Federal learning method and device, medium and product

Abstract

The invention discloses a federal learning method and device, a medium and a product, and relates to the field of artificial intelligence. The method comprises the following steps: acquiring parameters and private watermark parameters of initial local business models of a plurality of federated learning clients; performing matrix processing on the private watermark parameters through a predefined smart contract to obtain a private watermark vector; embedding the private watermark vectors into parameters of the corresponding initial local business model, and performing aggregation by applying a federated average algorithm to obtain parameters of an initial global business model; verifying by applying a consensus mechanism of the block chain to obtain a verification result; when the verification result is correct and the initial global service model converges, obtaining a global service model; the global service model is an initial global service model. According to the method, under the characteristic that the block chain network cannot be tampered, record traceability of service model operation is achieved, watermark embedding is verifiable, and robustness of a traditional federated learning framework is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to a federated learning method, device, medium and product. Background Art

[0002] In the era of big models, federated learning has become a cutting-edge technology that has attracted much attention with the idea of ​​distributed machine learning paradigm. The model training of this technology is carried out on multiple local data sources, without the need to centralize the original data set. After each round of training, the distributed client uploads the gradient parameters of the local model to the central server for aggregation. Federated learning technology realizes multi-party data utilization while protecting privacy and reducing data transmission, providing an effective solution to the problem of data islands. However, the current field of federated learning still faces many challenges, such as the single point failure problem under traditional centralized servers, data forgery and insufficient incentives of distributed clients, etc. These challenges make the exploration of safer and more transparent federated learning technology the focus of current research in this field. Summary of the invention

[0003] The purpose of the present invention is to provide a federated learning method, device, medium and product, which realizes the source authentication of the input data of the federated learning model training and the ownership protection of the output model. At the same time, under the tamper-proof characteristics of the blockchain network, the record of the model operation is traceable and the watermark embedding can be verified, which greatly enhances the robustness of the traditional federated learning framework and increases the applicable fields of the federated learning framework.

[0004] To achieve the above object, the present invention provides the following solutions:

[0005] A federated learning method, the method comprising:

[0006] Acquire parameters of initial local business models and private watermark parameters of multiple federated learning clients through multiple first nodes of the blockchain; wherein each of the first nodes corresponds to a federated learning client;

[0007] Matrixing the private watermark parameters of each of the federated learning clients through a predefined smart contract to obtain a watermark matrix containing multiple private watermark vectors;

[0008] Embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client, apply the federated average algorithm for aggregation, obtain the parameters of the initial global business model, and store the parameters of the initial global business model in the preset second node of the blockchain;

[0009] Applying the consensus mechanism of the blockchain, verifying the private watermark vector of the parameters of the initial global business model to obtain a verification result; the verification result includes correct and incorrect;

[0010] When the verification result is incorrect, each of the federated learning clients applies the local data set to train the initial local business model to obtain the parameters of the updated initial local business model, and returns to the step of "obtaining the parameters of the initial local business model and the private watermark parameters of each federated learning client through multiple first nodes of the blockchain" to continue execution;

[0011] When the verification result is correct, judging whether the initial global business model is converged according to the parameters of the initial global business model;

[0012] When the initial global business model does not converge, the parameters of the initial global business model are returned to each of the federated learning clients as the parameters of the initial local business model of each of the federated learning clients, and each of the federated learning clients uses a local data set to train the initial local business model to obtain the updated parameters of the initial local business model, and returns to the step of "obtaining the parameters of the initial local business model and the private watermark parameters of each federated learning client through multiple first nodes of the blockchain" to continue execution;

[0013] When the initial global business model converges, a global business model is obtained; the global business model is the initial global business model.

[0014] Optionally, the consensus mechanism is a practical Byzantine fault-tolerant consensus algorithm.

[0015] Optionally, a feature watermark method or a backdoor-based watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client.

[0016] Optionally, the feature watermark method embeds the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client through a loss function.

[0017] Optionally, when the characteristic watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client, the consensus mechanism of the blockchain is applied to verify the private watermark vector of the parameters of the initial global business model, specifically including:

[0018] Extracting watermark information from parameters of the initial global business model;

[0019] Calculating the similarity between the extracted watermark information and the private watermark parameters;

[0020] When the similarity is greater than a first preset threshold, the verification result is correct; otherwise, the verification result is incorrect.

