Robust federated learning method and system for privacy protection based on secret sharing

Abstract

The invention relates to a privacy protection robust federated learning method and system based on secret sharing, and belongs to the technical field of privacy protection and robust aggregation. The specific process of the method is as follows: initial model distribution: a server distributes initialized global model parameters to each client; local model training: the client updates a local model by using the global model parameters, trains the local model by using a local data set, and sends the local model to the server through secret sharing after training and updating; and model aggregation distribution: the server receives local model update parameters from the client, performs clustering operation, and distributes global model parameters obtained by clustering to the client, and the client performs local model update according to a received result.

Description

Technical Field

[0001] The present invention relates to a robust federated learning method and system based on secret sharing and privacy protection, belonging to the technical field of privacy protection and robust aggregation. Background Art

[0002] Federated learning (FL) has emerged as a promising distributed machine learning paradigm, enabling multiple participants to jointly train machine learning models without sending data to a central server. In FL, participants compute model updates based on local data and a global model received from a coordination server and send the resulting updates to the coordination server. The server aggregates the received updates to obtain a new global model, which is redistributed among the participants. This collaboration is mutually beneficial for all parties. Since the training data does not leave the participants' devices, FL is a suitable choice for scenarios that process personal data, such as facial recognition, voice assistants, healthcare, next word prediction, or intrusion detection in IoT networks. Despite its promising prospects, FL is vulnerable to poisoning attacks due to its distributed nature. For example, a malicious client may adversarially manipulate the global model by poisoning its own training dataset or the local model gradients sent to the server, thereby corrupting the global model to make incorrect predictions. In addition, regarding privacy issues, some powerful privacy attacks show that the original training data can be reconstructed by reversing the updated gradients, that is, transmitting gradient data in plaintext may face the risk of privacy leakage.

[0003] Data privacy and resistance to poisoning attacks (Byzantine robustness) are two key issues in FL. Coordinating privacy and security is a challenge for FL. On the one hand, good updates sent by honest participants may leak their private local information, while poisonous updates sent by malicious participants may compromise the availability or integrity of the model. On the other hand, privacy protection mechanisms often make data difficult to distinguish, which can compromise security because it does not allow the server to filter out a single poisonous update. However, most existing FL aggregation schemes focus on robustness implementation and ignore privacy protection issues.

[0004] The development of privacy-preserving robust aggregation in federated learning faces the following challenges: First, if the privacy of client private information is protected through encryption and other technologies, the server cannot distinguish malicious data from it and cannot implement robust aggregation. Second, if malicious data is to be screened and filtered, the server needs to obtain real model updates, which may lead to the risk of privacy leakage in the client. Therefore, it is still challenging to perform robust aggregation in federated learning while protecting privacy. Summary of the invention

[0005] In view of this, the present invention is committed to solving the problem of balancing robust aggregation and privacy protection in the above-mentioned federated learning, and proposes a robust federated learning method and system with privacy protection based on secret sharing.

[0006] In order to achieve the above object, the present invention adopts the following technical scheme:

[0007] In the first aspect, the embodiment of the present application provides a robust federated learning method based on privacy protection of secret sharing. The system targeted by the method includes two types of entities, namely, a client and a server. The specific process is as follows:

[0008] Initial model distribution: The server distributes the initial global model parameters to each client;

[0009] Local model training: The client updates the local model using the global model parameters and trains the local model using the local dataset. After training and updating, the model is sent to the server through secret sharing.

[0010] Model aggregation and distribution: The server receives local model update parameters from the client, performs clustering operations, and distributes the global model parameters obtained by clustering to the client. The client updates the local model based on the received results.

[0011] Furthermore, the specific process of the local model training of the present invention is:

[0012] Step 2.1: Client i updates the local model using the global model parameters and trains the local model using the local dataset to obtain the model update parameters g i ;

[0013] Step 2.2: Calculate the model update parameter g i The regularization result of

[0014] Step 2.3: According to the arithmetic secret sharing rule, g i Split into Similarly, Split into Then share and Sent to the aggregation server S0 and the auxiliary server S1 respectively.

