Federal learning security aggregation method based on key layer positioning and reversible watermarking

Abstract

The invention discloses a federated learning security aggregation method based on key layer positioning and reversible watermarking. The method comprises the following steps: S1, after training a federated learning structure, carrying out key layer positioning processing and encryption; s2, user additional information is embedded into the encrypted layer, and a cipher-carrying model ciphertext is obtained; s3, obtaining user embedded information, and carrying out security aggregation on the cipher-carrying model ciphertext at a server side to obtain an aggregation model ciphertext; and S4, the server embeds server additional information into the aggregation model ciphertext, the client obtains the encryption-carrying aggregation ciphertext and decrypts the encryption-carrying aggregation ciphertext to obtain the aggregation model, the step S1 is returned again for training, and training is stopped until the specified number of training rounds of the server are reached. The privacy security of the model is ensured in the model sharing process of the server and the user, the receiving end extracts the embedded authentication information from the ciphertext to realize the functions of identity authentication and the like, the availability of the FL training model is improved, and the efficiency and security of the model uploading process are effectively improved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a federated learning security aggregation method based on key layer positioning and reversible watermarking. Background Art

[0002] Machine learning (ML) is a revolutionary technology that is driving innovation and development in all walks of life. Traditionally, the success of machine learning algorithms is based on centralized data storage and processing, which requires organizations to collect and accumulate large amounts of data to train models. However, this centralized data processing method brings the risk of privacy leakage, which may result in sensitive information of individuals, customers, or proprietary processes being obtained by unauthorized entities. This risk has become an obstacle to the development of machine learning, as data holders are cautious about practices that may compromise user privacy and organizational security. In order to meet the challenges of data privacy protection, federated learning (FL) has emerged as an innovative solution. FL allows multiple participants to collaboratively train deep neural networks (DNNs) without sharing original data, thereby protecting data privacy, which is particularly suitable for data-sensitive fields such as healthcare or military. However, although the user's original data does not leave the local during the training process of FL, research shows that there is still a risk of privacy leakage during the model transmission and sharing process, such as attribute inference attacks, label inference attacks, and data reconstruction attacks. In addition, poisoning attacks and model infringement are also the main risks that federated learning technology needs to face in the research and application process. To this end, FL currently introduces two types of security technologies for prevention. First, in order to protect the content privacy of the model upload and distribution process in an environment where distributed users participate in training, FL is combined with cryptographic technologies such as homomorphic encryption, differential privacy, and multi-party secure computing. Distributed users upload encrypted models, and the server performs secure aggregation in the ciphertext state, and then distributes the model to users. When uploading model parameters, if existing homomorphic encryption technologies are applied to all parameters, a large amount of additional overhead will be generated, which will bring a huge burden to the device. Another important aspect to consider is to protect the intellectual property rights of the training model to prevent theft, plagiarism, and unauthorized use, and at the same time provide a model marking method for poisoning traceability. In summary, the main security requirements in the current FL field focus on protecting five aspects in the model interaction process: confidentiality of model content, model computing overhead, availability of model functions, traceability of copyright, and traceability of poisoning attacks. Summary of the invention

[0003] In order to solve the above technical problems, the present invention proposes a federated learning security aggregation method based on key layer positioning and reversible watermarking, which realizes privacy protection and security aggregation in the federated learning process, while improving the efficiency of homomorphic encryption in federated learning and reducing the storage space and communication overhead in the federated learning homomorphic encryption process.

[0004] To achieve the above object, the present invention provides a federated learning security aggregation method based on key layer positioning and reversible watermarking, comprising:

[0005] S1, perform key layer positioning processing and encryption after training the federated learning structure;

[0006] S2, embedding user extra information into the encrypted layer to obtain the secret-carrying model ciphertext;

[0007] S3, obtaining user embedded information, and securely aggregating the secret-carrying model ciphertext on the server side to obtain the aggregated model ciphertext;

[0008] S4. The server embeds the aggregate model ciphertext into the server additional information. The client obtains the aggregate ciphertext with secret information, decrypts it and obtains the aggregate model. The client returns to S1 for training again until the number of training rounds specified by the server is reached and the training is stopped.

[0009] Optionally, key layer positioning processing and encryption are performed after training the federated learning model, including:

[0010] The federated learning architecture is trained, and each layer of the trained federated learning structure is distinguished from key layers and other layers by key layer positioning, and the key layers and other layers are encrypted respectively.

