A verifiable privacy protection federated learning method and system

Abstract

The application discloses a verifiable privacy protection federated learning method and system, belongs to the field of federated learning security, and solves the problem that privacy protection federated learning based on multi-key homomorphic encryption faces, that is, at least two clients need to cooperate to decrypt the aggregation ciphertext returned by a server, a single client cannot realize independent decryption, and in the case that the server is untrusted, the problem of client key leakage is caused. The application comprises system initialization, key generation, local model training, encryption uploading, model aggregation, partial decryption, and complete decryption. The application is used for privacy protection federated learning.

Description

Technical Field

[0001] A verifiable privacy-preserving federated learning method and system is proposed for privacy-preserving federated learning, belonging to the field of federated learning security. Background Technology

[0002] Deep learning (DL) is a research direction in machine learning, bringing traditional machine learning closer to its original goal—artificial intelligence. This unique advantage has attracted considerable attention from scholars and led to its widespread application in various fields, such as natural language processing, data mining, and medical prediction. In traditional centralized DL, user or mobile device data is uploaded to a central data center, which then (e.g., large servers) uses this data and machine learning algorithms to train a final model. However, this approach has significant drawbacks. First, with the improvement of privacy protection laws and regulations both domestically and internationally, and the increasing awareness of privacy protection, more and more users, companies, and government agencies are unwilling to directly upload data to a central data center, which is the root cause of the data silo problem. Second, in real-world scenarios, centralized DL also faces the threat of single points of failure, high latency, and high overhead. To address these issues, Google proposed a distributed machine learning architecture in 2016: Federated Learning (FL). In this architecture, data users no longer directly upload their data to a central data center, but instead train their own local models based on local data and existing machine learning algorithms. Subsequently, after local training, the model parameters are uploaded to a central server. The server aggregates and averages all received local model parameters to form the global model, which is then returned to the data user. The data user and the central server repeat this interaction process until the final global model converges. FL's unique advantages have made it a focus of attention and research, and it has already been applied in multiple fields, such as privacy computing, edge computing, and the Internet of Things.

[0003] While federated learning can effectively address the data silo problem and provide a degree of privacy protection, it still presents several security challenges. First, the depth leak algorithm (DLG) proposed by Zhu et al. demonstrates that users directly uploading plaintext gradients can leak their private data, necessitating effective security protection for plaintext gradients. Current mainstream privacy protection methods in federated learning include homomorphic encryption (HE). Homomorphic encryption is a cryptographic technique that maps operations on ciphertext to plaintext, a property that has led to its widespread application in privacy protection. Existing homomorphic encryption algorithms can be categorized into two types based on the type of key: single-key homomorphic encryption (SKHE) and multi-key homomorphic encryption (MKHE). SKHE-based federated learning methods require the generation of a public-private key pair, meaning the client and server use the same key. Each participant can access the plaintext gradients of other participants, and the server, due to the shared private key, can access the plaintext gradients of all users. This leads to key reuse and still results in privacy leaks. MKHE-based federated learning methods generate their own public and private keys for each client. Each client uses its public key to encrypt and upload plaintext gradients, while the server only performs aggregation, i.e., homomorphic computation. However, because different public keys are used during encryption, multiple clients need to jointly decrypt the aggregated ciphertext returned by the server. Existing MKHE algorithms use a joint decryption method where each client generates a shared decryption key based on the aggregated ciphertext and then uploads it to the server for final decryption. This distributed decryption method not only increases the computational and communication overhead of the system but may also lead to key leaks. Neither SKHE nor MKHE is well-suited for federated learning scenarios.

[0004] CN115455476A - A privacy-preserving method and system for vertical federated learning based on multi-key homomorphic encryption. Although it employs multi-key homomorphic encryption, distributing different homomorphic encryption keys to different participants, thus solving the problem that traditional homomorphic encryption cannot guarantee privacy among participants, traditional multi-key homomorphic encryption still has some drawbacks.

