Byzantine-robust federated learning method for realizing privacy protection based on block chain

Abstract

The invention discloses a Byzantine-robust federal learning method for realizing privacy protection based on a block chain, and the method comprises the steps: distributing secret keys to a calculation server and participants based on a secret key generation center, initializing a global model through the calculation server, and uploading the initialized global model and a guarantee submitted by the participants to a block chain system; each federal learning participant carries out current model training locally, carries out normalization, homomorphic encryption and signature on the gradient obtained by training, uploads the signature to the block chain system and sends the encrypted gradient to the computing server; verifying the gradient and the signature submitted by the participant through the computing server; carrying out gradient aggregation by adopting a weighted average method based on the computing server, then updating the computing server to initialize the global model, and uploading the updated global model to the block chain; and repeating the steps until the model converges. According to the invention, privacy protection is realized, the communication overhead of the computing server is reduced, and the overall security is improved.

Description

Technical Field

[0001] The present invention relates to the technical fields of federated learning, blockchain and cryptography, and in particular to a Byzantine-robust federated learning method for implementing privacy protection based on blockchain. Background Art

[0002] With the emergence of privacy protection laws such as GDPR (General Data Protection Regulation), the direct use of user private data on central servers has been greatly restricted, and people are paying more and more attention to machine learning methods that can protect user privacy. In 2016, Google proposed a new paradigm called Federated Learning (FL). Federated learning allows all participants to jointly train machine learning models without sharing their local data. However, due to the centralization of the federated learning framework and the lack of trust between the participants, traditional federated learning solutions are vulnerable to poisoning attacks from malicious participants and servers.

[0003] The best solution known to overcome the above defects is "Privacy-Preserving Byzantine-RobustFederated Learning via Blockchain Systems", hereinafter referred to as PBFL, published in IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY in 2022. PBFL can not only resist poisoning attacks, but also provide a privacy protection mechanism, but it still has the following defects: 1) There is a lot of communication overhead and computational overhead. On the one hand, although the PBFL scheme uses blockchain technology to achieve decentralization, it relies on two additional trusted servers for gradient verification and aggregation, which runs counter to the traditional concept of federated learning. It not only greatly increases the communication overhead between servers, but also these two additional trusted servers also reduce the overall security of the scheme. 2) The PBFL scheme cannot resist man-in-the-middle attacks. When the adversary controls the communication channel, the adversary can maliciously modify the gradients uploaded by the participants, which may cause the participants to lose their digital currency.

[0004] The above methods all assume that all participants will abide by the rules of the protocol and execute according to the protocol, and do not take into account the situation that the participants may tamper with the data or submit false data during the execution of the protocol. Summary of the invention

[0005] To solve the above technical problems, the present invention proposes a Byzantine-robust federated learning method based on blockchain to achieve privacy protection. On the basis of the PBFL scheme, the two additional trusted servers in the PBFL scheme are combined into one, and in one global model iteration, the computing server only needs two additional communications to complete the model aggregation, which greatly reduces the communication overhead.

[0006] To achieve the above objectives, the present invention provides a Byzantine-robust federated learning method for implementing privacy protection based on blockchain, comprising:

[0007] S1. The key generation center distributes keys to the computing server and the participants, initializes the global model through the computing server, and uploads the initialized global model and the collateral submitted by the participants to the blockchain system;

[0008] S2. Each participant of the federated learning performs current model training locally, and normalizes, homomorphically encrypts and signs the gradients obtained from the training, uploads the signatures to the blockchain system and sends the encrypted gradients to the computing server;

[0009] S3, verifying the gradient and signature submitted by the participant through the computing server;

[0010] S4, performing gradient aggregation based on the computing server using a weighted average method, then updating the computing server to initialize the global model, and uploading the updated global model to the blockchain;

[0011] S5. Repeat S2-S4 until the model converges and all participants obtain a more accurate model.

[0012] Preferably, the key generation center issues a key pair for homomorphic encryption and a key pair for signature to the computing server and the participating party respectively; wherein the computing server only has a public key for homomorphic calculation and a public key for signature verification.

