Federal learning method for enhancing robustness and protecting medical privacy

Abstract

The invention provides a federal learning method for enhancing robustness and protecting medical privacy, and solves the technical problems that heterogeneous data in an intelligent medical scene is difficult to aggregate and malicious participants are poisoned and attacked. According to the technical scheme, the method comprises the steps that S10, a system administrator SM and a scientific research institution RI generate public parameters and distribute a key set; s20, the hospital uses the local data set to train model parameters, normalizes and encrypts the model, and uploads the encrypted model to a server of the RI; s30, the SM and the RI cooperatively carry out normalization judgment, and the RI evaluates a gradient ciphertext by using cosine similarity; s40, the RI uses a logistic regression function to adjust the aggregation weight of the gradient ciphertext, and then the gradient ciphertext is aggregated; and S50, the RI and the hospitals participating in training jointly update the local model. According to the method, a fully homomorphic encryption algorithm is used for protecting privacy data of medical patients, cosine similarity is used for evaluating gradient ciphertexts, and a new aggregation mechanism ensures that a training model has high accuracy.

Description

Technical Field

[0001] The present invention relates to the fields of privacy-preserving federated learning, fully homomorphic encryption, and Sigmoid logistic regression function, and in particular to a federated learning method for enhancing robustness and protecting medical privacy. Background Art

[0002] In the current medical field, the confidentiality of personal information is a very important issue. Medical information contains a lot of private information, such as health information, genetic information, etc. Once these data are leaked, they may cause great harm to the patient's life. With the current development of medical big data, how to achieve disease prediction, diagnosis and model training while ensuring patient privacy is an urgent problem that needs to be solved.

[0003] Traditional machine learning methods usually require medical data to be centralized on a central server for processing, which not only poses the risk of privacy leakage, but also has problems with data silos and data heterogeneity. Since the data of each hospital is usually limited, and the data distribution may vary due to factors such as geographic location, patient population, and hospital expertise, the trained model lacks generalization capabilities.

[0004] In order to solve these problems, federated learning has emerged as an emerging distributed machine learning technology. In the medical field, it allows each hospital to keep the original medical data locally and only upload the model parameters or gradient information trained locally to the central server. Therefore, different hospitals can jointly participate in the training of disease prediction and diagnosis models without directly sharing private data. In this way, the data can be fully utilized to improve the accuracy and generalization ability of the model.

[0005] However, the training process of federated learning also faces some challenges. First, even if the hospital conducts model training locally and only uploads model updates instead of original data, there is still a risk of privacy leakage. Attackers can reconstruct private information or infer patient-specific information through these updates, thereby achieving the purpose of privacy leakage. Secondly, due to its unique nature and source, medical data often presents a high degree of heterogeneity and uneven distribution, which may cause the model to perform well in disease prediction in some hospitals and poorly in disease prediction in other hospitals. In addition, the federated learning system also needs to deal with potential malicious node attacks, which may use sending arbitrary updates to disrupt training and reduce the robustness of the system.

[0006] How to solve the above technical problems is the subject faced by the present invention. Summary of the invention

[0007] The purpose of the present invention is to provide a federated learning method with enhanced robustness and protection of medical privacy, protect the privacy data of medical patients through fully homomorphic encryption technology, evaluate the quality of ciphertext through cosine similarity, and ensure the high accuracy of medical models through a new aggregation mechanism.

[0008] The inventive concept of the present invention is as follows: First, the system administrator SM sets security parameters and generates a key set to protect the local model. The scientific research institution RI sets the federated learning parameters and generates a key set to protect the global model. Then, each participating hospital uses the received security parameters, initial model parameters and learning rate to perform model training on the local medical data, normalize and encrypt the gradient, and upload the gradient ciphertext to RI. Next, RI and SM collaborate to perform normalization judgment. RI evaluates the quality of the gradient ciphertext uploaded by each hospital through cosine similarity, adjusts the aggregation weight accordingly, and then continues to aggregate the gradient ciphertext. After decrypting the aggregation result, SM re-encrypts it with the public key and distributes it to RI and each participating hospital to update the global model. After each round of training, RI tests the model accuracy. If it meets expectations, the learning ends, otherwise the next round of training continues.

[0009] The specific content is as follows: First, during the system initialization phase, the system administrator SM selects security parameters, including security parameter λ, left rotation parameter l, and scaling factor Δ. Then, SM generates a set of keys for encrypting local model training, including the public key pk s , private key sk s , evaluation key evk s and the rotation key rk s SM will pk s ,sk s ,evk s ,rk sand scaling factor Δ are sent to the research institution RI. RI sets parameters for this federated learning task, including the initial model parameter W0 and the learning rate η. RI generates another set of key sets for protecting the global model. RI sends all security parameters SecPar, including the key set, security parameters, initial model parameters W0 and learning rate η, to all hospitals Hi participating in the medical data model training. Then, in the local model training phase, after receiving the security parameters sent by RI, each hospital Hi uses the local medical data set, initial model parameter W0 and learning rate η to train the model and obtain their own local model gradients. To ensure data privacy, the hospital will normalize the gradient and encrypt the normalized gradient using security parameters, and finally upload the encrypted gradient ciphertext to RI's server. Next, in the gradient ciphertext evaluation phase, SM and RI work together to normalize the gradient ciphertexts uploaded by each hospital, and SM will remove the gradient ciphertexts that have not been normalized. RI uses its own clean data set to train the baseline gradient, normalizes and encrypts the baseline gradient to obtain the baseline gradient ciphertext. RI calculates the cosine similarity ciphertext between the gradient ciphertext uploaded by each hospital and the baseline gradient ciphertext, and uses this as a standard for evaluating the quality of the gradient ciphertext uploaded by each hospital. Then, in the gradient ciphertext aggregation stage, RI will adjust the aggregation weight of each gradient ciphertext according to the cosine similarity. Specifically, RI will approximate the Sigmoid logic function as a polynomial, and then use the cosine similarity ciphertext as the input value, and use this polynomial to calculate the aggregation weight corresponding to each gradient ciphertext. Finally, RI will aggregate according to each gradient ciphertext and its corresponding weight value. Finally, in the global model update stage, RI sends the aggregation result to SM. SM uses the private key sk s Decrypt the aggregated result and use the public key pk r After receiving the re-encrypted aggregate gradient, RI and the hospitals participating in the training use their own private key sk r Decrypt and update their local models based on the decrypted global model. After each round of training, RI will use the global model of this round to test on the test set. If the model accuracy reaches the expected value, the federated learning task will be terminated; otherwise, RI will ask the participating hospitals to conduct the next round of model training and repeat the above steps.

