Federal distillation learning privacy protection method based on ring signature
By adopting a ring signature-based approach in federated learning, the problems of insecure model updates and weak user privacy protection are solved, and more secure model delivery and privacy protection are achieved, and the coordination and adaptability of the system are enhanced.
Patent Information
- Application Number
- CN202411439345.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-15
- Publication Date
- 2025-01-07
AI Technical Summary
The existing technology cannot effectively solve the problems of client dissonance caused by unsafe model updates, weak user privacy protection, and single-point failure of the server.
Using a federal distillation learning method based on ring signature, the system's public parameters and partial signature key pairs are generated through the key generation center. The user generates the complete key pair and performs signature verification during the model delivery process to ensure the security of model updates and Privacy protection.
It improves the security of model updates, effectively protects user privacy, avoids centralized attacks, enhances the system's privacy protection capabilities, and ensures the adaptability and performance of the model.
Smart Images
Figure CN119272333A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence model security, and more specifically, to a privacy protection method for federated distillation learning based on ring signatures. Background Art
[0002] Federated learning is an emerging technology that uses decentralized private data for model training. It provides a privacy-aware learning paradigm that does not require sharing of original data for model training. However, the federated learning framework forces local models to adopt the same architecture and cannot adapt well to heterogeneous clients with different computing resources. In addition, model parameters encode private information about the dataset, making federated learning vulnerable to white-box privacy attacks when passing model parameters.
[0003] Federated distillation learning transfers knowledge between clients instead of model parameters, which better overcomes the defects of adapting to heterogeneous clients with different computing resources and being vulnerable to white-box privacy attacks, thus achieving efficient collaborative learning. However, there are still security issues such as attackers being able to impersonate legitimate users and upload poisoned parameters, thereby destroying the availability of the model and privacy protection issues caused by public user information; single point failures in higher-level servers or central servers can lead to problems of incoordination between clients.
[0004] The prior art discloses a verifiable privacy-preserving federated learning method based on linear homomorphic hashing and signcryption. This method uses signature encryption technology to perform identity authentication and data integrity verification while transferring keys, thereby avoiding impersonation attacks launched by attackers, but there is still a risk of leaking the identity privacy of the signer. Summary of the invention
[0005] The present invention aims to address the defects in the prior art, such as insecure model update, weak user privacy protection, and lack of coordination between clients due to single point failure of the server, and provides a privacy protection method for federated distillation learning based on ring signatures.
[0006] The primary purpose of the present invention is to solve the above technical problems. The technical solution of the present invention is as follows:
[0007] A privacy protection method for federated distillation learning based on ring signature, including:
[0008] S1: The key generation center generates system public parameters and distributes corresponding identity identification and partial signature key pairs to several users;
[0009] S2: Each user generates a corresponding complete key pair based on the received identity and partial signature key pair;
[0010] S3: select any user as the first user;
[0011] S4: training the local model of the first user to obtain a training model of the first user in a current training round;
[0012] S5: Determine whether the termination condition is met; if so, execute step S8; if not, execute step S6;
[0013] S6: Generate a signature of the training model of the current training round of the first user, and the first user sends the signature to the second user, where the second user is any one of the remaining users;
[0014] S7: The second user verifies whether the received signature is legal; if it is legal, the second user is taken as the new first user and step S4 is executed; if it is illegal, step S9 is executed;
[0015] S8: taking the training model of the current training round of the first user as the final model and ending the training;
[0016] S9: Issue data warning and end training.
[0017] Furthermore, in step S1, the key generation center generates system public parameters and distributes corresponding identity identifications and partial signature key pairs to several users, including:
[0018] S101: The key generation center obtains security parameters and generates system public parameters and system master private key;
[0019] S102: The key generation center generates an identity for each user, and generates a partial signature key pair for each user in combination with the system public parameters and the system master private key; each partial signature key pair is sent to the corresponding user.
[0020] Furthermore, in step S102, the formula for generating a partial signature key pair is as follows:
[0021] b i =s·H1(ID i )
[0022] B i =b i Q
[0023] In step S2, the formula for generating a complete key pair is as follows:
[0024] A i =a i Q
[0025] i represents the serial number, H1 represents the collision-resistant hash function, s represents the system master private key, ID irepresents the identity of the i-th user, Q represents the system public parameter, a i represents the private parameters of the i-th user;
[0026] The complete key pair of the i-th user consists of a public key and a private key, where the public key is A i , B i , the private key is a i , b i .
