A privacy protection federated learning method with a lightweight verification mechanism

Abstract

The application discloses a privacy protection federated learning method with a lightweight verification mechanism, which is characterized by adopting a homomorphic pseudo-random generator to generate a mask vector to encrypt a gradient vector, generating a proof value through a linear function and encrypting and uploading a cloud server to aggregate, realizing lightweight verification of the aggregation result, and specifically comprising the following steps: an initialization stage, a local training stage, an aggregation stage, a decryption stage and a verification stage. Compared with the prior art, the application can verify the aggregation result, resist a brute force attack initiated by the cloud server, effectively solve the problem of privacy leakage, reduce the overhead, and be more suitable for large-scale user drop-out situations, greatly reduce the calculation and communication overhead, and have high practical application value.

Description

Technical Field

[0001] This invention relates to the field of secure aggregation technology, and in particular to a privacy-preserving federated learning method with a lightweight verification mechanism. Background Technology

[0002] The advent of the big data era has spurred the development of artificial intelligence (AI) technology. Machine learning, as a popular AI technique, has been widely applied and has contributed to improvements in people's lives. However, training high-precision machine learning models requires massive amounts of data, which is often held by a few companies. Furthermore, due to privacy or profit motives, companies possessing the majority of the data are typically unwilling to share it, leading to the data silo problem. Because data silos hinder data sharing during centralized learning, federated learning was first proposed by Google in 2016. Federated learning allows models to be trained locally and then the resulting gradient parameters sent to a cloud server for aggregation. User privacy data remains on-premises, effectively protecting user privacy. Based on the differences in user datasets, federated learning can be categorized into horizontal federated learning, vertical federated learning, and federated transfer learning.

[0003] Federated averaging is widely used in traditional federated learning. This algorithm involves each user training the model locally using their own dataset, then sending the resulting gradient parameters to a cloud server. The cloud server receives the gradient parameters uploaded by the participants, averages them, and sends the average back to the users. Users then use this new average gradient for the next iteration until the model converges, at which point the iteration ends. While federated learning can protect user data privacy by keeping private data locally and only uploading shared gradients, existing research indicates that information about local data can be gleaned from the uploaded shared gradients, leading to privacy breaches. Therefore, a privacy-preserving scheme is needed to protect the privacy of gradients during the aggregation process.

[0004] Currently, existing privacy protection schemes are based on perturbation or encryption techniques. Perturbation-based schemes can affect the accuracy of the final model, while encryption-based schemes incur significant overhead. Encryption-based schemes mainly include secure multi-party computation (SMPC), homomorphic encryption, and functional encryption. Among them, SMPC-based schemes primarily use pairwise masks and secret sharing to protect users' gradient privacy, while allowing users to disconnect during training. However, user disconnection incurs substantial additional overhead and introduces extra communication rounds. Due to network latency and other factors, users can disconnect at any stage during the entire federated learning training process, affecting the training results. Therefore, designing a privacy protection scheme that can effectively handle user disconnection issues with minimal performance overhead and robust privacy protection without introducing extra communication rounds, even under large-scale user disconnection scenarios, is a crucial issue worth considering.

[0005] Currently, many privacy-preserving federated learning schemes use encryption to protect gradient privacy and can correctly complete training even when users are offline. However, handling offline issues incurs significant computational and communication overhead. Furthermore, only local gradient information is protected throughout the training process, while the aggregation results of each round are still exposed to the cloud server. The cloud server could potentially obtain honest users' privacy information from multiple rounds of aggregation results. Therefore, privacy protection of aggregation results needs to be achieved without collusion between users and the cloud server. Since the cloud server requires additional computational resources to aggregate gradient parameters sent by users, it might forge aggregation results to reduce computational overhead, leading to incorrect training results. More seriously, the cloud server might intentionally forge results to obtain users' gradient information, resulting in the leakage of users' privacy. Therefore, in addition to protecting user and aggregation result privacy, it is also necessary to verify whether the cloud server has tampered with the aggregation results, achieving verifiability.

