Federal learning method with privacy protection

Abstract

The invention discloses a federal learning method with privacy protection, and belongs to the technical field of federal learning. The problems that in an existing federal learning method, Byzantine attack affects model training, and a privacy disclosure risk exists in a client are solved. According to the method, the gradient parameters pass through the pseudo-random number generator, the correctness and integrity of the gradient parameters submitted by the participants are verified based on the generated random numbers, so that errors in the parameter transmission process are avoided, and whether the participants submit the gradient parameters repeatedly or not is checked through comparison. And the server judges the similarity of the verified gradient parameters based on the Mahalanobis distance so as to eliminate malicious gradient parameters. And the remaining gradient parameters are aggregated, and finally, an updated global model parameter is calculated by using a stochastic gradient descent algorithm. According to the method, the influence of the Byzantine attack on model training can be avoided, and the problem that the participant has a privacy disclosure risk is solved. The method can be applied to the field of federal learning.

Description

Technical Field

[0001] The present invention belongs to the technical field of federated learning, and in particular relates to a federated learning method with privacy protection. Background Art

[0002] In federated learning, model training often requires a large amount of data foundation. Joint model training can be achieved by sharing data or sharing model parameters. However, if the parameters are transmitted between the client and the server in plain text, the client's information may be leaked, and there is often a risk of privacy leakage. At the same time, in distributed systems, Byzantine attacks are always an unavoidable security problem. Byzantine attacks may be caused by errors in the process of client parameter transmission, transmission failures, malicious user nodes actively sharing wrong information, and free-riding clients using the previous round of training results when submitting parameters, which ultimately affects the convergence direction of the model and causes model training to fail.

[0003] In summary, in order to solve the problems of the impact of Byzantine attacks on model training and the risk of privacy leakage on the client, it is necessary to propose a robust federated learning method with privacy protection. Summary of the invention

[0004] The purpose of the present invention is to solve the problems that Byzantine attacks affect model training and the client has the risk of privacy leakage in the existing federated learning method, and propose a federated learning method with privacy protection.

[0005] The technical solution adopted by the present invention to solve the above technical problems is: a federated learning method with privacy protection, the method specifically comprising the following steps:

[0006] Step 1: The server generates a public key pk s and private key sk s The public-private key pair is composed and the public key is sent to each participant of federated learning;

[0007] The i-th participant P i Generated by the public key pk i and private key sk i The public and private key pairs are composed and the public key is sent to the server;

[0008] Step 2: After the tth round of training, the i-th participant P i The obtained gradient parameter is recorded as The i-th participant P i For the gradient parameter Perform randomization and obtain the processing results

[0009] The i-th participant Pi Using public key pk s For the gradient parameter Encrypt and get the encrypted ciphertext And the encrypted ciphertext Submit to the server;

[0010] The i-th participant P i Using the private key sk i right Encrypt and generate ciphertext And the encrypted ciphertext Submit to the server;

[0011] Step 3: The server uses the private key sk s Ciphertext Decrypt to get the gradient parameters Then the gradient parameter Processing to obtain Using public key pk i Ciphertext Decrypt to get

[0012] Compare and Are they equal? ​​If and If they are not equal, then the i-th participant P i The gradient parameter Invalid if and If they are equal, proceed to step 4;

[0013] Step 4: Stored in the server For comparison, l = 1, 2, ..., t-1, where is the i-th participant P i For the gradient parameter The randomization results are After the lth round of training, the i-th participant P i The gradient parameters obtained;

[0014] like and If they are not equal, then the i-th participant P i The obtained gradient parameters efficient;

[0015] like and If they are equal, then the i-th participant P i The obtained gradient parameters invalid;

[0016] Step 5: Eliminate the gradient parameters of potential malicious nodes from the valid gradient parameters obtained in step 4 based on the Mahalanobis distance, and then aggregate the remaining valid gradient parameters to obtain aggregated gradient parameters;

[0017] The aggregated gradient parameters are used to update the global model parameters, and the updated global model parameters are sent to each participant. Each participant updates the local model parameters according to the received global model parameters. Then, let t = t + 1, and each participant uses the local training data to perform the t + 1th round of training, and then returns to step 2 until the entire federated learning process is completed.