[0015] Furthermore, the present invention Where mod represents the modulus operation, l represents g i The number of bits.

[0016] Furthermore, the aggregation operation of the present invention is performed in an encrypted state, and the specific process includes:

[0017] Step 3.1: Aggregation server S0 and auxiliary server S1 calculate the model update parameter g sent by the two clients i ,g j The cosine distance cd between i,j , calculate the model update parameter g i ,g i The Euclidean distance between i,j ;

[0018] Step 3.2: Perform regularization check on the local model update parameters, and select the local model update parameters that pass the regularization check;

[0019] Step 3.3: Calculate clustering features using the cosine distance and Euclidean distance corresponding to the selected local model update parameters, perform clustering operations on the clustering features, and obtain a set C;

[0020] Step 3.4: Perform weighted aggregation on the model updates in set C to obtain the global model update g and update the global model.

[0021] Furthermore, the cosine distance cd in step 3.1 of the present invention is i,j The specific calculation process is:

[0022] First, server S0 calculates and Server S1 calculation and in, Represents the model update parameter g j The regularization result of and for The split result according to the secret sharing rule; u and v are random values, and is the split result of u according to the secret sharing rule, and is the split result of v according to the secret sharing rule;

[0023] Next, server S0 and server S1 exchange and You can restore

[0024] Again, server S1 computes locally And send the result to S0;

[0025] Finally, server S0 calculates After that, the secret reconstruction can get the model update g i ,g j The cosine similarity between i ,gj ) and then calculate the distance cd i,j ;

[0026] Furthermore, the Euclidean distance ed in step 3.1 of the present invention i,j The specific calculation process is:

[0027] First, server S0 calculates locally and Server S1 computes locally and

[0028] Next, server S0 and server S1 exchange and You can restore

[0029] Again, server S1 computes locally And send the result to S0;

[0030] Finally, server S0 calculates After that, the secret reconstruction can be obtained Then we get the model update g i ,g j The Euclidean distance between i,j .

[0031] Furthermore, the specific process of step 3.2 of the present invention is as follows:

[0032] Server S0 and server S1 hold their regularization results respectively. Share S0, S1 are based on arithmetic sharing calculation The result is then judged: If Then explain It is a legal regularization result. Only local model updates that pass the regularization check are retained and allowed to continue to participate in subsequent clustering operations, while those with illegal check results will be discarded.

[0033] Furthermore, the specific process of step 3.3 of the present invention is as follows:

[0034] Step 3.3.1: Update the Euclidean distance ed between the selected models i,j Perform the maximum value normalization to get ed′ i,j , and then calculate the comprehensive index d i,j =cd i,j +ed′ i,j Clustering features as local model updates;

[0035] Step 3.3.2: Use different clustering algorithms to cluster according to the proportion of malicious clients:

[0036] If the proportion of malicious clients is less than 50%, the HDBSCAN clustering algorithm is used for clustering, that is, C = HDBSCAN (d i,j );

[0037] If the proportion of malicious clients is greater than 50%, the agglomerative hierarchical clustering algorithm is used for clustering, that is, C = AHC (d i,j ).

[0038] Furthermore, the specific process of step 3.4 of the present invention is as follows:

[0039] Step 3.4.1: The comprehensive index d obtained in step 3.3.1 i,j Calculate model update g i Aggregation weight Where n is the number of model updates contained in the set C, i∈n;

[0040] Step 3.4.2: Based on the multiplication triple BT ( <z> , , <v>) for weighted aggregation, specifically:

[0041] The aggregate weight sc i Randomly split into Then they are sent to server S0 and server S1 respectively. In addition, the two servers also hold the model update g i Share Then calculate <g i > <sc i >, further calculate the global model update parameters

[0042] Step 3.4.3: Update the global model parameters w = w + α g, where α is the global learning rate.

