A Collusion-Resistant Byzantine Robust Privacy-Preserving Federated Learning Optimization Method

Abstract

The present invention relates to the technical field of federated learning and privacy protection, and more specifically to a collusion-resistant Byzantine robust privacy-preserving federated learning optimization method. The method comprises a malicious gradient screening mechanism and a collusion-resistant Byzantine robust aggregation strategy. First, the malicious gradient screening mechanism is used to select different random numbers from the clients participating in the federated learning training to blind the local gradients. Then, the central server can calculate the cosine similarity to screen out malicious gradients without knowing the plaintext of the local gradients, thereby taking into account both data privacy and model robustness. Secondly, a collusion-resistant Byzantine robust aggregation strategy is designed, in which the local gradients are weighted according to the cosine similarity calculated by the malicious gradient screening mechanism. Finally, the weights are used to perform weighted aggregation of different local gradients, and homomorphic encryption is used during the aggregation process to ensure data privacy. Secret sharing technology is also used to split the private key, and the client needs to collaborate on decryption when updating the model, thereby resisting collusion attacks between training entities.

Description

Technical Field

[0001] The present invention belongs to the field of federated learning and privacy protection technology, and specifically relates to an anti-collusion Byzantine robust privacy-preserving federated learning optimization method. Background Art

[0002] Federated learning (FL) is a distributed machine learning paradigm. It allows clients to complete model training locally, without sharing local data with a central server. Only local gradients are shared to generate global gradients. By preventing clients from directly sharing local data, it effectively protects data privacy and has gradually become a fundamental technology for training sensitive tasks. It is widely used in fields such as medical image analysis, financial risk control, and autonomous driving. While FL has advanced data privacy protection, it still faces threats such as poisoning and inference attacks.

[0003] Federated learning is distributed, and each client has the right to upload local gradients to update the global model. Therefore, it is highly vulnerable to poisoning attacks by malicious clients. A poisoning attack is initiated by a malicious client, which manipulates the convergence direction of the global model by providing erroneous training data or local gradients. Ultimately, this affects model learning, degrades model performance, and causes prediction errors. To combat poisoning attacks, some research has proposed defenses based on aggregation rules. These methods detect malicious clients and mitigate the impact of poisoning attacks by designing aggregation rules. However, malicious clients may evade detection by using carefully crafted malicious local gradients. Furthermore, some research utilizes trusted verification datasets to screen out malicious clients. First, a central server calculates trusted local gradients using the trusted verification dataset. The central server then compares the cosine similarity between the local gradients uploaded by the client and the trusted gradients to screen out malicious clients and defend against poisoning attacks. However, these schemes rely on unrealistic prior knowledge, which limits their practical application.

[0004] In addition to poisoning attacks, federated learning is also vulnerable to inference attacks during model training. Although clients only share local gradients during training and do not directly share data, semi-honest servers can conduct inference attacks by deeply analyzing local gradients and derive part of the client's training data. To mitigate inference attacks, some research has designed federated learning schemes based on secure multi-party computation, which can securely aggregate global gradients without exposing local gradients. However, secure multi-party computation incurs significant communication overhead. Differential privacy is also a widely used method that protects data privacy by adding random noise to local gradients, but this noise can affect model accuracy. To protect data privacy without compromising model accuracy, some research has leveraged the ciphertext computability of homomorphic encryption, enabling a centralized server to securely aggregate local gradient ciphertexts, effectively maintaining data privacy.

[0005] While some defenses against poisoning and inference attacks exist, most research can only protect against one of these attacks, while simultaneously protecting against both remains challenging. This is because, on the one hand, to protect data privacy and defend against inference attacks, local gradients are typically encrypted or noisy to ensure they are indistinguishable. On the other hand, existing defenses against poisoning attacks tend to use the similarity between local gradients to filter out malicious gradients. This requires ensuring that local gradients are distinguishable in order to obtain similarity information between them. To protect against both poisoning and inference attacks, one proposal uses the Pearson correlation coefficient to filter out malicious clients and employs a dual-server architecture to perform secure computation without revealing the privacy of local gradients. The trusted server holds the private key and can decrypt intermediate parameters. Therefore, the security of this scheme relies on the strong assumption that the confidentiality of the key cannot be compromised. Once the trusted server is compromised by an adversary, the key is highly likely to be leaked, leading to a privacy breach. Based on this, researchers have proposed a privacy protection strategy based on double-trapdoor homomorphic encryption. This mechanism prevents the leakage of the key and local gradients, ensuring data privacy.