[0018] Furthermore, the server and the i-th participant P i Both use KeyGen to generate public and private key pairs;

[0019] The public key generated by the server is represented as pk s =(N s ,r s ), the private key generated by the server is represented as sk s =(p s ,q s ,d s );

[0020] Among them, N s =p s ×q s , p s and q s are all randomly selected prime numbers, φ(N s )=(p s -1)×(q s -1), randomly select r s Satisfy 0 <r s <φ(N s ) and gcd(r s ,φ(N s ))=1,gcd(r s ,φ(N s )) represents r s and φ(N s ), d s Satisfy s ×d s =1modφ(N s ), 1modφ(N s ) is 1 divided by φ(N s )

[0021] The i-th participant P i The generated public key is denoted as pki =(N i ,r i ), the private key generated by the server is represented as sk i =(p i ,q i ,d i );

[0022] Among them, N i =p i ×q i , p i and q i are all randomly selected prime numbers, φ(N i )=(p i -1)×(q i -1), randomly select r i Satisfy 0 <r i <φ(N i ) and gcd(r i ,φ(N i ))=1,d i Satisfy i ×d i =1modφ(N i ).

[0023] Furthermore, the i-th participant P i For the gradient parameter The processing uses a pseudo-random number generator, specifically:

[0024]

[0025] in, yes The PRG value obtained by the pseudo-random number generator.

[0026] Furthermore, the server stores the PRG value obtained after the gradient parameters obtained by each participant in each round of training pass through the pseudo-random number generator.

[0027] Furthermore, the gradient parameters of the potential malicious nodes are removed from the effective gradient parameters obtained in step 4 based on the Mahalanobis distance, specifically:

[0028] Step 51: Calculate the mean μ and covariance matrix Σ of the effective gradient parameters obtained in step 4;

[0029] Step 52: Calculate the i-th participant P according to the mean μ and covariance matrix Σ i The effective gradient parameter The corresponding Mahalanobis distance

[0030] Step 5.3: Set the threshold θ. If is greater than the threshold θ, then The corresponding participants are potential malicious nodes. is less than or equal to the threshold θ, then The corresponding parties are not potential malicious nodes;

[0031] Then, the gradient parameters of potential malicious nodes are removed from the valid gradient parameters obtained in step 4.

[0032] Furthermore, the specific process of step 51 is:

[0033]

[0034] Where N is the number of valid gradient parameters obtained in step 4, and the superscript T stands for transpose.

[0035] Furthermore, the specific process of step 52 is as follows:

[0036]

[0037] The superscript -1 represents the inverse of the matrix.

[0038] Furthermore, the threshold θ is:

[0039]

[0040] Furthermore, the remaining effective gradient parameters are aggregated to obtain aggregated gradient parameters; specifically:

[0041]

[0042] Among them, g t is the aggregated gradient parameter, τ is the number of participants corresponding to the remaining valid gradient parameters, |D i ∣ is the i-th participant P corresponding to the remaining valid gradient parameters i The amount of training data.

[0043] Furthermore, the method of updating the global model parameters by using the aggregated gradient parameters adopts the stochastic gradient descent algorithm, and the specific updating process is as follows:

[0044] ω t+1 =ω t -ηg t

[0045] Among them, ω t+1 Represents the global model parameters after the current training round update, ω t represents the global model parameters updated in the previous training round, and η represents the learning rate.

[0046] The beneficial effects of the present invention are:

[0047] The present invention passes the gradient parameters through a pseudo-random number generator, and then verifies the correctness and integrity of the gradient parameters submitted by the participants based on the generated random numbers, so as to avoid errors in the process of transmitting parameters, and to check whether the participants have repeatedly submitted gradient parameters by comparison. The server judges the similarity of the verified gradient parameters based on the Mahalanobis distance to exclude malicious gradient parameters. The remaining gradient parameters are then aggregated, and finally the updated global model parameters are calculated using the stochastic gradient descent algorithm. The method of the present invention can improve the recognition accuracy of Byzantine nodes by screening the gradient parameters, avoid the influence of Byzantine attacks on model training, and solve the problem of privacy leakage risk of the participants by encrypting the gradient parameters submitted by the participants. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flow chart of a federated learning method with privacy protection of the present invention. DETAILED DESCRIPTION

[0049] Specific implementation method 1: Combination Figure 1 The present embodiment describes a method for federated learning with privacy protection, and the method specifically includes the following steps:

[0050] Step 1: The server generates a public key pk s and private key sk s The public-private key pair is composed and the public key is sent to each participant of federated learning;

[0051] The i-th participant P i Generated by the public key pk i and private key sk i The public and private key pairs are composed, and the public key is sent to the server; each participant in the present invention is a client;

[0052] Step 2: After the tth round of training, the i-th participant P i The obtained gradient parameter is recorded as The i-th participant P i For the gradient parameter Perform randomization and obtain the processing results

[0053] The i-th participant P i Using public key pk s For the gradient parameter Encrypt and get the encrypted ciphertext And the encrypted ciphertext Submit to the server;

