Federal learning method for model quality evaluation based on functional encryption

Abstract

The invention provides a federated learning method for model quality evaluation based on functional encryption, and the method comprises the steps: a server selects a plurality of clients to establish a federated learning protocol, and generates a main public key and a main private key; for a given global model, the server computes a global model update and processes the global model update to an integer domain, and computes a decryption key in combination with the master private key. The server sends the global model and the main public key to the selected client; and the client calculates local model update by using the global model, processes the local model update to an integer field, generates a ciphertext in combination with the main public key, and sends the ciphertext to the server. And the server decrypts the ciphertext by using the decryption key, and calculates the cosine similarity between the decrypted client local model and the server global model. Client models are divided into a high-quality model, a qualified model and a low-quality model through cosine similarity clustering, weights are distributed, and a global model is updated by a server through weighted aggregation. According to the invention, model quality evaluation can be carried out on the basis of high efficiency and privacy protection, so that global model updating is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of privacy protection in machine learning, and specifically relates to a federated learning method for model quality assessment based on functional encryption. Background Art

[0002] With the development of artificial intelligence, the demand for large amounts of high-quality training data continues to increase. However, people are increasingly concerned about privacy protection issues, and directly exchanging raw data is no longer appropriate. Federated learning (FL) is a distributed machine learning framework that has attracted widespread attention because it allows servers and multiple clients to jointly train models without directly exchanging data. Specifically, federated learning is completed through multiple rounds of cooperative training between servers and clients. In each round, the server sends the global model to each client; the client uses the local data set to train to generate local model updates and uploads them to the server; the server aggregates the local updates of the client to iterate the global model. The training process is repeated many times until the global model converges or the stopping condition is met.

[0003] Nowadays, FL has been applied to many privacy-sensitive industries, such as disease prediction and finance. However, existing work shows that FL still has the risk of privacy leakage. Although there are some privacy protection schemes for FL, most of these methods ignore an inherent problem of FL, namely statistical heterogeneity. Statistical heterogeneity stems from the uneven quality of data, which is caused by objective factors such as the quality of client devices and educational background, which may affect the convergence of the global model. In addition, some malicious clients may deliberately manipulate local models for improper benefits, resulting in reduced accuracy of the global model. Summary of the invention

[0004] In view of this, the present invention provides a federated learning method for model quality assessment based on functional encryption, which can perform model quality assessment on the basis of efficiency and privacy protection, assign weights according to the quality assessment results, and realize the update of the global model through weighted aggregation.

[0005] In order to solve the above technical problems, the present invention is implemented as follows.

[0006] A federated learning method for model quality assessment based on functional encryption is implemented using a federated learning framework. The method includes:

[0007] Step 1: The server selects multiple clients to establish a federated learning protocol and generates a master public key mpk and a master private key msk;

[0008] Step 2: The server calculates the first global model update y for the given global model θ, normalizes it and processes it to the integer domain to obtain the second global model update ny; calculates the decryption key sk based on the second global model update ny and the master private key msk y ;

[0009] Step 3: The server sends the global model θ and the master public key mpk to C selected clients; the client uses the global model θ to calculate the first local model update x, normalizes it and processes it to the integer domain to obtain the second local model update nx; according to the second local model update nx and the master public key mpk, the encrypted local model update, i.e., the ciphertext Ct, is generated and sent to the server;

[0010] Step 4: The server uses the decryption key sk y Decrypt the ciphertext Ct, and calculate the cosine similarity between the decrypted local model updates of each client and the global model update of the server;

[0011] Step 5: Cluster the cosine similarities corresponding to each client, and divide the client models into high-quality models, qualified models, and low-quality models; discard the low-quality models, assign a set large weight to the high-quality models, and assign weights to the qualified models according to the distance between the qualified models and the true value;

[0012] Step 6: The server updates the global model through weighted aggregation based on the assigned weights.

[0013] Preferably, in step 2, the normalization is performed and processed into the integer domain to obtain the second global model update ny as follows: the first global model update y is normalized and multiplied by the scaling factor M to obtain ny: |y| means modulo y.

[0014] Preferably, in step 2, the normalization is performed and processed into the integer domain to obtain the second local model update nx as follows: the first local model update x is normalized and multiplied by the scaling factor M to obtain nx: |x| means modulo x.

