A privacy-preserving vertical federated learning method and system based on function encryption

Abstract

This invention relates to the field of federated learning security, and provides a privacy-preserving vertical federated learning method and system based on function encryption. This method addresses the problems faced in achieving privacy protection using cryptographic techniques in vertical federated learning scenarios, namely, excessive computation time, high communication overhead, and the difficulty in balancing model accuracy and training costs. The main scheme includes system initialization, client-side forward propagation, server-side forward propagation, server-side backward propagation, and client-side backward propagation. This invention is used for privacy-preserving vertical federated learning. Through a decentralized multi-client function encryption algorithm and a vertical federated learning framework, it effectively resists gradient leakage attacks and backpropagation attacks based on model parameters, improving computational efficiency while ensuring model accuracy, reducing communication overhead, and enhancing the privacy of client sample data.

Description

Technical Field

[0001] This invention belongs to the field of vertical federated learning security, and provides a privacy-preserving vertical federated learning method and system based on function encryption for privacy-preserving vertical federated learning. Background Technology

[0002] Federated Learning (FL) is an emerging distributed machine learning technique that enables multiple participants to collaboratively build and train machine learning models without directly sharing raw data, thus effectively protecting data privacy. Depending on the overlap in the samples held by each participant, federated learning is divided into horizontal federated learning and vertical federated learning. In vertical federated learning (VFL), each participant typically possesses the same sample space, but differs in their feature space; that is, their data overlap in the sample dimension but complement each other in the feature dimension. This data distribution characteristic makes VFL well-suited for scenarios requiring cross-institutional collaboration, such as medical diagnostics and financial services, where the data often contains sensitive information that is not suitable for direct sharing.

[0003] Compared to centralized machine learning, VFL keeps raw data locally, with only intermediate results from model computation transmitted between participants, thus reducing the risk of data leakage. However, as research has deepened, scholars have found that even in this distributed training model, VFL systems still face potential threats to privacy, including but not limited to attacks that back-derive model parameters and gradient information leakage attacks. Several existing privacy-preserving techniques have been proposed and applied to longitudinal federated learning, such as differential privacy, gradient compression, multi-party secure computation, and partially homomorphic encryption. However, research by Zhuohang Li et al. shows that methods like differential privacy and gradient compression are difficult to resist inference attacks caused by gradient leakage. In contrast, multi-party secure computation and partially homomorphic encryption can provide higher model accuracy but require higher computational and communication overhead.

[0004] Function encryption, as an emerging privacy-preserving technology, is receiving increasing attention due to its better balance between security and performance. Compared to traditional privacy-preserving techniques (such as secure multi-party computation, differential privacy, and partially homomorphic encryption), function encryption not only allows users to decrypt data to obtain the complete plaintext information but also allows users holding specific decryption keys to obtain specific function values ​​from encrypted data without revealing any other plaintext information. However, current function encryption technologies applied to longitudinal federated learning all require the support of an absolutely trusted third-party authority (TPA), which is difficult to achieve in real-world scenarios. Furthermore, due to the characteristics of function encryption, when decrypting the function results of a batch of encrypted data, the decryptor needs to request a function-specific decryption key from the TPA, which in turn gives rise to various inference attacks targeting function elements (FEs) in VFL scenarios. The decryptor (usually an aggregator) can request decryption keys for multiple functions to obtain the results of multiple function computations, and then infer the privacy information of the encrypted data from other participants based on these results.

[0005] Therefore, the existing technology has the following technical problems:

[0006] 1. Insufficient protection of data privacy;

[0007] 2. Function encryption techniques used in vertical federated learning require the support of an absolutely trustworthy third-party institution;

[0008] 3. These methods either reduce the accuracy of model calculations or increase communication and computational overhead. Summary of the Invention

[0009] To address the problems mentioned above, the present invention aims to provide a privacy-preserving longitudinal federated learning method based on function encryption, which eliminates the dependence on absolutely trusted third-party institutions and solves the problems of existing methods struggling to balance model accuracy with computational and communication overhead, and insufficient data privacy protection.

[0010] To achieve the above objectives, the present invention adopts the following technical solution:

[0011] A privacy-preserving longitudinal federated learning method based on function encryption includes the following steps:

[0012] Step S1. This longitudinal federated learning system consists of M participants, where the first participant is the task initiator and acts as both the server and the first client, while the remaining participants act as clients. The server generates common parameters for distributed multi-client function encryption based on given security parameters and initializes a global model with a linear output layer. The server distributes the common encryption algorithm parameters and the input layer model parameters of the partitioned global model to each client.

