Personalized privacy protection longitudinal federated learning system based on lattice

Abstract

The invention discloses a lattice-based personalized privacy protection longitudinal federated learning system, belongs to the field of artificial intelligence, and relates to personalization and privacy protection of federated learning in the field of artificial intelligence. The method mainly comprises the steps of system design, establishment of a personalized longitudinal joint learning framework, selection of a personalized federal learning algorithm, data alignment and how to realize lattice-based privacy protection aggregation. On one hand, a personalized longitudinal federated architecture (pFedPQA) is constructed through a PFL algorithm, and meanwhile, the security of interactive data is ensured by using a matrix mask. And on the other hand, in consideration of rapid development of quantum computers in recent years, an original privacy protection aggregation protocol is improved by utilizing a lattice-based encryption method, a lattice-based post-quantum privacy protection aggregation protocol (PQLA) is designed, and the security of the system is improved.

Description

Technical Field

[0001] The present invention relates to a grid-based personalized privacy-preserving vertical federated learning system, which belongs to the field of artificial intelligence, and in particular to solving data heterogeneity and privacy issues in traditional processing. Background Art

[0002] With the advent of artificial intelligence (AI), various machine learning (ML) and deep learning (DL) methods are being widely used in media, entertainment, industry, healthcare and other fields. However, since modern DL models usually have millions or even more parameters, a large amount of management data is usually required to train such data-rich models. Therefore, seeking cooperation among institutions to jointly generate data and train a joint model has become an ideal solution. In centralized training, the server needs to collect data from all collaborators. Then, the model will be trained on the server. However, this strategy leads to concerns related to data security and privacy. Since the data is usually highly sensitive and strictly regulated, it is difficult to obtain and share these data in reality. Federated learning (FL) is proposed as a learning paradigm that aims to solve data governance and privacy issues by collaboratively training models without sharing the data itself. In essence, federated learning is a distributed learning architecture with privacy-preserving properties. It breaks the constraints of privacy data on the acquisition of intelligent models, and it makes data available but invisible. Federated learning has entered the field of traffic control and provides a personalized framework for network traffic flow anomaly detection. In addition, federated learning is widely used in smart healthcare, which unites decentralized medical data with privacy protection. At the same time, federated learning can be applied to industrial IoT scenarios to obtain high-precision models. Finally, federated learning can also detect malicious nodes in the IoT, ensuring the safe and reliable operation of the IoT system.

[0003] Federated learning is a machine learning model in which multiple parties participate in joint computing. In this configuration there is a group of users and a central server. In federated learning, the central server has a global model that has been trained over many learning cycles. In a round of learning, the global model is first provided to all users. Then, the user updates the local model with the global model, trains the local model with local data, and sends the model gradient back to the central server for aggregation, a process called secure aggregation. Although each user can train a model with his own data alone, each user's independently trained model may not generalize well to other users' data or new samples. In recent years, quantum computers have developed rapidly, and different quantum computing algorithms, such as Shor's algorithm, have been able to pose a major threat to some mathematical problems, such as large integer factorization and discrete logarithm problems. The implementation of quantum cryptography mainly includes the following four methods: hash-based, code-based, multivariate-based, and lattice-based. The representative cryptographic algorithms of these four methods are Merkle hash tree signature, McEliece, Rainbow, and NTRU series, respectively. In federated learning, aggregation based on homomorphic encryption is simpler to implement than aggregation based on shielding. To aggregate users’ vectors, they only need to encrypt them using a homomorphic encryption system and send them to the server. Due to the additive homomorphism of homomorphic encryption, aggregation can be done by directly adding and decrypting ciphertexts. In this paper, we chose lattice-based encryption techniques to create a post-quantum privacy-preserving aggregation protocol because they are faster in computation, reduce communication costs, and can be used to build a variety of cryptographic applications.

[0004] In view of the personalized privacy protection needs of the above-mentioned federated learning in the field of artificial intelligence applications, as well as the security issues faced by model gradients during the learning process, this paper proposes a lattice-based personalized privacy protection vertical federated learning system. In order to apply FL to private data, we use the personalized federated learning (PerFedAvg) framework, and then propose a post-quantum privacy protection aggregation protocol based on quantum attack based on double-masked MPC (multi-party computing) and lattice cryptography scheme to avoid the leakage of gradient information in the model, thereby achieving personalization and privacy protection in the federated scenario. Summary of the invention

[0005] The main content of the present invention is a grid-based personalized privacy-preserving vertical federated learning system, which mainly includes system design, framework construction, algorithm design and implementation of a grid-based privacy-preserving aggregation protocol.