[0013] Preferably, each participant in the federated learning performs model training locally, including:

[0014] During the i-th global model iteration, each federated learning participant calls the smart contract to obtain the latest global model parameters, and uses the decrypted plaintext of the latest global model parameters as the initialization model parameters for this training. Finally, the MBGD algorithm is used on the local dataset to update the gradient and obtain the updated gradient.

[0015] Preferably, the gradients obtained from training are normalized, homomorphically encrypted and signed, including:

[0016] Normalizing the updated gradient to a vector with a modulus of 1, homomorphically encrypting the updated gradient, and sending the ciphertext to the computing server;

[0017] Each participant signs the ciphertext and sends it to the smart contract on the blockchain.

[0018] Preferably, verifying the gradient and signature submitted by the participant by the computing server includes:

[0019] Signature verification, normalization verification, and cosine similarity verification.

[0020] Preferably, performing the signature verification includes:

[0021] Based on the computing server, the smart contract on the blockchain is called and the downloaded signature is verified. If the verification passes, normalization verification is performed, otherwise the agreement is terminated and the collateral of the corresponding participant is deducted.

[0022] Preferably, performing the normalization verification includes:

[0023] A binary linear equation Y=aX+r randomly generated by the computing server, wherein a (a≠0) and r are random numbers, X is its own inner product, and Y is the ciphertext obtained by the computing server through homomorphic operation;

[0024] Send (X, Y) to a random participant, who decrypts and sends the result (x, y) to the computing server, which verifies whether x is 1 and y is equal to ax+r;

[0025] If the verification is successful, cosine similarity verification will be performed, otherwise the agreement will be terminated and the collateral of the corresponding participants will be deducted.

[0026] Preferably, the cosine similarity verification includes:

[0027] The computing server calculates the cosine value between the gradient submitted by the participant and the gradient obtained locally by the computing server. When the cosine value is greater than or equal to 0, the gradient verified by the cosine similarity is used for model updating. When the cosine value is less than 0, the weight corresponding to the gradient verified by the cosine similarity is set to 0.

[0028] Preferably, the weighted average method is used to perform gradient aggregation based on the computing server, including:

[0029] The computing server performs gradient aggregation by weighted averaging, where the weight corresponding to each gradient is the ratio of the cosine value calculated by the cosine similarity verification to the sum of the cosine values ​​corresponding to each gradient. The computing server then updates the model and uploads the updated model parameters to the smart contract on the blockchain.

[0030] Compared with the prior art, the present invention has the following advantages and technical effects:

[0031] 1. This paper proposes a new privacy-preserving Byzantine-robust federated learning model. Based on the PBFL scheme, this paper combines the two additional trusted servers in the PBFL scheme into one, using only one additional computing server to assist the blockchain in off-chain computing. In addition, in one global model iteration, the computing server only needs two additional communications to complete model aggregation, greatly reducing communication overhead.

[0032] 2. This paper proposes a new privacy-preserving Byzantine-robust federated learning protocol π DPBFL (Decentralized Privacy-Preserving Byzantine-Robust Federated Learning, DPBFL) not only achieves privacy protection and decentralization, but also can resist man-in-the-middle attacks, reduce the communication overhead of computing servers, and improve the overall security of the solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0034] Figure 1 A system model diagram of a Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to an embodiment of the present invention;

[0035] Figure 2 This is a flow chart of a Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0037] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] The present invention proposes a Byzantine-robust federated learning method based on blockchain to achieve privacy protection, such as Figure 1-Figure 2 ,include:

[0039] S1, model initialization phase: the key generation center distributes keys to the computing server and participants, initializes the global model through the computing server, and uploads the collateral submitted by the participants to the blockchain system. The collateral is the deposit;

[0040] Specifically, the key generation center issues key pairs (pk x ,sk x ) and the signature key pair (pk s ,sk s ). The computing server only has the public key pk for homomorphic computing. x and the public key pk for signature verification s The computing server initializes the global model and uploads it to the smart contract on the blockchain. Each federated learning participant needs to submit a deposit to the smart contract to ensure the fairness of the protocol. If the computing server identifies malicious model parameters, it will call the smart contract to deduct the deposit of the corresponding participant as a punishment.