[0013] Step S2. The client generates a client key and initializes the local model based on the received public parameters of the encryption algorithm and the partial parameters of the global model input layer model;

[0014] Step S3. All participants jointly and secretly generate their own random mask vectors. Make ∑ m∈[M] T m =0;

[0015] Step S4. Client m based on random mask vector T m Calculate the decryption key dk for the partial function. m and dk m Send to the server;

[0016] Step S5. The server decrypts the key dk based on partial functions from all clients. m Aggregate generation function to decrypt key dk;

[0017] Step S6. The client calculates the local model output based on the local samples and uploads the encrypted output ciphertext and the randomly perturbed sample data to the server;

[0018] Step S7. The server receives the ciphertext of the local model output uploaded by each client, decrypts the aggregated result of all ciphertexts, and performs subsequent model calculation and model gradient calculation based on the decrypted aggregated result.

[0019] Step S8. The server updates the local model parameters based on the calculated model gradient;

[0020] Step S9. The server calculates the gradient of the client model after random perturbation based on the client samples after random perturbation, and sends it back to the corresponding client;

[0021] Step S10. The client receives the randomly perturbed local model gradient sent back by the server and updates the local model based on the perturbed local model gradient.

[0022] Furthermore, the specific steps of step S1 are as follows:

[0023] S1.1. The server selects a 2λ-bit prime number p based on the given security parameter λ;

[0024] S1.2. The server constructs a first additive cyclic group G1, a second additive cyclic group G2, and a third additive cyclic group G based on the prime number p. T ;

[0025] S1.3. The server generates P1 and P2 based on the first and second addition cyclic groups;

[0026] S1.4. The server constructs a bilinear mapping based on three additive cyclic groups.

[0027] S1.5. The server constructs a mapping to the first additive cyclic group G1. The hash function H1;

[0028] S1.6. The server is based on the third additive cyclic group G. T Build a from G T The group elements in the dictionary are mapped to the dictionary dic on Z;

[0029] S1.7. The server initializes a global model with a linear input layer and divides the input layer model parameters W vertically into W = {W1, ..., W...} based on the sample dimensions of each participant. M};

[0030] S1.8. The server will send the common parameters (G1, G2, p, P1, P2, e, H1) and the input layer model parameters W. m Distribute to client m, m∈{1,...,M}.

[0031] Furthermore, the specific steps of step S2 are as follows:

[0032] S2.1. Client m will receive model parameters W from the server. m As initial parameters for the local model;

[0033] S2.2. Client m uniformly and randomly selects two random numbers. Obtain the private key sk m =s m .

[0034] Furthermore, the specific steps of step S4 are as follows:

[0035] S4.1. The client m calculation function decryption key is dk. m =[d m ]2=[s m +T m ]2, where [*] i Indicates * in group G i Mapping on;

[0036] S4.2. Client m will calculate dk m This message is sent to the server; the client acting as the server does not need to send it.

[0037] Furthermore, the specific steps of step S5 are as follows:

[0038] After receiving the partial function decryption keys from all clients, the server calculates... Obtain the function decryption key dk and keep it.

[0039] Furthermore, the specific steps of step S6 are as follows:

[0040] S6.1. Client m selects a batch of local privacy samples X m Then, a random number r is uniformly and randomly selected from {1, ..., p}. m As a mask, and calculate and Obtain the sample matrix after mask perturbation and the output matrix f of the local model m ;

[0041] S6.2. Client m selects a timestamp as l m and calculate and Obtain matrix f m The ciphertext is

[0042] S6.3. Client m will encrypt the model output values. Timestamp m and Both are sent to the server together. The client that also acts as the server only needs to perform the preceding calculation process and does not need to perform the sending process.

[0043] Furthermore, the specific steps of step S7 are as follows:

[0044] S7.1. The server receives the encrypted output of the local model and the timestamp from all clients. m If m ∈ {2, ..., M}, then first check the l sent by each client. m Is it the same as yours? If there is a client-side version... m If the timestamps are different from the client's or more than M-1 timestamps are received, it indicates that the data received in this training round is incorrect, and this training round is invalid; if all clients' timestamps are different... m If all samples are the same as the original sample, then select the same sample X1 and calculate the ciphertext output by its local model in the same way. Then calculate The ciphertext C obtained by aggregating the outputs of each local model is obtained. f ;

[0045] S7.2. The server queries the dictionary dic to obtain the ciphertext C. f The corresponding plaintext f is used as the aggregated result of the client output;

[0046] S7.3. The server continues to calculate the output of the final global model and uses the sample labels to calculate the global model loss value.