[0021] Optionally, when a backdoor-based watermarking method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of each of the federated learning clients, the consensus mechanism of the blockchain is applied to verify the private watermark vector of the parameters of the initial global business model, specifically including:

[0022] Calling trigger parameters stored on the blockchain, applying a predefined trigger sample set, and calculating the accuracy of the initial global business model; the trigger parameters are stored on the blockchain when a backdoor-based watermarking method is applied to embed a private watermark vector of the watermark matrix into the parameters of the initial local business model of each of the federated learning clients;

[0023] When the accuracy is greater than a second preset threshold, the verification result is correct; otherwise, the verification result is incorrect.

[0024] Optionally, the method by which each of the federated learning clients applies the local data set to train the initial local business model is stochastic gradient descent method.

[0025] A computer device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any one of the above-mentioned federated learning methods.

[0026] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the above-described federated learning methods.

[0027] A computer program product comprises a computer program, wherein when the computer program is executed by a processor, the computer program implements any one of the above-mentioned federated learning methods.

[0028] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0029] This paper proposes and implements an innovative blockchain federated learning intellectual property protection framework (BFLIPR), which aims to solve the data security and model confirmation problems in federated learning in decentralized scenarios. The BFLIPR framework innovatively combines blockchain technology, digital watermarking technology and federated learning technology. By integrating the tamper-proof characteristics of blockchain, the concealment of digital watermarking and the distributed characteristics of federated learning, it provides an effective intellectual property protection mechanism, significantly enhancing data security and intellectual property protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 This is a schematic diagram of the federated learning framework based on the blockchain network;

[0032] Figure 2 This is a schematic diagram of the BFLIPR framework system architecture;

[0033] Figure 3 Schematic diagram of the generation and embedding process of the BFLIPR framework;

[0034] Figure 4 Schematic diagram of the digital watermark verification process of the BFLIPR framework;

[0035] Figure 5 A schematic diagram of the process flow of the federated learning method provided in Example 1 of the present invention;

[0036] Figure 6 This is a schematic diagram of the PBFT workflow;

[0037] Figure 7 This is a diagram of the internal structure of a computer device. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] The purpose of the present invention is to provide a federated learning method, device, medium and product, which aims to realize the source authentication of the input data of the federated learning model training and the ownership protection of the output model. At the same time, under the tamper-proof characteristics of the blockchain network, the record of the model operation can be traced and the watermark can be embedded for verification, etc., to enhance the robustness of the traditional federated learning framework and increase the applicable fields of the federated learning framework.

[0040] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] Example 1

[0042] like Figure 5 As shown, the federated learning method in this embodiment includes:

[0043] Step S1: Obtain parameters of initial local business models and private watermark parameters of multiple federated learning clients through multiple first nodes of the blockchain; wherein each of the first nodes corresponds to a federated learning client.

[0044] Step S2: Matrixing the private watermark parameters of each of the federated learning clients through a predefined smart contract to obtain a watermark matrix containing multiple private watermark vectors.

[0045] Step S3: embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client, apply the federated averaging algorithm for aggregation, obtain the parameters of the initial global business model, and store the parameters of the initial global business model in the preset second node of the blockchain.

[0046] Specifically, a feature watermark method or a backdoor-based watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client.

[0047] Furthermore, the feature watermark method embeds the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client through a loss function.

[0048] Step S4: Apply the consensus mechanism of the blockchain to verify the private watermark vector of the parameters of the initial global business model to obtain a verification result; the verification result includes correct and incorrect. The consensus mechanism is a practical Byzantine fault-tolerant consensus algorithm.

[0049] Specifically, when the characteristic watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client, the consensus mechanism of the blockchain is applied to verify the private watermark vector of the parameters of the initial global business model, specifically including:

[0050] Step S411: extracting watermark information from the parameters of the initial global service model.

[0051] Step S412: Calculate the similarity between the extracted watermark information and the private watermark parameters.

[0052] Step S413: When the similarity is greater than a first preset threshold, the verification result is correct; otherwise, the verification result is incorrect.