[0041] S2, model initialization stage: each participant of the federated learning performs model training locally, and normalizes, homomorphically encrypts and signs the gradients obtained from the training, uploads the signatures to the blockchain system and sends the encrypted gradients to the computing server;

[0042] Specifically, the local computing phase includes four steps: local training, normalization, homomorphic encryption, and signing. Specifically:

[0043] Step 1. Local training: During the i-th global model iteration, each federated learning participant C j Call the smart contract to obtain the latest global model parameters, and use the decrypted plaintext as the initialization model parameters for this training. Finally, in its own local dataset D j MBGD algorithm is used to update the gradient and obtain the gradient

[0044] Step 2, Normalization: Considering that malicious participants may submit carefully designed gradients to maximize their impact, it is very necessary to normalize the gradients before the participants submit them. Normalization can minimize the impact of malicious participants. The normalization process is to convert the gradients Normalize to a vector with magnitude 1.

[0045] Step 3, Homomorphic encryption: After normalization, each participant needs to convert the gradient Perform homomorphic encryption and send the ciphertext to the computing server.

[0046] Step 4, Signature: Each participant needs to sign the ciphertext obtained in step 3 and send the ciphertext to the smart contract on the blockchain.

[0047] S3, model verification phase: verifying the gradient and signature submitted by the participant through the computing server;

[0048] Specifically, the model verification phase includes three steps: signature verification, normalization verification, and cosine similarity verification. Specifically, it includes:

[0049] Step 1, Signature verification: The computing server calls the smart contract on the blockchain and verifies the downloaded signature. If the verification passes, it proceeds to Step 2, otherwise the agreement is terminated and the deposit of the corresponding participant is deducted.

[0050] Step 2, Normalization verification: In this process, the computing server will randomly generate a binary linear equation Y = aX + r, where a (a ≠ 0) and r are random numbers, X is its inner product, X =<g0,g0> , g0 represents the ciphertext corresponding to the gradient submitted by the participant, and X represents the inner product of g0 and g0. The computing server obtains the ciphertext Y through homomorphic operation and sends (X,Y) to a random participant. The participant decrypts and sends the result (x,y) to the computing server. The server verifies whether x is 1 and whether y is equal to ax+r. If the verification is successful, it enters Step 3. Otherwise, the protocol is terminated and the deposit of the corresponding participant is deducted.

[0051] Step 3, cosine similarity verification: Since this scheme considers that the data sets of each participant are independent and identically distributed, that is, IID. When a participant submits a gradient Gradients submitted to the compute server When there is a large error, the gradient is considered a malicious gradient, which is of no help to the convergence of the global model and may even bring huge negative consequences. Therefore, the cosine similarity verification mechanism is used to identify malicious gradients. The specific approach is to first calculate the cosine value between the gradient submitted by the server calculation participant and the gradient obtained locally by the calculation server. When the cosine value When it is greater than or equal to 0, it is considered that this gradient has a certain convergence effect on the global model and is used to update the model. On the contrary, when the cosine value is less than 0, it is considered that this gradient is of no help to the convergence of the global model, and the weight corresponding to the gradient is set to 0. It should be noted that the cosine value obtained by the computing server is a ciphertext, and it needs to obtain a larger value between this cosine value and 0. In order to reduce communication overhead, this embodiment adopts a numerical method for homomorphic ciphertext comparison in the range of [0,1]. For details, see the MAX algorithm.