[0005] The multi-key homomorphic encryption algorithm used in CN115455476A requires multiple clients to jointly decrypt. Each client needs to calculate a decryption share based on its own private key and upload it to the server to complete the final decryption. From a computational cost perspective, this incurs significant computational and communication overhead. From a security perspective, the decryption share contains each client's private key, which poses a key leakage risk. Furthermore, if a malicious attacker intercepts these decryption share values, they can also decrypt and obtain the global model. Additionally, the server can directly decrypt the global model in plaintext after receiving the decryption share value. This only applies when the server is completely trusted. If the server is untrusted, it may tamper with the global model, leading to a decrease in the accuracy of the final trained model and failing to achieve the initial training objectives. From an application perspective, traditional multi-key homomorphic encryption algorithms are not well-suited for federated learning scenarios.

[0006] Therefore, the existing technology has the following technical problems:

[0007] 1. The aggregated ciphertext returned by the server requires at least two clients to cooperate in decryption (i.e., decryption sharing is required), and it is impossible for a single client to decrypt it independently. In the case of an untrusted server, this will cause the client key to be leaked.

[0008] 2. It requires a significant amount of computing and communication overhead;

[0009] 3. It is not well adapted to federated learning scenarios. Summary of the Invention

[0010] To address the problems mentioned above, the present invention aims to provide a verifiable privacy-preserving federated learning method and system that solves the problem that the aggregated ciphertext returned by the server requires at least two clients to cooperate in decryption, making it impossible for a single client to decrypt it independently, and thus causing client key leakage when the server is untrusted.

[0011] To achieve the above objectives, the present invention adopts the following technical solution:

[0012] A verifiable privacy-preserving federated learning method includes the following steps:

[0013] Step S1. Generate public and private keys for the client and server based on the given security parameters. The server initializes a global model W0 based on the deep learning model, the public and private keys of the client and server. The global model refers to the plaintext of the global model, which is the aggregation result of all local models of the client. The local model is the deep learning model.

[0014] Step S2. If this is the first round of training, the client uses the global model W. nThe deep learning model is trained using local data, and the local model is encrypted using the Paillier homomorphic encryption algorithm and uploaded to the server. If there are t training rounds, where t is an integer greater than 1, the client receives the global model ciphertext from the server in the previous training round, decrypts it using its own private key to obtain the global model plaintext, and trains on the global model and local data to obtain a new local model. Then, the local model is encrypted using the Paillier homomorphic encryption algorithm and uploaded to the server. The encrypted local model is the local model ciphertext. The local data is the data required for the deep learning task, which may be image data, text data, audio data, or time series data depending on the training task.

[0015] Step S3. The server aggregates all local model ciphertexts uploaded by clients into global model ciphertext, and obtains partially decrypted global model ciphertext based on this global model ciphertext and the server's private key;

[0016] Step S4. The server transmits the partially decrypted global model ciphertext to each client, and the client uses its own private key to completely decrypt it to obtain the final global model plaintext.

[0017] Furthermore, the specific steps of step S1 are as follows:

[0018] S1.1. Based on the given security parameters, obtain prime numbers p and g;

[0019] S1.2. Constructing the first multiplicative cyclic group based on prime numbers Second-square cyclic group

[0020] S1.3. Obtain generators g, g1, and g2 based on the first and second multiplicative cyclic groups;

[0021] S1.4. Construct bilinear pairs based on two first multiplicative cyclic groups and one second multiplicative cyclic group.

[0022] S1.5. Constructing publicly available system parameters based on hash functions, prime numbers, the first multiplicative cyclic group, the second multiplicative cyclic group, generators, and bilinear pairings. Where, the large integer N = pq, is a function of x′ required for decryption. From Z N Select k random numbers z from the data. i (i∈{1, 2, ..., k}), and calculate 2k publicly available system parameter values. i represents the i-th element;

[0023] S1.6. Based on the publicly available system parameters, select multiple random numbers d. j ∈ RZ N As the j-th client u j private key sk j (j∈{1,2,…,n}), R represents random selection, and a secret polynomial function is constructed using random numbers as solutions. Among them, a l It is the coefficient of the l-th term in the polynomial function, y l It is each term of a polynomial function containing the variable y, ψ(N) 2 ) is N 2 The Euler totient function result, where N is the N in the system's public parameters, is used to construct the public keys for all clients based on the secret polynomial coefficients and generators.

