Federated learning method, client, server and system based on attention mechanism

Abstract

The present application discloses a federated learning method, client, server and system based on an attention mechanism. The method of the present application performs local training based on a global model on a local client, and encrypts the trained gradient using the CKKS homomorphic encryption algorithm and uploads it to an aggregation server. The aggregation server forwards the ciphertext gradient to the collaboration server. The collaboration server calculates the weight value of the ciphertext gradient uploaded by the client based on the zoom-click attention mechanism and returns it to the aggregation server, which completes the weighted aggregation of the ciphertext. This can effectively resist poisoning attacks from malicious clients, train high-precision, high-robustness, and high-availability global models in a malicious environment, and ensure that poisoning attacks from malicious clients can be effectively resisted in a malicious environment without affecting the accuracy of the model. At the same time, it provides enhanced privacy protection for client data, and realizes an efficient and secure federated learning process.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a federated learning method, client, server and system based on an attention mechanism. Background Art

[0002] Federated machine learning (Federated machine learning / Federated Learning), also known as federated learning, joint learning, and alliance learning. Federated learning is a distributed machine learning technology that enables all participants to collaboratively train and share global network models to achieve the goal of global optimization without centralizing the sample data corresponding to each participant. The data security issue of federated learning is a key factor in the application and development of federated learning. It has attracted widespread attention and attention from governments, industries, and academia at home and abroad. However, due to the distributed characteristics of federated learning, malicious clients will attempt to modify the behavior of the model by injecting malicious samples into the training data, thereby reducing the performance of the global model or even causing the system to crash, seriously affecting the prediction results, overall performance, and credibility of the system.

[0003] In related technologies, a Byzantine robust asynchronous federated learning framework is used to resist poisoning attacks, but it performs analysis on plain text, which increases the risk of client privacy leakage and loses some client model updates, which can easily lead to loss of global model accuracy. Summary of the invention

[0004] In view of this, the present application provides a federated learning method, client, server and system based on an attention mechanism, which can train high-quality global models in malicious environments, effectively resist poisoning attacks from malicious clients without affecting the model accuracy.

[0005] According to a first aspect of the present application, a federated learning method based on an attention mechanism is provided, which is applicable to an aggregation server, and the method includes:

[0006] Sending the first ciphertext global model of the t-1th round to the client, wherein the first ciphertext global model is a global model encrypted according to the first public key using the CKKS homomorphic encryption algorithm, so that the client determines the gradient information of the client according to the global model of the t-1th round decrypted by the first ciphertext global model of the t-1th round and the local data;

[0007] Receiving ciphertext gradient information sent by the client, wherein the ciphertext gradient information is the gradient information encrypted according to the second public key pair using the CKKS homomorphic encryption algorithm;

[0008] Sending the ciphertext gradient information to the collaboration server, so that the collaboration server calculates the attention weight according to the gradient information and the root gradient information of the client;

[0009] Receiving the ciphertext weight sent by the collaboration server, wherein the ciphertext weight is the attention weight encrypted according to the second public key using the CKKS homomorphic encryption algorithm;

[0010] The first ciphertext global model of the t-1th round is updated according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the tth round.

[0011] Optionally, updating the first ciphertext global model of the t-1th round according to the ciphertext weight and the ciphertext gradient information includes:

[0012] Aggregating the ciphertext gradient information according to the ciphertext weight to obtain a second ciphertext global model of the tth round, wherein the second ciphertext global model is a global model encrypted according to the second public key using the CKKS homomorphic encryption algorithm;

[0013] Sending the second ciphertext global model of the tth round to the collaboration server, so that the collaboration server encrypts the global model obtained by decrypting the second private key bound to the second public key according to the first public key, to obtain the first ciphertext global model of the tth round;

[0014] Receive the first ciphertext global model of the tth round sent by the collaborative server.

[0015] Optionally, before sending the ciphertext gradient information to the collaboration server, the method further includes:

[0016] generating a first ciphertext noise value according to the second public key;

[0017] The first ciphertext noise value is added to the ciphertext gradient information to perform disturbance processing on the ciphertext gradient information.

[0018] Optionally, before sending the second ciphertext global model of the tth round to the collaboration server, the method further includes:

[0019] generating a second ciphertext noise value according to the second public key;

[0020] The second ciphertext noise value is added to the second ciphertext global model of the t-th round to perform perturbation processing on the second ciphertext global model of the t-th round.

[0021] Optionally, after receiving the first ciphertext global model of the tth round sent by the collaboration server, the method further includes:

[0022] If the first ciphertext global model of the t-th round is added with the second ciphertext noise value, denoising is performed on the first ciphertext global model of the t-th round.

[0023] According to a second aspect of the present application, a federated learning method based on an attention mechanism is provided, which is applicable to a collaborative server, and the method includes:

[0024] Receive the ciphertext gradient information sent by the aggregation server;

[0025] Decrypting the ciphertext gradient information according to the second private key bound to the second public key to obtain gradient information;

[0026] Calculating attention weights based on the gradient information and the root gradient information of the client;

[0027] Encrypting the attention weight according to the second public key to obtain a ciphertext weight;

[0028] The ciphertext weight is sent to the aggregation server, so that the aggregation server updates the first ciphertext global model of the t-1th round according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the tth round.

[0029] Optionally, calculating the attention weight according to the gradient information and the root gradient information of the client includes:

[0030] Obtain root data corresponding to the client, and train the root data to obtain root gradient information of the client;

[0031] Performing dot product calculation based on the gradient information and the root gradient information corresponding to the same client to determine the scaling dot product score of the client;

[0032] The proportion of the scaling point score of the client to the total scaling point score of at least one client associated with the collaboration server is calculated as the attention weight.

