure the similarity between the two gradient vectors to identify malicious participants.

[0038] The cosine similarity value is calculated in the ciphertext state, and it is not possible to directly compare the cosine similarity value with 0. Cheon proposed a CKKS homomorphic ciphertext numerical comparison function Max(a, b, d), where d = 2α - 3 and α is the number of binary bits of the ciphertext. Max(a, b, d) takes two CKKS ciphertexts a and b with plaintext in the range [0, 1] as input, and returns the ciphertext with the largest plaintext value through an approximate iterative method.

[0039] In the first iteration of federated learning, participants obtain an initial model and train it using a local dataset. In this paper, the model refers to a neural network model denoted as f(x, W), where x is the input and W is the model parameters. This model is used for classification tasks and uses a loss function to measure the error between the predicted class and the true class. Then, the model parameters W are updated by backpropagating the error until the model accuracy is greater than a predetermined value, and finally a suitable model parameter W is obtained.

[0040] In federated learning, aggregation servers are vulnerable to malicious aggregation. The commonly used aggregation method in federated learning, the FedAvg algorithm, which weights the number of training samples, lacks the ability to resist malicious attacks. To construct trusted aggregation nodes in untrusted distributed IIoT environments, some research methods apply blockchain to federated learning to verify aggregation results. Blockchain integrates technologies such as distributed storage, peer-to-peer networks, cryptographic algorithms, and consensus mechanisms. It stores time-series transaction data in a distributed database in the form of a one-way blockchain table, possessing characteristics such as decentralization, transparency, immutability, and traceability. This enables the establishment of trust between nodes in untrusted environments, thus combining blockchain technology with federated learning.

[0041] Because PPFL uses cryptographic techniques to protect user privacy, all participants upload local gradient ciphertext, making malicious gradients difficult to detect. Malicious participants can launch poison attacks, bypassing existing defense mechanisms, modifying dataset labels during model training, and uploading malicious gradients obtained during training, or uploading carefully modified malicious gradients. Malicious participants submit poisoned local models, causing predictions to deviate from the correct trend, reducing the accuracy of federated learning, and ultimately resulting in a globally inaccurate model. This renders the model training of honest participants useless, reducing the performance of federated learning.

[0042] How to solve the above-mentioned technical problems is the challenge facing this invention. Summary of the Invention

[0043] The purpose of this invention is to provide a privacy-preserving federated learning method based on blockchain anti-poisoning attacks. It uses the fully homomorphic encryption algorithm CKKS to protect the privacy of the participants' model gradients, uses the cosine similarity method to identify malicious gradients in the gradient ciphertext, uses the homomorphic ciphertext comparison algorithm to remove malicious gradients, uses the distributed ledger of the blockchain to record the federated learning process, and uses a consensus mechanism to calculate and verify the aggregation results.

[0044] The inventive concept of this invention is as follows: First, the system administrator (SM) constructs a blockchain system, and the model owner (MO) and participants register on the blockchain. The MO publishes a federated learning task, and participants voluntarily participate in this task. The SM uses the key generation algorithm of the fully homomorphic encryption algorithm CKKS to generate a public-private key set for the task, and the MO also generates a public-private key set and sends the security parameters to all participants through a secret channel. Participants train the model to obtain local gradients, normalize and encrypt the local gradients, and upload the encrypted model gradients to the blockchain. The MO and SM cooperate to eliminate malicious gradients, using cosine similarity to identify malicious gradients and using homomorphic encrypted text comparison to eliminate malicious gradients. The consensus mechanism selects a blockchain node as an aggregator to weighted aggregate the encrypted gradients received from honest participants in each round. The SM calculates the aggregated gradient and re-encrypts the aggregated gradient. Participants and the MO download the aggregated gradient from the blockchain and update the model. The blockchain records the federated learning process and uses DFS to store relevant data files.

[0045] The specific process is as follows: System administrator SM constructs a blockchain. Participants and model owners register on this blockchain, receiving an account, a pair of public and private keys, a wallet address, an identity number, and a deposit upon registration. Participants and model owners generate a transaction using their wallet address, and the deposit is stored on the blockchain as a security deposit. Model owner MO publishes a federated learning task by issuing an asset transaction declaration. Participants participate in the task by publishing their own asset transaction declarations. SM and MO generate their own public and private key sets for the task using the fully homomorphic encryption CKKS key generation algorithm based on the participants' transactions. MO sends security parameters to all participants via a secret channel. Participants train on their local dataset to obtain local gradients, normalize and encrypt the local gradients, upload the normalized local gradient ciphertext to DFS, generate a hash address, package the hash address into a transaction, and upload it to the blockchain. MO and SM... After eliminating malicious participants, the MO calculates the cosine similarity between the baseline gradient ciphertext and the honest, normalized local gradient ciphertext. A negative cosine similarity indicates a malicious gradient uploaded by a malicious participant. The SM uses a homomorphic ciphertext comparison algorithm to eliminate malicious gradients. The blockchain uses the Algorand consensus mechanism to select a group of nodes to form a committee, and selects a committee member as the aggregator. The aggregator weights and aggregates the gradient ciphertexts of all honest, normalized participants, generating a transaction containing the hash address of the aggregated ciphertext. All transactions within a unit of time are packaged into a new block, which is then verified by the committee members. When more than 2 / 3 of the members agree on the block, it is uploaded to the blockchain, the aggregator receives a reward, and all committee members broadcast the block to the blockchain. Otherwise, the aggregator's deposit is forfeited, the reward is given to the committee members, and a new aggregator is selected. The SM retrieves the aggregated ciphertext from the blockchain using the CKKS private key sk. s Decryption yields the plaintext aggregation result and the sum of weights. The aggregation gradient is then calculated using the CKKS public key pk. x The encrypted aggregated gradient is uploaded to the blockchain; the MO and participants download the encrypted aggregated gradient from the blockchain and use the CKKS private key sk x The aggregated gradient is decrypted and used to update the local model. After updating the model, MO will test the accuracy of the model's predictions. If the expected accuracy is achieved, the task ends; otherwise, the next round of model training continues.

[0046] To achieve the aforementioned objectives, the present invention employs the following technical solution: a privacy-preserving federated learning method based on blockchain-based anti-poisoning attacks, primarily comprising five entities: system administrator (SM), model owner (MO), blockchain, participants, and distributed file system (DFS), including the following steps:

[0047] S10. System global initialization: The system administrator SM is responsible for building a blockchain system. Participants and model owners (MOs) register on this blockchain, obtain an account, and generate their own public-private key pair. MOs publish a federated learning task, and participants voluntarily join this task. SM uses the CKKS fully homomorphic encryption algorithm's key generation algorithm to generate a public-private key set (pk) for this task. s ,sk s evk s rk s ), through a secret channel (pk s evk s rk s The public key is sent to the MO. The MO uses the CKKS key generation algorithm to generate a public-private key set (pk) for this federated learning task. x ,sk x evk x rk x ), and transmit the security parameter SP = {(pk) through a secret channel x ,sk x evk x rk x ), (pk s evk s rk s ), Δ} are sent to all participants, where Δ is the scaling factor in the CKKS encoding;

[0048] S20, Local Model Training: Participants obtain secure parameters SP through a secret channel with MO, train the model to obtain local gradients, normalize and encrypt these local gradients, store the local gradient ciphertext in the Distributed File System (DFS), and finally package the address of the ciphertext in DFS into a transaction and upload it to the blockchain.