[0015] Preferably, the cosine similarity between the decrypted local model update of each client and the client global model calculated in step 4 is:

[0016] The ciphertext received from client A is Ct = (ct0, ct1, ... ct l ), the second global model of the same client A calculated by the server in step 2 is updated to ny = (ny1, ny2, ... ny l ); l is the dimension of the secret key used for function encryption;

[0017]

[0018] In the formula, cos<x,y> is the cosine similarity of client A, and M is the scaling factor used in steps 2 and 3 to update the model to the integer domain.

[0019] Preferably, the step 5 specifically includes:

[0020] Perform 2-clustering and g-clustering on the cosine similarity corresponding to each client;

[0021] If the cosine similarity of a client does not belong to any category in the g cluster or the 2 cluster, the client model is identified as a low-quality model;

[0022] If the cosine similarity of a client belongs to the second largest cluster in cluster g and is assigned a category in cluster 2, the client model is identified as a high-quality model and assigned a weight of 1;

[0023] If a client does not meet the above two conditions, the client model will be identified as a qualified model, and the weight will be assigned based on the distance between the cosine similarity and the maximum centroid, with a weight less than 1 assigned to it. The closer the distance, the greater the weight.

[0024] Beneficial effects:

[0025] (1) The present invention uses functional encryption for the model quality assessment method, which greatly improves the computational efficiency of the method and reduces the communication cost compared to the prior art. Compared to the prior art, the computational efficiency is improved by 25% and the communication cost is reduced by 70%.

[0026] (2) The present invention can achieve privacy protection. For the server, if it wants to obtain the client's local update x, it needs to crack the functional encryption algorithm based on the DDH assumption, which is difficult for the server; since the dimension of the model vector is large, the server knows cos<x,y> Nor can any specific x value be calculated from it; therefore, client information is safe from the server. Malicious data is filtered out in the model quality assessment scheme, and malicious clients cannot attack the global model by tampering with local updates, so other client information cannot be inferred, and information between clients is safe.

[0027] (3) The present invention clusters the cosine similarity between the local model update and the client global model, and evaluates the model quality based on the clustering results. The clustering scheme combines 2-clustering and g-clustering, and designs three division conditions to divide the models into high-quality models, qualified models, and low-quality models. For high-quality models, considering that the reference value of the largest cluster in K-means clustering is not high, the client in the second largest cluster of g-clustering is selected as the high-quality model, and a large weight is directly assigned; for qualified models, weights are assigned according to the distance from the maximum centroid, thereby achieving effective evaluation of model quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a structural diagram of the federated learning method for model quality assessment based on functional encryption in the present invention.

[0029] Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0030] Functional encryption (FE) is a class of cryptographic primitives that can finely control the amount of information revealed to a given recipient through a ciphertext. Specifically, in a functional encryption scheme, anyone can encrypt a message with a public key, and the decrypted result is a specific function that is only related to the decryption key and the message. Functional encryption can precisely control that the decryption party only gets the function value without revealing anything else.

[0031] The present invention designs an architecture that can securely calculate cosine similarity based on functional encryption, thereby performing efficient and privacy-preserving federated learning model quality assessment, and further realizing federated learning.

[0032] In order to achieve the above object, the present invention adopts the following technical solutions.

[0033] First, the relevant concepts are explained.

[0034] Definition 1: Server

[0035] The server is the owner of the global model in federated learning and implements the training of the global model by cooperating with multiple clients. During the training process, the server evaluates the data quality of the client before obtaining the client's plaintext data through the model quality evaluation method.

[0036] Definition 2: Client

[0037] The client is a participant in federated learning. It has access to the data needed for model training and assists the server in training the global model.

[0038] In this invention, two types of entities are considered: server and client. It is assumed that the server is honest but curious, and the client may be malicious. The detailed description of the threat model is as follows:

[0039] Honest but curious server: The server will strictly follow the protocol process, but will try to obtain sensitive data from the client by analyzing existing information.

[0040] Malicious clients: Clients will not only try to infer sensitive data of other clients through the protocol, but also try to disrupt the execution of the protocol and tamper with the uploaded data to obtain some improper benefits, thereby damaging the global model.

[0041] Based on the above definition, see Figure 1 and Figure 2 The federated learning method for model quality assessment based on functional encryption proposed in the present invention comprises the following steps:

[0042] Step 1: System initialization.

[0043] In this step, the server selects C clients to establish a federated learning protocol, after which the server generates the master public key mpk and master private key msk required for functional encryption.

