Data auditing system, method, computer device and medium based on federated learning

Abstract

The application discloses a kind of data audit systems, methods, equipment and medium based on federal learning, the system includes: key management module, model buyer node, computing node, aggregation node and agent node cluster;Wherein, the key generated by key management module includes shard public key, shard private key, joint private key, joint public key;Model buyer node is used to issue to-be-trained model parameter and provide test set;Each computing node carries out local model training, obtains local gradient, and uses the shard public key distributed by the agent node after registration to carry out gradient encryption, obtains local gradient ciphertext;Aggregation node is used to decrypt local gradient ciphertext and homomorphic aggregation, obtains aggregation gradient, and encrypts aggregation gradient, obtains aggregation gradient ciphertext;Agent node cluster is used to decrypt local gradient ciphertext and aggregation gradient ciphertext, and test is carried out through the obtained decrypted plaintext, to determine parameter audit result.The security and efficiency of data audit are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, in particular to a data auditing system and method based on federated learning, a computer device and a medium. BACKGROUND

[0002] Federated learning privacy protection technology can meet user machine learning modeling, training and prediction under the premise of ensuring the safety and privacy of participating parties. Federated learning does not need to aggregate source data to form training data sharing, reducing the risk of data leakage. Federated learning uses multi-party secure computing to jointly train the model by multiple participating parties, solving the machine learning problem in the data island situation. Due to the characteristics of multi-party participation and data encryption, real-time and parallel auditing and monitoring are required during the specific federated learning process, and the auditing of interaction data directly affects the model results of federated learning.

[0003] In some existing implementations, some of them implement management of data transmission processes between participating parties of federated learning by constructing auditing systems for different participating parties; some of them construct auditing systems for malicious behaviors of participating parties of federated learning through contribution comparison mechanisms; some of them design key management modules that can meet the requirements of various federated learning frameworks and software products for standardization and security, and can effectively record and manage key creation and deletion operations, and facilitate subsequent security auditing requirements under the premise of considering the differences between different participating parties; some of them guarantee the orderly execution and security of the execution process in the case of multiple participating parties in federated learning tasks through one or more of control flow auditing, algorithm flow auditing and data flow auditing, through different auditing levels and setting independent auditing mechanisms.

[0004] The inventors found that the above-mentioned implementations at least have the following problems in the process of implementing the present application:

[0005] 1) Malicious participating parties may submit false gradient parameters, and due to the encryption of interaction data, it is difficult to investigate its authenticity;

[0006] 2) Data auditing is closely coupled with federated learning, and the auditing process is mostly interactive. Data auditing by local participating parties will consume too much local computing resources, resulting in reduced efficiency. SUMMARY

[0007] The embodiments of the present application provide a data auditing system and method based on federated learning, a computer device and a storage medium to improve the security and efficiency of data review.

[0008] To solve the above technical problems, the embodiment of the present application provides a data auditing system based on federated learning, comprising a key management module, a model buyer node, a computing node, an aggregation node and a proxy node cluster; wherein,

[0009] The key management module is used for generating, storing and destroying keys, the generated keys comprising a shard public key, a shard private key, a joint private key and a joint public key, the joint public key being provided to the aggregation node, and the shard public key, the shard private key and the joint private key being distributed to the proxy node cluster;

[0010] The model buyer node is used for publishing a to-be-trained model parameter and a test set, and purchasing a joint private key from the proxy node cluster for decrypting an aggregated gradient ciphertext for a federated learning task passing an audit;

[0011] Each computing node performs local model training to obtain a local gradient, and uses a shard public key distributed by a registered proxy node to perform gradient encryption to obtain a local gradient ciphertext, and uploads the local gradient ciphertext to the aggregation node and the proxy node cluster;

[0012] The aggregation node is used for decrypting and homomorphically aggregating the local gradient ciphertext to obtain an aggregated gradient, encrypting the aggregated gradient using the joint public key to obtain an aggregated gradient ciphertext, and sending the aggregated gradient ciphertext to the proxy node cluster;

[0013] The proxy node cluster respectively decrypts each local gradient ciphertext and aggregated gradient ciphertext using a shard private key and a joint private key to obtain decrypted plaintext, and updates a to-be-trained model through the decrypted plaintext, tests the updated to-be-trained model using a test set to obtain a local score and an aggregated score, and determines a parameter audit result by comparing an average score of a plurality of computing nodes with the aggregated score.

[0014] Optionally, the key management module comprises:

[0015] A key generation unit is configured to generate a shard key pair and a joint key pair, and save them in a key space, wherein the shard key pair comprises a shard private key and a shard public key, and the joint key pair comprises a joint public key and a joint private key;

[0016] The key storage unit is configured to generate a key space in response to a request of the proxy node cluster or the aggregation node, wherein the key space is used for storing the generated keys and state information of the keys, and the key state is determined according to a federated learning task state corresponding to the keys and a security audit demand corresponding to the federated learning task;

[0017] A key service processing unit is configured to generate, according to a request of the proxy node, a shard key pair and a joint key pair by the key generation unit, save each key state to a key space where each key is located, and read the shard key pair and the joint key pair saved in the key space in the key storage unit.