[0049] S30. Malicious Participant Identification: The MO and SM collaborate to determine whether a participant has performed a normalization operation, generating a correctly normalized participant list L. The MO first trains a global model to obtain a baseline gradient, normalizes and encrypts the baseline gradient to obtain ciphertext. Then, it calculates the cosine similarity ciphertext between the baseline gradient ciphertext and the local gradient ciphertext of each participant in L, using a homomorphic ciphertext comparison algorithm. When the cosine similarity value is less than or equal to 0, the weight of this participant's gradient is set to 0; otherwise, the weight of this participant's gradient is set to the cosine similarity value. This process is performed in ciphertext. Finally, the gradient weight ciphertext is stored in the DFS, a transaction is generated, and it is uploaded to the blockchain.

[0050] S40, Gradient Ciphertext Aggregation: The blockchain uses the Algorand consensus mechanism to select an aggregator. This aggregator calculates the aggregated ciphertext for this round using the weights of the participants' gradients and stores it in the Distributed File System (DFS). The aggregation process generates a transaction, which is then packaged into a new block. The SM retrieves the aggregated ciphertext from the blockchain using its private key sk. s The plaintext of the aggregation result is decrypted, along with the sum of the weights of the participants in L. The aggregation gradient is calculated using the sum of the weights, and then calculated using MO and the public key pk shared by the participants. x Encrypt the aggregate gradient, store the ciphertext of the aggregate gradient in DFS, generate a transaction, and upload it to the blockchain;

[0051] S50, participants, and MO update the model. Participants and MO obtain the DFS address of the aggregated gradient ciphertext from the blockchain, download the aggregated gradient ciphertext from the DFS using this address, and use the private key sk shared by MO and participants. x The aggregated gradient is decrypted and used to update the local model. If the accuracy of the MO test model reaches a predetermined value, the federated learning task ends; otherwise, the participants proceed to the next round of training, repeating steps S20, S30, S40, and S50.

[0052] Further, step S10 includes the following steps:

[0053] S101, System Administrator SM constructs a blockchain. Traditional federated learning still faces many threats and challenges, such as inadequate privacy and security protection. To improve security, a blockchain network can be used instead of a central server. The immutable blockchain ledger enhances security; the immutability and traceability of information on the blockchain can, to some extent, prevent malicious data from damaging the system. Using a blockchain can reduce the risk of single points of failure, and the source of modifications or updates to model parameters during training can be traced through the blockchain. In blockchain-based federated learning, each device can act as a client to update its local model.

[0054] SM adopts the Algorand consensus protocol. Participants and model owners (MOs) register on this blockchain and each has an account, generating their own public-private key pair. (This public-private key pair can create a secret channel between the sender and receiver), a wallet address wa, a unique identity ID and deposit, the wallet address can be used to generate a transaction, all participants, MO and consensus nodes need to lock a portion of their deposits on the blockchain as collateral and create a block that records their deposit ownership declaration transactions;

[0055] S102 and MO publish federated learning tasks using an asset declaration transaction method. This task includes: an initial model W0, a model ID mid, and a learning rate η. The model owner is MO. j Publish an asset declaration transaction: Where H(W) j，0 ) is the initial model hash address stored in DFS. It's MO j private key, It is used to prove MO j It does indeed possess a digital signature for the model; "Keywords" represents the model description for this FL task. For ease of notation and description, {mid} has been removed. j W j，0 η j MO j The subscript j of} will be used to describe only one representative MO.

[0056] S103, SM based on MO's transaction TX MO The initial model W0 is obtained. SM uses the fully homomorphic encryption CKKS key generation algorithm to generate a set of CKKS public and private keys (pk) for this FL task. s ,sk s evk s rk s ), where pk s sk is the public key used to encrypt plaintext polynomials. s The private key is secretly stored by SM and used to decrypt the ciphertext of the aggregation results in each round; evk s To assist in calculating the key, used in CKKS homomorphic multiplication to obtain the ciphertext product; rk s This is the rotation key, used to left-shift the ciphertext vector. Then, SM transmits the security parameter (pk) through a secret channel. s evk s rk s Send to MO;

[0057] S104. Participants voluntarily join the FL task by publishing data asset declaration transactions. Assume a participant P... i (i = 1, 2, ...) Publish a data asset declaration transaction and join the MO's FL task: Where sid is P i Dataset D i serial number, It is P i The private key, H(D) i ) is dataset D i hash value, It is used to prove P i Indeed possesses D i Digital signature, H(TX) MO ) represents P i The FL task added to MO is a transaction TX. MO The hash value. MO uses the fully homomorphic encryption CKKS key generation algorithm to generate a set of CKKS public and private keys (pk x ,sk x evk x rk x According to the participants' transactions (TX) Di The security parameter SP = {(pk) is transmitted via a secret channel. x ,sk x evk x rk x ), (pk s evk s rk s ), Δ} is sent to all participants, where Δ is the scaling factor in the CKKS encoding.

[0058] Further, step S20 includes the following steps:

[0059] S201, P i Trading TX through MO MO Obtain the learning rate η and the address of the initial model W0, and download the initial model W0 from DFS based on the address. Then P i Use private key Decrypting the security parameter SP sent by MO through the secret channel yields the CKKS related information required for encryption and decryption: (pk x ,sk x evk x rk x (pk) s evk s rk s ) and scaling factor Δ;

[0060] S202, P i Using local dataset D i To train the model, let f(x, W) be a neural network model, where x is the input and W are the model parameters. Use the cross-entropy function as the loss function.

[0061]

[0062] in <x k y k >∈D i x k It is the input, y kHere, n is the label, and n is the dataset D. i For multi-class classification problems, the cross-entropy function combined with the softmax function is used, and the output probability of each class is obtained through the softmax function.

[0063] In the rth round, P i Using the model parameters W from the previous round r-1 The gradient g is obtained by training the model. i，r The goal of training a neural network model is to find the one that makes L... f The optimal solution for the model parameters with the smallest (·) can be obtained using gradient descent. The gradient is calculated at each iteration, and the model parameters are updated by backpropagating the error. Therefore, P i Calculate the gradient of the loss function in the r-th round:

[0064]

[0065] in The loss function L f The gradient of (·), D i * It is dataset D i A subset of;

[0066] S203. To significantly impact the model, malicious clients typically upload large local gradients. Normalizing these malicious gradients can reduce their influence. Treating the gradient as a direction vector, normalization ensures the magnitude of the local gradient is 1, transforming it into a unit vector. Since unit vectors have the same magnitude, normalization converts the cosine similarity of the gradient vectors into the inner product calculation cos = A ⊙ B.

