A privacy-protected robust federated learning method and system based on secret sharing

Abstract

The application relates to a privacy protection robust federated learning method and system based on secret sharing, and belongs to the technical field of privacy protection and robust aggregation. The specific process of the method is as follows: initial model distribution: a server distributes initial global model parameters to each client; local model training: a client updates a local model by using the global model parameters, trains the local model by using a local data set, and sends the updated local model to the server through secret sharing; model aggregation distribution: the server receives local model update parameters from the client, performs clustering operation, distributes global model parameters obtained through clustering to the client, and the client updates the local model according to the received result.

Description

Technical Field

[0001] This invention relates to a robust federated learning method and system based on secret sharing and privacy protection, belonging to the fields of privacy protection and robust aggregation technology. Background Technology

[0002] Federated learning (FL) has emerged as a promising distributed machine learning paradigm, enabling multiple participants to jointly train machine learning models without sending data to a central server. In FL, participants compute model updates based on their local data and a global model received from a coordinating server, and then send the resulting updates to the coordinating server. The server aggregates the received updates to obtain a new global model, which is then redistributed among the participants. This collaboration is mutually beneficial to all parties. Because the training data does not leave the participants' devices, FL is a suitable choice for scenarios involving personal data, such as facial recognition, voice assistants, healthcare, next-word prediction, or intrusion detection in IoT networks. Despite its promising future, FL is vulnerable to poisoning attacks due to its distributed nature. For example, a malicious client could hostilely manipulate the global model by poisoning its own training dataset or the gradients of its local model sent to the server, thereby corrupting the global model to make incorrect predictions. Furthermore, regarding privacy concerns, some powerful privacy attacks have shown that the original training data can be reconstructed by reversing the updated gradients, meaning that transmitting gradient data in plaintext may pose a risk of privacy breaches.

[0003] Data privacy and resistance to poisoning attacks (Byzantine robustness) are two key issues in Functional Linear Analysis (FL), and reconciling privacy and security is a challenge for FL. On the one hand, well-intentioned updates sent by honest participants may reveal their private local information, while poisoned updates sent by malicious participants may compromise the usability or integrity of the model. On the other hand, privacy-preserving mechanisms often make data difficult to distinguish, thus compromising security because they do not allow servers to filter out individual poisoned updates. However, most existing FL aggregation solutions focus on robustness implementation while neglecting privacy protection.

[0004] The development of robust aggregation in privacy-preserving federated learning faces several challenges: First, if client-side private information is protected through encryption or other technologies, the server cannot distinguish malicious data, thus hindering robust aggregation. Second, filtering malicious data requires the server to obtain real model updates, potentially leading to privacy breaches on the client side. Therefore, achieving robust aggregation while maintaining privacy in federated learning remains a challenge. Summary of the Invention

[0005] In view of this, the present invention aims to solve the problem of balancing robust aggregation and privacy protection in the above-mentioned federated learning, and proposes a robust federated learning method and system based on secret sharing and privacy protection.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] Firstly, this application provides a robust federated learning method based on secret sharing and privacy protection. The system targeted by this method includes two types of entities: clients and servers. The specific process is as follows:

[0008] Initial model distribution: The server distributes the initial global model parameters to each client;

[0009] Local model training: The client updates the local model using global model parameters and trains the local model using the local dataset. After training and updating, the model is sent to the server via secret sharing.

[0010] Model aggregation and distribution: The server receives local model update parameters from the client, performs clustering operations, and distributes the global model parameters obtained from the clustering to the client. The client then updates its local model based on the received results.

[0011] Furthermore, the specific process of local model training described in this invention is as follows:

[0012] Step 2.1: Client i updates the local model using the global model parameters and trains the local model using the local dataset to obtain the model update parameters g. i ;

[0013] Step 2.2: Calculate the model update parameter g i Regularization results

[0014] Step 2.3: According to the arithmetic secret sharing rules, g i Split into Similarly, Split into Then share and The data is sent to the aggregation server S0 and the auxiliary server S1, respectively.

[0015] Furthermore, the present invention Where mod represents the modulo operation, l represents g i The number of bits.

[0016] Furthermore, the aggregation operation described in this invention is performed in an encrypted state, and the specific process includes:

[0017] Step 3.1: Aggregation server S0 and auxiliary server S1 calculate the model update parameters g sent by the two clients. i ,g j The cosine distance cd between them i,j Calculate the model update parameter g i ,g i Euclidean distance between i,j ;

[0018] Step 3.2: Perform a regularization check on the local model update parameters and filter out the local model update parameters that pass the regularization check;

[0019] Step 3.3: Calculate clustering features using the cosine distance and Euclidean distance corresponding to the selected local model update parameters, and perform clustering operations on the clustering features to obtain set C;

[0020] Step 3.4: Perform weighted aggregation of the model updates in set C to obtain the global model update g, and update the global model.

