A verifiable federated learning method based on hybrid homomorphic encryption

Abstract

This invention discloses a verifiable federated learning method based on hybrid homomorphic encryption. Its key feature is that, on a centralized client-server architecture for federated learning, it employs hybrid homomorphic encryption technology supporting SIMD operations to encrypt data. While ensuring data privacy and correct aggregation, it leverages the advantages of symmetric encryption—simple computation and no ciphertext inflation—to overcome the shortcomings of public-key homomorphic encryption schemes, which are computationally complex and suffer from severe ciphertext inflation. A verification code is constructed using Lagrange interpolation, allowing the client to verify the aggregation results. Specifically, it includes steps such as system initialization, model training and data encryption, aggregation, aggregation result verification, and model updating. Compared with existing technologies, this invention ensures user gradient confidentiality, aggregation correctness, and the integrity of aggregation results during the federated learning aggregation process, while reducing the number of public-key encryption operations, alleviating computational and communication burdens, and significantly improving efficiency.

Description

Technical Field

[0001] This invention relates to the fields of homomorphic encryption in cryptography and privacy protection in machine learning, and particularly to a verifiable federated learning method based on hybrid homomorphic encryption. Background Technology

[0002] With the advent of the Fourth Industrial Revolution, new-generation technologies such as artificial intelligence and big data have brought opportunities for the intelligent transformation and development of traditional industries. Machine learning, as one of the main methods of big data analysis in recent years, encompasses various intelligent algorithms such as deep neural networks and regression algorithms, and has been successfully applied in many fields such as healthcare, autonomous driving, finance, and industrial manufacturing. High-quality machine learning models typically require massive amounts of reliable data for training; therefore, the performance of AI-based services is largely influenced by the quality of the training data, making large-scale data collection crucial. However, in most industries, data is limited and of poor quality, often leading to problems such as overfitting and unreliability in trained machine learning models, insufficient to support the implementation of AI technologies. An intuitive solution is data sharing, integrating data from different industries and different companies within the same industry. In traditional centralized training, the server requires all participants to upload their local data to the cloud. Then, the server initializes a deep neural network on the cloud and trains it using training samples until the optimal parameters are obtained. Finally, the cloud server publishes a prediction service interface or returns the optimal parameters to each participant. This centralized training method raises a series of data privacy and security issues: users' local data may contain sensitive privacy information; for example, in healthcare systems, patients may be unwilling to share their medical data with third-party service providers (such as cloud servers). Furthermore, there are often insurmountable barriers between different data sources, and in most industries, data exists in silos. Therefore, directly integrating data scattered across various industries and regions is difficult to achieve, or at least extremely costly and privacy-critical.

[0003] To address the problem of "data silos," the concept of federated learning was proposed: in the process of machine learning, participating parties can jointly model using data from other parties. The parties do not need to share data resources; that is, data can be trained jointly without leaving their local machines to build a shared machine learning model. Depending on the communication architecture, federated learning can be divided into centralized federated learning and decentralized federated learning. Centralized federated learning is based on a client-server architecture, while decentralized federated learning is based on an end-to-end network architecture. Compared to decentralized federated learning, centralized federated learning is generally simpler and more effective, and its scalability and stability make it more widely used. In a centralized federated learning scheme, each participating party trains a local model locally using private data. In each round of model updates, users upload the updated parameters (gradients) of their local model to an aggregation server. The aggregation server aggregates the updated parameters of all users and returns the aggregated values ​​to each user for model updates. However, research has shown that adversaries can still indirectly obtain sensitive information based on shared gradients. This has led to the research branch of privacy-preserving federated learning.

[0004] To protect the privacy of participants in federated learning, numerous strategies have been proposed, among which secure multi-party computation, differential privacy, and homomorphic encryption are widely used. Secure multi-party computation allows multiple participants to collaboratively compute an agreed-upon function with private data in a manner where each party is unaware of the inputs and outputs. Differential privacy ensures the privacy of each individual sample in the dataset by injecting noise into the dataset to obscure sensitive information, making it impossible for third parties to distinguish individuals. Homomorphic encryption allows certain computations to be performed directly on the ciphertext without prior decryption. Compared to secure multi-party computation and differential privacy methods, homomorphic encryption offers stronger privacy protection and has less impact on the accuracy of the trained model. However, because commonly used homomorphic encryption techniques are public-key cryptosystems, they require long keys and complex mathematical calculations, leading to high computational costs and ciphertext bloat. Therefore, the development of federated learning systems based on homomorphic encryption is limited by the bottleneck of high computational and communication overhead. In the field of cryptography research, scholars have recently proposed the concept of hybrid homomorphic encryption, which combines symmetric encryption with public-key homomorphic encryption. A feasible example supporting SIMD (Single Instruction Multiple Data) operations has been proposed: the fusion of Pasta (a family of symmetric stream encryption algorithms) symmetric cryptography and BFV (a fully homomorphic encryption scheme based on the RLWE (Ring-Learning With Errors) problem) homomorphic cryptography (hereinafter referred to as the "Pasta+BFV" scheme). The computationally efficient nature of symmetric cryptography complements homomorphic encryption, thus providing a new approach for privacy-preserving federated learning schemes.