[0067] Normalized local gradient is based on cosine similarity, and its calculation formula is as follows:

[0068]

[0069] Where A and B are vectors, ⊙ represents the inner product, and the range of cosine is [-1, 1]. This invention treats the gradient as a direction vector. To calculate the cosine similarity between gradients in the encrypted state, the gradient needs to be normalized before encryption. P i Normalize the local gradient using formula (8):

[0070]

[0071] Where || is the magnitude of the vector, It is the normalized gradient vector, i.e., the unit gradient vector;

[0072] S204. The gradient serves as a mapping to the client's local dataset. The gradient in its plaintext state has been proven to derive from the client's original data. To protect the privacy of participants' local gradients, participant P... i This invention achieves malicious data detection in its encrypted state by encrypting local gradients using privacy-preserving techniques before uploading them to the blockchain. Homomorphic encryption allows computation in its encrypted state, but the increased data size leads to significant computational and data transmission costs. Traditional privacy-preserving federated learning typically uses Paillier, but it can only encrypt integers. Gradients are floating-point numbers, requiring quantization before encryption, further increasing computational and communication overhead. This invention employs the CKKS homomorphic encryption method. CKKS performs approximate computation on plaintext floating-point numbers. Homomorphic multiplication in the ciphertext increases the data size. The CKKS method uses a homomorphic multiplication key to scale the multiplication ciphertext, keeping the data size within a smaller range. CKKS can encrypt floating-point numbers and directly encrypt vectors, reducing computational overhead.

[0073] To protect the privacy of local gradients, P i The gradient of each layer of the neural network is treated as a vector, and encryption is performed layer by layer to obtain the ciphertext of the gradient at each layer. For ease of description, this invention only describes the ciphertext of the gradient vector at one layer in detail. i First, call the CKKS encoding function. Obtain the polynomial g(X), and then use SM's own public key pk. s Calling the CKKS encryption function Enc(pk s g(X)) yields the local gradient ciphertext The above process can be described by formula (9):

[0074]

[0075] in This indicates that the vector x is encoded and encrypted using the public key pk, resulting in ciphertext.

[0076] S205, P i Local gradient ciphertext Stored in DFS, its hash address Packaged into the transaction: TX i，r Uploaded to the blockchain.

[0077] Further, step S30 includes the following steps:

[0078] S301, MO according to transaction TX i.r Obtain the hash address of the local gradient ciphertext Retrieve the participant's gradient ciphertext from the DFS based on the address.

[0079] S302, MO calls CKKS's inner product function. Get each P i The magnitude of the gradient vector Calculation results Stored in DFS, The generated hash address Packaged into the transaction: Upload the transaction to the blockchain;

[0080] S303 and SM obtain P from the blockchain. i The magnitude of the gradient vector Use your own private key sk s Decryption yields m i，r If m i，r =1, put P i Add to participant list L. MO stores the honest, normalized participant list L in DFS and generates a transaction containing the hash address H(L) of participant list L: Uploaded to the blockchain;

[0081] S304, MO uses the root dataset D0 to train the neural network model f(x, W) r-1 ), thus obtaining the baseline gradient g 0，r The local gradient obtained by normalizing MO is... First, call the CKKS encoding function. Obtain the polynomial g(X), and then use SM's own public key pk. s Calling the CKKS encryption function Enc(pk s g(X)) yields the local gradient ciphertext The above process can be described by formula (10):

[0082]

[0083] MO uses SM's CKKS auxiliary calculation key evk s and rotation key rk s Call the inner product function of CKKS The gradient vector ciphertext for each participant in list L is calculated. Ciphertext with MO gradient vector Cosine similarity ciphertext between

[0084]

[0085] S305, For each P j (P j ∈L), calculate P j The cosine similarity between the gradient vector of and the gradient vector of MO is cos j，r When cos j，r When ≤0, let P j gradient weights Otherwise

[0086] For each P j (P j ∈L), MO calls CKKS's The function will and The sum of the two is denoted as res. j，r ,res j，r The value range is [0, 2], then CKKS is called. The function will convert res j，r and The result of multiplication is denoted as re. j，r Then call the CKKS rescaling function RS(re j，r ), to obtain the converted ciphertext rt j，r ,rt j，r The range of values ​​is [0, 1]. At that time, the converted ciphertext Finally, MO calls the CKKS homomorphic ciphertext numerical comparison function. Where d = 2α - 3, and α is the ciphertext rt j，r The number of binary bits, The function returns the ciphertext rt. j，r and For the ciphertext with the largest corresponding plaintext value, the above process can be described by formula (12):

[0087]

[0088]

[0089] S306, MO calls CKKS The function will and The result of the multiplication is denoted as ret. j，r Then call The function will return ret j，r and The result of the addition is denoted as The above process can be described by formula (13):

[0090]

[0091] in Participant P i The weighted ciphertext. MO uses formula (8) to... Convert back to the original value before the range conversion.

[0092] MO calls |L|-1 times CKKS's Add(S) function. j，r S j+1，r ) function, P j For each |L| ∈ L, j = 1, 2, ..., |L|-1, the sum of the weights of the |L| participants is obtained.

[0093]

[0094] Where |L| represents the number of participants in the participant list L;

[0095] S307, MO will Stored in DFS, hash address and Packaged into the transaction: H(TX MO ), "Keywords"}, will be used to trade TX weight Uploaded to the blockchain.

[0096] Further, step S40 includes the following steps:

[0097] S401, The Algorand consensus protocol of the blockchain uses a verifiable random function to randomly select a portion of all consensus nodes to form a committee, and selects a member from the committee to become an aggregator;

[0098] S402, The aggregator first queries the blockchain for transaction TX. L Obtain the hash address H(L) of the honest and normalized participant list L, and retrieve L from DFS based on the address; query transaction {TX} j，r |j∈L} obtains the gradient ciphertext hash address Retrieved from DFS based on the address Query TX transactions weight Obtain the hash address of the weighted ciphertext Retrieve the weight ciphertext from DFS based on the address. Then the aggregator uses SM's CKKS auxiliary calculation key evks For each P j (P j ∈L), calling CKKS The function will and The result of multiplication is denoted as agg. j，r For each P j (P j ∈L), the aggregator then calls the CKKS rescaling function RS(agg) j，r To prevent the size and error of the ciphertext from increasing, the converted ciphertext ag is obtained. j，r Finally, the aggregator calls CKKS's Add(ag) method |L|-1 times. j，r ag j+1，r ) function, P j For each |L| ∈ L, j = 1, 2, ..., |L|-1, we obtain the aggregated ciphertext of |L| participants. The process of gradient ciphertext aggregation performed by the aggregator above is described by formula (15):

[0099]

[0100] S403. After the aggregator completes the calculation, it sends the aggregated ciphertext. Store in DFS and generate a transaction Package all transactions in this round into a new block. r ={TX Agg TX r，j |j∈L}. Next, the committee members verified this new block. r And vote on it; if you agree on the block... r Then generate a transaction: If more than two-thirds of the committee members agree to this block r If the block is accepted, the aggregator receives a reward, and all committee members broadcast the block; otherwise, the aggregator's deposit is forfeited and the reward is given to the other committee members. Then, the next committee member in the block proposal order becomes the aggregator, and aggregation steps S402 and S403 are re-executed until the committee approves the block. r An agreement was reached;

[0101] S404. After reaching a blockchain consensus, SM first queries the blockchain for transaction TX. Agg Obtain the aggregated ciphertext From TX weight Obtain the ciphertext of the sum of weights Then, SM uses its own private key sk s Call the CKKS decryption function The plaintext polynomials t(X) and sum(X) are obtained respectively, and then the CKKS decoding functions Dcd(t(X), Δ) and Dcd(sum(X), Δ) are called to obtain the aggregation result g respectively. r sum of weights r The above process can be described by formula (16):

[0102]

[0103]

[0104] Finally, SM calculates the aggregated gradient:

[0105]

[0106] SM calls CKKS encoding functions We obtain the polynomial m(X), and then use the public key pk shared by all participants and MO. x Calling the CKKS encryption function Enc(pk x m(X)) yields the aggregated gradient ciphertext The above process can be described by formula (18):

[0107]

[0108] Will Stored in DFS, hash address Packaged into the transaction: TX Result Uploaded to the blockchain.

