A method for implementing privacy protection byzantine-robust federated learning based on a block chain

Abstract

This invention discloses a privacy-preserving Byzantine-robust federated learning method based on blockchain, comprising: distributing keys to a computing server and participating parties through a key generation center; initializing a global model through the computing server; uploading the initialized global model and collateral submitted by participating parties to the blockchain system; each participating party training the current model locally; normalizing, homomorphically encrypting, and signing the gradients obtained during training; uploading the signatures to the blockchain system and sending the encrypted gradients to the computing server; verifying the gradients and signatures submitted by participating parties through the computing server; aggregating gradients using a weighted average method based on the computing server; updating the initialized global model on the computing server; and uploading the updated global model to the blockchain; repeating the above steps until the model converges. This invention achieves privacy protection, reduces the communication overhead of the computing server, and improves overall security.

Description

Technical Field

[0001] This invention relates to the fields of federated learning, blockchain, and cryptography, and in particular to a Byzantine-robust federated learning method based on blockchain for privacy protection. Background Technology

[0002] With the advent of privacy protection laws such as the GDPR (General Data Protection Regulation), the direct use of users' private data on central servers has been severely restricted, leading to increasing attention on machine learning methods that can protect user privacy. In 2016, Google proposed a new paradigm: Federated Learning (FL). Federated Learning allows participating parties to jointly train machine learning models without sharing their local data. However, due to the centralized nature of the federated learning framework and the lack of trust between participating parties, traditional federated learning solutions are vulnerable to poisoning attacks from malicious participants and servers.

[0003] The best known solution to overcome these shortcomings is "Privacy-Preserving Byzantine-Robust Federated Learning via Blockchain Systems," published in IEEE Transactions on Information, Forensics and Security in 2022 (hereinafter referred to as PBFL). PBFL not only resists poisoning attacks but also provides privacy protection mechanisms. However, it still has the following drawbacks: 1) Significant communication and computational overhead. On the one hand, although the PBFL scheme uses blockchain technology to achieve decentralization, it relies on two additional trusted servers for gradient verification and aggregation. This contradicts the traditional federated learning concept, significantly increasing communication overhead between servers and reducing the overall security of the scheme. 2) The PBFL scheme cannot resist man-in-the-middle attacks. When an adversary controls the communication channel, they can maliciously modify the gradients uploaded by participants, potentially causing losses to the participants' digital currency.

[0004] The above methods all assume that all participants will abide by the agreement rules and execute the agreement accordingly, without taking into account the possibility that participants may tamper with data or submit false data during the execution of the agreement. Summary of the Invention

[0005] To address the aforementioned technical issues, this invention proposes a Byzantine-Robust Federated Learning method based on blockchain for privacy protection. Building upon the PBFL scheme, it combines the two additional trusted servers in the PBFL scheme into one, and in a single global model iteration, the computing server only needs two additional communications to complete model aggregation, significantly reducing communication overhead.

[0006] To achieve the above objectives, this invention provides a privacy-preserving Byzantine-robust federated learning method based on blockchain, comprising:

[0007] S1. Distribute keys to the computing server and participants based on the key generation center, initialize the global model through the computing server, and upload the initialized global model and the collateral submitted by the participants to the blockchain system;

[0008] S2. Each participant in the federated learning performs local training of the current model, and normalizes, homomorphically encrypts and signs the gradients obtained from the training, uploads the signature to the blockchain system and sends the encrypted gradients to the computing server.

[0009] S3. The computing server verifies the gradient and signature submitted by the participants.

[0010] S4. Gradient aggregation is performed using a weighted average method based on the computing server, then the global model of the computing server is updated, and the updated global model is uploaded to the blockchain;

[0011] S5. Repeat S2-S4 until the model converges and all participants obtain a more accurate model.

[0012] Preferably, the key generation center issues key pairs for homomorphic encryption and key pairs for signing to the computing server and the participating parties, respectively; wherein, the computing server only possesses a public key for homomorphic operations and a public key for signature verification.