[0018] Optionally, the computing node comprises:

[0019] An authentication unit is configured to initiate a training application to the proxy node cluster, and assign an identifier pointing to itself to each computing node after identity authentication is passed.

[0020] A first receiving unit is configured to receive an initial parameter of a to-be-trained model and a shard public key obtained from the proxy node cluster.

[0021] A training unit is configured to train the to-be-trained model by using local data and the initial parameter of the to-be-trained model to obtain a local gradient.

[0022] An uploading unit is configured to encrypt the local gradient and the identifier by the shard key pair to obtain local gradient ciphertext, and upload the local gradient ciphertext to the aggregation node and the proxy node cluster.

[0023] Optionally, the aggregation node comprises:

[0024] A second receiving unit is configured to receive the local gradient ciphertext uploaded by the computing node and the joint public key distributed by the key management module after the computing node completes local training by identity authentication.

[0025] An aggregation unit is configured to homomorphically aggregate the local gradient ciphertext uploaded by each computing node, and decrypt the aggregated gradient.

[0026] A first sending unit is configured to encrypt the aggregated gradient by the joint public key to obtain aggregated gradient ciphertext, and send the aggregated gradient ciphertext to the proxy node cluster.

[0027] Optionally, the proxy node cluster comprises:

[0028] A third receiving unit is configured to receive the shard key pair and the joint private key distributed by the key management module, receive the local gradient ciphertext of the computing node and the aggregated gradient ciphertext of the aggregation node, and receive the initial parameter of the to-be-trained model and a plurality of test sets published by a model buyer node.

[0029] A second sending unit is configured to send model information and key information.

[0030] An audit unit is configured to perform malicious parameter auditing.

[0031] Optionally, the second sending unit comprises:

[0032] The allocation subunit is used to allocate a proxy node to the computing node after the computing node is authenticated, and send the model parameters to be trained and the shard public key to the computing node.

[0033] An iterative subunit is used to send the audited aggregated gradient ciphertext to each of the computing nodes in each iteration.

[0034] The sending sub-unit is used to send the encrypted model parameters after training is completed to the model buyer node.

[0035] Optionally, the audit unit includes:

[0036] The local score test subunit is used to decrypt the local gradient ciphertext using the fragmented private key, update the parameters of the model to be trained based on the local gradient provided by the computing node pointed to by the identifier, test the local gradient using the test set, obtain the local score, and record the identifier of the computing node.

[0037] The aggregate score test subunit is used to decrypt the aggregate gradient ciphertext using the joint private key, update the parameters of the model to be trained based on the decrypted aggregate gradient, and test the aggregate gradient using the test set to obtain the aggregate score.

[0038] The malicious parameter audit sub-unit determines whether there is any behavior of uploading false parameters by comparing the aggregated score with the average local score of several computing nodes.

[0039] To locate abnormal nodes, when averaging scores related to different subsets, if the model accuracy is abnormal, the local scores of several participants in different subsets of the set are averaged and tested using a test set to obtain the average scores of several subsets. By comparing the differences in nodes and scores between subsets, abnormal nodes are located, and feedback and penalties are applied to abnormal nodes.

[0040] To address the aforementioned technical problems, this application provides a data auditing method based on federated learning, applied to the aforementioned data auditing system based on federated learning. The data auditing method based on federated learning includes:

[0041] A proxy node cluster is allocated to each computing node, and a key management module is used to distribute sharded key pairs that can be homomorphically aggregated to each proxy node in the proxy node cluster. The corresponding joint private key is sent to the proxy node cluster, and the joint public key is sent to the aggregation node.

[0042] The model buyer node publishes the parameters of the model to be trained and several test sets to the agent node cluster;

[0043] After the identity signature passes, the computing node registers with the proxy nodes, obtains a multi-key homomorphic encryption shard key pair, and requests the to-be-trained model parameters and task requirements;

[0044] The computing node performs local training to obtain local gradients, and uploads the local gradient information to the aggregation node in a homomorphic encryption manner according to a traditional federated learning process and to the proxy node cluster in an encryption manner using a shard public key;

[0045] After the aggregation node homomorphically aggregates the gradient ciphertext of the computing node, the plaintext is obtained after decryption, and the aggregated gradient is encrypted using the joint public key distributed by the key management module and sent to the proxy node cluster for updating of the aggregated gradient to obtain an aggregated score for subsequent positioning of malicious nodes;

[0046] The proxy node cluster obtains the gradient ciphertext, decrypts and updates the model, scores the model using a test set, and obtains local scores of each computing node; the model is updated using the average aggregated gradient, and an aggregated score is obtained; the local score and the aggregated score are compared to determine whether there is a malicious parameter, and the average scores of different proxy node subsets are compared with the aggregated score to determine a malicious node;

[0047] In each iteration, the aggregated gradient after auditing is sent to each computing node by the proxy node cluster, the computing node updates the model using the gradient, and the next iteration begins; if the auditing fails, the current training is terminated;

[0048] After each iteration of federated learning passes the audit, the current federated learning training is completed, and the model buyer sends the model parameters that pass the audit and training to the model buyer using a joint public key encryption;

[0049] The model buyer node purchases a joint key private key from the proxy node cluster for decrypting the aggregated gradient ciphertext.

