A secure aggregation method for asynchronous federated learning based on learning with errors

Abstract

The present invention relates to an asynchronous federated learning security aggregation method based on error-based learning, belonging to the field of information security technology, comprising: a client downloads a global model for local training, randomly selects a secret vector and noise, and masks the locally trained gradient by the secret vector and noise, and uploads the masked gradient; a server receives the masked gradient uploaded by the client, puts it into a buffer K, and when K is full, prepares to aggregate the secret vectors of the clients in K, and broadcasts the clients in K; the clients in K perform security aggregation to obtain the aggregated secret vector s sum , and transmit the client set participating in the security aggregation process to the server; the server sums the mask gradients uploaded by the clients in the client set, and passes it to the server through s sum The mask of the masked gradient is deleted to obtain the updated gradient of the global model. The invention is a novel method for asynchronous security aggregation and reduces the computation and communication overhead in the security aggregation process.

Description

Technical Field

[0001] The invention relates to an asynchronous federated learning security aggregation method based on error-based learning, and belongs to the technical field of information security. Background Art

[0002] Traditionally, private data used to train machine learning models is usually collected and trained by a central server, but this approach requires full trust in the central server. Federated learning allows clients to collaborate with a central server to train machine learning models without sharing data, reducing the level of trust in the central server while protecting the privacy of their own data. Federated learning training is usually coordinated by a central server to achieve decentralized training without sharing local data. The main idea of ​​training is that each client uses its local dataset and the global model maintained by the server to train the local model. The client only shares its local model with the server, and the server updates the global model and pushes it again to the client for the next round of training until convergence. However, recent studies have shown that shared local models still violate the privacy of clients through inference or inversion attacks.

[0003] In order to ensure that the process of uploading local models to the central server is not leaked, a secure aggregation protocol was created. For example, in the article "Practical Secure Aggregation for Privacy-Preserving Machine Learning", Bonawitz used double masking and secret sharing technology to implement the secure aggregation process of the offline recovery mechanism. However, traditional federated learning secure aggregation protocols usually rely on synchronous training. Since each round has to wait for a sufficient number of clients to update, there will be a long wait for the last client that meets the requirements of aggregate training, which will cause a long delay in the entire secure aggregation process and reduce training efficiency.

[0004] Asynchronous federated learning solves this problem by merging the client's updates as soon as they reach the server. While asynchronous federated learning can effectively handle stragglers, it is incompatible with the secure aggregation protocol designed for synchronous federated learning. This is because the traditional secure aggregation process of synchronous federated learning is based on a pairwise mask mechanism, and since the clients participating in the secure aggregation process in each round are asynchronous, the pairwise masks cannot be offset, so they are not suitable for the secure aggregation process of asynchronous federated learning.

[0005] Existing asynchronous federated learning security aggregation processes, for example, Nguyen et al. proposed an asynchronous aggregation protocol called FedBuff to mitigate laggards and jointly achieve secure aggregation, but it relies on a trusted execution environment (TEE) to achieve secure aggregation. Due to the limited memory of the secure execution environment, the buffer size is limited, and the efficiency is lower than that of untrusted hardware; Jinhyun et al. developed a buffered asynchronous security aggregation protocol BASecAgg based on LightSecAgg based on the concept of FedBuff that does not rely on TEE, but it uses the mask calculation method in LightSecAgg, which is computationally complex and has a large amount of communication. Summary of the invention

[0006] In order to solve the problems of incompatibility between asynchronous federated learning and traditional security aggregation, the problem of buffer dependence on trusted execution environment, and the problem of complex calculation of mask operations in the asynchronous security aggregation process, the present invention provides an asynchronous federated learning security aggregation method based on learning with errors (LWE), which is also a novel method for asynchronous security aggregation that satisfies differential privacy. The noise in LWE acts as the noise in differential privacy. This method reduces the computational and communication overhead in the security aggregation process.

[0007] Terminology Note:

[0008] 1. Rényi differential privacy: The noise e in the present invention is uniformly randomly selected from a discrete Gaussian noise distribution, which does not meet the definition of Rényi differential privacy of the traditional continuous Gaussian noise distribution. Therefore, the present invention adopts the Proposition 1 hypothesis proposed by Kairouz et al. to make it meet Rényi differential privacy.

