A homomorphic encryption based fair federated learning method capable of protecting user privacy

Abstract

The application discloses a fair federated learning method based on homomorphic encryption capable of protecting user privacy, relates to the technical field of federated learning, and comprises the following steps: assuming that there are N participants in total, and the local gradient for aggregation is defined as the gradient Delta w j Based on local calculation, j represents the jth round of aggregation, and i represents the ith participant; the core element is a reputation coefficient, which is represented by R. The fair federated learning method based on homomorphic encryption capable of protecting user privacy adopts the method of homomorphic encryption, uses local gradients, improves the availability of training, and protects the privacy of users; a federated learning method capable of realizing privacy protection and fair cooperation is provided, the correctness and safety can be considered, and fairness is maintained; the fair federated learning method belongs to a fair federated learning scheme, that is, the more data a participant contributes, the better the accuracy or the higher the quality of the model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning, and particularly to a fair federated learning method based on homomorphic encryption capable of protecting user privacy. BACKGROUND

[0002] Federated learning is a distributed machine learning approach that allows multiple participants to collaboratively train a shared model while keeping their respective data private. In federated learning, data does not leave the local devices but is shared through model updates. These updates are then aggregated to improve the global model without exposing the original data. The background for applying federated learning mainly stems from the growing concerns about data privacy and security. With the strengthening of data protection regulations, such as the General Data Protection Regulation (GDPR) in the European Union, businesses and research institutions need to find new ways to process and analyze data while complying with privacy protection regulations. In addition, federated learning is also suitable for scenarios where data is widely distributed or sensitive, such as healthcare, financial services, and mobile devices, where data sharing faces legal or technical barriers.

[0003] Through federated learning, machine learning modeling can be performed using data scattered in different geographic locations without directly sharing the data, thereby improving the generalization ability and accuracy of the model while protecting privacy. Under the framework of federated learning, different participants (such as multiple companies, hospitals, or research institutions) can jointly train a model without exchanging or centrally storing their private data. Each participant only contributes model updates (such as gradient or weight updates) of their local data, which are then encrypted or anonymized and sent to a central server or aggregation node for aggregation.

[0004] The aggregated model updates are used to update the global model, and the updates of the global model are then distributed to each participant so that they can continue training on their local data sets. This process is iterated until the model reaches satisfactory performance or meets the stopping condition.

[0005] The third party usually plays the role of coordinator or service provider, and its specific functions include: coordinating communication (the third party is responsible for establishing a secure communication channel between participants to ensure the secure transmission of model updates or parameters between parties), model aggregation (the third party is responsible for collecting model updates or parameters from each party and then aggregating these updates according to the federated learning protocol to improve the global model), algorithm management (the third party may be responsible for managing version updates of the federated learning algorithm to ensure that all participants use the latest and secure algorithm), resolving conflicts (in the case of multiple participants, the third party can act as a neutral party to resolve any disputes or technical issues that may arise), and other functions.

[0006] However, in actual use, since the federated learning scheme allows multiple participants to collaboratively train a neural network without directly sharing underlying data, in a general scheme, all participants obtain the same model. In addition, aggregation is usually performed by a third party to update the gradient or weight to avoid this problem, which brings the risk of leaking the data of the model. Collaborative fairness requires ensuring individual model quality based on contributions, while protecting privacy for any type of data provided to the third party.

[0007] Therefore, there is an urgent need to improve this drawback, and the present application is directed to the existing technology and deficiencies to provide a fair federated learning method based on homomorphic encryption capable of protecting user privacy. SUMMARY

[0008] The present application aims to provide a fair federated learning method based on homomorphic encryption capable of protecting user privacy to solve the problems raised in the background art.

[0009] To achieve the above-mentioned purpose, the present application provides the following technical solution: a fair federated learning method based on homomorphic encryption capable of protecting user privacy, comprising the following steps:

[0010] S1, assuming there are N participants in total, the local gradient for aggregation is defined as Based on the locally calculated gradient Δw j , j represents the jth round of aggregation, i represents the ith participant; the core element is the reputation coefficient, denoted by r i j ; the gradient update is obtained based on weighted average calculation;

[0011] r i j At j = 1, the first round, initialize to

[0012] For an individual i, the contribution to the gradient update Δw j is calculated by the following formula:

[0013]

[0014] Then update the reputation coefficient:

[0015]

[0016] Where, alpha is a parameter in [0, 1]; then normalize r i j After normalization, all r i ​​j and is 1;

[0017] Then the relative reputation is calculated

[0018] After being determined, each participant can access j Gradient updates of represents the integer part; while the remaining gradient (sometimes called reward gradient, reward gradient, gradient updated by local gradient), will be returned to the participant, updated with the normalized local gradient; (in simple terms, the total gradient, also called FL gradient, is updated in two parts, global and local contributed by all participants; the higher the reputation, the more global updates, and vice versa);