[0050] To solve the above technical problems, the embodiment of the application further provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the above-mentioned federated learning-based data auditing method when executing the computer program.

[0051] To solve the above technical problems, the embodiment of the application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the above-mentioned federated learning-based data auditing method.

[0052] The embodiment of the present application provides a data auditing system and method based on federated learning, a computer device and a storage medium, and the system comprises a key management module, a model buyer node, a computing node, an aggregation node and a proxy node cluster; wherein the key management module is used for generating, storing and destroying keys, the generated keys comprise a shard public key, a shard private key, a joint private key and a joint public key, the joint public key is provided to the aggregation node, and the shard public key, the shard private key and the joint private key are distributed to the proxy node cluster; the model buyer node is used for publishing a to-be-trained model parameter and a test set, and for purchasing a joint private key from the proxy node cluster for decrypting an aggregated gradient ciphertext for a federated learning task passing an audit; each computing node performs local model training to obtain a local gradient, and performs gradient encryption using the shard public key distributed by the registered proxy node to obtain a local gradient ciphertext, and uploads the local gradient ciphertext to the aggregation node and the proxy node cluster; the aggregation node is used for decrypting and homomorphically aggregating the local gradient ciphertext to obtain an aggregated gradient, encrypting the aggregated gradient using the joint public key to obtain an aggregated gradient ciphertext, and sending the aggregated gradient ciphertext to the proxy node cluster; and the proxy node cluster respectively decrypts each local gradient ciphertext and aggregated gradient ciphertext using the shard private key and the joint private key to obtain decrypted plaintext, and updates the to-be-trained model through the decrypted plaintext, tests the updated to-be-trained model using the test set to obtain a local score and an aggregated score, and compares the average score of a plurality of computing nodes with the aggregated score to determine a parameter auditing result. Through the cooperative processing of the key management module, the model buyer node, the computing node, the aggregation node and the proxy node cluster, no additional computing overhead of the computing node is required, malicious behaviors of an enemy are prevented, any participant in the federated learning will be found in the auditing process if the participant has a malicious behavior, especially in the case that a plurality of participants cooperatively train and apply a model, the malicious attack defense mechanism for the purpose of destroying the federated learning task is enhanced. The security and efficiency of data auditing are improved. BRIEF DESCRIPTION OF DRAWINGS

[0053] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without any creative labor.

[0054] Figure 1 is an architecture diagram of the data auditing system based on federated learning of the present application;

[0055] Figure 2 is a structural schematic diagram of one embodiment of the computer device according to the present application. Detailed Implementation

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0057] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Please see Figure 1 , Figure 1 This embodiment illustrates a data auditing system based on federated learning, comprising: a key management module, model buyer nodes, computing nodes, aggregation nodes, and a proxy node cluster; wherein, Pu (Pu1, Pu2, Pu3, Pu4...Pun) with an outer circle represents a sharded public key, Pu with an outer triangle represents a combined public key, Pr with an outer circle represents a sharded private key, and Pr with an outer triangle represents a combined private key. After generating the sharded public key, combined public key, sharded private key, and combined private key, the key management module distributes the combined public key to the aggregation nodes and distributes the sharded private key, combined private key, and sharded public key to the proxy nodes in the proxy node cluster;

[0060] The key management module is used to generate, store, and destroy keys. The generated keys include a sharded public key, a sharded private key, a combined private key, and a combined public key. The combined public key is provided to the aggregation node, and the sharded public key, the sharded private key, and the combined private key are distributed to the proxy node cluster.

[0061] The model buyer node is configured to publish the to-be-trained model parameters and provide a test set, and purchase a joint private key for the agent node cluster to decrypt the aggregated gradient ciphertext for a federated learning task that passes an audit;

[0062] Each of the computing nodes performs local model training to obtain a local gradient, and encrypts the local gradient using a shard public key distributed by the registered agent node to obtain local gradient ciphertext, and uploads the local gradient ciphertext to the aggregation node and the agent node cluster;

[0063] The aggregation node is configured to decrypt and homomorphically aggregate the local gradient ciphertext to obtain an aggregated gradient, encrypt the aggregated gradient using the joint public key to obtain aggregated gradient ciphertext, and send the aggregated gradient ciphertext to the agent node cluster;

[0064] The agent node cluster respectively decrypts each local gradient ciphertext and aggregated gradient ciphertext using a shard private key and a joint private key to obtain decrypted plaintext, and updates the to-be-trained model through the decrypted plaintext, tests the updated to-be-trained model using a test set to obtain a local score and an aggregated score, and determines a parameter audit result by comparing an average score of a plurality of computing nodes with the aggregated score.

[0065] The decrypted plaintext includes local gradient plaintext and aggregated gradient plaintext, and updating the to-be-trained model through the decrypted plaintext is specifically: updating the to-be-trained model using each local gradient plaintext to obtain a local score, and updating the to-be-trained model using a unique aggregated gradient to obtain an aggregated score.

[0066] Any parameter in the entire system is transmitted in the form of ciphertext, and the computing nodes include, when uploading the local gradient: in accordance with a conventional federated learning process, each participant homomorphically encrypts and uploads a local gradient to the aggregation node for homomorphic aggregation; meanwhile, each computing node encrypts its local gradient using a shard public key and uploads the local gradient to the allocated agent node.