[0013] Preferably, the participants in each federated learning process train the model locally, including:

[0014] During the i-th global model iteration, each federated learning participant calls the smart contract to obtain the latest global model parameters, and uses the plaintext of the decrypted latest global model parameters as the initial model parameters for this training. Finally, the MBGD algorithm is used on the local dataset to update the gradient and obtain the updated gradient.

[0015] Preferably, the gradients obtained during training are normalized, homomorphically encrypted, and signed, including:

[0016] The updated gradient is normalized to a vector with a magnitude of 1, and the updated gradient is homomorphically encrypted and the ciphertext is sent to the computing server.

[0017] Each participant signs the ciphertext and sends it to a smart contract on the blockchain.

[0018] Preferably, the verification of the gradient and signature submitted by the participants is performed by the computing server, including:

[0019] Signature verification, normalization verification, and cosine similarity verification.

[0020] Preferably, the signature verification includes:

[0021] The computing server invokes the smart contract on the blockchain and verifies the downloaded signature. If the verification passes, normalization verification is performed; otherwise, the agreement is terminated and the collateral of the corresponding participant is deducted.

[0022] Preferably, the normalization verification includes:

[0023] The computation server randomly generates a linear equation in two variables, Y = aX + r, where a (a≠0) and r are random numbers, X is its inner product, and Y is the ciphertext obtained by the computation server through homomorphic operations.

[0024] (X,Y) is sent to a random participant, who decrypts it and sends the result (x,y) to the computing server. The server verifies whether x is 1 and whether y is equal to ax+r.

[0025] If the verification passes, a cosine similarity verification will be performed; otherwise, the agreement will be terminated and the collateral of the corresponding participant will be forfeited.

[0026] Preferably, the cosine similarity verification includes:

[0027] The computing server calculates the cosine value between the gradient submitted by the participants and the gradient obtained locally by the computing server. When the cosine value is greater than or equal to 0, the gradient that has passed the cosine similarity verification is used for model update. When the cosine value is less than 0, the weight corresponding to the gradient that has passed the cosine similarity verification is set to 0.

[0028] Preferably, gradient aggregation is performed using a weighted average method based on the computing server, including:

[0029] The computing server uses a weighted average method to aggregate gradients. The weight of each gradient is the ratio of the cosine value obtained from the cosine similarity verification calculation to the sum of the cosine values ​​of each gradient. The computing server then updates the model and uploads the updated model parameters to the smart contract on the blockchain.

[0030] Compared with the prior art, the present invention has the following advantages and technical effects:

[0031] 1. This invention proposes a novel privacy-preserving Byzantine-Robust Federated Learning (PBFL) model. Building upon the PBFL scheme, this invention combines the two additional trusted servers into one, using only one additional computing server to assist the blockchain in off-chain computation. Furthermore, in a single global model iteration, the computing server requires only two additional communications to complete model aggregation, significantly reducing communication overhead.

[0032] 2. This invention proposes a novel privacy-preserving Byzantine-robust federated learning protocol, π. DPBFL Decentralized Privacy-Preserving Byzantine-Robust Federated Learning (DPBFL) not only achieves privacy protection and decentralization, but also resists man-in-the-middle attacks, reduces the communication overhead of computing servers, and improves the overall security of the solution. Attached Figure Description

[0033] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0034] Figure 1 This is a system model diagram of a privacy-preserving Byzantine-robust federated learning method based on blockchain, according to an embodiment of the present invention.

[0035] Figure 2 This is a flowchart of a privacy-preserving Byzantine-robust federated learning method based on blockchain, as described in an embodiment of the present invention. Detailed Implementation

[0036] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0037] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0038] This invention proposes a privacy-preserving Byzantine-robust federated learning method based on blockchain, such as... Figures 1-2 ,include:

[0039] S1, Model Initialization Phase: Based on the key generation center, keys are distributed to the computing server and participants. The computing server initializes the global model and uploads the collateral submitted by the participants to the blockchain system. The collateral is the deposit.