[0033] Optionally, the attention mechanism-based federated learning method also includes:

[0034] Receiving a second ciphertext global model of round t sent by the aggregation server;

[0035] Decrypting the second ciphertext global model of the tth round according to the second private key to obtain the global model of the tth round;

[0036] Encrypting the global model of the tth round according to the first public key to obtain the first ciphertext global model of the tth round;

[0037] Sending the first ciphertext global model of the tth round to the aggregation server;

[0038] Among them, CKKS homomorphic encryption algorithm is used for encryption processing.

[0039] According to a third aspect of the present application, a federated learning method based on an attention mechanism is provided, which is applicable to a client, and the method includes:

[0040] Receive a first ciphertext global model of round t-1 sent by the aggregation server, wherein the first ciphertext global model is a global model encrypted by using a CKKS homomorphic encryption algorithm according to a first public key;

[0041] Decrypting the first ciphertext global model of the t-1th round according to the first private key bound to the first public key to obtain the global model of the t-1th round;

[0042] Iteratively train the local data according to the global model of the t-1th round to determine the gradient information of the tth round;

[0043] Encrypting the gradient information according to the second public key to obtain ciphertext gradient information;

[0044] The ciphertext gradient information is sent to the aggregation server, so that the aggregation server updates the first ciphertext global model of the t-1th round according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the tth round, wherein the ciphertext weight is obtained by the collaborative server based on the encryption processing of the attention weight, and the attention weight is calculated based on the gradient information.

[0045] According to the fourth aspect embodiment of the present application, a server is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, and when the processor executes the program, the steps of the above-mentioned federated learning method based on the attention mechanism are implemented.

[0046] According to the fifth aspect embodiment of the present application, a client is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, and when the processor executes the program, the steps of the above-mentioned federated learning method based on the attention mechanism are implemented.

[0047] According to the sixth aspect of the present application, a federated learning system is provided, including: the server and client provided in the above embodiment.

[0048] According to the seventh aspect embodiment of the present application, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the above-mentioned federated learning method based on the attention mechanism are implemented.

[0049] By means of the above technical solution, local training is performed on the local client based on the global model obtained in the previous round, and the trained gradient information encryption algorithm is used to encrypt the trained gradient information, and the encrypted ciphertext gradient information is uploaded to the aggregation server. The aggregation server forwards the encrypted ciphertext gradient information to the collaboration server. The collaboration server retains a small, clean and trusted portion of the root data, and calculates the weight value of the ciphertext gradient uploaded by the client based on the zoom-click attention mechanism, and then encrypts the attention weight obtained based on the attention mechanism and returns it to the aggregation server. The aggregation server uses the ciphertext weight and the ciphertext gradient information to complete the update of the global model of the current round. On the one hand, the weight calculation and ciphertext gradient information aggregation of the ciphertext gradient uploaded by the client are performed using the zoom-click attention mechanism, which facilitates the identification of whether the gradient information is maliciously attacked, and reduces the importance of possible malicious data for model updates, thereby achieving an efficient and secure federated learning process. On the other hand, during the federated learning process, the lightweight CKKS homomorphic encryption algorithm is used to encrypt and protect the gradient of the client's private data to ensure that malicious clients cannot infer that members upload malicious gradients, and to ensure that poisoning attacks from malicious clients can be effectively resisted in a malicious environment without affecting the accuracy of the model. At the same time, enhanced privacy protection for client data is provided to achieve an efficient and secure federated learning process. On the other hand, the collaborative server performs related operations of the attention mechanism, and there is no need for dual cloud servers to work simultaneously for the same security protocol, which reduces communication overhead.

[0050] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0052] Figure 1 A schematic diagram of a process flow of a federated learning method based on an attention mechanism provided in an embodiment of the present application is shown;

[0053] Figure 2 A schematic diagram of a flow chart of a federated learning method based on an attention mechanism provided in a specific embodiment of the present application is shown;

[0054] Figure 3 The figure is a schematic diagram of the structure of a federated learning system provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0055] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0056] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0057] Those skilled in the art will appreciate that, unless expressly stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, or there may be intermediate elements. In addition, the "connection" or "connection" used herein may include wireless connection or wireless fusion. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0058] Now, exemplary embodiments according to the present application will be described in more detail with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in a variety of different forms and should not be interpreted as being limited to the embodiments set forth herein. It should be understood that these embodiments are provided to make the disclosure of the present application thorough and complete, and to fully convey the concepts of these exemplary embodiments to those of ordinary skill in the art.

[0059] In this embodiment, a federated learning method based on an attention mechanism is provided, and a federated learning system is used as an example for explanation. The system includes at least one client, an aggregation server, and a collaboration server. At least one client is respectively connected to the aggregation server for communication. Figure 1 As shown, the method includes:

[0060] Step 101, the aggregation server sends the first ciphertext global model of the t-1th round to the client;

[0061] The first ciphertext global model is a global model encrypted by the first public key using the CKKS homomorphic encryption algorithm. t represents the current iteration update round, T represents the number of global iteration rounds, t is a positive integer, t≤T.

[0062] In this embodiment, a lightweight CKKS homomorphic encryption algorithm is used to encrypt the global model, so that the encrypted global model supports operations in an encrypted state without decrypting the ciphertext, thereby realizing computing functions while protecting data privacy, reducing data transmission volume, and reducing communication overhead.

[0063] It is understandable that if this is the first round of learning tasks, the step of the aggregation server sending the first encrypted global model to the client can be omitted, and the client can directly perform training based on local data, or randomly initialize the existing global model of the aggregation server, encrypt the global model and send it to the client for local training.

[0064] In the embodiment of the present application, the client is the data owner in federated learning, which can be a distributed terminal device or user. The terminal can be a smart phone, tablet computer, laptop computer, desktop computer, etc. Each client has its own local data set and performs model training locally. The client is responsible for model training on local data, generating gradients, and uploading them to the aggregation server.