[0021] Furthermore, in step 3.1 of the present invention, the cosine distance cd i,j The specific calculation process is as follows:

[0022] First, server S0 calculation and Server S1 computes and in, This indicates that the model updates the parameter g. j The regularization result, and for Based on the splitting result of the secret sharing rules; u and v are random values. and The result of splitting u according to the secret sharing rules. and The result of splitting v according to the secret sharing rules;

[0023] Secondly, server S0 and server S1 exchange and It can be restored

[0024] Secondly, server S1 performs local computation. And send the result to S0;

[0025] Finally, server S0 calculates... Afterwards, a secret reconstruction can be performed to obtain the model update g. i ,g j Cosine similarity between them i ,gj Then calculate the distance cd i,j ;

[0026] Furthermore, in step 3.1 of this invention, the Euclidean distance ed i,j The specific calculation process is as follows:

[0027] First, server S0 performs local computation. and Server S1 calculates locally. and

[0028] Secondly, server S0 and server S1 exchange and It can be restored

[0029] Secondly, server S1 performs local computation. And send the result to S0;

[0030] Finally, server S0 calculates... Then, a secret reconstruction can be performed to obtain... Then the model update g is obtained i ,g j Euclidean distance between i,j .

[0031] Furthermore, the specific process of step 3.2 of this invention is as follows:

[0032] Servers S0 and S1 each hold their regularization results. sharing S0 and S1 are based on arithmetic sharing computation. The result is then used for judgment: if This means Only valid regularization results are retained and allowed to continue participating in subsequent clustering operations. Valid results are discarded.

[0033] Furthermore, the specific process of step 3.3 of this invention is as follows:

[0034] Step 3.3.1: Update the Euclidean distance ed between the selected models. i,j Perform maximum / minimum value normalization to obtain ed′ i,j Then calculate the comprehensive index d. i,j =cd i,j +ed′ i,j Clustering features used for local model updates;

[0035] Step 3.3.2: Cluster the data using different clustering algorithms based on the proportion of malicious clients:

[0036] If the proportion of malicious clients is less than 50%, the HDBSCAN clustering algorithm is used for clustering, i.e., C = HDBSCAN(d i,j );

[0037] If malicious clients account for more than 50%, agglomerative hierarchical clustering algorithm is used for clustering, i.e., C = AHC(d i,j ).

[0038] Furthermore, the specific process of step 3.4 of this invention is as follows:

[0039] Step 3.4.1: Based on the comprehensive index d obtained in Step 3.3.1 i,j Computational model update g i Aggregate weights Where n is the number of model updates contained in set C, i∈n;

[0040] Step 3.4.2: Based on the multiplication triple BT ( <z> , , <v>Weighted aggregation is performed, specifically as follows:

[0041] Aggregate its weights sc i Randomly split into The data is then sent to servers S0 and S1 respectively. In addition, each server also holds a model update g. i sharing Then calculate <g i >· <sc i > Further calculate the global model update parameters

[0042] Step 3.4.3: Update the global model parameters w = w + α·g, where α is the global learning rate.

[0043] Secondly, this application provides a robust federated learning system based on secret sharing and privacy protection, comprising two types of entities: client and server.

[0044] The server serves two purposes: firstly, it distributes the initial global model parameters to each client; secondly, it receives the local model update parameters from the clients, performs clustering operations, and then distributes the clustered global model update parameters to the clients.

[0045] On the one hand, the client updates the local model using global model parameters and trains the local model using the local dataset, then sends the updated local model parameters to the server; on the other hand, it updates the local model using global model parameters obtained from clustering.

[0046] Beneficial effects

[0047] This invention relates to a robust federated learning system and method based on secret sharing and privacy protection, which has the following advantages compared with existing robust aggregation rules in federated learning:

[0048] First, in federated learning, resisting Byzantine attacks requires knowledge of the client's local model updates to filter out malicious data, but this risks compromising the client's data privacy. If homomorphic encryption or similar techniques are used to encrypt the client's model updates, the server cannot perform robust aggregation operations. Therefore, this invention designs a robust federated learning method based on secret sharing for privacy protection. It uses arithmetic secret sharing rules for parameter processing to achieve privacy protection, and performs clustering operations through the calculation of clustering features. Thus, robust aggregation is achieved while protecting client data privacy.