[0040] Specifically, the key generation center distributes key pairs (pk) for homomorphic encryption to the computing server and the participating parties respectively. x ,sk x ) and the key pair for signing (pk s ,sk s The computing server only possesses the public key pk used for homomorphic operations. x and the public key used for signature verification (PK) s The computing server initializes the global model and uploads it to the blockchain's smart contract. Each participant in the federated learning process needs to submit a deposit to the smart contract. This deposit is to ensure the fairness of the protocol. If the computing server identifies malicious model parameters, it will call the smart contract to deduct the corresponding participant's deposit as a form of punishment.

[0041] S2, Model Initialization Phase: Each participant in the federated learning performs model training locally, and normalizes, homomorphically encrypts, and signs the gradients obtained during training. The signature is then uploaded to the blockchain system, and the encrypted gradients are sent to the computing server.

[0042] Specifically, the local computation phase includes four steps: local training, normalization, homomorphic encryption, and signing.

[0043] Step 1, Local Training: During the i-th global model iteration, each federated learning participant C... j The system calls a smart contract to retrieve the latest global model parameters, and uses the decrypted plaintext as the initial model parameters for this training. Finally, it runs the model on its local dataset D. j The gradient is then updated using the MBGD algorithm, and the gradient is obtained.

[0044] Step 2, Normalization: Considering that malicious actors might submit carefully crafted gradients to maximize their impact, normalization is essential before these gradients are submitted. Normalization minimizes the impact of malicious actors. The normalization process involves converting the gradient... Normalize it into a vector with a magnitude of 1.

[0045] Step 3, Homomorphic Encryption: After normalization, each participant needs to convert the gradient... Homomorphic encryption is performed, and the ciphertext is sent to the computing server.

[0046] Step 4: Signing: Each participant needs to sign the ciphertext obtained in Step 3 and send it to the smart contract on the blockchain.

[0047] S3, Model Validation Phase: The gradients and signatures submitted by the participants are validated by the computing server;

[0048] Specifically, the model validation phase includes three steps: signature verification, normalization verification, and cosine similarity verification. These include:

[0049] Step 1, Signature Verification: The computing server calls the smart contract on the blockchain and verifies the downloaded signature. If the verification passes, proceed to Step 2; otherwise, terminate the agreement and deduct the deposit of the corresponding participant.

[0050] Step 2, Normalization Verification: In this process, the server will randomly generate a linear equation in two variables, Y = aX + r, where a (a ≠ 0) and r are random numbers, and X is its inner product.<g0,g0> Let g0 represent the ciphertext corresponding to the gradient submitted by the participant, and X represent the inner product of g0 and g0. The computation server obtains the ciphertext Y through homomorphic operation and sends (X,Y) to a random participant. After decryption, the participant sends the result (x,y) back to the computation server. The server verifies whether x is 1 and whether y is equal to ax+r. If the verification passes, it proceeds to Step 3; otherwise, the protocol is terminated and the corresponding participant's deposit is deducted.

[0051] Step 3, Cosine Similarity Verification: Since this scheme considers that the datasets of each participant are independent and identically distributed (IID), when a participant submits a gradient... Gradients submitted with the computation server When a significant error exists, this gradient is considered malicious, as it offers no benefit to the convergence of the global model and may even have serious negative consequences. Therefore, a cosine similarity verification mechanism is used to identify malicious gradients. Specifically, the cosine value between the gradient submitted by the participant and the gradient obtained locally on the server is first calculated. When the cosine value When the cosine value is greater than or equal to 0, the gradient is considered to have some convergence effect on the global model and is used for model updates. Conversely, when the cosine value is less than 0, the gradient is considered to have no contribution to the convergence of the global model and its corresponding weight is set to 0. It should be noted that the cosine value obtained by the computation server is ciphertext, and it needs to obtain the larger value between this cosine value and 0. To reduce communication overhead, this embodiment uses a numerical method for homomorphic ciphertext comparison within the range of [0,1], which can be found in the MAX algorithm.