[0065] The aggregation server is a central server that coordinates and integrates the gradients from various clients. After receiving the gradients from multiple clients, the aggregation server uses encryption technology to aggregate weights and add perturbation noise to generate an updated global model. The aggregation server then distributes the updated global model back to each client.

[0066] The collaboration server is a server for secure computing, which assists clients and aggregation servers in performing secure computing operations such as encryption and decryption. The collaboration server is responsible for controlling encryption algorithms, key management, and other security-related operations to ensure data privacy and security during the federated learning process.

[0067] Aggregation servers and collaborative servers can be configured as independent physical servers, or as server clusters or distributed systems consisting of multiple physical servers. They can also be configured as cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0068] Step 102, the client receives the first ciphertext global model of the t-1th round sent by the aggregation server;

[0069] Step 103: The client decrypts the first ciphertext global model of the t-1th round according to the first private key bound to the first public key to obtain the global model of the t-1th round;

[0070] It should be noted that when the federated learning task is started, two public-private key pairs can be generated, namely the bound first public key, the first private key and the bound second public key, the second private key. The two public-private key pairs are used to encrypt and decrypt model parameters between the aggregation server, the collaboration server and the client. The first public key and the first private key can be used as the public-private key pair for the client to interact with the aggregation server, and the second public key and the second private key can be used as the public-private key pair for the collaboration server to interact with the aggregation server. Under normal circumstances, the client and the aggregation server have no right to know the second private key, and the collaboration server and the aggregation server have no right to know the first private key.

[0071] Step 104, the client iteratively trains the local data based on the global model of the t-1th round to determine the gradient information of the tth round;

[0072] Among them, training parameters such as the number of local iteration rounds and iterative training learning rate can be set as needed, and the embodiments of the present application do not make specific limitations. Gradient information is the gradient of the client's local model relative to the loss function, which is used to reflect the optimization direction and degree of the client's local data for the model parameters. Local data, that is, data collected locally by the client, can be applied to the global model for model prediction, model training, and other appropriate multi-party data joint processing. Local data varies with different application scenarios and businesses. For example, application scenarios may include finance, insurance, government affairs, medical care, e-commerce, etc., and local data may be commodity transaction data, financial transaction data, medical and health data, user feature data, relationship feature data, etc.

[0073] In this embodiment, the global model obtained in the previous round is used as a basis, and the client local model is trained with local data, so that the local model can learn some high-quality feature representations from the global model, and can use the model parameters of the global model to adjust its own weights more quickly, so that the local model can quickly converge to the optimal solution.

[0074] It is understandable that the performance of different clients of the system may not be the same. For example, different clients may have different computing capabilities and / or communication capabilities.

[0075] Step 105: The client uses the CKKS homomorphic encryption algorithm to encrypt the gradient information according to the second public key to obtain ciphertext gradient information;

[0076] Step 106, the client sends the ciphertext gradient information to the aggregation server;

[0077] In this embodiment, the local data of the client can be trained on the local client, and the gradient information can be encrypted and transmitted. In this way, the aggregation server obtains the update direction of the global model based on the ciphertext gradient information, and updates the parameters of the global model. On the one hand, by transmitting gradient information to reflect the local training situation, it is possible to avoid transmitting sensitive data to the aggregation server, protect user data privacy, and save communication resources between the client and the aggregation server. On the other hand, by encrypting the gradient information with a second public key, the confidentiality of the gradient information during the transmission process can be ensured, and malicious participants can be effectively prevented from stealing or tampering with the gradient information. On the other hand, the CKKS homomorphic encryption algorithm is used for encryption processing to protect the privacy in the gradient information and realize secure information sharing and privacy-protected joint learning.

[0078] Step 107, the aggregation server receives the ciphertext gradient information sent by the client;

[0079] Step 108, the aggregation server sends the ciphertext gradient information to the collaboration server;

[0080] It is understandable that, considering that there may be multiple clients in the system, multiple clients will upload ciphertext gradient information to the aggregation server. When the aggregation server forwards the ciphertext gradient information to the collaboration server, it can send the ciphertext gradient information uploaded by different clients to the collaboration server one by one in the order in which the ciphertext gradient information is received. The aggregation server can also wait until all clients have uploaded the ciphertext gradient information, and then package the ciphertext gradient information sets of multiple clients and send them to the collaboration server together.

[0081] In an optional embodiment, before step 108, the attention mechanism-based federated learning method also includes: the aggregation server generates a first ciphertext noise value based on the second public key; the aggregation server adds the first ciphertext noise value to the ciphertext gradient information to perform perturbation processing on the ciphertext gradient information.

[0082] In this embodiment, disturbance processing is performed by adding ciphertext noise values ​​to the ciphertext gradient information. The addition of noise values ​​can increase the randomness and uncertainty of the gradient information, and attackers cannot accurately infer the original gradient information, effectively countering privacy attacks, thereby improving the privacy protection of the data, reducing the risk of sensitive information leakage, and further improving the security of model training and updating.

[0083] It can be understood that if the first ciphertext noise value is added to the ciphertext gradient information, the subsequent collaborative server uses the disturbed ciphertext gradient information to calculate the attention weight.

[0084] Step 109, the collaboration server receives the ciphertext gradient information sent by the aggregation server;

[0085] Step 110, the collaboration server decrypts the ciphertext gradient information according to the second private key bound to the second public key to obtain gradient information;

[0086] Step 111, the collaborative server calculates the attention weight according to the gradient information and the root gradient information of the client;

[0087] In this embodiment, the collaborative server retains a small, clean, and trusted portion of root data, and uses the root gradient information obtained by training the root data and the gradient information trained locally on the client to calculate the weight value based on the zoom-click attention mechanism. Thus, the correlation between the root data and the client's local data is determined through the attention mechanism, and then it can be determined whether the client is under a poisoning attack. The initial weight of the subsequent model training is adjusted by the size of the attention weight to reduce the sensitivity to poisoned data during the global model update process, thereby improving the performance and robustness of the global model.

