Homomorphic encryption-based fair federal learning method capable of protecting user privacy

Abstract

The invention discloses a fair federated learning method based on homomorphic encryption and capable of protecting user privacy, and relates to the technical field of federated learning, and the method comprises the steps: assuming that a local gradient for aggregation is defined as # imgabs0 # gradient delta wj based on local calculation, j represents the jth round of aggregation, and i represents the ith participant; and the core element is a sound coefficient and is represented by # imgabs1 #. According to the homomorphic encryption-based fair federated learning method capable of protecting the privacy of the user, a homomorphic encryption method is adopted, local gradient is used, the usability of training is improved, and meanwhile, the privacy of the user is protected; the federal learning method which can realize privacy protection and fair cooperation is provided, correctness and safety can be considered, and fairness can be kept; the method belongs to a fair federal learning scheme, that is to say, for participants with more contribution data, models with higher accuracy or higher quality can be obtained.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning, and in particular to a fair federated learning method based on homomorphic encryption that can protect user privacy. Background Art

[0002] Federated learning is a distributed machine learning method that allows multiple participants to collaborate on training a shared model while keeping their respective data private. In federated learning, data does not leave the local device but is shared through model updates. These updates are then aggregated to improve the global model without exposing the original data. The context for applying federated learning stems mainly from the growing concern about data privacy and security. With the strengthening of data protection regulations, such as the EU's General Data Protection Regulation (GDPR), companies and research institutions need to find new ways to process and analyze data while complying with privacy protection regulations. In addition, federated learning is also suitable for scenarios where data is widely distributed or sensitive, such as healthcare, financial services, and mobile devices, where there are legal or technical barriers to data sharing.

[0003] Federated learning allows machine learning modeling to be performed using data dispersed across different geographical locations without directly sharing the data, thereby improving the generalization and accuracy of the model while protecting privacy. Under the framework of federated learning, different participants (such as multiple companies, hospitals, or research institutions) can jointly train a model without exchanging or centrally storing their respective private data. Each participant only contributes model updates (such as gradient or weight updates) for its local data, which are then encrypted or anonymized and sent to a central server or aggregation node for aggregation.

[0004] The aggregated model updates are used to update the global model, and the global model updates are distributed to each participant again so that they can continue training on their local datasets. This process is repeated until the model achieves satisfactory performance or meets the stopping criteria.

[0005] The third party usually plays the role of coordinator or service provider. Its specific roles include: coordinating communications (the third party is responsible for establishing a secure communication channel between the participants to ensure that model updates or parameters are securely transmitted between the parties), model aggregation (the third party is responsible for collecting model updates or parameters from all parties, and then aggregating these updates in accordance with the federated learning protocol to improve the global model), algorithm management (the third party may be responsible for managing version updates of the federated learning algorithm to ensure that all participants use the latest and secure algorithms), conflict resolution (when multiple parties are involved, the third party can act as a neutral party to resolve any disputes or technical issues that may arise), and some other functions.

[0006] However, in actual use, since federated learning schemes allow multiple participants to collaborate on training neural networks without directly sharing the underlying data, in general schemes, all participants will obtain the same model. In addition, aggregation is usually performed by a third party to update gradients or weights to circumvent this problem, which brings the risk of leaking model data. Collaborative fairness requires ensuring the quality of individual models based on contributions, while protecting the privacy of any type of data given to third parties.

[0007] Therefore, there is an urgent need to improve this shortcoming. The present invention studies and improves the existing technology and its shortcomings, and provides a fair federated learning method based on homomorphic encryption that can protect user privacy. Summary of the invention

[0008] The purpose of the present invention is to provide a fair federated learning method based on homomorphic encryption that can protect user privacy, so as to solve the problems raised in the above background technology.

[0009] To achieve the above object, the present invention provides the following technical solution: a fair federated learning method based on homomorphic encryption that can protect user privacy, comprising the following steps:

[0010] S1. Assuming there are N participants, the local gradient used for aggregation is defined as Based on the locally calculated gradient Δw j ,j represents the jth round of aggregation, i represents the ith participant; the core element is the reputation coefficient, represented by r i j Represents; Gradient update is obtained based on weighted average calculation;

[0011] r i j When j=1, in the first round, it is initialized to

[0012] For an individual i, the gradient update Δw j Contribution Calculated by the following formula:

[0013]

[0014] Update the reputation coefficient later:

[0015]

[0016] Among them, α∈[0,1] is a parameter; then for r i j Perform normalization operation After normalization, all r ij The sum is 1;