[0052] After the computation server completes signature verification, it performs normalization verification on the gradients that have passed the signature verification. The purpose of normalization verification is to ensure that the participants honestly normalize their local gradients. Normalization serves two purposes: mitigating the impact of malicious participants and reducing the overhead of dense-state computation. Since gradients are vectors with magnitude and direction, adversaries are likely to upload large-scale gradients to amplify their impact. Normalization reduces the influence of adversaries. Furthermore, after gradient normalization, cosine similarity can be calculated from the inner product of the participant's local gradient and the computation server's trusted gradient, significantly reducing the computational overhead of homomorphic operations.

[0053] S4. Model Update Stage: Gradient aggregation is performed using a weighted average method based on the computing server, then the global model of the computing server is initialized and uploaded to the blockchain;

[0054] Specifically, during the model update phase, the computation server uses a weighted average method to aggregate gradients, where the weight of each gradient is the ratio of the cosine value calculated from the cosine similarity verification to the sum of the cosine values ​​corresponding to each gradient. The computation server then updates the model and uploads the updated model parameters to a smart contract on the blockchain.

[0055] Global model update formula:

[0056] w = w - β*g

[0057] w represents the global model, β represents the global learning rate, and g represents the aggregated gradient.

[0058] S5. Repeat S2-S4 until the model converges.

[0059] Once the global model converges, all participants obtain a more accurate model. During this process, no data from any participant is leaked, and the final global model incorporates the data features from all participants.

[0060] To more clearly illustrate the technical solution of the present invention, specific embodiments are provided below for description:

[0061] This invention provides a privacy-preserving Byzantine-robust federated learning method based on blockchain, comprising a model initialization phase, a local computation phase, a model verification phase, and a model update phase. The local computation phase includes four steps: local training, normalization, homomorphic encryption, and signing. The model verification phase includes three steps: signature verification, normalization verification, and cosine similarity verification. The system model mainly consists of four roles: a key generation center, federated learning participants, a computation server, and the blockchain system. The key generation center is responsible for generating and distributing keys, where each participant possesses a pair of keys for homomorphic encryption and a pair of keys for signing. The computation server only possesses a public key for homomorphic operations and a public key for verifying signatures. Each federated learning participant trains the model locally and performs homomorphic encryption and signing on the trained model parameters. The computation server is responsible for verifying the signatures and model parameters submitted by the participants. The blockchain system ensures the transparency and fairness of the entire computation process.

[0062] The following will provide a detailed explanation of the four stages mentioned above, specifically including the following steps:

[0063] Model initialization phase: The key generation center is responsible for generating two pairs of keys, one of which is a key (pk x ,sk x ) is used for homomorphic encryption, and another key pair (pk) s ,sk s ) is used for signing. Each participant in the federated learning process possesses a key distributed from the key generation center. x ,sk x ) and (pk s ,sk s The computing server only possesses the PK distributed by the key generation center. x and PK s After the keys are distributed, each participant needs to submit a deposit to the blockchain. Finally, the computing server uploads the initialized global model to the blockchain.

[0064] Local computation phase: This phase consists of four steps: local training, normalization, homomorphic encryption, and signature. The specific algorithmic process for each step is as follows:

[0065] Step 1, Local Training: Each federated learning unit first calls the smart contract to obtain the latest global model, and then uses the decryption result of the global model as the initial model parameters to train the local dataset using gradient descent (MBGD). The specific process of the algorithm is shown in Table 1.

[0066] Table 1

[0067]

[0068] Step 2, Normalization: After local training is complete, each participant in the federated learning process needs to normalize its local gradient. Normalization converts the local gradient into a vector with a magnitude of 1. Representative vector The specific process of the L2 norm normalization algorithm is shown in Table 2;

[0069] Table 2

[0070]

[0071] Step 3, Homomorphic Encryption: After completing the normalization operation, the participants need to perform homomorphic encryption on the model parameters. This embodiment uses the CKKS fully homomorphic encryption algorithm. CKKS is a floating-point encryption algorithm with very high encryption and decryption efficiency. However, CKKS programming is relatively complex. Therefore, this solution uses an EVA homomorphic encryption compiler developed by Microsoft to simplify programming. The EVA compiler will automatically convert the pre-set plaintext program into a computable encrypted program.