[0011] Optionally, the encrypted layer is embedded with additional user information to obtain the secret-carrying model ciphertext including:

[0012] After the key layer is encrypted, the first stage of reversible embedding is performed to embed the user's additional information to obtain the user-side key layer ciphertext; after the other layers are encrypted, the other layer ciphertexts are obtained; the user-side key layer ciphertext is combined with the other layer ciphertexts to obtain the secret model ciphertext.

[0013] Optionally, securely aggregating the secret-carrying model ciphertext on the server side to obtain the aggregated model ciphertext includes:

[0014] The user-side key layer ciphertext and the other layer ciphertexts are securely aggregated on the server side to obtain the aggregate model ciphertext.

[0015] Optionally, embedding the aggregate model ciphertext into server additional information to obtain the secret-carrying aggregate ciphertext includes:

[0016] The aggregation model ciphertext is divided into key layer ciphertext and other layer ciphertext, and the server additional information is reversibly embedded into the key layer ciphertext of the aggregation model ciphertext through the second stage to obtain the secret-carrying key layer ciphertext of the server side, and the secret-carrying key layer ciphertext of the server side is merged with the other layer ciphertexts of the aggregation model ciphertext to obtain the secret-carrying aggregation ciphertext.

[0017] Optionally, the method further includes performing a first-stage information extraction on the secret-carrying model ciphertext to obtain additional user information.

[0018] Optionally, the method further includes performing a second-stage information extraction on the secret-carrying aggregate ciphertext to obtain additional server information.

[0019] An electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the federated learning security aggregation method based on key layer positioning and reversible watermarking is implemented.

[0020] Technical effect of the present invention: The present invention discloses a secure aggregation method for federated learning based on key layer positioning and reversible watermarking. Introducing homomorphic encryption technology to encrypt all model layers will cause the problem of excessive computational complexity. Therefore, the present invention uses the key layer positioning method to determine the parameter layer with the greatest effect on the model function through random screening and model function evaluation, which is recorded as the key layer. After the user trains the model, the model layers are divided into key layers and other layers. The key layer uses the Paillier homomorphic encryption model to protect the privacy of the model, and the other layers use differential privacy technology to protect the privacy of the model. Compared with the homomorphic encryption technology, the computational complexity of differential privacy is small, which can effectively improve the aggregation efficiency. The two-stage ciphertext domain reversible watermarking algorithm for Paillier homomorphic encryption is used to support different stages of federated learning, and the identity authentication, security verification and other functions of the model ciphertext in the process of transmission between the user and the server. After the first stage is embedded in the user encryption key layer, the user ID and other information can be embedded to obtain the first stage secret ciphertext. The present invention uses the randomly generated bit stream data as the ID and other security authentication information to illustrate the correctness of the embedding process. The embedded data in this stage can be proposed by the server without decrypting the key layer ciphertext of the model. Then the key layer ciphertexts submitted by different users and the differential privacy ciphertexts of other layers can be securely aggregated on the server side. The second stage of embedding occurs when the server embeds additional information into the key layer ciphertext of the service aggregated model ciphertext after the secure aggregation is completed. Then the server distributes the secret aggregated ciphertext to each user, supporting users to directly extract embedded information from the ciphertext. At the same time, the information embedded by the server can be decrypted losslessly to support the implementation of subsequent authentication and other functions. Based on this technology, the privacy and security of the model is guaranteed during the model sharing process between the server and the user. At the same time, the receiving end implements identity authentication and other functions by extracting the embedded authentication information from the ciphertext, which can effectively resist man-in-the-middle attacks, as well as impersonation attacks and replay attacks by non-FL participants, improve the availability of the FL training model, and solve the problem that the identity authentication and content delivery processes in the traditional identity authentication protocol are carried out independently, effectively improving the efficiency and security of the model upload process. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 It is a flow chart of a federated learning security aggregation method based on key layer positioning and reversible watermarking according to an embodiment of the present invention;

[0023] Figure 2 Schematic diagram of key layer positioning in an embodiment of the present invention, wherein (a) is the training stage of the federated learning client, (b) is the stage of the federated learning client searching for the key layer; (c) is a flowchart of the federated learning client searching for the key layer;

[0024] Figure 3 The figure is a schematic diagram of the Paillier encryption and watermarking process of the server and the client in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0026] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] First, the technical terms involved in the following embodiments are explained.