[0027] Furthermore, in step S4, the loss function of training is as follows:
[0028]
[0029] Among them, t represents the user serial number, l cls (f t+1 ; x, y) represents the loss of the model performing reasoning, l dis t(g tea , g stu ; x) represents the loss of knowledge distillation, f t represents the local model of the current training round of the first user, f t+1 represents the local model of the current training round of the second user, g stu represents the local model f of the current training round of the second user t+1 The feature extractor, g tea represents the local model f of the current training round of the first user t , x represents the local model f of the current training round of the second user t+1 The sample input, λ represents the hyperparameter that weighs knowledge distillation and local training, D t+1 represents the local model f of the current training round of the second user t+1 The input dataset y represents the local model f of the current training round of the second user. t+1 The reference output, n t+1 represents the local model f of the current training round of the second user t+1 The number of input samples in the input dataset.
[0030] Furthermore, the loss of the model performing inference is as follows:
[0031]
[0032] The loss of knowledge distillation is as follows:
[0033]
[0034] t represents the user serial number, g stu represents the local model f of the current training round of the second usert+1 The feature extractor, g tea represents the local model f of the current training round of the first user t The feature extractor, f t+1 represents the local model of the current training round of the second user, and x represents the local model of the current training round of the second user f t+1 The sample input of y represents the local model f of the current training round of the second user. t+1 The reference output, y i represents the local model f of the current training round of the second user t+1 The i-th sample input reference output, represents the local model f of the current training round of the second user t+1 The output of the i-th sample input, C represents the number of categories in the multi-classification task.
[0035] Further, in step S6, generating a signature of the training model of the current training round of the first user includes:
[0036] S601: The first user generates N-1 random numbers; calculates a hash value of each random number and a local model of the current training round of the first user;
[0037] S602: Calculate a feature number and a feature check number according to each random number and a hash value of a local model of a current training round of the first user, the N-1 random numbers, a complete key pair of the first user, and the system public parameters;
[0038] S603: Combine the N-1 random numbers, the local model of the current training round of the first user, the feature number and the feature check number to form a signature of the training model of the current training round of the first user.
[0039] Furthermore, the formula for calculating the characteristic number is as follows:
[0040]
[0041] h i =H2(f t , v i )
[0042] t represents the user serial number, i represents the serial number, H2 and H3 represent collision-resistant hash functions, z represents a random integer, Q represents the system public parameter, N represents the total number of users, and h i represents the second hash solution expression of the ith i , B i represents the public key of the ith user, v i represents the i-th random number, f tRepresents the local model of the current training epoch for the first user.
[0043] Furthermore, in step S7, the formula for the second user to verify whether the received signature is legal is as follows:
[0044]
[0045] i represents the sequence number, v i represents the ith random number, H3 represents the anti-collision hash function, T represents the characteristic check number, Q represents the system public parameter, N represents the total number of users, and h i represents the second hash solution expression of the ith i , B i Represents the public key of the i-th user.
[0046] Furthermore, the formula for calculating the characteristic check number is as follows:
[0047] T=zh t ·(a t +b t )
[0048] t represents the user serial number, z represents a random integer, h t represents the second hash solution expression of the tth user, a t , b t Represents the private key of the t-th user.
[0049] A privacy protection device for federated distillation learning based on ring signature, comprising:
[0050] Parameter generation module: The key generation center generates system public parameters and distributes corresponding identity identification and partial signature key pairs to several users;
[0051] Key generation module: Each user generates a corresponding complete key pair based on the received identity and partial signature key pair;
[0052] User selection module: select any user as the first user;
[0053] Training module: training the local model of the first user to obtain the training model of the first user in the current training round;
[0054] Termination judgment module: judge whether the termination condition is met; if it is met, generate the final model; if not, continue training;
[0055] Signature generation module: generates a signature of a training model of a current training round of a first user, and the first user sends the signature to a second user, where the second user is any one of the remaining users;
[0056] Legality verification module: The second user verifies whether the received signature is legal; if it is legal, the second user is used as the new first user and training continues; if it is illegal, a data warning is executed;
[0057] Final model generation module: takes the training model of the first user's current training round as the final model;
[0058] Data early warning module: perform data early warning.