[0072]

[0073] In the formula, For the encrypted, normalized local gradient, For the normalized local gradient, pk x The public key used for encryption.

[0074] Step 4: Signing: After homomorphic encryption, the participants need to sign the ciphertext. The purpose of the signature is to ensure the integrity and authenticity of the messages sent by the participants. This invention uses the EIGamal signature scheme because it is not only secure but also has provable security. After signing, the participants need to send the ciphertext corresponding to the model parameters and the signature to the computing server and the blockchain system. The specific signing process is shown in Table 3.

[0075] Table 3

[0076]

[0077] Model validation phase: This phase consists of three steps: signature validation, normalization validation, and cosine similarity validation.

[0078] Step 1, Signature Verification: After receiving the signatures submitted by the participants, the computing server first performs a signature verification operation. The specific process of the signature verification algorithm is shown in Table 4;

[0079] Table 4

[0080]

[0081] Step 2, Normalization Verification: The computation server adds the participants whose signatures have been verified to set S, and then performs normalization verification on them. The purpose of normalization verification is to verify whether the gradients submitted by the participants have undergone a normalization operation. The specific process is shown in Table 5;

[0082] Table 5

[0083]

[0084] Step 3, Cosine Similarity Verification: After normalization verification, the computation server performs cosine similarity verification on the participating parties. The purpose of cosine similarity verification is to identify malicious gradients.

[0085] Assuming the datasets of the participants are independent and identically distributed, if the cosine of the gradient submitted by a participant and the gradient on the local computation server is less than 0, it is considered a malicious gradient. This gradient has no positive effect on the convergence of the global model and may even reduce the model's accuracy. Therefore, when performing gradient aggregation, the weights corresponding to malicious gradients need to be modified to 0. To reduce communication overhead, this embodiment uses a bivariate iterative method to compare the size of the ciphertext within the range [0,1]. The specific algorithm for ciphertext comparison is shown in Table 6.

[0086] Table 6

[0087]

[0088] The specific process of cosine similarity verification is shown in Table 7.

[0089] Table 7

[0090]

[0091] Model update phase: After signature verification, normalization verification and cosine similarity verification, the computing server performs gradient aggregation on the verified gradients, then updates the global model, and finally uploads the updated global model to the blockchain.

[0092] Repeat the above process until the given number of iterations is reached.

[0093] This invention proposes a novel privacy-preserving Byzantine-Robust Federated Learning (PBFL) model. Building upon the PBFL scheme, this invention combines the two additional trusted servers into one, using only one additional computing server to assist the blockchain in off-chain computation. Furthermore, in a single global model iteration, the computing server requires only two additional communications to complete model aggregation, significantly reducing communication overhead.

[0094] This invention proposes a novel privacy-preserving Byzantine-robust federated learning protocol, π. DPBFL (Decentralized Privacy-Preserving Byzantine-Robust Federated Learning, DPBFL) not only achieves privacy protection and decentralization, but also resists man-in-the-middle attacks and poisoning attacks, reduces the communication overhead of the computing server, and improves the overall security of the solution. See Tables 8-10.

[0095] Table 8

[0096]

[0097] Table 9

[0098]

[0099] Table 10

[0100]

[0101] To defend against man-in-the-middle attacks, this invention employs the EIGamal digital signature scheme. During the gradient upload phase, participants first need to sign the encrypted gradient and then upload the signature to the blockchain. The computing server can then verify the signature to determine the authenticity and completeness of the gradient submitted by the participant. This not only defends against man-in-the-middle attacks but also protects the participant's digital currency from malicious deduction.

[0102] To defend against poisoning attacks, this invention employs gradient aggregation based on cosine similarity. Malicious gradients are identified through cosine similarity, and the weights of malicious gradients are modified to 0 using the MAX algorithm, thus providing a reliable global model.