[0006] While the aforementioned schemes can defend against both poisoning and inference attacks, they fail to balance model robustness and data privacy under the assumption that entities participating in federated learning training may collude. Because these schemes require collaborative computation using two semi-honest servers, their effectiveness rests on the strong assumption that the two servers do not collude. While some researchers have proposed using compressed sensing technology to protect data privacy and utilize a single server to screen out malicious clients and defend against poisoning attacks, the security of these schemes also relies on the strong assumption that the server and clients do not collude. However, in practice, entities participating in federated learning training may be malicious, posing a security risk of collusion to steal data privacy. To address this, researchers have designed an Auditable Byzantine-robustness federated learning scheme (ABFL) that can defend against collusion among entities participating in federated learning training. However, this scheme requires each client to provide a trusted dataset for malicious gradient detection. Since the data distribution of the trusted dataset must match the client's training data, this compromises data privacy to some extent.

[0007] In summary, existing solutions cannot balance data privacy and model robustness under the assumption that entities participating in federated learning training may collude. Summary of the Invention

[0008] The purpose of this invention is to propose a Byzantine robust privacy-preserving federated learning optimization method that is resistant to collusion. This method solves the problem that existing solutions cannot balance data privacy and model robustness under the assumption that entities participating in federated learning training may collude, thereby improving the security of existing federated learning solutions.

[0009] To achieve the above object, the technical solution adopted by the present invention is:

[0010] A collusion-resistant Byzantine robust privacy-preserving federated learning optimization method is composed of a malicious gradient screening mechanism Randomcos and a collusion-resistant Byzantine robust aggregation strategy. Specifically, it includes the following steps:

[0011] Step 1: The key generation center sends the secret shares of the homomorphically encrypted public key and private key (pk, sk i );

[0012] Step 2: In the tth round of training iteration, client C i Using local dataset D i Perform model training to obtain local gradients

[0013] Step 3: The client converts the local gradient Randomly select a random number r before uploading to the central server i ,calculate

[0014] Step 4: The client encrypts r using the public key pk i -1 , upload R i and [r i -1 ] pk To the central server;

[0015] Step 5: The central server uses the malicious gradient screening mechanism Randomcos to calculate the cosine similarity of local gradients without knowing the local gradient plaintext, to screen out malicious clients and resist poisoning attacks;

[0016] Step 6: Assign different weights to the local gradients based on cosine similarity, and use the homomorphic encryption property to denoise the local gradients before weighted aggregation.

[0017]

[0018] In steps 5 and 6, the local gradients are first weighted according to the cosine similarity calculated by the malicious gradient screening mechanism Randomcos, and then the local gradients are weightedly aggregated using the weights. Homomorphic encryption is used during the aggregation process to ensure data privacy.

[0019] Step 7: The central server aggregates local gradients in the encrypted state to generate a global gradient;

[0020] In steps 1 and 7, secret sharing technology is used to split the private key. When the client updates the model, it needs to collaborate on decryption to resist collusion attacks between servers or clients and enhance the privacy of the federated learning solution.

[0021] In step 8, the client downloads the global gradient ciphertext from the central server and collaboratively decrypts it to update the local model.

[0022] The anti-collusion Byzantine robust privacy-preserving federated learning optimization method proposed in this paper uses the malicious gradient screening mechanism Randomcos to perturb local gradients with random numbers, which can effectively protect the privacy of local gradients.