[0109] Further, step S50 includes the following steps:

[0110] S501, MO and P i Querying transactions TX from the blockchain Result And download the aggregated gradient ciphertext from DFS based on the hash address. Then use MO's private key sk x Call the CKKS decryption function Given the plaintext polynomial p(X), call the CKKS decoding function Dcd(p(X), Δ) to obtain the global aggregated gradient. The above process can be described by formula (19):

[0111]

[0112] S502, MO, and participants used aggregated gradients Update the local model:

[0113]

[0114] After S503 and MO update the model, test the accuracy. If the expected model accuracy is achieved, generate a transaction and upload it to the blockchain. This indicates that the FL task has ended. Otherwise, P i Entering stage S201, local model training is carried out in round r+1.

[0115] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0116] This invention utilizes the fully homomorphic encryption algorithm CKKS to protect the privacy of participants' model gradients, uses the cosine similarity method to identify malicious gradients in the gradient ciphertext, uses the homomorphic ciphertext comparison algorithm to remove malicious gradients, and uses the consensus mechanism of blockchain to calculate and verify the aggregation result.

[0117] (1) This invention uses blockchain to record the federated learning task process, uses the homomorphic encryption algorithm CKKS method to implement the inner product operation in the gradient ciphertext state, and uses the cosine similarity method to identify malicious participants, thereby protecting the model training results of honest participants and improving the accuracy of model training in the federated learning process.

[0118] (2) This invention provides a privacy-preserving federated learning method based on blockchain anti-poisoning attack, which uses the CKKS encryption method to encrypt gradients. Traditional privacy-preserving federated learning methods usually use Pailler as a means of privacy protection, but it can only quantize integers. It is necessary to quantize the gradients first and then encrypt them one by one, which increases the computation and communication overhead. CKKS allows encryption of floating-point numbers and vectors, which improves computation efficiency.

[0119] (3) This invention provides a privacy-preserving federated learning method based on blockchain anti-poisoning attack. The blockchain technology records the federated learning process and uses the blockchain's Algorand consensus mechanism to ensure the correctness of the aggregation result. Compared with the method of gradient aggregation by entities, it reduces the number of communications between entities and solves the problems of malicious server behavior and single point of failure. The blockchain-based federated learning reduces the communication overhead of secure multi-party computation.

[0120] (4) This invention provides a privacy-preserving federated learning method based on blockchain anti-poisoning attack. Experimental verification shows that compared with existing malicious actor detection methods, it reduces computational and communication overhead and is more suitable for some lightweight IoT devices. Attached Figure Description

[0121] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0122] Figure 1 This is a flowchart of the blockchain-based anti-poisoning attack privacy-preserving federated learning method of Embodiment 1 of the present invention.

[0123] Figure 2 This is a system model diagram of the privacy-preserving federated learning method based on blockchain anti-poisoning attack in Embodiment 1 of the present invention.

[0124] Figure 3 This is the initial round sequence diagram of the privacy-preserving federated learning method based on blockchain anti-poisoning attack in Embodiment 1 of the present invention. Detailed Implementation

[0125] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Of course, the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0126] Example 1

[0127] See Figures 1 to 3 The present invention provides a technical solution: a privacy-preserving federated learning method based on blockchain anti-poisoning attacks, such as... Figure 1 As shown, it mainly includes five entities: System Administrator (SM), Model Owner (MO), Blockchain, Participants, and Distributed File System (DFS), and includes the following steps:

[0128] S10. System global initialization: The system administrator SM is responsible for building a blockchain system. Participants and model owners (MOs) register on this blockchain, obtain an account, and generate their own public-private key pair. MOs publish a federated learning task, and participants voluntarily join this task. SM uses the CKKS fully homomorphic encryption algorithm's key generation algorithm to generate a public-private key set (pk) for this task. s ,sk s evk s rk s ), through a secret channel (pk s evk s rk s The public key is sent to the MO. The MO uses the CKKS key generation algorithm to generate a public-private key set (pk) for this federated learning task. x ,sk x evk x rk x), and transmit the security parameter SP = {(pk) through a secret channel x ,sk x evk x rk x ), (pk s evk s rk s ), Δ} are sent to all participants, where Δ is the scaling factor in the CKKS encoding;

[0129] S20, Local Model Training: Participants obtain secure parameters SP through a secret channel with MO, train the model to obtain local gradients, normalize and encrypt these local gradients, store the local gradient ciphertext in the Distributed File System (DFS), and finally package the address of the ciphertext in DFS into a transaction and upload it to the blockchain.

[0130] S30. Malicious Participant Identification: The MO and SM collaborate to determine whether a participant has performed a normalization operation, generating a correctly normalized participant list L. The MO first trains a global model to obtain a baseline gradient, normalizes and encrypts the baseline gradient to obtain ciphertext. Then, it calculates the cosine similarity ciphertext between the baseline gradient ciphertext and the local gradient ciphertext of each participant in L, using a homomorphic ciphertext comparison algorithm. When the cosine similarity value is less than or equal to 0, the weight of this participant's gradient is set to 0; otherwise, the weight of this participant's gradient is set to the cosine similarity value. This process is performed in ciphertext. Finally, the gradient weight ciphertext is stored in the DFS, a transaction is generated, and it is uploaded to the blockchain.

[0131] S40, Gradient Ciphertext Aggregation: The blockchain uses the Algorand consensus mechanism to select an aggregator. This aggregator calculates the aggregated ciphertext for this round using the weights of the participants' gradients and stores it in the Distributed File System (DFS). The aggregation process generates a transaction, which is then packaged into a new block. The SM retrieves the aggregated ciphertext from the blockchain using its private key sk. s The plaintext of the aggregation result is decrypted, along with the sum of the weights of the participants in L. The aggregation gradient is calculated using the sum of the weights, and then calculated using MO and the public key pk shared by the participants. x Encrypt the aggregate gradient, store the ciphertext of the aggregate gradient in DFS, generate a transaction, and upload it to the blockchain;

[0132] S50, participants, and MO update the model. Participants and MO obtain the DFS address of the aggregated gradient ciphertext from the blockchain, download the aggregated gradient ciphertext from the DFS using this address, and use the private key sk shared by MO and participants. xThe aggregated gradient is decrypted and used to update the local model. If the accuracy of the MO test model reaches a predetermined value, the federated learning task ends; otherwise, the participants proceed to the next round of training, repeating steps S20, S30, S40, and S50.

