A secure federated learning method of ciphertext plaintext mixed learning mode

Abstract

The application discloses a secure federated learning method of ciphertext plaintext mixed learning mode, which comprises an encryption training protocol in the first stage, a partial plaintext training protocol in the second stage and selection discrimination of the current protocol; a client judges which stage protocol should be used for this round of training according to the index in the training process and the given discrimination method, and sends the judgment result to the server; the server decides the protocol of this round according to the judgment result uploaded by the client and notifies the client; the client and the server train and communicate according to the protocol content, and complete the training of this round. The application selects the appropriate training protocol in different periods of global training, protects the privacy of user data, improves the efficiency of federated learning training, effectively improves the computing efficiency, reduces the bandwidth consumed by the transmission of data of each party, and finally realizes efficient deep neural network model training based on multi-party data.

Description

Technical Field

[0001] This invention relates to a secure and efficient scheme for multi-party collaborative training of neural network models in a federated learning scenario based on homomorphic encryption, and more particularly to a scheme for efficient training by segmenting model parameters, as well as a discrimination scheme for selecting a global training protocol. Background Technology

[0002] With the increase in mobile internet users and the improvement of computing power in smart devices, machine learning, especially deep machine learning algorithms, is playing an increasingly important role in the interaction between internet companies and users. For example, many companies collect user data from mobile applications or devices, and based on this data, train machine learning models to understand user habits, thereby accurately pushing information that users want to know. In practical application training, deep neural networks are a commonly used model structure for learning algorithms.

[0003] This invention aims to safely and efficiently train neural network models from multiple parties. It is necessary to first introduce the construction of a single-party machine learning model, that is, the process of constructing a machine learning model for an independent client.

[0004] The collected attributes of things are called features, and the attributes that we hope to infer from the features are called labels. For example, the size, color, and stem of a watermelon are features, and whether the watermelon is sweet is the label we want to obtain; the graphics card model, operating system, and CPU of a computer are features, and the computer's performance is the label we want to obtain.

[0005] Machine learning models can be abstracted as a mapping from features to labels. However, to obtain the most accurate mapping possible, knowledge learning is required. This means providing a certain number of (feature, label) examples for the machine to construct the mapping. Ultimately, this allows the machine to achieve accurate results on more generalized data.

[0006] Let D be the dataset. x represents the features, and y represents the labels. The machine will build a model f:R by learning from the data in D. d →R, f(x) = y, we also need a loss function to evaluate the model's performance: F(D) = ∑ (x,y)∈D l(f(x),y), where l(f(x),y) gives the loss value, so the machine learning model is completed and the mapping f is the one that minimizes F(D).

[0007] Deep neural networks are discriminative models that can be trained using the backpropagation algorithm. Weight updates can be solved using stochastic gradient descent:

[0008] Where ∝ represents the learning rate, and C represents the cost function. The choice of this function depends on the type of learning (e.g., supervised learning, unsupervised learning, reinforcement learning) and the activation function. For example, for supervised learning on a multi-class classification problem, a common choice is to use ReLU as the activation function and cross-entropy as the cost function.

[0009] The Softmax function is defined as follows:

[0010] Where p j x represents the probability of category j, while x represents the probability of category j. j and x k These represent the inputs to units j and k, respectively.

[0011] Cross-entropy is defined as C = -∑ j d j log(p j ), where d j p represents the target probability of output unit j. j This represents the probability output for unit j after the activation function has been applied.

[0012] However, these services often require the collection of large amounts of user privacy data as the basis for training models. As users become increasingly aware of the importance of protecting their personal data privacy, companies that want to collect user data on their own servers and then use it for training not only risk violating user privacy but also face increasing difficulty in collecting sufficient training samples for a growing user base with evolving privacy concerns. Furthermore, even if strict monitoring of a company's use of privacy data is possible, data stored centrally on company servers is still at risk of being stolen by malicious attackers. Once stolen, the harm to users' rights would be unpredictable. For all these reasons, traditional centralized training methods are no longer suitable for the needs of today's businesses and society. Therefore, in 2016, Google proposed a new machine learning scenario—federated learning—which, as a distributed training scheme, is gradually replacing the original learning methods.

[0013] In terms of format, compared to single-machine machine learning, federated learning designs two types of entities: clients and servers. There are N clients, each holding a dataset D. i The details of the federated learning process are described in Algorithm 1. Essentially, each client receives a new model from the server and then trains it locally using its own dataset. The new model parameters are then sent to the server, which aggregates the parameters from all clients to obtain a new global model, which is then sent to each client. This process is repeated until a machine learning model adaptable to each client's dataset is obtained.

[0014] In federated learning algorithms, users do not upload their private data to the server; instead, they send data used to train the model. However, numerous subsequent studies have shown that, under various assumptions, transmitting intermediate gradient results based on user data can still potentially leak user privacy. Therefore, most current federated learning algorithms utilize other secure encryption techniques, such as homomorphic encryption. Homomorphic encryption is a public-key encryption technique that makes it difficult for attackers to extract plaintext information from the encrypted ciphertext, while simultaneously allowing others to perform certain calculations using the ciphertext, ensuring that the final decrypted result is the same as or sufficiently similar to the result of the same calculation based on the plaintext. Thus, by homomorphically encrypting the data uploaded from the client to the server, both user data privacy and the normal operation of the original training algorithm are guaranteed.