[0043] In a second aspect, the present application provides a robust federated learning system based on secret sharing and privacy protection, including two entities: a client and a server;

[0044] The server is used to distribute the initialized global model parameters to each client, and to receive the local model update parameters from the client, perform clustering operations, and then distribute the clustered global model update parameters to the client;

[0045] The client, on the one hand, uses the global model parameters to update the local model, and uses the local data set to train the local model, and sends the local model update parameters to the server; on the other hand, it uses the global model parameters obtained by clustering to update the local model.

[0046] Beneficial Effects

[0047] The present invention relates to a robust federated learning system and method based on secret sharing and privacy protection, which has the following beneficial effects compared with the existing federated learning robust aggregation rules:

[0048] First, in order to resist Byzantine attacks in federated learning, it is necessary to know the client's local model update to filter out malicious data, but the client's data privacy is at risk of being leaked; if the client's model update is encrypted using technologies such as homomorphic encryption, it is inconvenient for the server to perform robust aggregation operations. Therefore, the present invention designs a robust federated learning method based on secret sharing for privacy protection, performs parameter processing based on arithmetic secret sharing rules to achieve privacy protection effects, and implements clustering operations through the calculation of clustering features, so that robust aggregation can be achieved while protecting client data privacy.

[0049] Second, the role of Euclidean distance is limited by the data dimension, and the effect of using a single indicator to judge whether the local model update is malicious is also limited. When performing the clustering operation, the present invention uses a comprehensive indicator obtained by combining cosine distance and Euclidean distance as the clustering feature of the model update, thereby achieving a better clustering effect.

[0050] Third, compared with the existing federated learning robust aggregation rules that can mostly only cope with the honest majority situation (generally based on the setting that the malicious clients account for 20%), the present invention uses two clustering algorithms, HDBSCAN and agglomerative hierarchical clustering, to perform clustering operations to cope with situations with different proportions of malicious clients. Therefore, it can maintain robustness well in both honest majority and malicious majority situations. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 This is a model diagram of a robust federated learning system based on secret sharing and privacy protection of the present invention;

[0053] Figure 2 It is a simulation result diagram of the system of the present invention on three data sets: MNIST, Fashion-MNIST, and HAR. DETAILED DESCRIPTION

[0054] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0055] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0056] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0057] This embodiment describes in detail a typical application process of a robust federated learning method based on secret sharing and privacy protection in the present invention; the system model used in this method is shown in FIG. Figure 1 . The embodiment of the present application is a privacy-preserving robust federated learning method based on secret sharing. There are two types of entities, including clients and servers. The clients have their own local private data, train local models on this data set, and send them to the server through secret sharing after updating to protect data privacy; the server receives the local model update share from the client and performs aggregation operations, obtains the global model update, and then distributes it to the client.

[0058] The present application embodiment provides a privacy-preserving robust federated learning method based on secret sharing. The system targeted by the method includes two types of entities, a client and a server. The specific process is as follows:

[0059] Initial model distribution: The server distributes the initial global model parameters to each client;

[0060] Local model training: The client updates the local model using the global model parameters and trains the local model using the local dataset. After training and updating, the model is sent to the server through secret sharing.

[0061] Model aggregation and distribution: The server receives local model update parameters from the client, performs clustering operations, and distributes the global model parameters obtained by clustering to the client. The client updates the local model based on the received results.

[0062] In this embodiment, it is assumed that the user wants to obtain the results of federated learning training, and the number of malicious clients participating in the training in the system exceeds the number of benign clients. In this embodiment, it is assumed that the total number of clients participating in the training in the system is 30, of which the number of malicious clients is 18, and the trained local model is used to identify benign clients and malicious clients. The specific process of the method of the present invention is described in detail below:

[0063] Step 1. Global model parameter distribution. The aggregation server distributes the latest global model parameter w to the client, and the server initializes the global model parameter w0 during initial training.