[0010] In order to achieve the above invention objectives, the technical solution adopted by the present invention is as follows: a federated learning method for enhancing robustness and protecting medical privacy, mainly including system administrators SM, scientific research institutions RI, and hospitals H i Three entities, including the following steps:

[0011] S10, system initialization, first, the system administrator SM selects a security parameter λ, a left rotation parameter l and a scaling factor Δ, then SM generates a set of keys (pk s ,sk s ,evk s ,rk s ), and (pk s ,evk s ,rk s ) and the scaling factor Δ are sent to the research institution RI. RI generates a set of keys (pk r ,sk r ,evk r ,rk r ), a global model for protecting medical data. RI sets all security parameters SecPar = {(pk s ,evk s ,rk s ),Δ,(pk r ,sk r ,evk r ,rk r )}, the initial model parameters W0 and the learning rate η are sent to all hospitals participating in the medical data model training;

[0012] S20, local model training. After receiving the security parameters sent by RI, all hospitals participating in the training use their local medical data sets, combined with the initial model parameters W0 and the learning rate η to train the model, obtain the local model gradient, and then normalize the gradient. The normalized gradient is encrypted using the security parameters, and finally the gradient ciphertext is uploaded to the RI server.

[0013] S30, Gradient ciphertext evaluation, SM and RI jointly normalize the gradient ciphertexts uploaded by each hospital, and SM removes the gradient ciphertexts that have not been normalized. RI uses its own data set to train to obtain the baseline gradient, normalizes the baseline gradient and encrypts it to obtain the baseline gradient ciphertext. RI calculates the cosine similarity ciphertext between the gradient ciphertext uploaded by each hospital and the baseline gradient ciphertext, and uses the cosine similarity ciphertext as the standard for evaluating the quality of the gradient ciphertext uploaded by each hospital;

[0014] S40, gradient ciphertext aggregation, RI adjusts the aggregation weight of each gradient ciphertext based on cosine similarity. First, RI approximates the Sigmoid logic function as a polynomial, then uses the cosine similarity ciphertext as input value, and uses this polynomial to calculate the aggregation weight corresponding to each gradient ciphertext. Finally, RI aggregates according to each gradient ciphertext and its corresponding weight value;

[0015] S50, global model update, RI sends the aggregation result to SM, SM uses the private key sk s Decrypt the aggregated result and send the decrypted result to the public key pk r After receiving the re-encrypted aggregate gradient, RI and the hospitals participating in the training use their own private key sk r Decrypt, and then update your local model based on the decrypted global model. After each round of training, RI will use the current global model to test on the test set. When the model accuracy reaches the expected value, RI ends this federated learning task. Otherwise, RI will ask the participating hospitals to conduct the next round of model training, and repeat steps S20, S30, S40, and S50 in sequence;

[0016] Furthermore, the step S10 includes the following steps:

[0017] S101. Multiple hospitals jointly publish federated learning task requirements to SM. SM entrusts RI to assist in completing model aggregation. Then, SM initializes RI and hospitals participating in federated learning training and numbers these entities. Each entity has a unique ID to identify the identity information of the participants.

[0018] S102, SM selects a security parameter λ, a left-hand parameter l and a scaling factor Δ. Then, SM selects a large prime number q to limit the size of the polynomial coefficients, a modulus p for rescaling, selects a power of 2 N as the order of the polynomial, and constructs a polynomial quotient ring R q =Z q [X] / (x N +1), where Z q = {0,1,…,q-1} represents the set of integers modulo q, the ring R q Each element in is a polynomial, Z q [X] represents the set of polynomial coefficients.

[0019] Next, SM starts from ring R q N random samples are taken from a discrete Gaussian distribution G on the s =s0+s1x+s2x 2 +…+s N-1 x N-1 (mod x N +1), where s i Represents a value randomly sampled from a discrete Gaussian distribution G. The discrete Gaussian distribution G is a Gaussian distribution with integers as its range, and its probability mass function is:

[0020]

[0021] Similarly, SM constructs a polynomial e by random sampling in G, and q Construct a polynomial a by randomly sampling from a uniform distribution U on the surface, and then calculate b = -a·sk s +e(mod q) to get pk s =(a,b). Then, SM randomly samples and constructs the polynomial e in G. v and e k , randomly sample and construct polynomial a in U v and a k , calculate b v =-a v ·sk s +Δ·sk s 2 +e v (mod q) get evk s =(a v ,b v ), calculate b k =-a k ·sk s +R(sk s ,l)+e k (mod q) gets rk s =(a k ,b k ), where R(sk s ,l) means to convert sk s The coefficients of are rotated by l positions to obtain the new polynomial. SM generates the public key pk s , used to encrypt the hospital's local gradient and protect the privacy data of medical patients; generate the private key sk s , which is kept locally in the SM and used to decrypt the aggregated results of each round; generate the evaluation key evk s , used to support homomorphic multiplication operations; generate the rotation key rk s , used to support ciphertext rotation operations, forming a set of key sets (pk s ,sk s ,evk s ,rk s Then, SM will pass the key set (pk s ,evk s ,rk s ) and the scaling factor Δ are sent to RI;

[0022] S103, RI sets global parameters for this federated learning task, including the initial model W0 and the learning rate η. At the same time, RI generates a pair of public and private keys pk r and sk r , where pkr Used to encrypt the global model and protect the privacy of the global model, sk r By RI and Hospital H i Used to decrypt the global model; generate the key evk r and the rotation key rk r , which are used to support homomorphic multiplication and ciphertext rotation operations, forming a set of key sets (pk r ,sk r ,evk r ,rk r ). RI sets all security parameters SecPar={(pk s ,evk s ,rk s ),Δ,(pk r ,sk r ,evk r ,rk r )}, the initial model parameters W0 and the learning rate η are sent to all hospitals H participating in the medical data model training i ;

[0023] Furthermore, the step S20 includes the following steps:

[0024] S201, Hospital H i After receiving the initial model parameters W0, learning rate η and security parameters required for encryption and decryption from RI, the local medical dataset M i ={ <x k ,y k >|k=1,2,…,n} for local model training, x k and k Represent the medical data set M i In the rth iteration of federated learning, hospital H i Based on the global model parameter W of the previous round r-1 Perform model training and obtain the gradient g of this round through gradient descent i,r =(g0,g1,…,g n-1 ), n is the gradient vector g i,r Dimension.