[0006] The technical solution steps adopted by the present invention are as follows

[0007] Step S1: system design;

[0008] Step S2: Building a personalized vertical joint learning framework;

[0009] Step S3: Select a personalized federated learning algorithm;

[0010] Step S4: data alignment;

[0011] Step S5: Implementing grid-based privacy-preserving aggregation;

[0012] In the above technical solution, in step S1, the model design consists of two main modules as the training framework: a personalized longitudinal federated learning framework (Per-FedAvg) and a lattice-based privacy-preserving aggregation (PQLA) module. In each round of global training, the server broadcasts the server model to each user for initialization. Then, each user trains the local model using local private data. After completing the local training, each user will calculate the gradient between the local model and the server model and execute the PQLA mechanism.

[0013] In the above technical solution, in step S2, a personalized longitudinal joint learning framework is established on a dataset with the same sample space but different feature spaces. Now assume that there are participants A, B, and a third party C. A and B cannot exchange data directly. C is semi-honest. C collects intermediate results to calculate gradients and losses, and then forwards the results to A and B.

[0014] In the above technical solution, in step S3, the optimization goal of the Per-FedAvg algorithm is to find a good initialization

[0015]

[0016] where α (α ≥ 0) is the step size.

[0017] For each generation of training k, the server will broadcast the server model to all users. Then, all users will train their local models with τ local training. After τ local training, the server will broadcast the server model to all users according to user u. i generate

[0018] in β is the local learning rate, and yes The estimated value of .

[0019] In the above technical solution, in step S4, the first step of training the model is to identify the dataset. pFedPQA uses encrypted entities to align the data. The datasets from A and B are aligned with a virtually connected dataset X with the same sample distribution but different feature distribution.

[0020] In the above technical solution, in step S5, we refer to the lattice-based post-quantum privacy-preserving aggregation as PQLA. The goal is to allow the central server to calculate the sum of gradients without knowing any information about the gradients of local training. Our federated learning protocol involves a central server and n clients. During the execution of the protocol, the gradient sent by each client ui to the server is represented as the input vector x i For convenience, we assume that each client has a set of keys based on the same public key infrastructure, and we assume that the user generates two pairs of keys based on the LWE key agreement. When user u needs to calculate the masking vector based on the LWE key agreement, if his ID is higher than user v, he will use the public key pk′ received from another user v v The specific algorithm steps are as follows:

[0021] Step S501: key generation and message sending;

[0022] User A generates two sets of keys: each set contains a public key An encrypted public key and a private key The user then uses his or her private key to generate a signature, which is an encrypted hash value of the user's public key and other information. The user then sends the public key, encrypted public key, random number, and signature to the server. Finally, the server broadcasts the collected information to all users.

[0023] Step S502: receiving a message and sharing a key;

[0024] The user receives the message broadcast by the server and ensures that the number of participating users is greater than or equal to t. And verify each signature received. Then the user generates a random seed for the subsequent encryption process. The user calculates and uses the key sharing algorithm (SS.share) to share the key and seed with other users. Then the user encrypts the message with each other user using the shared key to generate the ciphertext. Here, the symmetric encryption algorithm (AE) and the key extraction function (KA.extract) are used. The user sends the encrypted message, the check field, and another set of check fields to the server. The server collects messages from at least t users and forwards them to other users.

[0025] Step S503: decryption and calculation;

[0026] The user receives a new message from the server and confirms that the number of users received meets the requirement (at least t). The user extracts the key based on the number relationship with other users and the KA key extraction algorithm. If the number of user u is greater than that of other users v, user u extracts a key; if the number of user u is less than v, the check field is used to calculate the key. The user calculates the parameters between other users. The user sends the calculated parameters to the server. The server collects information from at least t users, forms a new user list, and broadcasts it to all users.

[0027] Step S504: signature verification;

[0028] The user receives the server's user list and ensures that the number of participating users meets the requirement. Then a new signature is calculated and sent to the server. The server collects signatures from at least t users and broadcasts them to all other users.