[0005] Furthermore, federated learning presents data integrity issues. The aggregation server, acting as a third party, is prone to single points of failure. Without integrity guarantees, if the server is compromised, an adversary controlling it can manipulate the global model. Malicious servers can forge aggregation results to reverse-engineer the private data of participating parties or corrupt user-local models, leading to incorrect classification results.

[0006] In summary, protecting user privacy and data integrity are two fundamental issues in the federated learning training process. Furthermore, in homomorphic encryption-based federated learning schemes, achieving strong privacy protection while minimizing public-key encryption operations and reducing computational and communication burdens—a balance between security and efficiency—remains a challenging problem. Therefore, designing a secure, efficient, and verifiable federated learning method is both urgent and meaningful. Summary of the Invention

[0007] To address the privacy, security, data integrity, and efficiency issues inherent in federated learning as described in the background section, this invention provides a verifiable federated learning method based on hybrid homomorphic encryption. This method is applicable to centralized federated learning scenarios with a client-server architecture, allowing parties to perform joint training on data via an aggregation server without leaving their local source data, thus resolving the "data silo" problem. Regarding privacy and efficiency, this invention employs a "Pasta+BFV" hybrid homomorphic encryption technology supporting SIMD. It introduces the concept of "symmetric temporary homomorphism" to transfer complex computations from the client to the server, reducing the user's burden and alleviating communication pressure caused by ciphertext expansion. Based on BFV homomorphic encryption, it achieves correct aggregation under encrypted conditions to protect the privacy of user source data. Based on SIMD packaging, it encrypts multiple data points at once, reducing the number of encryption steps. To address data integrity, a CAPTCHA is constructed using Lagrange interpolation, allowing the client to verify the aggregation results.

[0008] The specific technical solution for achieving the objective of this invention is as follows:

[0009] A verifiable federated learning method based on hybrid homomorphic encryption includes the following entities: a public key generator (PKG), n clients, and an aggregation server; it is used in federated learning scenarios under a client-server architecture, and is characterized by the following specific steps:

[0010] Step A: Initialization

[0011] n clients first negotiate based on their business needs and reach an agreement on the training model; the key generation organization PKG generates the initial global model, key and public parameters, and distributes them to the clients and aggregation server as required;

[0012] Step B: Model Training and Data Encryption

[0013] In each round of model updates, each client trains a local model using local data and calculates the model update parameters for this iteration. Then, the update parameters are preprocessed to construct a verification code and form plaintext. Finally, the plaintext is encrypted using Pasta symmetric encryption and the Pasta symmetric ciphertext is sent to the aggregation server.

[0014] Step C: Aggregation

[0015] After receiving the Pasta symmetric ciphertext from all clients, the aggregation server first performs ciphertext transformation to obtain BFV homomorphic ciphertext; then it aggregates all the BFV homomorphic ciphertexts and sends the aggregation result to all clients.

[0016] Step D: Validation of Aggregation Results and Model Update

[0017] After each client receives the aggregation result from the aggregation server, it performs homomorphic decryption. Then, it uses Lagrange interpolation to verify the aggregation result. If the verification passes, the aggregation result is used to update the model; otherwise, the aggregation result is discarded. Then, it enters the next iteration until the model converges or the maximum number of federated rounds is reached.

[0018] Specifically, step A includes:

[0019] A1: Model Initialization

[0020] Each client first reaches an agreement on training the model based on the training objective. PKG then generates an initial global model, learning rate, gradient quantization precision, mapping finite field, and maximum number of federated rounds based on this agreement, and distributes them to all clients as initial local models.

