A federated learning method for model quality evaluation based on functional encryption

Abstract

The disclosure provides a federated learning method for model quality evaluation based on functional encryption, in which a server selects a plurality of clients to establish a federated learning protocol, generates a master public key and a master private key; the server calculates a global model update for a given global model and processes it to an integer domain, and calculates a decryption key in combination with the master private key. The server sends the global model and the master public key to the selected clients; the clients calculate a local model update using the global model and process it to an integer domain, and generate ciphertext in combination with the master public key and send it to the server. The server decrypts the ciphertext using the decryption key, and calculates the cosine similarity between the decrypted client local model and the server global model. Through cosine similarity clustering, the client models are divided into high-quality, qualified and low-quality models and are assigned weights, and the server updates the global model through weighted aggregation. Using the present application, model quality evaluation can be performed on the basis of high efficiency and privacy protection, and then global model updating is realized.

Description

Technical Field

[0001] This invention belongs to the field of machine learning privacy protection technology, specifically relating to a federated learning method for model quality evaluation based on functional encryption. Background Technology

[0002] With the development of artificial intelligence, the demand for large amounts of high-quality training data is constantly increasing. However, people are paying more and more attention to privacy protection issues, making the direct exchange of raw data inappropriate. Federated learning (FL) is a distributed machine learning framework that has attracted widespread attention because it allows servers and multiple clients to jointly train models without directly exchanging data. Specifically, federated learning is completed through multiple rounds of collaborative training between servers and clients. In each round, the server sends the global model to each client; the client trains using its local dataset to generate local model updates and uploads them to the server; the server aggregates the local updates from the clients to iterate the global model. This training process is repeated many times until the global model converges or meets the stopping condition.

[0003] Today, Field-Based Learning (FL) is applied in many privacy-sensitive industries, such as disease prediction and finance. However, existing work indicates that FL still carries the risk of privacy breaches. Although some privacy protection schemes exist for FL, most of these methods ignore an inherent problem of FL: statistical heterogeneity. Statistical heterogeneity stems from the inconsistent quality of data, caused by objective factors such as the quality of client devices and educational backgrounds, which can affect the convergence of the global model. Furthermore, some malicious clients may deliberately manipulate local models for illicit gains, leading to a decrease in the accuracy of the global model. Summary of the Invention

[0004] In view of this, the present invention provides a federated learning method for model quality evaluation based on functional encryption, which can perform model quality evaluation efficiently and with privacy protection, assign weights according to the quality evaluation results, and update the global model through weighted aggregation.

[0005] To solve the above-mentioned technical problems, the present invention is implemented as follows.

[0006] A federated learning method for model quality evaluation based on functional encryption, implemented using a federated learning framework, includes:

[0007] Step 1: The server selects multiple clients to establish a federated learning protocol and generates a master public key mpk and a master private key msk;

[0008] Step 2: For a given global model θ, the server calculates the first global model update y, normalizes it, and processes it to the integer field to obtain the second global model update ny; based on the second global model update ny and the master private key msk, the server calculates the decryption key sk. y ;

[0009] Step 3: The server sends the global model θ and the master public key mpk to C selected clients; the clients use the global model θ to calculate the first local model update x, normalize it and process it to the integer field to obtain the second local model update nx; based on the second local model update nx and the master public key mpk, they generate the encrypted local model update, i.e., the ciphertext Ct, and send it to the server.

[0010] Step 4: The server uses the decryption key sk y The ciphertext Ct is decrypted, and the cosine similarity between the decrypted client-local model updates and the server-global model updates is calculated.

[0011] Step 5: Cluster the cosine similarity of each client to classify the client models into high-quality models, qualified models and low-quality models; discard low-quality models, assign large weights to high-quality models, and assign weights to qualified models based on their distance from the ground truth.

[0012] Step 6: The server updates the global model by weighted aggregation based on the assigned weights.

[0013] Preferably, in step 2, the normalization and processing to the integer domain to obtain the second global model update ny is: normalizing the first global model update y and multiplying it by the scaling factor M to obtain ny: |y| represents taking the modulus of y.

[0014] Preferably, in step 2, the normalization and processing to the integer domain to obtain the second local model update nx is: normalizing the first local model update x and multiplying it by the scaling factor M to obtain nx: |x| represents taking the modulus of x.