[0059] Compared with the prior art, the present invention has the following beneficial effects:
[0060] The present invention makes model updates safer and effectively protects user privacy by transmitting signatures between various clients and having the receiving users verify the legitimacy of the signatures. It can also effectively coordinate training with various clients. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] Figure 1 A flowchart of a privacy protection method for federated distillation learning based on ring signature provided in Example 1.
[0062] Figure 2 A schematic diagram of a privacy protection method for federated distillation learning based on ring signature provided in Example 1.
[0063] Figure 3 The key generation center provided in Example 1 generates system public parameters and distributes corresponding identity identifications and partial signature key pairs to several users. DETAILED DESCRIPTION
[0064] The drawings are for illustrative purposes only and should not be construed as limiting the present patent;
[0065] In order to better illustrate the present embodiment, some parts in the drawings may be omitted, enlarged or reduced, and do not represent the size of the actual product;
[0066] It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.
[0067] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.
[0068] Example 1
[0069] like Figure 1 , Figure 2 As shown, a privacy protection method for federated distillation learning based on ring signature includes:
[0070] S1: The key generation center generates system public parameters and distributes corresponding identity identification and partial signature key pairs to several users;
[0071] S2: Each user generates a corresponding complete key pair based on the received identity and partial signature key pair;
[0072] S3: select any user as the first user;
[0073] S4: training the local model of the first user to obtain a training model of the first user in a current training round;
[0074] S5: Determine whether the termination condition is met; if so, execute step S8; if not, execute step S6;
[0075] S6: Generate a signature of the training model of the current training round of the first user, and the first user sends the signature to the second user, where the second user is any one of the remaining users;
[0076] S7: The second user verifies whether the received signature is legal; if it is legal, the second user is taken as the new first user and step S4 is executed; if it is illegal, step S9 is executed;
[0077] S8: taking the training model of the current training round of the first user as the final model and ending the training;
[0078] S9: Issue data warning and end training.
[0079] It should be noted that the remaining users refer to the users who have not been trained in the current round; when the remaining users are empty, steps S4-S7 are repeated according to the order of selecting the first user in the previous round.
[0080] It should be noted that through the ring signature technology in steps S1-S2 and steps S6-S7, each participant can maintain anonymity when sharing model updates, and other participants cannot track or identify specific model contributors. This anonymity reduces the risk of identity information leakage and enhances the privacy protection capabilities of the system. By eliminating the dependence on the central server, the risk of centralized attacks is avoided, further improving the privacy protection capabilities of the system. The anonymity and decentralized architecture of the ring signature enable the system to better resist attacks from malicious nodes and prevent attackers from using model update information for tracking, thereby protecting the integrity of the system.
[0081] Through the cyclic knowledge distillation technology in steps S3 to S7, participants can gradually accumulate and share common knowledge while retaining the personalized information of local data, thereby improving the adaptability and performance of the model when the data distribution varies greatly.
[0082] In a specific embodiment, the termination condition is the change between the loss value of the current user in this round and the loss value of the previous round. In k consecutive rounds, the value is less than the preset threshold or the current round reaches the maximum number of rounds. If either of the above conditions is met, the training is terminated. In this embodiment, the maximum number of rounds is set to 10, the preset threshold is set to 0.01, and k is 3.
[0083] It should be noted that, by combining a fixed number of iterations and convergence judgment, the model can terminate training in advance when the best performance is achieved, thus avoiding unnecessary computational overhead. This allows the invention to perform better in an environment with limited network resources, effectively utilize bandwidth resources, and improve communication efficiency. The dynamic termination condition ensures that each participating user can flexibly terminate training based on the specific circumstances of their local data and the actual performance of the model. The final model can better adapt to the characteristics of local data, thus improving the personalized performance of the model.