[0019] S2, introduce a mask Map to the l-dimensional vector {0, 1} l (l-dimensional vector, each position takes the value 0 or 1), to adjust, and then summarize the above description to get the formula:

[0020]

[0021] Where × is vector multiplication;

[0022] Then introduce the HE homomorphic encryption (HE schema) method, specifically the CKKS homomorphic encryption method;

[0023] S3, participants establish a homomorphic encryption-based system through collaboration, each participant can access the key, while the central server cannot decrypt any ciphertext encrypted in the homomorphic encryption system; use additional symmetric encryption to encrypt all communications, and only share local gradients with the central server; all participants share the same key and do not pose a privacy threat;

[0024] Key steps for the central server and participants: all local gradients are normalized locally, encrypted by the participant, and then sent to the central server; the reputation coefficient is initialized in plaintext; then, the central server calculates the encrypted FL gradient w and scalar product s:

[0025] The encrypted scalar product is given to the participant, who then decrypts it using the formula and calculates the contribution coefficient:

[0026]

[0027] ​Participants cannot infer the gradient from the scalar product and then choose to compute redundantly at the immediate neighbor of participant i

[0028] S4, server updates reputation coefficient r i j Then according to the formula Update And then adjust according to a constant coefficient γ Will Keep in the interval [0, 1]; γ belongs to the parameters, which can be adjusted;

[0029] Set a mask (m) to represent that the calculation of reward gradient (g) needs to consider the mask;

[0030] As above, keep

[0031] Gradient updates, where l is a constant coefficient, Represents the integer part; initialization can be random; participants with high data quality will get more global gradient updates; use parameters β and γ to adjust the propagation, local gradient and global gradient. Further, in step S1, the gradient calculation and normalization method is as follows:

[0032]

[0033] Where,

[0034] Is the normalized gradient, and the normalization method is defined as:

[0035] Where δ represents the adjustment coefficient, δ ∈ R, which is a real number, and ||·||2 represents the L2 norm (for details, see https: / / blog.csdn.net / u010725283 / article / details / 79212762).

[0036] Further, in step S1, the relative reputation

[0037] The calculation formula is as follows:

[0038]

[0039] Where, Tanh is a commonly used activation function, and β is a real constant parameter;

[0040] ​

[0041] β is a constant coefficient, usually a small number.

[0042] Further, in the step S2, the HE provides an encryption and decryption method interface, Enc(x, pk) represents that x is encrypted with the public key pk, and the ciphertext after encryption is [x], and then the private key sk is used for decryption, defined as Dec([x], sk); based on the HE schema, the ciphertext can be operated, but only limited to multiplication and addition.

[0043] Further, the operation of the HE on the ciphertext includes:

[0044] Scalar addition is defined as

[0045] Scalar subtraction is defined as

[0046] Vector multiplication is defined as

[0047] Scalar products, based on the scalar multiplication [x]⊙[y]=[x·y].

[0048] Further, in the step S3, the center server can access all the gradients, including the global gradient, and the center server must be operated by a third party, and the privacy of the third party holding the gradient is maintained by using the HE.

[0049] Further, in the step S3, for the participants, all communications are encrypted using symmetric encryption, and the participants can only obtain their own local and reward gradients.

[0050] Further, in the step S3, the center server calculates the encrypted FL gradient w and the scalar product s, and the formula is as follows:

[0051]

[0052] The application provides a fair federated learning method based on homomorphic encryption capable of protecting user privacy, which has the following beneficial effects:

[0053] The application adopts the method of homomorphic encryption, uses local gradients, improves the availability of training, and protects the privacy of users; a fair and cooperative federated learning method is provided, which can balance correctness and security, and maintain fairness; it belongs to a fair federated learning scheme, that is, the more data a participant contributes, the better the accuracy of the model, or the higher the quality of the model. BRIEF DESCRIPTION OF DRAWINGS

[0054] Fig. 1 For the participant and the center service of the invention, a fair federated learning method based on homomorphic encryption capable of protecting user privacy, a schematic diagram of calculating an encrypted FL gradient is provided;

[0055] Fig. 2 For the participant and the center service of the invention, a fair federated learning method based on homomorphic encryption capable of protecting user privacy, a schematic diagram of calculating a reward gradient of ciphertext based on a contribution coefficient is provided. DETAILED DESCRIPTION

[0056] The embodiments of the present application will be further described in detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate the present application, but cannot be used to limit the scope of the present application.