[0015] Preferably, in step 4, the cosine similarity between the decrypted client-local model updates and the client-global model is calculated as follows:

[0016] The ciphertext received from client A is Ct = (ct0, ct1, ... ct1) l In step 2, the server updates the second global model for the same client A to ny = (ny1, ny2, ... ny). l ); l represents the dimension of the key used in functional encryption;

[0017]

[0018] In the formula, cos<x,y> Let M be the cosine similarity of client A, and M be the scaling factor used in steps 2 and 3 to update the model to the integer domain.

[0019] Preferably, step 5 specifically includes:

[0020] Perform 2-clustering and g-clustering on the cosine similarity of each client;

[0021] If a client's cosine similarity does not belong to either g-cluster or 2-cluster, the client model is considered a low-quality model.

[0022] If a client's cosine similarity belongs to the second largest cluster in the g cluster and is assigned to a certain category in the 2 cluster, then the client model is considered a high-quality model and assigned a weight of 1.

[0023] If a client does not meet the above two conditions, the client model is considered a qualified model, and the weight is assigned based on the distance between the cosine similarity and the maximum centroid, with a weight less than 1. The closer the distance, the larger the weight.

[0024] Beneficial effects:

[0025] (1) This invention applies functional encryption to the model quality assessment method, which significantly improves the computational efficiency and reduces communication costs compared to existing technologies. It improves computational efficiency by 25% and reduces communication costs by 70% compared to existing technologies.

[0026] (2) This invention can achieve privacy protection. For the server, to obtain the client's local update x, it is necessary to crack the functional encryption algorithm based on the DDH assumption, which is difficult for the server; due to the large dimension of the model vector, the server knows cos<x,y> Neither y nor y can be used to calculate any specific x value; therefore, client information is secure to the server. Malicious data is filtered out in the model quality assessment scheme, preventing malicious clients from attacking the global model by tampering with local updates. Therefore, it is impossible to infer information from other clients, and information between clients is secure.

[0027] (3) This invention clusters the cosine similarity between the local model update and the client's global model, and evaluates the model quality based on the clustering results. The clustering scheme combines binary clustering and g-clustering, and designs three partitioning conditions to classify the models into high-quality models, qualified models, and low-quality models. For high-quality models, considering that the largest cluster in K-means clustering has low reference value, the client in the second largest cluster of g-clustering is selected as a high-quality model and directly assigned a large weight. For qualified models, the weight is assigned according to the distance from the largest centroid, thereby achieving an effective evaluation of model quality. Attached Figure Description

[0028] Figure 1 This is a structural diagram of the federated learning method for model quality evaluation based on functional encryption, as described in this invention.

[0029] Figure 2 This is a flowchart of the present invention. Detailed Implementation

[0030] Functional encryption (FE) is a class of cryptographic primitives that allows for precise control over the amount of information revealed to a given recipient from ciphertext. Specifically, in a functional encryption scheme, anyone can encrypt a message using a public key, and the decryption result is a specific function that depends only on the decryption key and the message itself. Functional encryption precisely controls the information received by the decryptor, revealing only the function value without disclosing any other content.

[0031] This invention designs an architecture based on functional encryption that can securely compute cosine similarity, thereby enabling efficient and privacy-preserving quality evaluation of federated learning models and ultimately achieving federated learning.

[0032] To achieve the above objectives, the present invention adopts the following technical solutions.

[0033] First, the relevant concepts will be explained.

[0034] Definition 1: Server

[0035] The server, acting as the owner of the global model in federated learning, collaborates with multiple clients to train the global model. During training, the server evaluates the quality of the client's data using model quality assessment methods before receiving the client's plaintext data.

[0036] Definition 2: Client

[0037] The client is a participant in federated learning, possessing the data needed for model training and assisting the server in training the global model.

[0038] In this invention, two types of entities are considered: servers and clients. It is assumed that the server is honest but curious, while the client may be malicious. A detailed description of the threat model is as follows:

[0039] An honest but curious server: The server will strictly follow the protocol process, but will attempt to obtain sensitive data from the client by analyzing existing information.

[0040] Malicious clients: Clients not only attempt to infer sensitive data from other clients through the protocol, but also try to disrupt the execution of the protocol and tamper with uploaded data to gain illegitimate benefits, thereby damaging the global model.

[0041] Based on the above conceptual definitions, see Figure 1 and Figure 2 The federated learning method for model quality evaluation based on functional encryption proposed in this invention includes the following steps:

[0042] Step 1: System initialization.