[0053] When the backdoor-based watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of each of the federated learning clients, the consensus mechanism of the blockchain is applied to verify the private watermark vector of the parameters of the initial global business model, specifically including:

[0054] Step S421: calling the trigger parameters stored on the blockchain, applying a predefined trigger sample set, and calculating the accuracy of the initial global business model; the trigger parameters are stored on the blockchain when a backdoor-based watermarking method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of each of the federated learning clients.

[0055] Step S422: When the accuracy is greater than a second preset threshold, the verification result is correct; otherwise, the verification result is incorrect.

[0056] Step S5: When the verification result is incorrect, each of the federated learning clients applies a local data set to train the initial local business model, obtains parameters of an updated initial local business model, and returns to step S1 to continue execution.

[0057] Step S6: When the verification result is correct, judging whether the initial global business model is converged by using the parameters of the initial global business model.

[0058] Step S7: When the initial global business model does not converge, the parameters of the initial global business model are returned to each of the federated learning clients as the parameters of the initial local business model of each of the federated learning clients. Each of the federated learning clients uses a local data set to train the initial local business model to obtain the updated parameters of the initial local business model, and returns to step S1 to continue execution.

[0059] Specifically, the method by which each of the federated learning clients applies a local data set to train the initial local business model is a stochastic gradient descent method.

[0060] Step S8: When the initial global business model converges, a global business model is obtained; the global business model is the initial global business model.

[0061] As a specific implementation method, 1) the federated learning client uploads the trained local model information and private digital watermark parameters to the blockchain network. 2) When uploading to the blockchain network, the data is first verified in the blockchain through the smart contract. The smart contract assigns nodes to process the private watermark parameters (the digital watermark parameters are matrixed) according to the pre-written steps to form a watermark matrix. 3) The consensus mechanism records and globally broadcasts the processed watermark matrix to all nodes for confirmation, and it can only be passed if more than 2 / 3 of the nodes agree. 4) Finally, the confirmed watermark matrix will be aggregated at the model level together with the local model to form a global model for this round of training. The blockchain network sends the global model to the client, and the client receives and starts a new round of training. 5) Repeat steps 1) to 4) until global convergence.

[0062] In practical applications, in order to explore safer and more transparent federated learning technology, the present invention takes the research on trusted federated learning that integrates the decentralized and tamper-proof characteristics of blockchain technology as one of the most promising research directions. Blockchain technology, with decentralization, immutability and transparency as its core features, was originally designed for cryptocurrency systems, but is now widely used in various fields. Blockchain forms a chain by linking transaction data together in the form of blocks in timestamp order. Each block contains the hash value of the previous block, ensuring the immutability of the data. At the same time, the blockchain stores data on multiple nodes of the network, and each node has the right to verify and record transactions, which improves the system's anti-attack and fault tolerance. Figure 1 As shown in the figure, the combination of blockchain technology and federated learning technology has extensive research value in solving the problem of participant behavior tracing, single-point risk of federated learning system, and positive incentives for participants. However, the shortcoming of the federated learning framework integrating blockchain technology is that, although it has made significant progress in improving system security and data privacy protection, it still faces great challenges in model ownership confirmation, especially in preventing illegal copying, abuse and theft of models. At present, some studies have used digital watermarking technology as a supplementary means of model confirmation and have carried out research based on this. As a means of information embedding, digital watermarking technology can achieve information authentication and tracking by embedding invisible identifiers in data. In addition, in scenarios where multiple users participate, digital watermarks can also be used to verify data sources, ensure content authenticity, and track unauthorized copying or modification, etc., to achieve the purpose of protecting data ownership. In the current research on digital watermarking to ensure model confirmation, this technology can significantly reduce the security risks of model theft and application, and play a key role in information security and intellectual property protection. Therefore, innovating and integrating mature digital watermarking technology in the field of centralized federated learning can solve the model ownership problem of federated learning clients and prevent the risks of model copying and theft.

[0063] In traditional federated learning (FL), user sensitive data is trained locally, while the coordination of model updates occurs on centralized servers, which increases the robustness of the system and the risk of data leakage. With the continuous development of federated learning, research optimization based on traditional frameworks may not be able to fully solve problems such as data dispersion, privacy leakage, and model authentication. Therefore, the integration of blockchain technology and federated learning technology aims to provide a new paradigm for the federated learning framework through the decentralized, tamper-proof, and smart contract characteristics of blockchain. Under this paradigm, problems such as data privacy leakage, model collaborative training, and data traceability can be better addressed.