[0052] After the computing server completes the signature verification, it will perform normalization verification on the gradients that have passed the signature verification. The purpose of normalization verification is to ensure that the participants have honestly normalized the local gradients. The normalization operation has two purposes: to reduce the impact of malicious participants and to reduce the overhead of secret state computing. Gradients are vectors with size and direction, so the adversary is likely to upload a larger gradient to amplify the impact they cause. After completing the normalization operation, the impact caused by the adversary can be reduced. In addition, after the gradient is normalized, the cosine similarity can be calculated by the inner product between the local gradient of the participant and the trusted gradient of the computing server, which greatly reduces the computational overhead caused by homomorphic operations.

[0053] S4, model update stage: gradient aggregation is performed based on the computing server using a weighted average method, and then the computing server is updated to initialize the global model, and the updated global model is uploaded to the blockchain;

[0054] Specifically, in the model update phase, the computing server uses weighted averaging to aggregate gradients, and the weight corresponding to each gradient is the ratio of the cosine value calculated by the cosine similarity verification to the sum of the cosine values ​​corresponding to each gradient. The computing server then updates the model and uploads the updated model parameters to the smart contract on the blockchain.

[0055] Global model update formula:

[0056] w=w-β*g

[0057] w represents the global model, β represents the global learning rate, and g represents the aggregated gradient.

[0058] S5. Repeat S2-S4 until the model converges.

[0059] After the global model converges, all participants can obtain a higher-precision model. In this process, the data of each participant is not leaked, and the final global model contains the data features of all participants.

[0060] In order to more clearly express the technical solution of the present invention, the following specific embodiments are provided to introduce the solution:

[0061] The embodiment of the present invention provides a Byzantine-robust federated learning method for implementing privacy protection based on blockchain, which is divided into a model initialization phase, a local calculation phase, a model verification phase, and a model update phase. The local calculation phase includes four steps: local training, normalization, homomorphic encryption, and signature. The model verification phase includes three steps: signature verification, normalization verification, and cosine similarity verification. The system model is mainly divided into four roles: a key generation center, a federated learning participant, a computing server, and a blockchain system. The key generation center is responsible for generating and distributing keys, wherein each participant has a pair of keys for homomorphic encryption and a pair of signature keys, and the computing server only has a public key for homomorphic computing and a public key for verifying signatures. Each federated learning participant performs model training locally, and homomorphically encrypts and signs the model parameters obtained by the training. The computing server is responsible for verifying the signatures and model parameters submitted by the participants. The blockchain system is used to ensure the transparency and fairness of the entire computing process.

[0062] The following will be explained in detail in combination with the above four stages, which specifically include the following steps:

[0063] Model initialization phase: The key generation center is responsible for generating two pairs of keys, one of which is x ,sk x ) is used for homomorphic encryption, and another pair of secret keys (pk s ,sk s ) is used for signing. Each federated learning participant has a (pk x ,sk x ) and (pk s ,sk s ), and the computing server only has the pk distributed by the key generation center x and pk s After the secret key is distributed, each participant needs to submit a deposit to the blockchain, and finally the computing server uploads the initialized global model to the blockchain.

[0064] Local computing phase: This phase includes four steps, namely local training, normalization, homomorphic encryption and signing. The specific process of the algorithm designed for each step is as follows:

[0065] Step 1, local training: Each federated learning first calls the smart contract to obtain the latest global model, and then uses the decrypted result of the global model as the initial model parameter to perform gradient descent (MBGD) training on the local data set. The specific process of the algorithm is shown in Table 1;

[0066] Table 1

[0067]

[0068] Step 2, Normalization: After completing local training, each federated learning participant needs to normalize the local gradient. Normalization is to convert the local gradient into a vector with a modulus of 1. Representation vector The specific process of the normalization algorithm is shown in Table 2.

[0069] Table 2

[0070]

[0071] Step 3. Homomorphic encryption: After completing the normalization operation, the participants need to perform homomorphic encryption operations on the model parameters. This embodiment adopts the CKKS fully homomorphic encryption algorithm. CKKS is an algorithm based on floating-point encryption. The encryption and decryption efficiency is very high, but the programming of CKKS is relatively complex. Therefore, this solution uses an EVA homomorphic encryption compiler developed by Microsoft to simplify programming. The EVA compiler will automatically convert the preset plaintext program into a computable encrypted program.