[0043] In this step, the server selects C clients to establish a federated learning protocol. After that, the server generates the master public key mpk and master private key msk required for functional encryption.

[0044] Specifically, given the system's security parameter 1 λ And Dimension 1 l , l represents the dimension of the key used for functional encryption, and the following steps are performed: the length of p;

[0045] According to safety parameter 1 λ Generate an integer cyclic group G using the integer cyclic group generating function GroupGen: Calculate the parameters G, p, f:

[0046] G,p,f←GroupGen(1 λ )

[0047] Randomly generate a vector s within the integer cyclic group G:

[0048] s=(s1,…,s l )←Z p

[0049] Using the master private key msk and the generator f, calculate the master public key mpk:

[0050]

[0051] Master private key msk = s;

[0052] This step obtained the master public key mpk = (h1,…,h l ) and master private key msk = (s1,…,s l).

[0053] Where GroupGen represents the generating function of the cyclic group of integers, G represents a cyclic group of integers, p represents the order of the group G, λ is the order dimension, f represents the generator of the cyclic group of integers G, and s is a random element of dimension 1 generated within the group. l The vector of Z; p Represents the integer field.

[0054] Step 2: Server pre-calculation.

[0055] In this step, for a given global model θ, the server first calculates the global model update y, then preprocesses the global model update, including normalization and processing to the integer field, to obtain the global model update ny; and calculates the decryption key sk based on the processed global model update ny and the master private key msk. y .

[0056] Specifically, given a global model θ, the server dataset D S Scaling factor M; obtain the master private key msk through step 1, and perform the following steps:

[0057] First, calculate the global model update y:

[0058] y←ModelUpdate(θ,D S )

[0059] Next, y is normalized and multiplied by a scaling factor M, so that ny, which was originally floating-point data, belongs to the integer field and can be processed using functional encryption. The scaling factor M can be chosen to be 10. 6 Numbers on the order of magnitude:

[0060]

[0061] Where |·| represents the modulo operation.

[0062] Calculate the decryption key sk y :

[0063]

[0064] Here, ModelUpdate represents the model update function, which the server updates based on the global model θ and the server dataset D. S Calculate the global model update y; ny represents the global model update after normalization and scaling factor M; sk y This represents the decryption key generated by ny and msk.

[0065] Step 3: Local training on the client side.

[0066] In this step, the server sends the global model θ and the master public key mpk to each selected client. Each selected client first calculates the local model update x, then preprocesses the local model update, including normalization and processing to the integer field, to obtain the processed local model update nx, and encrypts the processed local model update nx with the master public key mpk, and sends the encrypted ciphertext Ct to the server.

[0067] Specifically, given a global model θ, the client dataset D C Given the scaling factor M, the master public key mpk and generator f received from the server, the following steps are performed:

[0068] Calculate the local model update x:

[0069] x←ModelUpdate(θ,D C )

[0070] Normalize x and multiply by the scaling factor M:

[0071]

[0072] Generate a random integer r:

[0073] r←Z p

[0074] Calculate the ciphertext Ct, i.e., the encrypted local model update:

[0075] ct0 = f r

[0076]

[0077] Ct = (ct0, ct1, ... ct) l )

[0078] In the above formula, h i The i-th element in the master public key mpk is used to obtain the ciphertext Ct.

[0079] Where ModelUpdate represents the model update function, which is based on the global vector θ and the client dataset D. C Calculate the local model update x; nx represents the local model update after normalization and scaling factor M; r represents a randomly generated integer; Ct represents the encrypted local model update.

[0080] Step 4: Calculate the server model quality assessment criteria.

[0081] In this step, the server receives the ciphertext Ct sent by the client and decrypts it using the decryption key sk. yDecrypt and calculate the cosine similarity between the global model update and the client's local model update. Use the cosine similarity as a criterion for evaluating the quality of the local model.

[0082] Specifically, in step 2, the global model update ny is obtained, and the encrypted local model update Ct is sent from the client, with the decryption key sk known. y Given the scaling factor M, perform the following steps:

[0083] Write the ciphertext received from client A as Ct = (ct0, ct1, ... ct1) l In step 2, the global model update calculated by the server for the same client A is denoted as ny = (ny1, ny2, ... ny). l );

[0084] The cosine similarity of the encrypted local model uploaded by client A is then calculated as follows:

[0085]

[0086] In the formula, cos<x,y> Let M be the cosine similarity of client A, and M be the scaling factor used in steps 2 and 3 to update the model to the integer domain.