[0067] The data auditing system based on federated learning in the embodiment comprises a key management module, a model buyer node, a computing node, an aggregation node and a proxy node cluster; wherein the key management module is used for generating, storing and destroying keys, the generated keys comprising a shard public key, a shard private key, a joint private key and a joint public key, the joint public key being provided to the aggregation node, and the shard public key, the shard private key and the joint private key being distributed to the proxy node cluster; the model buyer node is used for publishing a to-be-trained model parameter and a test set, and for purchasing a joint private key from the proxy node cluster for decrypting an aggregated gradient ciphertext for a federated learning task that passes auditing; each computing node performs local model training to obtain a local gradient, and uses the shard public key distributed by the registered proxy node to perform gradient encryption to obtain a local gradient ciphertext, and uploads the local gradient ciphertext to the aggregation node and the proxy node cluster; the aggregation node is used for decrypting and homomorphically aggregating the local gradient ciphertext to obtain an aggregated gradient, encrypting the aggregated gradient using the joint public key to obtain an aggregated gradient ciphertext, and sending the aggregated gradient ciphertext to the proxy node cluster; the proxy node cluster respectively decrypts each local gradient ciphertext and aggregated gradient ciphertext using the shard private key and the joint private key to obtain decrypted plaintext, and updates the to-be-trained model through the decrypted plaintext, tests the updated to-be-trained model using the test set to obtain a local score and an aggregated score, and determines a parameter auditing result by comparing the average score of a plurality of computing nodes with the aggregated score. Through the cooperative processing of the key management module, the model buyer node, the computing node, the aggregation node and the proxy node cluster, without increasing the additional computing overhead of the computing node, the malicious behavior of an adversary is prevented, so that any participant in federated learning with malicious behavior will be discovered in the auditing process, especially in the case of training and application of a model involving multiple participants, the malicious attack defense mechanism for the purpose of destroying the federated learning task is enhanced. The security and efficiency of data auditing are improved.

[0068] Further, the key management module comprises:

[0069] a key generation unit configured to generate a shard key pair and a joint key pair, and save them in a key space, the shard key pair comprising a shard private key and a shard public key, and the joint key pair comprising a joint public key and a joint private key;

[0070] the key storage unit is configured to generate a key space in response to a request of the proxy node cluster or the aggregation node, the key space being used for storing the generated keys and state information of the keys, and the key state being determined according to a federated learning task state corresponding to the keys and a security auditing requirement corresponding to the federated learning task;

[0071] A key service processing unit is configured to generate a shard key pair and a joint key pair according to a request of the proxy node, save each key state to a key space where each key is located, and read the shard key pair and the joint key pair saved in the key space in the key storage unit.

[0072] Specifically, the key management module records and manages operations such as creation and deletion of keys and updates the usage state of the keys in time; different individuals of the same participant may create or delete keys on behalf of the participant at different times, and these individuals may have different permissions or isolation requirements, and effective key management records are implemented for this problem.

[0073] Optionally, for the model buyer node, specifically comprising:

[0074] An initialization module is configured to set initial parameters of a to-be-trained model of this federated learning and training task requirements, and set a plurality of test sets according to an online prediction data set;

[0075] A sending module is configured to send the initial parameters, the task requirements, and the plurality of test sets in the initialization module to the proxy node cluster;

[0076] A prediction module is configured to purchase a joint private key decryption model ciphertext from the proxy node cluster to obtain a new model parameter to update a model for actual prediction.

[0077] Further, the computing node comprises:

[0078] An authentication unit is configured to initiate a training application to the proxy node cluster, and assign an identifier pointing to itself to each computing node after identity authentication is passed;

[0079] A first receiving unit is configured to receive initial parameters of a to-be-trained model and shard public keys obtained from the proxy node cluster;

[0080] A training unit is configured to train the to-be-trained model using local data and the initial parameters of the to-be-trained model to obtain a local gradient;

[0081] An uploading unit is configured to encrypt the local gradient and the identifier by the shard key pair to obtain local gradient ciphertext, and upload the local gradient ciphertext to the aggregation node and the proxy node cluster.

[0082] Specifically, the uploading unit uploads the local gradient homomorphically encrypted to the aggregation node for homomorphic aggregation according to a conventional federated learning process; meanwhile, each computing node encrypts its local gradient using the shard public key and uploads the local gradient to the corresponding proxy node.

[0083] Further, the aggregation node comprises:

[0084] a second receiving unit, configured to receive the local gradient ciphertext uploaded by the computing node and the joint public key distributed by the key management module after the computing node completes local training through identity authentication;

[0085] an aggregation unit, configured to decrypt the local gradient ciphertext uploaded by each computing node after homomorphic aggregation of the local gradient ciphertext, to obtain aggregated gradient;

[0086] a first sending unit, configured to encrypt the aggregated gradient using the joint public key to obtain aggregated gradient ciphertext, and send the aggregated gradient ciphertext to the proxy node cluster.