[0017] Then calculate the relative reputation

[0018] Once determined, each participant can access Δw j In The gradient update is, where l is a constant coefficient, represents the integer downward; and the remaining gradient (Sometimes called reward gradient, the gradient updated with local gradient), will be returned to the participant and updated with the normalized local gradient; (In simple terms, it is the total gradient, also called FL gradient, the update is divided into two parts, the global one contributed by all participants, and the local one of the participants; the higher the reputation, the more global updates can be made, and vice versa);

[0019] S2. Introduce a mask Mapped to a vector of dimension l {0, 1} l (a vector of dimension l, where each position has a value of 0 or 1) to make adjustments, and then summarize the above description to get the formula:

[0020]

[0021] Where × is vector multiplication;

[0022] Then the HE homomorphic encryption (HE schema) method is introduced, specifically the CKKS homomorphic encryption method;

[0023] S3. Participants collaborate to establish a homomorphic encryption-based system. Each participant can access the key, and the central server cannot decrypt any ciphertext encrypted in the homomorphic cryptographic system. All communications are encrypted using additional symmetric encryption, and only local gradients are shared with the central server. All participants share the same key without causing privacy threats.

[0024] Key steps for the central server and participants: All local gradients are normalized locally, encrypted by the participant, and then sent to the central server; the reputation coefficient is initialized in plain text; then, the central server computes the encrypted FL gradient w and the scalar product s:

[0025] The encrypted scalar product is given to the participant, who then uses the formula Decryption is performed and the contribution coefficient is calculated:

[0026]

[0027] Participants cannot infer the gradient from the scalar product and then choose the node directly adjacent to participant i, which is redundant calculation.

[0028] S4. Server updates reputation coefficient r i j , then according to the formula renew Then adjust it according to a constant coefficient γ Will Keep it in the interval [0,1]; γ is a parameter and can be adjusted;

[0029] Set a mask (represented by mask-m), reward gradient ( The calculation of (to represent) needs to take the mask into account;

[0030]

[0031] Same as above, keep The gradient update is, where l is a constant coefficient, Indicates rounding down to an integer; during initialization, random saving can be performed; participants with high data quality will receive more global gradient updates; parameters β and γ are used to adjust propagation, local gradients, and global gradients.

[0032] Furthermore, in step S1, the calculation and normalization method of the gradient is as follows:

[0033]

[0034] in, is the normalized gradient, and the normalization method is defined as:

[0035]

[0036] Among them, δ represents the adjustment coefficient, δ∈R, is a real number, and ||·||2 represents the L2 norm (for details, see the website https: / / blog.csdn.net / u010725283 / article / details / 79212762).

[0037] Furthermore, in step S1, relative reputation The calculation formula is as follows:

[0038]

[0039] in, Tanh is a commonly used activation function, and β is a real constant parameter;

[0040]

[0041] β is a constant coefficient, usually a small number.

[0042] Furthermore, in step S2, HE provides an encryption and decryption method interface, Enc(x,pk) means encrypting x with the public key pk, the encrypted ciphertext is [x], and then decrypted with the private key sk, defined as Dec([x],sk); based on the HE schema, the ciphertext can be operated, but it is limited to multiplication and addition.

[0043] Furthermore, the HE operation on the ciphertext includes:

[0044] Scalar addition is defined as [x]⊕[y]=[x+y],

[0045] Scalar subtraction is defined as

[0046] Vector multiplication is defined as

[0047] Scalar products, based on scalar multiplication [x]⊙[y]=[x·y].

[0048] Furthermore, in step S3, the central server can access all gradients, including global gradients, and a third party must operate the central server and use HE to keep the gradients private to the third party.

[0049] Furthermore, in step S3, for participants, all communications are encrypted using symmetric encryption, and participants can only obtain their own local and reward gradients.

[0050] Furthermore, in step S3, the central server calculates the encrypted FL gradient w and the scalar product s using the following formula:

[0051]

[0052] The present invention provides a fair federated learning method based on homomorphic encryption that can protect user privacy, which has the following beneficial effects:

[0053] The present invention adopts a homomorphic encryption method and uses local gradients to improve the availability of training while protecting the privacy of users. It provides a fair and collaborative federated learning method that can achieve privacy protection and can balance correctness and security while maintaining fairness. It is a fair federated learning solution, that is, the more participants contribute data, the better the accuracy, or the higher the quality of the model, will be. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of calculating encrypted FL gradients for participants and central services of a fair federated learning method based on homomorphic encryption that can protect user privacy in the present invention;

[0055] Figure 2 A schematic diagram of a reward gradient for calculating ciphertext based on a contribution coefficient among participants and a central service of a fair federated learning method based on homomorphic encryption that can protect user privacy according to the present invention. DETAILED DESCRIPTION

[0056] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0057] like Figure 1-Figure 2 As shown, a fair federated learning method based on homomorphic encryption that can protect user privacy includes the following steps:

[0058] S1. Assuming there are N participants, the local gradient used for aggregation is defined as Based on the locally calculated gradient Δw j ,j represents the jth round of aggregation, i represents the ith participant; the core element is the reputation coefficient, represented by r i j Represents; Gradient update is obtained based on weighted average calculation;

[0059] The calculation and normalization method of the gradient is as follows:

[0060]

[0061] Among them, Δw~ i j is the normalized gradient, and the normalization method is defined as:

[0062]

[0063] Where δ represents the adjusted coefficient, δ∈R is a real number, and ||·||2 represents the L2 norm (for details, see the website https: / / blog.csdn.net / u010725283 / article / details / 79212762);

[0064] r i j When j=1, in the first round, it is initialized to

[0065] For an individual i, the gradient update Δw j Contribution Calculated by formula 2:

[0066]

[0067] Update the reputation coefficient later:

[0068]

[0069] Among them, α∈[0,1] is a parameter; then for r i j Perform normalization operation After normalization, all r i j The sum is 1;

[0070] Then calculate the relative reputation

[0071]

[0072] in, Tanh is a commonly used activation function, and β is a real constant parameter;

[0073]

[0074] β is a constant coefficient, usually a relatively small number;

[0075] Once determined, each participant can access Δw j In The gradient update is, where l is a constant coefficient, represents the integer downward; and the remaining gradient (Sometimes called reward gradient, the gradient updated with local gradient), will be returned to the participant and updated with the normalized local gradient; (In simple terms, it is the total gradient, also called FL gradient, the update is divided into two parts, the global one contributed by all participants, and the local one of the participants; the higher the reputation, the more global updates can be made, and vice versa);

[0076] S2. Introduce a mask Mapped to a vector of dimension l {0, 1} l (a vector of dimension l, where each position has a value of 0 or 1) to make adjustments, and then summarize the above description to get the formula:

[0077]

[0078] Where × is vector multiplication;

[0079] Then the HE homomorphic encryption (HE schema) method is introduced; HE provides encryption and decryption method interfaces. Enc(x,pk) means encrypting x with the public key pk. The encrypted ciphertext is [x]. The private key sk is then used for decryption, which is defined as Dec([x],sk); based on the HE schema, the ciphertext can be operated, but only limited to multiplication and addition;

[0080] This embodiment adopts the homomorphic encryption method of CKKS; the specific CKKS method is referred to (JHCheon, A.Kim, M.Kim, and Y.Song, "Homomorphic encryption for arithmetic of approximate numbers," in Advances in Cryptology-ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23. Springer, 2017, pp. 409-437), which is not the focus of this embodiment;

[0081] Among them, the operations based on ciphertext are:

[0082] Scalar addition is defined as [x]⊕[y]=[x+y],

[0083] Scalar subtraction is defined as

[0084] Vector multiplication is defined as

[0085] Scalar products, based on scalar multiplication [x]⊙[y]=[x·y],

[0086] Note that the above indicates operations on ciphertext;

[0087] S3. The central server has access to all gradients, including global gradients. Therefore, in order to provide a fair algorithm, a third party must operate this server, which may leak some of the algorithm's data to the third party, thereby reducing the credibility of the algorithm. Using HE to keep these gradients private to third parties is sufficient to solve all security issues related to the central server. It is assumed that the server provider may try to infer as much information as possible, but will not modify any calculations, because once modified, it will cause irreversible errors and lead to the discovery of the modification behavior.

[0088] For participants, if all communications in the embodiment are encrypted using symmetric encryption, participants can only obtain their own local and reward gradients, so it is believed that the scheme can achieve privacy protection for other participants;

[0089] In this system, participants collaborate to establish a homomorphic encryption-based system. Each participant can access the key, and the central server cannot decrypt any ciphertext encrypted in the homomorphic cryptographic system. All communications are encrypted using additional symmetric encryption, and only local gradients are shared with the central server. All participants share the same key, which does not pose a privacy threat.

[0090] Figure 1 is a key step for the central server and participants; all local gradients are normalized locally, encrypted by the participants, and then sent to the central server; the reputation coefficient is initialized in plain text; then, the central server calculates the encrypted FL gradient w and the scalar product s:

[0091]

[0092] The encrypted scalar product is given to the participant, who then uses Formula 2 to decrypt and calculate the contribution coefficient:

[0093]

[0094] Participants cannot infer the gradient from the scalar product. We choose to redundantly compute the gradient at the nodes directly adjacent to participant i. like Figure 2 As shown;

[0095] S4. Server updates reputation coefficient r i j , and then update according to Formula 3 Then adjust it according to a constant coefficient γ Will Keep it in the interval [0,1]; γ is a parameter and can be adjusted;

[0096] Set a mask (represented by mask-m), reward gradient ( The calculation of (to represent) needs to take the mask into account;

[0097]

[0098] Similar to the above description, we keep The gradient update is, where l is a constant coefficient, Indicates rounding down to an integer; during initialization, random saving can be performed; participants with high data quality will receive more global gradient updates; parameters β and γ are used to adjust propagation, local gradients, and global gradients.