[0057] As shown in Figs. 1-2 , a fair federated learning method based on homomorphic encryption capable of protecting user privacy includes the following steps:

[0058] S1, assuming there are N participants in total, the local gradient for aggregation is defined as Based on the locally calculated gradient Δw j , j represents the jth round of aggregation, i represents the ith participant; the core element is the reputation coefficient, which is represented by r i j ; the gradient update is obtained based on weighted average calculation;

[0059] The calculation and normalization method of the gradient is as follows:

[0060]

[0061] wherein, is the gradient after normalization, and the normalization method is defined as:

[0062]

[0063] wherein, δ represents the adjustment coefficient, δ ∈ R, which is a real number, and ||·||2 represents the L2 norm (for details, see the website https: / / blog.csdn.net / u010725283 / article / details / 79212762);

[0064] r i j At j = 1, the first round, initialize to

[0065] For a certain individual i, the contribution j to the gradient update Δw is calculated by formula 2:

[0066]

[0067] Then update the reputation coefficient:

[0068]

[0069] where, a e [0, 1] is a parameter; then r i j Normalization operation After normalization, all r i j and are 1;

[0070] Then calculate the relative reputation

[0071]

[0072] where, tanh is a commonly used activation function, and β is a real constant parameter;

[0073]

[0074] β is a constant coefficient, usually a small number;

[0075] After being determined, each participant can access the gradient update of the j in Δw , where, l is a constant coefficient, represents the integer part; and the remaining gradient (sometimes called reward gradient, reward gradient, gradient updated by local gradient), will be returned to the participant, and the normalized local gradient is updated; (in simple terms, the total gradient, also called FL gradient, is updated in two parts, the global one contributed by all participants, and the local one of the participant; the higher the reputation, the more global updates, and vice versa);

[0076] S2, introduce a mask Map to l-dimensional vector {0, 1} l (l-dimensional vector, each position takes value 0 or 1), to adjust, then summarize the above description, get the formula:

[0077]

[0078] where, × is vector multiplication;

[0079] Then the HE homomorphic encryption (HE schema) method is introduced; HE provides the method interface of encryption and decryption, Enc(x, pk) represents the encryption of x with the public key pk, the ciphertext after encryption is [x], and then the private key sk is used for decryption, defined as Dec([x], sk); based on the HE schema, the ciphertext can be operated, but only limited to multiplication and addition;

[0080] The CKKS homomorphic encryption method is used in this embodiment; for specific CKKS method, refer to (J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption for arithmetic of approximate numbers,” in Advances in Cryptology-ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I 23. Springer, 2017, pp. 409-437), which is not the focus of this embodiment;

[0081] Among them, the operation based on the ciphertext is:

[0082] The scalar addition is defined as

[0083] The scalar subtraction is defined as

[0084] The vector multiplication is defined as

[0085] The scalar product (scalar products), the scalar multiplication [x]⊙[y] = [x·y],

[0086] Note that the above represents the operation on the ciphertext;

[0087] S3, the center server can access all gradients, including global gradients; therefore, in order to provide a fair algorithm, this server must be operated by a third party, which makes part of the data of the algorithm possibly leaked to the third party, thereby reducing the credibility of the algorithm; using HE to keep the privacy of these gradients for the third party has solved all security problems related to the center server; it is assumed that the server provider may try to infer as much information as possible, but will not modify any calculation, because once modified, it will cause irreversible errors, leading to the discovery of the modification behavior;

[0088] For participants, if all communications in the embodiment are encrypted using symmetric encryption, participants can only obtain their own local and reward gradients, so it is considered that the scheme has achieved privacy protection for other participants;

[0089] In the system, participants establish a homomorphic encryption-based system through cooperation, and each participant can access the key, while the center server cannot decrypt any ciphertext encrypted in the homomorphic encryption system; all communications are encrypted using additional symmetric encryption, and only local gradients are shared with the center server, and sharing the same key by all participants does not pose a privacy threat;

[0090] Fig. 1 is a key step for the center server and participants; all local gradients are normalized locally, encrypted by the participants, and then sent to the center server; the reputation coefficient is initialized in plaintext; then, the center server calculates the encrypted FL gradient w and the scalar product s:

[0091]

[0092] The encrypted scalar product is given to the participants, who then decrypt and calculate the contribution coefficient in the manner of formula 2:

[0093]

[0094] The participants cannot infer the gradient from the scalar product, and we choose to calculate the redundant as shown in Fig. 2 ;

[0095] S4, the server updates the reputation coefficient r i j , and then updates r according to formula 3 is adjusted according to a constant coefficient γ Keep in the interval [0, 1]; γ belongs to the parameters and can be adjusted;

[0096] Set a mask (mask-m to represent) reward gradient ( The computation of the gradient (indicated by the arrow) needs to take into account

[0097] masking;

[0098]

[0099] Similar to the above description, we reserve a gradient update of the local model, where l is a constant factor, denotes the floor function; at initialization, random values can be saved; participants with high data quality will get more global gradient updates; parameters β and γ are used to adjust the propagation, local gradient and global gradient.