[0025] S202. Due to the different models of medical equipment used to collect medical data, the data types are diverse and complex, and there is a lack of unified standards. Therefore, the data distribution between hospitals may vary greatly. These differences usually lead to reduced model training efficiency and reduced model accuracy. Therefore, the hospital H i The following formula is needed for the gradient vector g i,r Normalize the gradient vector g i,r The modulus of is limited to 1. First, hospital Hi Calculate the gradient vector g i,r The model||g i,r ||:

[0026]

[0027] Then, H i For the gradient vector g i,r Each component in is normalized to obtain

[0028]

[0029] Each hospital is required to calculate the gradient vector g i,r Normalization not only helps to reduce the data distribution differences between hospitals, increase the consistency between models, speed up the convergence of the global model, and enhance the accuracy of the global model, but also avoids non-target attacks launched by malicious actors through enhanced gradients, because the gradient vector g i,r The modulus of is always limited to 1 and cannot be enhanced;

[0030] S203, due to the gradient vector g i,r The medical patient's privacy data may be included in the gradient vector g. i,r Privacy protection is performed. During the training process of the neural network model, the gradient of each layer can be regarded as a vector. Therefore, the hospital H i The gradient of each layer needs to be encrypted. For the convenience of explanation, only the encryption of one layer of gradient vector is described. First, the hospital H i Using the encoding function The normalized gradient vector Encoded into a polynomial g(X), and then the gradient vector g i,r Extension to vectors of length 2n in Indicates g i The conjugate of the polynomial g(X) is then calculated as the coefficient c i :

[0031]

[0032] Then the polynomial g(X) is calculated by formula (5):

[0033]

[0034] Next Hospital H i Use the public key pk in the security parameters s =(a,b), combined with the encryption function Enc(pk s,g(X)) is encrypted. First, H i Select random numbers to construct polynomials u0, n0 and n1, then calculate y0 = b·u0+n0+g(X)(mod q), y1 = a·u0+n1(mod q) to get the ciphertext represents the gradient vector g i,r By Hospital H i The final gradient ciphertext obtained after normalization, encoding and encryption;

[0035] S204, Hospital H i The final calculated gradient ciphertext Upload to RI;

[0036] Furthermore, the step S30 includes the following steps:

[0037] S301, RI receives the hospital H i Gradient ciphertext sent

[0038] S302, RI uses the evaluation key evk in the security parameters s and the rotation key rk s , combining the homomorphic addition function Add(·), the homomorphic multiplication function Mult(·) and the inner product function Calculate the H of each hospital i The ciphertext of the uploaded gradient vector modulus Assume that two ciphertexts ct1=(c 1,1 ,c 1,2 ), ct2=(c 2,1 ,c 2,2 ), RI first defines the homomorphic addition function Add(·) and the homomorphic multiplication function Mult(·), then the homomorphic addition result of two ciphertexts is ct add =(c 1,1 +c 2,1 ,c 1,2 +c 2,2 ), the result of homomorphic multiplication is ct mult =(c1+a v ·c3,c2+b v c3), where c1 = c 1,1 ·c 2,1 , c2=c 1,1 ·c 2,2 +c 1,2 ·c 2,2 , c3=c 1,2 ·c 2,2 , a v and b v is the evaluation key evk sThen RI defines the inner product function Dot(·), using the rotation key rk s calculate:

[0039]

[0040] Get the inner product ciphertext ct1 and ct2 ct = (c m,1 ,c m,2 ), where R(·) represents the new polynomial obtained by rotating the corresponding polynomial coefficients by i positions. RI is calculated to obtain the H i The ciphertext of the uploaded gradient vector modulus Then all the hospital numbers and their corresponding calculation results Upload to SM;

[0041] S303, SM receives the hospital number and its corresponding calculation result sent from RI Use your own private key sk kept locally s For all calculation results To decrypt, assume that the ciphertext First, use the decryption function Calculate the polynomial u(X)=c m,1 +c m,2 ·sk s , and then use the decoding function Calculate m(X) = u(X) / Δ, extract the first N / 2 components of the polynomial m(X) to form the coefficient vector (m0, m1, ..., m N / 2-1 ), and then calculate:

[0042]

[0043] Get the decryption result m i,r Since the hospitals that honestly participate in the training will normalize the gradient vector as required, the decrypted result should be m i,r =1, if the decryption result is not 1, it can be considered that the hospital H i is a malicious participant, or the gradient value of the hospital has been tampered by an external attacker. SM will decrypt the result m i,r =1, add the numbers of the hospitals to the list L, and then send L to RI;

[0044] S304, RI uses its own initial training set D0 to train a baseline model and obtain the baseline gradient g 0,r , then normalize the local gradient g 0,r ,get Next, Encode and encrypt to obtain a baseline gradient ciphertext. The specific process can be described by the following formula:

[0045]

[0046] Among them, g0(X) represents The polynomial for encoding is Represents the baseline gradient ciphertext that RI has locally. Then, RI uses the evaluation key evk in the security parameters s and the rotation key rk s , combined with the inner product function Calculate baseline gradient ciphertext And the gradient ciphertext uploaded by each hospital in list L The cosine similarity ciphertext between:

[0047]

[0048] in Indicates that in the rth iteration, hospital H i Gradient ciphertext Baseline gradient ciphertext with RI The cosine similarity ciphertext between the two ciphertext vectors is between -1 and 1. The closer the cosine similarity value is to 1, the more similar the two ciphertext vectors are. i The more likely the submitted data is to be authentic and valid, the closer the cosine similarity value is to -1, which means the greater the deviation between the two ciphertext vectors, that is, the hospital H i The more likely the submitted data is to be malicious;

[0049] Furthermore, the step S40 includes the following steps:

[0050] S401. For each hospital H in the list L i , RI uses the homomorphic addition function Get the ciphertext

[0051]

[0052] Ciphertext The range of is adjusted to [0,2], and then RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext

[0053]

[0054] Assuming ciphertext RI uses the rescaling function Calculate the ciphertext Where p and q are the parameters selected by S102. The range of is adjusted to [0,1];

[0055] S402, RI uses ciphertext Combine the Sigmoid function for each hospital H in the list L i Assign weights. First, RI adjusts the parameters in the Sigmoid function, transforming it into a function centered at 0.5:

[0056]

[0057] Among them, β is a hyperparameter that adjusts the curvature of the Sigmoid function, and RI sets its value to 50.

[0058] S403. Since the ciphertext after homomorphic encryption can only be subjected to homomorphic addition and homomorphic multiplication operations, RI uses a polynomial to approximate equation (12), and the approximate polynomial is expressed as:

[0059] y=0.2787x 3 +0.4214x 2 +1.0181x+0.9991 (13)

[0060] For each hospital H in list L i First, RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext

[0061]

[0062] RI uses the rescaling function Get the ciphertext Next, RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext

[0063]

[0064] RI uses the rescaling function Get the ciphertext Next, RI converts the ciphertext into as well as Multiply by the corresponding coefficient:

[0065]

[0066] RI uses the rescaling function to obtain the ciphertext as well as Finally, get the hospital H i Aggregate weight ciphertext

[0067]

[0068] S404. For each hospital H in the list L i , RI uses the rotating key evk s , combined with the homomorphic multiplication function Calculate the ciphertext

[0069]

[0070] Then, RI uses the rescaling function Get the ciphertext Finally, RI uses the homomorphic addition function to add all the ciphertexts Accumulate and get the aggregate ciphertext

[0071]

[0072] Furthermore, the step S50 includes the following steps:

[0073] S501, RI uses the homomorphic addition function Add(S j,r ,S j+1,r ), calculate the sum of the weights of the L hospitals participating in the training at the time of aggregation

[0074]

[0075] Among them, |L| represents the number of hospitals in the list L. Then, RI encrypts the weighted sum And aggregate ciphertext Send to SM.