[0047] Furthermore, the specific steps of step S9 are as follows:

[0048] The server is based on the gradient of the input layer output value. calculate Obtain the perturbed model gradient of client m and send it back to the corresponding client.

[0049] Furthermore, the specific steps of step S10 are as follows:

[0050] Client m receives its perturbed local model gradient. Then, the number of samples in this batch, bn, was obtained, and its local model gradient was calculated. And utilize gradient Update its local model.

[0051] A privacy-preserving longitudinal federated learning system based on function encryption, comprising a client and a server:

[0052] The servers include:

[0053] System initialization module: Generates decentralized multi-client function encryption public parameters based on given security parameters, informs all clients, and jointly generates a mask vector unique to each client; initializes a global model with a linear input layer, and vertically divides the input layer model parameters according to the sample dimension of each participant as the initialization parameters of their local model; receives partial function decryption keys calculated by each client and aggregates them to generate a complete function decryption key.

[0054] Model forward propagation module: Receives the ciphertext of the local model output values ​​calculated by all participants, aggregates them, decrypts them using the function decryption key to obtain the input layer model output, and performs subsequent model calculations and global model loss calculations.

[0055] Model backpropagation module: Based on the global model loss value, the gradient of the model held by the server and the gradient of the output value of the output layer are recursively calculated using the chain rule; the model gradient is updated using the gradient descent principle, and the perturbed client model gradient is calculated by combining the perturbed sample data of each client, and then sent back to the corresponding client.

[0056] The client includes:

[0057] System initialization model: Receives the public parameters of the decentralized multi-client function encryption algorithm sent by the server, and initializes its own function encryption key based on these parameters; secretly negotiates a random mask with the server and other clients, generates a partial function decryption key based on this random mask, and sends it to the server; receives the model parameters sent by the server, and re-initializes the local model based on these parameters.

[0058] Model forward propagation module: Calculates the local model output based on local samples, and encrypts it using a function encryption key to obtain its ciphertext; selects a random mask to perturb the local samples; and sends the ciphertext of the local model output and the perturbated samples to the client.

[0059] Model backpropagation module: Receives the perturbed local model parameters from the server, deperturbs them, and updates the local model parameters using the gradient descent principle based on the deperturbed model gradient.

[0060] Furthermore, it also includes:

[0061] Each client must be synchronized in time, meaning that the timestamps selected by each client should be the same during each round of model training; model optimization is performed based on gradient descent-type optimization algorithms during model training; the entire longitudinal federated learning process will repeat the forward and backward propagation calculations until the model converges or the number of training rounds set by the system is reached.

[0062] Compared with the prior art, the beneficial effects of this invention are as follows:

[0063] This invention, based on decentralized multi-client function encryption technology, solves the problems of client data privacy leakage and gradient leakage during model training in vertical federated learning. While ensuring that the model accuracy is not affected, it reduces the communication and time overhead of the entire system during model training, and can effectively resist gradient leakage attacks and reverse inference attacks based on model parameters. Furthermore, the vertical federated learning method proposed in this invention is applicable to training any machine learning or deep learning model with a linear layer as the input layer using gradient descent-type optimization algorithms. Attached Figure Description

[0064] Figure 1 This is a flowchart of a privacy-preserving longitudinal federated learning method based on function encryption. Detailed Implementation

[0065] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments.

[0066] In federated learning, uploading plaintext gradients can compromise user privacy, and servers may tamper with the aggregated global model. This method can be used to achieve secure privacy protection and verifiable aggregation results. Based on multi-key homomorphic encryption and vector homomorphic hashing, this method effectively protects the confidentiality and integrity of information, enriching its application scenarios for secure protection of the federated learning process.

