A secure and fair federated learning privacy protection aggregation system and method
Patent Information
- Application Number
- CN202311527204.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-11-16
- Publication Date
- 2026-08-21
- Estimated Expiration
- 2043-11-16
AI Technical Summary
[0006]为了解决上述现有技术中存在的问题，本发明拟提供了一种安全且公平的联邦学习隐私保护聚合系统及方法，拟解决现有的分布式跨设备联邦学习方案存在的计算效率低且对少数客户端不公平的问题
[0029] An anonymous model submission mechanism based on ring signature technology and P2P networks is designed to ensure model updates are not linked, thereby preventing cloud servers from launching model inference attacks and stealing sensitive information from local data. Then, for plaintext model updates, principal component analysis and micro-aggregation algorithms are used to achieve fairness detection of anomalous models. Security analysis shows that the proposed scheme can truly achieve anonymous model submission and protect the privacy of local data through non-linkability. Experimental evaluation demonstrates that the detection scheme of this invention has a high malicious model detection rate and maintains aggregation fairness for minority models, allowing the global model to learn knowledge from diverse data and improving the quality of the global model.
Smart Images
Figure CN117560159B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of federated learning technology, specifically to a secure and fair federated learning privacy-preserving aggregation system and method. Background Technology
[0002] In recent years, based on the unique privacy-preserving properties of federated learning, its introduction into the Internet of Things (IoT) has become an effective way to solve IoT data security problems. Existing research indicates that the distributed architecture of federated learning is vulnerable to privacy and security attacks. More specifically, gradient updates uploaded by edge clients are likely to be attacked by malicious analysts or servers, thereby obtaining private information from users' local data. Security attacks are even more pronounced, especially in B2C distributed network application scenarios. Compared to aggregation servers, edge client devices are more susceptible to malicious attacks and can be controlled by adversaries, who can then submit malicious model updates to hinder global model convergence (Byzantine attack) or generate erroneous models (poisoning attack).
[0003] Currently, there are three main strategies for defending against model poisoning attacks: 1. Removing outliers from local model sets based on distance and similarity between models. 2. The aggregation server testing received models using its own test set. 3. Using blockchain to build a client reputation system, dynamically adjusting the client's reputation based on the quality of each model uploaded. However, all three defense strategies have certain problems. Reputation-based evaluation can constrain benign clients, but it cannot prevent malicious attackers from infiltrating a client and directly launching a model poisoning attack that affects the aggregation of global models in that round. Server-side model quality detection requires the aggregation server to have a corresponding test dataset, which is unreasonable in many application scenarios. Anomaly detection methods based solely on model distance perform poorly against adaptive attacks launched by adversaries with prior knowledge.
[0004] On the other hand, ensuring the fairness of anomaly detection algorithms is also a challenge. In distributed IoT scenarios, data collected by some terminal devices may exhibit non-independent and identically distributed characteristics. The local models submitted by these devices show significant and reasonable differences from the models submitted by the majority of devices. However, existing anomaly detection algorithms often ignore these reasonable differences, removing all outliers. This is unfair to the models of the minority of benign models and contradicts the original intention of using differentiated data to improve the overall model quality. Therefore, it is necessary to identify and retain differentiated, benign models while detecting malicious models.
[0005] Based on the above analysis, the main problems with existing distributed cross-device federated learning schemes are: 1. Difficulty in simultaneously satisfying the requirements of model privacy and aggregation security. Even if some schemes based on homomorphic encryption and third-party server-assisted detection meet these requirements, their communication protocols are often complex, computationally inefficient, and rely heavily on server security assumptions. 2. Failure to achieve fairness detection of anomalous models. Anomaly detection schemes based on Euclidean distance and cosine similarity often fail at high dimensions and ignore model diversity, which is unfair to a minority of clients. Summary of the Invention
[0006] To address the problems existing in the prior art, this invention aims to provide a secure and fair federated learning privacy-preserving aggregation system and method, which addresses the issues of low computational efficiency and unfairness to a minority of clients in existing distributed cross-device federated learning schemes.
[0007] A secure and fair federated learning privacy-preserving aggregation system includes a cloud aggregation server, edge computing nodes, IoT terminal devices, and N training clients that conduct distributed cross-device horizontal federated learning with the assistance of M edge computing nodes; wherein,
[0008] The cloud aggregation server is used to perform fair anomaly detection on the collected local models, identify and exclude malicious models, aggregate benign models, update the global model, and then send it to smart terminal devices.
[0009] Edge computing nodes are used to package the collected local models and transmit them to the anonymous communication system, thereby anonymizing the models at the communication layer.