[0064] In these research works, blockchain technology is used to improve various aspects of federated learning. Not only has some success been achieved in decentralized data management, transparent and verifiable collaborative training of models has been achieved, but the credibility of the models has also been enhanced through smart contracts and data traceability mechanisms. However, a major limitation of these works is that there is still no effective solution for the protection of the trained models.

[0065] Federated learning has certain deficiencies in the field of model protection and ownership confirmation, especially in ensuring the source of model training data and the privacy of output models. In the case that existing methods are difficult to ensure model security, exploring effective federated learning model authentication and ownership confirmation mechanisms is one of the current research focuses. Digital watermarking technology has a good research foundation in centralized machine learning scenarios and also provides an effective solution to ensure the credibility and integrity of machine learning models. Therefore, applying digital watermarking technology to distributed scenarios of federated learning provides a possibility for federated learning to ensure model traceability, verify legal owners and prevent unauthorized copying, which has become a valuable exploration. Digital watermarking technology can be embedded in model parameters to form a unique identifier, thereby maintaining the uniqueness and traceability of the model during model dissemination and use. The embedded characteristics of digital watermarking technology provide a means of tamper-proofing the model, and the legitimacy of the model can be verified by extracting the watermark. However, these works are currently only in the exploratory stage, and the robustness of aggregated watermarks and multi-watermark conflicts in distributed scenarios have always been key limitations in this research field.

[0066] At present, the research on using blockchain technology, federated learning technology, and digital watermark technology to protect model ownership in distributed scenarios is still seriously insufficient. The reasons are: 1) The single watermark embedding technology of traditional machine learning needs to be innovated to provide support for multi-participant multi-watermark embedding of federated learning and blockchain, which can solve the multi-watermark conflict problem caused by multiple participants. 2) After federated learning is combined with digital watermark technology, there is a lack of storage protection for watermarks in distributed scenarios.

[0067] In response to the above problems, the present invention proposes and constructs a decentralized blockchain federated learning framework based on blockchain network, integrating digital watermarking technology and federated learning technology with personalized consensus mechanism, which realizes the confirmation of model ownership, traceability of transaction behavior, and fair participation of multiple parties. The main contributions of the present invention are:

[0068] 1) A distributed digital watermarking technology that integrates digital watermarking technology with blockchain consensus mechanism and smart contracts is proposed; 2) By integrating the public and tamper-proof characteristics of blockchain, the privacy protection advantages of federated learning and the copyright protection mechanism of digital watermarking, a fusion of federated learning model rights confirmation, copyright verification and efficient management framework is constructed.

[0069] Specifically, based on the Federated learning model intellectual property rights (FedIPR) framework, the present invention innovatively integrates blockchain and smart contract technology, and proposes a Blockchain Federated Learning Model Intellectual Property (BFLIPR) framework that is more in line with current privacy information security standards. The BFLIPR framework provides a more secure and reliable decentralized distributed scenario for the application of digital watermarks in a federated learning environment. In other words, the present invention designs a distributed digital watermarking technology that integrates digital watermarking technology with blockchain consensus mechanism and smart contracts, and constructs a decentralized verifiable federated learning framework with blockchain network and federated learning technology as the core. The framework realizes the source authentication of the input data of the federated learning model training and the confirmation protection of the output model. At the same time, under the tamper-proof characteristics of the blockchain network, the record of the model operation can be traced and the watermark can be verified, which greatly enhances the robustness and applicable fields of the traditional federated learning framework.

[0070] The three key aspects of the BFLIPR framework provided by the present invention, namely, the system architecture and design, the generation and embedding process of digital watermarks, and the digital watermark verification mechanism based on blockchain, are interconnected. The complete workflow of the BFLIPR framework is introduced below.