[0049] Second, the effectiveness of Euclidean distance is limited by the data dimensionality, and using a single metric to determine whether a local model update is malicious is also relatively limited. This invention uses a combined metric obtained from joint cosine distance and Euclidean distance as the clustering feature for model updates during clustering operations, thereby achieving superior clustering results.

[0050] Third, compared to existing federated learning robust aggregation rules, which can mostly only handle the honest majority case (generally based on a malicious client ratio of 20%), this invention uses two clustering algorithms, HDBSCAN and agglomerative hierarchical clustering, to handle situations where the malicious client ratio is different. Therefore, it can maintain robustness well in both honest majority and malicious majority cases. Attached Figure Description

[0051] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a model diagram of a robust federated learning system for privacy protection based on secret sharing, as proposed in this invention.

[0053] Figure 2 The figures show the simulation results of the system of this invention on three datasets: MNIST, Fashion-MNIST, and HAR. Detailed Implementation

[0054] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0055] It should be noted that, in the absence of conflict, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0056] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0057] This embodiment details a typical application process of the privacy-preserving robust federated learning method based on secret sharing according to the present invention; the system model diagram used by this method is shown in the figure below. Figure 1 This application proposes a robust federated learning method based on secret sharing for privacy protection, comprising two types of entities: clients and servers. Clients possess their own local private data, train local models on this dataset, and send updated models to the server via secret sharing to protect data privacy. The server receives the local model update sharing from the clients, performs an aggregation operation to obtain the global model update, and then distributes it to the clients.

[0058] This application provides a robust federated learning method based on secret sharing for privacy protection. The system targeted by this method includes two types of entities: clients and servers. The specific process is as follows:

[0059] Initial model distribution: The server distributes the initial global model parameters to each client;

[0060] Local model training: The client updates the local model using global model parameters and trains the local model using the local dataset. After training and updating, the model is sent to the server via secret sharing.

[0061] Model aggregation and distribution: The server receives local model update parameters from the client, performs clustering operations, and distributes the global model parameters obtained from the clustering to the client. The client then updates its local model based on the received results.

[0062] This embodiment assumes that the user wants to obtain the federated learning training results, and that the number of malicious clients participating in the training in the system exceeds the number of benign clients. This embodiment assumes that the total number of clients participating in the training in the system is 30, of which 18 are malicious clients. The trained local model is used to identify benign and malicious clients. The specific process of the method of this invention is described in detail below:

[0063] Step 1. Global Model Parameter Distribution. The aggregation server distributes the latest global model parameters w to the clients. During initial training, the server initializes the global model parameters w0.

[0064] Step 2. The client trains the local model and uploads it to the server. After obtaining the global model parameters w, the client updates the local model and trains it using the local dataset. After training and updating, the model is sent to the server via secret sharing. This includes the following sub-steps:

[0065] Step 2.1: Client i (i∈[1,30]) uses the global model parameters w to update the local model to achieve local model fine-tuning, and then uses the local dataset to train the local model to obtain its model update parameters g. i Where i is the client number participating in the training, which is an integer.

[0066] Step 2.2: Calculate the model update parameter g i Regularization results

[0067] Step 2.3: According to the arithmetic secret sharing rules, g i Split into Similarly, Split into Then share and Send them to aggregation server S0 and auxiliary server S1 respectively;

[0068] in, Where mod represents the modulo operation, l represents g i The number of bits.

[0069] Step 3: The server performs a secret aggregation operation based on the aggregation rules and updates the global model, including the following sub-steps:

[0070] Step 3.1: Aggregation server S0 and auxiliary server S1 calculate the model update parameters g sent by the two clients. i ,g j The cosine distance cd between them i,j Calculate the model update parameter g i ,g i Euclidean distance between i,j It includes the following sub-steps:

[0071] Step 3.1.1: Based on the multiplication triple BT ( <z> , , <v>), the aggregation server S0 and the auxiliary server S1 calculate the model updates g i , g j The cosine similarity cos(g i , g j ) between them, and then calculate the cosine distance cd i,j ; The specific process is as follows:

[0072] Taking the model updates g i , g j (i < j) as an example, their regularization results are respectively The servers S0 and S1 respectively hold the shares and The servers first perform calculations locally. Among them, S0 calculates and S1 calculates and The two parties exchange and to restore Then S1 calculates locally and sends the result to S0. S0 calculates After that, through secret reconstruction, the model updates g i , g j The cosine similarity cos(g i , g j ) between them, and then calculate the distance cd i,j .

[0073] <z> A ＝ A · <v> A

[0074]

[0075] cd i,j =1-cos(g) i ,g j ).

