Privacy protection longitudinal federated learning method and system based on function encryption

Abstract

The invention relates to the field of federated learning security, and provides a privacy protection longitudinal federated learning method and system based on function encryption. According to the method, the problems that in a longitudinal federated learning scene, when privacy protection is achieved based on the cryptography technology, the calculation time is too long, the communication overhead is too large, and the model accuracy and the training overhead are difficult to balance are solved. The main scheme comprises system initialization, client forward propagation, server forward propagation, server backward propagation and client backward propagation. The method is used for privacy protection longitudinal federated learning, gradient leakage attacks and reverse derivation attacks based on model parameters are effectively resisted through a decentralized multi-client function encryption algorithm and a longitudinal federated learning framework, the calculation efficiency is improved, meanwhile, the model precision is guaranteed, the communication overhead is reduced, and the privacy of client sample data is enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of vertical federated learning security, and provides a privacy-preserving vertical federated learning method and system based on function encryption, which are used for privacy-preserving vertical federated learning. Background Art

[0002] Federated Learning (FL) is an emerging distributed machine learning technology that enables multiple parties to jointly build and train machine learning models without directly sharing raw data, thereby effectively protecting data privacy. Federated learning is divided into horizontal federated learning and vertical federated learning according to the overlap of samples held by each participant. In the scenario of vertical federated learning (VFL), each participant usually has the same sample space, but different feature spaces, that is, their data overlap in the sample dimension, but complement each other in the feature dimension. This data distribution feature makes VFL very suitable for scenarios that require cross-institutional cooperation, such as medical diagnosis, financial services and other fields, where the data involved often contains sensitive information and should not be shared directly.

[0003] Compared with centralized machine learning, VFL keeps the original data locally, and only the intermediate results of the model calculation are transmitted between the participants, thereby reducing the risk of data leakage. However, as the research deepens, scholars have found that even in this distributed training mode, the VFL system still faces potential threats of privacy leakage, including but not limited to model parameter reverse derivation attacks and gradient information leakage attacks. Some existing privacy protection technologies have been proposed and applied to vertical federated learning, such as differential privacy, gradient compression, multi-party secure computing, and partially homomorphic encryption. However, the research of Zhuohang Li et al. shows that methods such as differential privacy and gradient compression are difficult to resist inference attacks caused by gradient leakage. In contrast, multi-party secure computing and partially homomorphic encryption can provide higher model accuracy but require higher computing and communication overhead.

[0004] As an emerging privacy protection technology, function encryption is gaining more and more attention because it provides a better balance between security and performance. Compared with traditional privacy protection technologies (such as secure multi-party computation, differential privacy, and partially homomorphic encryption), function encryption not only allows users to decrypt to obtain complete plaintext information, but also allows users holding specific decryption keys to obtain specific function values ​​of encrypted data without leaking any other plaintext information. However, the function encryption technologies currently used in vertical federated learning all require the support of an absolutely trusted third-party agency (TPA), which is difficult to achieve in real scenarios. In addition, due to the characteristics of function encryption technology, when decrypting the function results of a batch of encrypted data, the decryptor needs to request a decryption key specific to the function from the TPA, which has spawned a variety of inference attacks against FE in VFL scenarios. The decryptor (usually an aggregator) can request the decryption keys of multiple functions to obtain the results of multiple function calculations, and thus infer the privacy information of ciphertext data from other participants based on these results.

[0005] Therefore, the prior art has the following technical problems:

[0006] 1. Insufficient protection of data privacy;

[0007] 2. Function encryption technology used in vertical federated learning requires the support of an absolutely credible third-party organization;

[0008] 3. These methods either reduce the accuracy of model calculation or increase communication and computational overhead. Summary of the invention

[0009] In response to the above research issues, the purpose of the present invention is to provide a privacy-preserving vertical federated learning method based on function encryption, eliminating the dependence on absolutely trustworthy third-party organizations, and solving the problem that existing methods are difficult to balance model accuracy with computing and communication overhead, and lack the strength of data privacy protection.