[0009] Proposition 1:

[0010] make For each independent i,j, make make For all and α∈[1,∞), in

[0011] Proposition 1 provides the Rényi divergence D for the noise generated by the discrete Gaussian sum α This directly implies Rényi differential privacy. Proposition 1 yields almost the same results as the privacy analysis of Rényi differential privacy for continuous Gaussian noise distribution. When n equals the batch size and Equal to C 2 (where C is the L2 clipping parameter), the first term of the bound in Proposition 1 is the same as the bound given in the privacy analysis of Rayleigh differential privacy for continuous Gaussian noise distribution.

[0012] As the fixed-point representation of the noise gradient becomes more precise, the second term of the bound (τd) becomes very small. If we use 4 decimal places of precision, this means that σ 2 and The effective value of is 10,000 times its "original" value. Both values ​​increase by a factor of 10 for each additional bit of precision. This has the effect of reducing the value of τ to extremely close to zero.

[0013] 2. FLDP: FLDP is a protocol proposed by Stevens et al. in 2022 that realizes efficient differential privacy and secure aggregation of federated learning through the difficulty of learning with errors, which can support the training of federated learning. The protocol mainly realizes differential privacy through the difficulty of learning with errors (LWE), and uses a synchronous secure aggregation process to realize the aggregate upload of local gradients. Compared with previous differential privacy federated learning training, it not only realizes the addition of noise locally on each client, but also realizes the addition of local noise to meet the central differential privacy requirements, thereby ensuring data privacy and achieving high model accuracy. Compared with previous secure aggregation protocols, FLDP does not require a double mask mechanism, and only requires a single mask with an aggregation vector dimension much smaller than the gradient vector, which greatly reduces communication and computation. Figure 1 The flow of the traditional FLDP overall algorithm is shown. FLDP is a synchronous security aggregation. The present invention has made further improvements to it and applied the improved method to asynchronous security aggregation. In the entire training process, only the first round needs to wait for the buffer to be full, and the remaining rounds do not need to wait for a sufficient number of clients to start training. Therefore, the improved method of the present invention will greatly speed up the model training speed.

[0014] 3. LWE: Learning with errors is an algorithm invented by American computer scientist Regev in 2005. Because its security is based on the difficulty of solving the worst-case lattice problem, the cryptographic algorithm based on the LWE assumption is resistant to quantum attacks. The LWE problem is to solve a system of linear equations with noise. The following are some LWE technology primitives:

[0015] Let F q is a finite field of prime size q, a fixed secret vector In F q The error distribution χ on the error distribution χ, and the error e randomly selected from the error distribution χ. The LWE sample is a pair (a, b), is uniformly randomly selected, b = a·s+e∈F q, where a·s denotes the usual dot product operation. Then the LWE (search) problem consists in retrieving the secret s given a polynomial number of LWE samples (a, b). The difficulty of the LWE decision problem is the problem of distinguishing a set of pairs (a, b) from a set of LWE sample pairs, where each pair is Regev showed that when q is a prime polynomial in n and for F q For an arbitrary error distribution χ on , the LWE decision problem is at least as difficult as the LWE search problem.

[0016] 4. Packed Secret Sharing: A (t, k, n) threshold secret sharing scheme that divides k secret values ​​into n shares and requires at least t + k shares to recover the secret. Packed Shamir Secret Sharing can maintain the same security as traditional Shamir Secret Sharing if the number of shares that the adversary has access to is less than t. To ensure security, the parameter settings are chosen to ensure that the adversary can never access t or more shares.

[0017] The present invention adopts the following technical solution:

[0018] A secure aggregation method for asynchronous federated learning based on error learning is based on a single-server federated learning framework, including a semi-honest server and n semi-honest clients, and includes the following steps:

[0019] (1) The client downloads the global model for local training, randomly selects a secret vector s and noise e, masks the locally trained gradients with the secret vector s and noise e, and uploads the masked gradients;

[0020] (2) The server receives the mask gradient uploaded by the client and puts it into buffer K. When buffer K is full, it prepares to aggregate the secret vector s of the client in K and broadcasts the client in buffer K.

[0021] (3) The client in buffer K performs secure aggregation and obtains the aggregated secret vector s sum , and pass the client set participating in the security aggregation process to the server;

[0022] (4) The server sums the mask gradients uploaded by the clients in the client set participating in the security aggregation process and passes s sum Remove the mask in the masked gradient to obtain the updated gradient of the global model.