[0084] Furthermore, if Figure 3 In step S1, the key generation center generates system public parameters and distributes corresponding identity identifiers and partial signature key pairs to several users, including:
[0085] S101: The key generation center obtains security parameters and generates system public parameters and system master private key;
[0086] S102: The key generation center generates an identity for each user, and generates a partial signature key pair for each user in combination with the system public parameters and the system master private key; each partial signature key pair is sent to the corresponding user.
[0087] Furthermore, in step S102, the formula for generating a partial signature key pair is as follows:
[0088] b i =s·H1(ID i )
[0089] B i =b i Q
[0090] In step S2, the formula for generating a complete key pair is as follows:
[0091] A i =a i Q
[0092] i represents the serial number, H1 represents the collision-resistant hash function, s represents the system master private key, ID i represents the identity of the i-th user, Q represents the system public parameter, a i represents the private parameters of the i-th user;
[0093] The complete key pair of the i-th user consists of a public key and a private key, where the public key is A i , B i, the private key is a i , b i In a specific embodiment, the system common parameter Q is generated as follows:
[0094] Q=s·g
[0095] in, is the p-order additive cyclic group generated by the security parameter, and g is The generation of vulgar.
[0096] Furthermore, in step S4, the loss function of training is as follows:
[0097]
[0098] Among them, t represents the user serial number, l cls (f t+1 ; x, y) represents the loss of the model performing reasoning, l dis t(g tea , g stu ; x) represents the loss of knowledge distillation, f t represents the local model of the current training round of the first user, f t+1 represents the local model of the current training round of the second user, g stu represents the local model f of the current training round of the second user t+1 The feature extractor, g tea represents the local model f of the current training round of the first user t , x represents the local model f of the current training round of the second user t+1 The sample input, λ represents the hyperparameter that weighs knowledge distillation and local training, D t+1 The local model f of the current training round of the second user t+1 The input dataset y represents the local model f of the current training round of the second user. t+ 1 的 Reference output, n t+1 represents the local model f of the current training round of the second user t+1 The number of input samples in the input dataset.
[0099] Furthermore, the loss of the model performing inference is as follows:
[0100]
[0101] The loss of knowledge distillation is as follows:
[0102]
[0103] t represents the user serial number, g stu represents the local model f of the current training round of the second user t+1 The feature extractor, g tea represents the local model f of the current training round of the first user t The feature extractor, f t+1 represents the local model of the current training round of the second user, and x represents the local model of the current training round of the second user f t+1 The sample input of y represents the local model f of the current training round of the second user. t+1 The reference output, y i represents the local model f of the current training round of the second user t+1 The i-th sample input reference output, represents the local model f of the current training round of the second user t+1 The output of the i-th sample input, C represents the number of categories in the multi-classification task.
[0104] Further, in step S6, generating a signature of the training model of the current training round of the first user includes:
[0105] S601: The first user generates N-1 random numbers; calculates a hash value of each random number and a local model of the current training round of the first user;
[0106] S602: Calculate a feature number and a feature check number according to each random number and a hash value of a local model of a current training round of the first user, the N-1 random numbers, a complete key pair of the first user, and the system public parameters;
[0107] S603: Combine the N-1 random numbers, the local model of the current training round of the first user, the feature number and the feature check number to form a signature of the training model of the current training round of the first user.
[0108] It should be noted that N represents the total number of users, and N-1 represents the total number of users except the current user.
[0109] Furthermore, the formula for calculating the characteristic number is as follows:
[0110]
[0111] h i =H2(f t , v i )
[0112] t represents the user serial number, i represents the serial number, H2 and H3 represent collision-resistant hash functions, z represents a random integer, Q represents the system public parameter, N represents the total number of users, and h irepresents the second hash solution expression of the ith i , B i represents the public key of the ith user, v i represents the i-th random number, f t Represents the local model of the current training epoch for the first user.
[0113] Furthermore, in step S7, the formula for the second user to verify whether the received signature is legal is as follows:
[0114]
[0115] i represents the sequence number, v i represents the ith random number, H3 represents the anti-collision hash function, T represents the characteristic check number, Q represents the system public parameter, N represents the total number of users, and h i represents the second hash solution expression of the ith i , B i Represents the public key of the i-th user.