[0133] The Distributed File System (DFS) primarily stores encrypted data, and the addresses of these encrypted data are stored on the blockchain. Entities within the system can download the corresponding encrypted data based on these addresses, thereby reducing the storage overhead of the blockchain.

[0134] like Figure 2 As shown, a privacy-preserving federated learning method based on blockchain-based anti-poisoning attacks includes five entities: System Administrator (SM), Model Owner (MO), Blockchain, Participants, and Distributed File System (DFS). The System Administrator (SM) is a trusted entity responsible for building the blockchain and generating a public-private key set for the federated learning task. The Model Owner (MO) is an entity willing to improve products or services by using higher-performance models and pays rewards for the models. The MO is responsible for issuing a federated learning task, collecting a root dataset, generating a public-private key set for the task, and sending security parameters to all participants via a secret channel. Participants are responsible for training local datasets to obtain local gradients, normalizing and encrypting the local gradients, storing the encrypted local gradients in the DFS to generate hash addresses, and packaging the hash addresses into transactions and uploading them to the blockchain. The MO and SM collaborate to identify malicious participants. The DFS is a distributed file system; after storing data files in the DFS, a unique hash address is generated for the file content, and the hash address is packaged into a transaction. The main interaction order among the five entities in the initial round is as follows: Figure 3 As shown.

[0135] Step S10 includes the following steps:

[0136] S101. System administrator SM constructs a blockchain. SM determines that the Algorand consensus protocol will be used. Participants and model owners MO register on this blockchain and each has an account, generating their own public-private key pair. (This public-private key pair can create a secret channel between the sender and receiver), a wallet address wa, a unique identity ID and deposit, the wallet address can be used to generate a transaction, all participants, MO and consensus nodes need to lock a portion of their deposits on the blockchain as collateral and create a block that records their deposit ownership declaration transactions;

[0137] S102 and MO publish federated learning tasks using an asset declaration transaction method. This task includes: an initial model W0, a model ID mid, and a learning rate η. The model owner is MO. jPublish an asset declaration transaction: Where H(W) j，0 ) is the initial model hash address stored in DFS. It's MO j private key, It is used to prove MO j It does indeed possess a digital signature for the model; "Keywords" represents the model description for this FL task. For ease of notation and description, {mid} has been removed. j W j，0 η j MO j The subscript j of} will be used to describe only one representative MO.

[0138] S103, SM based on MO's transaction TX MO The initial model W0 is obtained. SM uses the fully homomorphic encryption CKKS key generation algorithm to generate a set of CKKS public and private keys (pk) for this FL task. s ,sk s evk s rk s ), where pk s sk is the public key used to encrypt plaintext polynomials. s The private key is secretly stored by SM and used to decrypt the ciphertext of the aggregation results in each round; evk s To assist in calculating the key, used in CKKS homomorphic multiplication to obtain the ciphertext product; rk s This is the rotation key, used to left-shift the ciphertext vector. Then, SM transmits the security parameter (pk) through a secret channel. s evk s rk s Send to MO;

[0139] S104. Participants voluntarily join the FL task by publishing data asset declaration transactions. Assume a participant P... i (i = 1, 2, ...) Publish a data asset declaration transaction and join the MO's FL task: Where sid is P i Dataset D i serial number, It is P i The private key, H(D) i ) is dataset D i hash value, It is used to prove P i Indeed possesses D i Digital signature, H(TX) MO ) represents P iThe FL task added to MO is a transaction TX. MO The hash value. MO uses the fully homomorphic encryption CKKS key generation algorithm to generate a set of CKKS public and private keys (pk x ,sk x evk x rk x According to the participants' transactions (TX) Di The security parameter SP = {(pk) is transmitted via a secret channel. x ,sk x evk x rk x ), (pk s evk s rk s ), Δ} is sent to all participants, where Δ is the scaling factor in the CKKS encoding.

[0140] Step S20 includes:

[0141] S201, P i Trading TX through MO MO Obtain the learning rate η and the address of the initial model W0, and download the initial model W0 from DFS based on the address. Then P i Use private key Decrypting the security parameter SP sent by MO through the secret channel yields the CKKS related information required for encryption and decryption: (pk x ,sk x evk x rk x (pk) s evk s rk s ) and scaling factor Δ;

[0142] S202, P i Using local dataset D i To train the model, let f(x, W) be a neural network model, where x is the input and W are the model parameters. Use the cross-entropy function as the loss function.

[0143]

[0144] in <x k y k >∈D i x k It is the input, y k Here, n is the label, and n is the dataset D. i For multi-class classification problems, the cross-entropy function combined with the softmax function is used, and the output probability of each class is obtained through the softmax function.

[0145] In the rth round, P i Using the model parameters W from the previous round r-1 The gradient g is obtained by training the model. i，r The goal of training a neural network model is to find the one that makes L... f The optimal solution for the model parameters with the smallest (·) can be obtained using gradient descent. The gradient is calculated at each iteration, and the model parameters are updated by backpropagating the error. Therefore, P i Calculate the gradient of the loss function in round T:

[0146]

[0147] in The loss function L f The gradient of (·), D i * It is dataset D i A subset of;

[0148] S203. This paper treats the gradient as a direction vector. In order to calculate the cosine similarity between gradients in the ciphertext state, the gradient needs to be normalized before encryption. P i Normalize the local gradient using formula (3):

[0149]

[0150] Where || is the magnitude of the vector, It is the normalized gradient vector, i.e., the unit gradient vector;

[0151] S204. To protect the privacy of local gradients, P i The gradient of each layer of the neural network is treated as a vector, and encryption is performed layer by layer to obtain the ciphertext of the gradient at each layer. For ease of description, this paper only describes the ciphertext of the gradient vector at one layer in detail. i First, call the CKKS encoding function. The polynomial g(X) is obtained, and then the CKKS encryption function Enc(pk) is called using SM's own public key pks. s g(X)) yields the local gradient ciphertext The above process can be described by formula (4):

[0152]

[0153] in This indicates that the vector x is encoded and encrypted using the public key pk, resulting in ciphertext.

[0154] S205, P i Local gradient ciphertext Stored in DFS, its hash address Packaged into the transaction: TX i，r Uploaded to the blockchain. The pseudocode for participant's local model training and encryption is shown in Table 1.

[0155] Table 1

[0156]

[0157] Step S30 includes:

[0158] S301, MO according to transaction TX i.r Obtain the hash address of the local gradient ciphertext Retrieve the participant's gradient ciphertext from the DFS based on the address.