[0023] This paper proposes a Byzantine robust privacy-preserving federated learning optimization method that is collusion-resistant. In this method, the malicious gradient screening mechanism Randomcos first requires the clients participating in the federated learning training to select different random numbers to blind the local gradients. The central server then uses the blinded local gradients to calculate the cosine similarity to screen out malicious gradients, resist poisoning attacks, and ensure model robustness.

[0024] Compared with the existing solutions, the beneficial effects of the present invention are:

[0025] 1) Under the assumption that entities participating in federated learning training may collude, it can balance data privacy and model robustness.

[0026] 2) To protect data privacy, this invention uses random numbers randomly selected by the client to perturb local gradients, effectively protecting them. Furthermore, by leveraging the ciphertext computability of homomorphic encryption, the semi-honest central server can denoise local gradients without knowing the random number information, thereby ensuring the correct aggregation of the global gradient.

[0027] 3) To ensure model robustness, this paper screens malicious clients by calculating the cosine similarity of perturbed local gradients. To defend against potential collusion attacks among entities participating in federated learning training, each client first selects a different random number to add noise to the local gradient. This prevents malicious clients from obtaining the honest client's random number, even if they collude with the semi-honest central server, and thus from recovering the true local gradient. This protects the honest client's data privacy. Secondly, the private key is split, making decryption impossible for a single client; only the cooperation of all clients is required, further defending against collusion attacks between entities. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1Schematic diagram of a collusion-resistant Byzantine robust privacy-preserving federated learning optimization method of the present invention.

[0029] Figure 2 This is a comparison chart of the attack success rate of target poisoning attacks under different malicious client ratios of the present invention, where a and b represent 20% and 30% malicious clients respectively.

[0030] Figure 3 This is a comparison chart of the source class accuracy and overall accuracy of the target poisoning attack under different malicious client ratios of the present invention, where a and b represent 20% and 30% malicious clients respectively.

[0031] Figure 4 This is a comparison chart of the overall accuracy of non-target poisoning attacks under different malicious client ratios of the present invention, where a, b, and c represent 20%, 30%, and 40% malicious clients, respectively. DETAILED DESCRIPTION

[0032] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and specific embodiments. The following embodiments or drawings are used to illustrate the present invention, but do not limit the scope of the present invention.

[0033] This paper proposes a Byzantine robust and privacy-preserving federated learning optimization method that is resistant to collusion. The method consists of a malicious gradient screening mechanism Randomcos and a Byzantine robust aggregation strategy that is resistant to collusion. The method specifically includes the following steps:

[0034] Step 1: The key generation center sends the secret shares of the homomorphically encrypted public key and private key (pk, sk i );

[0035] Step 2: In the tth round of training iteration, client C i Using local dataset D i Perform model training to obtain local gradients

[0036] Step 3: The client converts the local gradient Randomly select a random number r before uploading to the central server i ,calculate

[0037] Step 4: The client encrypts r using the public key pk i -1 , upload R i and [r i -1 ] pk To the central server;

[0038] Step 5: The central server uses the malicious gradient screening mechanism Randomcos to calculate the cosine similarity of local gradients without knowing the local gradient plaintext, to screen out malicious clients and resist poisoning attacks;

[0039] Step 6: Assign different weights to the local gradients based on cosine similarity, and use the homomorphic encryption property to denoise the local gradients before weighted aggregation.

[0040]

[0041] Step 7: The central server aggregates local gradients in the encrypted state to generate a global gradient;

[0042] In step 8, the client downloads the global gradient ciphertext from the central server and collaboratively decrypts it to update the local model.

[0043] The proposed anti-collusion Byzantine robust privacy-preserving federated learning optimization method consists of the following entities: a Key Generation Center (KGC), a Central Server (CS), n clients C i , i∈[1,n], as shown in the attached Figure 1 The specific functions of each entity are as follows:

[0044] Key Generation Center: The Key Generation Center KGC is responsible for C i Generate public key and private key secret sharing (pk, sk i ).