[0028] Key Layers of the Model: In the field of federated learning, the concept of key layers (KL) is given special significance. These key layers are the core components of the model architecture and play a vital role in the model's predictive ability. When the parameters of these layers are destroyed, such as being replaced by random matrices, the overall prediction accuracy of the model will suffer a catastrophic decline, a phenomenon that is vividly described as an "avalanche" loss. These key layers play a dominant role in the sensitivity and decision-making process of the model. In Zhuang [8]In the study of , a similar concept, namely the backdoor critical layer (BC layer for short), was also mentioned, but the focus of its research is different from that of the present invention. The present invention explores the possibility of reconstructing these critical layers using random matrices by simulating the behavior of attackers. The purpose of this simulated attack is to test the vulnerability of the model in the face of such attacks and to find possible defense strategies. The experimental results reveal an important phenomenon: a part of the layers in the model has an extremely significant impact on the overall prediction accuracy. Slight changes in these layers can lead to a significant decrease in model performance. Therefore, identifying and encrypting these critical layers can not only effectively reduce the communication and computing costs in the federated learning process, but also significantly improve learning efficiency. This approach helps to ensure the security and efficiency of the model while protecting the model parameters, thereby achieving data privacy protection without sacrificing performance. Through this strategy, it is possible to more accurately locate and protect those layers that are critical to model performance in the federated learning environment. This not only provides additional protection for the security of the model, but also provides a new perspective for optimizing resource allocation in the federated learning process. The implementation of this method is expected to promote the application of federated learning technology in a wider range of fields while protecting personal data privacy, achieving efficient use of data and robust learning of models.

[0029] Paillier Homomorphic Encryption: Paillier cipher is a public key cryptographic scheme that supports additive homomorphism. In this algorithm, it is mainly used to support the server to implement secure aggregation. The algorithm meets semantic security, that is, ciphertext indistinguishability under chosen plaintext attack (IND-CPA). The security of the scheme can be reduced to the decisional composite residuosity assumption (DCRA) problem. The symbols involved are shown in Table 1.

[0030] Table 1

[0031]

[0032]

[0033] The Paillier cipher scheme consists of the following algorithms:

[0034] (1) Key generation. First, select two large prime numbers p and q of equal length, calculate the product of p and q N = pq; then select an integer And satisfy gcd(L(g λ mod N 2 ),N)=1, where:

[0035] L(x)=(x-1) / N (1)

[0036] calculate:

[0037] λ=lcm(p-1,q-1) (2)

[0038] μ=(L(gλmodN2))-1mod N (3)

[0039] Then the public key pk = (N, g), and the private key sk = (λ, μ).

[0040] (2) Encryption. Any integer Given a plaintext m∈Z N , the corresponding ciphertext is:

[0041] c=Enc(m,r)=gmrN modN2 (4)

[0042] (3) Decryption. The ciphertext c can be decrypted as follows to obtain the corresponding plaintext m:

[0043] m=Dec(c)=L(cλmodN2)·μmodN (5)

[0044] If the Paillier cipher algorithm is used to encrypt the model parameters, each parameter needs to be encrypted using formula (4), and finally a large integer array is obtained. Each large integer in this array is decrypted using formula (5), and the original model can be obtained by summing up. The premise of decryption correctness is that the parameter value of the model parameter is located in Z N , in the algorithm, N is usually used as 1024 bits, so this is usually satisfied.

[0045] The Paillier cipher has additive homomorphism. Assume that for plaintext m,m 1 ,m 2 , the corresponding ciphertext is:

[0046] The calculation results are:

[0047]

[0048]

[0049]

[0050] As you can see, c 1 c 2 ,c k ,cg k They are m 1 +m 2 ,km,m+k is the legal ciphertext.

[0051] There are already some RDHED schemes based on Paillier additive homomorphism. By multiplying the ciphertext value by itself in the encryption domain, the corresponding plaintext pixel value can be doubled. In addition, the ciphertext value multiplied by 1 can be embedded with 1, and the ciphertext without any operation or multiplied by 0 can be embedded with 0.

[0052] Paillier-based reversible watermarking in ciphertext domain: Reversible information hiding in ciphertext domain is one of the important branches of information hiding technology. Its characteristic is that the carrier used for embedding is encrypted. It requires not only the ability to accurately extract the embedded information from the ciphertext after the embedded information, but also the ability to decrypt and losslessly restore the original plaintext. This technology combines information hiding and encryption technology to provide double protection for data.