[0044] Specifically, given the system's security parameter 1 λ and dimension 1 l , l is the dimension of the secret key used for functional encryption, and the following steps are performed: the length of p;

[0045] According to safety parameter 1 λ , use the integer cyclic group generating function GroupGen to generate the integer cyclic group G: calculate the parameters G, p, f:

[0046] G,p,f←GroupGen(1 λ )

[0047] Generate a random vector s in the cyclic group of integers G:

[0048] s=(s1,…,s l )←Z p

[0049] Using the master private key msk and the generator f, calculate the master public key mpk:

[0050]

[0051] Master private key msk = s;

[0052] This step obtains the master public key mpk=(h1,…,h l ) and the master private key msk=(s1,…,s l).

[0053] Where GroupGen represents the integer cyclic group generating function, G represents an integer cyclic group, p represents the order of the group G, λ is the order dimension, f represents the generator of the integer cyclic group G; s is a randomly generated dimension of 1 in the group l The vector of Z p Represents a domain of integers.

[0054] Step 2: Server pre-computation.

[0055] In this step, the server first calculates the global model update y for a given global model θ, and then preprocesses the global model update, including normalizing and processing it to the integer domain, to obtain the global model update ny; the decryption key sk is calculated based on the processed global model update ny and the master private key msk y .

[0056] Specifically, given the global model θ, the server dataset D S , scaling factor M; obtain the master private key msk through step 1, and perform the following steps:

[0057] First, calculate the global model update y:

[0058] y←ModelUpdate(θ,D S )

[0059] Then normalize y and multiply it by the scaling factor M, so that ny, which was originally floating point data, belongs to the integer domain and can be processed by functional encryption. The scaling factor M can be selected as 10 6 Number of magnitude:

[0060]

[0061] Here, |·| represents a modulo operation.

[0062] Calculate the decryption key sk y :

[0063]

[0064] Among them, ModelUpdate represents the model update function, and the server updates the model based on the global model θ and the server dataset D S Calculate the global model update y; ny represents the global model update after normalization and scaling factor M; sk y Represents the decryption key calculated from ny and msk.

[0065] Step 3: Client local training.

[0066] In this step, the server sends the global model θ and the master public key mpk to each selected client. Each selected client first calculates the local model update x, and then preprocesses the local model update, including normalizing and processing it to the integer domain, obtains the processed local model update nx, and encrypts the processed local model update nx with the master public key mpk, and sends the encrypted ciphertext Ct to the server.

[0067] Specifically, given the global model θ, the client dataset D C , scaling factor M, received from the server master public key mpk and generator f, perform the following steps:

[0068] Compute the local model update x:

[0069] x←ModelUpdate(θ,D C )

[0070] Normalize x and multiply by the scaling factor M:

[0071]

[0072] Generate a random integer r:

[0073] r←Z p

[0074] Calculate the ciphertext Ct, that is, the encrypted local model update:

[0075] ct0=f r

[0076]

[0077] Ct=(ct0,ct1,…ct l )

[0078] In the above formula, h i The ith element in the master public key mpk is the ciphertext Ct.

[0079] ModelUpdate represents the model update function, and the client updates the model based on the global vector θ and the client dataset D C Calculate the local model update x; nx represents the local model update after normalization and scaling factor M; r represents a randomly generated integer; Ct represents the encrypted local model update.

[0080] Step 4: Calculation of server model quality assessment criteria.

[0081] In this step, the server receives the ciphertext Ct sent by the client and uses the decryption key sk yDecrypt and calculate the cosine similarity between the global model update and the client local model update. Use cosine similarity as a criterion for evaluating the quality of the local model.

[0082] Specifically, step 2 obtains the global model update ny, and the encrypted local model update Ct is sent from the client. The decryption key sk is known. y , scaling factor M, perform the following steps:

[0083] The ciphertext received from client A is written as Ct = (ct0, ct1, ... ct l ), the global model update of the same client A calculated by the server in step 2 is denoted as ny = (ny1, ny2, ... ny l );

[0084] Then the cosine similarity calculated for the encrypted local model uploaded by client A is:

[0085]

[0086] In the formula, cos<x,y> is the cosine similarity of client A, and M is the scaling factor used in steps 2 and 3 to update the model to the integer domain.

[0087] Perform the above operation for each client and obtain the corresponding cosine similarity, which is recorded as {S} = (S1,…,S C ). Where {S} represents the set of cosine similarities S between the local model updates and the global model updates of all clients.