[0045] Central Server: The central server CS is responsible for receiving all C i The uploaded local gradients are then filtered out without revealing the gradient privacy to resist poisoning attacks. Finally, the filtered gradients are aggregated to obtain a global gradient.

[0046] Client: Client C i Client C is an individual or organization with certain computing power, who collaborates to train a unified model under the coordination of the central server CS. i Own a private dataset D i , the present invention assumes that all C i All data are independent and identically distributed.

[0047] The federated learning training process of the present invention includes three stages: system initialization, security training, and robust aggregation. The detailed steps are as follows:

[0048] (1) System initialization

[0049] In this stage, KGC first generates homomorphic encryption public and private keys (pk, sk) for encrypting and decrypting gradients. Then, KGC uses secret sharing technology to split sk and generate a secret share sk of the private key sk for each client. i , (i∈[1,n]). All shares satisfy the requirement that any shares less than t cannot reveal any information about the secret sk, while any shares not less than t can recover the original secret sk, where t≤n. In consideration of overall performance, the present invention adopts efficient additive secret sharing, where t=n. Finally, the central server CS generates the initial model parameters ω0 of the federated learning and encrypts the global gradient ciphertext [ω (0) ] pk Sent to each client. The detailed calculation process is as follows:

[0050] First, KGC executes the algorithm Setup(1 λ )→(pk,sk i ) i∈[1，n] With safety parameter 1 λ As input, output public parameters PP{q, E, G}, where E is defined in a finite field The elliptic curve on G is the q-order base point of the elliptic curve. Then the key generation center KGC selects sk and calculates

[0051]

[0052] Let sk = s and randomly generate n-1 random numbers x i , where i∈[1,n-1], is the n-1 secret share. Then, calculate the nth secret share:

[0053]

[0054] Let x i =sk i As secret shares, let S be the set of secret shares {sk1, sk2, ..., sk n}, for each secret quorum Then, the key generation center KGC publishes pk and issues S i To each client.

[0055] Finally, the central server CS randomly generates the initial global model ω of federated learning (0) And encrypt and send to each client Enc(pk,ω (0) )→([ω (0) ] pk ), x||y represents the direct concatenation of byte strings or bit strings x and y, H(·) is a cryptographic hash function, The encryption process is as follows:

[0056] (a) Compute the elliptic curve point A = [h]pk, where h = 1. If A is at infinity, report an error and exit.

[0057] (b) Select a random number Calculate c1=[k]G=(x1, y1), [k]pk=(x2, y2);

[0058] (c) Calculate c2 = [ω (0) ]G+[k]pk;

[0059] (d) Calculate c3 = H(x2||ω) (0) ||y2);

[0060] (e) Output ciphertext [ω (0) ] pk =(c1||c2||c3);

[0061] (2) Safety training

[0062] In the tth round of training, each client C i Receive the encrypted global model [ω (t-1) ] pk After that, the clients first collaborate to decrypt, n clients mutually confirm their online status, and t clients online at the same time collaborate to decrypt [ω (t-1 )] pk , the decryption process is as follows:

[0063] (a) Verify whether c1 satisfies the elliptic curve equation. If not, exit with an error.

[0064] (b) Calculate the elliptic curve point S = [h]c1, where h = 1. If s is a point at infinity, an error is reported and the program exits.

[0065] (c) t clients share their respective secret shares and calculate

[0066]

[0067] (d) After the client collaborates to recover the private key, it performs the decryption operation and uses the Baby Step Giant Step (BSGS) algorithm to extract the decrypted data from [ω (t-1) ]G recovery ω (t-1) ;

[0068] [sk]c1=(x2,y2,[ω (t-1) ]G=c2-[sk]c1

[0069] After decryption is completed, the client uses local data D iTrain the model and use Stochastic Gradient Descent (SGD) to calculate the local gradient

[0070]