[0010] In order to achieve the above object, the present invention adopts the following technical solution:

[0011] A privacy-preserving vertical federated learning method based on function encryption includes the following steps:

[0012] Step S1. The vertical federated learning system consists of M participants, of which the first participant is the initiator of the task and acts as the server and the first client at the same time, and the remaining participants act as clients. The server generates public parameters for distributed multi-client function encryption based on given security parameters, and initializes a global model with a linear layer as the output layer. The server distributes the public parameters of the encryption algorithm and the input layer model parameters of the segmented global model to each client;

[0013] Step S2. The client generates a client key based on the received encryption algorithm public parameters and some parameters of the global model input layer model and initializes the local model;

[0014] Step S3. All participants jointly and secretly generate their own random mask vectors So that∑ m∈[M] T m =0;

[0015] Step S4. Client m based on random mask vector T m Calculate partial function decryption key dk m , and dk m Send to the server;

[0016] Step S5. The server decrypts the key dk based on the partial function of all clients m Aggregation generates a function decryption key dk;

[0017] Step S6. The client calculates the local model output based on the local sample, and uploads the encrypted output result ciphertext and the randomly perturbed sample data to the server;

[0018] Step S7. The server receives the ciphertext output by the local model uploaded by each client, decrypts the aggregated result of all ciphertexts, and performs subsequent model calculation and model gradient calculation based on the decrypted aggregated result;

[0019] Step S8. The server updates the local model parameters based on the calculated model gradient;

[0020] Step S9. The server calculates the randomly perturbed client model gradient based on the randomly perturbed client sample and sends it back to the corresponding client;

[0021] Step S10: The client receives the randomly perturbed local model gradient sent back by the server, and updates the local model based on the local model gradient after removing the perturbation.

[0022] Further, the specific steps of step S1 are:

[0023] S1.1. The server selects a 2λ-bit prime number p based on a given security parameter λ;

[0024] S1.2. The server constructs the first additive cyclic group G1, the second additive cyclic group G2 and the third additive cyclic group G based on the prime number p. T ;

[0025] S1.3. The server obtains and generates P1 and P2 based on the first addition cycle group and the second addition cycle group;

[0026] S1.4. The server constructs a bilinear map based on three additive cyclic groups

[0027] S1.5. The server constructs a mapping to the first additive cyclic group G1. The hash function H1;

[0028] S1.6. The server is based on the third addition cycle group G T Construct a T The group elements in are mapped to the dictionary dic on Z;

[0029] S1.7. The server initializes the input layer as a global model of the linear layer, and divides the input layer model parameters W according to the sample dimensions of each participant, dividing them vertically into W = {W1, ..., W M};

[0030] S1.8. The server takes the public parameters (G1, G2, p, P1, P2, e, H1) and the input layer model parameters W m Distribute to clients m, m∈{1,...,M}.

[0031] Further, the specific steps of step S2 are:

[0032] S2.1. Client m receives the model parameters W from the server m As initial parameters of the local model;

[0033] S2.2. Client m uniformly randomly selects 2 random numbers Get the private key sk m =s m .

[0034] Further, the specific steps of step S4 are:

[0035] S4.1. Client m calculates the partial function decryption key dk m =[d m ]2=[s m +T m ]2, where [*] i Indicates * in group G i Mapping on ;

[0036] S4.2. Client m will calculate dk m Sent to the server. Clients acting as servers do not need to send this message.

[0037] Further, the specific steps of step S5 are:

[0038] After the server receives the partial function decryption key sent by all clients, it calculates Get the function decryption key dk and keep it.

[0039] Further, the specific steps of step S6 are:

[0040] S6.1. Client m selects a batch of local private samples X m , then uniformly randomly select a random number r from {1, ..., p} m as a mask and calculate and Get the sample matrix after mask perturbation and the output matrix f of the local local model m ;

[0041] S6.2. Client m selects a timestamp as l m , and calculate and Get the matrix f m The ciphertext is

[0042] S6.3. Client m ciphers the model output value Timestamp m and The client that also acts as a server only needs to perform the previous calculation process and does not need to perform the sending process.

[0043] Further, the specific steps of step S7 are:

[0044] S7.1. The server receives the local model output ciphertext and timestamp l sent by all clients m , m∈{2,...,M}, and then first check the l sent by each client m Is it the same as your own? If there is a client's l m If the timestamps received are different from their own or more than M-1 timestamps are received, it means that the data received in this round of training is incorrect, and this round of training is invalid; if the l m If they are the same as their own, then select the same sample X1 and calculate the ciphertext output by its local model in the same way Then calculate Get the ciphertext C after the aggregation of the output results of each local model f ;

[0045] S7.2. The server queries the dictionary dic to obtain the ciphertext C f The corresponding plaintext f is used as the aggregated result of the output results of each client;

[0046] S7.3. The server continues to calculate the output of the final global model and uses the sample labels to calculate the global model loss value.