[0029] Step S505: decrypt and reconstruct information;

[0030] The user receives signatures from other users and verifies the validity of these signatures. The user then uses the extracted key to decrypt the information from other users. The user sends the decrypted information and key to the server. After the server collects enough information, it is able to reconstruct the user's private key and other related data and calculate the final parameters between the participating users and integrate this information.

[0031] In summary, to solve the problems of data heterogeneity and privacy, we proposed a lattice-based personalized privacy-preserving longitudinal federated learning system for personalized and privacy-preserving data analysis. Specifically, we set up clients for different heterogeneous data and train a personalized U-net model for each client at the same time, and each model can be regarded as learning a different data distribution. The present invention is specifically aimed at scenarios where the original data should not be shared with any third party, the existing DL model should not be structurally modified, and heterogeneous data. We tried to improve the original privacy-preserving aggregation protocol using lattice-based encryption methods, encountered and solved several adaptive problems, and finally proposed a secure aggregation protocol with anti-quantum attack capabilities. For the first time, personalization and privacy protection were discussed simultaneously in a federated scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 :The overall structure diagram of the grid-based personalized privacy protection vertical federated learning system

[0033] Figure 2 :Dataset distribution map of vertical federated learning

[0034] Figure 3:Graph of the training process of the vertical federation model

[0035] Figure 4 :Data alignment diagram DETAILED DESCRIPTION

[0036] The present invention will be explained and described below in conjunction with the accompanying drawings:

[0037] In order to make the purpose, technical solution and features of the present invention clearer, the present invention will be further refined and explained in conjunction with the accompanying drawings. Figure 1 shown.

[0038] This paper designs a grid-based personalized privacy-preserving vertical federated learning system, and simultaneously discusses the personalization and privacy protection of data in a federated scenario.

[0039] The technical solution steps adopted by the present invention are as follows

[0040] Step S1: system design;

[0041] Step S2: Building a personalized vertical joint learning framework;

[0042] Step S3: Select a personalized federated learning algorithm;

[0043] Step S4: data alignment;

[0044] Step S5: Implementing grid-based privacy-preserving aggregation;

[0045] In the above technical solution, in step S1, the grid-based personalized privacy-preserving longitudinal federated learning system (pFedPQA) consists of two main modules as a training framework: PFL and PQLA modules. In each round of global training, the server broadcasts the server model to each user for initialization. Then, each user trains the local model with local private data. After completing the local training, each user will calculate the gradient between the local model and the server model. In order to avoid sending the user's gradient directly to the server, which may cause potential privacy leakage, pFedPQA transfers the gradient aggregation process originally performed on the server to a loop consisting of all users in a decentralized manner. At the end of each global training, the PQLA mechanism will be executed. The user in the loop will be randomly selected as the initiator, who will protect his own gradient by adding a random mask as noise to the gradient, encrypt the noisy gradient with PQLA, and transmit the noisy gradient to the loop for further aggregation. The noise in the aggregated gradient is maintained until the execution of the PQLA mechanism ends. pFedPQA achieves secure gradient aggregation through double-masked multi-party computation and lattice cryptography schemes, so that each user can confidently aggregate his own gradient into the transmitted gradient without worrying about privacy issues.

[0046] In the above technical solution, in step S2, the personalized vertical federated learning framework is established on the datasets with the same sample space but different feature spaces. In the vertical federation scenario, the samples in the datasets overlap, but the features of the samples in the datasets are different, such as Figure 2 shown.

[0047] The training process of the vertical federation model is as follows Figure 3 As shown. The data privacy of participants A and B must be preserved, so A and B cannot exchange data directly. To ensure data privacy, the model includes a third party C. C is semi-honest and helps participants to conduct secure longitudinal federated learning. C collects intermediate results to calculate gradients and losses, and then forwards the results to A and BC. The information received from the participants is encrypted or obfuscated so that the original data of the participants is not exposed to C.

[0048] In addition, participants only receive model parameters related to their own features. Operation 1 represents a semi-honest third party that issues a key, operation 2 is the exchange of intermediate results, operation 3 represents the calculation of gradients and losses, and operation 4 is the update of the model.