[0054] The i-th participant P i Using the private key sk i right Encrypt and generate ciphertext Right now And the encrypted ciphertext Submit to the server;

[0055] Step 3: The server uses the private key sk s Ciphertext Decrypt to get the gradient parameters Then use the same PRG algorithm as the participants to adjust the gradient parameters Processing to obtain Using public key pk i Ciphertext Decrypt it to get

[0056] Compare and Are they equal? ​​If and If they are not equal, then the i-th participant P i The gradient parameter Invalid if and If they are equal, proceed to step 4;

[0057] Step 4: Stored in the server For comparison, l = 1, 2, ..., t-1, where is the i-th participant P i For the gradient parameter The randomization results are After the lth round of training, the i-th participant P i The gradient parameters obtained;

[0058] like and If they are not equal, then the i-th participant P i The obtained gradient parameters efficient;

[0059] like and If they are equal, then the i-th participant P i The obtained gradient parameters invalid;

[0060] Step 5: Based on the Mahalanobis distance, the gradient parameters of potential malicious nodes are removed from the valid gradient parameters obtained in step 4 (i.e., the Byzantine nodes are identified and the gradient parameters of the Byzantine nodes are removed, and the gradient parameters of the Byzantine nodes are removed from the aggregation process of federated learning to avoid negative impact on the overall model), and then the remaining valid gradient parameters are aggregated to obtain the aggregated gradient parameters;

[0061] The aggregated gradient parameters are used to update the global model parameters, and the updated global model parameters are sent to each participant. Each participant updates the local model parameters according to the received global model parameters. Then, let t = t + 1, and each participant uses the local training data to perform the t + 1th round of training, and then returns to step 2 until the entire federated learning process is completed.

[0062] The present invention uses federated learning combined with privacy protection technology, and uses data encryption verification technology to establish a credible, privacy-safe training environment for federated learning. Encryption verification technology is used in the parameter interaction stage to ensure the protection of parameters in the interaction process and the correctness of the parameter transfer process. After the local training is completed, each participant uploads the local gradient parameters. After the gradient parameters are verified, the Mahalanobis distance is used to judge the quality of each gradient parameter. Unlike the classic Euclidean distance, the Mahalanobis distance takes into account the distribution characteristics of the data when making judgments, which can more effectively identify malicious participant models with different distribution characteristics, ensuring the correctness and reliability of model aggregation.

[0063] Specific implementation method 2: This implementation method is different from the specific implementation method 1 in that the server and the i-th participant P i Both use KeyGen to generate public and private key pairs;

[0064] The public key generated by the server is represented as pk s =(N s ,r s ), the private key generated by the server is represented as sk s =(p s ,q s ,d s );

[0065] Among them, N s =p s ×q s , p s and q s are all randomly selected prime numbers (and p s and q s are all prime numbers greater than 1024 bits), φ(N s )=(p s -1)×(q s -1), randomly select rs Satisfy 0 <r s <φ(N s ) and gcd(r s ,φ(N s ))=1,gcd(r s ,φ(N s )) represents r s and φ(N s ), d s Satisfy s ×d s =1modφ(N s ), 1modφ(N s ) is 1 divided by φ(N s )

[0066] The i-th participant P i The generated public key is denoted as pk i =(N i ,r i ), the private key generated by the server is represented as sk i =(p i ,q i ,d i );

[0067] Among them, N i =p i ×q i , p i and q i are all randomly selected prime numbers (and p i and q i are all prime numbers greater than 1024 bits), φ(N i )=(p i -1)×(q i -1), randomly select r i Satisfy 0 <r i <φ(N i ) and gcd(r i ,φ(N i ))=1,d i Satisfy i ×d i =1modφ(N i ).

[0068] The other steps and parameters are the same as those in the first embodiment.

[0069] Specific implementation method three: This implementation method is different from specific implementation methods one or two in that the i-th participant P i For the gradient parameter The processing is done using a pseudo-random number generator (PRG), specifically:

[0070]

[0071] in, yes The PRG value obtained by the pseudo-random number generator.

[0072] The other steps and parameters are the same as those in the first or second embodiment.

[0073] Specific implementation method four: This implementation method is different from any one of specific implementation methods one to three in that the server stores the PRG value obtained by each participant after the gradient parameters obtained in each round of training are passed through a pseudo-random number generator.

[0074] The other steps and parameters are the same as those in Specific Embodiments 1 to 3.