[0071] 1) First, the system architecture and design part introduces the infrastructure, operation mechanism and components of the entire framework, including the blockchain network part, the federated learning client part and the digital watermark part. The blockchain network part includes nodes, watermark consensus mechanism and preset smart contracts, which are responsible for managing the verification, storage and synchronization of on-chain data, as well as the processing and broadcasting of on-chain data; the federated learning client uses private data for model training and integrates the digital watermark component to generate unique digital watermark information and synchronize it to the chain when the model is updated and uploaded. The watermark consensus mechanism uses the PBFT consensus mechanism for global broadcasting and 2 / 3 node consent, while the smart contract is responsible for data classification, interface, and storage; 2) The digital watermark generation and embedding process based on the BFLIPR architecture uses two watermark types based on the content in 1) to detail the process of using smart contracts to perform model training on digital watermarks in the entire framework, including private watermark privacy storage, matrix processing, global aggregation, etc.; 3) The blockchain-based digital watermark verification mechanism demonstrates how to use the on-chain storage and tamper-proof nature of blockchain technology to reliably verify watermarks, including using the formulas and calculation methods in the watermark generation phase to reversely deduce the original private watermark parameters, and using blockchain storage to ensure the accuracy of the prompt information in the subsequent watermark.

[0072] Furthermore, this paper introduces BFLIPR from three aspects: system architecture and design, blockchain-based digital watermark generation and embedding, and blockchain-based reliable digital watermark verification mechanism.

[0073] 1. BFLIPR system architecture and design.

[0074] like Figure 2 As shown in the figure, the BFLIPR system framework requires each client to submit the model update parameters and at the same time send the participant’s private watermark parameter (B i θ i ; T i ) and model gradient parameters and other information are uploaded to the chain, among which (B i θ i ) are the target watermark and watermark extraction parameters, T i is the watermark trigger set of the backdoor watermark. The private watermark parameters of the participants are uniformly processed by the smart contract and stored on the blockchain, and the processed global watermark matrix E is broadcast through the consensus mechanism. t , where the private watermark parameter (B i θ i ; T i ) remains available but not visible to other participants.

[0075] Based on FedIPR, the BFLIPR framework also uses smart contracts to achieve integration and optimization among various components of the system framework, and at the same time realizes the pluggable modular design of the framework. This paper will introduce the blockchain-enhanced federated learning and innovative digital watermarking module and the smart contract-driven blockchain network module respectively.

[0076] (1) Blockchain-enhanced federated learning and innovative digital watermarking module.

[0077] In addition to the idea of ​​combining the black box model proposed by the original FedIPR framework with the white box model to achieve model embedding and verification, BFLIPR uses the smart contract nested verification algorithm to achieve docking with the black box model, and has made lightweight optimizations to the original framework. The white box model is used as an optional part of the system framework. The design purpose of the original white box model is still innovatively realized on the blockchain, reducing the complexity of the integrated framework. In terms of watermark types, BFLIPR still uses the two watermark methods proposed by the FedIPR framework:

[0078] 1) Feature watermarking: This type of watermark is designed to be directly embedded into the parameters of the federated learning model and change the model weights to include specific, difficult-to-detect patterns. Specifically, for a given set of model parameters W, the feature watermark can be added by adding an optimization term L watermark (W) to the original loss function L original (W). The purpose of the optimization term is to adjust the model parameters to include specific watermark information without significantly affecting the performance of the original task. Ultimately, the total loss function L total The mathematical expression of (W) is:

[0079] L total (W) = L original (W)+λL watermark (W) (1)

[0080] Among them, λ is an adjustment term used to balance watermark embedding and model performance.

[0081] 2) Backdoor-based Watermarks: The core idea of ​​this type of watermark is to create a set of specific input-output pairs (i.e., trigger sets). When the model encounters a specific input pattern (trigger), a predefined output will be generated, thereby proving the ownership of the model. The mathematical form of this watermark is: given a trigger sample set The model encounters (x i ) should output (y i ).

[0082] (2) Blockchain network module driven by smart contracts.

[0083] In the blockchain network module, BFLIPR innovatively integrates this module with other modules through smart contracts and consensus mechanisms, so that all participants maintain a continuously growing list of records (blocks) in a decentralized network to record all important transactions and data changes during model training, etc., which plays a vital role in the entire system framework. At the same time, in the system framework design, the modular composition of the system greatly generalizes the selectivity and flexibility of each component in the blockchain network, including personalized consensus mechanisms, blockchain network types, smart contract verification algorithms, etc. In order to effectively ensure data consistency and system robustness, the present invention selects the Practical Byzantine FaultTolerance (PBFT) consensus mechanism as the experimental consensus algorithm, and provides BFLIPR with an efficient and reliable consensus solution through its precisely designed role allocation and operation process. The following is an introduction to the PBFT consensus mechanism and its role in the framework.