[0076] S502, SM receives the weighted sum ciphertext And aggregate ciphertext Afterwards, use the private key sk that you keep locally s To decrypt:

[0077]

[0078] Among them, t(X) and sum(X) represent the weighted sum ciphertext And aggregate ciphertext The plaintext polynomial obtained after decryption. Then, SM uses the decoding function to obtain the aggregation result g of the rth round respectively. r Sum of weights r :

[0079] g r =Dcd(t(X),Δ),sum r =Dcd(sum(X),Δ) (22)

[0080] Finally, SM calculates the final aggregate gradient of this round

[0081]

[0082] S503, SM uses encoding function The final aggregate gradient Encoded into a polynomial m(X):

[0083]

[0084] Then, SM uses RI’s public key pk r , combined with the encryption function Enc(pk r ,m(X)) re-encrypts the aggregation result to obtain the aggregated gradient ciphertext

[0085]

[0086] Finally, SM aggregates the gradient ciphertext Sent to RI and various hospitals.

[0087] S504, RI and Hospital H i Receive the aggregate gradient ciphertext from SM Afterwards, using RI's private key sk r , combined with the decryption function Get the plaintext polynomial P(X):

[0088]

[0089] Then, RI and Hospital H i Use the decoding function Dcd(P(X),Δ) to get the global aggregate gradient of this round

[0090]

[0091] Finally, RI and Hospital H iUsing Global Aggregate Gradients To update your local model:

[0092]

[0093] S505, RI tests the accuracy of the updated model on the test set. If the accuracy reaches the expected value, it means that the training is completed. Otherwise, each hospital H i The process proceeds to stage S201, and on this basis, the r+1th round of local model training is performed.

[0094] The present invention uses a fully homomorphic encryption algorithm to protect the privacy data of medical patients, uses cosine similarity to evaluate gradient ciphertext, and designs a new aggregation mechanism to ensure that the aggregation results are highly accurate.

[0095] (1) During the training of the medical data model, the present invention realizes fully homomorphic encryption of medical data through the key set generated by the system administrator and the scientific research institution. This encryption method allows the encrypted data to be calculated and the encryption result to be obtained without decrypting the data itself, thereby effectively protecting the privacy of medical patients. Existing privacy-preserving federated learning usually adopts the Pailler encryption method, which can only encrypt each parameter in the model vector one by one, with high computational overhead and long encryption and decryption time. The fully homomorphic encryption method of the present invention can encrypt the model vector as a whole, greatly reducing the computational overhead and shortening the encryption and decryption time.

[0096] (2) The present invention introduces cosine similarity as a standard for evaluating the quality of gradient ciphertexts uploaded by each hospital. By calculating the cosine similarity between the gradient ciphertexts uploaded by each hospital and the baseline gradient ciphertext, scientific research institutions can accurately judge the quality of the gradient ciphertexts and adjust the aggregation weights accordingly. Existing ciphertext evaluation methods are usually based on statistical methods such as Krum, Median and Trim-mean, which are easily affected by the proportion of malicious participants. When the proportion of malicious participants is high, the quality of the ciphertext cannot be accurately judged. The cosine similarity method of the present invention is not affected by the proportion of malicious participants.

[0097] (3) The present invention designs a new gradient ciphertext aggregation mechanism, which is based on cosine similarity and uses a polynomial approximated by the Sigmoid logic function to calculate the aggregation weight. Existing aggregation methods usually only consider the case where the data is uniformly distributed. In heterogeneous scenarios where there are significant differences in data distribution, the model accuracy is poor. The mechanism designed by the present invention can effectively cope with the model training challenges in heterogeneous scenarios, ensuring that the global model can still maintain high accuracy when there are differences in data distribution, model structure, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0098] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0099] Figure 1 The present invention is a flowchart of a federated learning method for enhancing robustness and protecting medical privacy according to an embodiment of the present invention.

[0100] Figure 2 This is a system model diagram of a federated learning method for enhancing robustness and protecting medical privacy according to an embodiment of the present invention. DETAILED DESCRIPTION

[0101] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Of course, the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0102] Example 1

[0103] See also Figure 1 and Figure 2 ,This embodiment provides a technical solution, a federated learning method for enhancing robustness and protecting medical privacy, such as Figure 1 As shown, it mainly includes system administrators SM, scientific research institutions RI, hospitals H i Three entities, including the following steps:

[0104] S10, system initialization, first, the system administrator SM selects a security parameter λ, a left rotation parameter l and a scaling factor Δ, then SM generates a set of keys (pk s ,sk s ,evk s ,rk s ), and (pk s ,evk s ,rk s ) and the scaling factor Δ are sent to the research institution RI. RI generates a set of keys (pk r ,sk r ,evk r ,rk r ), a global model for protecting medical data. RI sets all security parameters SecPar = {(pk s ,evk s ,rk s ),Δ,(pk r ,sk r ,evk r ,rk r)}, the initial model parameters W0 and the learning rate η are sent to all hospitals participating in the medical data model training;

[0105] S20, local model training. After receiving the security parameters sent by RI, all hospitals participating in the training use their local medical data sets, combined with the initial model parameters W0 and the learning rate η to train the model, obtain the local model gradient, and then normalize the gradient. The normalized gradient is encrypted using the security parameters, and finally the gradient ciphertext is uploaded to the RI server.