[0021] A2: Key Initialization

[0022] The PKG generates the Pasta encryption scheme, the BFV encryption scheme, and the security parameter λ. Then, it generates a Pasta key for each client and distributes it to each client. Next, it generates a set of public BFV keys, which include a public key, a private key, and a computation key. The public key and computation key are public to all participants, i.e., the n clients and the aggregation server, while the private key is shared among all clients but kept secret from the aggregation server. Then, it sequentially encrypts the Pasta keys of each client using the BFV public key, forming a user list which is sent to the aggregation server.

[0023] A3: Common Parameter Initialization

[0024] PKG generates a parameter sequence for Lagrange interpolation and sends it to all clients.

[0025] Step B specifically includes:

[0026] B1: Model Training

[0027] Each client uses its local private dataset to train a local model, and calculates the loss function for this round of training and the gradient used for updating;

[0028] B2: Data Preprocessing

[0029] To encrypt the gradient, it is preprocessed to convert it into a form suitable for "PASTA+BFV" hybrid homomorphic encryption. Specifically, the floating-point gradient is first quantized to integer, then the quantized gradient is mapped onto a finite field to fit the encryption algorithm. Finally, all data to be encrypted is grouped according to the threshold parameter of the SIMD operations supported by Pasta.

[0030] B3: Constructing the verification code

[0031] For each preprocessed gradient group, a verification code is constructed using Lagrange interpolation.

[0032] B4: Encryption

[0033] A plaintext vector is constructed based on a preprocessed gradient block and its verification code; the plaintext vector is then encrypted using the Pasta cipher, and the Pasta symmetric ciphertext is sent to the aggregation server.

[0034] Step C specifically includes:

[0035] C1: Ciphertext Conversion

[0036] After receiving the Pasta symmetric ciphertext from the client, the aggregation server first retrieves the Pasta key encrypted by BFV for the user from the user list received from the PKG during the initialization process; then, based on the full homomorphism of the BFV cipher, it homomorphically decrypts the symmetric ciphertext to convert it into BFV homomorphic ciphertext.

[0037] C2: Aggregation

[0038] After converting all received Pasta symmetric ciphertexts into BFV homomorphic ciphertexts, the aggregation server aggregates the BFV homomorphic ciphertexts and then sends the aggregation results to each client.

[0039] Step D specifically includes:

[0040] D1: Verification

[0041] After receiving the aggregation result from the aggregation server, the client decrypts it and divides it into aggregated gradient groups and aggregated verification codes. Then, it uses Lagrange interpolation to construct a verification code for the aggregated gradient groups and verifies whether the verification code is equal to the aggregated verification code. If they are equal, the verification is successful; otherwise, the verification fails.

[0042] D2: Update Model

[0043] If the verification is successful, the user processes the aggregated gradient, which is the inverse operation of data preprocessing in the model training and data encryption process; then the recovered aggregated gradient is used to update the model; if the verification fails, the aggregated value is discarded.

[0044] D3: Iterate into the next round of training, that is, repeat steps B to D until the model converges or the maximum number of federated rounds is reached.

[0045] Compared with existing privacy-preserving federated learning methods, the advantages of this invention are:

[0046] (1) This invention applies the concept of hybrid homomorphic encryption to the federated learning scenario, leveraging the advantages of symmetric encryption—simple computation and no ciphertext inflation—while overcoming the shortcomings of public-key homomorphic encryption schemes—complex computation and severe ciphertext inflation. In existing federated learning methods based on homomorphic encryption, clients typically encrypt gradients directly using public-key homomorphic encryption schemes and then transmit the homomorphic ciphertext to the aggregation server to calculate the aggregation result. However, the ciphertext generated by public-key encryption schemes is usually much longer than the plaintext, and its inflation factor depends on the security parameters of the encryption scheme. To ensure the security of the cryptographic scheme, this security parameter needs to be sufficiently large. Existing research has shown that the amount of data transmitted by executing this type of federated learning method increases by more than 150 times compared to unencrypted transmission. Furthermore, the implementation of public-key homomorphic encryption schemes requires complex cryptographic operations (such as modular multiplication and exponentiation), which will bring significant computational pressure to some clients with limited computing power. In this invention, the client uses a symmetric encryption algorithm to encrypt the gradient and then transmits the symmetric ciphertext to the aggregation server to calculate the aggregation result. Note that symmetric encryption schemes are computationally simple and have equal plaintext and ciphertext lengths, i.e., the ciphertext inflation factor is 1. This shifts the computational burden from clients with limited computing power to the aggregation server, reducing client computational overhead and alleviating communication pressure caused by the ciphertext inflation problem of public-key encryption.