[0006] Existing verifiable privacy protection schemes use homomorphic hash functions to hash gradient parameters and upload them to a cloud server for aggregation. The aggregated hash value returned by the cloud server is then used to verify whether the cloud server has tampered with the aggregation result. Users can use homomorphic hashing to hash the aggregation result returned by the cloud server locally and compare it with the aggregated hash value to verify the correctness of the aggregation result. If the cloud server returns a forged aggregation result, then the aggregated hash value needs to be tampered with to deceive the user into accepting the forged aggregation result. However, due to the collision resistance of homomorphic hash functions, the cloud server cannot successfully forge hash values ​​to pass the user's verification, thus achieving verifiability of the aggregation result. However, researchers have observed that in federated learning, the distribution of gradient vectors is generally bell-shaped near zero within a small and fixed range, and homomorphic hashing is similar to a deterministic encryption. Therefore, attackers can recover the user's original gradient through brute-force attacks, leading to serious privacy leaks. Experiments have shown that the original gradient vector can be cracked with high accuracy within an acceptable cost. Therefore, a reasonable verifiable mechanism is needed to defend against brute-force attacks launched by adversaries. Furthermore, many current verifiable solutions require additional computation and communication to verify the aggregation results, and verification also incurs additional overhead when the user is offline. Therefore, it is necessary to design a lightweight verification mechanism to achieve verifiability of the aggregation results and protect the user's gradient privacy.

[0007] In summary, existing verifiable privacy-preserving federated learning schemes cannot achieve the following functions: 1) using reasonable encryption schemes to protect the gradient privacy of users; 2) protecting the privacy of aggregation results for the cloud server without collusion between users and the cloud server; 3) achieving verifiability of aggregation results and resisting brute-force attacks launched by the cloud server with a lightweight verification mechanism; 4) allowing users to disconnect during training without incurring additional overhead. Summary of the Invention

[0008] The purpose of this invention is to provide a privacy-preserving federated learning method with a lightweight verification mechanism to address the shortcomings of existing technologies. It employs a homomorphic pseudo-random generator to generate a mask vector to encrypt the gradient vector. By encrypting and uploading the mask seed, it eliminates the aggregation mask and reduces computational overhead. A linear function is introduced to generate proof values, which are then encrypted and uploaded to the cloud server for aggregation. This achieves a lightweight verification mechanism to validate the correctness of the aggregation results. Simultaneously, the coefficients of the linear function are used to generate a mask to conceal the aggregation results, thereby protecting the privacy of the aggregation results for the cloud server and effectively resisting brute-force attacks launched by the cloud server. This method is suitable for environments with large-scale user disconnections during training. While protecting gradient privacy, it can lightweightly verify the correctness of the aggregation results and has high practical application value.

[0009] The objective of this invention is achieved as follows: a privacy-preserving federated learning method with a lightweight verification mechanism, characterized by using a homomorphic pseudo-random generator to generate a mask vector to encrypt the gradient vector, thereby protecting the gradient vector; eliminating the aggregation mask by encrypting and uploading the mask seed, thus reducing computational overhead; introducing a linear function to generate proof values ​​and encrypting and uploading them to the cloud server for aggregation, thereby realizing the verification of the correctness of the aggregation result with a lightweight verification mechanism; and using the coefficients of the linear function to generate a mask to cover the aggregation result, thereby protecting the privacy of the aggregation result for the cloud server.

[0010] This invention mainly comprises three entities: a trusted third party, a user, and a cloud server. The trusted third party initializes the entire system, provides security parameters, generates public and private keys for an encryption scheme and a linear function for verification, sends the private key and linear function to a designated user, publishes the public key, and simultaneously generates a global model for the user to train. After system initialization, the trusted third party goes offline. The user trains the global model using a local dataset, sends the resulting gradient parameters to the cloud server for aggregation, and verifies the correctness of the aggregation results returned by the cloud server. The cloud server aggregates the gradient parameters uploaded by the user, generates a verification value using additional information uploaded by the user, and sends it to the user. The user uses the verification value to verify whether the cloud server has tampered with the aggregation results.

[0011] The threat model used in this invention assumes a trusted third party is considered completely trustworthy and goes offline after system initialization. The cloud server has the additional capability to tamper with aggregation results to deceive users into accepting fabricated aggregation results. Consider a malicious adversary. The attack targets include: obtaining the gradient privacy of honest users; acquiring the aggregation results of gradients; and tampering with the aggregation results to pass verification. It is possible to eavesdrop on messages during communication and corrupt a subset of users to infer the private information of honest users. Furthermore, it protects the privacy and verifiability of aggregation results without considering collusion between users and cloud servers.

[0012] The present invention enables lightweight verification of aggregation results, specifically including the following steps:

[0013] 1) Initialization phase: Input system security parameters, a trusted third party generates public and private keys for the encryption scheme, and sends the private key fragments to designated users and publishes the public key; initialize linear functions and initialize the global model and send them to all users.