[0071] (3) Robust aggregation

[0072] When the client trains to obtain local gradients The client generally adopts the method of encrypting local gradients to protect the privacy of local data. However, the encrypted local gradients provide convenience for poisoning attacks by malicious clients. Malicious local gradients are more difficult to detect after encryption. In order to screen malicious gradients, resist poisoning attacks, and enhance the robustness of federated learning schemes without leaking gradient privacy, the present invention designs a malicious gradient screening protocol Randomcos based on cosine similarity. Compared with the traditional malicious gradient screening mechanism based on cosine similarity, Randomcos can screen malicious gradients without leaking gradient privacy; compared with the scheme that also uses cosine similarity to screen malicious gradients in privacy-preserving federated learning, Randomcos can directly use the cosine similarity calculated without additional processing. The specific process of Randomcos is as follows:

[0073] First, client C i Randomly select a random number r i , (i∈[1,n]); then, client C i Multiply the selected random number by the local gradient obtained in this round of training The local gradient is perturbed by random numbers to protect the privacy of the local gradient.

[0074]

[0075] Secondly, client C i R is transmitted through a secure channel (such as Transport Layer Security, TSL) i Sent to the central server CS, transmitted through a secure channel to ensure R i Security during transmission, to prevent malicious attackers from stealing R i The central server CS receives R i It is used to calculate the cosine similarity between local gradients. The specific calculation process is as follows:

[0076]

[0077] For each client C i, the central server CS uses Randomcos to calculate the cosine similarity between it and the previous round of global gradient, and uses it as the client C i credibility score.

[0078] Score i =cos (i，j)

[0079] Finally, the central server CS assigns different weights to each client based on its credibility score. Since the similarity between malicious local gradients and benign local gradients is low, benign local gradients can be distinguished from malicious local gradients through cosine similarity. The higher the credibility score of a local gradient, the more similar the local gradient is to the global gradient of the previous round, and the more likely the local gradient is to be a benign local gradient, and the greater the weight assigned to it. The more dissimilar the malicious local gradient is to the global gradient of the previous round, the lower the credibility score is, and the smaller the corresponding weight is. Finally, when the central server CS performs weighted aggregation, the influence of the malicious local gradient is smaller. In this way, the present invention resists poisoning attacks and improves the robustness of the federated learning scheme when encountering poisoning attacks.

[0080]

[0081] (4) After the central server CS calculates the weights of different clients, it needs to perform weighted aggregation on the local gradients uploaded by the clients to form a global model.

[0082] First, client C i It is necessary to use the homomorphic encryption public key pk to encrypt the inverse of the random number it chooses [r i -1 ] pk Upload to the central server CS. Because during the malicious gradient screening phase, the central server CS obtains local gradients with random numbers uploaded by each client. During the weighted aggregation process, the random numbers need to be eliminated to avoid affecting the global model. This invention uses the characteristics of homomorphic encryption to eliminate random numbers. The specific process is as follows:

[0083] The central server CS receives [r i -1 ] pk Post-calculation Due to the properties of homomorphic encryption, random numbers can be effectively eliminated, ultimately allowing the central server CS to obtain the local gradient ciphertext. However, since the central server CS lacks decryption capabilities, it cannot decrypt and steal the local gradient plaintext information. When a semi-honest server colludes with a client, as long as the number of clients colluding with the central server CS does not exceed the threshold set by the present invention during the secret key sharing phase, the colluding central server CS and the client will also be unable to decrypt the gradient ciphertext. Therefore, the present invention can achieve aggregation without leaking gradient privacy and can resist collusion attacks within a certain range.

[0084]

[0085] After eliminating random numbers, the central server CS performs weighted aggregation on the local gradients and calculates the global model. The specific process is as follows:

[0086]

[0087] Finally, the central server CS sends the global model ciphertext [ω (t) ] pk The data is sent to each client. The client repeats steps (2), (3), and (4) until the training reaches the preset number of rounds or the model reaches the preset accuracy.

[0088] Comparative experiment:

[0089] This paper compares the present invention with FedAvg and Shieldfl. FedAvg is the original federated learning algorithm, while Shieldfl is a paper published in 2022 in the top international SCI journal "IEEE Transactions on Information Forensics and Security".