[0047] Further, the specific steps of step S9 are:

[0048] The server is based on the gradient of the input layer output value calculate Get the perturbed model gradients of client m and send them back to the corresponding client.

[0049] Further, the specific steps of step S10 are:

[0050] Client m receives its perturbed local model gradient After that, the number of samples in the batch bn is counted and the local model gradient is calculated. And using the gradient Update its local model.

[0051] A privacy-preserving vertical federated learning system based on function encryption, including a client and a server:

[0052] The server includes:

[0053] System initialization module: Generate decentralized multi-client function encryption public parameters based on given security parameters, inform all clients, and jointly generate a mask vector unique to each client; initialize the input layer as a global model of the linear layer, and vertically divide the input layer model parameters to each participant according to the sample dimensions of each participant as the initialization parameters of their local models; receive the partial function decryption keys calculated by each client and aggregate them to generate a complete function decryption key.

[0054] Model forward propagation module: Receives the ciphertext of the local model output values ​​calculated by all participants, aggregates them and decrypts them using the function decryption key to obtain the input layer model output, and performs subsequent model calculations and calculations of the global model loss value.

[0055] Model backpropagation module: Based on the global model loss value, the chain rule is used to recursively calculate the gradient of the model held by the server and the gradient of the output value of the output layer; the model gradient is updated using the principle of gradient descent, and combined with the perturbed sample data of each client, the perturbed client model gradient is calculated and sent back to the corresponding client.

[0056] The client includes:

[0057] System initialization model: Receive the public parameters of the decentralized multi-client function encryption algorithm sent by the server, and initialize its own function encryption key based on this parameter; secretly negotiate a respective random mask with the server and other clients, and generate a partial function decryption key based on this random mask, and send it to the server; receive the model parameters sent by the server, and initialize the local model based on this parameter.

[0058] Model forward propagation module: Calculate the local model output result based on the local sample, and encrypt it with the function encryption key to obtain its ciphertext; select a random mask to perturb the local sample; send the ciphertext of the local model output result and the perturbed sample to the client.

[0059] Model back propagation module: receives the disturbed local model parameters sent by the server, de-perturbs them, and updates the local model parameters using the gradient descent principle based on the de-perturbed model gradients.

[0060] Furthermore, it also includes:

[0061] Each client needs to be synchronized in time, that is, the timestamp selected by each client in each round of model training should be the same; model optimization is performed based on gradient descent optimization algorithms during model training; the entire vertical federated learning will repeat the forward propagation and backward propagation calculation process until the model converges or the number of training rounds set by the system is reached.

[0062] Compared with the prior art, the present invention has the following beneficial effects:

[0063] The present invention is based on decentralized multi-client function encryption technology, which solves the problems of client data privacy leakage and gradient leakage during model training in the process of vertical federated learning. While ensuring that the model accuracy is not affected, it reduces the communication overhead and time overhead of the entire system during model training, and can effectively resist gradient leakage attacks and reverse deduction attacks based on model parameters; and the vertical federated learning method proposed in the present invention is suitable for training any machine learning or deep learning model with a linear layer as the input layer using a gradient descent optimization algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a flow chart of the privacy-preserving vertical federated learning method based on function encryption. DETAILED DESCRIPTION

[0065] The present invention will be further described below in conjunction with the accompanying drawings and specific implementation methods.

[0066] In the process of federated learning, since uploading plaintext gradients will leak user privacy and the server may tamper with the aggregated global model, this method can be used to achieve secure privacy protection and verifiable aggregation results. This method is based on two cryptographic technologies, multi-key homomorphic encryption and vector homomorphic hashing, which effectively protects the confidentiality and integrity of information, and provides security protection for the federated learning process, enriching its application scenarios.