[0023] Furthermore, the present invention is divided into three parts, a server, a client, and a buffer, specifically:

[0024] Step (1) comprises:

[0025] 1.1: Each client i obtains the global model gradient from the server and marks the round of downloading the global model as t i , perform local training and obtain gradient updates Uniformly randomly select a random secret vector from the χ discrete Gaussian noise distribution Among them, t represents the round that client i needs to upload to the server after completing local training. Indicates that client i uploads the local model gradient for the tth time, represents the secret vector randomly selected by client i for the tth time, F represents the domain, m and n represent the dimensions of the vector, n is much smaller than m, and q is a prime number;

[0026] 1.2: The client uniformly randomly selects a random noise vector from the χ discrete Gaussian noise distribution represents the noise vector randomly selected by client i for the tth time;

[0027] 1.3: Calculate the t-th mask vector of client i (The arrow ← indicates that the calculation result on the right is assigned to the left). is an identical matrix shared by all parties;

[0028] 1.4: Perform mask operation on the gradient uploaded in this round and calculate the mask gradient uploaded by client i for the tth time Where time(t i -t) is a time compensation function, and the newer local updates play a greater role, that is, t i -The smaller the t is, the greater the time(t i -t) is larger, time(x)=(1+x) -0.5 ;

[0029] 1.5: Mask gradient The uploaded gradient is masked by the mask vector, which satisfies the definition of differential privacy. Therefore, the server cannot know the original local gradient of the client.

[0030] Step (2) comprises:

[0031] 2.1: Server receives And put it into buffer K. When K is full, prepare to aggregate the clients in K. To get

[0032] 2.2: Broadcast the client set in K.

[0033] Step (3) includes:

[0034] 3.1: For each client i, if i∈K, perform security vector addition Sagg to obtain And return the client set U that participates in the security vector addition Sagg (Sagg is a security vector addition used to aggregate the data uploaded by client i Sagg uses packaged secret sharing technology and satisfies the properties of additive homomorphic encryption, see Algorithm 2) This secure aggregation operation only requires the secret vector selected by client i To aggregate, just follow The mask vector in the mask gradient can be eliminated, so the calculation is simple and efficient. The server only needs to broadcast the client set in K to the client and wait for Aggregation results That's it.

[0035] 3.2: and U is sent to the server.

[0036] because The vector dimension of is much smaller than the dimension of the uploaded gradient, so the communication and computation amount of the aggregation process are greatly reduced.

[0037] Step (4) comprises:

[0038] 4.1: For the server, the aggregated mask gradient H is calculated by simple vector addition,

[0039] 4.2: Calculate the gradient and V of the removed mask vector,

[0040] 4.3: Update parameters through V.

[0041] In the present invention, because the server can only obtain s sum , and cannot know the individual client Because a single client adds noise It does not necessarily make a one-time mask Secure enough, but the server can only get Only through Get the belt and Central differential privacy is satisfied, so the server does not know the true aggregate gradient, but the server can use it to train the global model. This not only ensures the privacy of the data, but also allows the training of the global model.

[0042] Traditional pairwise mask-based secure aggregation protocols cannot perform asynchronous aggregation because the vectors masked with one-time masks uploaded by the client in the asynchronous aggregation algorithm contain paired masks (pairwise masks are random vectors encrypted by key negotiation between clients in the same round). Due to different client computing power in the asynchronous aggregation algorithm, the rounds of uploading parameters are different, so the paired masks in the aggregation vector cannot be offset in the asynchronous aggregation algorithm.

[0043] Therefore, the present invention draws on the FLDP proposed by Stevens et al. in 2022 (but the FLDP proposed by Stevens et al. is only suitable for synchronous aggregation), and improves it and applies it to asynchronous aggregation. The improved method introduces a buffer to achieve asynchronous aggregation. In addition, a label (local upload round) is introduced in the original direct aggregation secret vector, and a label (global update round) is introduced when downloading the global model. A time function is introduced through the difference between rounds to adjust the importance of client upload parameters in global updates.

[0044] At the same time, the present invention introduces the FLDP algorithm into asynchronous aggregation for the first time, and compared with the existing asynchronous aggregation algorithms (FedBuff, BASecAgg), it has lower communication and calculation overheads.

[0045] For any details not provided in the present invention, please refer to the prior art.

[0046] The beneficial effects of the present invention are:

[0047] 1. This paper proposes an asynchronous federated learning secure aggregation method based on error-based learning. It is a novel method for asynchronous secure aggregation of differential privacy. The noise in LWE also acts as noise in differential privacy. This method can protect the privacy of locally uploaded gradients during federated learning training. For the server, the server cannot obtain the true gradient uploaded by each client. For the client, the uploaded local gradient cannot be obtained by the server.