[0015] Among all homomorphic encryption algorithms, semi-homomorphic encryption algorithms are frequently used in FedAvG scenarios within federated learning. Typical homomorphic encryption includes the following algorithms:

[0016] ·GenKey(1 λ )→(pk, sk): Homomorphic encryption generates key pairs, where λ is called the security factor, used to generate random public key pk and private key sk, and their lengths are often determined by λ.

[0017] ·Enc(m, pk)→c: An algorithm for encrypting plaintext using a public key, where m is the plaintext to be encrypted and pk is the public key generated in advance. The algorithm takes both as input and outputs the encrypted ciphertext.

[0018] Dec(c, sk) → m: An algorithm for decrypting ciphertext using a key, where c is the ciphertext to be decrypted and sk is the private key corresponding to the encryption public key pk. The algorithm takes both as input and outputs the decrypted plaintext. The result should be the same as the original plaintext as input, i.e., Dec(Enc(m, pk), sk) = m.

[0019] ·Add(c1, c2)→c sum The sum of two ciphertexts should be equal to the sum of the plaintexts after decryption.

[0020] That is, Dec(c1,sk)+Dec(c2,sk)=Dec(c sum (sk). Unless otherwise specified, any additions between ciphertexts mentioned below refer to ciphertext additions performed using the Add function.

[0021] In homomorphic encryption, if a ciphertext addition algorithm exists that satisfies the last condition, it is said to satisfy the additive homomorphic property. Similarly, if ciphertext multiplication can be implemented, it is said to satisfy the multiplicative homomorphic property. Different homomorphic encryption methods often differ in their additive and multiplicative homomorphic capabilities, and some also have limitations on the range of encrypted numbers, the number of operations, etc. We only focus on encryption methods that possess the additive homomorphic property; these methods with only one homomorphic encryption property are also called "semi-homomorphic encryption."

[0022] The Paillier algorithm, a semi-homomorphic encryption algorithm used in this invention, is described below.

[0023] ·GenKey(1 λ → (pk, sk):

[0024] 1. For a given λ, Paillier first finds two prime numbers p and q whose bit length is not less than its. Here, it is necessary to ensure that p and q satisfy gcd(pq, (p-1)(q-1))=1. This property is easily satisfied when the lengths of p and q are the same or very close.

[0025] 2. Let n = pq, α = 1cm(p-1, q-1). Randomly select g from Zn*2 (when p and q are of equal length, g = n+1 can be directly selected), and satisfy L(g α mod n 2 The function has an inverse modulo n, let the inverse be μ, where the function... The value modulo n

[0026] 3. Finally, Paillier sets the tuples (n, g) and (α, μ) as the current public and private keys, respectively.

[0027] ·Enc(m,pk=(n,g))→c:

[0028] 1. During each encryption, the encryptor randomly selects an integer r from (0, n) such that gcd(r, n) = 1;

[0029] 2. Let the plaintext to be encrypted be m (0≤m<n), calculate c=g m r n (modn 2 c is the ciphertext obtained in this encryption;

[0030] ·Dec(c,sk=(α,μ))→m:

[0031] The decryptor calculates m = L(c) α modn 2 )·μmodn,m is the result of decryption·Add(c1,c2)→c sum

[0032] To calculate the sum of two ciphertexts, the person holding both ciphertexts calculates c = c1·c2 mod n. 2 c is the ciphertext of the addition.

[0033] • Mul(c1, b) → c: Paillier also supports the operation of multiplying the ciphertext c1 by a plaintext constant b, the result of which is

[0034] Next, we briefly prove the correctness of Paillier's encryption and decryption algorithm, as well as the properties of homomorphic addition and homomorphic multiplication of ciphertext and plaintext constants:

[0035] • Encryption / Decryption Correctness: Let the plaintext to be encrypted be m, and the public and private keys be (n, g) and (α, μ) respectively. The encryption result is c = g. m r n (modn 2 Then we have:

[0036] Dec(c, sk=(α, μ))=L(c α modn 2 )·μ modn

[0037] =L((g) m r n modn 2 ) α modn 2 )·μ modn

[0038] =L(g) mα r nα modn 2 )·μ modn

[0039] According to Fermat's Little Theorem, we have x p-1 31modp, x q-1 Given α = lcm(p-1, q-1), we have x mod q. α ≡1 mod n, and thus with respect to a specific x, we get:

[0040] g α 31 mod n, r α 31modn

[0041] Therefore, we can set g α =1+q g n, r α =1+q r n and substitute it into c α We can obtain:

[0042] c α ≡(1+qg n) m ·(1+q r n) n modn 2 ≡(1+q g nm)·(1+q r n 2 )modn 2

[0043] ≡(1+q g nm)modn 2

[0044] The above steps utilize a simple binomial theorem.

[0045] Based on the definition of function L and the above equation, we have:

[0046]

[0047] Similarly, we can conclude that:

[0048]

[0049] According to the definition of μ, we have:

[0050]

[0051] Substituting the above results into the Dec function, we get:

[0052]

[0053] The decrypted ciphertext is identical to the original plaintext, thus proving the correctness of the encryption and decryption.

[0054] • Homomorphic addition correctness: Let plaintexts m1 and m2 be encrypted using the same public and private keys, resulting in ciphertexts c1 and c2 respectively. Then we have:

[0055]

[0056]

[0057]

[0058] It is evident that performing addition on the ciphertext according to our definition yields the ciphertext after adding the plaintext (without overflow), thus proving the homomorphic additivity.