[0064] Step 2. The client trains the local model and uploads it to the server. After obtaining the global model parameter w, the client updates the local model and uses the local data set to train the local model. After training and updating, it sends it to the server through secret sharing. It includes the following sub-steps:

[0065] Step 2.1: Client i (i∈[1,30]) uses the global model parameter w to update the local model to achieve local model fine-tuning, and then uses the local dataset to train the local model to obtain its model update parameter g i ; Where i is the client number participating in the training, which is an integer.

[0066] Step 2.2: Calculate the model update parameter g i The regularization result of

[0067] Step 2.3: According to the arithmetic secret sharing rule, g i Split into Similarly, Split into Then share and Send to aggregation server S0 and auxiliary server S1 respectively;

[0068] in, Where mod represents the modulus operation, l represents g i The number of bits.

[0069] Step 3: The server performs secret aggregation operations according to the aggregation rules and updates the global model, including the following sub-steps:

[0070] Step 3.1: Aggregation server S0 and auxiliary server S1 calculate the model update parameter g sent by the two clients i ,g j The cosine distance cd between i,j , calculate the model update parameter g i ,g i The Euclidean distance between i,j ; including the following sub-steps:

[0071] Step 3.1.1: Based on the multiplication triple BT ( <z> , , <v>), the aggregation server S0 and the auxiliary server S1 calculate the model updates g i , g j cosine similarity cos(g i , g j ) between them, and then calculate the cosine distance cd i,j ; The specific process is as follows:

[0072] Taking the model updates g i , g j (i < j) as an example, their regularization results are respectively The servers S0 and S1 respectively hold the shares and The servers first perform calculations locally. Among them, S0 calculates and S1 calculates and The two parties exchange and to recover Then S1 calculates locally and sends the result to S0. S0 calculates and then performs secret reconstruction to obtain the cosine similarity cos(g i , g j between), and then calculates the distance cd i , g j ) i,j .

[0073] <z> A ＝ A · <v> A

[0074]

[0075] cd i,j =1-cos(g i ,g j ).

[0076] Step 3.1.2: Based on the multiplication triple BT( <z> , , <v>), the aggregation server S0 and the auxiliary server S1 calculate the model updates g i , g j the Euclidean distance ed i,j .

[0077] Taking the model updates g i , g i (i < j) as an example, the servers S0 and S1 respectively hold the shares and S0 calculates locally and S1 calculates locally and The two parties exchange and to recover Then S1 calculates locally and sends the result to S0. S0 calculates After secret reconstruction, Subsequently, the model updates g i , g j the Euclidean distance ed i,j .

[0078] ed i,j = ||g i - g j ||2.

[0079] Step 3.2: Conduct secret regularization check on the local model updates.

[0080] Taking the model updates g i as an example, the servers S0 and S1 respectively hold the shares of their regularization results of S0 and S1 calculate the result of based on arithmetic secret sharing, and then make a judgment: if then it means is a legal regularization result. Only the local model updates that pass the regularization check as qualified are retained and allowed to continue participating in the subsequent clustering operations, while those with illegal check results are discarded.

[0081] Among them, relies on to generate, and this formula is deformed from The above formula calculates by multiplying Replace the first formula, that is, replace with to become by multiplying.

[0082] Step 3.3: Multi-index clustering obtains the final model update set C involved in the aggregation; including the following sub-steps:

[0083] Step 3.3.1: Update the Euclidean distance between models i,j Perform the maximum value normalization to get ed′ i,j , and then calculate the comprehensive index d i,j =cd i,j +ed′ i,j Clustering features used as local model updates.

[0084] Among them, the maximum value normalization processing is ed max ,ed min are the maximum and minimum values ​​in the Euclidean distance set, respectively.