[0159] S302, MO calls CKKS's inner product function. Get each P i The magnitude of the gradient vector Calculation results Stored in DFS, The generated hash address Packaged into the transaction: Upload the transaction to the blockchain;

[0160] S303 and SM obtain P from the blockchain. i The magnitude of the gradient vector Use your own private key sk s Decryption yields m i，r If m i，r =1, put P i Add to participant list L. MO stores the honest, normalized participant list L in DFS and generates a transaction containing the hash address H(L) of participant list L: Uploaded to the blockchain. The pseudocode for MO and SM normalization judgment is shown in Table 2;

[0161] S304, MO uses the root dataset D0 to train the neural network model f(x, W) r-1 ), thus obtaining the baseline gradient g 0，r The local gradient obtained by normalizing MO is... First, call the CKKS encoding function. Obtain the polynomial g(X), and then use SM's own public key pk. s Calling the CKKS encryption function Enc(pk s g(X)) yields the local gradient ciphertext The above process can be described by formula (5):

[0162]

[0163] Table 2

[0164]

[0165] MO uses SM's CKKS auxiliary calculation key evk s and rotation key rk s Call the inner product function of CKKS The gradient vector ciphertext for each participant in list L is calculated. Ciphertext with MO gradient vector Cosine similarity ciphertext between

[0166]

[0167] S305, For each P j (P j ∈L), calculate P j The cosine similarity between the gradient vector of and the gradient vector of MO is cos j，r When cos j，r When ≤0, let P j gradient weights Otherwise

[0168] For each P j (P j ∈L), MO calls CKKS's The function will and The sum of the two is denoted as res. j，r ,res j，r The value range is [0, 2], then CKKS is called. The function will convert res j，r and The result of multiplication is denoted as re. j，r Then call the CKKS rescaling function RS(re j，r ), to obtain the converted ciphertext rt j，r ,rt j，r The range of values ​​is [0, 1]. At that time, the converted ciphertext Finally, MO calls the CKKS homomorphic ciphertext numerical comparison function. Where d = 2α - 3, and α is the ciphertext rt j，rThe number of binary bits, The function returns the ciphertext rt. j，r and For the ciphertext with the largest corresponding plaintext value, the above process can be described by formula (7):

[0169]

[0170]

[0171] The pseudocode for CKKS's numerical comparison functions is shown in Table 3.

[0172] Table 3

[0173]

[0174] S306, MO calls CKKS The function will and The result of the multiplication is denoted as ret. j，r Then call The function will return ret j，r and The result of the addition is denoted as The above process can be described by formula (8):

[0175]

[0176] in Participant P i The weighted ciphertext. MO uses formula (8) to... Convert back to the original value before the range conversion.

[0177] MO calls |L|-1 times CKKS's Add(S) function. j，r S j+1，r ) function, P j For each |L| ∈ L, j = 1, 2, ..., |L|-1, the sum of the weights of the |L| participants is obtained.

[0178]

[0179] Where |L| represents the number of participants in the participant list L;

[0180] S307, MO will Stored in DFS, hash address and Packaged into the transaction: TX weightUploaded to the blockchain. The pseudocode for calculating MO weights is shown in Table 4.

[0181] Table 4

[0182]

[0183] Step S40 includes:

[0184] S401, The Algorand consensus protocol of the blockchain uses a verifiable random function to randomly select a portion of all consensus nodes to form a committee, and selects a member from the committee to become an aggregator;

[0185] S402, The aggregator first queries the blockchain for transaction TX. L Obtain the hash address H(L) of the honest and normalized participant list L, and retrieve L from DFS based on the address; query transaction {TX} j，r |j∈L} obtains the gradient ciphertext hash address Retrieved from DFS based on the address Query TX transactions weight Obtain the hash address of the weighted ciphertext Retrieve the weight ciphertext from DFS based on the address. Then the aggregator uses SM's CKKS auxiliary calculation key evk s For each P j (P j ∈L), calling CKKS The function will and The result of multiplication is denoted as agg. j，r For each P j (P j ∈L), the aggregator then calls the CKKS rescaling function RS(agg) j，r To prevent the size and error of the ciphertext from increasing, the converted ciphertext ag is obtained. j，r Finally, the aggregator calls CKKS's Add(ag) method |L|-1 times. j，r ag j+1，r ) function, P j For each |L| ∈ L, j = 1, 2, ..., |L|-1, we obtain the aggregated ciphertext of |L| participants. The process of gradient ciphertext aggregation performed by the aggregator above is described by formula (10):

[0186]

[0187] S403. After the aggregator completes the calculation, it sends the aggregated ciphertext. Store in DFS and generate a transaction Package all transactions in this round into a new block. r ={TX Agg TX r，j |j∈L}. Next, the committee members verified this new block. r And vote on it; if you agree on the block... r Then generate a transaction: If more than two-thirds of the committee members agree to this block r If the block is accepted, the aggregator receives a reward, and all committee members broadcast the block; otherwise, the aggregator's deposit is forfeited and the reward is given to the other committee members. Then, the next committee member in the block proposal order becomes the aggregator, and aggregation steps S402 and S403 are re-executed until the committee approves the block. r An agreement was reached;

[0188] S404. After reaching a blockchain consensus, SM first queries the blockchain for transaction TX. Agg Obtain the aggregated ciphertext From TX weight Obtain the ciphertext of the sum of weights Then, SM uses its own private key sk s Call the CKKS decryption function The plaintext polynomials t(X) and sum(X) are obtained respectively, and then the CKKS decoding functions Dcd(t(X), Δ) and Dcd(sum(X), Δ) are called to obtain the aggregation result g respectively. r sum of weights r The above process can be described by formula (11):

[0189]

[0190]

[0191] Finally, SM calculates the aggregated gradient:

[0192]

[0193] SM calls CKKS encoding functions We obtain the polynomial m(X), and then use the public key pk shared by all participants and MO. x Calling the CKKS encryption function Enc(pk x m(X)) yields the aggregated gradient ciphertext The above process can be described by formula (13):

[0194]

[0195] Will Stored in DFS, hash address Packaged into the transaction: TX Result Uploaded to the blockchain. The pseudocode for aggregator gradient ciphertext aggregation is shown in Table 5.

[0196] Table 5

[0197]

[0198]

[0199] Step S50 includes:

[0200] S501, MO and P i Querying transactions TX from the blockchain Result And download the aggregated gradient ciphertext from DFS based on the hash address. Then use MO's private key sk x Call the CKKS decryption function Given the plaintext polynomial p(X), call the CKKS decoding function Dcd(p(X), Δ) to obtain the global aggregated gradient. The above process can be described by formula (14):

[0201]

[0202] S502, MO, and participants used aggregated gradients Update the local model:

[0203]

[0204] After S503 and MO update the model, test the accuracy. If the expected model accuracy is achieved, generate a transaction and upload it to the blockchain. This indicates the end of the FL task. Otherwise, Pi enters stage S201 for r+1 rounds of local model training.