[0072]

[0073] In the formula, is the encrypted normalized local gradient, is the normalized local gradient, pk x The public key for encryption.

[0074] Step 4, Signature: After completing homomorphic encryption, the participants need to sign the ciphertext. The role of the signature is to ensure the integrity and authenticity of the message sent by the participants. The present invention adopts the EIGamal signature scheme, because the EIGamal signature scheme is not only safe, but also has provable security. After the participants complete the signature, the ciphertext and signature corresponding to the model parameters need to be sent to the computing server and blockchain system. The specific process of the signature is shown in Table 3.

[0075] Table 3

[0076]

[0077] Model verification phase: This phase is divided into three steps, namely signature verification, normalization verification and cosine similarity verification.

[0078] Step 1, Signature verification: After the computing server receives the signature submitted by the participant, it first performs a signature verification operation. The specific process of the signature verification algorithm is shown in Table 4;

[0079] Table 4

[0080]

[0081] Step 2, Normalization Verification: The computing server will put the participants who have passed the signature verification into the set S, and then the computing server will perform normalization verification on them. The function of normalization verification is to verify whether the gradient submitted by the participant has been normalized. The specific process is shown in Table 5;

[0082] Table 5

[0083]

[0084] Step 3, cosine similarity verification: After normalizing the verified participants, the computing server will perform cosine similarity verification. The purpose of cosine similarity verification is to find malicious gradients.

[0085] Assume that the data sets between the participants are independent and identically distributed. Therefore, if the cosine value between the gradient submitted by a participant and the local gradient of the computing server is less than 0, it is considered to be a malicious gradient, which has no positive effect on the convergence of the global model and may even reduce the accuracy of the model. Therefore, when performing gradient aggregation, the weight corresponding to the malicious gradient needs to be modified to 0. In order to reduce communication overhead, this embodiment adopts a two-variable iteration method to compare the size of the ciphertext in the range of [0,1]. The specific algorithm for ciphertext comparison is shown in Table 6;

[0086] Table 6

[0087]

[0088] The specific process of cosine similarity verification is shown in Table 7.

[0089] Table 7

[0090]

[0091] Model update phase: After signature verification, normalization verification, and cosine similarity verification, the computing server performs gradient aggregation on the verified gradients, then updates the global model, and finally uploads the updated global model to the blockchain.

[0092] Repeat the above process until the given number of iterations is reached.

[0093] This paper proposes a new privacy-preserving Byzantine-robust federated learning model. Based on the PBFL scheme, this paper combines the two additional trusted servers in the PBFL scheme into one, using only one additional computing server to assist the blockchain in off-chain computing, and in one global model iteration, the computing server only needs two additional communications to complete model aggregation, greatly reducing communication overhead.

[0094] This paper proposes a new privacy-preserving Byzantine-robust federated learning protocol π DPBFL (Decen-tralized Privacy-Preserving Byzantine-Robust Federated Learning, DPBFL), not only achieves privacy protection and decentralization, but also can resist man-in-the-middle attacks and poisoning attacks, reduce the communication overhead of the computing server, and improve the overall security of the solution. See Table 8-Table 10.

[0095] Table 8

[0096]

[0097] Table 9

[0098]

[0099] Table 10

[0100]

[0101] In order to resist man-in-the-middle attacks, the present invention adopts the ElGamal digital signature scheme. In the gradient upload stage, the participants first need to sign the encrypted gradient and then upload the signature to the blockchain. When verifying the signature, the computing server can judge the authenticity and integrity of the gradient submitted by the participant through the verification result. This can not only resist man-in-the-middle attacks, but also protect the digital currency of the participant from being maliciously deducted.

[0102] In order to resist poisoning attacks, the present invention adopts gradient aggregation based on cosine similarity, finds malicious gradients through cosine similarity, and modifies the weight of malicious gradients to 0 through the MAX algorithm, providing a credible global model.