[0087] Perform the above operation for each client to obtain the corresponding cosine similarity, denoted as {S} = (S1, ..., S2). C Here, {S} represents the set of cosine similarities S between the local model updates and the global model updates for all clients.

[0088] Step 5: Federated learning model aggregation.

[0089] In this step, the server updates and assigns weights to each local model based on cosine similarity using a clustering algorithm. This process clusters the cosine similarity of each client, classifying client models into three categories: high-quality models, acceptable models, and low-quality models. Low-quality models are then discarded, and weights are assigned to acceptable and high-quality models. High-quality models are assigned a large weight, for example, 1; acceptable models are assigned a weight less than 1. The server then updates the global model using weighted aggregation based on these assigned weights.

[0090] Specifically, the client set is {C}, the client cosine similarity set is {S}, the client local model update is x, the global model is θ, and the following steps are performed:

[0091] Step a: Perform binary clustering and g-clustering on the cosine similarity of each client. Binary clustering results in 2 clusters, and g-clustering results in g clusters. K-means clustering can be used as the clustering algorithm.

[0092] The appropriate value for the cluster number g is calculated as follows: g starts from 2, and the smallest g that satisfies the following conditions is found:

[0093] Gap(g)-Gap(g+1)+σ g+1 ≥0

[0094] Where Gap is a clustering result comparison function, calculating the difference between the total cohesion of the actual data clustering results and the total cohesion of the randomly generated data; σ g+1 The standard error related to g+1 is represented; g needs to satisfy the condition that the difference between the gap value of the current cluster number g and the gap value of the next cluster number g+1 is greater than the standard error σ. g+1 If so, then the current number of clusters g is considered appropriate.

[0095] The cosine similarity is clustered into g classes using the K-means clustering algorithm:

[0096] N1,P1=K_Means({S},g);

[0097] P best =Max(P1);

[0098] Return N1, P1, P best .

[0099] The cosine similarity was clustered into two classes using the K-means clustering algorithm:

[0100] N2,P2=K_Means({S},2);

[0101] Return N2, P2.

[0102] Where N1 represents the class number of all clients in a cluster with number g; P1 represents the centroid of each class in a cluster with number g; P best N1 represents the maximum centroid of all categories; N2 represents the category number of all clients in a cluster with 2 clusters; P2 represents the centroid of each category in a cluster with 2 clusters; K_Means represents the clustering function, which aggregates based on the client cosine similarity set {S} and the number of clusters g.

[0103] Step b: If a client's cosine similarity does not belong to either the g-cluster or the 2-cluster, the client model is considered a low-quality model; if a client's cosine similarity belongs to the second largest cluster in the g-cluster and is assigned to a category in the 2-cluster, the client model is considered a high-quality model and assigned a weight of 1; if a client does not meet the above two conditions, the client model is considered a qualified model, and the weight is assigned based on the distance between the cosine similarity and the largest centroid, assigning a weight less than 1, with the closer the distance, the larger the weight.

[0104] The specific implementation of this step is as follows:

[0105] For each client i, the data cosine similarity S i The following judgments are applied to classify them into three categories:

[0106] If N1[i] = 0 or N2[i] = 0, meaning it is not in a cluster of cluster g or in a cluster of cluster 2, it is classified as low-quality data, and the weight w is set to 0. i =0;

[0107] If N1[i] = g-1 and N2[i] ≠ 0, divide the data into high-quality data, and maximize the weights, w. i =1;

[0108] Otherwise, the data is classified as qualified, and the weights are set based on the distance between the cosine similarity of the qualified model and the true value.

[0109]

[0110] Among them, |S i -P best | represents the distance between the cosine similarity of each client and the maximum centroid of the g cluster (considered to be the true value).

[0111] The logic for classifying data quality based on aggregation results is as follows: If a data point does not belong to either the g-cluster or the 2-cluster, it is considered to have a large bias and is low-quality data, assigned a weight of 0, essentially discarding the data. If a data point belongs to the second largest cluster g-1 in the g-cluster and is assigned to a category in the 2-cluster, it is considered to have high quality data, assigned a weight of 1. If none of the above conditions are met, the data is considered to have medium quality and is acceptable data, with the weight assigned based on the distance between the cosine similarity and the largest centroid. {w i} represents the set of weights for all clients.