[0087] Further, the proxy node cluster comprises:

[0088] a third receiving unit, configured to receive the sharded key pair and the joint private key distributed by the key management module, receive the local gradient ciphertext of the computing node and the aggregated gradient ciphertext of the aggregation node, and receive the initial parameters of the model to be trained and a plurality of test sets published by the model buyer node;

[0089] a second sending unit, configured to send the model information and the key information;

[0090] an audit unit, configured to perform malicious parameter auditing.

[0091] Further, the second sending unit comprises:

[0092] an allocation subunit, configured to allocate a proxy node pointed to by the computing node after the computing node passes authentication, and send the model parameters to be trained and the sharded public key to the computing node;

[0093] an iteration subunit, configured to issue the aggregated gradient ciphertext that passes the audit to each computing node in each iteration;

[0094] a sending subunit, configured to send the model parameter ciphertext after training to the model buyer node.

[0095] Further, the audit unit comprises:

[0096] a local score test subunit, configured to decrypt the local gradient ciphertext using the sharded private key, update the model parameters to be trained according to the local gradient provided by the computing node pointed to by the identifier, test the local gradient using the test set to obtain a local score, and record the identifier of the computing node;

[0097] an aggregated score test subunit, configured to decrypt the aggregated gradient ciphertext using the joint private key, update the model parameters to be trained according to the aggregated gradient obtained by decryption, and test the aggregated gradient using the test set to obtain an aggregated score;

[0098] The audit malicious parameter subunit judges whether there is an uploading of false parameter behavior by comparing the aggregation score with the average local score of a plurality of computing nodes.

[0099] The abnormal node is located by comparing the node difference and the score difference between the subsets, and the abnormal node is fed back and punished.

[0100] The number of the plurality of computing nodes can be set according to actual needs, and is not specifically limited here.

[0101] In the audit process of the ciphertext interaction, no additional computing overhead of the participants is required for data auditing in the embodiment; meanwhile, the malicious gradient ciphertext uploaded by each participant is audited in real time during the training process of each round of joint modeling, thereby improving the timeliness of abnormal data detection.

[0102] In another embodiment of the present application, a data auditing method based on federated learning is also provided, which is applied to the above-mentioned data auditing system based on federated learning and specifically includes:

[0103] Step 1: Assign an agent node cluster to each computing node, and distribute a multi-key homomorphic aggregation sharded key pair to each agent node in the agent node cluster by using a key management module, and send the corresponding joint private key to the agent node cluster and the joint public key to the aggregation node.

[0104] Specifically, in step 1, a blockchain network is constructed and agent node clusters are assigned to the computing nodes, a key management module distributes a multi-key homomorphic aggregation sharded key pair to each agent node, and the corresponding joint key is sent to the agent node cluster, and the joint public key is sent to the aggregation node, specifically including: constructing a blockchain network and associating an agent node cluster; generating a sharded key pair and a joint key pair; distributing the sharded key pair and the joint key pair.

[0105] The blockchain network is constructed and the agent node cluster is associated by using a super account book to construct a right blockchain, and in order to improve the efficiency of the blockchain, a proof of authority (PoA) consensus algorithm is used. The agent nodes are associated for the federated learning computing nodes.

[0106] The generation of the shard key pair and the joint key pair generates the shard key pair and the joint key pair of the response agent node, the joint public key of the response aggregation node, and saves them in the key space visible only to the agent node or the key space visible only to the aggregation node. The joint key pair is calculated by the key management module according to the multi-key homomorphic aggregation shard key pair, and the agent node cluster cannot calculate the joint key pair according to each shard key pair. The generated key state is in the available state at this time. It should be noted that, in order to ensure security, permissions are set for different agent nodes, and the key space accessible by the agent node is set as the visible key space corresponding to the agent node.

[0107] The distribution of the shard key pair and the joint key pair is performed after the key management module receives the request of the agent node cluster. The key service module reads the shard key pair and the joint key pair in the key storage module. The multi-key homomorphic aggregation shard key pair in the key space is distributed to each agent node, and the joint private key is distributed to the agent node cluster; then the joint public key is sent to the aggregation node for subsequent encryption and aggregation of the gradient. After the distribution of each key is completed, the key state changes to the occupied state.

[0108] Step 2: The model buyer node publishes the to-be-trained model parameters and several test sets to the agent node cluster.

[0109] Specifically, the model buyer node publishes the to-be-trained model parameters and provides the test set by initializing the model parameters and the task publishing.

[0110] Specifically, initialization is performed by the initialization module. The model buyer node sets the initial parameters of the to-be-trained model and the training task requirements, such as the machine learning model and the initial parameters of the model for this federated modeling. The model buyer node sets several test sets according to the data set for online prediction. According to the training set data in the data set for online prediction, the test set is emulated. A sending module is called to publish the initial parameters, task requirements, and several test sets to the agent node cluster.

[0111] Step 3: After the identity signature is passed, the computing node registers with each agent node, obtains the multi-key homomorphic encryption shard key pair, and requests the to-be-trained model parameters and task requirements.

[0112] Specifically, step 3 includes:

[0113] When each computing node submits a training participation application to the agent node, the key signature verification mechanism uses the private key in the digital signature algorithm to sign the application message for identity authentication. After the identity authentication is passed, an identifier pointing to only one agent node is assigned to each computing node.