[0053] EVR is based on cryptography that uses randomly sampled variables during encryption, such as Paillier encryption, LWE, and ElGamal encryption. By randomly refreshing the variables, another ciphertext is generated. Bits of the ciphertext are sampled from specific locations. If the sampled bits match the bits to be embedded, the stegosaurus is obtained. If the bits do not match, the variables are refreshed again until the resampled bits match.

[0054] The embedding function of EVR’s SIED steganography based on Paillier encryption is as follows.

[0055] Key generation: Choose two large prime numbers p and q, and calculate N = p × q. Calculate the least common multiple of (p-1, q-1), denoted as λ. Choose an integer gcd(L(g λ modN 2 ),N)=1,L(x)=(x-1) / N, is less than N 2 And with N 2 The public key for encryption is K 1 (N,g), the decrypted private key is K 2 (p,q,λ).

[0056] Encryption: Randomly select an encrypted process variable The plaintext is p∈Z N The encryption result is c=Enc(K 1 ,p)=g p ·r N modN 2 .

[0057] Decryption: The decryption result of c is

[0058] EVR's Bit Sample Embedding (BSE):

[0059] The variable to refresh is The secret message bits are denoted as s∈{0,1}. To maintain the distribution of the embedded bit plane, the bits to be embedded are first encrypted. A key bit k is randomly sampled from {0,1}. The bits to be embedded are denoted as b s. .

[0060]

[0061] The LSB(.) function is used to get the least significant bit of the input integer.

[0062] Step 1: If b r = LSB (c), then c' = c; if b r ≠LSB(c), then refresh r'≠r.

[0063] Step 2: c' = Enc(K 1 ,p)=g p ·r' N modN 2 .

[0064] Step 3: Repeat step 2 until LSB(c') = b. Return c' as the steganographic ciphertext.

[0065] Decryption: m = Dec(K 2 ,c').

[0066] extract:

[0067] In order to meet the needs of large-capacity embedding, the present invention improves the algorithm and defines LSN (least significant number), which is used to obtain the last n bits of the input character. r =LSN(n,·). The idea is the same as that of the EVR bit sampling embedding algorithm. By refreshing the variable Until LSN(c', ) = b, c' is returned as the steganographic ciphertext.

[0068] like Figure 1 As shown, this embodiment provides a federated learning security aggregation method based on key layer positioning and reversible watermarking, including:

[0069] S1, perform key layer positioning processing and encryption after training the federated learning structure;

[0070] S2, embedding user extra information into the encrypted layer to obtain the secret-carrying model ciphertext;

[0071] S3, obtaining user embedded information, and securely aggregating the secret-carrying model ciphertext on the server side to obtain the aggregated model ciphertext;

[0072] S4. The server embeds the aggregate model ciphertext into the server additional information. The client obtains the aggregate ciphertext with secret information, decrypts it and obtains the aggregate model. The client returns to S1 for training again until the number of training rounds specified by the server is reached and the training is stopped.

[0073] Further, such as Figure 2 As shown, the key layer positioning processing and encryption after the federated learning model is trained include:

[0074] The federated learning architecture is trained, and each layer of the trained federated learning structure is distinguished from key layers and other layers by key layer positioning, and the key layers and other layers are encrypted respectively.

[0075] Specifically, Figure 2 (a) Training the federated learning architecture. During the training process of the machine learning model, determining which layers are the key layers of the model is crucial to the performance of the model, such as Figure 2 After the client has completed the training of the model, they will have data for training and testing, as well as a trained machine learning model. To identify these key layers, the client will adopt a strategy of making substitutions in the parameters of the model to evaluate the impact of different layers on the model accuracy, such as Figure 2(c) is shown in the figure. Specifically, the client will randomly select t layers from the n parameter layers of the model. They will then use random matrices to replace the parameters of these selected layers, a process that simulates the situation where a malicious attacker attempts to construct the parameters of the key layers. However, since the attacker does not have access to the client's private data, they cannot verify whether these constructed parameters are correct. Therefore, the client needs to rely on its own local test set to evaluate the impact of these replacement parameters on the accuracy of the model. After performing parameter replacement, the client will test the accuracy of the model using the local test set. By comparing the model performance of different replacement layers, the client can identify those layers that have the greatest impact on the accuracy of the model. These layers are considered to be the key layers of the model because their parameters have a significant impact on the overall performance of the model. Once the clients have identified these key layers, they will conduct a voting process for the key layer index. In this process, all clients will share the key layer indexes they have identified and vote. Finally, through the voting mechanism, t layers will be agreed upon as the key layers of the model. This step ensures that the selection of key layers is verified and agreed upon by multiple parties, thereby increasing the security and reliability of the model. After the key layers are determined, subsequent training will perform homomorphic encryption on these key layers and embed information. Homomorphic encryption is a special encryption method that allows calculations to be performed directly on encrypted data without decryption, which is critical for protecting the client's privacy data. By applying homomorphic encryption on key layers, it can be ensured that sensitive information will not be leaked even during model training and inference.