[0059] • Homomorphic multiplication with constant multiplication: Let the plaintext be m, the constant factor be b, and the ciphertext obtained after encrypting m be c, then:

[0060] c = g m r n modn2

[0061] Mul(c, b) = c b =(g m r n ) b modn 2 =g mb r nb modn 2

[0062] Where r nb Since the term is a distractor and has been proven not to affect the final decryption result, the correctness of the multiplication homomorphism is thus proven.

[0063] However, the inventors of this application have discovered that the above-mentioned technology has at least the following technical problems:

[0064] In FedAvG federated learning based on semi-homomorphic encryption, encrypting / decrypting the original model data often consumes a significant amount of time, especially in scenarios with small local datasets, where the encryption / decryption time may exceed the training time of the local model. Furthermore, the data transmitted between the client and server is primarily encrypted model data; with fixed communication bandwidth, the communication time is directly proportional to the size of the ciphertext. Therefore, if trainers use more complex deep learning models with more parameters to improve model performance, the communication overhead for all participants will increase significantly, creating a trade-off between security and training efficiency.

[0065] For a federated learning protocol, training an efficient model and maintaining low computational / communication overhead are often mutually exclusive requirements. However, if multiple protocols with different effects can be used during a single training run, it may be possible to maximize the strengths of each protocol at different stages.

[0066] In the process of transmitting model parameters from the client to the server for aggregation, in order to avoid the exposure of such privacy as parameters, the client will only transmit encrypted ciphertext. However, encrypting and decrypting the model parameters in each round of training will incur a lot of overhead, and transmitting ciphertext will occupy a lot of communication bandwidth.

[0067] Therefore, this patent addresses the inefficiencies of existing solutions in the aforementioned training scenarios by designing a two-stage federated learning scheme based on semi-homomorphic encryption, and also designs a method for determining when it is more appropriate to switch between the two training stages. Summary of the Invention

[0068] This application provides a secure federated learning method with a encrypted-verified hybrid learning mode. The method uses a federated learning scheme with a two-stage training protocol and a stage discrimination method. It can provide a relatively efficient training protocol for the different degrees of contradiction between privacy and efficiency in different training stages of deep neural networks, and ultimately greatly reduces the overhead of computing resources and network bandwidth during training.

[0069] This application provides a secure federated learning method with a hybrid encrypted and plaintext learning mode, characterized by including a first-stage encrypted training protocol, a second-stage partially plaintext training protocol, and a selection and discrimination of the current protocol;

[0070] If the local model on the client converges quickly, that is, the local models on each client are significantly different, then the traditional semi-homomorphic encryption aggregation scheme is adopted. Each client first trains the global model on its own local machine, and then encrypts the updated gradient values ​​using a semi-homomorphic encryption algorithm before uploading them to the server. The server then aggregates the received data and sends it back to the client for decryption.

[0071] If the convergence speed of the client's local model begins to slow down or even converges to the minimum point, that is, the local models of each client are relatively similar, then a fast aggregation scheme is used. The server selects some clients based on the statistical information distribution of the parameters of each client and interacts with them by passing some parameters to complete the fast aggregation.

[0072] The client, based on its own training metrics and the given discrimination method, determines which stage of the protocol should be used in this training round and sends the result to the server. The server determines the protocol for this round based on the client's uploaded result and notifies the client. The client and server then train and communicate according to the protocol content to complete this round of training. When using semi-homomorphic encryption, the model parameters are encrypted ciphertext binary codes after being compressed to plaintext. When using the fast aggregation protocol, the high-order bits are the binary codes mapped using a hash function, and the low-order bits are the plaintext binary codes of the parameters.

[0073] The technical solution further defined in this invention is: the encryption training protocol for the first stage, specifically including the following steps:

[0074] Let the current round be t, and the previous round trained the global model θ. (t-1) The training hyperparameter is φ, the encryption / decryption public key is pk, the private key is sk, and the desired output is the current model θ. (t) ,

[0075] For the client, the i-th client performs the first phase of protocol training, D i For its dataset or a subset thereof, the first-phase protocol process for client i includes:

[0076] 1. New model trained locally on the client

[0077] 2. The model is determined by its parameters, which are compressed and encoded here.

[0078] 3. Obtained by encrypting with a public key.

[0079] 4. Send to the server

[0080] 5. Receive Enc(m) from the server (t) ,pk)

[0081] 6. Use the private key to decrypt and obtain m (t) ←Dec(Enc(m (t) ,pk),sk)

[0082] 7. Decode the compressed parameters to obtain θ (t) ←Decode(m (t) );

[0083] The process of the server performing the first phase protocol includes:

[0084] 1. Collect the data uploaded by the i-th client. i = 1, 2, ..., N

[0085] 2. Homomorphic encryption addition is used to aggregate the ciphertext.

[0086] 3.Enc(m (t) ,pk): Send the aggregated ciphertext to each client.

[0087] Preferably, the second-stage protocol assumes that all parameters consist of K-bit fixed-point numbers, with the high K bits... high The first bit is considered as the high-order bit of the parameter, and the remaining K bits are... low =KK high The bit is considered the low-order bit;

[0088] Let the high-order and low-order bits of each K-bit parameter ω be ω0 and ω1 respectively. high ω low Then ω is represented as Simplified to ω=[ω hig ω low ];

[0089] Let the current position be in round t, and the global model obtained in the previous round be θ. (t-1) The training hyperparameter is φ, the encryption / decryption public key is pk, the private key is sk, and the output is the current model θ. (t) .