[0116] In a specific embodiment, the mapping relationship between the collision-resistant hash functions H1, H2, and H3 is as follows:
[0117] H1: The collision-resistant hash function H1 maps a string of length l consisting of {0, 1} to an element in the p-order positive integer group.
[0118] H2: The collision-resistant hash function H2 maps a string of {0, 1} of arbitrary length to an element in the p-order positive integer group.
[0119] H3: The collision-resistant hash function H3 maps an element in the additive cyclic group G to an element in the p-order positive integer group.
[0120] Furthermore, the formula for calculating the characteristic check number is as follows:
[0121] T=zh t ·(a t +b t )
[0122] t represents the user serial number, z represents a random integer, h t represents the second hash solution expression of the tth user, a t , b t Represents the private key of the t-th user.
[0123] In a specific embodiment, the principle of signature verification is as follows:
[0124]
[0125] A privacy protection device for federated distillation learning based on ring signature, comprising:
[0126] Parameter generation module: The key generation center generates system public parameters and distributes corresponding identity identification and partial signature key pairs to several users;
[0127] Key generation module: Each user generates a corresponding complete key pair based on the received identity and partial signature key pair;
[0128] User selection module: select any user as the first user;
[0129] Training module: training the local model of the first user to obtain the training model of the first user in the current training round;
[0130] Termination judgment module: judge whether the termination condition is met; if it is met, generate the final model; if not, continue training;
[0131] Signature generation module: generates a signature of a training model of a current training round of a first user, and the first user sends the signature to a second user, where the second user is any one of the remaining users;
[0132] Legality verification module: The second user verifies whether the received signature is legal; if it is legal, the second user is used as the new first user and training continues; if it is illegal, a data warning is executed;
[0133] Final model generation module: takes the training model of the first user's current training round as the final model;
[0134] Data early warning module: perform data early warning.
[0135] The same or similar reference numerals correspond to the same or similar components;
[0136] The terms used in the drawings to describe positional relationships are only used for illustrative purposes and should not be construed as limiting this patent;
[0137] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.
Claims
1. A privacy protection method for federated distillation learning based on ring signature, characterized in that: include: S1: The key generation center generates system public parameters and distributes corresponding identity identification and partial signature key pairs to several users; S2: Each user generates a corresponding complete key pair based on the received identity and partial signature key pair; S3: select any user as the first user; S4: training the local model of the first user to obtain a training model of the first user in a current training round; S5: Determine whether the termination condition is met; If satisfied, execute step S8; If not satisfied, execute step S6; S6: Generate a signature of the training model of the current training round of the first user, and the first user sends the signature to the second user, where the second user is any one of the remaining users; S7: The second user verifies whether the received signature is legal; if it is legal, the second user is taken as the new first user and step S4 is executed; if it is illegal, step S9 is executed; S8: taking the training model of the current training round of the first user as the final model and ending the training; S9: Issue data warning and end training.
2. According to the method for privacy protection of federated distillation learning based on ring signature in claim 1, it is characterized in that: In step S1, the key generation center generates system public parameters and distributes corresponding identity identification and partial signature key pairs to several users, including: S101: The key generation center obtains security parameters and generates system public parameters and system master private key; S102: The key generation center generates an identity for each user, and generates a partial signature key pair for each user in combination with the system public parameters and the system master private key; each partial signature key pair is sent to the corresponding user.
3. According to the method for privacy protection of federated distillation learning based on ring signature in claim 2, it is characterized in that: In step S102, the formula for generating a partial signature key pair is as follows: b i =s·H1(ID i ) B i =b i ·Q In step S2, the formula for generating a complete key pair is as follows: A i =a i Q i represents the serial number, H1 represents the collision-resistant hash function, s represents the system master private key, ID i represents the identity of the i-th user, Q represents the system public parameter, a i represents the private parameters of the i-th user; The complete key pair of the i-th user consists of a public key and a private key, where the public key is A i , B i , the private key is a i 、b i .