[0067] 1. System initialization:

[0068] The server first uses a polynomial-time pairing group generation algorithm, PGGen, to generate a pairing group for decentralized function encryption. Inputting a security parameter λ, PGGen generates an asymmetric pairing group PG = (G1, G2, p, P1, P2, e), where G1, G2, ..., p ... It is an additive cyclic group of prime numbers p of order 2λ-bit, where P1 and P2 are generators of groups G1 and G2, respectively, and e: It is a computationally efficient bilinear mapping, and then a mapping is selected to... The global hash function H1 is used to obtain the decentralized function-encrypted master public key mpk = (PG, H1), which is also a public parameter. The server initializes the model and vertically divides the input layer parameters of the model into W = {W1, ..., W...} based on the data dimensions of each participant. M}, divide the W m Assign it to participant m, and inform all clients of the public parameters. Finally, Creating a small dictionary dic on the group (mapping points on the group to actual values) facilitates efficient resolution of the discrete logarithm problem during decryption.

[0069] Each participant m, m∈{1, ..., M}, initializes its local model using the input layer parameters assigned by the server, and uniformly selects two random numbers. Obtain the private key sk m =s m Then, together with the other participants, they secretly negotiated a random mask vector. Make ∑ m∈[M] T m =0, and calculate the partial function decryption key. dk m Send to the server, where [*] i Indicates * in group G i The mapping on [expr] i This indicates that expr is in group G. i The server receives the partial function decryption key dk from all participating parties. m Then, the function decryption key is calculated. And retain.

[0070] 2. Client-side forward propagation:

[0071] Assume the dataset is divided into B batches, each containing bn samples, and client m selects a batch of local privacy samples X. b，m b∈{1,...,B}, and then a random number r is uniformly and randomly selected from {1,...,p}. m As a mask, calculate and Obtain the masked sample matrix and the output matrix f of the local model b，m Then, the timestamp is selected as l. m ,calculate Obtain matrix f b，m The ciphertext is ciphertext of the model output value l m and Send them together to the server, including [*]. i Indicates * in group G i The mapping on [expr] i This indicates that expr is in group G. i The calculations are performed on the same data. Note that during forward propagation, all participants select the same sample for computation, and their times are synchronized, meaning that the timestamps they select are also the same.

[0072] 3. Server forward propagation:

[0073] After receiving the local model output ciphertext and timestamp l from all clients, the server first checks whether the timestamps sent by each client are the same as its own. If any client's timestamp is different or more than M-1 timestamps are received, it indicates that the data received in this round of training is incorrect, and this round of training is invalidated. If all clients' timestamps are the same as its own, then the same sample X is selected. b，1 And compute the ciphertext output by its local model in the same way. Then calculate The ciphertext of the aggregated outputs of each local model is obtained, and finally, the discrete logarithm is indirectly solved by querying the dictionary dic to obtain the input f of the server model. b The server continues to calculate the final global model output and uses the sample labels to calculate the global model loss value.

[0074] 4. Server backpropagation:

[0075] The server uses a chain rule to recursively calculate the gradient of the server model and the gradient of the input layer output value. (That is, the gradient of the local model output values ​​of each participant), and then update the server model using the server model gradient, using... The gradient of the server's local model is calculated and the local model is updated. Finally, the server calculates the perturbed local model gradient of the client m (m∈{2,...,M}). And send it back to the client m.

[0076] 5. Client-side backpropagation:

[0077] Client m receives the local model gradient after its perturbation. Then, its model gradient was calculated. And utilize gradient Update its local model.

[0078] To ensure the data privacy of all participating parties and enable secure training of a machine learning or deep learning model, this invention employs a decentralized function encryption algorithm to protect the privacy of client data during forward propagation in model training; and uses random number perturbation to protect the privacy of client model gradients during backward propagation. This invention achieves a good balance between high privacy requirements, model computational accuracy, and computational and communication overhead during model training. Compared with other existing solutions, it provides stronger privacy, lossless model computation, and lower computational and communication overhead.

[0079] In summary, the present invention has the following characteristics:

[0080] I. This invention employs a vertical federated learning computation method based on decentralized multi-client function encryption. This method does not require the support of any trusted third-party institution. The encrypted output ciphertext is indistinguishable and can resist adaptive degradation under the classic Decisional Diffie-Hel Iman assumption. At the same time, it can provide higher computational efficiency without affecting the model accuracy.

[0081] Second, this invention adopts a novel vertical federated learning architecture, which saves the input layer model parameters on the client during model initialization. During model backpropagation computation, it can provide higher computational efficiency and require less communication overhead, while further improving the privacy of client sample data.

[0082] Third, the vertical federated learning architecture adopted in this invention uses gradient descent-type algorithms as model optimization algorithms, which supports any machine learning or deep learning model with linear layers as input layers.