[0076] Furthermore, the encrypted layer is embedded with additional user information to obtain the secret-carrying model ciphertext including:

[0077] After the key layer is encrypted, the first stage of reversible embedding is performed to embed the user's additional information to obtain the user-side key layer ciphertext; after the other layers are encrypted, the other layer ciphertexts are obtained; the user-side key layer ciphertext is combined with the other layer ciphertexts to obtain the secret model ciphertext.

[0078] Specifically, Figure 3 As shown in FIG. 1 , the server and client Paillier encryption and watermarking process occurs when the client uploads model parameters to the server after training and when the server sends aggregated data to the client after aggregation.

[0079] Phase 1: After the client training is completed, the model is encrypted and uploaded, including the following steps:

[0080] Step 1: The client separates the negotiated key layer from other layers;

[0081] Step 2: Perform differential privacy random perturbations on other layers;

[0082] Step 3: Choose the parameters w of the key layer W i Encryption and embedding;

[0083] Step 4: Embed information m and divide it into blocks (m 1 ,m 2 ,m 3 …m n ), a total of n blocks, refresh variables The parameter w of the key layer i Use formula (4) to encrypt and generate the ciphertext c i ;

[0084] Step 5: If LSN(n,c i )=m i , then go to step 6, otherwise go to step 4;

[0085] Step 6: If i=n, ​​execute step 7, otherwise select the i+1th parameter embedding of the matrix and execute step 3;

[0086] Step 7: Merge the key layer and the common layer and upload them to the server.

[0087] Furthermore, the secret-carrying model is securely aggregated on the server side to obtain the aggregated model ciphertext, including:

[0088] The user-side key layer ciphertext and the other layer ciphertexts are securely aggregated on the server side to obtain the aggregate model ciphertext.

[0089] Specifically, Figure 3 Stage 2 shown: The server receives the uploaded parameters and executes the aggregation parameters and secondary embedding information, including the following steps:

[0090] Step 1: Receive all model parameter information uploaded by clients (W c1 ,W c2 ,W c3 …W cμ )(assuming there are μ clients);

[0091] Step 2: Extract model parameter embedding information in the key layer, m i =LSB(n,c i ), merge(m 1 ,m 2 ,m 3 …m n ), obtain embedded information, perform verification or authentication, etc.

[0092] Step 3: Divide the server information m into blocks (m 1 ,m 2 ,m 3 …m n), a total of n blocks, for model parameter information (W c1 ,W c2 ,W c3 …W cμ ) for aggregation

[0093] Step 4: Select key layers The parameter w i Embed

[0094] Step 5: Use Paillier's pk to refresh the variables Use formula (4) to encrypt integers 0, c 0 =Enc(0,r);

[0095] Step 6: If LSN(n,w i +c 0 )=m i , then go to step 7, otherwise go to step 5;

[0096] Step 7: If i=n, ​​execute step 8, otherwise select the i+1th parameter embedding of the matrix and execute step 4;

[0097] Step 8: Embed the W st Restore to W s and sent to the client.

[0098] Further, embedding the aggregate model ciphertext into the server additional information to obtain the secret-carrying aggregate ciphertext includes:

[0099] The aggregation model ciphertext is divided into key layer ciphertext and other layer ciphertext, and the server additional information is reversibly embedded into the key layer ciphertext of the aggregation model ciphertext through the second stage to obtain the secret-carrying key layer ciphertext of the server side, and the secret-carrying key layer ciphertext of the server side is merged with the other layer ciphertexts of the aggregation model ciphertext to obtain the secret-carrying aggregation ciphertext.