[0114] After the identity authentication of each computing node is passed, each computing node receives the public key of the shard key and the to-be-trained model parameter obtained from the proxy node cluster.

[0115] Step 4: The computing node performs local training to obtain a local gradient, and uploads the local gradient information to the aggregation node and the proxy node cluster using the shard public key in a homomorphic encryption manner according to a traditional federated learning process.

[0116] Specifically, in step 4, local gradient testing and local gradient uploading are included.

[0117] The local gradient testing refers to that, after the identity signature of the computing node is passed, the computing node is registered with each proxy node, obtains a multi-key homomorphic encryption shard key pair from the proxy node cluster, and requests the to-be-trained model parameter to be trained, and then performs model training according to the obtained model parameter and local data to obtain a local gradient.

[0118] The local gradient uploading refers to that, according to the traditional federated learning process, each computing node uploads the local gradient and identifier to the aggregation node in a homomorphic encryption manner for homomorphic aggregation; then each computing node uses the shard public key to homomorphic encrypt the gradient and identifier to obtain local gradient ciphertext, and uploads the local gradient ciphertext to the corresponding proxy node.

[0119] Step 5: After the aggregation node homomorphic aggregates the gradient ciphertext of the computing node, the plaintext is obtained after decryption, and the aggregated gradient is encrypted using the joint public key distributed by the key management module and sent to the proxy node cluster for updating of the aggregated gradient to obtain an aggregated score for subsequent positioning of a malicious node.

[0120] Step 6: The proxy node cluster obtains the gradient ciphertext decryption and updates the model, uses a test set to score the model, obtains a local score of each computing node, subsequently updates the model using the average aggregated gradient and obtains an aggregated score, and judges whether there is a malicious parameter by comparing the local score with the aggregated score, and determines the malicious node by comparing the average score of different proxy node subsets with the aggregated score.

[0121] Specifically, in step 6, local score testing, aggregated score testing, auditing whether there is a malicious node, and positioning of the malicious node are included.

[0122] The local score testing refers to that the local gradient ciphertext is decrypted by the local shard private key, the to-be-trained model parameter is updated according to the local gradient provided by the computing node indicated by the identifier, the updated model is tested using a test set, a local score is obtained, and the identifier of the computing node is recorded.

[0123] The aggregation score test is to decrypt the aggregation gradient ciphertext with the joint private key, update the to-be-trained model parameters according to the obtained aggregation gradient, and test the updated model using the test set to obtain the aggregation score.

[0124] The audit of whether there is a malicious node is to compare the aggregation score with the average local score of a plurality of computing nodes to determine whether there is a false parameter uploading behavior. The aggregation score is compared with the average local score (i.e., the average value of the local scores obtained by all proxy nodes), and it is determined whether the aggregation score is significantly less than the lowest local score of a subset, thereby achieving the audit of whether there is a malicious node. For example, there are three participants ABC, and the local score obtained by the proxy node of A indicates that the gradient makes the model accuracy reach 0.8, similarly, B has 0.9, and C has 0.85. The aggregation node aggregates the gradients of ABC (for example, the simplest average aggregation), and then updates the to-be-trained model using the aggregated gradient to obtain a new aggregation score (for example, 0.7, i.e., the score of the aggregation gradient ciphertext). Since 0.7 is lower than the values (0.8, 0.9, 0.85) sent by ABC, it is considered that the score of a participant in ABC is not that high (i.e., a participant uploads a false gradient), and there is a malicious node. For example, the accuracy of A is 0.6, but A sends a result of 0.8 for federated modeling, which is obviously a malicious behavior of A. The audit of the present application is to audit the malicious parameter uploaded by the adversary participant.

[0125] The positioning of the malicious node refers to that when the average scores of different subsets of the proxy node cluster are obtained, if the model accuracy is abnormal, the average values of the local scores of a plurality of participants in different subsets are obtained and tested using the test set to obtain the average scores of a plurality of subsets. The difference between the nodes and the scores in the subsets is compared to locate the abnormal node, and the abnormal node is fed back and punished.

[0126] When the proxy node audits each set, the score of the aggregation gradient ciphertext is compared with the local score of the gradient ciphertext participating in the aggregation. If the aggregation gradient score decreases by more than a certain threshold compared with all local gradient scores, it indicates that the current federated modeling is abnormal, and the current federated modeling should be stopped immediately. The aggregation node compares the difference between the nodes and the scores in different subsets. If the scores of a plurality of subsets of a node are less than a certain threshold, the node is located as an abnormal node.

[0127] Step 7: In each iteration, the aggregation gradient after the audit is issued to each computing node by the proxy node cluster, the computing node updates the model using the gradient, and the next iteration is started; if the audit fails, the current training is terminated.

[0128] It should be noted that steps four, five, six and seven are performed once per iteration in the training.

[0129] Step 8: After each iteration of federated learning is audited, the current federated learning training is completed, and the proxy node cluster sends the model parameters audited and trained to the model buyer using the joint public key for encryption.