[0088] In an optional embodiment, step 111, that is, the collaborative server calculates the attention weight according to the gradient information and the root gradient information of the client, specifically includes the following steps:

[0089] Step 111 - 1 , the collaboration server obtains the root data corresponding to the client, and trains the root data to obtain the root gradient information of the client;

[0090] The root data is the original data in the client application that has not been modified or processed, represents the initial data state, and has not been changed by other operations.

[0091] Step 111 - 2 , the collaborative server performs dot product calculation based on the gradient information and root gradient information corresponding to the same client to determine the scaling dot product score of the client;

[0092] Specifically, the formula for calculating the scaling point integral score is as follows:

[0093]

[0094] In the formula, g0 represents the root gradient information, d represents the gradient dimension, ⊙ represents the inner product operation, and G i represents the gradient information, α i Represents the corresponding scaling point score of the i-th client.

[0095] It is worth mentioning that if the client's gradient information is significantly different from the clean root gradient information, its scaled point product score may be low, thus reducing its influence in model aggregation.

[0096] Step 111 - 3 : The collaboration server calculates the proportion of the zoom point score of the client to the total zoom point score of at least one client associated with the collaboration server as the attention weight.

[0097] Specifically, the formula for calculating the attention weight is as follows:

[0098]

[0099] In the formula, ω i represents the attention weight of the i-th client, α i represents the corresponding scaled point integral of the ith client, m represents the number of clients interacting with the aggregation server in the federated learning system, and exp(·) represents an exponential function (e.g., exp(a) = e^a).

[0100] In this embodiment, the collaborative server generates root gradient information using clean root data set training. The corresponding scaling point score of the client is calculated through the root gradient information and gradient information belonging to the same client to analyze whether the client is under poisoning attack and quantify the degree of influence of the client on the model parameters. The attention weight is then determined by the proportion of the scaling point score of the client in the total scaling point score of all clients. In this way, the weights are allocated more accurately, which helps to eliminate the interference of malicious clients on model updates, and the model parameters can be updated more safely, ensuring the security and reliability of federated learning.

[0101] Step 112: The collaborative server uses the CKKS homomorphic encryption algorithm to encrypt the attention weight according to the second public key to obtain a ciphertext weight.

[0102] In this embodiment, the attention weights are encrypted using the CKKS homomorphic encryption algorithm, and calculations and processing can be performed using the attention weights without exposing the plaintext. This protects data privacy and prevents information leakage. Even if the collaborative server is attacked or leaked, the attacker cannot obtain the plaintext attention weights, effectively reducing the risk of information leakage caused by server attacks, achieving secure computing, and thus helping to improve the security, credibility, and scalability of federated learning.

[0103] Step 113, the collaboration server sends the ciphertext weight to the aggregation server;

[0104] Step 114, the aggregation server receives the ciphertext weight sent by the collaboration server;

[0105] Step 115: The aggregation server updates the first ciphertext global model of the t-1th round according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the tth round.

[0106] The federated learning method based on the attention mechanism provided in the embodiment of the present application performs local training on the local client based on the global model obtained in the previous round, and encrypts the trained gradient information encryption algorithm, and uploads the encrypted ciphertext gradient information to the aggregation server. The aggregation server forwards the encrypted ciphertext gradient information to the collaboration server. The collaboration server retains a small, clean and trusted root data, and calculates the weight value of the ciphertext gradient uploaded by the client based on the zoom click attention mechanism, and then encrypts the attention weight obtained based on the attention mechanism and returns it to the aggregation server. The aggregation server uses the ciphertext weight and the ciphertext gradient information to complete the weighted aggregation to complete the update of the global model of the current round. The aggregation server distributes the updated ciphertext global model to each client for the next round of training until the preset number of global iterations is reached. On the one hand, the weight calculation and ciphertext gradient information aggregation of the ciphertext gradient uploaded by the client are performed using the zoom click attention mechanism, which is convenient for identifying whether the gradient information has malicious attacks, and reduces the importance of possible malicious data for model updates, so as to achieve an efficient and secure federated learning process. On the other hand, during the federated learning process, the lightweight CKKS homomorphic encryption algorithm is used to encrypt and protect the gradient of the client's private data to ensure that malicious clients cannot infer that members upload malicious gradients, and to ensure that poisoning attacks from malicious clients can be effectively resisted in a malicious environment without affecting the accuracy of the model. At the same time, enhanced privacy protection for client data is provided to achieve an efficient and secure federated learning process. On the other hand, the collaborative server performs related operations of the attention mechanism, and there is no need for dual cloud servers to work simultaneously for the same security protocol, which reduces communication overhead.

[0107] In an optional embodiment, the attention mechanism-based federated learning method further includes: if the current round t is greater than or equal to a preset global iteration number, stopping updating the global model.

[0108] In this embodiment, after the update round of the global model reaches the preset number of global iteration rounds, the global model is no longer updated. In this way, the global model will remain unchanged and will no longer be affected by the update from the local model to avoid overfitting or save computing resources. After stopping updating the global model, model evaluation or other subsequent operations can be performed.

[0109] In an optional embodiment, updating the first ciphertext global model of the t-1th round to form the first ciphertext global model of the tth round specifically includes the following steps:

[0110] Step 201, the aggregation server aggregates the ciphertext gradient information according to the ciphertext weight to obtain the second ciphertext global model of the tth round;

[0111] Among them, the second ciphertext global model is a global model encrypted according to the second public key using the CKKS homomorphic encryption algorithm.