[0048] 2. The present invention avoids the waiting delay problem of traditional synchronous security aggregation, which requires waiting for laggards. The asynchronous security aggregation algorithm of the present invention adopts a buffer strategy, and the client only needs to upload the local gradient to the buffer without waiting for each round of synchronous security aggregation process, thereby improving the speed of model training.

[0049] 3. The present invention avoids the problem of incompatibility between asynchronous federated learning and traditional security aggregation. Traditional security aggregation is specially designed for synchronous training, and generally adopts a paired mask mechanism. In asynchronous training, each client is not necessarily in the same round when performing security aggregation, so the paired masks cannot be offset and the aggregation calculation cannot be completed. The asynchronous security aggregation algorithm of the present invention combines the LWE problem, uses the secret vector in LWE to calculate the one-time mask, and the aggregation process only calculates the secret vector, so there is no need to worry about the problem that the clients in the aggregation process are not in the same round.

[0050] 4. The present invention avoids the expensive communication and computing problems of traditional asynchronous security aggregation algorithms, because traditional aggregation algorithms based on paired masks are not suitable for asynchronous processes. Therefore, it is necessary to design a single-mask asynchronous aggregation algorithm, such as FedBuff and BASecAgg. However, FedBuff relies on the trusted execution environment (TEE) as a buffer, which limits the size of the buffer and weakens the speed advantage of asynchronous training. Although BASecAgg solves the problem that the buffer in FedBuff depends on TEE, its aggregation algorithm uses the mask calculation method in LightSecAgg, which is complex in calculation and has a large amount of communication. In the asynchronous federated learning aggregation method based on LWE of the present invention, the mask is calculated by the secret vector in LWE, which is simple in calculation. To restore the mask vector, it only needs to aggregate the secret vector, and the dimension of the secret vector is much lower than the dimension of the uploaded gradient. Therefore, this method reduces the computational and communication overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings in the specification, which constitute a part of the present application, are used to provide further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0052] Figure 1 This is the process of the traditional FLDP overall algorithm;

[0053] Figure 2 This is the process of the asynchronous federated learning security aggregation method based on learning with errors (LWE) of the present invention. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of the present invention are clearly and completely described below in conjunction with the drawings in the implementation of this specification, but are not limited to this. Anything not fully described in the present invention shall be based on the conventional technology in the art.

[0055] Example 1

[0056] A secure aggregation method for asynchronous federated learning based on error-based learning includes the following steps:

[0057] (1) The client downloads the global model for local training, randomly selects a secret vector s and noise e, masks the locally trained gradients with the secret vector s and noise e, and uploads the masked gradients;

[0058] (2) The server receives the mask gradient uploaded by the client and puts it into buffer K. When buffer K is full, it prepares to aggregate the secret vector s of the client in K and broadcasts the client in buffer K.

[0059] (3) The client in buffer K performs secure aggregation and obtains the aggregated secret vector s sum , and pass the client set participating in the security aggregation process to the server;

[0060] (4) The server sums the mask gradients uploaded by the clients in the client set participating in the security aggregation process and passes s sum Remove the mask in the masked gradient to obtain the updated gradient of the global model.

[0061] This embodiment is divided into three parts: server, client, and buffer, specifically:

[0062] Step (1) comprises:

[0063] 1.1: Each client i obtains the global model gradient from the server and marks the round of downloading the global model as t i , perform local training and obtain gradient updates Uniformly randomly select a random secret vector from the χ discrete Gaussian noise distribution Among them, t represents the round that client i needs to upload to the server after completing local training. Indicates that client i uploads the local model gradient for the tth time, represents the secret vector randomly selected by client i for the tth time, F represents the domain, m and n represent the dimensions of the vector, n is much smaller than m, and q is a prime number;

[0064] 1.2: The client uniformly randomly selects a random noise vector from the χ discrete Gaussian noise distribution represents the noise vector randomly selected by client i for the tth time;

[0065] 1.3: Calculate the t-th mask vector of client i (The arrow ← indicates that the calculation result on the right is assigned to the left). is an identical matrix shared by all parties;

[0066] 1.4: Perform mask operation on the gradient uploaded in this round and calculate the mask gradient uploaded by client i for the tth time Where time(t i -t) is a time compensation function, and the newer local updates play a greater role, that is, t i -The smaller the t is, the greater the time(t i -t) is larger, time(x)=(1+x) -0.5 ;

[0067] 1.5: Mask gradient The uploaded gradient is masked by the mask vector, which satisfies the definition of differential privacy. Therefore, the server cannot know the original local gradient of the client.