[0024] S1.7. Based on the publicly available system parameters, a trusted third party selects a random number x∈ R Z N sk as the server's private key s Calculate the server's public key based on the server's private key.

[0025] S1.8. The federated learning task issuer sets the initialization hyperparameters of the federated learning task and sets the machine learning algorithm;

[0026] S1.9. The server initializes the global model W0 based on the deep learning model, the client and the server's public and private keys, where the deep learning model is a global neural network model.

[0027] Furthermore, the specific steps of step S2 are as follows:

[0028] Step S2.1. If it is the first round of training, the client trains the deep learning model based on the global model W0, local data, machine learning algorithm and hyperparameters, that is, trains the local model, and then proceeds to step S2.3, where the machine learning algorithm is stochastic gradient descent;

[0029] Step S2.2. If the training is in round t, where t is an integer greater than 1, the client u j Receive the global model ciphertext C(W) from the server obtained in the previous training round. t-1 The global model W is obtained by decrypting it using its own private key. t-1 And based on this global model and local data, a new local model is obtained through training. Where η represents the learning rate, Let b denote the partial derivative, b denote the bias, and then proceed to step S2.3;

[0030] S2.3. Client u j(j∈{1,...,n}) Select random numbers in, Calculate the trained local model The corresponding n+2 dimensional local model ciphertext vector c j =(c j，0 c j，1 c j，m c j，n c j，n+1 ), where c j，m (j∈{1, ..., n}, m∈{0, 1, ..., n+1}) is the ciphertext c of the j-th client-side local model. j The m-th element in Client u j The corresponding local model ciphertext c j Uploaded to the server.

[0031] Furthermore, the specific steps of step S3 are as follows:

[0032] S3.1. Based on server aggregation of all client u j The local model ciphertext c uploaded by (j∈{1,2,…,n}) j Obtain an n+2 dimensional global model ciphertext. in, express The m-th global model ciphertext in the data.

[0033]

[0034] S3.2. After completing the ciphertext model aggregation, the server uses the global model ciphertext from S3.1 as a basis. Partial decryption using one's own private key, computation And, replace with that value In the original And delete The (n+2)th ciphertext Obtain partially decrypted new global model ciphertext

[0035] Furthermore, the specific steps of step S4 are as follows:

[0036] The server transmits a partially decrypted global model ciphertext to each client, and the client u j Use your own private key sk j (j∈{1,2,…,n}) Complete decryption yields the plaintext of the global model. in, It is based on the new global ciphertext in step S3.2. Client private key sk j The value calculated by raising it to the power of 11.

[0037] Furthermore, it also includes:

[0038] Step S5. Obtain local model proof based on the trained local model and upload it to the blockchain;

[0039] Step S6. Each client retrieves all local model proofs from the blockchain and verifies them based on the global model plaintext. If the verification passes, proceed to step 3 to continue execution; otherwise, terminate.

[0040] Furthermore, the specific implementation steps of step S5 are as follows:

[0041] Client u j For the trained local model Calculate the corresponding proof in, Based on the publicly available system parameter h i and local model The value calculated from the i-th element, proof j That is, the local model The corresponding hash value is then uploaded to the blockchain for public verification.

[0042] Furthermore, the specific implementation steps of step S6 are as follows:

[0043] Each client obtains all local model proofs from the blockchain. j (j∈{1, 2, ..., n}), then based on the plaintext vector of the global model in, W represents the global model vector of client J in round t. t Calculate the k-th value in the data. in Based on the publicly available system parameter h 1，i (i∈{1,...,k}) and the global model plaintext W t The value calculated for the i-th element in the equation is... If the global model is validated, it means that the global model data has not been maliciously tampered with. Proceed to step 3 to continue training until the global model W is successfully trained. t It must converge; otherwise, it will terminate.