[0112] Step 202, the aggregation server sends the second ciphertext global model of the tth round to the collaboration server;

[0113] It is worth mentioning that before the aggregation server sends the second ciphertext global model of the tth round to the collaboration server, the federated learning method of the attention mechanism also includes: the aggregation server generates a second ciphertext noise value based on the second public key; the aggregation server adds the second ciphertext noise value to the second ciphertext global model of the tth round to perform perturbation processing on the second ciphertext global model of the tth round. In this way, by introducing the ciphertext noise value into the second ciphertext global model for perturbation processing, the specific information of the second ciphertext global model becomes more vague, thereby protecting the privacy data, reducing the sensitivity of the second ciphertext global model and the risk of privacy leakage, increasing the difficulty of attackers, and improving the security of the model.

[0114] Among them, if the first ciphertext noise value has been generated, the first ciphertext noise value can be directly used as the second ciphertext noise value to perturb the second ciphertext global model, thereby omitting the step of generating the second ciphertext noise value according to the second public key.

[0115] It is understandable that if the second ciphertext global model adds a second ciphertext noise value, the subsequent ciphertext global model generated by decryption and encryption by the collaborative server will also be disturbed.

[0116] Step 203, the collaboration server receives the second ciphertext global model of the tth round sent by the aggregation server;

[0117] Step 204: the collaborative server decrypts the second ciphertext global model of the tth round according to the second private key to obtain the global model of the tth round;

[0118] Step 205: The collaborative server uses the CKKS homomorphic encryption algorithm to encrypt the global model of the tth round according to the first public key to obtain the first ciphertext global model of the tth round;

[0119] Step 206: The collaborative server sends the first encrypted global model of round t to the aggregation server

[0120] Step 207: The aggregation server receives the first encrypted global model of the tth round sent by the collaboration server.

[0121] In this embodiment, the aggregation server performs ciphertext weighted aggregation on the local gradient information of all clients based on the ciphertext weight to update the ciphertext global model of the current round. Data is processed in ciphertext form during the aggregation process, which reduces the possibility of malicious attackers stealing sensitive information and improves data security. In addition, since both the ciphertext weight and the ciphertext gradient information are encrypted using the second public key agreed upon by the collaborative server, the client cannot decrypt the second ciphertext global model after ciphertext aggregation. The collaborative server can encrypt the global model obtained after decryption by the second private key based on the first public key, thereby converting the ciphertext global model into a ciphertext form that can be decrypted by the client through re-encryption processing on the basis of ensuring the security of data transmission and processing, so that the client can directly use the converted first ciphertext global model for reasoning and prediction without decrypting the model or communicating with the server, reducing communication overhead and improving the availability of the model and the convenience of practical application.

[0122] It can be understood that if the first ciphertext global model of the tth round is added with the second ciphertext noise value, the first ciphertext global model of the tth round is subjected to denoising to remove the noise disturbance in the first ciphertext global model and obtain a clean first ciphertext global model for subsequent use.

[0123] In a specific embodiment, Figure 2 As shown in the figure, a privacy federated learning method based on attention mechanism is proposed, which includes the following steps:

[0124] Step 301, system initialization.

[0125] The system includes an aggregation server S0, a collaboration server S1 and m clients C, where m is a positive integer.

[0126] Specifically, set the global iteration number T, local iteration number E and learning rate η of the system. Randomly initialize the global model w1 of the aggregation server. The collaborative server collects a small and clean root data set D0 and trains it to generate the root gradient g0. Generate two public and private key pairs for encryption and decryption of model parameters between the aggregation server, the collaborative server and the client, which are the public and private key pairs of the collaborative server and the client. And the client's public and private key pair (pk C ,sk C ). If it is the first update, the aggregation server uses the client's first public key pk C Encrypt the initial global model w1 to obtain the first ciphertext global model

[0127] Among them, the aggregation server uses the client's first public key pk C The steps to encrypt the initial global model w1 are as follows:

[0128] (1) Based on the properties of the CKKS homomorphic encryption algorithm, the model parameters are sharded. The server node divides the initial global model w1 into fragments, i.e.

[0129] (2) Based on the CKKS homomorphic encryption algorithm, use the public key pk C Encrypt each shard to obtain the initial global model ciphertext

[0130] In the formula, the gradient length is n, the encryption length is k, Indicates rounding up operation. Indicates a round-down operation. Indicates the CKKS encryption algorithm.

[0131] Step 302: client local training.

[0132] Specifically, since the federated learning process requires multiple rounds of training, in this section, we take the single client C in round t as i The training process of is taken as an example to illustrate, i represents the client C i The index value of (Ci∈C). Client C i Get the first ciphertext global model distributed by the aggregation server And use the first private key sk C Decrypt the parameter to obtain the global model w in plain text t Client C i Use local data to iterate E times to complete local training and obtain local gradients

[0133] Among them, client C i The steps for local training using local data are as follows:

[0134] (1) Select random samples from the dataset to participate in this iterative training D i Represents client C i The local dataset of , j represents the round of iteration.

[0135] (2) Iteratively train the local model according to the following formula:

[0136]

[0137] Where η represents the learning rate of local training, represents the loss function.

[0138] Step 303: The client uploads the local update.

[0139] Specifically, client Ci Use the collaboration server's second public key For local gradient Encrypt to get the ciphertext gradient And use it as the local update of this round. Client C i The encrypted ciphertext gradient Sent to the aggregation server.

[0140] Step 304: The aggregation server perturbs the local gradient.