[0106] S30, Gradient ciphertext evaluation, SM and RI jointly normalize the gradient ciphertexts uploaded by each hospital, and SM removes the gradient ciphertexts that have not been normalized. RI uses its own data set to train to obtain the baseline gradient, normalizes the baseline gradient and encrypts it to obtain the baseline gradient ciphertext. RI calculates the cosine similarity ciphertext between the gradient ciphertext uploaded by each hospital and the baseline gradient ciphertext, and uses the cosine similarity ciphertext as the standard for evaluating the quality of the gradient ciphertext uploaded by each hospital;

[0107] S40, gradient ciphertext aggregation, RI adjusts the aggregation weight of each gradient ciphertext based on cosine similarity. First, RI approximates the Sigmoid logic function as a polynomial, then uses the cosine similarity ciphertext as input value, and uses this polynomial to calculate the aggregation weight corresponding to each gradient ciphertext. Finally, RI aggregates according to each gradient ciphertext and its corresponding weight value;

[0108] S50, global model update, RI sends the aggregation result to SM, SM uses the private key sk s Decrypt the aggregated result and send the decrypted result to the public key pk r After receiving the re-encrypted aggregate gradient, RI and the hospitals participating in the training use their own private key sk r Decrypt, and then update your local model based on the decrypted global model. After each round of training, RI will use the current global model to test on the test set. When the model accuracy reaches the expected value, RI ends this federated learning task. Otherwise, RI will ask the participating hospitals to conduct the next round of model training, and repeat steps S20, S30, S40, and S50 in sequence;

[0109] The federated learning method for enhancing robustness and protecting medical privacy includes system administrators, scientific research institutions, multiple hospitals, and servers;

[0110] Among them, scientific research institutions themselves have a clean dataset through public datasets or experimental sampling, which can be used to train an initial model.

[0111] like Figure 2 As shown in the figure, a federated learning method for enhancing robustness and protecting medical privacy includes system administrator SM, scientific research institution RI, hospital H i Three entities. The system administrator SM is a trusted entity, usually a government agency. SM generates a key set for the local model parameters of the hospital, collaborates with the scientific research institution RI to perform normalization judgment, and finally re-encrypts the global model. The scientific research institution RI receives the training task commission of the hospital's medical model, generates a key set to protect the global model, evaluates the quality of the ciphertext uploaded by the hospital, and performs aggregation for the hospital's gradient ciphertext. Each hospital H participating in the training i Responsible for training local gradients using local medical datasets, normalizing and encrypting local gradients, and then sending them to research institutions RI.

[0112] The step S10 comprises the following steps:

[0113] S101. Multiple hospitals jointly publish federated learning task requirements to SM. SM entrusts RI to assist in completing model aggregation. Then, SM initializes RI and hospitals participating in federated learning training and numbers these entities. Each entity has a unique ID to identify the identity information of the participants.

[0114] S102, SM selects a security parameter λ, a left-hand parameter l and a scaling factor Δ. Then, SM selects a large prime number q to limit the size of the polynomial coefficients, a modulus p for rescaling, selects a power of 2 N as the order of the polynomial, and constructs a polynomial quotient ring R q =Z q [X] / (x N +1), then SM from ring R q N random samples are taken from a discrete Gaussian distribution G on the s , that is, sk s =s0+s1x+s2x 2 +…+s N-1 x N-1 (mod x N +1), where s i Represents a value randomly sampled from a discrete Gaussian distribution G. The discrete Gaussian distribution G is a Gaussian distribution with integers as its range, and its probability mass function is:

[0115]

[0116] Similarly, SM constructs a polynomial e by random sampling in G, and q Construct a polynomial a by randomly sampling from a uniform distribution U on the surface, and then calculate b = -a·sk s+e(mod q) to get pk s =(a,b). Then, SM randomly samples and constructs the polynomial e in G. v and e k , randomly sample and construct polynomial a in U v and a k , calculate b v =-a v ·sk s +Δ·sk s 2 +e v (mod q) get evk s =(a v ,b v ), calculate b k =-a k ·sk s +R(sk s ,l)+e k (mod q) gets rk s =(a k ,b k ), where R(sk s ,l) means to convert sk s The coefficients of are rotated by l positions to obtain the new polynomial. SM generates the public key pk s , used to encrypt the hospital's local gradient and protect the privacy data of medical patients; generate the private key sk s , which is kept locally in the SM and used to decrypt the aggregated results of each round; generate the evaluation key evk s , used to support homomorphic multiplication operations; generate the rotation key rk s , used to support ciphertext rotation operations, forming a set of key sets (pk s ,sk s ,evk s ,rk s Then, SM will pass the key set (pk s ,evk s ,rk s ) and the scaling factor Δ are sent to RI;

[0117] S103, RI sets global parameters for this federated learning task, including the initial model W0 and the learning rate η. At the same time, RI generates a pair of public and private keys pk r and sk r , where pk r Used to encrypt the global model and protect the privacy of the global model, sk r By RI and Hospital H i Used to decrypt the global model; generate the key evk r and the rotation key rk r, which are used to support homomorphic multiplication and ciphertext rotation operations, forming a set of key sets (pk r ,sk r ,evk r ,rk r ). RI sets all security parameters SecPar={(pk s ,evk s ,rk s ),Δ,(pk r ,sk r ,evk r ,rk r )}, the initial model parameters W0 and the learning rate η are sent to all hospitals H participating in the medical data model training i ;

[0118] The step S20 comprises the following steps:

[0119] S201, Hospital H i After receiving the initial model parameters W0, learning rate η and security parameters required for encryption and decryption from RI, the local medical dataset M i ={ <x k ,y k >|k=1,2,…,n} for local model training, x k and k Represent the medical data set M i In the rth iteration of federated learning, hospital H i Based on the global model parameter W of the previous round r-1 Perform model training and obtain the gradient g of this round through gradient descent i,r =(g0,g1,…,g n-1 ), n is the gradient vector g i,r Dimension.

[0120] S202. Due to the different models of medical equipment used to collect medical data, the data types are diverse and complex, and there is a lack of unified standards. Therefore, the data distribution between hospitals may vary greatly. These differences usually lead to reduced model training efficiency and reduced model accuracy. Therefore, the hospital H i The following formula is needed for the gradient vector g i,r Normalize the gradient vector g i,r The modulus of is limited to 1. First, hospital H i Calculate the gradient vector g i,r The model||g i,r ||:

[0121]

[0122] Then, Hi For the gradient vector g i,r Each component in is normalized to obtain

[0123]

[0124] Each hospital is required to calculate the gradient vector g i,r Normalization not only helps to reduce the data distribution differences between hospitals, increase the consistency between models, speed up the convergence of the global model, and enhance the accuracy of the global model, but also avoids non-target attacks launched by malicious actors through enhanced gradients, because the gradient vector g i,r The module will always be limited to 1 and cannot be enhanced; S203, Hospital H i Using the encoding function The normalized gradient vector Encoded into a polynomial g(X). First, H i The gradient vector g i,r Extension to vectors of length 2n in Indicates g i The conjugate of the polynomial g(X) is then calculated as the coefficient c i :

[0125]

[0126] Then the polynomial g(X) is calculated by formula (5):

[0127]

[0128] Next Hospital H i Use the public key pk in the security parameters s =(a,b), combined with the encryption function Enc(pk s ,g(X)) is encrypted. First, H i Select random numbers to construct polynomials u0, n0 and n1, then calculate y0 = b·u0+n0+g(X)(mod q), y1 = a·u0+n1(mod q) to get the ciphertext represents the gradient vector g i,r By Hospital H i The final gradient ciphertext obtained after normalization, encoding and encryption;