[0068] Step (2) comprises:

[0069] 2.1: Server receives And put it into buffer K. When K is full, prepare to aggregate the clients in K. To get

[0070] 2.2: Broadcast the client set in K.

[0071] Step (3) includes:

[0072] 3.1: For each client i, if i∈K, perform security vector addition Sagg to obtain And return the client set U that participates in the security vector addition Sagg (Sagg is a security vector addition used to aggregate the data uploaded by client i See Algorithm 2) This secure aggregation operation only requires the secret vector selected by client i To aggregate, just follow The mask vector in the mask gradient can be eliminated, so the calculation is simple and efficient. The server only needs to broadcast the client set in K to the client and wait for Aggregation results That's it.

[0073] 3.2: and U is sent to the server.

[0074] because The vector dimension of is much smaller than the dimension of the uploaded gradient, so the communication and computation amount of the aggregation process are greatly reduced.

[0075] Step (4) comprises:

[0076] 4.1: For the server, the aggregated mask gradient H is calculated by simple vector addition,

[0077] 4.2: Calculate the gradient and V of the removed mask vector,

[0078] 4.3: Update parameters through V.

[0079] In the present invention, because the server can only obtain s sum , and cannot know the individual client Because a single client adds noise It does not necessarily make a one-time mask Secure enough, but the server can only get Only through Get the belt and Central differential privacy is satisfied, so the server does not know the true aggregate gradient, but the server can use it to train the global model. This not only ensures the privacy of the data, but also allows the training of the global model.

[0080] The specific algorithm is shown in Algorithm 1:

[0081]

[0082]

[0083] Secure vector addition Sagg uses packaged secret sharing technology, see Algorithm 2 for details.

[0084]

[0085]

[0086] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A secure aggregation method for asynchronous federated learning based on error-based learning, characterized in that: The following steps are involved: (1) The client downloads the global model for local training, randomly selects a secret vector s and noise e, masks the locally trained gradients with the secret vector s and noise e, and uploads the masked gradients; (2) The server receives the mask gradient uploaded by the client and puts it into buffer K. When buffer K is full, it prepares to aggregate the secret vector s of the client in K and broadcasts the client in buffer K. (3) The client in buffer K performs secure aggregation and obtains the aggregated secret vector s sum , and pass the client set participating in the security aggregation process to the server; (4) The server sums the mask gradients uploaded by the clients in the client set participating in the security aggregation process and passes s sum Delete the mask in the mask gradient to obtain the updated gradient of the global model; Step (1) comprises: 1.1: Each client i obtains the global model gradient from the server and marks the round of downloading the global model as t i , perform local training and obtain gradient updates Uniformly randomly select a random secret vector from the χ discrete Gaussian noise distribution Among them, t represents the round that client i needs to upload to the server after completing local training. Indicates that client i uploads the local model gradient for the tth time, represents the secret vector randomly selected by client i for the tth time, F represents the domain, m and n represent the dimensions of the vector, and q is a prime number; 1.2: The client uniformly randomly selects a random noise vector from the χ discrete Gaussian noise distribution represents the noise vector randomly selected by client i for the tth time; 1.3: Calculate the t-th mask vector of client i is an identical matrix shared by all parties; 1.4: Perform mask operation on the gradient uploaded in this round and calculate the mask gradient uploaded by client i for the tth time Where time(t i -t) is a time compensation function, and the newer local updates play a greater role, that is, t i -The smaller the t is, the greater the time(t i -t) is larger, time(x)=(1+x) -0.5 ; 1.5: Mask gradient Sent to the server.

2. The method for secure aggregation of asynchronous federated learning based on error-based learning according to claim 1, characterized in that: Step (2) comprises: 2.1: Server receives And put it into buffer K. When K is full, prepare to aggregate the clients in K. To get 2.2: Broadcast the client set in K.

3. The method for secure aggregation of asynchronous federated learning based on error-based learning according to claim 2, characterized in that: Step (3) includes: 3.1: For each client i, if i∈K, perform security vector addition Sagg to obtain And return the client set U that participates in the security vector addition Sagg; 3.2: and U is sent to the server.

4. The method for secure aggregation of asynchronous federated learning based on error-based learning according to claim 3 is characterized in that: Step (4) comprises: 4.1: For the server, calculate the aggregated mask gradient H, 4.2: Calculate the gradient and V of the mask vector removed, 4.3: Update parameters through V.

5. The method for secure aggregation of asynchronous federated learning based on error-based learning according to claim 4 is characterized in that: The secure vector addition Sagg adopts the packaged secret sharing technology.

Images