[0141] Specifically, the aggregation server obtains the ciphertext gradients of the clients participating in the training The aggregation server randomly generates a non-zero integer as the noise value and uses the second public key of the collaboration server Encrypt it to get the first ciphertext noise value The aggregation server adds the ciphertext noise value to the ciphertext gradient of the client participating in the training to obtain the disturbed ciphertext gradient The aggregation server stores the perturbed ciphertext gradients into the set G and sends the perturbed ciphertext gradients to the collaborative server.

[0142] The formula for adding the ciphertext gradient noise value is as follows:

[0143]

[0144] Step 305: The collaboration server calculates the weight.

[0145] Specifically, the collaborative server obtains the perturbed ciphertext gradient set G. The collaborative server traverses the perturbed ciphertext gradient set G and uses its own second private key Decrypt the perturbed ciphertext gradient. The collaborative server calculates the corresponding scaled point integral value for each perturbed local gradient. The collaborative server calculates the corresponding weight coefficient (attention weight) based on the scaled click score value of the perturbed local gradient. The collaborative server uses its own second public key Encrypt the weight coefficient to obtain the ciphertext weight coefficient The collaborative server sends the ciphertext weight coefficients of the clients participating in the training to the aggregation server.

[0146] Among them, the calculation client C i The corresponding scaling point integral value formula is as follows:

[0147]

[0148] In the formula, g0 represents the root gradient information, d represents the gradient dimension, ⊙ represents the inner product operation, and G i represents the gradient information, α iRepresents the corresponding scaling point score of the i-th client.

[0149] The formula for calculating the corresponding weight coefficient is as follows:

[0150]

[0151] In the formula, ω i represents the attention weight of the i-th client, α i represents the corresponding scaled point integral of the i-th client, m represents the number of clients interacting with the aggregation server in the federated learning system, and exp(·) represents the preset function.

[0152] Step 306: The aggregation server performs global model aggregation update.

[0153] Specifically, the aggregation server obtains the ciphertext weight coefficient of the client. The aggregation server removes the noise value of the perturbed local ciphertext gradient to obtain a clean ciphertext gradient. The aggregation server aggregates the ciphertext local gradients of all clients based on the ciphertext weight coefficient to update the ciphertext global model and obtain

[0154] Among them, the formula for removing ciphertext gradient noise is as follows:

[0155]

[0156] The formula for the aggregation server to aggregate the ciphertext local gradients of all clients based on the ciphertext weight coefficient is as follows:

[0157]

[0158] Step 307: The aggregation server perturbs the global model.

[0159] Specifically, the aggregation server randomly generates a new non-zero integer as the noise value and uses the second public key of the collaboration server Encrypt it to get the second ciphertext noise value Aggregation server is a ciphertext global model Add new ciphertext noise value Get the perturbed ciphertext global model The aggregation server will perturb the ciphertext global model Sent to the collaboration server.

[0160] Among them, is the ciphertext global model The formula for adding the ciphertext gradient noise value is as follows:

[0161]

[0162] Step 308: The collaborative server re-encrypts.

[0163] Specifically, the collaborative server obtains the perturbed ciphertext global model sent by the aggregation server The collaborative server uses its own second private key Global model of perturbed ciphertext Decrypt and get a clean perturbed global model The collaboration server uses the client's first public key pk C Re-encrypt the perturbed global model and obtain The collaborative server sends the re-encrypted perturbed ciphertext to the global model To the aggregation server.

[0164] Step 309: The aggregation server distributes the global model.

[0165] Specifically, the aggregation server obtains the perturbed ciphertext global model The aggregation server removes the noise value from the disturbed ciphertext global model to obtain a clean ciphertext global model. The aggregation server will cipher the global model Distribute to each client for the next round of training, and the update of the global model stops after reaching the set number of rounds T.

[0166] The formula for removing noise value from the global model of the disturbed ciphertext by the aggregation server is as follows:

[0167]

[0168] In this embodiment, first, local training is performed on the local client based on the global model, and the trained gradient is encrypted using the CKKS homomorphic encryption algorithm and uploaded to the aggregation server. The aggregation server perturbs the gradient and sends it to the collaboration server after updating. The collaboration server retains a small and clean trusted root data set, and calculates the weight value of the ciphertext gradient uploaded by the client based on the zoom click attention mechanism. The aggregation server then completes the weighted aggregation of the ciphertext, and finally the dual cloud server uses re-encryption technology to provide the global model to the client for download. This can effectively resist poisoning attacks from malicious clients, train high-precision, high-robustness, and high-availability global models in malicious environments, and ensure that poisoning attacks from malicious clients can be effectively resisted in malicious environments without affecting the accuracy of the model. At the same time, enhanced privacy protection for client data is provided. An efficient and secure federated learning process is achieved.

[0169] It should be noted that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0170] In one embodiment, based on the above Figure 1 and Figure 2 The method shown, in order to achieve the above-mentioned purpose, an embodiment of the present application also provides a server, which includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to implement the above-mentioned attention mechanism-based federated learning method applied to the aggregation server and the collaborative server.

[0171] In one embodiment, based on the above Figure 1 and Figure 2 The method shown, in order to achieve the above-mentioned purpose, an embodiment of the present application also provides a client, which includes a storage medium and a processor; the storage medium is used to store a computer program; the processor is used to execute the computer program to implement the above-mentioned attention mechanism-based federated learning method applied to the client.

[0172] Optionally, the client may also include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display, an input unit such as a keyboard, etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a Bluetooth interface, a WI-FI interface), etc.

[0173] In one embodiment, if Figure 3 As shown, as a specific implementation of the above-mentioned federated learning method based on the attention mechanism, an embodiment of the present application provides a federated learning system, which includes: a client 41, an aggregation server 42 and a collaborative server 43.