[0083] Fifth, this invention combines a decentralized multi-client function encryption algorithm with a vertical federated learning framework, which can effectively resist gradient leakage attacks and reverse derivation attacks based on model parameters.

[0084] The above are merely representative embodiments among the many specific applications of this invention, and do not constitute any limitation on the scope of protection of this invention. All technical solutions formed by transformation or equivalent substitution fall within the scope of protection of this invention.

Claims

1. A privacy-preserving vertical federated learning method based on function encryption, characterized in that, The steps include: Step S1. Includes M participants, where the first participant is the initiator of the task and acts as both the server and the first client. The remaining participants all act as clients. The server generates common parameters for the distributed multi-client function encryption algorithm based on the given security parameters and initializes a global model with a linear output layer. The server distributes the common parameters of the encryption algorithm and the input layer model parameters of the segmented global model to each client. Step S2. The client generates a client key and initializes the local model based on the received public parameters of the encryption algorithm and the partial parameters of the global model input layer model; Step S3. All participants jointly and secretly generate their own random mask vectors. Make ∑ m∈[M] T m =0, where This represents a 2-dimensional p-order cyclic group; Step S4. Client m based on random mask vector T m Calculate the decryption key dk for the partial function. m and dk m Send to the server; Step S5. The server decrypts the key dk based on partial functions from all clients. m Aggregate generation function to decrypt key dk; Step S6. The client calculates the local model output based on the local samples and uploads the encrypted output ciphertext and the randomly perturbed sample data to the server; Step S7. The server receives the ciphertext of the local model output uploaded by each client, decrypts the aggregated result of all ciphertexts, and performs subsequent model calculation and model gradient calculation based on the decrypted aggregated result. Step S8. The server updates the local model parameters based on the calculated model gradient; Step S9. The server calculates the gradient of the client model after random perturbation based on the client samples after random perturbation, and sends it back to the corresponding client; Step S10. The client receives the randomly perturbed local model gradient sent back by the server and updates the local model based on the perturbed local model gradient.

2. The privacy-preserving vertical federated learning method based on function encryption according to claim 1, characterized in that, The specific steps of step S1 are as follows: Step S1.

1. The server selects a 2λ-bit prime number p based on the given security parameter λ; Step S1.

2. The server constructs a first additive cyclic group G1, a second additive cyclic group G2, and a third additive cyclic group G based on the prime number p. T ; Step S1.

3. The server obtains generators P1 and P2 based on the first and second additive cyclic groups, where P1 and P2 are generators of groups G1 and G2, respectively. Step S1.

4. The server constructs a bilinear mapping based on three additive cyclic groups. Step S1.

5. The server constructs a mapping from strings of arbitrary length to... based on the first addition cyclic group G1. The hash function H1; Step S1.

6. The server is based on the third additive cyclic group G. T Build a from G T The group elements in the dictionary are mapped to a dictionary dic on Z, where Z represents the integer field; Step S1.

7. The server initializes a global model with a linear input layer and divides the input layer model parameters W vertically into W = {W1, ..., W2} based on the sample dimensions of each participant. M }; Step S1.

8. The server will combine the common parameters (G1, G2, p, P1, P2, e, H1) and the input layer partial model parameters W. m Distribute to client m, m∈{1, ..., M}.

3. The privacy-preserving vertical federated learning method based on function encryption according to claim 2, characterized in that, The specific steps of step S2 are as follows: Step S2.

1. The client m receives the input layer partial model parameters W from the server. m As initial parameters for the local model; Step S2.

2. The client m uniformly and randomly selects two random numbers. Obtain the private key sk m =s m , where s m，1 s m，2 They represent Two random numbers in the array.

4. The privacy-preserving vertical federated learning method based on function encryption according to claim 3, characterized in that, The specific steps of step S4 are as follows: Step S4.

1. The client m calculates the partial function decryption key dk. m =[d m ]2=[s m +T m ]2, where [*] i Indicates * in group G i Mapping on, where T m Let d represent the random mask vector of client m. m Represents points in the G2 group; Step S4.

2. Client m will calculate dk m This message is sent to the server; the client acting as the server does not need to send it.

5. The privacy-preserving vertical federated learning method based on function encryption according to claim 4, characterized in that, The specific steps of step S5 are as follows: After receiving the partial function decryption keys from all clients, the server calculates... Obtain the function decryption key dk and keep it.