[0090] In order to verify the superiority of the present invention, this experiment constructed two standard model poisoning attacks, a targeted attack and a non-target attack.

[0091] (1) Target poisoning attack: Target poisoning attacks mislead the specified data from source class i to target class j, while ensuring that other classes are not affected. To simulate a target poisoning attack, the data with label 0 in the malicious client training data is relabeled as label 4 for training the malicious local gradient.

[0092] (2) Non-target poisoning attack: The purpose of non-target poisoning attack is to reduce the prediction accuracy of all classes. To simulate non-target poisoning attack, the training data labels of the malicious client are relabeled. For each source class label i, it is relabeled as ni-1, where n is the total number of data labels.

[0093] For target poisoning attacks, this experiment uses overall test accuracy, attack success rate (Attack Success Rate, ASR) and source class test accuracy to evaluate the performance of the present invention. The purpose of the target poisoning attack is to reduce the source class prediction accuracy while ensuring that other classes remain unchanged. Therefore, the correct implementation of the target poisoning attack is ensured by measuring the overall test accuracy. When the source class data in the test data is classified as the target class by the global model, the attack is judged to be successful. The attack success rate represents the proportion of test inputs that are successfully attacked. A lower ASR indicates that the model has a stronger defense capability against target poisoning attacks. In addition to the attack success rate, the source class test accuracy can also directly reflect whether the model can effectively resist target poisoning attacks. The higher the source class test accuracy, the more the model can correctly identify the category, thereby proving that the solution can effectively defend against target poisoning attacks.

[0094] For non-target poisoning attacks, this experiment uses overall test accuracy to evaluate the performance of the present invention. The higher the overall test accuracy, the better the model's defense effect against non-target poisoning attacks.

[0095] First, the experiment evaluates the success rate of target poisoning attacks under different malicious client ratios. Figure 2 It can be seen that the Fedavg solution has a higher attack success rate under different malicious client ratios, which means that Fedavg is basically unable to resist target poisoning attacks and the model performance will be damaged when attacked. This proves the importance of studying how to resist poisoning attacks. Figure 2 It can be seen that under different malicious client ratios, the ASR of the present invention is around 0.1, maintaining a low state and lower than Shieldfl. This proves that the performance of the present invention in resisting target poisoning attacks is better than Shieldfl.

[0096] In addition to the attack success rate ASR, the experiment also measured the source class prediction accuracy and overall test accuracy under different malicious client ratios. Figure 3 Global represents the overall test accuracy, and the others represent the source class test accuracy obtained under different aggregation methods. Figure 3 It can be seen that the source class test accuracy of the present invention is higher than that of the Fedavg solution and is similar to the overall test accuracy. Therefore, it can be inferred that the present invention can effectively resist target poisoning attacks.

[0097] And as the proportion of malicious clients increases, the source class test accuracy of the present invention remains around 0.9. However, as the proportion of malicious clients increases, the source class test accuracy of Shieldfl decreases. This is because in the present invention, the local gradient of each client is directly calculated with the global gradient for cosine similarity, and then the local gradients are weighted and aggregated based on these similarities. Therefore, even if there are malicious clients, their local gradients differ greatly from the global gradients, so the weights assigned to malicious clients in the weighted aggregation process are relatively small. The impact of malicious clients on the global model is relatively small, and the source class test accuracy can be maintained at a high level.

[0098] But in Shieldfl, it first calculates the cosine similarity between the global model update and the gradient of each client. Then, based on these similarities, a client is selected as a malicious client. Next, the cosine similarity of the gradients of other clients is calculated with the gradient of the malicious client, and the gradients are weighted and aggregated according to these similarities. Such an operation is intended to minimize the impact of malicious clients on the global model while retaining the contribution of normal clients. However, when the proportion of malicious clients increases, this method may lead to misjudgment and loss of normal client gradients due to its complex processing strategy, thereby reducing the source class test accuracy when the proportion of malicious clients increases. Since the present invention is simpler and more direct, when the number of malicious clients increases, it is also ensured as much as possible that the source class test accuracy is not reduced.