[0044] A verifiable, privacy-preserving federated learning system, including client and server blockchains;

[0045] The client includes:

[0046] System initialization module: Generates public and private keys for the client and server based on given security parameters. The server initializes a global model W0 based on the deep learning model, the public and private keys of the client and server. The global model refers to the plaintext of the global model, which is the aggregation result of all local models of the client. The local model is a deep learning model.

[0047] Local Model Training Module: In the first round of training, the client trains the deep learning model based on the global model W0 and local data, and encrypts the local model using the multi-key Paillier homomorphic encryption algorithm before uploading it to the server. In the t rounds of training, where t is an integer greater than 1, the client receives the global model ciphertext obtained from the previous round of training from the server, decrypts it using its own private key to obtain the global model plaintext, and trains based on the global model and local data to obtain a new local model. Subsequently, the local model is encrypted using the multi-key Paillier homomorphic encryption algorithm and uploaded to the server. The encrypted local model is the local model ciphertext. The local data is the data required for the deep learning task, which may be image data, text data, audio data, or time series data depending on the different training task data.

[0048] The client receives the partially decrypted global model ciphertext and uses its own private key to completely decrypt it to obtain the final global model plaintext;

[0049] The servers include:

[0050] Model aggregation module: The server aggregates the local model ciphertext uploaded by all clients into global model ciphertext, and obtains a partially decrypted global model ciphertext based on the global model ciphertext and the server's private key. The server then transmits the partially decrypted global model ciphertext to each client.

[0051] Furthermore, it also includes a blockchain, which includes a proof storage module:

[0052] It is used to obtain local model proofs based on the trained local model and upload them to the blockchain, and to allow each client to obtain all local model proofs from the blockchain and verify the plaintext of the global model.

[0053] Compared with the prior art, the beneficial effects of this invention are as follows:

[0054] I. This invention employs a novel multi-key homomorphic encryption structure, extending the single-key Paillier algorithm to a multi-key homomorphic encryption algorithm. Furthermore, its decryption does not require multi-user collaboration. This novel multi-key homomorphic encryption algorithm not only provides privacy protection for federated learning but also solves the security problems existing in current privacy protection schemes.

[0055] II. This invention employs a novel multi-key homomorphic encryption structure, specifically a multi-key homomorphic encryption algorithm that satisfies single-private-key decryption. It extends the traditional single-key Paillier algorithm to a multi-key Paillier homomorphic encryption algorithm with single-private-key decryption. Compared to traditional multi-key homomorphic encryption algorithms, this novel algorithm offers higher security, solves the problem of private key leakage, and eliminates the need for multi-user collaboration during decryption, significantly reducing communication and computational overhead. Furthermore, this novel multi-key homomorphic encryption structure achieves complete confidentiality; throughout the entire process, the central server remains completely unaware of any plaintext information from the local or global models.

[0056] Third, this invention employs a vector homomorphic hash algorithm and designs a method for integrity verification in federated learning. Vector homomorphic hash can generate a hash value for a vector. Compared with traditional hash functions, it can effectively reduce the computation and communication overhead required for integrity verification, and achieve high-efficiency verification and reliable federated learning.

[0057] Fourth, this invention applies the above two methods to federated learning, realizing a verifiable privacy-preserving federated learning scheme;

[0058] Fifth, the multi-key homomorphic encryption algorithm presented in this invention can support multi-user distributed scenarios, and vector homomorphic hashing can efficiently verify the correctness of aggregation results in the federated learning process. Therefore, the technology of this invention has the characteristics of security, reliability, multi-functionality, multi-scenario compatibility, and scalability, and can be well adapted to federated learning scenarios. Attached Figure Description

[0059] Figure 1 It is a verifiable privacy-preserving federated learning flowchart. Detailed Implementation

[0060] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0061] In federated learning, uploading plaintext gradients can compromise user privacy, and servers may tamper with the aggregated global model. This method can be used to achieve secure privacy protection and verifiable aggregation results. Based on multi-key homomorphic encryption and vector homomorphic hashing, this method effectively protects the confidentiality and integrity of information, enriching its application scenarios for secure protection of the federated learning process.