[0130] Specifically, if each iteration of federated learning training is performed under audit, it means that the current federated learning training is completed. The local node with the highest score attempts to write the set of computing nodes and all gradient ciphertexts, local scores, and identifiers pointing to each computing node into a new block in the proxy node cluster; call the iteration subunit to publish the model, and the proxy node cluster encrypts the model parameters audited and trained using the joint public key to obtain the final model ciphertext, and sends the model ciphertext to the model buyer.

[0131] Step 9: The model buyer node purchases the joint private key from the proxy node cluster for decrypting the aggregated gradient ciphertext.

[0132] Specifically, when the model buyer obtains the new model ciphertext from the proxy node cluster, the model buyer purchases the joint private key from the proxy node cluster for decrypting the model parameter ciphertext to obtain new model parameters to update the model for subsequent online prediction.

[0133] In the audit process of the ciphertext interaction in the embodiment, no additional computing overhead is required for the participants to perform data auditing, improving the efficiency of data auditing; at the same time, in the training process of each round of joint modeling, real-time auditing is performed on the malicious gradient ciphertext uploaded by each participant, improving the timeliness of data auditing.

[0134] To solve the above technical problems, the embodiment of the present application also provides a computer device. For details, please refer to Figure 2 , Figure 2 The basic structure block diagram of the computer device of the embodiment is shown in the following figure.

[0135] The computer device 4 includes a memory 41, a processor 42, and a network interface 43, which are communicatively connected to each other through a system bus. It should be noted that only the computer device 4 with the components of the memory 41, the processor 42, and the network interface 43 is shown in the figure, but it should be understood that all the components shown are not required to be implemented, and more or fewer components can be alternatively implemented. Among them, those skilled in the art can understand that the computer device herein is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0136] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. The computer device can interact with the user through a keyboard, a mouse, a remote controller, a touchpad, a voice control device, and the like.

[0137] The memory 41 includes at least one type of readable storage medium, which includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or D interface display memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or a memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 4. Of course, the memory 41 can also include both the internal storage unit and the external storage device of the computer device 4. In the present embodiment, the memory 41 is generally used to store an operating system and various application software installed on the computer device 4, such as program codes for data auditing based on federated learning, etc. In addition, the memory 41 can also be used to temporarily store various data that have been output or will be output.

[0138] The processor 42 may, in some embodiments, be a Central Processing Unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is generally used to control the overall operation of the computer device 4. In the present embodiment, the processor 42 is configured to run program code or process data stored in the memory 41, such as program code for federated learning based data auditing.

[0139] The network interface 43 may include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0140] The present application also provides another embodiment, i.e., a computer readable storage medium storing an interface display program, the interface display program being executable by at least one processor to cause the at least one processor to perform the steps of the federated learning based data auditing method as described above.

[0141] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software and the necessary general hardware platform, of course, they can also be implemented by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a number of instructions for causing a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device) to perform the methods described in the various embodiments of the present application.

[0142] Obviously, the above-described embodiments are only some of the embodiments of the present application, rather than all the embodiments, and the preferred embodiments of the present application are given in the drawings, but do not limit the patent scope of the present application. The present application can be implemented in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing specific embodiments, or make equivalent replacements to some technical features. Any equivalent structure made by referring to the contents of the specification and drawings, directly or indirectly applied to other related technical fields, is also within the scope of the patent protection of the present application.

Claims

1. A data auditing system based on federated learning, characterized in that, include: The cluster consists of a key management module, model buyer nodes, compute nodes, aggregation nodes, and a proxy node cluster; among them, The key management module is used to generate, store, and destroy keys. The generated keys include sharded public keys, sharded private keys, combined private keys, and combined public keys. The combined public key is provided to the aggregation node, and the sharded public keys, sharded private keys, and combined private keys are distributed to the proxy node cluster. The key management module includes: a key generation unit for generating sharded key pairs and combined key pairs; a key storage unit for generating a key space in response to requests from the proxy node cluster or aggregation node. The key space is used to store the generated keys and key status information. The key status is determined based on the status of the federated learning task corresponding to the key and the security audit requirements corresponding to the federated learning task; and a key service processing unit for calling the key generation unit to generate sharded key pairs and combined key pairs according to requests from proxy nodes, and saving the status of each key to the key space where each key resides. The model buyer node is used to publish the parameters of the model to be trained and provide the test set, and to purchase a joint private key from the agent node cluster for decrypting the aggregated gradient ciphertext for the federated learning task that has passed the audit. Each computing node sends a training request to the proxy node cluster. After the identity authentication is passed, each computing node is assigned an identifier pointing to itself, performs local model training, obtains local gradients, and uses the sharded public key distributed by the registered proxy node to encrypt the gradients to obtain local gradient ciphertext. The local gradient ciphertext is then uploaded to the aggregation node and the proxy node cluster. The aggregation node is used to decrypt and homomorphically aggregate the local gradient ciphertext to obtain the aggregated gradient, encrypt the aggregated gradient using the joint public key to obtain the aggregated gradient ciphertext, and also to send the aggregated gradient ciphertext to the proxy node cluster. The proxy node cluster uses the sharded private key and the joint private key to decrypt each local gradient ciphertext and the aggregated gradient ciphertext respectively, obtaining the decrypted plaintext. The decrypted plaintext is then used to update the model to be trained. The updated model is tested using a test set to obtain local and aggregate scores. The average score of several computing nodes is compared with the aggregate score to determine the parameter audit results. The proxy node cluster includes an audit unit, which includes: The local score test subunit is used to decrypt the local gradient ciphertext using the fragmented private key, update the parameters of the model to be trained according to the local gradient provided by the computing node pointed to by the obtained target identifier, test the local gradient using the test set, obtain the local score, and record the identifier of the computing node. The aggregate score test subunit is used to decrypt the aggregate gradient ciphertext using the joint private key, update the parameters of the model to be trained based on the decrypted aggregate gradient, and test the aggregate gradient using the test set to obtain the aggregate score. The audit of the malicious parameter sub-unit determines whether there is any behavior of uploading false parameters by comparing the aggregated score with the average local score of several computing nodes. To locate abnormal node subunits, when averaging scores related to different subsets, if the model accuracy is abnormal, the local scores of several participants in different subsets of the proxy node cluster are averaged and tested using a test set to obtain the average scores of several subsets. By comparing the differences between nodes and scores between subsets, abnormal nodes are located, and penalties are applied to abnormal nodes.