[0085] Step 3.3.2: The proportion of malicious clients participating in training in the system is The agglomerative hierarchical clustering algorithm is used for clustering, that is, C = AHC (d i,j ).

[0086] Step 3.4: Perform secret weighted aggregation on the model updates in set C to obtain the global model update g and update the global model; including the following sub-steps:

[0087] Step 3.4.1: The comprehensive index d obtained in step 3.3.1 i,j Calculate model update g i Aggregation weight

[0088]

[0089] Where n is the number of model updates contained in the set C, i∈n.

[0090] Step 3.4.2: In the multiplication triple BT( <z> , , <v>) assisted secret weighted aggregation.

[0091] Update g with model i For example, the aggregation weight sc i Randomly split into Then they are sent to servers S0 and S1 respectively. In addition, the two servers also hold the model update g i Share Follow the same calculation steps as in step 3.1.1 to calculate <g i > <sc i >, and then calculate the global model update

[0092] Step 3.4.3: Define the global learning rate α = 0.1, and then update the global model w = w + α·g = w + 0.1·g.

[0093] So far, after steps 1 to 3, a robust federated learning system and method with privacy protection based on secret sharing has been completed. In the method, we have implemented robust federated learning with privacy protection, which can achieve robust aggregation in the encrypted state.

[0094] In the method, a comprehensive index obtained by combining cosine distance and Euclidean distance is used as the clustering feature of model update, and the characteristics of model update (essentially a multidimensional vector) in terms of direction and modulus are considered to obtain a better clustering effect.

[0095] The embodiment of the present application adopts two clustering algorithms, HDBSCAN and agglomerative hierarchical clustering, to perform clustering operations to deal with situations where the proportion of malicious clients is different. When the number of benign clients is large, the HDBSCAN clustering algorithm is selected, and when the number of malicious clients is large, the agglomerative hierarchical clustering algorithm is selected. Robustness can be well maintained in both honest majority and malicious majority situations.

[0096] Figure 2 This is a Test Accuracy simulation experiment of the present invention on three different data sets. It can be seen from the figure that the present invention has a high model accuracy on the three data sets and can maintain good robustness in both honest majority and malicious majority situations.

[0097] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.< / v> < / z> < / v> < / z> < / v> < / z> < / v> < / z> < / v> < / z>

Claims

1. A privacy-preserving robust federated learning method based on secret sharing, wherein the system targeted by the method includes two types of entities: a client and a server, and is characterized in that: The specific process is: Initial model distribution: The server distributes the initial global model parameters to each client; Local model training: The client updates the local model using the global model parameters and trains the local model using the local dataset. After training and updating, the model is sent to the server through secret sharing. Model aggregation and distribution: The server receives local model update parameters from the client, performs clustering operations, and distributes the global model parameters obtained by clustering to the client. The client updates the local model based on the received results.

2. The privacy-preserving robust federated learning method based on secret sharing according to claim 1, characterized in that: The specific process of local model training is as follows: Step 2.1: Client i updates the local model using the global model parameters and trains the local model using the local dataset to obtain the model update parameters g i ; Step 2.2: Calculate the model update parameter g i The regularization result of Step 2.3: According to the arithmetic secret sharing rule, g i Split into Similarly, Split into Then share and Sent to the aggregation server S0 and the auxiliary server S1 respectively.

3. The privacy-preserving robust federated learning method based on secret sharing according to claim 2, characterized in that: Where mod represents the modulus operation, l represents g i The number of bits.

4. The privacy-preserving robust federated learning method based on secret sharing according to claim 1, characterized in that: The aggregation operation is performed in an encrypted state, and the specific process includes: Step 3.1: Aggregation server S0 and auxiliary server S1 calculate the model update parameter g sent by the two clients i ,g j The cosine distance cd between i,j , calculate the model update parameter g i ,g i The Euclidean distance between i,j ; Step 3.2: Perform regularization check on the local model update parameters, and select the local model update parameters that pass the regularization check; Step 3.3: Calculate clustering features using the cosine distance and Euclidean distance corresponding to the selected local model update parameters, perform clustering operations on the clustering features, and obtain a set C; Step 3.4: Perform weighted aggregation on the model updates in set C to obtain the global model update g and update the global model.