[0010] IoT terminal devices are used to collect data from their local area network, then train models on the local dataset to obtain local model updates, then use ring signature technology to achieve model anonymity at the message level, and finally upload the local model updates to the corresponding edge computing nodes.
[0011] A secure and fair method for privacy-preserving aggregation in federated learning includes:
[0012] S1. Initialization Phase: Terminal Device Request ring signature key pair { }, negotiate public-key encryption algorithm g, hash function H, and symmetric encryption algorithm E, edge nodes Request a signature key pair { A P2P network is established among M edge nodes, and the cloud server publishes the key pair { And send the initialization model (Model) to all terminal devices;
[0013] S2, Local Training Phase: Terminal Devices Receive the initialization model (Model) and complete the training locally to obtain local model updates. Update the local model Encrypt and attach a ring signature As model message Send to edge nodes;
[0014] S3, Anonymous Communication System Transmission Phase: Edge Nodes Generate a message set after receiving a certain number of model messages. ,in for The managed set of terminal devices then forwards the message set to another edge node or cloud server according to an anonymous communication protocol.
[0015] S4, Malicious Model Detection Phase: The cloud server detects model messages in the received message set. Ring signature verification is performed, and then the model messages are subjected to data dimensionality reduction and then malicious model detection is performed using homogeneous clustering technology.
[0016] S5, Global Model Update Phase: After removing all malicious models detected in S4, the remaining benign models are aggregated to complete the global model update.
[0017] Preferably, S2 includes:
[0018] S201, Terminal Equipment After local model training, the model's local update is obtained. At the same time, generate a random number. Then, based on the public key of the cloud server Encryption yields ciphertext .
[0019] S202, Terminal Equipment Randomly select a subset of participants' public keys as the public key set R, and compute the ring signature. and send This is sent as a model message to the corresponding edge computing node. .
[0020] Preferably, the anonymous communication protocol in S3 includes:
[0021] S301, Edge Node Collected multiple Combined into a message set Edge nodes Will by Forwarded to another edge node ;
[0022] S302, Make a random choice, that is, submit to the cloud server with a probability of 1-p. And forward the message with probability p. Give another edge node ;
[0023] S303, The decision to submit the message will be made with equal probability. Send it to the cloud server, or continue forwarding the message;
[0024] S304, cloud server received message Then, for the message set Each model message in Perform decryption calculations and then verify the ring signature. The correctness of each model message is guaranteed. It is indeed made by legitimate terminal equipment. The generated ring signature is verified, and then the random number is checked. ,make sure This is not a duplicate message.
[0025] Preferably, S4 includes:
[0026] S401, the cloud server first processes all received model messages. Perform ring signature verification to exclude all invalid model messages.
[0027] S402, Constructing a valid model update set Principal component analysis was performed to reduce the dimensionality of the data. Micro-aggregation was then conducted on the dimensionality-reduced data to achieve homogeneous clustering. Finally, malicious model detection was performed within each homogeneous cluster.
[0028] The beneficial effects of this invention include:
[0029] An anonymous model submission mechanism based on ring signature technology and P2P networks is designed to ensure model updates are not linked, thereby preventing cloud servers from launching model inference attacks and stealing sensitive information from local data. Then, for plaintext model updates, principal component analysis and micro-aggregation algorithms are used to achieve fairness detection of anomalous models. Security analysis shows that the proposed scheme can truly achieve anonymous model submission and protect the privacy of local data through non-linkability. Experimental evaluation demonstrates that the detection scheme of this invention has a high malicious model detection rate and maintains aggregation fairness for minority models, allowing the global model to learn knowledge from diverse data and improving the quality of the global model. Attached Figure Description
[0030] Figure 1 This is a diagram of a secure and fair federated learning privacy-preserving aggregation system architecture involved in Example 1.
[0031] Figure 2 This is a flowchart of a secure and fair federated learning privacy-preserving aggregation method according to Example 1.
[0032] Figure 3 This is a comparison of the computational and communication overhead of the solution involved in Example 1 with that of the prior art.
[0033] Figure 4 This is a comparison of the accuracy of the proposed solution in Example 1 with existing technologies when the proportion of malicious models is 10%.
[0034] Figure 5 This is a comparison of the accuracy of the proposed solution in Example 1 with existing technologies when the proportion of malicious models is 20%. Detailed Implementation
[0035] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.