2. The data auditing system based on federated learning as described in claim 1, characterized in that, The computing nodes include: The authentication unit is used to initiate a training request to the agent node cluster, and after the identity authentication is passed, it assigns an identifier pointing to itself to each computing node. The first receiving unit is used to receive the initial parameters of the model to be trained and the shard public key obtained from the proxy node cluster; The training unit is used to train the model to be trained using local data and the initial parameters of the model to be trained, and to obtain the local gradient. The upload unit is used to encrypt the local gradient and the identifier using the sharding key pair to obtain the local gradient ciphertext, and then upload it to the aggregation node and the agent node cluster.

3. The data auditing system based on federated learning as described in claim 1, characterized in that, The aggregation node includes: The second receiving unit is used to receive the local gradient ciphertext uploaded by the computing node and the joint public key distributed by the key management module after the computing node completes local training through identity authentication. The aggregation unit is used to homomorphically aggregate the local gradient ciphertext uploaded by each computing node, and then decrypt it to obtain the aggregated gradient. The first sending unit encrypts the aggregated gradient using the joint public key to obtain the aggregated gradient ciphertext, and sends it to the agent node cluster.

4. The data auditing system based on federated learning as described in any one of claims 1 to 3, characterized in that, The proxy node cluster includes: The third receiving unit is used to receive the fragmented key pairs and joint private keys distributed by the key management module, receive the local gradient ciphertext of the computing node and the aggregated gradient ciphertext of the aggregation node, and also to receive the initial parameters of the model to be trained and several test sets published by the model buyer node. The second sending unit is used to send model information and key information; The audit unit is used to audit malicious parameters.

5. The data auditing system based on federated learning as described in claim 4, characterized in that, The second transmitting unit includes: The allocation subunit is used to allocate a proxy node to the computing node after the computing node is authenticated, and send the model parameters to be trained and the shard public key to the computing node. An iterative subunit is used to send the audited aggregated gradient ciphertext to each of the computing nodes in each iteration. The sending sub-unit is used to send the encrypted model parameters after training is completed to the model buyer node.

6. A data auditing method based on federated learning, characterized in that, The method, applied to the data auditing system based on federated learning as described in any one of claims 1 to 5, comprises: A proxy node cluster is allocated to each computing node, and a key management module is used to distribute sharded key pairs that can be homomorphically aggregated to each proxy node in the proxy node cluster. The corresponding joint private key is sent to the proxy node cluster, and the joint public key is sent to the aggregation node. The model buyer node publishes the parameters of the model to be trained and several test sets to the agent node cluster; After the identity signature is approved, the computing node registers with each agent node, obtains the multi-key homomorphic encryption shard key pair, and requests the parameters of the model to be trained and the task requirements. The compute nodes perform local training to obtain local gradients, and then upload the local gradient information to the aggregation node using homomorphic encryption according to the traditional federated learning process and to the proxy node cluster using sharded public key encryption. After the aggregation node homomorphically aggregates the gradient ciphertext of the computing node, it decrypts it to obtain the plaintext. The aggregated gradient is then encrypted using the joint public key distributed by the key management module and sent to the proxy node cluster to update the aggregated gradient and obtain the aggregated score for subsequent location of malicious nodes. The proxy node cluster obtains the gradient ciphertext, decrypts it, and updates the model. It then uses the test set to score the model and obtains the local score for each computing node. Subsequently, it uses the average aggregated gradient to update the model and obtains the aggregated score. It compares the local score with the aggregated score to determine if there are malicious parameters. It then compares the average score of different proxy node subsets with the aggregated score to identify malicious nodes. In each iteration, the aggregated gradient that passes the audit is distributed from the proxy node cluster to each computing node. The computing nodes use the gradient to update the model and start the next iteration. If the audit fails, the training is terminated. After each iteration of the federated learning process is audited, the federated learning training is completed. The agent node cluster will send the audited and trained model parameters to the model buyer using a federated public key. The model buyer node purchases a joint key private key from the agent node cluster to decrypt the aggregate gradient ciphertext.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the data auditing method based on federated learning as described in claim 6.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the data auditing method based on federated learning as described in claim 6.

Images