[0090] Preferably, the plaintext training protocol of the second-phase protocol includes the following steps:

[0091] 1) Collect the high and low bit parameters from each client;

[0092] Let s and l be the high and low byte statistics that the server wants to collect, respectively;

[0093] For client i:

[0094] 1. New model trained locally on the client

[0095] 2. Extract high-order bits

[0096] 3.

[0097]

[0098] Use a hash function to encrypt the high-order bits so that the server can obtain the same number of clients with the same high-order bits;

[0099] 4. The low-order bits are directly passed to the server without exposing the parameters; exposing the low-order bits of the parameters alone will almost never cause privacy leaks.

[0100] 5. Send h to the server i , l i ;

[0101] For the server side:

[0102] Collect high and low byte statistics from the client:

[0103] h←(h1, h2, ..., h) N ), l←(l1, l2, ..., l N )

[0104] Statistical hash value based on parameters:

[0105] s j ←(h 1，j h 2，j , ..., h N,j ), j = 1, 2, ..., m

[0106] s←(s1, s2, ..., s m )

[0107] 2) Determine the representative value of the higher-order bits of each parameter;

[0108] Using either independent selection or top-K selection, the server obtains a representative of the j-th parameter, and uses Sel...i This represents the list of parameter indices represented by the i-th client and is then returned to the corresponding client.

[0109] The independent selection method involves directly selecting the most frequent hash value from the statistical hash values ​​of each parameter and recording it as h. j The hash value of all j-th parameters is equal to h. j All clients can represent the j-th parameter; to ensure that the representation sets of each client are relatively average and that the time consumed by each client is relatively average, the client with the smallest Sel among those currently representing the j-th parameter is selected. i And add j to Sel i Go to the middle.

[0110] The top-K selection method is implemented in multiple rounds, with each round yielding only one Sel. i Delete Sel i The representative parameter is selected, and the remaining parameters are selected repeatedly until the number of remaining parameters falls below the initially set threshold. The remaining unrepresented parameters are then set to 0. In each round, a temporary Sel is generated. i ', the top K hash values ​​of each parameter that have the same value represent the parameter obtained after iterating through all the parameters. i Then take the set Sel with the largest number of elements. i As a result of this round.

[0111] 3) Finally, perform aggregation and training.

[0112] Once the representatives are determined, the client sends the corresponding encrypted parameters to the server based on the parameters it can represent. The server determines the low-order bits of the clients that need to participate in the aggregation and returns the results to each client. At the same time, each client will also receive the high-order bits selected by the server. The server shuffles the set of high-order bits and adds a new index as a guide to participate in the transmission.

[0113] Preferably, the selection and discrimination of the current protocol adopts a naive threshold strategy, and the specific steps include:

[0114] 1) Select a series of test sets, and train the model directly on the test sets using the protocol of the first stage to obtain curves of several indicators. From the curves, obtain the inflection point of the model's convergence speed.

[0115] 2) Use the obtained inflection point to set a threshold condition. If the test accuracy is higher than the threshold, select the second-stage protocol for training. If the test accuracy is lower than the threshold, select the first-stage protocol for training.

[0116] Preferably, the training of the current protocol's selection discrimination model is based on a model-learned discrimination strategy, using the Λ model to predict the original model θ.p The current state in federated learning; specific steps include:

[0117] Collect the original model θ p The m training results on m disjoint datasets divided by Ds, where Ds is a dataset with the same distribution as the actual test dataset;

[0118] Assume each training session consists of n rounds, and the original model θ p The parameters and metrics obtained after training m times on different datasets are denoted as M1, M2, ..., M... m It means that M i =(M i,1 M i,2 M i,n ), i = 1, 2, ..., m;

[0119] Divide the index M into several groups of fixed size β1, β2, ..., and assume that each group contains training information from B consecutive rounds. Then β i ={M j，(i-1)B+1 M j，iB}; j = 1, 2, 3, ..., m;

[0120] For each group in each training iteration, the original model θ is determined based on the obtained parameters and metrics. p The state in which it is located is β. i Tag l i ∈{1, 2, 3}, then {β i , l i This constitutes a sample in the dataset used to train model A; the final dataset is D. M Choose a prediction model with a suitable structure and use D M The dataset is used for training, thus obtaining the required Λ model; 1, 2, and 3 correspond to the following three different state stages:

[0121] 1. Fast convergence phase: In this phase, the model is in a stage of rapid parameter convergence, with accuracy rising rapidly and the loss function decreasing continuously;

[0122] 2. Slow convergence phase: The model as a whole still tends to converge, but the convergence speed is much slower than that of the fast convergence phase, or there may be small fluctuations.

[0123] 3. Long-tail effect stage: The model reaches the training bottleneck, its performance tends to stabilize, and the indicators oscillate within a small range.

[0124] This invention also discloses a secure federated learning system with a encrypted-verb hybrid learning mode, characterized in that it includes:

[0125] The client obtains parameters from the server using the method described above, then uses these parameters to train the model locally, and finally sends the trained parameters back to the server.

[0126] The server is used to receive parameters sent by each client, aggregate them, and then send the aggregated results back to each client.

[0127] The technical solutions provided in this application embodiment have at least the following technical effects or advantages:

[0128] This invention provides an efficient two-stage encrypted-plaintext hybrid federated learning method, consisting of a first-stage encrypted training protocol, a second-stage partially plaintext training protocol, and a discriminative strategy for selecting the current protocol. By selecting appropriate training protocols at different stages of global training, the efficiency of federated learning training is improved while protecting user data privacy. Compared with traditional federated learning methods based on semi-homomorphic encryption, it effectively improves computational efficiency, reduces the bandwidth consumed by data transmission from each party, and ultimately achieves efficient training of deep neural network models based on multi-party data.