[0088] Step 5: Federated learning model aggregation.

[0089] In this step, the server updates and assigns weights to each local model based on cosine similarity through a clustering algorithm. This process clusters the cosine similarities corresponding to each client, and divides the client models into three categories based on the clustering results, namely high-quality models, qualified models, and low-quality models; then discards the low-quality models, and assigns weights to qualified models and high-quality models. Among them, a high-quality model is assigned a large weight, such as 1; for qualified models, a weight less than 1 is assigned. Then the server updates the global model through weighted aggregation based on the assigned weights.

[0090] Specifically, the client set is {C}, the client cosine similarity set is {S}, the client local model update is x, the global model is θ, and the following steps are performed:

[0091] Step a: Perform 2-clustering and g-clustering on the cosine similarity corresponding to each client. The number of clusters in 2-clustering is 2, and the number of clusters in g-clustering is g. The clustering algorithm can adopt the K-means clustering algorithm.

[0092] The appropriate value of the number of clusters g is calculated as follows: g starts at 2 and finds the minimum g that satisfies the following conditions:

[0093] Gap(g)-Gap(g+1)+σ g+1 ≥0

[0094] Among them, Gap is the clustering result comparison function, which calculates the difference between the total cohesion of the real data clustering results and the total cohesion of the randomly generated data; σ g+1 Represents the standard error related to g+1; the condition that g needs to satisfy is that the difference between the Gap value of the current cluster number g and the Gap value of the next cluster number g+1 is greater than the standard error σ g+1 , then the current number of clusters g is considered appropriate.

[0095] Use the K-means clustering algorithm to cluster cosine similarity into g clusters:

[0096] N1,P1=K_Means({S},g);

[0097] P best =Max(P1);

[0098] Return N1,P1,P best .

[0099] Use K-means clustering algorithm to cluster cosine similarity into 2 classes:

[0100] N2,P2=K_Means({S},2);

[0101] Return to N2, P2.

[0102] Where N1 represents the category number of all clients in the cluster with cluster number g; P1 represents the centroid of each category in the cluster with cluster number g; P best represents the maximum value among the centroids of all categories; N2 represents the category number of all clients in the cluster with a cluster number of 2; P2 represents the centroid of each category in the cluster with a cluster number of 2; K_Means represents the clustering function, which performs aggregation based on the client cosine similarity set {S} and the cluster number g;

[0103] Step b: If the cosine similarity of a client does not belong to any category in g clusters or 2 clusters, the client model is identified as a low-quality model; if the cosine similarity of a client belongs to the second largest cluster in g clusters and is assigned a category in 2 clusters, the client model is identified as a high-quality model and the weight assigned is 1; if a client does not meet the above two conditions, the client model is identified as a qualified model, and the weight assigned is based on the distance between the cosine similarity and the maximum centroid, and a weight less than 1 is assigned to it. The closer the distance, the greater the weight.

[0104] The specific implementation of this step is:

[0105] For each client i, the cosine similarity S i , perform the following judgment to divide it into three categories:

[0106] If N1[i] = 0 or N2[i] = 0, that is, it is not clustered in cluster g, nor in cluster 2, it is classified as low-quality data, and the weight w is set. i =0;

[0107] If N1[i]=g-1 and N2[i]≠0, it is classified as high-quality data, and the weight is maximized, w i =1;

[0108] Otherwise, it is classified as qualified data, and the weight is set according to the distance between the cosine similarity of the qualified model and the true value:

[0109]

[0110] Among them, |S i -P best | represents the distance between the cosine similarity of each client and the maximum centroid of the g cluster (considered to be the true value).

[0111] The logic of data quality classification based on the above aggregation results is that if a data does not belong to any category in the g cluster or the 2 cluster, it is considered that the data has a large deviation and is low-quality data, and the weight assigned is 0, which is equivalent to discarding the data; if a data belongs to the second largest cluster g-1 in the g cluster and is assigned a category in the 2 cluster, it is considered that the data quality is high and is high-quality data, and the weight assigned is 1; if none of the above conditions are met, the data quality is considered to be medium and is qualified data, and the weight assigned is based on the distance between the cosine similarity and the maximum centroid, which is {w i} represents the weight set of all clients.