[0062] 1. System Initialization: A trusted third-party organization generates large prime numbers p and q based on given security parameters; and constructs the first multiplicative cyclic group based on these prime numbers. Second-square cyclic group Generation order is Cyclic group, calculate the modulus N = pq, choose the first multiplication cyclic group. Second-square cyclic group Generators g, g1, and g2. Based on two multiplicative cyclic groups. and Construct a bilinear pairing map Simultaneously select random numbers (i∈{1, 2, ..., k}) and generator The system's public parameters are constructed based on hash functions, prime numbers, the first multiplicative cyclic group, the second multiplicative cyclic group, generators, and bilinear pairings. Where, the large integer N = pq, is a function of x required for decryption. From Z N Select k random numbers z from the data. i (i∈{1, 2, ..., k}), and calculate 2k publicly available system parameter values. i represents the i-th element.

[0063] 2. Key Generation: Select a random number based on the system's publicly available parameters. As a participant u j (i.e., client u) j Private key sk j (j∈{1, 2, ..., n}), and construct a private polynomial based on the random number. Among them, a l It is the coefficient of the l-th term in the polynomial function, y l It is each term of a polynomial function containing the variable y, ψ(N) 2 ) is N 2 The Euler totient function result, N is the N in the system's public parameters, and finally, based on the secret polynomial coefficients and generators, the public keys of all participants are calculated.

[0064] In addition, a trusted third party selects the random number. The private key sk of the central server (i.e., the server mentioned above) s Calculate the corresponding public key After the key is generated, the private key is transmitted through a secure channel and the corresponding public key is made public.

[0065] The issuer of the federated learning task sets the initialization hyperparameters and configures the machine learning algorithm.

[0066] The server initializes a global model W0 based on a deep learning model, the client's and server's public and private keys, where the deep learning model is a global neural network model.

[0067] 3. Local model training: In the first round of training, each participant u j Participants obtain an initial global model W0 from the server, and then train their local models based on their local data, machine learning algorithms, hyperparameters, and W0. In the remaining rounds, taking the j-th participant in round t as an example, each participant obtains the global model ciphertext C(W0). t-1 After that, the plaintext W of the global model is first obtained through a decryption algorithm. t-1 Then update the local model.

[0068] 4. Model Encryption: After any round of training, to prevent privacy breaches in federated learning, each participant u... j Select random number in Compute local model The corresponding ciphertext Among them, c j，m (j∈{1, ..., n}, m∈{0, 1, ..., n+1}) is the ciphertext c of the j-th client-side local model. j The m-th element in the ciphertext c is then used to encrypt the text. j Uploaded to the central server for aggregation.

[0069] 5. Model Aggregation: The server receives all participant u j The local model ciphertext c uploaded by (j∈{1,2,...,n}) j Then, model aggregation is performed to obtain the global model ciphertext. in, express The m-th global model ciphertext in the data is as follows:

[0070]

[0071] 6. Partial Decryption: After completing the ciphertext model aggregation, the server decrypts the ciphertext based on the global model. Partial decryption using one's own private key, computation Replace with that value The original And delete The (n+2)th ciphertext Obtain partially decrypted new global model ciphertext

[0072] 7. Full Decryption: After completing partial decryption, the server transmits the partially decrypted ciphertext to each participant. j Then participant u j Use your own private key sk j(j∈{1,2,...,n}) Complete decryption yields the plaintext of the global model.

[0073] 8. Local Model Proof Generation: To address the issue of easily forged aggregation results in federated learning, each participant u... i For its local model Calculate the corresponding proof That is, the client u j Local model vectors The corresponding hash value is then uploaded to the blockchain for public verification. 9.

[0075] 9. Model Validation: Each participant obtains all local model proofs from the blockchain. j (j∈{1, 2, ..., n}), then based on the plaintext of the global model calculate If the equation If the validation is successful, proceed to step 3 to continue training until the global model W is established. t If the training converges, the training will terminate.