[0036] Example 1
[0037] The following is in conjunction with the appendix Figure 1-5 Specific embodiments of the present invention will be described in detail;
[0038] A secure and fair federated learning privacy-preserving aggregation system, such as Figure 1 As shown, it includes a cloud aggregation server, edge computing nodes, IoT terminal devices, and N training clients that conduct distributed cross-device horizontal federated learning with the assistance of M edge computing nodes; among them,
[0039] The cloud aggregation server is used to perform fair anomaly detection on the collected local models, identify and exclude malicious models, aggregate benign models, update the global model, and then send it to smart terminal devices.
[0040] Edge computing nodes are used to package the collected local models and transmit them to the anonymous communication system, thereby anonymizing the models at the communication layer.
[0041] IoT terminal devices are used to collect data from their local area network, then train models on the local dataset to obtain local model updates, then use ring signature technology to achieve model anonymity at the message level, and finally upload the local model updates to the corresponding edge computing nodes.
[0042] In the following description, cloud aggregation server is referred to as cloud server, edge computing node as edge node, and IoT terminal device as terminal device; for ease of understanding, a list of the main symbols and variables involved in this embodiment is shown:
[0043] Table 1. Variable Symbols and Definitions
[0044]
[0045] A secure and fair method for privacy-preserving aggregation in federated learning includes:
[0046] S1. Initialization Phase: Terminal Device Request ring signature key pair { }, negotiate public-key encryption algorithm g, hash function H, and symmetric encryption algorithm E, edge nodes Request a signature key pair { A P2P network is established among M edge nodes as the underlying communication architecture for the anonymous communication protocol; the cloud server publishes the key pair { And send the initialization model (Model) to all terminal devices;
[0047] S2, Local Training Phase: Terminal Devices Receive the initialization model (Model) and complete the training locally to obtain local model updates. Update the local model Encrypt and attach a ring signature As model message Send to edge nodes;
[0048] S201, Terminal Equipment After local model training, the model's local update is obtained. At the same time, generate a random number. Then, based on the public key of the cloud server Encryption yields ciphertext .
[0049] S202, Terminal Equipment Randomly select a subset of participants' public keys as the public key set R, and compute the ring signature. and send This is sent as a model message to the corresponding edge computing node. Specifically:
[0050] Every smart terminal device Freely select from the set of public keys of all smart devices that contain r. A set R of ring signatures, public key for signing Let be the s-th public key in set R, and have Calculate the symmetric key. Then Randomly select r-1 items As the input to the one-way trapdoor function of the devices corresponding to other public keys in set R, that is ,choose Using a random number v within the range as the initial value, construct a combination function: By solving the combination function in the above equation, we can obtain... .at last Calculate the input to your own one-way trapdoor function. Then output ring signature Ring signature In identification information While ensuring legality and validity, the real signatory will also be considered. The identity information is hidden within multiple smart devices in a set R, achieving message anonymity. Finally... Message Upload to the corresponding edge computing node .
[0051] S3, Anonymous Communication System Transmission Phase: Edge Nodes Generate a message set after receiving a certain number of model messages. ,in for The managed set of terminal devices then forwards the message set to another edge node or cloud server according to an anonymous communication protocol; the anonymous communication protocol includes:
[0052] S301, Edge Node Collected multiple Combined into a message set Edge nodes Will by Forwarded to another edge node ;
[0053] S302, Make a random choice, that is, submit to the cloud server with a probability of 1-p. And forward the message with probability p. Give another edge node ;
[0054] S303, The decision to submit the message will be made with equal probability. Send it to the cloud server, or continue forwarding the message;
[0055] S304, cloud server received message Then, for the message set Each model message in Perform decryption calculations and then verify the ring signature. The correctness of each model message is guaranteed. It is indeed made by legitimate terminal equipment. The generated ring signature is verified, and then the random number is checked. ,make sure This is not a duplicate message.
[0056] S4, Malicious Model Detection Phase: The cloud server detects model messages in the received message set. Ring signature verification is performed, and then the model messages are subjected to data dimensionality reduction and then malicious model detection is performed using homogeneous clustering technology.
[0057] S401. After the server waits for the set time, it will process all messages in the message set collected in this round. Perform ring signature verification. The information in R is used to calculate all records in R. and symmetric keys Then verify the equation. Is it true? If true, then mark it. It comes from IoT smart devices Valid model messages.
[0058] S402. After completing the ring signature verification of all model messages, the cloud server needs to... Principal component analysis is performed to reduce the dimensionality of the model data. The server constructs the matrix. ,in First, the model data is normalized to zero mean, and then the model mean is calculated:
[0059]
[0060] Calculate the variance of the model data:
[0061]
[0062] Perform standardized calculations on the data:
[0063]
[0064] The matrix is obtained after data preprocessing. Then calculate the covariance matrix of the model data:
[0065]
[0066] Next, we need to analyze the covariance matrix. Perform diagonalization to transform it into the following form:
[0067]
[0068] In the formula, Here are the eigenvalues of the covariance matrix, and their corresponding eigenvectors are... And there are Finally, the first d feature vectors can be selected. Reduce the original m-dimensional vector to d-dimensional.