[0129] S204, Hospital H i The final gradient ciphertext Upload to RI;

[0130] The step S30 comprises the following steps:

[0131] S301, RI receives the hospital H i Gradient ciphertext sent

[0132] S302, RI uses the evaluation key evk in the security parameters s and the rotation key rk s , combining the homomorphic addition function Add(·), the homomorphic multiplication function Mult(·) and the inner product function Calculate the H of each hospital i The ciphertext of the uploaded gradient vector modulus Assume that two ciphertexts ct1=(c 1,1 ,c 1,2 ), ct2=(c 2,1 ,c 2,2 ), RI first defines homomorphic addition function and homomorphic multiplication function, then the homomorphic addition result of two ciphertexts is ct add =(c 1,1 +c 2,1 ,c 1,2 +c 2,2 ), the result of homomorphic multiplication is ct mult =(c1+a v ·c3,c2+b v c3), where c1 = c 1,1 ·c 2,1 , c2=c 1,1 ·c 2,2 +c 1,2 ·c 2,2 , c3=c 1,2 ·c 2,2 , a v and b v is the evaluation key evk s Then RI defines the inner product function Dot(·), using the rotation key rk s calculate:

[0133]

[0134] Get the inner product ciphertext ct1 and ct2 ct = (c m,1 ,c m,2 ), where R(·) represents the new polynomial obtained by rotating the corresponding polynomial coefficients by i positions. RI is calculated to obtain the H i The ciphertext of the uploaded gradient vector modulus Then all the hospital numbers and their corresponding calculation results Upload to SM;

[0135] S303, SM receives the hospital number and its corresponding calculation result sent from RI Use your own private key sk kept locally s For all calculation results To decrypt, assume that the ciphertext First, use the decryption function Calculate the polynomial u(X)=c m,1 +c m,2 ·sk s , and then use the decoding function Calculate m(X) = u(X) / Δ, extract the first N / 2 components of the polynomial m(X) to form the coefficient vector (m0, m1, ..., m N / 2-1 ), and then calculate:

[0136]

[0137] Get the decryption result m i,r SM will decrypt the result m i,r =1, add the numbers of the hospitals to the list L, and then send L to RI;

[0138] S304, RI uses its own initial training set D0 to train a baseline model and obtain the baseline gradient g 0,r , then normalize the local gradient g 0,r ,get Next, Encode and encrypt to obtain a baseline gradient ciphertext. The specific process can be described by the following formula:

[0139]

[0140] Among them, g0(X) represents The polynomial for encoding is Represents the baseline gradient ciphertext that RI has locally. Then, RI uses the evaluation key evk in the security parameters s and the rotation key rk s , combined with the inner product function Calculate baseline gradient ciphertext And the gradient ciphertext uploaded by each hospital in list L The cosine similarity ciphertext between:

[0141]

[0142] in Indicates that in the rth iteration, hospital H i Gradient ciphertext Baseline gradient ciphertext with RI The cosine similarity ciphertext between them, its plaintext represents the angle between two ciphertext vectors, ranging from -1 to 1;

[0143] The step S40 comprises the following steps:

[0144] S401. For each hospital H in the list L i , RI uses the homomorphic addition function Get the ciphertext

[0145]

[0146] Ciphertext The range of is adjusted to [0,2], and then RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext

[0147]

[0148] Assuming ciphertext RI uses the rescaling function Calculate the ciphertext Where p and q are the parameters selected by S102. The range of is adjusted to [0,1];

[0149] S402, RI uses ciphertext Combine the Sigmoid function for each hospital H in the list L i Assign weights. First, RI adjusts the parameters in the Sigmoid function, transforming it into a function centered at 0.5:

[0150]

[0151] Among them, β is a hyperparameter that adjusts the curvature of the Sigmoid function, and RI sets its value to 50.

[0152] S403, RI uses a polynomial to approximate equation (12), and the approximate polynomial is:

[0153] y=0.2787x 3 +0.4214x 2 +1.0181x+0.9991 (13)

[0154] For each hospital H in list L i First, RI uses the rotation key evks , combined with the homomorphic multiplication function Get the ciphertext

[0155]

[0156] RI uses the rescaling function Get the ciphertext Next, RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext

[0157]

[0158] RI uses the rescaling function Get the ciphertext Next, RI converts the ciphertext into as well as Multiply by the corresponding coefficient:

[0159]

[0160] RI uses the rescaling function to obtain the ciphertext as well as Finally, get the hospital H i Aggregate weight ciphertext

[0161]

[0162] S404. For each hospital H in the list L i , RI uses the rotating key evk s , combined with the homomorphic multiplication function Calculate the ciphertext

[0163]

[0164] Then, RI uses the rescaling function Get the ciphertext Finally, RI uses the homomorphic addition function to add all the ciphertexts Accumulate and get the aggregate ciphertext

[0165]

[0166] The step S50 comprises the following steps:

[0167] S501, RI uses the homomorphic addition function Add(S j,r ,S j+1,r ), calculate the sum of the weights of the L hospitals participating in the training at the time of aggregation

[0168]

[0169] Among them, |L| represents the number of hospitals in the list L. Then, RI encrypts the weighted sum And aggregate ciphertext Send to SM.

[0170] S502, SM receives the weighted sum ciphertext And aggregate ciphertext Afterwards, use the private key sk that you keep locally s To decrypt:

[0171]

[0172] Among them, t(X) and sum(X) represent the weighted sum ciphertext And aggregate ciphertext The plaintext polynomial obtained after decryption. Then, SM uses the decoding function to obtain the aggregation result g of the rth round respectively. r Sum of weights r :

[0173] g r =Dcd(t(X),Δ),sum r =Dcd(sum(X),Δ) (22)

[0174] Finally, SM calculates the final aggregate gradient of this round

[0175]

[0176] S503, SM uses encoding function The final aggregate gradient Encoded into a polynomial m(X):

[0177]

[0178] Then, SM uses RI’s public key pk r , combined with the encryption function Enc(pk r ,m(X)) re-encrypts the aggregation result to obtain the aggregated gradient ciphertext

[0179]

[0180] Finally, SM aggregates the gradient ciphertext Sent to RI and various hospitals.

[0181] S504, RI and Hospital H i Receive the aggregate gradient ciphertext from SM Afterwards, using RI's private key sk r , combined with the decryption function Get the plaintext polynomial P(X):

[0182]

[0183] Then, RI and Hospital H i Use the decoding function Dcd(P(X),Δ) to get the global aggregate gradient

[0184]

[0185] Finally, RI and Hospital H i Using Global Aggregate Gradients To update your local model:

[0186]

[0187] S505, RI tests the accuracy of the updated model. If the accuracy reaches the expected value, it means that the training is completed. Otherwise, each hospital H i The process proceeds to stage S201, and on this basis, the r+1th round of local model training is performed.