[0076] In real-world scenarios, finding a completely trustworthy server is extremely difficult. Servers may modify the aggregation results for economic gain or other purposes, ultimately causing the trained model to deviate from the original objective. Therefore, it is necessary to verify the integrity of the aggregation results to ensure they have not been maliciously modified. The mainstream method for integrity verification is hash functions, which map an input message string of arbitrary length to a fixed-length output string. To make it applicable to federated learning, existing research has also constructed hash functions with homomorphic properties, i.e., homomorphic hash functions. Homomorphism allows the integrity of plaintext to be guaranteed by verifying the integrity of ciphertext while ensuring privacy. This invention implements an efficient, verifiable, privacy-preserving federated learning system with features such as multifunctionality, multi-scenario applicability, openness, security, and efficiency.

[0077] The above are merely representative embodiments among the many specific applications of this invention, and do not constitute any limitation on the scope of protection of this invention. All technical solutions formed by transformation or equivalent substitution fall within the scope of protection of this invention.

Claims

1. A verifiable privacy-preserving federated learning method, characterized in that, Includes the following steps: Step S1. Generate public and private keys for the client and server based on the given security parameters. The server initializes a global model based on the deep learning model, the client's and server's public and private keys. The global model refers to the plaintext of the global model, which is the aggregated result of all client-side local models. The local models are deep learning models. Step S2. If this is the first round of training, the client uses the global model. The deep learning model is trained using local data, and the local model is encrypted using the Paillier homomorphic encryption algorithm and uploaded to the server. If there are t training rounds, where t is an integer greater than 1, the client receives the global model ciphertext from the server in the previous training round, decrypts it using its own private key to obtain the global model plaintext, and trains on the global model and local data to obtain a new local model. Then, the local model is encrypted using the Paillier homomorphic encryption algorithm and uploaded to the server. The encrypted local model is the local model ciphertext. The local data is the data required for the deep learning task, which may be image data, text data, audio data, or time series data depending on the training task. Step S3. The server aggregates all local model ciphertexts uploaded by clients into global model ciphertext, and obtains partially decrypted global model ciphertext based on this global model ciphertext and the server's private key; Step S4. The server transmits the partially decrypted global model ciphertext to each client, and the client uses its own private key to completely decrypt it to obtain the final global model plaintext; The specific steps of step S1 are as follows: S1.

1. Based on given security parameters Find prime numbers and ; S1.

2. Constructing the first multiplicative cyclic group based on prime numbers Second-square cyclic group ; S1.

3. Obtaining generators based on the first and second multiplicative cyclic groups. , and ; S1.

4. Construct bilinear pairs based on two first multiplicative cyclic groups and one second multiplicative cyclic group. ; S1.

5. Constructing publicly available system parameters based on hash functions, prime numbers, the first multiplicative cyclic group, the second multiplicative cyclic group, generators, and bilinear pairings. Among them, large integers A decryption required regarding function ,from Select k random numbers and calculate System publicly disclosed parameter values , Indicates the first indivual; S1.

6. Select multiple random numbers based on publicly available system parameters. As the first Client private key R represents random selection, and a secret polynomial function is constructed using random numbers as solutions. ,in, It is the first polynomial function. The coefficient of the term, It is a polynomial function with variables Each item, yes The result of Euler's totient function, That is, the system's publicly available parameters Finally, all client public keys are constructed based on the secret polynomial coefficients and generators. ; S1.

7. Random numbers selected by a trusted third party based on publicly available system parameters. As the server's private key Calculate the server's public key based on the server's private key. ; S1.

8. The federated learning task issuer sets the initialization hyperparameters of the federated learning task and sets the machine learning algorithm; S1.

9. The server initializes the global model based on the deep learning model, the client's and server's public and private keys. Among them, the deep learning model is a global neural network model; The specific steps of step S2 are as follows: Step S2.

1. If this is the first round of training, the client uses the global model. The deep learning model is trained using local data, machine learning algorithms, and hyperparameters, i.e., the local model is trained, and then the process proceeds to step S2.3, where the machine learning algorithm is stochastic gradient descent; Step S2.

2. If the training is in round t, where t is an integer greater than 1, the client... Receive the global model ciphertext obtained from the previous training round from the server. Decrypt it using your own private key to obtain the global model. And based on this global model and local data, a new local model is obtained through training. ,in, Indicates the learning rate. Let b represent the partial derivative, b represent the bias, and then proceed to step S2.3; S2.3 Client Select random number ,in, Calculate the trained local model One corresponding Dimensional local model ciphertext vector ,in, It is the first Local model ciphertext for each client The first in One element, , will the client Corresponding local model ciphertext Uploaded to the server; S3.