[0047] (2) The hybrid homomorphic encryption scheme used in this invention is the "Pasta+BFV" scheme, which supports the SIMD concept. The BFV homomorphic encryption scheme supports polynomial packing, that is, encoding a plaintext vector into a polynomial, converting vector encryption into polynomial encryption. Furthermore, homomorphic operations on ciphertext are equivalent to element-wise operations on vectors. To leverage the packing advantages of BFV in the hybrid homomorphic encryption scheme, this invention selects the Pasta symmetric encryption scheme, which supports the SIMD concept. A Pasta encryption scheme with a SIMD operation threshold of 1 can convert 1 plaintext into a single BFV homomorphic ciphertext after encryption. Compared to encrypting one plaintext at a time and performing ciphertext conversion one by one, this reduces the number of encryption / decryption operations on the client side and the number of ciphertext conversions on the aggregation server side to 100%. This improves computational efficiency.

[0048] (3) This invention uses the Lagrange interpolation method to verify the aggregation results. This not only ensures data integrity, but also makes the calculation simpler and more efficient compared to general methods using homomorphic hashing and linear pairing. Attached Figure Description

[0049] Figure 1 This is a diagram of the architecture of the present invention;

[0050] Figure 2 This is a flowchart of the present invention;

[0051] Figure 3 This is a schematic diagram of the gradient grouping method in this invention. Detailed Implementation

[0052] The present invention will be further described in detail below with reference to the specific embodiments and accompanying drawings. The processes, conditions, experimental methods, etc., for implementing the present invention, except as specifically mentioned below, are all common knowledge and general knowledge in the art, and the present invention has no particular limitations. It should be noted that similar reference numerals and letters in the accompanying drawings denote similar items; therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0053] Terminology Explanation:

[0054] (1) Symmetric Key Encryption (SKE): Based on whether the encryption and decryption keys are the same, cryptosystems are divided into symmetric and asymmetric cryptosystems. Asymmetric cryptosystems are also called public-key cryptosystems. Symmetric cryptography is a cryptosystem that uses the same key for encryption and decryption. Symmetric cryptography uses a key and an encryption algorithm to transform plaintext into ciphertext. Using the same key and decryption algorithm, plaintext can be recovered from ciphertext.

[0055] A symmetric encryption scheme SKE consists of three probabilistic multinomial-time algorithms:

[0056] SKE=(SKE.keyGen, SKE.Enc.SKE.Dec).

[0057] Here, SKE.keyGen is the key generation algorithm, SKE.Enc is the encryption algorithm, and SKe.Dec is the decryption algorithm.

[0058] (2) Homomorphic Encryption (HE): Homomorphic encryption allows certain computations to be performed directly on the ciphertext without first decrypting it. Commonly used homomorphic encryption schemes are public-key cryptosystems. Let m1 and m2 be the plaintexts that are encrypted into ciphertexts respectively. The homomorphism of homomorphic encryption is manifested as follows:

[0059] Additive homomorphism:

[0060] Multiplicative homomorphism:

[0061] Based on the types and number of operations supported, homomorphic encryption can be further divided into partially homomorphic encryption, slightly homomorphic encryption, and fully homomorphic encryption. Partially homomorphic encryption only supports homomorphism in addition or multiplication operations. Slightly homomorphic encryption supports a finite number of addition and multiplication operations; fully homomorphic encryption supports homomorphism in any computation on the ciphertext and has no limit on the number of computations. The BFV cryptographic scheme used in this invention is a fully homomorphic encryption scheme.

[0062] A public-key homomorphic encryption scheme, HE, consists of four probabilistic multinomial-time algorithms:

[0063] HE=(HE.keyGen,HE.Enc,HE.Dec,HE.Eval).

[0064] HE.keyGen is the key generation algorithm, which outputs a set of public-key homomorphic keys, including a public key, a private key, and a computation key. HE.Enc and HE.Dec are the encryption and decryption algorithms, respectively. HE.Eval is the homomorphic evaluation algorithm, which takes the computation key, the target computation function, and the ciphertext as input. The output of this algorithm, after decryption, is equal to the value obtained by directly applying the target computation function to the original plaintext.