[0103] To reduce the communication overhead of the computing server, this invention designs a novel normalized verification protocol, NormalVerify. In NormalVerify, the computing server only needs to complete one communication with the participants to complete verification; furthermore, the participants cannot deduce additional information from the decryption result. Compared to the PBFL scheme, the protocol designed in this invention has lower communication overhead and is more secure.

[0104] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A privacy-preserving Byzantine-robust federated learning method based on blockchain, characterized in that, include: S1. Distribute keys to the computing server and participants based on the key generation center, initialize the global model through the computing server, and upload the initialized global model and the collateral submitted by the participants to the blockchain system; S2. Each participant in the federated learning performs local training of the current model, and normalizes, homomorphically encrypts and signs the gradients obtained from the training, uploads the signature to the blockchain system and sends the encrypted gradients to the computing server. S3. The computing server verifies the gradient and signature submitted by the participants. The computation server verifies the gradients and signatures submitted by the participants, including: Signature verification, normalization verification, and cosine similarity verification; Performing the signature verification includes: The computing server calls the smart contract on the blockchain and verifies the downloaded signature. If the verification passes, normalization verification is performed; otherwise, the agreement is terminated and the collateral of the corresponding participant is deducted. Performing the normalization verification includes: The computation server randomly generates a linear equation in two variables, Y=aX+r, where a and r are both random numbers, a≠0, X is its inner product, and Y is the ciphertext obtained by the computation server through homomorphic operations. (X,Y) is sent to a random participant, who then decrypts the result and sends it to the other party. The data is sent to the computing server, which verifies whether x is 1 and whether y is equal to 1. ; If the verification passes, a cosine similarity verification will be performed; otherwise, the agreement will be terminated and the collateral of the corresponding participant will be deducted. The cosine similarity verification includes: The computing server calculates the cosine value between the gradient submitted by the participants and the gradient obtained locally by the computing server. When the cosine value is greater than or equal to 0, the gradient that has passed the cosine similarity verification is used for model update. When the cosine value is less than 0, the weight corresponding to the gradient that has passed the cosine similarity verification is set to 0. S4. Gradient aggregation is performed using a weighted average method based on the computing server, then the global model of the computing server is updated, and the updated global model is uploaded to the blockchain; S5. Repeat S2-S4 until the model converges and all participants obtain a more accurate model.

2. The Byzantine-Robust Federated Learning Method for Privacy Protection Based on Blockchain as described in claim 1, characterized in that, The key generation center issues key pairs for homomorphic encryption and key pairs for signing to the computing server and the participating parties, respectively; wherein, the computing server only possesses the public key for homomorphic operations and the public key for signature verification.

3. The Byzantine-Robust Federated Learning Method for Privacy Protection Based on Blockchain as described in claim 1, characterized in that, Each participant in the federated learning process trains the model locally, including: During the i-th global model iteration, each federated learning participant calls the smart contract to obtain the latest global model parameters, and uses the plaintext of the decrypted latest global model parameters as the initial model parameters for this training. Finally, the MBGD algorithm is used on the local dataset to update the gradient and obtain the updated gradient.

4. The Byzantine-Robust Federated Learning Method for Privacy Protection Based on Blockchain as described in claim 3, characterized in that, The gradients obtained during training are normalized, homomorphically encrypted, and signed, including: The updated gradient is normalized to a vector with a magnitude of 1, and the updated gradient is homomorphically encrypted and the ciphertext is sent to the computing server. Each participant signs the ciphertext and sends it to a smart contract on the blockchain.

5. The Byzantine-Robust Federated Learning Method for Privacy Protection Based on Blockchain as described in claim 1, characterized in that, Gradient aggregation is performed based on a weighted average method using the aforementioned computing server, including: The computing server uses a weighted average method to aggregate gradients. The weight of each gradient is the ratio of the cosine value obtained from the cosine similarity verification calculation to the sum of the cosine values ​​of each gradient. The computing server then updates the model and uploads the updated model parameters to the smart contract on the blockchain.

Images