[0049] In the above technical solution, in step S3, in order to achieve personalized FL, the personalized federated learning algorithm (Per-FedAvg algorithm) obtains the optimal initial model (meta-model) as the server model, which can be easily adapted to local heterogeneous data with just a few steps of gradient descent. Per-FedAvg is inspired by the basic idea of ​​the model-agnostic meta-learning (MAML) framework. Given a set of tasks from different underlying distributions, MAML tends to find a model that generalizes all tasks to FL, but finds a meta-model that can perform better in different tasks after a few steps of local gradient descent.

[0050] In FL, the optimization goal is to minimize where f i For user u i According to the concept of MAML, the optimization goal is to find a good initialization

[0051]

[0052] where α (α ≥ 0) is the step size.

[0053] As shown in Algorithm 1, for each generation of training k, the server will broadcast the server model to all users. Then, all users will train their local models with τ local training. After τ local training, the server will broadcast the server model to all users according to user u. i generate

[0054] in β is the local learning rate, and yes The estimated value of .

[0055] In this study, we proposed a model training method based on user participation. We set the number of global training to K, the number of local training to τ, the number of users to N, and the number of final adaptive training to γ. The parameters of the server model in the kth global training are represented by x k , and user u i The parameters for local training at the tth time and global training at the kth time are expressed as

[0056] The specific process is as follows: After the system starts, the server first sets the current model parameter x k Send to all users i (i=0, ..., N-1). Each user sets the global model parameters to Then, user u i The local training will be performed τ times. The specific steps are as follows: In each local training, the user uses his local dataset D iCalculate the stochastic gradient, expressed as Next, the user updates the parameters to The user then calculates the local update parameter using the following formula:

[0057]

[0058] User i (i=0, ..., N-1) Compute the gradient update compared to the server Afterwards, the user performs a cyclic secure aggregation using the PQLA method to preserve privacy (users (u0, ..., u N-1 )). Initiatoru I Send security aggregate updates to servers The server updates its model parameters by averaging the received gradients as follows:

[0059]

[0060] Finally, the server broadcasts the updated metamodel to all users. i (i=0, ..., N-1) will use its local private data to make γ adjustments to optimize the meta-model.

[0061] In the above technical solution, in step S4, the first step of training the model is to identify the dataset. pFedPQA uses encrypted entities to align the data. The datasets from A and B are aligned with a virtually connected dataset X with the same sample distribution but different feature distribution, such as Figure 4 shown.

[0062] In the above technical solution, for step S5, in many federated learning applications, participants may come from different companies or institutions, some of which may even have competing interests. This creates an incentive to obtain data from other participants. For these reasons, we consider two threat models, namely the semi-honest model and the malicious model. In the semi-honest model, the adversary will execute the protocol normally, but will try to infer the data of honest participants. In the malicious model, the adversary not only tries to infer information from other clients, but may also collude and send false messages.

[0063] We call our privacy-preserving aggregation PQLA (lattice-based post-quantum privacy-preserving aggregation). The goal is to have a central server compute the sum of gradients without knowing any information about the gradients of the local training.

[0064] Our federated learning protocol involves a central server and n clients. During the protocol execution, each client u i The gradient sent to the server is represented as the input vector xi . Assume that there is a time limit for communication between the central server and the client. If the client's communication times out, the server will regard it as a quit. For convenience, we assume that each client has a set of keys based on the same public key infrastructure, and we assume that the user generates two pairs of keys based on the LWE key agreement. When user u needs to calculate the masking vector based on the LWE key agreement, if his ID is higher than user v, he will use the public key pk′ received from another user v v . In this way, users can use the key agreement result obtained by the key group as the responder to encrypt in the first round of communication, and use the key agreement result obtained by the key group as the initiator to mask private data in the second round of communication. Therefore, aggregation can be achieved without affecting the communication cycle or security of the protocol while applying the same procedure for all users. Based on the double-masked multi-party computation (MPC) and lattice cryptography scheme, we propose the following specific method:

[0065] Step S501: key generation and message sending

[0066] 1. User key generation:

[0067] User A generates two sets of keys: each set contains a public key An encrypted public key and a private key

[0068] These keys are used to encrypt and decrypt messages, ensuring that only authorized users can access sensitive information.