[0065] (3) Hybrid Homomorphic Encryption (HHE): Considering that commonly used homomorphic encryption techniques are all public-key cryptosystems, requiring long keys and complex mathematical calculations, leading to expensive computational overhead and ciphertext inflation, researchers have proposed the concept of hybrid homomorphic encryption. Its main idea is to use a symmetric cryptographic scheme with a ciphertext inflation factor of 1 to encrypt data instead of homomorphic encryption with a larger inflation factor. Then, the key of the symmetric encryption scheme is encrypted using homomorphic encryption, and sent along with the symmetric ciphertext to the cloud service provider. Next, the cloud service provider first homomorphically executes a symmetric decryption circuit to convert the symmetric ciphertext into homomorphic ciphertext, and then continues to perform the necessary computational operations. The following definition of hybrid homomorphic encryption will be derived from a public-key homomorphic encryption scheme and a symmetric cryptographic scheme:

[0066] Based on a public-key homomorphic encryption scheme HE and a symmetric encryption scheme SKE, a hybrid homomorphic encryption scheme HHE can be constructed, which consists of five probabilistic multinomial-time algorithms:

[0067] HHE=(HHE.keyHen, HHE.Enc, HHE.Decomp, HHE.Eval, HHE.Dec).

[0068] The key generation algorithm HHE.keyGen calls HE.keyGen and SKE.keyGen; the encryption algorithm HHE.Enc calls SKE.Enc to encrypt the plaintext and then calls HE.Enc to encrypt the symmetric key; the ciphertext conversion algorithm HHE.Decomp calls HE.Rval to homomorphically execute the decryption circuit of the symmetric cipher, converting the symmetric ciphertext into homomorphic ciphertext; the homomorphic evaluation algorithm HHW.Eval and the decryption algorithm HHE.Dec directly call HE.Eval and HE.Dec, respectively.

[0069] A finite field, also known as a Galois field, is a field containing only a finite number of elements, F. q Let F represent a finite field containing q elements. Homomorphic encryption schemes applied in federated learning scenarios generally use finite fields F. q For the input plaintext space, many popular homomorphic encryption algorithms (such as BFV) support SIMD operations: encoding a plaintext vector into a polynomial, converting vector encryption into polynomial encryption, thus homomorphic operations on the ciphertext are equivalent to element-wise operations on the vector. To maintain this property in hybrid homomorphic encryption schemes, many researchers have studied symmetric cryptographic schemes that meet the corresponding requirements and achieved some results, such as Pasta. Therefore, to achieve further efficiency improvements using SIMD, this invention selects the Pasta symmetric cryptographic scheme and the BFV homomorphic encryption scheme to construct a hybrid homomorphic encryption scheme, where Pasta is... A family of symmetric stream encryption algorithms on the Internet It is a finite field F q In a dimensional vector space, q is generally chosen to satisfy 2 (16) <q<2 (60) A large prime number is used as the threshold for SIMD operations, i.e., batch transformations. A suitable threshold can be calculated based on a given q and security level requirements. In this constructed "Pasta+BFV" encryption scheme, finite fields F are encrypted. q The plaintext can be converted into a BFV homomorphic ciphertext in one go.

[0070] It should be noted that the above description of the composition of the hybrid homomorphic cryptographic scheme algorithm is only for illustrating the construction and execution process of hybrid homomorphic encryption. Furthermore, in the above definition, each encryption of plaintext by the hybrid homomorphic encryption algorithm is accompanied by homomorphic symmetric cryptographic operations, but in practical applications, these operations can be simplified and separated. Therefore, the following description of the embodiments of the present invention does not directly use the formal definition of the hybrid homomorphic encryption scheme, but rather uses the terminology of base homomorphic encryption and symmetric encryption based on the idea of ​​hybrid homomorphic encryption.

[0071] (4) Lagrange Interpolation: Lagrange interpolation is a polynomial interpolation method. Given +1 points with different coordinates, Lagrange interpolation can provide a polynomial function of order exactly passing through these +1 points. The calculation idea is to first calculate the nodal basis functions at the given nodes, and then perform a linear combination of the basis functions to obtain an interpolation polynomial with combination coefficients equal to the nodal function values.

[0072] The detailed calculation process is explained below:

[0073] Given +1 distinct interpolation points x i , (i = 0, 1, ..., n.), and the corresponding numerical value f(x) i First, calculate the interpolation basis function:

[0074]

[0075] Obviously, l i (x) is also an nth-order polynomial, and satisfies

[0076]

[0077] Then, a linear combination of the basis functions is performed:

[0078]

[0079] Thus, an nth-order polynomial L is obtained. n (x), which clearly satisfies L. n (n i )=f(x i ), which is the Lagrange interpolation polynomial passing through n+1 given interpolation points.