[0084] 1) The PBFT system mainly includes two roles: the leader and followers. The leader is responsible for initiating new requests or proposals, while followers are responsible for verifying and voting on these proposals. Figure 6 As shown, the workflow of PBFT can be divided into:

[0085] Pre-prepare: The master node receives the request from the client and assigns it a unique serial number, and then broadcasts the request and serial number to all slave nodes in the form of a message. This message is digitally signed by the master node's private key to ensure its non-repudiation and source verification. The message can be represented as M pre =sign(H(request,sequence\number),SKleader), where H is a hash function used to generate a unique representation of the request and sequence number, and SK leader is the private key of the master node. In the BFLIPR framework, the watermark matrix E is sent along with the verification message. k .

[0086] Preparation phase: Receive and use the master node's public key PK from the node leader Verify whether the digital signature of the pre-prepared message sent by the master node is correct. The verification function is V(M pre ,PK leader), where V is the verification function. The verification process ensures the authenticity of the message and the correctness of the sequence number, preventing replay attacks and message tampering. After successful verification, the slave node broadcasts a prepare message, indicating that it is ready to process the request.

[0087] Commit phase: After receiving a sufficient number of prepare messages (usually more than the total number of network nodes), the slave node Broadcast the commit message. This step marks the final approval of the request by the node. The key to the commit phase is to ensure that most nodes in the network agree on the current request status and reach a consensus. After receiving the commit message from most other nodes, the node will execute the request and return the result to the client. The broadcast of the commit message can be expressed as:

[0088] Commit=true if|{valid prepare messages}|>2f (2)

[0089] Where f is the maximum possible number of malicious nodes in the network.

[0090] These phases form the core of the PBFT consensus mechanism, ensuring that the BFLIPR framework can still reach consensus in scenarios where there may be participating nodes with malicious behavior.

[0091] In summary, the BFLIPR framework significantly enhances the security and effectiveness of the federated learning model by integrating blockchain technology and smart contracts. This framework not only innovatively expands on the basis of FedIPR, but also further improves the robustness and data consistency of the system by introducing the PBFT consensus mechanism. This design provides a new research idea for the intellectual property protection and privacy security of the federated learning model.

[0092] 2. Digital watermark generation and embedding based on blockchain.

[0093] The BFLIPR framework has made technical innovations in the generation and embedding of digital watermarks. Figure 3 As shown in the figure, the BFLIPR framework combines the security of blockchain and the flexibility of smart contracts, which not only optimizes the implementation method of watermarking, but also ensures its effectiveness and concealment in the federated learning environment. By deeply integrating the mathematical model of the original framework with blockchain technology, BFLIPR proposes a powerful and secure watermarking solution, which effectively strengthens the intellectual property protection and data security of the federated learning model. The following is a detailed introduction to the generation and embedding of two types of digital watermarks:

[0094] (1) Integration and optimization of global feature watermark encoding and training process.

[0095] Generation phase: The global feature watermark of each round is composed of all client feature watermarks B k Generated through complex encoding technology, the encoding process includes converting the watermark into a series of binary strings Etc. These strings are designed to be directly mapped to the model parameters, making them difficult to detect by third parties. Before completing the encoding, the smart contract encrypts these client watermark parameters and stores them on the blockchain through the PBFT consensus mechanism to ensure the consistency and security of the information; after the encoding is completed, the PBFT consensus mechanism will send the global feature watermark and model parameters together to all clients to complete the global broadcast and store this important transaction on the chain. The encoding method is as follows: Each client has a feature-based private watermark B that only it knows. k The definition of watermark is determined by business requirements. In experiments, watermark is usually defined as the client number. For example, the watermark information of client No. 2 is defined as 2, and the watermark is converted into binary as B2=010.

[0096] Embedding stage: Feature watermark is obtained through customized loss function L watermark (W) is integrated into the model training and the model parameters are optimized to include the watermark information. This loss function is expressed as:

[0097]

[0098] Among them, f(B k,i ,W i ) is used to measure the watermark parameter B of the i-th round of training k,i With the model parameter W i The difference between them, N is the number of training rounds to complete the training.