[0100] Embodiments of the application are presented by way of example and description only, and are not intended to limit the application to the form disclosed. Many modifications and variations will occur to those skilled in the art. The embodiments are chosen and described in order to best explain the principles of the application and its practical application, and to thereby enable others skilled in the art to best utilize the application in various embodiments and with various modifications as are suited to the particular use contemplated.

Claims

1. A homomorphic encryption-based fair federated learning method capable of protecting user privacy, characterized in that, Comprising the following steps: S1, assuming there are N participants in total, the local gradient for aggregation is defined as Based on the locally calculated gradient Δw j , j represents the jth round of aggregation, i represents the ith participant; the core element is the reputation coefficient, denoted as r i j ; the gradient update is obtained based on the weighted average calculation; r i j At j = 1, the first round, initialize to The contribution of a certain individual i to the gradient update Δw j is calculated by the following formula is calculated by the following formula is the normalized gradient, and || · ||2denotes the L2 norm. The prestige coefficient is updated as follows: where a e [0, 1] is a parameter; then normalize r i j performing normalization operation After normalization, all r i j and are 1; Relative prestige is then calculated After being determined, each participant can access Dw j in the gradient update of Dw , where l is a constant coefficient, represents the integer part; while the remaining gradient will be returned to the participant for updating with the normalized local gradient; S2, introduce a mask Vector {0, 1} mapped to l-dimension l , to adjust, after the above description, get the formula: Where x is vector multiplication; Then the HE homomorphic encryption method is introduced; S3, participants establish a homomorphic encryption-based system through collaboration, each participant can access the key, while the central server cannot decrypt any ciphertext encrypted in the homomorphic encryption system; all communications are encrypted using additional symmetric encryption, and only the local gradient is shared with the central server; all participants share the same key without causing privacy threats; The key steps of the central server and the participants: all local gradients are normalized locally, encrypted by the participants, and then sent to the central server; the prestige coefficient is initialized in plaintext; then, the central server calculates the encrypted FL gradient w and the scalar product s: The encrypted scalar product is given to the participant who then decrypts it in the manner of the formula and computes the contribution coefficient: Participants cannot reason from the scalar product to infer the gradient and then choose to compute redundantly at the immediate neighbor of participant i S4, the server updates the prestige coefficient r i j Then, according to the formula Update And then, according to a constant coefficient γ, adjust Will Keep in the interval [0, 1]; γ belongs to the parameters; A mask, mask-m, is set to reward gradients The computation needs to take the mask into account; As above, reserve Gradient updates of l, where l is a constant factor, Indicates rounding down; initialization can be random; participants with high data quality will get more global gradient updates; parameters β and γ are used to adjust the propagation, local gradient and global gradient.

2. The homomorphic encryption-based fair federated learning method capable of protecting user privacy according to claim 1, characterized in that, In the step S1, the gradient calculation and normalization method is as follows: Where the normalization method is defined as: Where δ represents the adjustment coefficient, δ∈R, which is a real number.

3. The homomorphic encryption based fair federated learning method capable of protecting user privacy according to claim 1, characterized in that, In the step S1, the relative prestige is calculated according to the following formula: wherein tanh is a commonly used activation function, and β is a real constant parameter. β is a constant coefficient.

4. The homomorphic encryption-based fair federated learning method capable of protecting user privacy according to claim 1, characterized in that, In the step S2, HE provides an encryption and decryption method interface, Enc(x, pk) represents the encryption of x with the public key pk, and the encrypted ciphertext is [x], then the private key sk is used for decryption, defined as Dec([x], sk).

5. The homomorphic encryption-based fair federated learning method capable of protecting user privacy according to claim 4, characterized in that, The operations of the HE on the ciphertext include: Scalar addition is defined as [x]⊕[y]=[x+y], Scalar subtraction is defined as Vector multiplication is defined as Scalar multiplication is based on [x]⊙[y]=[x·y].

6. The homomorphic encryption-based fair federated learning method capable of protecting user privacy according to claim 1, characterized in that, In the step S3, the central server can access all gradients, including the global gradient, and the central server must be operated by a third party, and HE is used to maintain the privacy of the third party gradient.

7. The homomorphic encryption based fair federated learning method capable of protecting user privacy according to claim 1, characterized in that, In the step S3, for the participants, all communications are encrypted using symmetric encryption, and the participants can only obtain their own local and reward gradients.

8. The homomorphic encryption-based fair federated learning method capable of protecting user privacy according to claim 1, characterized in that, In the step S3, the central server calculates the encrypted FL gradient w and the scalar product s as follows:

Images