[0129] Furthermore, this technical solution has a clear approach, a simple design, and is highly portable, offering significant operational flexibility. Users can choose one of the solution routes to complete their work based on their own circumstances. Attached Figure Description

[0130] Figure 1 This is a schematic diagram of the overall process of the two-stage federated learning method based on homomorphic encryption in a specific implementation.

[0131] Figure 2 This is a flowchart illustrating the first phase protocol in a specific implementation.

[0132] Figure 3 This is a flowchart illustrating the second phase protocol in a specific implementation.

[0133] Figure 4 This is a schematic diagram illustrating the training and use of the phase protocol discrimination model in a specific implementation. Detailed Implementation

[0134] This embodiment discloses a federated learning scheme using a two-stage training protocol with semi-homomorphic encryption. This technical solution involves two functional entities: a server and a client. Each client holds its own private data and needs to interact with the server using limited computing resources to ultimately obtain the trained plaintext model. The server has relatively abundant computing resources and is mainly responsible for aggregating the ciphertext parameters from each client and sending the results of each round back to the client.

[0135] This technical solution mainly consists of three parts:

[0136] First, the traditional semi-homomorphic encryption aggregation scheme is used when the local models of each client differ significantly. Each client first trains the global model locally, encrypts the updated gradient values ​​using a semi-homomorphic encryption algorithm, and then uploads them to the server. The server then aggregates the results and sends them back to the client for decryption.

[0137] Second, a fast aggregation scheme is used when the models of each client are relatively similar. The server selects some clients based on the statistical information distribution of the parameters of each client and interacts with them by passing some parameters to complete the fast aggregation.

[0138] Third, to ensure the efficiency of the training protocol in each round, the client first determines the applicable protocol for that round using a discrimination scheme before finalizing the protocol for each round. Then, a designed voting strategy determines the final protocol to be used. At the beginning of each round, each client first determines which stage of the protocol should be used for training based on its own training metrics and the given discrimination method, and then sends the determination result to the server. The server then determines the protocol for that round based on the uploaded results from each client and notifies each client. Afterwards, the client and server perform training and communication according to the protocol content.

[0139] After determining the protocol to be used in this round, the corresponding protocol is used to begin this round of training. In the early stages of model training, i.e., the stage where the model converges rapidly, or in the later stages when the model's training efficiency declines, an encrypted federated learning training method is adopted to fully aggregate the parameters of each client, enabling the model to converge quickly to a reasonable level.

[0140] This invention enables the server to efficiently train a neural network model based on data from multiple clients, while ensuring that client privacy is not compromised under certain attack intensity. Experimental results show that this method effectively reduces computational overhead during training while maintaining the final model performance.

[0141] To better understand the above technical solution, the following will refer to the appendix to the instruction manual. Figures 1-4 The specific implementation methods are described in detail below for the above technical solutions.

[0142] This embodiment provides a two-stage encrypted-plaintext hybrid federated learning protocol, consisting of a first-stage encrypted training protocol and a second-stage partially plaintext training protocol, as well as a discrimination strategy for selecting the current protocol. This embodiment aims to ensure the security of the federated learning process while simultaneously increasing efficiency.

[0143] Each client can locally determine the current protocol using a phase-based discrimination method: when the model converges quickly, the first-stage protocol is used for training; when the model's convergence speed begins to slow down or even converges to a minimum, the second-stage protocol is used for training. Considering the complexity of actual training, this implementation provides a single-machine method based on an approximate dataset to train a neural network model that takes the current model's metrics as input and outputs the protocol suitable for this round. Figure 4 As shown, the model training method is as follows:

[0144] 1) Naive threshold strategy

[0145] Select a series of test sets and train the model directly on these test sets using the first-stage protocol. This yields curves for several metrics, from which the inflection point of the model's convergence speed can be identified. Using these inflection points, set relevant threshold conditions. For example, if the metric curves show that the convergence speed slows significantly when the test accuracy exceeds 80%, then during formal training, switch to the second-stage protocol when the accuracy exceeds 80%, and revert to the first-stage protocol when the accuracy drops back to 80%.

[0146] 2) Model-based discrimination strategy

[0147] Since our goal is to predict the current training stage of the model based on its current parameters, accuracy, and loss function—which is exactly what a machine learning model can do—we can train such a machine learning model Λ using a small dataset that is not significantly different from the original dataset.

[0148] Let M1, M2, ..., M m It is a certain model θ p The parameters and metrics obtained from training m times on different datasets are then presented. This completes the training round. Based on the results, the stage of the model can be determined, generally falling into one of the following three categories:

[0149] 1. Rapid convergence phase: In this phase, the model is in the stage of rapid parameter convergence, which is characterized by a rapid increase in accuracy and a continuous decrease in the loss function;

[0150] 2. Slow convergence phase: The model as a whole still tends to converge, but the convergence speed is much slower than in the previous phase, and small fluctuations may occasionally occur.

[0151] 3. Long-tail effect stage: The model reaches the training bottleneck, its performance is basically stable, and the indicators may oscillate within a small range.