[0100] Specific as Figure 3 Phase 3 shown: The client receives the sent aggregation parameters and replaces the local model parameters, including the following steps:

[0101] Step 1: Receive the aggregation parameter W sent by the server s ;

[0102] Step 2: Extract model parameter embedding information, m i =LSB(n,c i ), merge(m 1 ,m 2 ,m 3 …m n ), obtain embedded information, perform verification or authentication, etc.

[0103] Step 3: Adjust the model parameters W s Decryption W = (w 1 ,w 2 …w n-t ,Dec(w 1 ),Dec(w 2 )…Dec(w t )), and divide the decrypted model parameter W by W avg =W / μ;

[0104] Step 4: Use W avg Update the user local model.

[0105] Furthermore, the present invention also includes performing a first-stage information extraction on the secret-carrying model ciphertext to obtain additional user information.

[0106] Furthermore, the present invention also includes performing a second stage of information extraction on the secret-carrying aggregate ciphertext to obtain additional server information.

[0107] An electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, a federated learning security aggregation method based on key layer positioning and reversible watermarking is implemented.

[0108] A specific example of the present invention is as follows:

[0109] The purpose of this paper is to demonstrate and analyze how to effectively select the key layers of the model and securely embed and extract model parameters through homomorphic encryption technology under the framework of federated learning through a series of experiments. The central goal of these experiments is to verify whether the proposed key layer selection scheme and parameter embedding scheme can maintain the integrity and accuracy of the model parameters while ensuring data privacy protection and improving model performance. The experimental environment and data set are shown in Table 2.

[0110] Table 2

[0111]

[0112]

[0113] In the experimental part, it was carried out under the configuration of a single machine and a single thread. The specific parameters of the single machine device are detailed in Table 2. All experiments were run in an environment with Python version 3.9 installed. In the experiment, the Paillier homomorphic encryption algorithm was used. This algorithm was implemented through Python's phe library, which is characterized by the ability to effectively homomorphically encrypt decimals. In addition, the framework of federated learning is built based on the PyTorch library. In order to simulate the environment of federated learning, the MNIST public dataset was selected. The MNIST dataset contains handwritten digits from 0 to 9, all of which are grayscale images. The dataset consists of 60,000 training images and 10,000 test images, each with a resolution of 28x28 pixels. Through experiments on this dataset, the performance and applicability of the federated learning algorithm can be effectively verified.

[0114] The experimental training model settings are shown in Table 3.

[0115] Table 3

[0116]

[0117] In the present invention, a convolutional neural network (CNN) model is designed and implemented for classifying handwritten digit images. The structure of the model is shown in detail in Table 3, which lists the type, input and output dimensions of each layer. The model can process grayscale images of size 28x28 pixels and process 256 samples per batch. The input of the model is [256,1,28,28], which means that 256 single-channel 28x28 pixel images are processed per batch. Through the combination of convolutional layers and activation layers, the model can extract the features of the image. Then, the spatial dimension of the features is reduced by the pooling layer, and overfitting is prevented by the discard layer. The flattening layer converts the multi-dimensional feature map into a one-dimensional feature vector to prepare for the input of the fully connected layer. The first fully connected layer reduces the feature vector from 9216 dimensions to 128 dimensions and introduces nonlinearity through the activation layer. The second fully connected layer further reduces the feature vector to 10 dimensions, corresponding to 10 classification categories. Finally, the probability distribution layer converts the output into a probability distribution using the LogSoftmax function for multi-classification tasks. The output of the model is [256,10], which represents the classification probability distribution of each batch of 256 samples. Each output vector contains 10 probability values, corresponding to 10 categories, and the category with the highest probability is the category predicted by the model.

[0118] The experimental hyperparameter settings are shown in Table 4.

[0119] Table 4

[0120]

[0121] In the present invention, a deep learning model containing multiple hyperparameters is used to train and evaluate the data set. Table 4 shows the key hyperparameters used in the model of the present invention and their specific values. These parameters are carefully selected after multiple experiments to ensure that the model can learn effectively and not overfit during the training process. During the model training process, 4 clients are used to simulate the distributed training environment. Each training cycle (epoch) represents a complete traversal of the entire data set by the model, and 10 cycles are set to ensure that the model has enough time to learn the data features. The learning rate is set to 0.5, which is a relatively high value that helps the model converge quickly in the early stage, but it also needs to be carefully adjusted to avoid excessive step size leading to unstable training. The batch size is set to 256, which is a balanced choice after considering computing resources and memory constraints. It can ensure the efficiency of model training without causing memory overflow due to excessive batch size. After the model is instantiated, a custom analysis tool is used to evaluate the number and size of parameters of the model to ensure that the complexity of the model is within a controllable range. The loss function selected is the cross entropy loss, which is a loss function commonly used in multi-classification problems. Its unreduced setting allows us to observe the loss of each sample, which helps to debug and optimize the model. Finally, the optimizer selects stochastic gradient descent (SGD), which is a simple and effective optimization algorithm suitable for training large-scale data sets.