6. The privacy-preserving vertical federated learning method based on function encryption according to claim 5, characterized in that, The specific steps of step S6 are as follows: Step S5.

1. Client m selects a batch of local privacy samples x m Then, a random number r is uniformly and randomly selected from {1, ..., p}. m As a mask, and calculate and Obtain the sample matrix after mask perturbation and the output matrix f of the local model m ,in W m transpose, * T Indicates the transpose of *; Step S5.

2. Client m selects a timestamp as l m and calculate and Obtain matrix f m The ciphertext is in Indicate l m The transpose of a 2D vector mapped onto group G1; Step S5.

3. Client m transmits the encrypted value of the model output. Timestamp m and Both are sent to the server together. The client that also acts as the server only needs to perform the preceding calculation process and does not need to perform the sending process.

7. The privacy-preserving vertical federated learning method based on function encryption according to claim 6, characterized in that, The specific steps of step S7 are as follows: Step S7.

1. The server receives the encrypted local model output and timestamp from all clients. m If m ∈ {2, ..., M}, then first check the l sent by each client. m Is it the same as yours? If there is a client-side version... m If the timestamps are different from the client's or more than M-1 timestamps are received, it indicates that the data received in this training round is incorrect, and this training round is invalid; if all clients' timestamps are different... m If all samples are the same as the original sample, then select the same sample X1 and calculate the ciphertext output by its local model in the same way. Then calculate The ciphertext C obtained by aggregating the outputs of each local model is obtained. f ; Step S7.

2. The server queries the dictionary dic to obtain the ciphertext C. f The corresponding plaintext f is used as the aggregated result of the client output; Step S7.

3. The server continues to calculate the output of the final global model and uses the sample labels to calculate the global model loss value and the model gradients excluding the input layer.

8. The privacy-preserving vertical federated learning method based on function encryption according to claim 7, characterized in that, The specific steps of step S9 are as follows: The server is based on the gradient of the input layer output value. calculate Obtain the perturbed model gradient of client m and send it back to the corresponding client. This represents the perturbation value of the local model gradient; The specific steps of step S10 are as follows: Client m receives its perturbed local model gradient. Then, the number of samples in this batch, bn, was obtained, and its local model gradient was calculated. And utilize gradient Update its local model.

9. A privacy-preserving vertical federated learning system based on function encryption, characterized in that, Includes client and server: The servers include: The system initialization module generates decentralized multi-client function encryption public parameters based on given security parameters, informs all clients of these parameters, and jointly generates a mask vector unique to each client; it initializes a global model with a linear input layer, and vertically distributes the input layer model parameters to each participant based on the sample dimension of each participant as the initialization parameters of their local model; it receives partial function decryption keys calculated by each client and aggregates them to generate a complete function decryption key. Model forward propagation module: Receives the ciphertext of the local model output values ​​calculated by all participants, aggregates them, decrypts them using the function decryption key to obtain the input layer model output, and performs subsequent model calculations and global model loss calculations. Model backpropagation module: Based on the global model loss value, the gradient of the model held by the server and the gradient of the output value of the output layer are recursively calculated using the chain rule; the model gradient is updated using the gradient descent principle, and the perturbed client model gradient is calculated by combining the perturbed sample data of each client and sent back to the corresponding client. The client includes: System initialization model: Receives the public parameters of the decentralized multi-client function encryption algorithm sent by the server, and initializes its own function encryption key based on these parameters; secretly negotiates a random mask with the server and other clients, generates a partial function decryption key based on this random mask, and sends it to the server; receives the model parameters sent by the server, and re-initializes the local model based on these parameters. Model forward propagation module: Calculates the local model output based on local samples, and encrypts it using a function encryption key to obtain its ciphertext; selects a random mask to perturb the local samples; sends the ciphertext of the local model output and the perturbated samples to the client; Model backpropagation module: Receives the perturbed local model parameters from the server, deperturbs them, and updates the local model parameters using the gradient descent principle based on the deperturbed model gradient.

10. A privacy-preserving longitudinal federated learning system based on function encryption according to claim 9, characterized in that: Each client needs to be synchronized in time, that is, the timestamp selected by each client should be the same during each round of model training; Model training is performed using gradient descent-based optimization algorithms. The entire longitudinal federated learning process will repeat the forward and backward propagation computation process until the model converges or the number of training rounds set by the system is reached.

Images