[0174] Among them, the client 41 is used to receive the first ciphertext global model of the t-1 round sent by the aggregation server, wherein the first ciphertext global model is a global model encrypted according to the first public key using the CKKS homomorphic encryption algorithm; the first ciphertext global model of the t-1 round is decrypted according to the first private key bound to the first public key to obtain the global model of the t-1 round; local data is iteratively trained according to the global model of the t-1 round to determine the gradient information of the t round; the gradient information is encrypting according to the second public key using the CKKS homomorphic encryption algorithm to obtain the ciphertext gradient information; the ciphertext gradient information is sent to the aggregation server, so that the aggregation server updates the first ciphertext global model of the t-1 round according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the t round, wherein the ciphertext weight is obtained by the collaborative server based on the encryption processing of the attention weight, and the attention weight is calculated based on the gradient information.

[0175] The aggregation server 42 is used to send the first ciphertext global model of the t-1 round to the client, wherein the first ciphertext global model is a global model encrypted according to the first public key using the CKKS homomorphic encryption algorithm, so that the client determines the client's gradient information based on the global model of the t-1 round and local data decrypted by the first ciphertext global model of the t-1 round; receive the ciphertext gradient information sent by the client, wherein the ciphertext gradient information is the gradient information encrypted according to the second public key pair using the CKKS homomorphic encryption algorithm; send the ciphertext gradient information to the collaborative server, so that the collaborative server calculates the attention weight based on the gradient information and the root gradient information of the client; receive the ciphertext weight sent by the collaborative server, wherein the ciphertext weight is the attention weight encrypted according to the second public key using the CKKS homomorphic encryption algorithm; update the first ciphertext global model of the t-1 round based on the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the t round.

[0176] The collaborative server 43 is used to receive the ciphertext gradient information sent by the aggregation server; decrypt the ciphertext gradient information according to the second private key bound to the second public key to obtain the gradient information; calculate the attention weight according to the gradient information and the root gradient information of the client; use the CKKS homomorphic encryption algorithm to encrypt the attention weight according to the second public key to obtain the ciphertext weight; send the ciphertext weight to the aggregation server, so that the aggregation server updates the first ciphertext global model of the t-1 round according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the t round.

[0177] In one embodiment, the aggregation server 42 is specifically used to aggregate the ciphertext gradient information according to the ciphertext weights to obtain the second ciphertext global model of the tth round, wherein the second ciphertext global model is a global model encrypted by the second public key using the CKKS homomorphic encryption algorithm; the second ciphertext global model of the tth round is sent to the collaborative server, so that the collaborative server encrypts the global model obtained after decryption by the second private key according to the first public key to obtain the first ciphertext global model of the tth round; and the first ciphertext global model of the tth round sent by the collaborative server is received.

[0178] In one embodiment, the aggregation server 42 is also used to generate a first ciphertext noise value based on the second public key; add the first ciphertext noise value to the ciphertext gradient information to perform perturbation processing on the ciphertext gradient information; generate a second ciphertext noise value based on the second public key; add the second ciphertext noise value to the second ciphertext global model of the tth round to perform perturbation processing on the second ciphertext global model of the tth round; if the first ciphertext global model of the tth round is added with the second ciphertext noise value, denoising is performed on the first ciphertext global model of the tth round.

[0179] In one embodiment, the collaborative server 43 is specifically used to obtain root data corresponding to the client, and train the root data to obtain root gradient information of the client; perform dot product calculation based on the gradient information and root gradient information corresponding to the same client to determine the scaling point score of the client; calculate the proportion of the scaling point score of the client in the total scaling point score of at least one client associated with the collaborative server as the attention weight.

[0180] In one embodiment, the collaborative server 43 is also used to receive the second ciphertext global model of the tth round sent by the aggregation server; decrypt the second ciphertext global model of the tth round according to the second private key to obtain the global model of the tth round; use the CKKS homomorphic encryption algorithm to encrypt the global model of the tth round according to the first public key to obtain the first ciphertext global model of the tth round; and send the first ciphertext global model of the tth round to the aggregation server.

[0181] Based on the above Figure 1 and Figure 2 The method shown in the embodiment of the present application accordingly provides a readable storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned Figure 1 and Figure 2 The federated learning method based on the attention mechanism is shown.

[0182] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0183] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages and saves the hardware and software resources of the computer device, and supports the operation of information processing programs and other software and / or programs. The network communication module is used to realize communication between the components inside the storage medium, and communication with other hardware and software in the physical device.

[0184] Those skilled in the art will appreciate that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present application. Those skilled in the art will appreciate that the modules in the devices in the implementation scenario can be distributed in the devices of the implementation scenario according to the description of the implementation scenario, or can be changed accordingly and located in one or more devices different from the present implementation scenario. The modules of the above-mentioned implementation scenario can be combined into one module, or can be further split into multiple submodules.

[0185] The above serial numbers of this application are only for description and do not represent the advantages and disadvantages of the implementation scenarios. The above disclosure is only a few specific implementation scenarios of this application, but this application is not limited to them, and any changes that can be thought of by technicians in this field should fall within the scope of protection of this application.

Claims

1. A federated learning method based on attention mechanism, applicable to aggregation servers, characterized in that: The method comprises: Sending the first ciphertext global model of the t-1th round to the client, wherein the first ciphertext global model is a global model encrypted according to the first public key using the CKKS homomorphic encryption algorithm, so that the client determines the gradient information of the client according to the global model of the t-1th round decrypted by the first ciphertext global model of the t-1th round and the local data; Receiving ciphertext gradient information sent by the client, wherein the ciphertext gradient information is the gradient information encrypted according to the second public key pair using the CKKS homomorphic encryption algorithm; Sending the ciphertext gradient information to the collaboration server, so that the collaboration server calculates the attention weight according to the gradient information and the root gradient information of the client; Receiving the ciphertext weight sent by the collaboration server, wherein the ciphertext weight is the attention weight encrypted according to the second public key using the CKKS homomorphic encryption algorithm; According to the ciphertext weight and the ciphertext gradient information, the first ciphertext global model of the t-1th round is updated to form the first ciphertext global model of the tth round; The collaborative server calculates the attention weight according to the gradient information and the root gradient information of the client, including: performing dot product calculation according to the gradient information and the root gradient information corresponding to the same client to determine the scaling point score of the client; calculating the proportion of the scaling point score of the client in the total scaling point score of at least one client associated with the collaborative server as the attention weight; the root gradient information is trained based on the root data corresponding to the client, and the root data is the original data that has not been modified or processed in the application of the client; the calculation formula of the scaling point score is as follows: In the formula, g0 represents the root gradient information, d represents the gradient dimension, ⊙ represents the inner product operation, Gi represents the gradient information, α i Represents the scaling point score of the i-th client.