[0122] In this experiment, a series of experiments are conducted to analyze and identify the key layers in the federated learning process. Key layers are those layers that have a significant impact on the model's prediction performance. Once their parameters are tampered with, the model performance will drop sharply. The purpose of this experiment is to identify these key layers and evaluate the vulnerability of the model under different numbers of key layers.

[0123] Experimental design

[0124] In the experiment, two cases are set: the number of critical layers t is selected as 1 and 2. Our goal is to evaluate the difficulty of the attacker to reconstruct the model parameters under these conditions and determine which layers are key to the model performance. The layers with parameters in the model are 2 convolutional layers and 2 fully connected layers, each of which contains a weight layer and a bias layer, so there are a total of 8 layers in the experiment. Layers (1, 2, 3, 4, 5, 6, 7, 8) correspond to convolutional layer 1 weight layer, convolutional layer 1 bias layer, convolutional layer 2 weight layer, convolutional layer 2 bias layer, fully connected layer 1 weight layer, fully connected layer 1 bias layer, fully connected layer 2 weight layer, fully connected layer 2 bias layer.

[0125] Experimental results when the number of key layers t is 1

[0126] Table 5 shows the experimental results when the number of critical layers t is 1. In the experiment, the 2nd, 4th, 6th, and 8th layers of the model were tested, and it was found that in these layers, the random matrix can completely replace the test layer of the model, which means that with only one critical layer, the attacker can relatively easily reconstruct the model parameters. However, when the test layer is the 5th layer, the overall accuracy of the model drops significantly to 0.0845, with a drop rate of 0.9105. Considering that the probability of random guessing in a ten-class task is about 0.1, this drop in accuracy indicates that the model has lost its practicality. Therefore, it can be determined that the 5th layer is a critical layer.

[0127] Table 5

[0128]

[0129] Experimental results when the number of key layers t is 2

[0130] Table 6 shows the experimental results when the number of key layers t is 2. In this case, it is observed that the overall model accuracy has dropped significantly, mainly distributed in the range of 0.1 to 0.2. In particular, the modification of layers 6 and 8 has little effect on the overall performance of the model. However, the modification of layers 6 and 7 has the greatest impact on the accuracy of model prediction, and the accuracy drops to 0.038, a decrease of 0.95, and the model has completely lost its usability. Therefore, layers 6 and 7 can be selected as key layers.

[0131] Table 6

[0132]

[0133]

[0134] Paillier homomorphic watermark aggregation and the first and second embedding experiments:

[0135] To simplify the presentation, this experiment selects specific parameters of three clients for operation. Specifically, we focus on the parameters of the i-th row and j-th column of the t-th layer. In the experiment, we use three decimal numbers as embedding information. This choice is based on the demand for embedding space in practical applications. In fact, all parameters in the layer can be embedded in this way, indicating that the embedding space of the model parameters is sufficient to meet our embedding requirements. The specific experimental data is shown in Table 7.

[0136] Table 7

[0137]

[0138] First embed operation

[0139] In the first embedding operation, the three participating users provided parameter values ​​22.3253, 2333, and -2.22 respectively. By summing these parameters, we get the result 2353.1053. This result is converted into a tuple, where the first number is the encrypted embedding result, and the second number is the marker bit set to adapt to the characteristic that the Paillier homomorphic encryption algorithm only processes integers, which is used to map decimals to integers.

[0140] By extracting the result of the first embedding operation, we quickly obtained the embedding information of three data: 041, 314, and 133. In the experiment, we tried to decrypt these three parameters and successfully restored the original parameter values ​​22.3253, 2333, and -2.22. However, it is worth noting that the server does not hold the private key of homomorphic encryption, so it is impossible to decrypt the encrypted parameters, which further ensures the security of the data.

[0141] Second embed operation

[0142] In the second embedding operation, the server selected the four-digit decimal number 6789 as the embedding information. This step is performed only on a single aggregate data, demonstrating the high-capacity nature of the embedding algorithm. After the server aggregates the parameters uploaded by the client, it performs the second embedding operation.