[0099] The embodiments of the present invention are given for the purpose of illustration and description, and are not intended to be exhaustive or to limit the invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.

Claims

1. A fair federated learning method based on homomorphic encryption that can protect user privacy, characterized in that: The following steps are involved: S1. Assuming there are N participants, the local gradient used for aggregation is defined as Δw i j , based on the locally calculated gradient Δw j ,j represents the jth round of aggregation, i represents the i-th participant; the core element is the reputation coefficient, expressed as Represents; Gradient update is obtained based on weighted average calculation; When j=1, in the first round, it is initialized to For an individual i, the gradient update Δw j Contribution Calculated by the following formula: Update the reputation coefficient afterwards: Among them, α∈[0,1] is a parameter; then Perform normalization operation After normalization, all The sum is 1; Then calculate the relative reputation Once determined, each participant can access Δw j In The gradient update is, where l is a constant coefficient, represents the integer downward; and the remaining gradient It will be returned to the participant and updated with the normalized local gradient; S2. Introduce a mask Mapped to a vector of dimension l {0, 1} l , to make adjustments, and then summarize the above description to get the formula: Where × is vector multiplication; Then the HE homomorphic encryption method is introduced; S3. Participants collaborate to establish a homomorphic encryption-based system. Each participant can access the key, and the central server cannot decrypt any ciphertext encrypted in the homomorphic cryptographic system. All communications are encrypted using additional symmetric encryption, and only local gradients are shared with the central server. All participants share the same key without causing privacy threats. Key steps for the central server and participants: All local gradients are normalized locally, encrypted by the participant, and then sent to the central server; the reputation coefficient is initialized in plain text; then, the central server computes the encrypted FL gradient w and the scalar product s: The encrypted scalar product is given to the participant, who then uses the formula Decryption is performed and the contribution coefficient is calculated: Participants cannot infer the gradient from the scalar product and then choose the node directly adjacent to participant i, which is redundant calculation. S4. Server-side reputation update Then according to the formula renew Then adjust it according to a constant coefficient γ Will Keep in the interval [0,1]; γ is a parameter; Set a mask mask-m, reward gradient The calculation of needs to take the mask into account; Same as above, keep The gradient update is, where l is a constant coefficient, Indicates rounding down to an integer; during initialization, random saving can be performed; participants with high data quality will receive more global gradient updates; parameters β and γ are used to adjust propagation, local gradients, and global gradients.

2. A fair federated learning method based on homomorphic encryption that can protect user privacy according to claim 1, characterized in that: In step S1, the calculation and normalization method of the gradient is as follows: in, is the normalized gradient, and the normalization method is defined as: Among them, δ represents the adjusted coefficient, δ∈R, is a real number, and ||·||2 represents the L2 norm.

3. A fair federated learning method based on homomorphic encryption that can protect user privacy according to claim 1, characterized in that: In step S1, relative reputation The calculation formula is as follows: in, Tanh is a commonly used activation function, and β is a real constant parameter; β is a constant coefficient.

4. The method of fair federated learning based on homomorphic encryption that can protect user privacy according to claim 1, characterized in that: In step S2, HE provides an encryption and decryption method interface, Enc(x,pk) means that x is encrypted with the public key pk, and the encrypted ciphertext is [x], which is then decrypted with the private key sk, which is defined as Dec([x],sk).

5. A fair federated learning method based on homomorphic encryption that can protect user privacy according to claim 4, characterized in that: The HE operation on the ciphertext includes: Scalar addition is defined as Scalar subtraction is defined as Vector multiplication is defined as Scalar products, based on scalar multiplication [x]⊙[y]=[x·y].

6. The fair federated learning method based on homomorphic encryption that can protect user privacy according to claim 1, characterized in that: In step S3, the central server can access all gradients, including global gradients, and a third party must operate the central server and use HE to keep the gradients private to the third party.

7. The fair federated learning method based on homomorphic encryption that can protect user privacy according to claim 1, characterized in that: In step S3, for participants, all communications are encrypted using symmetric encryption, and participants can only obtain their own local and reward gradients.

8. The fair federated learning method based on homomorphic encryption that can protect user privacy according to claim 1, characterized in that: In step S3, the central server calculates the encrypted FL gradient w and the scalar product s using the following formula:

Images