5. The privacy-preserving robust federated learning method based on secret sharing according to claim 4, characterized in that: The cosine distance cd in step 3.1 i,j The specific calculation process is: First, server S0 calculates and Server S1 calculation and in, Represents the model update parameter g j The regularization result of and for The split result according to the secret sharing rule; u and v are random values, and is the split result of u according to the secret sharing rule, and is the split result of v according to the secret sharing rule; Next, server S0 and server S1 exchange and You can restore Again, server S1 computes locally And send the result to S0; Finally, server S0 calculates After that, the secret reconstruction can get the model update g i ,g j The cosine similarity between i ,g j ) and then calculate the distance cd i,j .

6. The privacy-preserving robust federated learning method based on secret sharing according to claim 4, characterized in that: The Euclidean distance in step 3.1 is ed i,j The specific calculation process is: First, server S0 calculates locally and Server S1 computes locally and Next, server S0 and server S1 exchange and You can restore Again, server S1 computes locally And send the result to S0; Finally, server S0 calculates After that, the secret reconstruction can be obtained Then we get the model update g i ,g j The Euclidean distance between i,j .

7. The privacy-preserving robust federated learning method based on secret sharing according to claim 4, characterized in that: The specific process of step 3.2 is as follows: Server S0 and server S1 hold their regularization results respectively. Share S0, S1 are based on arithmetic sharing calculation The result is then judged: If Then explain It is a legal regularization result. Only local model updates that pass the regularization check are retained and allowed to continue to participate in subsequent clustering operations, while those with illegal check results will be discarded.

8. The privacy-preserving robust federated learning method based on secret sharing according to claim 4, characterized in that: The specific process of step 3.3 is as follows: Step 3.3.1: Update the Euclidean distance ed between the selected models i,j Perform the maximum value normalization to get ed′ i,j , and then calculate the comprehensive index d i,j =cd i,j +ed′ i,j Clustering features as local model updates; Step 3.3.2: Use different clustering algorithms to cluster according to the proportion of malicious clients: If the proportion of malicious clients is less than 50%, the HDBSCAN clustering algorithm is used for clustering, that is, C = HDBSCAN (d i,j ); If the proportion of malicious clients is greater than 50%, the agglomerative hierarchical clustering algorithm is used for clustering, that is, C = AHC (d i,j ).

9. The privacy-preserving robust federated learning method based on secret sharing according to claim 4, characterized in that: The specific process of step 3.4 is as follows: Step 3.4.1: The comprehensive index d obtained in step 3.3.1 i,j Calculate model update g i Aggregation weight Where n is the number of model updates contained in the set C, i∈n; Step 3.4.2: Based on the multiplication triple BT ( <z> , , <v> ) for weighted aggregation, specifically:< / v> < / z> The aggregate weight sc i Randomly split into Then they are sent to server S0 and server S1 respectively. In addition, the two servers also hold the model update g i Share Then calculate <g i > <sc i >, further calculate the global model update parameters Step 3.4.3: Update the global model parameters w = w + α g, where α is the global learning rate.

10. A robust federated learning system with privacy protection based on secret sharing, comprising two entities, a client and a server, characterized in that: The server is used to distribute the initialized global model parameters to each client, and to receive the local model update parameters from the client, perform clustering operations, and then distribute the clustered global model update parameters to the client; The client, on the one hand, uses the global model parameters to update the local model, and uses the local data set to train the local model, and sends the local model update parameters to the server; on the other hand, it uses the global model parameters obtained by clustering to update the local model.

Images