[0076] Step 3.1.2: Based on the multiplication triple BT ( <z> , , <v>), the aggregation server S0 and the auxiliary server S1 calculate the model updates g i , g j the Euclidean distance ed i,j .

[0077] Taking the model updates g i , g i (i < j) as an example, the servers S0 and S1 respectively hold the shares and S0 locally calculates and S1 locally calculates and The two parties exchange and to recover Then S1 locally calculates and sends the result to S0. S0 calculates After that, through secret reconstruction to obtain Subsequently, to obtain the model updates g i , g j the Euclidean distance ed i,j .

[0078] ed i,j = ||g i - g j ||2.

[0079] Step 3.2: Conduct a secret regularization check on the local model updates.

[0080] Taking the model updates g i as an example, the servers S0 and S1 respectively hold the shares of their regularization results S0 and S1 calculate the result of based on arithmetic secret sharing, and then make a judgment: if it means that is a legal regularization result. Only the local model updates that pass the regularization check are retained and allowed to continue participating in the subsequent clustering operation, while those with illegal check results are discarded.

[0081] Among them, is generated based on and this formula is deformed from The above formula calculates by multiplying Replacing the first formula, that is, replacing with becomes by multiplying.

[0082] Step 3.3: Multi-index clustering yields the final model update set C participating in the aggregation; including the following sub-steps:

[0083] Step 3.3.1: Euclidean distance ed between model updates i,j Perform maximum / minimum value normalization to obtain ed′ i,j Then calculate the comprehensive index d. i,j =cd i,j +ed′ i,j Clustering features used for local model updates.

[0084] Among them, the extreme value normalization process is as follows: ed max ,ed min These are the maximum and minimum values ​​in the set of Euclidean distances, respectively.

[0085] Step 3.3.2: The percentage of malicious clients participating in the training in the system is... Then, agglomerative hierarchical clustering algorithm is used for clustering, i.e., C = AHC(d i,j ).

[0086] Step 3.4: Perform secret weighted aggregation on the model updates in set C to obtain the global model update g, and update the global model; including the following sub-steps:

[0087] Step 3.4.1: Based on the comprehensive index d obtained in Step 3.3.1 i,j Computational model update g i Aggregate weights

[0088]

[0089] Where n is the number of model updates contained in set C, i∈n.

[0090] Step 3.4.2: In the multiplication triple BT( <z> , , <v>Secret weighted aggregation with assistance.

[0091] Update g with model i For example, let's aggregate its weights sc i Randomly split into The updates are then sent to servers S0 and S1 respectively. In addition, each server also holds a model update g. i sharing Perform the calculations following the same steps as in step 3.1.1. <g i >· <sc i Then calculate the global model update.

[0092] Step 3.4.3: Define the global learning rate α = 0.1, and then update the global model w = w + α·g = w + 0.1·g.

[0093] Thus, through steps 1 to 3, a robust federated learning system and method based on secret sharing and privacy protection have been completed. In this method, we have implemented privacy-preserving robust federated learning, enabling robust aggregation in encrypted form.

[0094] In the method described above, a comprehensive index obtained by combining cosine distance and Euclidean distance is used as the clustering feature for model update. The method also considers the features of model update (which is essentially a multi-dimensional vector) in terms of both direction and magnitude to achieve better clustering results.

[0095] This application employs two clustering algorithms, HDBSCAN and cohesive hierarchical clustering, to address situations where the proportion of malicious clients varies. When the number of benign clients is large, HDBSCAN is selected, while when the number of malicious clients is large, cohesive hierarchical clustering is selected. Both algorithms maintain robustness well in both honest and malicious majority scenarios.

[0096] Figure 2 The figure shows the test accuracy simulation experiments of this invention on three different datasets. As can be seen from the figure, this invention has high model accuracy on all three datasets and maintains good robustness in both honest majority and malicious majority cases.

[0097] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.< / v> < / z> < / v> < / z> < / v> < / z> < / v> < / z> < / v> < / z>