[0067] 1. System initialization:

[0068] The server first uses a polynomial time pairing group generation algorithm PGGen to generate a pairing group for decentralized function encryption. Input the security parameter λ and use PGGen to generate an asymmetric pairing group PG = (G1, G2, p, P1, P2, e), where G1, G2, is the additive cyclic group of prime numbers p of order 2λ-bit, P1 and P2 are generators of groups G1 and G2 respectively, e: is a computationally efficient bilinear map, and then choose a map to The global hash function H1 is used to obtain the master public key mpk = (PG, H1) of the decentralized function encryption, which is also a public parameter. The server initializes the model and divides the input layer parameters of the model vertically into W = {W1, ..., W M}, the divided W m Assign it to participant m and inform all clients of the public parameters. A small-scale dictionary dic is established on the group (mapping from points on the group to real values) to facilitate efficient solution of the discrete logarithm problem during decryption.

[0069] Each participant m, m∈{1, .., M}, initializes the local model with the input layer parameters assigned by the server and uniformly randomly selects 2 random numbers Get the private key sk m =s m . Then secretly negotiate with other participants to come up with a random mask vector So that∑ m∈[M] T m =0, and calculate the partial function decryption key DK m Sent to the server, where [*] i Indicates * in group G i Mapping on [expr] i Indicates that expr is in group G i The server receives the partial function decryption key dk of all participants. m After that, the function decryption key is calculated and retain.

[0070] 2. Client forward propagation:

[0071] Assume that the dataset is divided into B batches, each batch contains bn samples, and client m selects a batch of local privacy samples X b，m , b∈{1,...,B}, and then uniformly randomly select a random number r from {1,...,p} m As a mask, calculate and Get the masked sample matrix and the output matrix f of the local local model b，m . Then, select the timestamp as l m ,calculate Get the matrix f b，m The ciphertext is And the ciphertext of the model output value l m and Sent to the server together, where [*] i Indicates * in group G i Mapping on [expr] i Indicates that expr is in group G i Note that during the forward propagation, all participants select the same samples for calculation, and their time is synchronized, that is, the timestamp l they select is also the same.

[0072] 3. Server forward propagation:

[0073] After the server receives the local model output ciphertext and timestamp l from all clients, it first checks whether the timestamps sent by each client are the same as its own. If the timestamp of a client is different from its own or more than M-1 timestamps are received, it means that the data received in this round of training is incorrect, and this round of training is invalid; if the timestamps of all clients are the same as its own, the same sample X is selected. b，1 And calculate the ciphertext output by its local model in the same way Then calculate Get the ciphertext of the aggregated output results of each local model, and finally indirectly solve the discrete logarithm by querying the dictionary dic to get the input f of the server model b The server continues to calculate the final output of the global model and uses the sample labels to calculate the global model loss value.

[0074] 4. Server back propagation:

[0075] The server uses the chain rule to recursively calculate the gradient of the server model and the gradient of the input layer output value (that is, the gradient of the local model output value of each participant), and then use the server model gradient to update the server model, Calculate the gradient of the server's local model and update the local model. Finally, the server calculates the perturbed local model gradient of client m (m∈{2,...,M}) And send it back to client m.

[0076] 5. Client back propagation:

[0077] Client m receives the local model gradient after its perturbation After that, the model gradient is calculated And using the gradient Update its local model.

[0078] In order to ensure the data privacy of all participants and collaborate with all participants to safely train a machine learning or deep learning model, the present invention adopts a decentralized function encryption algorithm to achieve privacy protection of client data during forward propagation during model training; and adopts a random number perturbation method to achieve privacy protection of client model gradients during backward propagation during model training. The present invention achieves a good balance between high privacy requirements, model calculation accuracy, and computational and communication overhead during model training. Compared with other existing solutions, it can provide stronger privacy, lossless model calculation, and lower computational and communication overhead.

[0079] In summary, the present invention has the following characteristics:

[0080] 1. The present invention adopts a longitudinal federated learning calculation method based on decentralized multi-client function encryption. The method does not require the support of any trusted third-party organization. The output ciphertext of the encrypted calculation is indistinguishable and can resist adaptive destruction under the classic Decisional Diffie-Hel Iman assumption. At the same time, it can provide higher computing efficiency without affecting the accuracy of the model.

[0081] Second, the present invention adopts a novel vertical federated learning architecture, which saves the input layer model parameters on the client side when the model is initialized. During the model backpropagation calculation, it can provide higher computing efficiency and require less communication overhead, while further improving the privacy of client sample data;

[0082] 3. The vertical federated learning architecture adopted by the present invention uses a gradient descent algorithm as a model optimization algorithm and supports any machine learning or deep learning model with a linear layer as the input layer;

[0083] 5. The present invention combines a decentralized multi-client function encryption algorithm and a vertical federated learning framework, which can effectively resist gradient leakage attacks and reverse deduction attacks based on model parameters.