[0014] 2) Local Training Phase: Each user trains the global model locally using a privacy dataset to obtain updated gradient parameters. Users then use a linear function to generate validation values ​​using the gradient parameters as input, and encrypt these validation values ​​before sending them to the cloud server for secure aggregation. First, users use the coefficients of the linear function as input to a pseudo-random generator (PRG) to generate a mask vector to mask the gradient parameters. Then, they select random values ​​and use a homomorphic pseudo-random generator (HPRG) to generate a mask vector to encrypt the masked gradient parameters before uploading it to the cloud server for aggregation.

[0015] 3) Aggregation Phase: The cloud server aggregates the ciphertext of gradients and ciphertext of verification values ​​uploaded by all users. Then, it sends these ciphertexts to all participants for joint decryption, obtaining the masked aggregated gradient parameters and aggregated verification value. The masked aggregated gradient parameters are kept secret from the cloud server, while the masked aggregated verification value is sent to users to verify the correctness of the returned aggregated gradient parameters.

[0016] 4) Decryption phase: The user receives the aggregated gradient ciphertext and aggregated verification value sent by the cloud server, uses the private key to perform preliminary decryption of the aggregated gradient ciphertext and aggregated verification value ciphertext, and sends part of the decryption result to the cloud server; the cloud server receives the part of the decryption result sent by the user, aggregates it, uses the Lagrange interpolation method to perform complete decryption, obtains the masked aggregated gradient and aggregated verification value, and sends it to all users for verification to proceed to the next round of iterative training.

[0017] 5) Verification Phase: After receiving the masked aggregated gradient and aggregated verification value from the cloud server, the user first uses a local mask to eliminate the masked aggregated gradient to obtain the aggregated gradient. Then, a linear function is used to generate a new verification value by taking the aggregated gradient as input. The new verification value is compared with the aggregated verification value returned by the cloud server. If they are the same, the user passes the verification and enters the next round of iterative training. If they are different, the user rejects the aggregated result returned by the cloud server.

[0018] During the training process, users may experience disconnections due to network failures or other reasons, introducing additional communication rounds and computational overhead to address this issue. This invention allows users to disconnect at any stage and still complete training correctly. Users employ a homomorphic pseudo-random generator to generate a mask to protect the privacy of gradient parameters, reducing computational overhead. The gradient parameters are masked locally, and the cloud server decrypts the masked aggregated result, protecting the privacy of the aggregated result for the cloud server. A linear function is used to generate a single verification value, achieving lightweight verifiability of the aggregated result. The communication overhead for verification is independent of the dimensionality of the gradient parameters, and encryption technology is used to encrypt the verification value to resist brute-force attacks launched by the cloud server.

[0019] Compared with the prior art, the present invention has the following beneficial technical effects and significant technical progress:

[0020] 1) Use appropriate encryption schemes to protect users' privacy at different levels;

[0021] 2) Protect the privacy of the aggregation results for the cloud server in the absence of collusion between the user and the cloud server;

[0022] 3) A lightweight verification mechanism is used to verify the aggregation results and resist brute-force attacks launched by cloud servers, effectively solving the problem of privacy leakage;

[0023] 4) Allows users to disconnect during training without incurring additional overhead, greatly reducing computational and communication costs;

[0024] 5) It enables the verification of aggregation results and protects the gradient privacy of users. The method is simple and has high practical application value. Attached Figure Description

[0025] Figure 1 A system diagram constructed for this invention;

[0026] Figure 2 This is a flowchart of the present invention. Detailed Implementation

[0027] I. Explanation of the mathematical theory applied in this invention:

[0028] 1. Secret Sharing

[0029] Let the secret be s. Divide the secret into n pieces. For a (t, n) threshold secret sharing scheme, the secret s can only be recovered after receiving at least t pieces. Let the secret sharing scheme (SA) include a polynomial construction initialization algorithm, a secret sharing algorithm, and a secret recovery algorithm, denoted as SA.Setup, SA.Share, and SA.Recon, respectively.

[0030] The polynomial construction initialization algorithm SA.Setup(1) κ f(x) → s: Input security parameter κ, for secret s, initialize polynomial Where a i It is a random binary integer with κ bits, i = 1, 2, ..., t-1.

[0031] The secret sharing algorithm SA.Share(s, t, U) → {(u, s} u )} u∈U，|U|＝n The algorithm generates n partitions {(u, s)} u )} u∈U，|U|＝n , where su =f(u), and the secret s can be recovered with only t fragments.