Claims

1. A privacy-preserving robust federated learning method based on secret sharing, the method is for a system comprising two types of entities, clients and servers, characterized in that, The specific process is: Initial model distribution: the server distributes the initial global model parameters to each client; Local model training: the client updates the local model using the global model parameters, and trains the local model using the local data set, and sends the updated local model to the server through secret sharing; Model aggregation distribution: the server receives the local model update parameters from the client, performs clustering operation, distributes the global model parameters obtained by clustering to the client, and the client updates the local model according to the received result; The aggregation operation is performed in an encrypted state, and the specific process includes: Step 3.1: Aggregation server S0 and auxiliary server S1 calculate the model update parameters g sent by the two clients. i g j The cosine distance cd between them i，j Calculate the model update parameter g i ,g j Euclidean distance between i,j ; Step 3.2: Regularization check is performed on the local model update parameters, and the local model update parameters that pass the regularization check are selected; Step 3.3: Calculate the clustering feature by using the cosine distance and Euclidean distance corresponding to the selected local model update parameters, and perform clustering operation on the clustering feature to obtain a set C; Step 3.4: Weighted aggregation is performed on the model updates in set C to obtain global model update g and update the global model; The cosine distance cd in step 3.1 i,j The specific process of calculation is: First, the server S calculates and The server S1 calculates and wherein, denotes the regularization result of the model update parameter g j , and are split results according to a secret sharing rule; u and v are random values, and are split results of u according to a secret sharing rule, and are split results of v according to a secret sharing rule. Secondly, the server S0 and the server S1 exchange and i.e. the restoration Again, the server S1 computes locally and sends the result to S0; Finally, the server S0 calculates After that, the secret reconstruction is performed to obtain the model update g i ,g j The cosine similarity cos(g i ,g j ) between them is calculated, and then the distance cd i,j ; The step 3.1 Euclidean distance ed i,j The specific process of calculation is: First, the server SO computes locally and The server SI computes locally and Second, the server SO and the server SI exchange and i.e. the recovery Again, the server S1 computes locally and sends the result to S0; Finally, the server S0 computes After that, the secret reconstruction is performed to obtain Then the model update g is obtained i ,g j The Euclidean distance ed between them i,j .

2. The privacy-preserving robust federated learning method based on secret sharing according to claim 1, characterized in that, The specific process of the local model training is: Step 2.1: Client i updates the local model with the global model parameters and trains the local model with the local dataset to obtain model update parameters g i ; Step 2.2: Compute model update parameters g i regularization result of Step 2.3: g i is split into is split into is split into Then the shares and are sent to the aggregation server So and the helper server Si, respectively.

3. The privacy-preserving robust federated learning method based on secret sharing according to claim 2, characterized in that, where mod denotes a modulo operation, / denotes the number of bits of g i .

4. The privacy-preserving robust federated learning method based on secret sharing according to claim 1, characterized in that, The specific process of step 3.2 is: The server S0 and the server S1 hold their regularized results respectively of the sharing The S0, S1 calculate the result based on the arithmetic sharing Then, the judgment is made: if It means is a legal regularized result. Only the local model updates that pass the regularized check are retained to continue participating in the subsequent clustering operations, and the check results that are not legal are discarded.

5. The privacy-preserving robust federated learning method based on secret sharing according to claim 1, characterized in that, The specific process of step 3.3 is: Step 3.3.1: Euclidean distance ed between the screened model updates i,j Performing the min-max normalization to obtain ed' i,j Then, calculate the comprehensive index d i,j = cd i,j + ed' i,j as the clustering feature of the local model update; Step 3.3.2: Different clustering algorithms are used for clustering according to the proportion of malicious clients: If the proportion of malicious clients is less than 50%, use the HDBSCAN clustering algorithm for clustering operation, that is, C = HDBSCAN(d i,j ). If the proportion of malicious clients is greater than 50%, a clustering operation is performed using a condensed hierarchical clustering algorithm, i.e. C = AHC(d i,j ).

6. The privacy-preserving robust federated learning method based on secret sharing according to claim 1, characterized in that, The specific process of step 3.4 is: Step 3.4.1: The aggregated indicator d is obtained according to step 3.3.1 i,j Computing model update g i The aggregated weight of where n is the number of model updates contained in the set C, i e n; Step 3.4.2: Based on the multiplication triplets BT <z> , <v> , <v>Weighted aggregation is performed, specifically:< / v> < / v> < / z> aggregating weights sc i randomly split into are sent to server S0 and server S1 respectively, in addition, the two servers also hold model updates g i sharing of then calculate <g i >·<sc i > further calculate global model update parameters Step 3.4.3: Update the global model parameters w = w + alpha.g, where alpha is the global learning rate.

7. A privacy-protected robust federated learning system based on secret sharing, used for executing the method of any one of claims 1-6, comprising two types of entities, clients and servers, characterized in that, The server is used to distribute the initial global model parameters to each client, and is also used to receive the local model update parameters from the client and perform clustering operation, and then distribute the global model update parameters obtained by clustering to the client; The client is used to update the local model using the global model parameters, and train the local model using the local data set, and send the local model update parameters to the server; on the other hand, the global model parameters obtained by clustering are used to update the local model.

Images