[0188] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A federated learning method for enhancing robustness and protecting medical privacy, characterized in that: The following steps are involved: S10, system initialization, first, the system administrator SM selects a security parameter λ, a left rotation parameter l and a scaling factor Δ, then SM generates a set of keys (pk s ,sk s ,evk s ,rk s ), and (pk s ,evk s ,rk s ) and the scaling factor Δ are sent to the research institution RI, which generates a set of key sets (pk r ,sk r ,evk r ,rk r ), a global model for protecting medical data, RI sets all security parameters SecPar = {(pk s ,evk s ,rk s ),Δ,(pk r ,sk r ,evk r ,rk r )}, the initial model parameters W0 and the learning rate η are sent to all hospitals participating in the medical data model training; S20, local model training. After receiving the security parameters sent by RI, all hospitals participating in the training use their local medical data sets, combined with the initial model parameters W0 and the learning rate η to train the model, obtain the local model gradient, and then normalize the gradient. The normalized gradient is encrypted using the security parameters, and finally the gradient ciphertext is uploaded to the RI server. S30, gradient ciphertext evaluation. SM and RI jointly perform normalization judgment on the gradient ciphertexts uploaded by each hospital. SM removes the gradient ciphertexts that have not been normalized. RI uses its own data set to train to obtain the baseline gradient, normalizes the baseline gradient and encrypts it to obtain the baseline gradient ciphertext. RI calculates the cosine similarity ciphertext between the gradient ciphertexts uploaded by each hospital and the baseline gradient ciphertext, and uses the cosine similarity ciphertext as the standard for evaluating the quality of the gradient ciphertexts uploaded by each hospital. S40, gradient ciphertext aggregation, RI adjusts the aggregation weight of each gradient ciphertext based on cosine similarity. First, RI approximates the Sigmoid logic function as a polynomial. Then, the cosine similarity ciphertext is used as the input value, and the aggregation weight corresponding to each gradient ciphertext is calculated using this polynomial. Finally, RI aggregates according to each gradient ciphertext and its corresponding weight value. S50, global model update, RI sends the aggregation result to SM, SM uses the private key sk s Decrypt the aggregated result and send the decrypted result to the public key pk r Re-encrypt and then send to RI and each hospital participating in the training; after obtaining the re-encrypted aggregate gradient, RI and the hospitals participating in the training use their own private key sk r Decryption is performed, and then the local model is updated according to the decrypted global model. After each round of training, RI will use the global model of this round to test on the test set. When the model accuracy reaches the expected value, RI ends this federated learning task; otherwise, RI will require the participating hospitals to conduct the next round of model training, and repeat steps S20, S30, S40, and S50 in sequence; The federated learning method for enhancing robustness and protecting medical privacy includes system administrators, scientific research institutions, multiple hospitals, and servers; Among them, scientific research institutions themselves have a clean dataset through public datasets or experimental sampling, which is used to train an initial model.

2. The method for enhancing robustness and protecting medical privacy according to claim 1, characterized in that: The step S10 comprises the following steps: S101. Multiple hospitals jointly publish federated learning task requirements to SM. SM entrusts RI to assist in completing model aggregation. Then, SM initializes RI and hospitals participating in federated learning training and numbers these entities. Each entity has a unique ID to identify the identity information of the participants. S102, SM selects a security parameter λ, a left-hand parameter l and a scaling factor Δ. Then, SM selects a large prime number q to limit the size of the polynomial coefficients, a modulus p for rescaling, and selects a power of 2 N as the order of the polynomial to construct a polynomial quotient ring R. q =Z q [X] / (x N +1), then SM from ring R q N random samples are taken from a discrete Gaussian distribution G on the surface of the matrix to construct the polynomial sk s =s0+s1x+s2x 2 +…+s N-1 x N-1 (mod x N +1), the coefficients of the polynomial are randomly sampled values ​​from the discrete Gaussian distribution G, which is a Gaussian distribution with integers as its range and a probability mass function of: Similarly, SM constructs a polynomial e by random sampling in G, and q Construct a polynomial a by randomly sampling from a uniform distribution U on the surface and calculate b = -a·sk s +e(mod q) to get pk s =(a,b), then SM randomly samples and constructs the polynomial e in G v and e k , randomly sample and construct polynomial a in U v and a k , calculate b v =-a v ·sk s +Δ·sk s 2 +e v (mod q) get evk s =(a v ,b v ), calculate b k =-a k ·sk s +R(sk s ,l)+e k (mod q) gets rk s =(a k ,b k ), where R(sk s ,l) means to convert sk s The new polynomial obtained by rotating the coefficients of l positions; SM generates the public key pk s , used to encrypt the hospital's local gradient and protect the privacy data of medical patients; generate the private key sk s , which is kept locally in the SM and used to decrypt the aggregated results of each round; generate the evaluation key evk s , used to support homomorphic multiplication operations; generate the rotation key rk s , used to support ciphertext rotation operations, forming a set of key sets (pk s ,sk s ,evk s ,rk s ); Then, SM sends the key set (pk s ,evk s ,rk s ) and the scaling factor Δ are sent to RI; S103, RI sets global parameters for this federated learning task, including the initial model W0 and the learning rate η, and RI generates a pair of public and private keys pk r and sk r , where pk r Used to encrypt the global model and protect the privacy of the global model, sk r By RI and Hospital H i Used to decrypt the global model; generate the key evk r and the rotation key rk r , which are used to support homomorphic multiplication and ciphertext rotation operations, forming a set of key sets (pk r ,sk r ,evk r ,rk r ), RI sets all security parameters SecPar = {(pk s ,evk s ,rk s ),Δ,(pk r ,sk r ,evk r ,rk r )}, the initial model parameters W0 and the learning rate η are sent to all hospitals H participating in the medical data model training i .