[0075] The PRG values ​​stored in the server can be used for secondary PRG value comparison. In the current training task, in order to prevent lazy participants from directly using the gradient parameters of the previous round, after the edge sequence completes the first PRG value comparison, the PRG value after the current round of training is used to retrieve the PRG value record of the local gradient parameter. After completing the traversal of the record, if there is no hit, it can be proved that the gradient parameter is valid.

[0076] Specific implementation method 5: This implementation method is different from any one of specific implementation methods 1 to 4 in that the gradient parameters for eliminating potential malicious nodes from the effective gradient parameters obtained in step 4 based on the Mahalanobis distance are specifically:

[0077] Step 51: Calculate the mean μ and covariance matrix Σ of the effective gradient parameters obtained in step 4;

[0078] Step 52: Calculate the i-th participant P according to the mean μ and covariance matrix Σ i The effective gradient parameter The corresponding Mahalanobis distance

[0079] Step 5.3: Set the threshold θ. If is greater than the threshold θ, then The corresponding participants are potential malicious nodes. is less than or equal to the threshold θ, then The corresponding parties are not potential malicious nodes;

[0080] Then, the gradient parameters of potential malicious nodes are removed from the valid gradient parameters obtained in step 4.

[0081] The other steps and parameters are the same as those in Specific Embodiments 1 to 4.

[0082] Specific implementation method 6: This implementation method is different from specific implementation methods 1 to 5 in that the specific process of step 51 is:

[0083]

[0084] Where N is the number of valid gradient parameters obtained in step 4 (i.e., the number of participants whose gradient parameters are valid), and the superscript T represents transposition.

[0085] The other steps and parameters are the same as those in Specific Implementation Methods 1 to 5.

[0086] Specific implementation method 7: This implementation method is different from specific implementation methods 1 to 6 in that the specific process of step 52 is as follows:

[0087]

[0088] The superscript -1 represents the inverse of the matrix.

[0089] The other steps and parameters are the same as those in Specific Embodiments 1 to 6.

[0090] Specific implementation eight: This implementation is different from any one of specific implementations one to seven in that the threshold value θ is:

[0091]

[0092] The other steps and parameters are the same as those in Specific Embodiments 1 to 7.

[0093] Nodes exceeding the threshold indicate that their updates are statistically significantly deviated from normal nodes, that is, nodes exceeding the threshold are regarded as potential malicious nodes. Potential malicious nodes may be nodes that have errors in the process of transmitting parameters and maliciously share erroneous information.

[0094] Specific implementation method 9: This implementation method is different from any one of specific implementation methods 1 to 8 in that the remaining effective gradient parameters are aggregated to obtain aggregated gradient parameters; specifically:

[0095]

[0096] Among them, g t is the aggregated gradient parameter, τ is the number of participants corresponding to the remaining valid gradient parameters, |D i ∣ is the i-th participant P corresponding to the remaining valid gradient parameters i The amount of training data.

[0097] The other steps and parameters are the same as those in Specific Embodiments 1 to 8.

[0098] Specific implementation method 10: This implementation method is different from the specific implementation methods 1 to 9 in that the use of aggregated gradient parameters to update the global model parameters adopts a stochastic gradient descent algorithm, and the specific updating process is:

[0099] ω t+1 =ω t -ηg t

[0100] Among them, ω t+1 Represents the global model parameters after the current training round update, ω t represents the global model parameters updated in the previous training round, and η represents the learning rate.

[0101] The other steps and parameters are the same as those in Specific Embodiments 1 to 9.

[0102] The above calculation examples of the present invention are only used to explain the calculation model and calculation process of the present invention in detail, and are not intended to limit the implementation methods of the present invention. For ordinary technicians in the relevant field, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the implementation methods here. All obvious changes or modifications derived from the technical solution of the present invention are still within the scope of protection of the present invention.