[0112] The above server completes the evaluation of the client model quality under the condition of privacy protection. After that, the server selectively purchases or obtains the client's plaintext in other ways according to actual needs. The client sends the local update under the plaintext to the server, and the server updates the global model through weighted aggregation according to the weight; the server weighted aggregation is:

[0113] W=∑ i∈{c} w i

[0114]

[0115] Where W is the sum of the weights of all clients.

[0116] The above steps are then repeated multiple times, including server pre-computation, client local training, server model quality assessment, and federated learning model aggregation, until the global model converges.

[0117] The solution proposed in this invention is privacy-protective for honest but curious servers and malicious clients. The specific security analysis is as follows:

[0118] For the server, before assigning weights, only the encrypted client local update Ct and cosine similarity cos can be obtained.<x,y> To obtain the local update x, it is necessary to crack the functional encryption algorithm based on the DDH assumption, which is difficult for the server. In addition, due to the large dimension of the model vector, the server knows cos<x,y> and y cannot be calculated from them to any specific value of x. So in theory, the server cannot infer anything about the client's local update x.

[0119] For the client, since malicious data is filtered out in the model quality assessment scheme, malicious clients cannot attack the global model by tampering with local updates. At the same time, during the execution of the scheme, the client can only obtain the global model in addition to its own local updates, so it cannot infer other client data.

[0120] The above specific embodiments only describe the design principle of the present invention. The shapes and names of the components in the description may be different and are not limited. Therefore, those skilled in the art in the field of the present invention may modify or replace the technical solutions recorded in the above embodiments; and these modifications and replacements do not deviate from the creative purpose and technical solutions of the present invention and should all fall within the protection scope of the present invention.

Claims

1. A federated learning method for model quality assessment based on functional encryption, characterized in that: The method is implemented using a federated learning framework and includes: Step 1: The server selects multiple clients to establish a federated learning protocol and generates a master public key mpk and a master private key msk; Step 2: The server calculates the first global model update y for the given global model θ, normalizes it and processes it to the integer domain to obtain the second global model update ny; calculates the decryption key sk based on the second global model update ny and the master private key msk y ; Step 3: The server sends the global model θ and the master public key mpk to C selected clients; the client uses the global model θ to calculate the first local model update x, normalizes it and processes it to the integer domain to obtain the second local model update nx; according to the second local model update nx and the master public key mpk, the encrypted local model update, i.e., the ciphertext Ct, is generated and sent to the server; Step 4: The server uses the decryption key sk y Decrypt the ciphertext Ct, and calculate the cosine similarity between the decrypted local model updates of each client and the global model update of the server; Step 5: Cluster the cosine similarities corresponding to each client, and divide the client models into high-quality models, qualified models, and low-quality models; discard the low-quality models, assign a set large weight to the high-quality models, and assign weights to the qualified models according to the distance between the qualified models and the true value; Step 6: The server updates the global model through weighted aggregation based on the assigned weights.

2. The method according to claim 1, characterized in that In step 2, the normalization is performed and processed to the integer domain to obtain the second global model update ny: the first global model update y is normalized and multiplied by the scaling factor M to obtain ny: |y| means modulo y.

3. The method according to claim 1, characterized in that In step 2, the normalization is performed and processed to the integer domain to obtain the second local model update nx: the first local model update x is normalized and multiplied by the scaling factor M to obtain nx: |x| means modulo x.

4. The method according to claim 1, 2 or 3, characterized in that: The cosine similarity between the decrypted local model updates of each client and the client global model calculated in step 4 is: The ciphertext received from client A is Ct = (ct0, ct1, ... ct l ), the second global model of the same client A calculated by the server in step 2 is updated to ny = (ny1, ny2, ... ny l );l is the dimension of the secret key used for function encryption; In the formula, cos<x,y> is the cosine similarity of client A, and M is the scaling factor used in steps 2 and 3 to update the model to the integer domain.

5. The method according to claim 1, characterized in that The step 5 specifically includes: Perform 2-clustering and g-clustering on the cosine similarity corresponding to each client; If the cosine similarity of a client does not belong to any category in the g cluster or the 2 cluster, the client model is identified as a low-quality model; If the cosine similarity of a client belongs to the second largest cluster in cluster g and is assigned a category in cluster 2, the client model is identified as a high-quality model and assigned a weight of 1; If a client does not meet the above two conditions, the client model will be identified as a qualified model, and the weight will be assigned based on the distance between the cosine similarity and the maximum centroid, with a weight less than 1 assigned to it. The closer the distance, the greater the weight.

Images