[0099] The parameter update process uses more targeted optimization algorithms, such as stochastic gradient descent with momentum Here, W new is the updated model parameter, η is the learning rate, is the gradient of the total loss function. It can embed watermark information while maintaining the original task performance and minimize the impact on model performance.

[0100] (2) Model’s backdoor watermark generation and activation strategy.

[0101] Generation phase: backdoor-based watermarking The trigger set is generated by adversarial learning technology, each trigger ((x i ,y i )) Design for specific layers of the model to maximize activation of specific neural network paths. The optimization formula used in the generation process is:

[0102]

[0103] Among them, N represents the prediction function of the model, and δ is the loss function L(y i ,N(x i +δ)) determines the disturbance, and the constraint |δ|≤∈ ensures that the size of the disturbance will not exceed the predetermined threshold ∈.

[0104] At the same time, all trigger samples and their parameters are encrypted by smart contracts after generation and stored on the blockchain. The PBFT consensus mechanism ensures the accuracy and security of this information. During this process, the trigger parameters are not broadcast globally, which provides tamper-proof and persistent protection for the subsequent watermark information verification.

[0105] Embedding phase: The model's training strategy is projected gradient descent to ensure effective embedding of triggers without affecting the main performance of the model. This includes adjusting the learning rate and using optimization algorithms, such as stochastic gradient descent with momentum, to ensure that the watermark is activated and retained in specific layers. The purpose of this process is to enhance the model's sensitivity to these specific samples and reduce interference with the overall model performance. During this process, the smart contract automatically manages the embedding process of the trigger set, including the selection of trigger samples, the adjustment of embedding time and frequency, and the broadcasting of watermark information. This automation reduces the need for human intervention and improves the efficiency and reliability of the entire embedding process.

[0106] In general, the BFLIPR framework integrates blockchain technology and smart contract technology, making the overall framework more intelligent, standardized, and secure, which provides a safe and effective intellectual property protection solution for the federated learning model. The application of these technologies not only enhances the concealment and robustness of the watermark, but also improves the overall system's ability to protect intellectual property. The next section will introduce the digital watermark verification process in the BFLIPR framework in depth.

[0107] 3. Reliable digital watermark verification mechanism based on blockchain.

[0108] In the BFLIPR framework, the digital watermark verification process deeply integrates blockchain technology to improve security, transparency and consistency. The process covers advanced verification mechanisms for feature watermarks and backdoor-based watermarks.

[0109] (1) Decoding and verification of feature watermarks.

[0110] The verification of feature watermarks depends on some algorithms used in FedIPR. Figure 4 As shown in the figure, the complete digital watermark verification process is shown. First, the verifier needs to extract the watermark information from the model parameters using the same algorithm as when embedding the watermark. To ensure the accuracy of the extracted information. The original watermark information B stored on the blockchain k By comparing them through formula (5), the similarity between them is calculated:

[0111]

[0112] In the model design phase, the verification mechanism proposed by equation (5) was connected and deployed in the smart contract. Therefore, the actual execution of the verification process is automatically performed by the smart contract, which effectively ensures the accuracy and consistency of the verification.

[0113] (2) Automated backdoor watermark verification driven by smart contracts.

[0114] Backdoor-based watermark verification covers the use of a predefined set of trigger samples Test the model. Trigger sample set During the verification process, the smart contract calls the trigger parameters stored on the blockchain to ensure the consistency and security of the test:

[0115]

[0116] in, represents the average calculation of the trigger sample set, normalizing the total number of correct predictions, I[N(x i )=y i ] is an indicator function for validating input data.

[0117] Similarly, the process is deployed in the smart contract in advance. The automation function of the smart contract ensures the efficiency and reliability of the verification process, while reducing the need for human intervention and eliminating the probability of verification errors.

[0118] This paper deeply explores the generation and embedding process of digital watermarks in the BFLIPR framework, as well as the verification mechanism of digital watermarks. It also introduces in detail the specific implementation of watermarking technology and how to ensure the effectiveness and reliability of the model while protecting the intellectual property rights and privacy security of the federated learning model.