[0205] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A privacy protection federated learning method based on blockchain anti-poisoning attack, characterized in that, The method comprises the following steps: S10, system global initialization, the system administrator SM is responsible for building a blockchain system, participants and model owners MO register to this blockchain, get an account, and generate their own pair of public and private keys, MO publishes a federated learning task, participants voluntarily join the federated learning task, SM uses the key generation algorithm of the fully homomorphic encryption algorithm CKKS to generate a set of public and private key sets (pk s ,sk s ,evk s ,rk s ) for this federated learning task, wherein pk s is the public key used to encrypt the plaintext polynomial; sk s is the private key, which is kept secret by SM and is used to decrypt the ciphertext of each round aggregation result; evk s is an auxiliary calculation key used for homomorphic multiplication calculation of CKKS to obtain ciphertext product; rk s is a rotation key, (pk s , evk s , rk s ) is sent to MO through a secret channel, and MO uses the key generation algorithm of the fully homomorphic encryption CKKS to generate a set of public and private key sets (pk x ,sk x ,evk x ,rk x ) for this federated learning task, and sends the security parameter SP = {(pk x ,sk x ,evk x ,rk x ), (pk s ,evk s ,rk s ), Δ} to all participants through a secret channel, wherein Δ is the scaling factor in the fully homomorphic encryption CKKS encoding; S20, local model training, participants obtain security parameters SP through a secret channel with the MO, train the model to obtain a local gradient, normalize and encrypt the local gradient, store the local gradient ciphertext in a distributed file system DFS, and finally pack the address of the ciphertext in the DFS into a transaction and upload it to the blockchain; S30, malicious participant identification, the MO and the SM cooperate to determine whether the participants have performed the normalization operation, generate a correct normalized participant list L, the MO first trains a global model to obtain a baseline gradient, normalizes and encrypts the baseline gradient to obtain a ciphertext, then calculates the cosine similarity ciphertext between the baseline gradient ciphertext and the local gradient ciphertext of each participant in L, uses a homomorphic ciphertext comparison algorithm; when the cosine similarity value is less than or equal to 0, the weight of this participant gradient is set to 0, otherwise, the weight of this participant gradient is set to the value of the cosine similarity, this process is operated in the ciphertext state, finally the gradient weight ciphertext is stored in the DFS, a transaction is generated and uploaded to the blockchain; S40, gradient ciphertext aggregation, blockchain calls Algorand consensus mechanism to select aggregator, the aggregator uses the weight of the participant gradient to calculate the aggregation ciphertext of this round, stores the aggregation ciphertext in the distributed file system DFS, generates a transaction for the aggregation process, and packs the transaction into a new block. The SM queries the transaction from the blockchain to obtain the aggregation ciphertext, uses its own private key sk s decrypts to obtain the plaintext of the aggregation result and the sum of the weights of the participants in L, calculates the aggregation gradient using the sum of the weights, and uses the public key pk common to the MO and the participants x encrypts the aggregation gradient, stores the aggregation gradient ciphertext in DFS, generates a transaction and uploads it to the blockchain; S50, the participant and the MO update the model, the participant and the MO get the DFS address of the aggregated gradient ciphertext from the blockchain, download the aggregated gradient ciphertext from the DFS according to the address, and use the private key sk shared by the MO and the participant x The aggregated gradient is obtained by decryption, the local model is updated, if the accuracy of the MO testing model reaches a predetermined value, the federated learning task ends, otherwise the participant performs the next round of training, and steps S20, S30, S40 and S50 are repeatedly executed. Wherein, the distributed file system DFS stores data ciphertext, the data ciphertext address is stored in the blockchain, and the entities in the system download the corresponding data ciphertext according to the address, which is used to reduce the storage overhead of the blockchain.

2. The blockchain-based privacy-preserving federated learning method against poisoning attacks according to claim 1, characterized in that, The step S10 comprises the following steps: S101、system administrator SM constructs a blockchain, SM determines to use Algorand consensus protocol, participants and model owners MO register to the blockchain, and each has an account, and generates a pair of public and private keys of oneself The pair of public and private keys creates a secret channel between the sender and the receiver, a wallet address wa, a unique identity id and a deposit, the wallet address is used to generate a transaction, all participants, MO and consensus nodes will lock a part of the deposit on the blockchain as a deposit, and create a block recording the declaration transaction of their deposit ownership; S102, the MO publishes a federated learning task in the form of a publish asset declaration transaction, which contains: an initial model W0, a model number mid, a learning rate η, and a model owner MO j Publish an asset declaration transaction: Where H(W j,0 ) is the initial model hash address stored in DFS, is the private key of MO j , is the digital signature used to prove that MO j does indeed have the model, and "Keywords" represents the model description of the FL task. In order to facilitate notation and description, the subscript j of {mid j , W j,0 , η j , MO j} is removed, and only a representative MO is described subsequently. S103, SM generates a set of CKKS public and private keys (pk MO , sk s , evk s , rk s ) for the FL task using the key generation algorithm of CKKS, where pk s is the public key for encrypting plaintext polynomials, sk s is the private key which is kept secret by SM and used to decrypt the ciphertext of the aggregated result of each round, evk s is the auxiliary computation key for homomorphic multiplication of CKKS, and rk s is the rotation key for left-shifting vector ciphertexts. s SM sends the security parameters (pk s , evk s , rk s ) to MO through a secret channel. S104. Participants voluntarily join the FL task by publishing data asset declaration transactions. Assume a participant P... i For i = 1, 2, ..., publish a data asset declaration transaction and join the MO's FL task: Where sid is P i Dataset D i serial number, It is P i The private key, H(D) i ) is dataset D i hash value, It is used to prove P i Indeed possesses D i Digital signature, H(TX) MO ) represents P i The FL task added to MO is a transaction TX. MO The hash value is used by MO to generate a set of CKKS public and private keys (pk) using the fully homomorphic encryption CKKS key generation algorithm. x ,sk x ,evk x ,rk x According to the participants' transactions (TX) Di The security parameter SP = {(pk) is transmitted via a secret channel. x ,sk x ,evk x ,rk x ),(pk s ,evk s ,rk s ),Δ} is sent to all participants, where Δ is the scaling factor in the CKKS encoding.

3. The privacy-preserving federated learning method against poisoning attacks based on blockchain according to claim 1 or 2, characterized in that, The step S20 comprises the following steps: S201, P i Transaction TX through MO MO Get learning rate η and address of initial model W0, download initial model W0 from DFS according to the address, and then P i Use the private key Decrypt the security parameter SP sent by the MO through the secret channel to obtain the relevant information of the homomorphic encryption CKKS required for encryption and decryption: (pk x ,sk x ,evk x ,rk x ), (pk s ,evk s ,rk s ) and the scaling factor Δ; S202, P i using the local dataset D i Train the model, let f(x, W) be the neural network model, where x is the input and W is the model parameter, and use the cross-entropy function as the loss function: where <x k ,y k >∈D i , x k is the input, y k is the label, n is the size of the dataset D i , for multi-classification problems, the cross-entropy function combined with the softmax function is adopted, and the output probability of each class is obtained through the softmax function; In the rth round, P i Using the model parameters W r-1 The gradient g i,r The goal of training the model is to find the model parameters that minimize L f (·) using the gradient descent method to get the optimal solution, calculate the gradient at each iteration, and then update the model parameters by backpropagating the error, so P i Calculate the gradient of the rth round loss function: wherein is a loss function L f the gradient of (·), D i * is a subset of the dataset D i ; S203. Treating the gradient as a direction vector, in order to calculate the cosine similarity between gradients in the ciphertext state, the gradient needs to be normalized before encryption. P i Normalize the local gradient using formula (3): where || || is the norm of the vector, is the normalized gradient vector, i.e. the unit gradient vector; S204, in order to protect the privacy of the local gradient, P i The gradient of each layer of the neural network is regarded as a vector, and each layer is encrypted layer by layer to obtain the gradient ciphertext of each layer. In order to facilitate the description, only the gradient vector ciphertext of one layer is described in detail, P i First, call the encoding function of the fully homomorphic encryption CKKS Get the polynomial g(X), and then use the public key pk of SM s , call the encryption function Enc(pk s , g(X)) of the fully homomorphic encryption CKKS to obtain the local gradient ciphertext The above process is described by formula (4) as follows: wherein denotes the ciphertext after encoding and encrypting the vector x using the public key pk; S205, P i The local gradient ciphertext is stored in the DFS, whose hash address is packaged into a transaction: H(TX MO ),"Keywords”} and the transaction TX i,r is uploaded to the blockchain.