Claims

1. A privacy-preserving federated learning method, characterized in that: The method specifically comprises the following steps: Step 1: The server generates a public key pk s and private key sk s The public-private key pair is composed and the public key is sent to each participant of federated learning; The i-th participant P i Generated by the public key pk i and private key sk i The public and private key pairs are composed and the public key is sent to the server; Step 2: After the tth round of training, the i-th participant P i The obtained gradient parameter is recorded as The i-th participant P i For the gradient parameter Perform randomization and obtain the processing results The i-th participant P i Using public key pk s For the gradient parameter Encrypt and get the encrypted ciphertext And the encrypted ciphertext Submit to the server; The i-th participant P i Using the private key sk i right Encrypt and generate ciphertext And the encrypted ciphertext Submit to the server; Step 3: The server uses the private key sk s Ciphertext Decrypt to get the gradient parameters Then the gradient parameter Processing to obtain Using public key pk i Ciphertext Decrypt to get Compare and Are they equal? ​​If and If they are not equal, then the i-th participant P i The gradient parameter Invalid if and If they are equal, proceed to step 4; Step 4: Stored in the server For comparison, l = 1, 2, ..., t-1, where is the i-th participant P i For the gradient parameter The randomization results are After the lth round of training, the i-th participant P i The gradient parameters obtained; like and If they are not equal, then the i-th participant P i The obtained gradient parameters efficient; like and If they are equal, then the i-th participant P i The obtained gradient parameters invalid; Step 5: Eliminate the gradient parameters of potential malicious nodes from the valid gradient parameters obtained in step 4 based on the Mahalanobis distance, and then aggregate the remaining valid gradient parameters to obtain aggregated gradient parameters; The aggregated gradient parameters are used to update the global model parameters, and the updated global model parameters are sent to each participant. Each participant updates the local model parameters according to the received global model parameters. Then, let t = t + 1, and each participant uses the local training data to perform the t + 1th round of training, and then returns to step 2 until the entire federated learning process is completed.

2. A method for federated learning with privacy protection according to claim 1, characterized in that: The server and the i-th participant P i Both use KeyGen to generate public and private key pairs; Denote the public key generated by the server as pk s =(N s ,r s ), the private key generated by the server is represented as sk s =(p s ,q s ,d s ); Among them, N s =p s ×q s , p s and q s are all randomly selected prime numbers, φ(N s )=(p s -1)×(q s -1), randomly select r s Satisfy 0 <r s <φ(N s ) and gcd(r s ,φ(N s ))=1,gcd(r s ,φ(N s )) represents r s and φ(N s ), d s Satisfy s ×d s =1modφ(N s ), 1modφ(N s ) is 1 divided by φ(N s ) The i-th participant P i The generated public key is denoted as pk i =(N i ,r i ), the private key generated by the server is represented as sk i =(p i ,q i ,d i ); Among them, N i =p i ×q i , p i and q i are all randomly selected prime numbers, φ(N i )=(p i -1)×(q i -1), randomly select r i Satisfy 0 <r i <φ(N i ) and gcd(r i ,φ(N i ))=1,d i Satisfy i ×d i =1modφ(N i ).

3. A method for federated learning with privacy protection according to claim 2, characterized in that: The i-th participant P i For the gradient parameter The processing uses a pseudo-random number generator, specifically: in, yes The PRG value obtained by the pseudo-random number generator.

4. A method for federated learning with privacy protection according to claim 3, characterized in that: The server stores the PRG values ​​obtained by each participant in each round of training after the gradient parameters are passed through the pseudo-random number generator.

5. A method for federated learning with privacy protection according to claim 4, characterized in that: The gradient parameters for eliminating potential malicious nodes from the effective gradient parameters obtained in step 4 based on the Mahalanobis distance are specifically: Step 51: Calculate the mean μ and covariance matrix Σ of the effective gradient parameters obtained in step 4; Step 52: Calculate the i-th participant P according to the mean μ and covariance matrix Σ i The effective gradient parameter The corresponding Mahalanobis distance Step 5.3: Set the threshold θ. If is greater than the threshold θ, then The corresponding participants are potential malicious nodes. is less than or equal to the threshold θ, then The corresponding parties are not potential malicious nodes; Then, the gradient parameters of potential malicious nodes are removed from the valid gradient parameters obtained in step 4.

6. A method for federated learning with privacy protection according to claim 5, characterized in that: The specific process of step 51 is: Where N is the number of valid gradient parameters obtained in step 4, and the superscript T stands for transpose.

7. A method for federated learning with privacy protection according to claim 6, characterized in that: The specific process of step 52 is as follows: The superscript -1 represents the inverse of the matrix.

8. A method for federated learning with privacy protection according to claim 7, characterized in that: The threshold value θ is:

9. The method for privacy-preserving federated learning according to claim 8, characterized in that: The remaining effective gradient parameters are aggregated to obtain aggregated gradient parameters; specifically: Among them, g t is the aggregated gradient parameter, τ is the number of participants corresponding to the remaining valid gradient parameters, |D i ∣ is the i-th participant P corresponding to the remaining valid gradient parameters i The amount of training data.

10. A method for federated learning with privacy protection according to claim 9, characterized in that: The method of updating the global model parameters by using the aggregated gradient parameters adopts the stochastic gradient descent algorithm, and the specific updating process is as follows: oh t+1 =ω t -ηg t Among them, ω t+1 Represents the global model parameters after the current training round update, ω t represents the global model parameters updated in the previous training round, and η represents the learning rate.

Images