[0069] 2. Calculate the signature:

[0070] The user uses his or her private key to generate a signature, which is an encrypted hash value containing the user's public key and other information.

[0071] By signing, users can ensure that the data has not been tampered with and confirm the identity of the sender of the information.

[0072] 3. Send information to the server:

[0073] The user sends the following to the server: the user's public key, the encrypted public key, the random number, and the signature

[0074] 4. Server collects messages:

[0075] The server collects messages from at least t users to ensure data integrity and redundancy.

[0076] The information collected will be broadcast to all users so that users can learn about other users who have participated.

[0077] Step S502: receiving message and key sharing

[0078] 1. Receive server message:

[0079] The user receives the message broadcast by the server, ensuring that the number of participating users is greater than or equal to t.

[0080] The user verifies each signature received to ensure the authenticity of the information.

[0081] 2. Generate a random seed:

[0082] The user generates a random seed for subsequent encryption processes, which provides additional randomness for key distribution.

[0083] 3. Key Sharing:

[0084] The user calculates and shares the key and seed with other users using the key sharing algorithm (SS.share)

[0085] This step allows the user to distribute parts of the private key to participants.

[0086] 4. Encrypted information:

[0087] The user uses the shared key to encrypt the message for each other user to generate the ciphertext. Here, the symmetric encryption algorithm (AE) and the key extraction function (KA.extract) are used.

[0088] 5. Send encrypted information:

[0089] The user sends the encrypted message, the check field, and another set of check fields to the server.

[0090] 6. The server collects messages again:

[0091] The server collects messages from at least t users and forwards these messages to other users, ensuring that all users have the latest information.

[0092] Step S503: Decryption and calculation

[0093] 1. Receive new messages:

[0094] The user receives the new message from the server and confirms that the number of users received meets the requirement (at least t). This step ensures that all participants are valid.

[0095] 2. Key extraction and calculation parameters:

[0096] The user extracts the key based on the number relationship with other users and the KA key extraction algorithm. If the number of user u is greater than that of other user v, user u extracts a key; if the number of user u is less than v, the check field is used to calculate the key. This process ensures that keys can be effectively shared between different users.

[0097] 3. Calculation parameters:

[0098] Users calculate parameters between other users, which are related to their relationships and are used for subsequent data calculations.

[0099] 4. Send calculation results:

[0100] The user sends the calculated parameters to the server so that the server can track the status and information of participating users.

[0101] 5. Server collects information:

[0102] The server collects information from at least t users, forms a new user list, and broadcasts it to all users. In this way, each user can understand the other users who participated.

[0103] Step S504: Signature verification

[0104] 1. Receive user list:

[0105] The user receives the user list from the server and ensures that the number of participating users meets the requirement (at least t).

[0106] 2. Calculate the new signature:

[0107] The user calculates a new signature and sends it to the server. This signature confirms the user's identity and ensures the credibility of the information.

[0108] 3. Server collects signatures:

[0109] The server collects signatures from at least t users and broadcasts these signatures to all other users, ensuring the consistency and reliability of the information.

[0110] Step S505: Decrypt and reconstruct information

[0111] 1. Receive signature:

[0112] Users receive signatures from other users and verify the validity of those signatures, ensuring that all information is authentic.

[0113] 2. Decrypt other users’ information:

[0114] The user uses the extracted key to decrypt the information from other users. This process ensures that the user can access the encrypted data shared by other users.

[0115] 3. Send decryption results:

[0116] The user sends the decrypted information and key to the server. This information includes the key between users and other important data.

[0117] 4. Server reconstruction information:

[0118] After the server has collected enough information, it is able to reconstruct the user's private key and other relevant data. It also calculates the final parameters between the participating users and integrates this information.

[0119] In summary, to solve the problems of data heterogeneity and privacy, we proposed a lattice-based personalized privacy-preserving longitudinal federated learning system for personalized and privacy-preserving data analysis. Specifically, we set up clients for different heterogeneous data and train a personalized U-net model for each client at the same time, and each model can be regarded as learning a different data distribution. The present invention is specifically aimed at scenarios where the original data should not be shared with any third party, the existing DL model should not be structurally modified, and heterogeneous data. We tried to improve the original privacy-preserving aggregation protocol using lattice-based encryption methods, encountered and solved several adaptive problems, and finally proposed a secure aggregation protocol with anti-quantum attack capabilities. For the first time, personalization and privacy protection were discussed simultaneously in a federated scenario.