[0143] The experiment extracted the result of the second embedding operation and successfully recovered the 6789 embedded by the server. Furthermore, we decrypted the result after the second embedding, and the decrypted result was consistent with the sum of the three parameters uploaded by the client, thus verifying the accuracy and reliability of the embedding and extraction process.

[0144] Experimental results show that the proposed embedding scheme can effectively embed and extract information in model parameters without sacrificing parameter accuracy. This process not only demonstrates the potential of homomorphic encryption technology in protecting privacy, but also proves its application value in federated learning. In this way, effective model training and accurate parameter aggregation can be achieved while protecting data privacy, providing new perspectives and technical support for the development of federated learning.

[0145] The advantages of the present invention are as follows:

[0146] High security: This solution uses key layer selection and homomorphic encryption technology to encrypt and protect the model, which can effectively protect the model's parameters and intermediate results from being leaked.

[0147] Good privacy: This solution can protect the user's privacy information. The user's authentication information and embedded information are encrypted and protected, and only authorized users can access them.

[0148] Strong scalability: This solution can support multiple users to jointly train a model, and can securely aggregate the model, improving the training efficiency and accuracy of the model.

[0149] Good compatibility: This solution is compatible with the existing federated learning framework and does not require large-scale modifications to the existing system.

[0150] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A federated learning secure aggregation method based on key layer positioning and reversible watermarking, characterized in that: include: S1. Perform key layer positioning processing and encryption on the federated learning model after training; S2, embedding user extra information into the encrypted layer to obtain the secret-carrying model ciphertext; S3, obtaining user embedded information, and securely aggregating the secret-carrying model ciphertext on the server side to obtain the aggregated model ciphertext; S4. The server embeds the aggregate model ciphertext into the server additional information. The client obtains the aggregate ciphertext with secret information, decrypts it and obtains the aggregate model. The client returns to S1 for training again until the number of training rounds specified by the server is reached and the training is stopped.

2. The method for secure aggregation of federated learning based on key layer positioning and reversible watermarking as claimed in claim 1, characterized in that: The key layer positioning processing and encryption of the federated learning model after training include: The model parameters are trained, and each layer of the trained model parameters is distinguished from the key layer and other layers by key layer positioning, and the key layer and the other layers are encrypted respectively.

3. The method for secure aggregation of federated learning based on key layer positioning and reversible watermarking as claimed in claim 2, characterized in that: The encrypted layer is embedded with additional user information to obtain the secret model ciphertext including: After the key layer is encrypted, the first stage of reversible embedding is performed to embed the user's additional information to obtain the user-side key layer ciphertext; after the other layers are encrypted, the other layer ciphertexts are obtained; the user-side key layer ciphertext is combined with the other layer ciphertexts to obtain the secret model ciphertext.

4. The method for secure aggregation of federated learning based on key layer positioning and reversible watermarking as claimed in claim 1, characterized in that: The secure aggregation of the secret-carrying model ciphertext on the server side to obtain the aggregated model ciphertext includes: The user-side key layer ciphertext and the other layer ciphertexts are securely aggregated on the server side to obtain the aggregate model ciphertext.

5. The method for secure aggregation of federated learning based on key layer positioning and reversible watermarking as claimed in claim 1, characterized in that: The aggregation model ciphertext is embedded in the server additional information to obtain the secret aggregation ciphertext including: The aggregation model ciphertext is divided into key layer ciphertext and other layer ciphertext, and the server additional information is reversibly embedded into the key layer ciphertext of the aggregation model ciphertext through the second stage to obtain the secret-carrying key layer ciphertext of the server side, and the secret-carrying key layer ciphertext of the server side is merged with the other layer ciphertexts of the aggregation model ciphertext to obtain the secret-carrying aggregation ciphertext.

6. The method for secure aggregation of federated learning based on key layer positioning and reversible watermarking as claimed in claim 1, characterized in that: The method also includes performing a first-stage information extraction on the secret-carrying model ciphertext to obtain additional user information.

7. The method for secure aggregation of federated learning based on key layer positioning and reversible watermarking as claimed in claim 1, characterized in that: The method also includes performing a second-stage information extraction on the secret-carrying aggregate ciphertext to obtain additional server information.

8. An electronic device, characterized in that: The device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the federated learning security aggregation method based on key layer positioning and reversible watermarking as described in any one of claims 1-7.

Images