[0080] Example

[0081] See Figure 1 This invention employs a centralized federated learning structure based on a client-server architecture, comprising three types of entities: a key generation organization (PKG), n clients, and an aggregation server. The key generation organization is responsible for parameter initialization and key distribution; after completing the initialization task, it does not participate in subsequent processes. Each client P... i Each of the following datasets (+∈N, N={1,2,…,n}) has a private dataset D. i ={<x j ,y j >|j=1,2,…,T}, where x j It is the input, y j It's a label, T = |D i| indicates the size of the dataset. Using this dataset, the client trains a local model f(x,M) locally, where x is the input and M are the model parameters. The goal of training is to obtain the model parameters that minimize the loss function, i.e., to achieve model convergence. Therefore, in each round of model updates, P i Choose D i A random subset is used to train the model locally, and then the gradient W of the loss function is calculated. i To accelerate model convergence and compensate for insufficient local data, clients do not directly use the local gradient W. i Instead of updating, it obtains the aggregated value of the local gradient and other client gradients, i.e., the global gradient. An update is then performed. Therefore, each client encrypts its local gradient and adds a verification code to obtain the ciphertext c. i The client uploads the ciphertext and requests the aggregation server to aggregate the local gradients from all clients. After receiving the ciphertext from all clients, the aggregation server aggregates the ciphertext to obtain C and sends it back to each client. Each client receives the aggregated ciphertext, unpacks it, and obtains the aggregated verification code and the global gradient W. globPl Based on the verification results, the client decides whether to use W. globPl Update the model and then proceed to the next iteration until the model converges or reaches the agreed maximum number of federated rounds.

[0082] See Figure 2 This invention proposes a verifiable federated learning method based on hybrid homomorphic encryption, comprising the following steps:

[0083] Step A: Initialization

[0084] n clients negotiate based on their business needs and reach an agreement on the training model; the key generation organization PKG generates the initial global model, key and public parameters, and distributes them to the clients and aggregation server as required;

[0085] Step B: Model Training and Data Encryption

[0086] In each round of model updates, each client trains a local model using local data and calculates the model update parameters for this iteration. Then, the update parameters are preprocessed to construct a verification code and form plaintext. Finally, the plaintext is encrypted using Pasta symmetric encryption and the Pasta symmetric ciphertext is sent to the aggregation server.

[0087] Step C: Aggregation

[0088] After receiving the Pasta symmetric ciphertext from all clients, the aggregation server first performs ciphertext transformation to obtain BFV homomorphic ciphertext; then it aggregates all the BFV homomorphic ciphertexts and sends the aggregation result to all clients.

[0089] Step D: Validation of Aggregation Results and Model Update

[0090] After each client receives the aggregation result from the aggregation server, it performs homomorphic decryption. Then, it uses the Lagrange interpolation method to verify the aggregation result. If the verification passes, the aggregation result is used to update the model; otherwise, the aggregation result is discarded. Then, it enters the next round of iteration, that is, steps B to D are repeated until the model converges or the maximum number of federated rounds is reached.

[0091] Step A specifically includes:

[0092] Step A1: Model Initialization. All clients agree on the training model based on the training objective. PKG generates an initial global model d(x,M) according to this agreement, along with the learning rate η and the gradient quantization precision l. w , mapping finite field F q And the maximum number of federated rounds r of the model max It is then distributed to all clients as the initial model, i.e., the local model used in the first round of model updates.

[0093] Step A2: Key initialization. The PKG initializes the key based on the finite field F. q Based on the security level requirements, the SIMD operation threshold t is calculated, and the following is generated. The Pasta encryption scheme, BFV encryption scheme, and security parameters are then used. Then, for each client P... i Generate a connection to other client P j (j∈N,j≠i) and the Pasta key k kept secret by the aggregation server. i Next, a public BFV key (pk, sk, evk) is generated. The public key pk and the computation key evk are public to all participants (n clients and the aggregation server), while the private key sk is shared among all clients but kept secret from the aggregation server. Then, the BFV public key pk is used sequentially to encrypt the Pasta key of each client. i ,i∈N, calculate Composition of user list Send to the aggregation server.

[0094] Step A3: Initialize common parameters. PKG generates a parameter sequence {a1, a2, ..., a...} for Lagrange interpolation. t} and send it to all clients. Here, t is the SIMD operation threshold of the Pasta encryption scheme.