Claims

1. A personalized privacy-preserving vertical federated learning system based on lattice, characterized in that: The implementation steps of this method are as follows: Step S1: system design; Step S2: Building a personalized vertical joint learning framework; Step S3: Select a personalized federated learning algorithm; Step S4: data alignment; Step S5: Implementing grid-based privacy-preserving aggregation.

2. A lattice-based personalized privacy-preserving vertical federated learning system as claimed in claim 1, characterized in that: In step S1, the grid-based personalized privacy-preserving longitudinal federated learning system (pFedPQA) consists of two main parts as a training framework: a personalized longitudinal federated learning framework (Per-FedAvg) and a grid-based privacy-preserving aggregation (PQLA) module. In each round of global training, the server broadcasts the server model to each user for initialization. Then, each user trains the local model with local private data. After completing the local training, each user will calculate the gradient between the local model and the server model. In order to avoid sending the user's gradient directly to the server, which may lead to potential privacy leakage, pFedPQA transfers the gradient aggregation process originally performed on the server to a loop consisting of all users in a decentralized manner. At the end of each global training, the PQLA mechanism will be executed. The user in the loop will be randomly selected as the initiator, who will protect his own gradient by adding a random mask as noise to the gradient, encrypt the noisy gradient with PQLA, and transmit the noisy gradient to the loop for further aggregation. The noise in the aggregated gradient is kept until the execution of the PQLA mechanism ends.

3. A grid-based personalized privacy-preserving vertical federated learning system according to claim 1, characterized in that: In step S2, the personalized longitudinal federated learning framework is built on a dataset with the same sample space but different feature spaces. In the longitudinal federation scenario, there is overlap in the samples in the dataset, but the characteristics of the samples in the dataset are different. During the training of the longitudinal federation model, it is assumed that there are participants A and B. The data privacy of participants A and B must be retained, so A and B cannot exchange data directly. In order to ensure data privacy, the model includes a third party C: C is semi-honest and helps participants to conduct secure longitudinal federated learning. C collects intermediate results to calculate gradients and losses, and then forwards the results to A and B. C receives encrypted or obfuscated information from participants so as not to expose the original data C of the participants. In addition, participants only receive model parameters related to their own characteristics.

4. A grid-based personalized privacy-preserving vertical federated learning system according to claim 1, characterized in that: In step S3, in order to achieve personalized FL, the personalized federated learning algorithm (Per-FedAvg algorithm) obtains the optimal initial model as the server model, which can be easily adapted to local heterogeneous data by only a few steps of gradient descent. In FL, the optimization goal is to minimize where f i For user u i The loss function of the Per-FedAvg algorithm is to find a good initialization: Where α (α ≥ 0) is the step size. Based on this, we propose a model training method based on user participation, setting the number of global training to K, the number of local training to τ, the number of users to N, and the number of final adaptive training to γ. The parameter of the server model in the kth global training is represented by x k , and user u i The parameters for local training at the tth time and global training at the kth time are expressed as The specific process is as follows: After the system starts, the server first sets the current model parameters x k Send to all users i (i=0, ..., N-1), each user sets the global model parameters to Then, user u i The local training will be performed τ times. The specific steps are as follows: In each local training, the user uses his local dataset D i Calculate the stochastic gradient, expressed as Next, the user updates the parameters to The user then calculates the local update parameter using the following formula: u i (i=0, ..., N-1) Compute the gradient update compared to the server Afterwards, the user performs a cyclic secure aggregation using the PQLA method to preserve privacy (users (u0, ..., u N-1 )), Initiator u I Send security aggregate updates to servers The server updates its model parameters by averaging the received gradients as follows: Finally, the server broadcasts the updated metamodel to all users, after which user u i (i=0, ..., N-1) will use its local private data to make γ adjustments to optimize the meta-model.

5. A grid-based personalized privacy-preserving vertical federated learning system according to claim 1, characterized in that: In step S4, the first step of training the model is to identify the dataset. pFedPQA utilizes the encrypted entities to align the data. The datasets from A and B are aligned with a virtually connected dataset X with the same sample distribution but different feature distribution.