[0069]
[0070] in, It is a d-row, N-column matrix. The dimensionality-reduced model vectors can well represent the main characteristics of the original model update and will be used for subsequent micro-clustering.
[0071] S403, Regarding the matrix Micro-clustering classification is performed on all column vectors (i.e., the principal component vectors updated by each model). This embodiment uses the heuristic fixed-length classification algorithm MDAV to complete the clustering process, ultimately obtaining several homogeneous classes with k records each. Then, based on the division into homogeneous principal component classes, the original model update set is... The model is divided into multiple micro-clusters. This approach maximizes model similarity within clusters and maximizes model difference between clusters. Because the majority and minority models are clustered separately, anomalous models in homogeneous clusters are more likely to be malicious models emitted by attackers, as these anomalous updates are infrequent even for the minority group. Finally, anomalous models are excluded within each micro-cluster based on model similarity, thus completing the fairness detection of malicious models.
[0072] S5. Global Model Update Phase: After removing all malicious models detected in S4, the remaining benign models are aggregated to complete the global model update. After excluding malicious updates in all homogeneous classes, the server will perform an aggregation operation on the remaining benign models in all clusters. In this embodiment, the federated averaging algorithm is used to complete the global model update. The updated global model will be sent to IoT smart devices for subsequent training.
[0073] Experimental evaluation is conducted based on the technical solution of this embodiment, specifically including:
[0074] The MNIST dataset was used as the training dataset, which is a collection of images of handwritten digits 0-9, with approximately 6,000 images for each digit, totaling 60,000 images in the training set and 20,000 images in the test set. In this experiment, N=30 smart edge devices and M=6 edge computing nodes were selected for training. To simulate the model update differences among a minority, images of the digit 0 were only assigned to 3 smart edge devices (the same applies to digits 1 and 2), while the remaining 21 devices equally distributed images of scrambled digits 3-9 to ensure similarity among the majority of models. The batch size was set accordingly.
[0075] =32, global training for 40 rounds, local training for 3 rounds. In addition, to accelerate the training task, malicious poisoning attacks and anomaly detection are only carried out on the final linear layer with 330 parameters.
[0076] First, let's analyze the computational and communication overhead of this embodiment: such as Figure 3 As shown, as p increases, the number of times the model set is transmitted in the P2P network also increases, the anonymity effect of the model set is better, and the privacy of the model in the model set is stronger, but the communication overhead and computation overhead will also increase. Compared with the Paillier scheme [1] encryption model, when the value of p=0.5, the communication overhead is almost the same, and the computation overhead is smaller. Moreover, the model privacy protection method of this embodiment can make the subsequent malicious model detection more accurate.
[0077] Secondly, the malicious model detection mechanism is analyzed: the effects of the scheme in this embodiment, the DNC scheme [2], the Bulyan scheme [3], the Krum scheme [4] and the Emd scheme [5] are compared when the proportion of malicious models is set to 10% and 20% respectively. The DNC scheme is an anomaly detection scheme based on matrix spectral analysis, the Bulyan and Krum schemes are Byzantine fault-tolerant aggregation schemes, while the Emd scheme uses the EMD distance, which is more discriminative for high-dimensional models, to identify malicious models. In order to adapt to the gradually shrinking gradient update value under normal model convergence, the malicious attack applied in this embodiment will gradually increase the attack intensity as global training progresses.
[0078] like Figure 4 , 5As shown, even when the proportion of malicious models is 10%, the accuracy of the baseline and DNC schemes is still poor, indicating that the malicious poisoning attack prevents the global model from converging. Meanwhile, it can be observed that the global models trained by the Krum, Bulyan, Emd, and this embodiment schemes all eventually converge, achieving better model performance. Furthermore, the comparison shows that when the proportion of malicious models is large, the number of benign models used for aggregation decreases, leading to a decline in model accuracy for all convergence schemes under the same number of rounds.
[0079] The specific comparison scheme is as follows:
[0080] [1]Aono Y, Hayashi T, Wang L, et al. Privacy-preserving deep learning via additively homomorphic encryption[J]. IEEE Transactions on InformationForensics and Security, 2017, 13(5): 1333-1345.