[0095] Step B of the present invention specifically includes:

[0096] Step B1: Model Training. In each round of model updates, the client P... i Randomly select a subset from the local private dataset. Train a local model and calculate the loss function for this training round. and for updating gradients in, Let be the gradient operator. (The rest of the text is incomplete and cannot be translated.) Where n gn =|W i |for W i The length.

[0097] Step B2: Data Preprocessing. To encrypt the gradients, they are preprocessed to transform them into a form suitable for "PASTA+BFV" hybrid homomorphic encryption. Specifically, this involves first processing the floating-point vector gradient W... i Quantization is performed to convert the gradient to an integer vector, and then the quantized gradient is mapped to a finite field F. q Get it The specific calculation process is as follows: for each component of the gradient vector calculate get in,(·) round ψ(·) and ψ(·) are the quantization function and the finite field mapping function, respectively:

[0098]

[0099] Represents the largest integer less than or equal to x.

[0100] Finally, see Figure 3 Based on the threshold parameter of SIMD operations supported by Pasta, all data to be encrypted is grouped: consecutive -1 components form a group, and when the number of components in the last group is less than -1, it is padded with zeros, so the total number of groups is... in Let x represent the largest integer greater than or equal to x. Let the j-th group be denoted as... but

[0101] Step B3: Construct the CAPTCHA. For each preprocessed gradient group... A verification code is constructed using Lagrange interpolation. The specific process is as follows: based on -1 interpolation points... Find a Lagrange polynomial of order t-2. Then substitute the code to get the verification code.

[0102] Step B4: Encrypt. For each packet and its corresponding verification code A plaintext vector can be constructed. The plaintext vector is encrypted using the Pasta cipher to obtain the symmetric ciphertext. Then send all Pasta symmetric ciphertexts to the aggregation server.

[0103] Step C of the present invention specifically includes:

[0104] Step C1: Ciphertext Conversion. The aggregation server receives the Pasta symmetric ciphertext from the client. Then, for each client P i The user list received from PKG in step A2 The user's Pasta key, encrypted via BFV, was retrieved from the database. Then, based on the complete homomorphism of the BFV cipher, the symmetric ciphertext is homomorphically decrypted to convert it into BFV homomorphic ciphertext.

[0105] Step C2: Aggregation. After converting all received Pasta symmetric ciphertexts into BFV ciphertexts, the aggregation server aggregates the BFV ciphertexts. Where h is an aggregation function. Then the aggregation result (C) (j) ) HE ,j∈N group Send to each client.

[0106] Step D of the present invention specifically includes:

[0107] Step D1: Verification. After receiving the aggregation result from the aggregation server, the client decrypts it. (j) =BFV.Dec((R (j) ) HE ),j∈N group According to m (j) =G (j) ||v (j) The aggregated gradient grouping G is obtained (j) and aggregated verification code v (j) Then, the aggregated gradients are grouped. The check code is constructed using Lagrange interpolation: that is, for each j∈N group Based on t-1 interpolation points Construct the Lagrange polynomial (L t-2 (x)) (j)Then substitute a t Get the verification code (L) t-2 (a t )) (j) Then, verify the check code (L). t-2 (a t ) (j) Is it related to aggregated verification code v? (j) If they are equal, the verification is successful; otherwise, the verification fails.

[0108] Step D2: Update the model. If validation is successful, the aggregated gradient can be obtained based on all aggregated groupings. It can be proven that, relying on the additive homomorphism of BFV, This refers to the correctness of the aggregation process. Therefore, the client recovers the aggregated gradient, that is, for each component... Perform the inverse operation in step B2 of the data preprocessing process. Obtain the recovered gradient Then each client updates the model using the recovered aggregate gradient. If validation fails, the aggregate value is discarded.

[0109] Step D3: Iterate into the next round of training, that is, repeat steps B1 to D3 until the model converges or the maximum number of federated rounds r is reached. max .

[0110] In the example, client P * Taking (+∈N, N={1,2,…,n}) as an example, the client-related operations in the process of this invention will be explained in detail. It should be noted that P i It is not limited to a specific client, but represents that all clients will operate in the same way.