4. According to the method for privacy protection of federated distillation learning based on ring signature in claim 1, it is characterized in that: In step S4, the training loss function is as follows: Among them, t represents the user serial number, l cls (f t+1 ; x, y) represents the loss of the model performing reasoning, l dist (g tea ,g stu ; x) represents the loss of knowledge distillation, f t represents the local model of the current training round of the first user, f t+1 represents the local model of the current training round of the second user, g stu represents the local model f of the current training round of the second user t+1 The feature extractor, g tea represents the local model f of the current training round of the first user t , x represents the local model f of the current training round of the second user t+1 The sample input, λ represents the hyperparameter that weighs knowledge distillation and local training, D t+1 represents the local model f of the current training round of the second user t+1 The input dataset y represents the local model f of the current training round of the second user. t+1 The reference output, n t+1 represents the local model f of the current training round of the second user t+1 The number of input samples in the input dataset.
5. According to the method for privacy protection of federated distillation learning based on ring signature in claim 4, it is characterized in that: The loss of the model performing inference is as follows: The loss of knowledge distillation is as follows: t represents the user serial number, g stu represents the local model f of the current training round of the second user t+1 The feature extractor, g tea represents the local model f of the current training round of the first user t The feature extractor, f t+1 represents the local model of the current training round of the second user, and x represents the local model of the current training round of the second user f t+1 The sample input of y represents the local model f of the current training round of the second user. t+1 The reference output, y i represents the local model f of the current training round of the second user t+1 The i-th sample input reference output, represents the local model f of the current training round of the second user t+1 The output of the i-th sample input, C represents the number of categories in the multi-classification task.
6. According to the method for privacy protection of federated distillation learning based on ring signature in claim 1, it is characterized in that: In step S6, generating a signature of the training model of the current training round of the first user includes: S601: The first user generates N-1 random numbers; calculates a hash value of each random number and a local model of the current training round of the first user; S602: Calculate a feature number and a feature check number according to each random number and a hash value of a local model of a current training round of the first user, the N-1 random numbers, a complete key pair of the first user, and the system public parameters; S603: Combine the N-1 random numbers, the local model of the current training round of the first user, the feature number and the feature check number to form a signature of the training model of the current training round of the first user.
7. According to claim 6, a method for protecting privacy in federated distillation learning based on ring signature, characterized in that: The formula for calculating the characteristic number is as follows: h i =H2(f t ,v i ) t represents the user serial number, i represents the serial number, H2 and H3 represent collision-resistant hash functions, z represents a random integer, Q represents the system public parameter, N represents the total number of users, and h i represents the ith second hash solution expression, A i , B i represents the public key of the ith user, v i represents the i-th random number, f t Represents the local model of the current training epoch for the first user.
8. According to the method for privacy protection of federated distillation learning based on ring signature in claim 1, it is characterized in that: In step S7, the formula for the second user to verify whether the received signature is legal is as follows: i represents the sequence number, v i represents the ith random number, H3 represents the anti-collision hash function, T represents the characteristic check number, Q represents the system public parameter, N represents the total number of users, and h i represents the ith second hash solution expression, A i , B i Represents the public key of the i-th user.
9. A method for protecting privacy in federated distillation learning based on ring signature according to any one of claims 6 to 8, characterized in that: The formula for calculating the characteristic check number is as follows: T=z-h t ·(a t +b t ) t represents the user serial number, z represents a random integer, h t represents the second hash solution expression of the tth user, a t 、b t Represents the private key of the t-th user.
10. A privacy protection device for federated distillation learning based on ring signature, applied to the protection method according to any one of claims 1 to 9, characterized in that: include: Parameter generation module: The key generation center generates system public parameters and distributes corresponding identity identification and partial signature key pairs to several users; Key generation module: Each user generates a corresponding complete key pair based on the received identity and partial signature key pair; User selection module: select any user as the first user; Training module: training the local model of the first user to obtain the training model of the first user in the current training round; Termination judgment module: judge whether the termination condition is met; If satisfied, the final model is generated; If not satisfied, continue training; Signature generation module: generates a signature of a training model of a current training round of a first user, and the first user sends the signature to a second user, where the second user is any one of the remaining users; Legitimacy verification module: The second user verifies whether the received signature is legitimate; if it is legitimate, the second user is taken as the new first user and training continues; If it is illegal, data warning will be executed; Final model generation module: takes the training model of the first user's current training round as the final model; Data early warning module: perform data early warning.