[0084] The above are only representative embodiments of the present invention in many specific application scopes, and do not constitute any limitation on the protection scope of the present invention. Any technical solutions formed by transformation or equivalent replacement fall within the protection scope of the present invention.

Claims

1. A privacy-preserving vertical federated learning method based on function encryption, characterized in that: The steps include: Step S1. includes M participants, of which the first participant is the initiator of the task and acts as the server and the first client at the same time, and the remaining participants all act as clients. The server generates the public parameters of the distributed multi-client function encryption algorithm based on the given security parameters, and initializes a global model with a linear layer as the output layer. The server distributes the public parameters of the encryption algorithm and the input layer model parameters of the segmented global model to each client; Step S2. The client generates a client key based on the received encryption algorithm public parameters and some parameters of the global model input layer model and initializes the local model; Step S3. All participants jointly and secretly generate their own random mask vectors So that∑ m∈[M] T m =0, where represents a 2-dimensional p-order cyclic group; Step S4. Client m based on random mask vector T m Calculate partial function decryption key dk m , and dk m Send to the server; Step S5. The server decrypts the key dk based on the partial function of all clients m Aggregation generates a function decryption key dk; Step S6. The client calculates the local model output based on the local sample, and uploads the encrypted output result ciphertext and the randomly perturbed sample data to the server; Step S7. The server receives the ciphertext output by the local model uploaded by each client, decrypts the aggregated result of all ciphertexts, and performs subsequent model calculation and model gradient calculation based on the decrypted aggregated result; Step S8. The server updates the local model parameters based on the calculated model gradient; Step S9. The server calculates the randomly perturbed client model gradient based on the randomly perturbed client sample and sends it back to the corresponding client; Step S10: The client receives the randomly perturbed local model gradient sent back by the server, and updates the local model based on the local model gradient after removing the perturbation.

2. According to claim 1, a privacy-preserving vertical federated learning method based on function encryption is characterized in that: The specific steps of step S1 are: Step S1.

1. The server selects a 2λ-bit prime number p based on a given security parameter λ; Step S1.

2. The server constructs the first additive cyclic group G1, the second additive cyclic group G2 and the third additive cyclic group G based on the prime number p. T ; Step S1.

3. The server obtains generation P1 and P2 based on the first additive cyclic group and the second additive cyclic group, where P1 and P2 are generators of groups G1 and G2 respectively; Step S1.

4. The server constructs a bilinear map based on three additive cyclic groups Step S1.

5. The server constructs a mapping from arbitrary length strings to The hash function H1; Step S1.

6. The server performs the following operations based on the third addition cycle group G. T Construct a T The group elements in are mapped to the dictionary dic on Z, where Z represents the domain of integers; Step S1.

7. The server initializes the input layer as a global model of the linear layer, and divides the input layer model parameter W according to the sample dimension of each participant, vertically dividing it into W = {W1, ..., W M }; Step S1.

8. The server takes the public parameters (G1, G2, p, P1, P2, e, H1) and the input layer model parameters W m Distribute to clients m, m∈{1,..,M}.

3. According to claim 2, a privacy-preserving vertical federated learning method based on function encryption is characterized in that: The specific steps of step S2 are: Step S2.

1. Client m receives the input layer model parameters W from the server m As initial parameters of the local model; Step S2.

2. Client m uniformly randomly selects 2 random numbers Get the private key sk m =s m , where s m，1 ,s m，2 Respectively 2 random numbers in .

4. According to claim 3, a privacy-preserving vertical federated learning method based on function encryption is characterized in that: The specific steps of step S4 are: Step S4.

1. Client m calculates the partial function decryption key dk m =[d m ]2=[s m +T m ]2, where [*] i Indicates * in group G i The mapping on T m represents the random mask vector of client m, d m represents a point on the G2 group; Step S4.

2. Client m will calculate dk m Sent to the server. Clients acting as servers do not need to send this message.

5. According to claim 4, a privacy-preserving vertical federated learning method based on function encryption is characterized in that: The specific steps of step S5 are: After the server receives the partial function decryption key sent by all clients, it calculates Get the function decryption key dk and keep it.