6. A grid-based personalized privacy-preserving vertical federated learning system according to claim 1, characterized in that: In step S5, we consider two threat models, namely the semi-honest model and the malicious model. In the semi-honest model, the adversary will execute the protocol normally but will try to infer the data of the honest participants. In the malicious model, the adversary not only tries to infer information from other clients, but may also collude and send false messages. We call the lattice-based post-quantum privacy-preserving aggregation PQLA. The goal is to let the central server calculate the sum of gradients without knowing any information about the gradients of local training. Our federated learning protocol involves a central server and n clients. During the execution of the protocol, each client u i The gradient sent to the server is represented as the input vector x i , Assume that there is a time limit for the communication between the central server and the client. If the client's communication times out, the server will regard it as a quit. For convenience, we assume that each client has a set of keys based on the same public key infrastructure. We assume that the user generates two pairs of keys based on the LWE key agreement. When user u needs to calculate the masking vector based on the LWE key agreement, if his ID is higher than that of user υ, he will use the public key pk′ received from another user υ υ ,In this way, users can use the key agreement result obtained by the key group as the responder to encrypt in the first round of communication, and use the key agreement result obtained by the key group as the initiator to shield the private data in the second round of communication.,Therefore, aggregation can be achieved without affecting the communication cycle or security of the protocol, while applying the same procedure for all users.,Based on the double-masked multi-party computation (MPC) and lattice cryptography scheme, we propose the specific method as follows: Step S501: key generation and message sending 1) User key generation: User A generates two sets of keys: each set contains a public key An encrypted public key and a private key These keys are used to encrypt and decrypt messages, ensuring that only authorized users can access sensitive information; 2) Calculate the signature: The user uses his or her private key to generate a signature, which is an encrypted hash value containing the user's public key and other information; 3) Send information to the server: The user sends the following to the server: the user's public key, encrypted public key, random number, and signature; 4) Server collects messages: The server collects messages from at least t users to ensure data integrity and redundancy, and the collected information will be broadcast to all users; Step S502: receiving message and key sharing 1) Receive server message: The user receives the message broadcast by the server, ensures that the number of participating users is greater than or equal to t, and verifies each signature received; 2) Generate a random seed: The user generates a random seed for the subsequent encryption process, which provides additional randomness for key distribution; 3) Key Sharing: The user calculates and shares the key and seed with other users using the key sharing algorithm (SS.share). This step allows the user to distribute part of the private key to participants. 4) Encrypted information: The user encrypts the message with each other user using the shared key to generate the ciphertext. Here, the symmetric encryption algorithm (AE) and key extraction function (KA.extract) are used. 5) Send encrypted information: The user sends the encrypted message, the check field, and another set of check fields to the server. 6) The server collects messages again: The server collects messages from at least t users and forwards them to other users, ensuring that all users have the latest information; Step S503: Decryption and calculation 1) Receive new messages: The user receives the new message from the server and confirms that the number of users received meets the requirement (at least t); 2) Key extraction and calculation parameters: The user extracts the key based on the number relationship with other users and the KA key extraction algorithm. If the number of user u is greater than that of other user v, user u extracts a key; if the number of user u is less than v, the check field is used to calculate the key; 3) Calculation parameters: Users calculate parameters between other users, which are related to their relationships and are used for subsequent data calculations; 4) Send calculation results: The user sends the calculated parameters to the server so that the server can track the status and information of participating users; 5) Server collects information: The server collects information from at least t users, forms a new user list, and broadcasts it to all users; Step S504: Signature verification 1) Receive user list: The user receives the user list from the server and ensures that the number of participating users meets the requirement (at least t); 2) Calculate the new signature: The user calculates a new signature and sends it to the server; 3) Server collects signatures: The server collects signatures from at least t users and broadcasts these signatures to all other users; Step S505: Decrypt and reconstruct information 1) Receive signature: Users receive signatures from other users and verify the validity of those signatures; 2) Decrypt other users' information: The user uses the extracted key to decrypt messages from other users; 3) Send decryption result: The user sends the decrypted information and key to the server. This information includes the key between users and other important data. 4) Server reconstruction information: After the server collects enough information, it can reconstruct the user's private key and other relevant data. It will also calculate the final parameters between the participating users and integrate this information.

Images