[0119] In general, the BFLIPR framework integrated with blockchain technology not only ensures the secure storage and management of verification data, but also provides transparent and tamper-proof verification records. Smart contracts automatically execute verification steps, reducing the possibility of human intervention and ensuring the accuracy and integrity of data, while the PBFT consensus mechanism ensures that all clients unanimously recognize the verification results.

[0120] Example 2

[0121] A computer device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the federated learning method in Embodiment 1.

[0122] Example 3

[0123] A computer-readable storage medium stores a computer program, which implements the federated learning method in embodiment 1 when executed by a processor.

[0124] Example 4

[0125] A computer program product includes a computer program, which implements the federated learning method in embodiment 1 when executed by a processor.

[0126] Example 5

[0127] A computer device, which may be a database, may have an internal structure as shown in Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store pending transactions. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the federated learning method in Example 1 is implemented.

[0128] It should be noted that the object information (including but not limited to object device information, object personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the present invention are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0129] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided by the present invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided by the present invention may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processor involved in each embodiment provided by the present invention may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited thereto.

[0130] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0131] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A federated learning method, characterized in that: The method comprises: Acquire parameters of initial local business models and private watermark parameters of multiple federated learning clients through multiple first nodes of the blockchain; wherein each of the first nodes corresponds to a federated learning client; Matrixing the private watermark parameters of each of the federated learning clients through a predefined smart contract to obtain a watermark matrix containing multiple private watermark vectors; Embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client, apply the federated average algorithm for aggregation, obtain the parameters of the initial global business model, and store the parameters of the initial global business model in the preset second node of the blockchain; Applying the consensus mechanism of the blockchain, verifying the private watermark vector of the parameters of the initial global business model to obtain a verification result; the verification result includes correct and incorrect; When the verification result is incorrect, each of the federated learning clients applies the local data set to train the initial local business model to obtain the parameters of the updated initial local business model, and returns to the step of "obtaining the parameters of the initial local business model and the private watermark parameters of each federated learning client through multiple first nodes of the blockchain" to continue execution; When the verification result is correct, judging whether the initial global business model is converged according to the parameters of the initial global business model; When the initial global business model does not converge, the parameters of the initial global business model are returned to each of the federated learning clients as the parameters of the initial local business model of each of the federated learning clients, and each of the federated learning clients uses a local data set to train the initial local business model to obtain the updated parameters of the initial local business model, and returns to the step of "obtaining the parameters of the initial local business model and the private watermark parameters of each federated learning client through multiple first nodes of the blockchain" to continue execution; When the initial global business model converges, a global business model is obtained; the global business model is the initial global business model.

2. The federated learning method according to claim 1, characterized in that: The consensus mechanism is a practical Byzantine fault-tolerant consensus algorithm.

3. The federated learning method according to claim 1, characterized in that: A feature watermark method or a backdoor-based watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client.

4. The federated learning method according to claim 3, characterized in that: The feature watermark method embeds the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client through a loss function.

5. The federated learning method according to claim 3, characterized in that: When the characteristic watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of the corresponding federated learning client, the consensus mechanism of the blockchain is applied to verify the private watermark vector of the parameters of the initial global business model, specifically including: Extracting watermark information from parameters of the initial global business model; Calculating the similarity between the extracted watermark information and the private watermark parameters; When the similarity is greater than a first preset threshold, the verification result is correct; otherwise, the verification result is incorrect.

6. The federated learning method according to claim 3, characterized in that: When the backdoor-based watermark method is applied to embed the private watermark vector of the watermark matrix into the parameters of the initial local business model of each of the federated learning clients, the consensus mechanism of the blockchain is applied to verify the private watermark vector of the parameters of the initial global business model, specifically including: Calling trigger parameters stored on the blockchain, applying a predefined trigger sample set, and calculating the accuracy of the initial global business model; the trigger parameters are stored on the blockchain when a backdoor-based watermarking method is applied to embed a private watermark vector of the watermark matrix into the parameters of the initial local business model of each of the federated learning clients; When the accuracy is greater than a second preset threshold, the verification result is correct; otherwise, the verification result is incorrect.

7. The federated learning method according to claim 1, characterized in that: The method by which each of the federated learning clients applies a local data set to train the initial local business model is a stochastic gradient descent method.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the federated learning method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the federated learning method described in any one of claims 1 to 7 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the federated learning method described in any one of claims 1 to 7 is implemented.

Images