[0111] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method of verifiable federated learning based on hybrid homomorphic encryption, comprising entities: a key generation authority PKG, a plurality of clients and an aggregation server; for a federated learning scenario under a client-server architecture, characterized in that, The method includes the following specific steps: Step A: Initialization Each client first negotiates and reaches an agreement on the training model based on its business needs; the key generation organization PKG generates the initial global model, key and public parameters, and distributes them to the clients and aggregation server as required. Step B: Model Training and Data Encryption In each round of model update, each client trains a local model using local data and calculates the model update parameters for this iteration. Then, the update parameters are preprocessed to construct a verification code and form plaintext. Finally, the plaintext is encrypted using the symmetric encryption scheme Pasta to obtain Pasta symmetric ciphertext, and the ciphertext is sent to the aggregation server. Step C: Aggregation After receiving the Pasta symmetric ciphertext from all clients, the aggregation server first uses the fully homomorphic encryption scheme BFV to transform the ciphertext into BFV homomorphic ciphertext; then it aggregates all the BFV homomorphic ciphertexts and sends the aggregation result to all clients. Step D: Validation of Aggregation Results and Model Update After each client receives the aggregation result from the aggregation server, it performs homomorphic decryption. Then, it uses Lagrange interpolation to verify the aggregation result. If the verification passes, the aggregation result is used to update the model; otherwise, the aggregation result is discarded. Then, it enters the next iteration until the model converges or the maximum number of federated rounds is reached.

2. The verifiable federated learning method based on hybrid homomorphic encryption as described in claim 1, characterized in that, Step A specifically includes: A1: Model Initialization Each client first reaches an agreement on training the model based on the training objective. PKG then generates an initial global model, learning rate, gradient quantization precision, mapping finite field, and maximum number of federated rounds based on this agreement, and distributes them to all clients as initial local models. A2: Key Initialization PKG generates Pasta encryption scheme, BFV encryption scheme, and security parameters. Then, a Pasta key is generated for all clients and distributed to each client; next, a set of public BFV keys is generated, which includes a public key, a private key, and a computation key, wherein the public key and the computation key are known to all participants. Each client and the aggregation server are exposed, the private key is shared among all clients but kept secret from the aggregation server; then, the Pasta key of each client is encrypted in turn using the BFV public key to form a user list and sent to the aggregation server. A3: Common Parameter Initialization PKG generates a parameter sequence for Lagrange interpolation and sends it to all clients.

3. The verifiable federated learning method based on hybrid homomorphic encryption as described in claim 1, characterized in that, Step B specifically includes: B1: Model Training In each round of model updates, each client trains a local model using its local private dataset, calculates the loss function for this round of training, and the gradient used for updating. B2: Data Preprocessing To encrypt the gradient, the gradient is preprocessed to convert it into a form suitable for "PASTA+BFV" hybrid homomorphic encryption. Specifically, the floating-point gradient is first quantized to integer, then the quantized gradient is mapped onto a finite field to fit the encryption algorithm. Finally, all the data to be encrypted is grouped according to the threshold parameter of the batch conversion operation supported by Pasta. B3: Constructing the verification code For each preprocessed gradient group, a verification code is constructed using Lagrange interpolation. B4: Encryption A plaintext vector is constructed based on a preprocessed gradient block and its verification code; the plaintext vector is then encrypted using the Pasta cipher, and the Pasta symmetric ciphertext is sent to the aggregation server.

4. The verifiable federated learning method based on hybrid homomorphic encryption as described in claim 1, characterized in that, Step C specifically includes: C1: Ciphertext Conversion After receiving the Pasta symmetric ciphertext from the client, the aggregation server first retrieves the Pasta key encrypted by BFV for the user from the user list received from the PKG during the initialization process; then, based on the full homomorphism of the BFV cipher, it homomorphically decrypts the symmetric ciphertext to convert it into BFV homomorphic ciphertext. C2: Aggregation After converting all received Pasta symmetric ciphertexts into BFV homomorphic ciphertexts, the aggregation server aggregates the BFV homomorphic ciphertexts and then sends the aggregation results to each client.

5. The verifiable federated learning method based on hybrid homomorphic encryption as described in claim 1, characterized in that, Step D specifically includes: D1: Verification After receiving the aggregation result from the aggregation server, the client decrypts it and divides it into aggregated gradient groups and aggregated verification codes. Then, it uses Lagrange interpolation to construct a verification code for the aggregated gradient groups and verifies whether the verification code is equal to the aggregated verification code. If they are equal, the verification is successful; otherwise, the verification fails. D2: Update Model If the verification is successful, the user processes the aggregated gradient, which is the inverse operation of data preprocessing in the model training and data encryption process; then the recovered aggregated gradient is used to update the model; if the verification fails, the recovered aggregated gradient is discarded. D3: Iterate into the next round of training, that is, repeat steps B to D until the model converges or the maximum number of federated rounds is reached.

Images