[0112] The above servers completed the client model quality assessment while protecting privacy. Afterwards, the servers selectively purchase or otherwise obtain plaintext from the clients based on actual needs. The clients send local updates in plaintext to the servers, and the servers update the global model through weighted aggregation based on weights. The server's weighted aggregation is as follows:

[0113] W = ∑ i∈{c} w i

[0114]

[0115] Where W is the sum of the weights of all clients.

[0116] The above steps are then repeated multiple times, namely server pre-computation, client local training, server model quality evaluation, and federated learning model aggregation, until the global model converges.

[0117] The proposed solution offers privacy protection against both honest but curious servers and malicious clients. A detailed security analysis is as follows:

[0118] For the server, only encrypted client-local updates of Ct and cosine similarity cos can be obtained before weights are assigned.<x,y> To obtain a local update x, it is necessary to crack the functional encryption algorithm based on the DDH assumption, which is difficult for the server. Furthermore, due to the large dimension of the model vectors, the server knows cos...<x,y> From y, no specific value of x can be calculated. Therefore, theoretically, the server cannot infer any information about the client's local update of x.

[0119] For the client, because the model quality assessment scheme filters out malicious data, malicious clients cannot attack the global model by tampering with local updates. Furthermore, during the scheme's execution, clients can only access the global model besides their own local updates, thus preventing them from inferring data from other clients.

[0120] The specific embodiments described above only illustrate the design principles of the present invention. The shapes and names of the components in this description may differ and are not limited. Therefore, those skilled in the art can modify or make equivalent substitutions to the technical solutions described in the foregoing embodiments; and these modifications and substitutions do not depart from the inventive spirit and technical solutions of the present invention, and should all fall within the protection scope of the present invention.

Claims

1. A federated learning method for model quality evaluation based on functional encryption, characterized in that, This method is implemented using a federated learning framework and includes: Step 1: The server selects multiple clients to establish a federated learning protocol and generates a master public key mpk and a master private key msk; Step 2: The server computes the first global model update y for a given global model θ, normalizes and processes to the integer domain to obtain the second global model update ny; computes the decryption key sk from the second global model update ny and the master secret key msk y ; Step 3: The server sends the global model θ and the master public key mpk to C selected clients; the clients use the global model θ to calculate the first local model update x, normalize it and process it to the integer field to obtain the second local model update nx; based on the second local model update nx and the master public key mpk, they generate the encrypted local model update, i.e., the ciphertext Ct, and send it to the server. Step 4: The server decrypts the ciphertext Ct with the decryption key sk y decrypts the ciphertext Ct, and calculates the cosine similarity between the decrypted local model update of each client and the server global model update. Step 5: Cluster the cosine similarity of each client to classify the client models into high-quality models, qualified models and low-quality models; discard low-quality models, assign large weights to high-quality models, and assign weights to qualified models based on their distance from the ground truth. Step 6: The server updates the global model by weighted aggregation based on the assigned weights.

2. The method as described in claim 1, characterized in that, In step 2, the normalization and processing to the integer domain to obtain the second global model update ny is: normalizing the first global model update y and multiplying it by the scaling factor M to obtain ny: |y| represents taking the modulus of y.

3. The method as described in claim 1, characterized in that, In step 2, the normalization and processing to the integer domain to obtain the second local model update nx is: normalizing the first local model update x and multiplying it by the scaling factor M to obtain nx: |x| represents taking the modulus of x.

4. The method as described in claim 1, 2, or 3, characterized in that, The cosine similarity between the decrypted client-local model updates and the client-global model calculated in step 4 is as follows: The ciphertext received from the client A is Ct=(ct0, ct1, …ct l ), and the server calculates the second global model update of the same client A as ny=(ny1, ny2, …ny l ) in step 2; l is the dimension of the function encryption key. In the formula, cos<x,y> Let M be the cosine similarity of client A, and M be the scaling factor used in steps 2 and 3 to update the model to the integer domain.

5. The method as described in claim 1, characterized in that, Step 5 specifically includes: Perform 2-clustering and g-clustering on the cosine similarity of each client; If a client's cosine similarity does not belong to either g-cluster or 2-cluster, the client model is considered a low-quality model. If a client's cosine similarity belongs to the second largest cluster in the g cluster and is assigned to a certain category in the 2 cluster, then the client model is considered a high-quality model and assigned a weight of 1. If a client does not meet the above two conditions, the client model is considered a qualified model, and the weight is assigned based on the distance between the cosine similarity and the maximum centroid, with a weight less than 1. The closer the distance, the larger the weight.

Images