[0103] In order to reduce the communication overhead of the computing server, the present invention designs a new normalized verification protocol NormalVerify. In the protocol NormalVerify, the computing server only needs to complete one communication with the participating party to complete the verification. In addition, the participating party cannot reversely infer additional information from the decryption result. Compared with the PBFL solution, the protocol designed by the present invention has lower communication overhead and is more secure.

[0104] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A Byzantine-robust federated learning method based on blockchain to achieve privacy protection, characterized by: include: S1. Distribute secret keys to computing servers and participants based on the secret key generation center, initialize the global model through the computing server, and upload the initialized global model and the collateral submitted by the participants to the blockchain system; S2. Each participant of the federated learning performs current model training locally, and normalizes, homomorphically encrypts and signs the gradients obtained from the training, uploads the signatures to the blockchain system and sends the encrypted gradients to the computing server; S3, verifying the gradient and signature submitted by the participant through the computing server; S4, performing gradient aggregation based on the computing server using a weighted average method, then updating the computing server to initialize the global model, and uploading the updated global model to the blockchain; S5. Repeat S2-S4 until the model converges and all participants obtain a more accurate model.

2. The Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to claim 1, characterized in that: The key generation center issues a key pair for homomorphic encryption and a key pair for signature to the computing server and the participating party respectively; wherein the computing server only has a public key for homomorphic calculation and a public key for signature verification.

3. The Byzantine-robust federated learning method for privacy protection based on blockchain according to claim 1 is characterized in that: Each participant in federated learning performs model training locally, including: During the i-th global model iteration, each federated learning participant calls the smart contract to obtain the latest global model parameters, and uses the decrypted plaintext of the latest global model parameters as the initialization model parameters for this training. Finally, the MBGD algorithm is used on the local dataset to update the gradient and obtain the updated gradient.

4. The Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to claim 3 is characterized in that: Normalize, homomorphically encrypt and sign the gradients obtained from training, including: Normalizing the updated gradient to a vector with a modulus of 1, homomorphically encrypting the updated gradient, and sending the ciphertext to the computing server; Each participant signs the ciphertext and sends it to the smart contract on the blockchain.

5. The Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to claim 1, characterized in that: Verifying the gradient and signature submitted by the participant through the computing server includes: Signature verification, normalization verification, and cosine similarity verification.

6. The Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to claim 5 is characterized in that: Performing the signature verification includes: Based on the computing server, the smart contract on the blockchain is called and the downloaded signature is verified. If the verification passes, normalization verification is performed, otherwise the agreement is terminated and the collateral of the corresponding participant is deducted.

7. The Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to claim 6 is characterized in that: The normalization verification includes: A binary linear equation Y=aX+r randomly generated by the computing server, wherein a (a≠0) and r are random numbers, X is its own inner product, and Y is the ciphertext obtained by the computing server through homomorphic operation; Send (X, Y) to a random participant, who decrypts and sends the result (x, y) to the computing server, which verifies whether x is 1 and y is equal to ax+r; If the verification is successful, cosine similarity verification will be performed, otherwise the agreement will be terminated and the collateral of the corresponding participants will be deducted.

8. The Byzantine-robust federated learning method for implementing privacy protection based on blockchain according to claim 7 is characterized in that: The cosine similarity verification includes: The computing server calculates the cosine value between the gradient submitted by the participant and the gradient obtained locally by the computing server. When the cosine value is greater than or equal to 0, the gradient verified by the cosine similarity is used for model updating. When the cosine value is less than 0, the weight corresponding to the gradient verified by the cosine similarity is set to 0.

9. The Byzantine-robust federated learning method for privacy protection based on blockchain according to claim 1, characterized in that: Based on the computing server, a weighted average method is used to perform gradient aggregation, including: The computing server performs gradient aggregation by weighted averaging, where the weight corresponding to each gradient is the ratio of the cosine value calculated by the cosine similarity verification to the sum of the cosine values ​​corresponding to each gradient. The computing server then updates the model and uploads the updated model parameters to the smart contract on the blockchain.

Images