[0032] The secret recovery algorithm SA.Recon({(u, s) v )} v∈V，|V|≥t The algorithm, t)→s: Based on the received at least t fragment sets V, takes a subset V′ of size t from V and recovers the secret using Lagrange interpolation.

[0033] 2. Paillier Homomorphic Encryption Scheme

[0034] The Paillier encryption algorithm consists of three parts: a key generation algorithm, an encryption function, and a decryption function, denoted as KeyGen, Enc, and Dec, respectively.

[0035] The KeyGen(1) κ →PK, SK: The algorithm generates a public key PK for encryption based on the input security parameter κ, and generates a private key SK for decryption.

[0036] The Enc(PK, M)→C statement means that for plaintext M, the encryptor uses the system public key PK to encrypt it to obtain ciphertext C.

[0037] The term Dec(SK, C)→M means that for ciphertext C, the decryptor uses the system private key SK to decrypt and obtain plaintext M.

[0038] It satisfies the additive homomorphism, that is, Dec(SK, Enc(PK, M1)·Enc(PK, M2))=M1+M2.

[0039] 3. Homomorphic pseudo-random generator HPRG

[0040] A homomorphic pseudorandom generator (HPRG) is a pseudorandom generator with homomorphic properties. It expands the input seed into a vector of a specified dimension and satisfies the homomorphism.

[0041] Given a prime q-order cyclic group G, a hash function H: A pseudo-random function F with homomorphic properties: The condition F(k, x) = H(x) is satisfied. k Construct HPRG(s) = (F(s, 1), F(s, 2), ..., F(s, m)), where It is plaintext space.

[0042] The homomorphism is satisfied: HPRG(s1+s2)=HPRG(s1)·HPRG(s2).

[0043] To understand the technical means, creative features, objectives, and effects of this invention, the invention will be further described below in conjunction with specific embodiments.

[0044] Example 1

[0045] See Figures 1-2 The lightweight verification process for the aggregation results in this invention is specifically implemented as follows:

[0046] 1) Initialization phase

[0047] Given a security parameter κ, a trusted third party selects two κ-bit large prime numbers p′ and q′, calculates p = 2p′ + 1 and q = 2q′ + 1, until p and q are also prime numbers. Calculate N = pq and λ = lcm(p-1, q-1) = 2p′q′, select d satisfying d ≡ 0 mod λ and d ≡ 1 mod N, and set SK = d as the private key. Use secret sharing to send fragments of the private key to designated users. Randomly select a κ-bit prime number p1, generate a prime group G of order p1, select the generator g of G, and publish the public key PK = (g, N) to all entities. Simultaneously, randomly select a... And initialize (a, b) and the global model W (0) And send it to all users.

[0048] 2) Local training phase (round r)

[0049] User i sets the local model to the aggregated gradient W obtained from the server. (r-1) Then use the local dataset DB i Gradient parameters G are obtained by training the model locally. i The mask vector c = PRG((a+b)||r) = (c0, c2, ..., c) is calculated using parameters (a, b) and the pseudo-random generator PRG. m Use a mask vector c to blind the gradient vector. Simultaneously calculate the vector used for verification: a = PRG(a||r) = (a1, a2, ..., a...). m ) and b = PRG(b||r) = (b1, b2, ..., b m The verification value is calculated using the vector pair (a, b). Select a random value s i ∈Z p The homomorphic pseudo-random generator HPRG is used to expand the vector into an m-dimensional vector. And for the gradient vector G i Encryption is performed to obtain Calculate s i The ciphertext C si=Enc pk (s i ) and V i The ciphertext C vi =Enc pk (V i ), and C i C si and C vi Send it to the cloud server for aggregation.

[0050] 3) Aggregation Phase

[0051] The cloud server receives at least t user sets U1 uploaded C. i C si and C vi Perform aggregation, where Some users experienced disconnections. Firstly, regarding C... i The ciphertext is obtained by aggregation. Then calculate G si aggregated ciphertext and C v aggregated ciphertext The calculated G s and C v Send it to users who are still online to enter the decryption phase.

[0052] 4) Decryption stage

[0053] Because user i only holds a partial fragment of the private key SK, sk i Therefore, a server is needed as an intermediary to collect the fragments and recover the private key, thus completing decryption without revealing the private key SK. Specifically, user i receives G from the server. s and C v Entering the decryption stage, C is then calculated locally. s and C v Partial decryption of ciphertext C′ si and C′ vi .in, Then user i will C′ si and C′ vi Send to the cloud server for aggregation. The cloud server receives at least t user sets U2 uploaded C′. si and C′ vi Aggregation is performed to achieve complete decryption. Among these, Some users have lost connection. First, for user i in set U2, calculate... and Then, the aggregated result A of the mask and the aggregated result 2 of the verification value are calculated.