6. A privacy-preserving vertical federated learning method based on function encryption according to claim 5, characterized in that: The specific steps of step S6 are: Step S5.

1. Client m selects a batch of local private samples x m , then uniformly randomly select a random number r from {1, ..., p} m as a mask and calculate and Get the sample matrix after mask perturbation and the output matrix f of the local local model m ,in W m The transpose of T represents the transpose of *; Step S5.

2. Client m selects a timestamp as l m , and calculate and Get the matrix f m The ciphertext is in Indicates l m The transpose of a 2D vector mapped to the group G1; Step S5.

3. Client m ciphers the model output value Timestamp m and The client that also acts as a server only needs to perform the previous calculation process and does not need to perform the sending process.

7. A privacy-preserving vertical federated learning method based on function encryption according to claim 6, characterized in that: The specific steps of step S7 are: Step S7.

1. The server receives the local model output ciphertext and timestamp l sent by all clients m , m∈{2,...,M}, and then first check the l sent by each client m Is it the same as your own? If there is a client's l m If the timestamps received are different from their own or more than M-1 timestamps are received, it means that the data received in this round of training is incorrect, and this round of training is invalid; if the l m If they are the same as their own, then select the same sample X1 and calculate the ciphertext output by its local model in the same way Then calculate Get the ciphertext C after the aggregation of the output results of each local model f ; Step S7.

2. The server queries the dictionary dic to obtain the ciphertext C f The corresponding plaintext f is used as the aggregated result of the output results of each client; Step S7.

3. The server continues to calculate the output of the final global model, and uses the sample labels to calculate the global model loss value and the model gradient except the input layer.

8. According to claim 7, a privacy-preserving vertical federated learning method based on function encryption is characterized in that: The specific steps of step S9 are: The server is based on the gradient of the input layer output value calculate Get the perturbed model gradient of client m and send it back to the corresponding client, Represents the perturbation value of the local model gradient; The specific steps of step S10 are: Client m receives its perturbed local model gradient After that, the number of samples in the batch bn is counted and the local model gradient is calculated. And using the gradient Update its local model.

9. A privacy-preserving vertical federated learning system based on function encryption, characterized in that: Including client and server: The server includes: System initialization module: Generate decentralized multi-client function encryption public parameters based on given security parameters, inform all clients, and jointly generate a mask vector unique to each client; initialize the input layer as a global model of the linear layer, and divide the input layer model parameters vertically according to the sample dimensions of each participant to each participant as the initialization parameters of their local model; receive the partial function decryption keys calculated by each client and aggregate them to generate a complete function decryption key; Model forward propagation module: Receives the ciphertext of the local model output values ​​calculated by all participants, aggregates them and decrypts them using the function decryption key to obtain the input layer model output, and performs subsequent model calculations and calculations of the global model loss value. Model back propagation module: Based on the global model loss value, the gradient of the model held by the server and the gradient of the output value of the output layer are recursively calculated using the chain rule; the model gradient is updated using the principle of gradient descent, and the perturbed sample data of each client is combined to calculate the perturbed client model gradient, and it is sent back to the corresponding client; The client includes: System initialization model: Receive the public parameters of the decentralized multi-client function encryption algorithm sent by the server, and initialize its own function encryption key based on this parameter; secretly negotiate a random mask with the server and other clients, and generate a partial function decryption key based on this random mask, and send it to the server; receive the model parameters sent by the server, and initialize the local model based on this parameter; Model forward propagation module: Calculate the local model output result based on the local sample, and encrypt it with the function encryption key to obtain its ciphertext; select a random mask to perturb the local sample; send the ciphertext of the local model output result and the perturbed sample to the client; Model back propagation module: receives the disturbed local model parameters sent by the server, de-perturbs them, and updates the local model parameters using the gradient descent principle based on the de-perturbed model gradients.

10. The privacy-preserving vertical federated learning system based on function encryption according to claim 9, characterized in that: Each client needs to be synchronized in time, that is, the timestamp selected by each client in each round of model training should be the same; During model training, the model is optimized based on the optimization algorithm of gradient descent; The entire vertical federated learning will repeat the forward propagation and backward propagation calculation process until the model converges or the number of training rounds set by the system is reached.

Images