1. Aggregates all clients based on the server. Uploaded local model ciphertext Obtain an n+2 dimensional global model ciphertext. ,in, express The first in Item global model ciphertext, ； S3.

2. After completing the ciphertext model aggregation, the server uses the global model ciphertext from S3.1 as a basis. Partial decryption using one's own private key, computation and replace with that value In the original And delete The (n+2)th ciphertext Obtain partially decrypted new global model ciphertext .

2. The verifiable privacy-preserving federated learning method according to claim 1, characterized in that, The specific steps of step S4 are as follows: The server transmits a partially decrypted global model ciphertext to each client, and the client... Use your own private key Complete decryption yields the plaintext of the global model. ,in, It is based on the new global ciphertext in step S3.

2. Client private key of The value calculated by exponentiation.

3. A verifiable privacy-preserving federated learning method according to any one of claims 2, characterized in that, Also includes: Step S5. Obtain local model proof based on the trained local model and upload it to the blockchain; Step S6. Each client retrieves all local model proofs from the blockchain and verifies them based on the global model plaintext. If the verification passes, proceed to step 3 to continue execution; otherwise, terminate.

4. The verifiable privacy-preserving federated learning method according to claim 3, characterized in that, The specific implementation steps of step S5 are as follows: Client For the trained local model Calculate the corresponding proof ,in, Based on publicly available system parameters and local model The Middle The value calculated for each element. That is, the local model The corresponding hash value is then uploaded to the blockchain for public verification.

5. A verifiable privacy-preserving federated learning method according to claim 4, characterized in that, The specific implementation steps of step S6 are as follows: Each client obtains all local model proofs from the blockchain. Then, based on the plaintext vector of the global model ,in, Indicates the first Client-side global model vector in round t The first in Calculate the value. in Based on publicly available system parameters and global model plaintext The first in The numerical values ​​calculated for each element, if the equation If the global model is verified, it means that the global model data has not been maliciously tampered with. Proceed to step 3 to continue training until the global model is fully established. It must converge; otherwise, it must terminate.

6. A verifiable privacy-preserving federated learning system, wherein the system implements a verifiable privacy-preserving federated learning method as described in any one of claims 1-5 during runtime, characterized in that, Including client-side and server-side blockchains; The client includes: The system initialization module generates public and private keys for the client and server based on given security parameters. The server then initializes a global model based on the deep learning model and the public and private keys of the client and server. The global model refers to the plaintext of the global model, which is the aggregated result of all client-side local models. The local models are deep learning models. Local model training module: If it is the first round of training, the client is based on the global model. The deep learning model is trained using local data, and the local model is encrypted using the Paillier homomorphic encryption algorithm and uploaded to the server. If there are t training rounds, where t is an integer greater than 1, the client receives the global model ciphertext from the server in the previous training round, decrypts it using its own private key to obtain the global model plaintext, and trains on the global model and local data to obtain a new local model. Then, the local model is encrypted using the Paillier homomorphic encryption algorithm and uploaded to the server. The encrypted local model is the local model ciphertext. The local data is the data required for the deep learning task, which may be image data, text data, audio data, or time series data depending on the training task. The client receives the partially decrypted global model ciphertext and uses its own private key to completely decrypt it to obtain the final global model plaintext; The servers include: Model aggregation module: The server aggregates the local model ciphertext uploaded by all clients into global model ciphertext, and obtains a partially decrypted global model ciphertext based on the global model ciphertext and the server's private key. The server then transmits the partially decrypted global model ciphertext to each client.

7. A verifiable privacy-preserving federated learning system according to claim 6, characterized in that: It also includes a blockchain, which includes a proof storage module: It is used to obtain local model proofs based on the trained local model and upload them to the blockchain, and to allow each client to obtain all local model proofs from the blockchain and verify the plaintext of the global model.

Images