[0099] For non-target poisoning attacks, the experiment evaluates the performance of the solution by measuring the overall accuracy of the model. Figure 4 This chart compares the overall accuracy of different solutions at a malicious client ratio of 20%-40%. As can be seen from the figure, the present invention outperforms Shieldfl in both effectiveness and stability. At a malicious client ratio of 20%, Shieldfl and the present invention achieve similar overall accuracy, approaching 0.9, significantly exceeding the defenseless Fedavg solution. This demonstrates that both the present invention and Shieldfl offer excellent defense against non-targeted poisoning attacks.

[0100] As the proportion of malicious clients increases, the overall accuracy of the Fedavg method decreases significantly. When the proportion of malicious clients is greater than or equal to 30%, the overall accuracy of the present invention and the Shieldfl solution also decreases slightly. This is because the increase in the proportion of malicious clients increases the number of malicious gradients in the federated learning training process, and the convergence direction of the global model is disturbed by a large number of malicious gradients, resulting in a decrease in overall accuracy. However, the overall accuracy of the present invention can still be maintained at around 0.8, and will not change drastically with the increase in the number of iterations, demonstrating the effectiveness and stability of the solution. When the proportion of malicious clients reaches 40%, the overall accuracy of the Shieldfl solution remains at around 0.6 with the increase in the number of iterations, which is higher than the 0.5 of the Fedavg solution, but lower than the 0.8 of the present invention. This proves that Shieldfl can defend against non-target poisoning attacks, but its defense performance is lower than that of the present invention.

[0101] The above content is merely an example and explanation of the concept of the present invention. Those skilled in the art may make various modifications or additions to the described specific embodiments or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the claims, they should all fall within the scope of protection of the present invention.

Claims

1. A Byzantine robust privacy-preserving federated learning optimization method that is collusion-resistant, characterized by: It consists of a malicious gradient screening mechanism Randomcos and a collusion-resistant Byzantine robust aggregation strategy, specifically including the following steps: Step 1: The key generation center sends the secret shares of the homomorphically encrypted public key and private key (pk, sk i ); Step 2: In the tth round of training iteration, client C i Using local dataset D i Perform model training to obtain local gradients Step 3: The client converts the local gradient Randomly select a random number r before uploading to the central server i ,calculate Step 4: The client encrypts r using the public key pk i -1 , upload R i and [r i -1 ] pk To the central server; Step 5: The central server uses the malicious gradient screening mechanism Randomcos to calculate the cosine similarity of local gradients without knowing the local gradient plaintext, to screen out malicious clients and resist poisoning attacks; Step 6: Assign different weights to the local gradients based on cosine similarity, and use the homomorphic encryption property to denoise the local gradients before weighted aggregation. Step 7: The central server aggregates local gradients in the encrypted state to generate a global gradient; In step 8, the client downloads the global gradient ciphertext from the central server and collaboratively decrypts it to update the local model.

2. The optimization method according to claim 1, wherein: In steps 5 and 6, the local gradients are first weighted according to the cosine similarity calculated by the malicious gradient screening mechanism Randomcos, and then the local gradients are weightedly aggregated using the weights. Homomorphic encryption is used during the aggregation process to ensure data privacy.

3. The optimization method according to claim 1, wherein: In steps 1 and 7, secret sharing technology is used to split the private key. When the client updates the model, it needs to collaborate on decryption to resist collusion attacks between the central server or clients and enhance the privacy of the federated learning solution.

4. The optimization method according to any one of claims 1 to 3, characterized in that: Using the malicious gradient screening mechanism Randomcos, the local gradient is perturbed by random numbers, which can effectively protect the privacy of local gradients.

5. The optimization method according to any one of claims 1 to 3, characterized in that: The malicious gradient screening mechanism Randomcos first requires the clients participating in federated learning training to select different random numbers to blind the local gradients. Then the central server uses the blinded local gradients to calculate the cosine similarity, screen out malicious gradients, resist poisoning attacks, and ensure model robustness.

Images