4. The blockchain-based privacy-preserving federated learning method against poisoning attacks according to claim 1, characterized in that, The step S30 comprises the following steps: S301、MO according to transaction TX i.r get the hash address of the local gradient ciphertext get the gradient ciphertext of the participant from the DFS according to the address S302, MO calls the inner product function of fully homomorphic encryption CKKS Get each P i The modulus of the gradient vector Store the calculation result In DFS, and Pack the corresponding hash address Into the transaction: Upload the transaction to the blockchain; S303 and SM obtain P from the blockchain. i The magnitude of the gradient vector Use your own private key sk s Decryption yields m i,r If m i,r =1, put P i Add the participant list L, MO stores the honestly normalized participant list L in DFS, and generates a transaction containing the hash address H(L) of the participant list L: Uploaded to the blockchain; S304、MO uses the root data set D0 to train the neural network model f(x, W r-1 ), and obtains the baseline gradient g 0,r , and the MO normalizes the local gradient to obtain First, call the encoding function of the fully homomorphic encryption CKKS to obtain the polynomial g(X), and then use the public key pk of the SM s to call the encryption function Enc(pk s , g(X)) of the fully homomorphic encryption CKKS to obtain the local gradient ciphertext The above process is described by formula (5) as follows: MO uses CKKS-assisted computation of key evk by SM s and rotation key rk s , call the inner product function of fully homomorphic encryption CKKS Calculate the cosine similarity ciphertext between the gradient vector ciphertext of each participant in the list L and the MO gradient vector ciphertext ​​ S305、For each P j (P j ∈L), compute the value cos j j,r j,r j ​​​​​ For each P j (P j ∈L), MO calls CKKS's The function will and The sum of the two is denoted as res. j,r ,res j,r The value range is [0,2], and then CKKS is called. evk s The function will convert res to res. j,r and The result of multiplication is denoted as re. j,r Then call the CKKS rescaling function RS(re j,r ), to obtain the converted ciphertext rt j,r ,rt j,r The range of values ​​is [0,1]. At that time, the converted ciphertext Finally, MO calls the CKKS homomorphic ciphertext numerical comparison function. Where d = 2α - 3, and α is the ciphertext rt j,r The number of binary bits, The function returns the ciphertext rt. j,r and The ciphertext corresponding to the largest plaintext value can be described by formula (7): S306、MO calls the function of CKKS , multiplies and , and records the result as ret j,r , then calls the function of CKKS , adds ret j,r and , and records the result as The above process is described as formula (8): in Participant P i The weighted ciphertext, MO uses formula (8) to... Convert back to the original value before the range conversion; MO calls |L| - 1 times of CKKS's Add(S j,r , j+1,r ) function, P j ∈ L, j = 1, 2, …, |L| - 1, to get the sum of weights of |L| participants Wherein, |L| represents the number of participants in the participant list L; S307, MO will store in DFS, will hash address and package into transaction: upload transaction TX weight to blockchain.

5. The blockchain-based privacy-preserving federated learning method against poisoning attacks according to claim 1, characterized in that, The step S40 comprises the following steps: S401, the Algorand consensus protocol of the blockchain uses a verifiable random function to randomly select a committee from all consensus nodes, and select a member from the committee as an aggregator; S402, The aggregator first queries the blockchain for transaction TX. L Obtain the hash address H(L) of the honest and normalized participant list L, and retrieve L from DFS based on the address; query transaction {TX} j,r |j∈L} obtains the gradient ciphertext hash address Retrieved from DFS based on the address Query TX transactions weight Obtain the hash address of the weighted ciphertext Retrieve the weight ciphertext from DFS based on the address. Then the aggregator uses SM's CKKS auxiliary calculation key evk s For each P j (P j ∈L), calling CKKS The function will and The result of multiplication is denoted as agg. j,r For each P j (P j ∈L), the aggregator then calls the CKKS rescaling function RS(agg) j,r To prevent the size and error of the ciphertext from increasing, the converted ciphertext ag is obtained. j,r Finally, the aggregator calls CKKS's Add(ag) method |L|-1 times. j,r ,ag j+1,r ) function, P j ∈L, j=1,2,…,|L|-1, to obtain the aggregated ciphertext of |L| participants. The process of gradient ciphertext aggregation performed by the aggregator above is described by formula (10): S403, the aggregator calculates the aggregated ciphertext and generates a transaction H(TX MO ), "Keywords"} and packs all the transactions in this round into a new block block r = {TX Agg , TX r,j | j e L}, next, the committee members verify this new block block r and vote on it, if agree the block block r , then generate a transaction: If more than 2 / 3 of the committee members agree on the block block r , then the block is accepted, the aggregator gets the reward, and all the committee members broadcast the block; otherwise, the aggregator's deposit will be confiscated and given to other committee members, and then the next committee member in the block proposal order becomes the aggregator, and the aggregation steps S402, S403 are executed again until the committee agrees on the block block r . S404, after reaching the blockchain consensus, the SM first queries the transaction TX from the blockchain Agg to get the aggregation ciphertext from the transaction TX weight to get the sum of weights ciphertext Then, the SM uses its own private key sk s to call the decryption function of the fully homomorphic encryption CKKS to get the plaintext polynomial t(X) and sum(X) respectively, and then call the decoding functions Dcd(t(X), Δ) and Dcd(sum(X), Δ) of the fully homomorphic encryption CKKS to get the aggregation result g r and the sum of weights sum r The above process is described by formula (11) as follows: Finally, the SM calculates the aggregated gradient: SM calls an encoding function of homomorphic encryption CKKS A polynomial m(X) is obtained, and a public key pk common to all participants and the MO is used x , an encryption function Enc(pk x , m(X)) of homomorphic encryption CKKS is called to obtain an aggregated gradient ciphertext The above process is described by formula (13) as: Will store in DFS, hash address pack into transaction: H(TX MO ),"Keywords”} upload transaction TX Result to blockchain.

6. The blockchain-based privacy-preserving federated learning method against poisoning attacks according to claim 1, characterized in that, The step S50 comprises the following steps: S501, MO and P i Querying transactions TX from the blockchain Result And download aggregated gradient ciphertexts from DFS according to hash addresses Then use the private key sk of MO x Call the decryption function of CKKS Get plaintext polynomial p(X), call the decoding function Dcd(p(X), Delta) of CKKS to get global aggregated gradient The above process is described as formula (14): S502, MO and participants use aggregated gradients Update local model: S503, test the accuracy rate after the MO is updated, and if the expected model accuracy rate is reached, a transaction is generated and uploaded to the blockchain: indicates that the FL task is completed, otherwise P i Enter the S201 stage to perform r+1 rounds of local model training.

Images