[0054] in,

[0055]

[0056] Use a homomorphic pseudo-random generator to expand A into a V-dimensional vector. Then, the mask is removed from the ciphertext C to obtain... Using Pollard's Kangaroo algorithm, the following was calculated: The result is the gradient aggregation result, and B is taken as the aggregation result e in the r-th round. (f) 2 is sent to the user to enter the verification phase.

[0057] 4) Verification Phase

[0058] After user i obtains B and 2 from the cloud server, it needs to verify the aggregation result B to determine whether the cloud server has tampered with the aggregation result B, thereby deciding whether to proceed to the next round of training. First, Next, the mask is eliminated using the local mask vector h, resulting in... Then, the final aggregated result M is used as the input to the linear function for calculation.

[0059] The obtained 23 is compared with the 2 returned by the cloud server. If they are equal, the aggregation result is accepted and the next round of iteration training is entered; if they are not equal, the aggregation result returned by the cloud server is rejected.

[0060] This invention combines privacy protection schemes and verification mechanisms. Based on a homomorphic pseudo-random generator, it proposes a privacy protection scheme that is more applicable in the event of user disconnection. The method proposes a lightweight verification mechanism that verifies the correctness of aggregation results with low verification overhead. It can also resist brute-force attacks launched by cloud servers. Furthermore, the verification mechanism is universal, effectively protecting user privacy and the correctness of aggregation results, while reducing overhead and being more suitable for large-scale user disconnection situations.

[0061] The above embodiments are merely illustrative of the present invention and are not intended to limit the scope of the present invention. All equivalent implementations of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A privacy-preserving federated learning method with a lightweight verification mechanism, characterized in that, The method of using a homomorphic pseudo-random generator to generate a mask vector to encrypt the gradient vector, generating a proof value through a linear function and encrypting it before uploading it to a cloud server for aggregation, achieves lightweight verification of the aggregation result, specifically including the following steps: 1) Initialization phase 1-1: Input system security parameters, and a trusted third party will generate the public and private keys for the encryption scheme; 1-2: Slice the private key and send it to the designated user, making the public key public; 1-3: Initialize the linear function and global model and send them to all users; 2) Local training phase 2-1: Each user trains the global model locally using the privacy dataset to obtain updated gradient parameters: 2-2: Users use linear functions to generate validation values ​​by taking gradient parameters as input; 2-3: Encrypt the verification value and send it to the cloud server for secure aggregation: 2-3-1: Users use the coefficients of a linear function as input to the pseudo-random generator PRG to generate a mask vector that masks the gradient parameters; 2-3-2: Select random values, use the homomorphic pseudo-random generator HPRG to generate a mask vector to encrypt the masked gradient parameters, and upload it to the cloud server for aggregation; 3) Aggregation Phase 3-1: The cloud server aggregates the gradient ciphertext and verification value ciphertext uploaded by all users; 3-2: Send the aggregated gradient ciphertext and aggregated verification value ciphertext to all participants for joint decryption to obtain the masked aggregated gradient parameters and aggregated verification value. The masked aggregated gradient parameters will keep the aggregated gradient parameters confidential to the cloud server. 3-3: Send the masked aggregated verification value to the user to verify the correctness of the returned aggregated gradient parameters; 4) Decryption stage 4-1: When a user receives the aggregated gradient ciphertext and aggregated verification value sent by the cloud server, they use the fragmentation of the private key to perform preliminary decryption of the aggregated gradient ciphertext and aggregated verification value ciphertext, and send the preliminary decryption result to the cloud server. 4-2: The cloud server aggregates the preliminary decryption results and uses the Lagrange interpolation method to perform complete decryption, obtaining the masked aggregated gradient and aggregated verification value, which are then sent to all users for verification to proceed with the next round of iterative training. 5) Local verification phase 5-1: The user receives the masked aggregate gradient and aggregate verification value sent by the cloud server, uses the local masking mask to eliminate the masked aggregate gradient, and obtains the aggregate gradient; 5-2: Use a linear function to aggregate the gradient as input to generate new validation values; 5-3: Compare the new verification value with the aggregated verification value returned by the cloud server. If they are the same, the verification is passed and the next round of iterative training is entered; if they are different, the aggregated result returned by the cloud server is rejected.

Images