[0152] In summary, the following training method for the Λ model can be derived: Suppose we want to use the Λ model to predict another model θ. pIn federated learning, we collect the state at the current time step from the model θ. p Given m training iterations on m disjoint datasets partitioned by Ds, where each training iteration consists of n rounds, the results can be represented as M1, M2, ..., M... m It means that M i =(M i,1 M i,2 M i,n Let M = 1, 2, ..., m. To represent the rate of change, M is divided into several groups of fixed size β1, β2, ..., where each group contains training information from B consecutive rounds. Then β... i ={M (j,i-1)B+1 M j，iB For each group during training, based on the three cases from the previous model, a certain strategy is used to determine which state it belongs to, which is β. i Tag l i ∈{1, 2, 3}, then {β i , l i This constitutes a sample in the dataset used to train the Λ model. Let's assume the final dataset created in this way is D. M Finally, select a prediction model with a suitable structure and use D. M The dataset is used for training, thus obtaining the required Λ model.

[0153] Next, as follows Figure 1 As shown, each client sends its current stage to the server. The server coordinates the opinions, either by directly selecting the most popular option on an equal footing, or by comparing the gains and losses based on the current weight of each client. This embodiment provides a voting strategy, which will be adjusted according to the actual situation. Then, the server makes a comprehensive judgment to determine which stage's protocol to use in this round and sends the result back to each client. The specific steps are as follows:

[0154] Let the current round be t, and the previous round trained the global model θ. (t-1) The training hyperparameter is φ, the encryption / decryption public key is pk, the private key is sk, and the desired output is the current model θ. (t) .

[0155] For the client, without loss of generality, we consider the training process of the first phase protocol for the i-th client, D i It is its dataset or a subset thereof.

[0156] The process of client i executing the first phase protocol:

[0157] 1. The new model trained locally on the client side

[0158] 2. The model is determined by the model's parameters. Here, the parameters are compressed and encoded. The parameters used can be considered as floating-point numbers, which need to be mapped to non-negative integers within a reasonable range that can be encrypted.

[0159] 3. Obtained by encrypting with a public key.

[0160] 4. Send to the server

[0161] 5. Receive Enc(m) from the server (t) ,pk),

[0162] 6. Use the private key to decrypt and obtain m (t) ←Dec(Enc(m (t) ,pk),sk),

[0163] 7. Decode the compressed parameters to obtain θ (t) ←Decode(m (t) ),

[0164] The process of the server executing the first phase protocol:

[0165] 1. Collect the data uploaded by the i-th client. i = 1, 2, ..., N,

[0166] 2. This section describes the aggregation of ciphertext using homomorphic encryption addition.

[0167] 3.Enc(m (t) ,pk): Send the aggregated ciphertext to each client.

[0168] like Figure 2 As shown, each client compresses and encodes all parameters. The homomorphic encryption scheme used in this embodiment is the Paillier scheme for integers, as detailed in Background Technology 5. Therefore, it is necessary to first compress possible floating-point numbers into integers. Here, a simple compression scheme is given: the potentially long plaintext of length L is divided into segments of length B, and each segment is denoted as:

[0169] (a B-1 a B-2 …a0)2

[0170] This binary string can be directly treated as a single binary number, thus enabling bijection to integers. After compressing and encoding the parameters, encryption can be performed, and the ciphertext is then sent to the server. The server directly performs aggregation; due to the homomorphism of the Paillier algorithm, data is not leaked to the server, allowing the server to complete aggregation, specifically homomorphic addition and scalar multiplication. The server then sends the result back to the client, which decrypts it using its private key and then decompresses the code.

[0171] When the global model has converged to a certain extent, the uploaded parameters contain a large amount of repetition. The local model parameters obtained by each client after updating the global model are already quite similar, leading to a waste of local resources and communication bandwidth in traditional training. Therefore, for models with similar parameter distributions, a lightweight aggregation method is needed. This leads to a protocol that uses a second-stage approach when necessary to avoid the massive computational burden required for such large-scale encryption.

[0172] like Figure 3 As shown: When most clients have converged slowly, it means that for a total of m parameters, many clients may have reached very close understanding of many parameters. In terms of encoding, for a certain parameter, its high-order bits are the same across many clients, only the low-order bits may differ. In this case, the client only needs to know which parameters it represents, i.e., Sei of client i. i The server collects the index and sends the ciphertext of the high-order hash value of the index parameter to the server. Since the low-order bits, even if leaked, won't affect overall security, the client can directly send the plaintext low-order bits of all its parameters to the server. Then, for each parameter, the server uses the hash value to determine which clients have the same high-order bits for that parameter. The hash function guarantees that if the hash values ​​are the same, the high-order bits are also the same, and the low-order bits of that parameter can be obtained by averaging the low-order bits from these clients. This process is repeated for each parameter, and finally, the server obtains the low-order bits of each aggregated parameter. The high-order bits are then sent back to each client by compiling the received tuples.

[0173] In the second-phase protocol, it is assumed that all parameters of the model consist of K-bit fixed-point numbers, and the high K bits are... high The first bit is considered as the high-order bit of the parameter, and the remaining K bits are... low =KK high The bit is considered the low-order bit. Assume that for each K-bit parameter ω, its high-order and low-order bits are ω0 and ω1 respectively. hig ω low Then ω can be expressed as Simplified representation: ω=[ω high ωlow ],

[0174] The meanings of some mathematical symbols are given below for ease of explanation and elaboration in the following text:

[0175] • N: Number of clients

[0176] ·θ i ={θ i，1 θ i，2 , ..., θ i，m}, i = 1, 2, ..., N: The local model held by client i,

[0177] ·|ω|: The length of parameter ω, in bits.

[0178] ·ω i ∈θ i : A parameter in the client-side i-model,

[0179] ·high(ω): the height of the parameter K high A number composed of individual bits.