2. The attention-based federated learning method according to claim 1, characterized in that: The updating of the first ciphertext global model of the t-1th round according to the ciphertext weight and the ciphertext gradient information includes: Aggregating the ciphertext gradient information according to the ciphertext weight to obtain a second ciphertext global model of the tth round, wherein the second ciphertext global model is a global model encrypted according to the second public key using the CKKS homomorphic encryption algorithm; Sending the second ciphertext global model of the tth round to the collaboration server, so that the collaboration server encrypts the global model obtained by decrypting the second private key bound to the second public key according to the first public key, to obtain the first ciphertext global model of the tth round; Receive the first ciphertext global model of the tth round sent by the collaborative server.

3. The attention-based federated learning method according to claim 2, characterized in that: Before sending the ciphertext gradient information to the collaboration server, the method further includes: generating a first ciphertext noise value according to the second public key; Adding the first ciphertext noise value to the ciphertext gradient information to perform disturbance processing on the ciphertext gradient information; Before sending the second ciphertext global model of the tth round to the collaboration server, the method further includes: generating a second ciphertext noise value according to the second public key; adding the second ciphertext noise value to the second ciphertext global model of the t-th round to perform a perturbation process on the second ciphertext global model of the t-th round; After receiving the first ciphertext global model of the tth round sent by the collaboration server, the method further includes: If the first ciphertext global model of the t-th round is added with the second ciphertext noise value, denoising is performed on the first ciphertext global model of the t-th round.

4. A federated learning method based on an attention mechanism, applicable to a collaborative server, characterized in that: The method comprises: Receive the ciphertext gradient information sent by the aggregation server; Decrypting the ciphertext gradient information according to the second private key bound to the second public key to obtain gradient information; Calculating attention weights based on the gradient information and root gradient information of the client, the root gradient information being trained based on root data corresponding to the client, the root data being original data that has not been modified or processed in the application of the client; Using the CKKS homomorphic encryption algorithm, encrypt the attention weight according to the second public key to obtain a ciphertext weight; Sending the ciphertext weight to the aggregation server, so that the aggregation server updates the first ciphertext global model of the t-1th round according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the tth round; The calculating the attention weight according to the gradient information and the root gradient information includes: Performing dot product calculation based on the gradient information and the root gradient information corresponding to the same client to determine the scaling dot product score of the client; Calculate the proportion of the scaling point score of the client to the total scaling point score of at least one client associated with the collaboration server as the attention weight; The calculation formula of the scaling point integral fraction is as follows: In the formula, g0 represents the root gradient information, d represents the gradient dimension, ⊙ represents the inner product operation, Gi represents the gradient information, α i Represents the scaling point score of the i-th client.

5. The method for federated learning based on the attention mechanism according to any one of claim 4, characterized in that: The method further comprises: Receiving a second ciphertext global model of round t sent by the aggregation server; Decrypting the second ciphertext global model of the tth round according to the second private key to obtain the global model of the tth round; Using the CKKS homomorphic encryption algorithm, encrypt the global model of the tth round according to the first public key to obtain the first ciphertext global model of the tth round; The first ciphertext global model of the tth round is sent to the aggregation server.

6. A federated learning method based on an attention mechanism, applicable to a client, characterized in that: The method comprises: Receive a first ciphertext global model of the t-1th round sent by the aggregation server, wherein the first ciphertext global model is a global model encrypted by using a CKKS homomorphic encryption algorithm according to a first public key; Decrypting the first ciphertext global model of the t-1th round according to the first private key bound to the first public key to obtain the global model of the t-1th round; Iteratively train the local data according to the global model of the t-1th round to determine the gradient information of the tth round; Using the CKKS homomorphic encryption algorithm, the gradient information is encrypted according to the second public key to obtain ciphertext gradient information; The ciphertext gradient information is sent to the aggregation server, so that the aggregation server updates the first ciphertext global model of the t-1th round according to the ciphertext weight and the ciphertext gradient information to form the first ciphertext global model of the tth round, wherein the ciphertext weight is obtained by the collaboration server according to the encryption processing of the attention weight, the attention weight is the proportion of the scaled point score of the client to the total scaled point score of at least one client associated with the collaboration server, the scaled point score of the client is obtained by performing dot product calculation based on the gradient information and root gradient information corresponding to the same client, the root gradient information is obtained by training the root data corresponding to the client, and the root data is the original data that has not been modified or processed in the application of the client; the calculation formula of the scaled point score is as follows: In the formula, g0 represents the root gradient information, d represents the gradient dimension, ⊙ represents the inner product operation, Gi represents the gradient information, α i Represents the scaling point score of the i-th client.

7. A server comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the program, the attention mechanism-based federated learning method as described in any one of claims 1 to 5 is implemented.

8. A client, comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the program, the federated learning method based on the attention mechanism as described in claim 6 is implemented.

9. A federated learning system, characterized in that: include: The server as claimed in claim 7 and the client as claimed in claim 8.

Images