[0081] [2]Shejwalkar V, Houmansadr A. Manipulating the byzantine: optimizing model poisoning attacks and defenses for federated learning[C]. 28th AnnualNetwork and Distributed System Security Symposium (NDSS), ELECTR NETWORK:NDSS, 2021.
[0082] [3]Guerraoui R, Rouault S. The hidden vulnerability of distributed learning in byzantium[C]. 35th International Conference on Machine Learning(ICML), Stockholm, Sweden: ACM, 2018: 3521-3530.
[0083] [4]Fang M, Cao X, Jia J, et al. Local model poisoning attacks tobyzantine-robust federated learning[C]. Proceedings of the 29th USENIXConference on Security Symposium: USENIX Association, 2020: 1623-1640.
[0084] [5]Wang J, Xu G, Lei W, et al. CPFL: an effective secure cognitive personalized federated learning mechanism for industry 4.0[J]. IEEETransactions on Industrial Informatics, 2022, 18(10): 7186-7195.
[0085] The embodiments described above merely illustrate specific implementation methods of this application, and while the descriptions are detailed and specific, they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.
Claims
1. A secure and fair method for privacy-preserving aggregation in federated learning, characterized in that, include: S1. Initialization Phase: Terminal Device Request ring signature key pair { }, negotiate public-key encryption algorithm g, hash function H, and symmetric encryption algorithm E, edge nodes Request a signature key pair { A P2P network is established among M edge nodes, and the cloud server publishes the key pair { And send the initialization model (Model) to all terminal devices; S2, Local Training Phase: Terminal Devices Receive the initialization model (Model) and complete the training locally to obtain local model updates. Update the local model Encrypt and attach a ring signature As model message Send to edge nodes; S3, Anonymous Communication System Transmission Phase: Edge Nodes Generate a message set after receiving a certain number of model messages. ,in for The managed set of terminal devices then forwards the message set to another edge node or cloud server according to an anonymous communication protocol. S4, Malicious Model Detection Phase: The cloud server detects model messages in the received message set. Ring signature verification is performed, and then the model messages are subjected to data dimensionality reduction and then malicious model detection is performed using homogeneous clustering technology. S5, Global Model Update Phase: After removing all malicious models detected in S4, the remaining benign models are aggregated to complete the global model update; S4 includes: S401. The cloud server first performs ring signature verification on all received model messages M_i=(PK_M (U_i ||N_i),σ_i) to exclude all illegal model messages; S402. Construct a valid model update set {U}_i |1≤i≤N} and perform principal component analysis to reduce the dimensionality of the data. Perform micro-aggregation on the dimensionality-reduced data to achieve homogeneous clustering. Finally, perform malicious model detection in each homogeneous cluster.
2. The secure and fair federated learning privacy-preserving aggregation method according to claim 1, characterized in that, S2 includes: S201, Terminal Equipment After local model training, the model's local update is obtained. At the same time, generate a random number. Then, based on the public key of the cloud server Encryption yields ciphertext ; S202, Terminal Equipment Randomly select a subset of participants' public keys as the public key set R, and compute the ring signature. and send This is sent as a model message to the corresponding edge computing node. .
3. The secure and fair federated learning privacy-preserving aggregation method according to claim 1, characterized in that, The anonymous communication protocol in S3 includes: S301, Edge Node Collected multiple Combined into a message set Edge nodes Will by Forwarded to another edge node ; S302, Make a random choice, that is, submit to the cloud server with a probability of 1-p. And forward the message with probability p. Give another edge node ; S303, The decision to submit the message will be made with equal probability. Send it to the cloud server, or continue forwarding the message; S304, cloud server received message Then, for the message set Each model message in Perform decryption calculations and then verify the ring signature. The correctness of each model message is guaranteed. It is indeed made by legitimate terminal equipment. The generated ring signature is verified, and then the random number is checked. ,make sure This is not a duplicate message.
4. A secure and fair federated learning privacy-preserving aggregation system, characterized in that, A secure and fair federated learning privacy-preserving aggregation method according to any one of claims 1-3 includes a cloud aggregation server, edge computing nodes, IoT terminal devices, and N training clients that conduct distributed cross-device horizontal federated learning with the assistance of M edge computing nodes; wherein, The cloud aggregation server is used to perform fair anomaly detection on the collected local models, identify and exclude malicious models, aggregate benign models, update the global model, and then send it to smart terminal devices. Edge computing nodes are used to package the collected local models and transmit them to the anonymous communication system, thereby anonymizing the models at the communication layer. IoT terminal devices are used to collect data from their local area network, then train models on the local dataset to obtain local model updates, then use ring signature technology to achieve model anonymity at the message level, and finally upload the local model updates to the corresponding edge computing nodes.