[0180] ·low(ω): The low K of the parameters low A number composed of individual bits.

[0181] ·[ω h ω l ]: Represents a K high The number of bits and another K low The result of concatenating the high and low bits of a number.

[0182] • hash(x): The hash function, shared by all clients.

[0183] ·Sel i The parameter index set represented by client i, initially empty.

[0184] Let the current position be in round t, and the global model obtained in the previous round be θ. (t-1) The training hyperparameter is φ, the encryption / decryption public key is pk, the private key is sk, and the desired output is the current model θ. (t) .

[0185] The core idea of ​​the second phase is lightweight aggregation. The final model consists of m parameters. If we consider the high and low bits of each parameter separately, training using the second-phase protocol requires that the high bits of the corresponding parameters from each client should tend to be consistent. Therefore, the aggregation method on the server side is no longer the direct addition as in the first-phase protocol. Instead, it directly selects the one with the highest frequency in the high bits as the representative and concatenates it with the average of the low bits from clients that have the same high bits as the representative. Clearly, only the low bits need to be calculated, and the low bits do not need to be encrypted, because the core of the parameters is the high bits, which greatly improves efficiency.

[0186] The second-stage protocol described in this implementation first collects the high and low bit parameters from each client, then determines the representative of the high bit of each parameter, and finally performs aggregation and training. The specific steps are as follows:

[0187] 1) Collection of high and low bit parameters

[0188] Let the server want to collect high and low bit statistics as s, l

[0189] For client i:

[0190] 1. The new model trained locally on the client side

[0191] 2. Extract the high-order bits.

[0192] 3.

[0193] The high-order bits still need to be encrypted. To ensure the server receives the number of clients with the same high-order bits, a hash function is used.

[0194] 4. The lower-order bits do not expose parameters and can be directly passed to the server;

[0195] 5. Send h to the server i , l i

[0196] For the server side:

[0197] Collect high and low byte statistics from the client:

[0198] h←(h1, h2, ..., h) N ), l←(l1, l2, ..., l N )

[0199] Statistical hash value based on parameters:

[0200] s j ←(h 1，j h2，j , ..., h N,j ), j = 1, 2, ..., m

[0201] s←(s1, s2, ..., s m )

[0202] 2) Selecting representatives

[0203] This specific implementation provides two methods for the representative selection stage: independent selection and top-K selection. The goal of both is to allow the server to obtain the representative of the j-th parameter and use Sel... i This represents the list of parameter indices represented by the i-th client and is then returned to the corresponding client.

[0204] Selecting parameters independently is relatively easy to implement; simply count the most frequent hash value for each parameter and record it as h. j Thus, the hash value of all j-th parameters equals h. j All clients can represent the j-th parameter. However, to ensure a relatively even distribution of client representation sets and correspondingly, a relatively even distribution of client execution time, we select Sel from the clients that can currently represent the j-th parameter. i The smallest one, and add j to Sel i Go to the middle.

[0205] Top-K selection requires multiple rounds, with each round yielding only one Sel. i And delete Sel i The parameters that are represented are selected, and the remaining parameters are selected repeatedly until the number of remaining parameters falls below the initially given threshold. The remaining unrepresented parameters are then set to 0. In each round, a temporary Sel is generated. i Unlike independent selection, for each parameter we consider the top K hash values ​​with the same value to represent it, and after iterating through the parameters once, we can obtain Sel. i Then take the set Sel with the largest number of elements. i That's the result of this round.

[0206] 3) Aggregation and Training

[0207] Once the representatives are determined, the client can send the corresponding encrypted parameters to the server based on the parameters it can represent. The server needs to determine which clients' low-order bits should participate in the aggregation and return the results to each client. At the same time, each client will also receive the high-order bits selected by the server. To prevent the client from knowing the source of the corresponding result, the server will shuffle the set. However, to help the client know which parameter's high-order bit it is, an index is added as a guide and included in the transmission.

[0208] In summary, the specific implementation method provided by this invention completes the scheme of a two-phase federated learning protocol based on homomorphic encryption plus a phase decision.

[0209] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements can be made without departing from the principle of the present invention, and these improvements should also be considered within the scope of protection of the present invention.

Claims

1. A secure federated learning method with a hybrid encrypted and text-to-text learning mode, characterized in that... This includes the encrypted training protocol in the first phase, the partial plaintext training protocol in the second phase, and the selection and discrimination of the current protocol; If the local model on the client converges quickly, a traditional semi-homomorphic encryption aggregation scheme is adopted. Each client first trains the global model on its own local machine, and then encrypts the updated gradient values ​​using a semi-homomorphic encryption algorithm before uploading them to the server. The server then aggregates the received data and sends it back to the client for decryption. If the convergence speed of the local model on the client starts to slow down or even converges to a minimum, a fast aggregation scheme is used. The server selects some clients based on the statistical information distribution of parameters of each client and interacts with them by passing some parameters to complete the fast aggregation. The client determines which stage of the protocol should be used in this round of training based on its own training metrics and the given discrimination method, and sends the determination result to the server. The server determines the protocol for this round based on the determination result uploaded by the client and notifies the client. The client and the server then train and communicate according to the protocol content to complete this round of training.

2. The secure federated learning method with encrypted and text-to-text hybrid learning mode according to claim 1, characterized in that: The first phase of the encrypted training protocol includes the following steps: Let the current round be t, and the global model was trained in the previous round. The training hyperparameters are Encryption and decryption public keys Private key We hope to output the model for this round. , For the client, the first Each client performs the first phase of protocol training. The client is for its dataset or a subset thereof. The process of the first phase agreement includes: (1) The new model trained locally by the client; (2) The model is determined by its parameters, which are compressed and encoded here. (3). Obtained by encrypting with the public key: ; (4) Send to the server: ; (5) Receive from the server: ; (6) Decrypt using the private key to obtain: ; (7) Decoding the compression parameters yields: ; The process of the server performing the first phase protocol includes: (1) Collect the data uploaded by the i-th client. ; (2) Homomorphic encryption addition is used to aggregate the ciphertext; (3) Send the aggregated ciphertext to each client.

3. The secure federated learning method with encrypted and text-to-text hybrid learning mode according to claim 1, characterized in that: The second phase protocol assumes that all parameters are determined by... Composed of fixed-point numbers of digits, the high-order digits are... Consider the high-order bits of the parameter, the remainder The position is considered low; Suppose for each parameters Its high position and status are respectively ,So Represented as Simplified to ; Let the current position be in round t, and the global model obtained in the previous round be... The training hyperparameters are Encryption and decryption public keys Private key Output the current model .

4. The secure federated learning method with encrypted and text-to-text hybrid learning mode according to claim 3, characterized in that: The second-phase protocol's plaintext training protocol includes the following steps: 1) Collect the high and low bit parameters from each client; Suppose the server wants to collect the high and low digit statistical values ​​respectively. ; For the client : The new model trained locally on the client side. Its dataset or a subset thereof; :Retrieve the high-order bits; A hash function is used to encrypt the high-order bits so that the server can obtain the number of clients with the same high-order bits. The low-order bits are directly passed to the server without exposing the parameters. (5) Send to the server ; For the server side: Collect high and low byte statistics from the client: ； Statistical hash value based on parameters: ， ； 2) Determine the representative of the higher-order bits of each parameter. Use independent selection or The selection method allows the server to obtain the first... Representatives of each parameter, and using Indicates the first The list of parameter indices representing each client is then returned to the corresponding client. The independent selection method involves directly selecting the parameter with the highest frequency from the statistical hash values. All the The hash value of each parameter equals All clients can represent the first There are several parameters; to ensure that the representative sets of each client are relatively average and that the time consumed by each client is relatively average, the current representative set is selected. The smallest of the parameters in the client. and put join in Go to the middle; The The selection method uses multiple rounds, with only one result obtained in each round. Delete The representative parameters are selected, and the remaining parameters are selected repeatedly until the number of remaining parameters falls below the initially set threshold. The remaining unrepresented parameters are then set to 0. In each round, temporary parameters are generated. The top K hash values ​​of each parameter that have the same hash value represent the result after iterating through all the parameters. Then take the set with the largest number of elements. As a result of this round; 3) Finally, perform aggregation and training. Once the representatives are determined, the client sends the corresponding encrypted parameters to the server based on the parameters it can represent. The server determines the low-order bits of the clients that need to participate in the aggregation and returns the results to each client. At the same time, each client will also receive the high-order bits selected by the server. The server shuffles the set of high-order bits and adds a new index as a guide to participate in the transmission.

5. The secure federated learning method with encrypted and text-to-text hybrid learning mode according to claim 1, characterized in that: The training of the current protocol selection and discrimination model adopts a naive threshold strategy, and the specific steps include: 1) Select a series of test sets, and train the model directly on the test sets using the protocol of the first stage to obtain curves of several indicators. From the curves, obtain the inflection point of the model's convergence speed. 2) Use the obtained inflection point to set a threshold condition. If the test accuracy is higher than the threshold, select the second-stage protocol for training. If the test accuracy is lower than the threshold, select the first-stage protocol for training.

6. The secure federated learning method with encrypted and text-to-text hybrid learning mode according to claim 1, characterized in that: The training of the current protocol selection discrimination model is based on the discrimination strategy learned by the model. The model predicts the original model The current state in federated learning; The specific steps include: Collect original models exist Divided On a set of non-intersecting datasets The training results A dataset with the same distribution as the actual test dataset; Assume each training session consists of n rounds, and the original model... The parameters and metrics obtained from training m times on different datasets are used as follows: It means that among them , i=1, 2, … , m; Divide the index M into several groups of fixed size. Assuming each group contains training information from B consecutive rounds, then j = 1, 2, 3, ..., m; For each training group, the original model is judged based on the obtained parameters and metrics. The state in which it is Label If ∈ {1, 2, 3}, then { This constitutes the training. A sample from the dataset used by the model; based on the final generated dataset Choose a prediction model with a suitable structure and use it. The dataset is used for training, thus obtaining the desired result. The model; 1, 2, and 3 correspond to the following three different state stages: (1). Fast convergence stage: In this stage, the model is in the stage of rapid parameter convergence, the accuracy increases rapidly and the loss function decreases continuously; (2). Slow convergence stage: The model as a whole still tends to converge, but the convergence speed is much slower than that of the fast convergence stage, or there may be small fluctuations. (3) Long tail effect stage: The model reaches the training bottleneck, the performance tends to stabilize, and the index oscillates within a small range.

7. A secure federated learning system with a hybrid encrypted-verb learning mode, characterized in that, include: The client obtains parameters from the server using the method described in any one of claims 1-6, then uses these parameters to train the model locally, and finally sends the trained parameters to the server. The server is used to receive parameters sent by each client, aggregate them, and then send the aggregated results back to each client.

Images