3. The federated learning method for enhancing robustness and protecting medical privacy according to claim 1, characterized in that: The step S20 comprises the following steps: S201, Hospital H i After receiving the initial model parameters W0, learning rate η and security parameters required for encryption and decryption from RI, the local medical dataset M i ={ <x k ,y k >|k=1,2,…,n} for local model training, x k and k Represent the medical data set M i The model input value and sample label of hospital H i Based on the global model parameter W of the previous round r-1 Perform model training and obtain the gradient vector g of this round through gradient descent i,r =(g0,g1,…,g n-1 ), n is the gradient vector g i,r Dimensions; S202, Hospital H i Calculate the gradient vector g i,r The model||g i,r ||: Then, H i For the gradient vector g i,r Each component in is normalized to obtain S203, Hospital H i Using the encoding function The normalized gradient vector Encoded into a polynomial g(X), first, H i The gradient vector g i,r Extension to vectors of length 2n in Indicates g i The conjugate of the polynomial g(X) is then calculated as the coefficient c i : Then the polynomial g(X) is calculated by formula (5): Next Hospital H i Use the public key pk in the security parameters s =(a,b), combined with the encryption function Enc(pk s ,g(X)) is encrypted; first, H i Select random numbers to construct polynomials u0, n0 and n1, then calculate y0 = b·u0+n0+g(X)(mod q), y1 = a·u0+n1(mod q) to get the ciphertext represents the gradient vector g i,r By Hospital H i The final gradient ciphertext obtained after normalization, encoding and encryption; S204, Hospital H i The final gradient ciphertext Upload to RI.

4. The method for federated learning with enhanced robustness and protection of medical privacy according to claim 1, characterized in that: The step S30 comprises the following steps: S301, RI receives the hospital H i Gradient ciphertext sent S302: RI uses the evaluation key evk in the security parameters s and the rotation key rk s , combining the homomorphic addition function Add(·), the homomorphic multiplication function Mult(·) and the inner product function Calculate the H of each hospital i The ciphertext of the uploaded gradient vector modulus Assume that two ciphertexts ct1=(c 1,1 ,c 1,2 ), ct2=(c 2,1 ,c 2,2 ), RI first defines the homomorphic addition function Add(·) and the homomorphic multiplication function Mult(·). The homomorphic addition result of two ciphertexts is ct add =(c 1,1 +c 2,1 ,c 1,2 +c 2,2 ), the result of homomorphic multiplication is ct mult =(c1+a v ·c3,c2+b v c3), where c1 = c 1,1 ·c 2,1 , c2=c 1,1 ·c 2,2 +c 1,2 ·c 2,2 , c3=c 1,2 ·c 2,2 , a v and b v is the evaluation key evk s polynomial, then RI defines the inner product function Dot(·), using the rotation key rk s calculate: Get the inner product ciphertext ct1 and ct2 ct = (c m,1 ,c m,2 ), where R(·) represents the new polynomial obtained by rotating the corresponding polynomial coefficients by i positions. The RI is calculated to obtain the H i The ciphertext of the uploaded gradient vector modulus Then all the hospital numbers and their corresponding calculation results Send to SM; S303, SM receives the hospital number and its corresponding calculation result sent from RI Use your own private key sk kept locally s For all calculation results To decrypt, assume that the ciphertext First, use the decryption function Calculate the polynomial u(X)=c m,1 +c m,2 ·sk s , and then use the decoding function Calculate m(X) = u(X) / Δ, extract the first N / 2 components of the polynomial m(X) to form the coefficient vector (m0, m1, ..., m N / 2-1 ), and then calculate: Get the decryption result m i,r SM will decrypt the result m i,r =1, add the numbers of the hospitals to the list L, and then send L to RI; S304, RI uses its own initial training set D0 to train a baseline model and obtain the baseline gradient g 0,r , then normalize the local gradient g 0,r ,get Next, Encode and encrypt to obtain a baseline gradient ciphertext. The specific process is described by the following formula: Among them, g0(X) represents The polynomial for encoding is Represents the baseline gradient ciphertext that RI has locally. Then, RI uses the evaluation key evk in the security parameters s and the rotation key rk s , combined with the inner product function Calculate baseline gradient ciphertext And the gradient ciphertext uploaded by each hospital in list L The cosine similarity ciphertext between them is: in Indicates that in the rth iteration, hospital H i Gradient ciphertext Baseline gradient ciphertext with RI The cosine similarity ciphertext between the two ciphertext vectors is represented by its plaintext, which is the cosine value of the angle between the two ciphertext vectors, ranging from -1 to 1.

5. The method for enhancing robustness and protecting medical privacy according to claim 1, characterized in that: The step S40 comprises the following steps: S401. For each hospital H in the list L i , RI uses the homomorphic addition function Get the ciphertext Right now: Ciphertext The range of is adjusted to [0,2], and then RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext Right now: Assuming ciphertext RI uses the rescaling function Calculate the ciphertext Where p and q are the parameters set in S102, the ciphertext The range of is adjusted to [0,1]; S402, RI uses ciphertext Combine the Sigmoid function for each hospital H in the list L i To assign weights, first, RI adjusts the parameters in the Sigmoid function, transforming it into a function centered at 0.5: Among them, β is a hyperparameter that adjusts the curvature of the Sigmoid function, and RI sets its value to 50; S403, RI uses a polynomial to approximate equation (12), and the approximate polynomial is: y=0.2787x 3 +0.4214x 2 +1.0181x+0.9991 (13) For each hospital H in list L i First, RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext RI uses the rescaling function Get the ciphertext Next, RI uses the rotation key evk s , combined with the homomorphic multiplication function Get the ciphertext RI uses the rescaling function Get the ciphertext Next, RI converts the ciphertext into as well as Multiply by the corresponding coefficient: RI uses the rescaling function to obtain the ciphertext as well as Finally, get the hospital H i Aggregate weight ciphertext S404. For each hospital H in the list L i , RI uses the rotating key evk s , combined with the homomorphic multiplication function Calculate the ciphertext Then, RI uses the rescaling function Get the ciphertext Finally, RI uses the homomorphic addition function to add all the ciphertexts Accumulate and get the aggregate ciphertext 6. The method for enhancing robustness and protecting medical privacy according to claim 1, characterized in that: The step S50 comprises the following steps: S501, RI uses the homomorphic addition function Add(S j,r ,S j+1,r ), calculate the weighted sum of the L hospitals participating in the training at the time of aggregation Among them, |L| represents the number of hospitals in the list L. Then, RI encrypts the weighted sum And aggregate ciphertext Send to SM; S502, SM receives the weighted sum ciphertext And aggregate ciphertext Afterwards, use the private key sk that you keep locally s To decrypt: Among them, t(X) and sum(X) represent the weighted sum ciphertext And aggregate ciphertext The plaintext polynomial obtained after decryption, then SM uses the decoding function to obtain the aggregation result g of the rth round respectively r Sum of weights r : g r =Dcd(t(X),Δ),sum r =Dcd(sum(X),Δ) (22) Finally, SM calculates the final aggregate gradient of this round S503, SM uses encoding function The final aggregate gradient Encoded into a polynomial m(X): Then, SM uses RI’s public key pk r , combined with the encryption function Enc(pk r ,m(X)) re-encrypts the aggregation result to obtain the aggregated gradient ciphertext Finally, SM aggregates the gradient ciphertext Sent to RI and various hospitals; S504, RI and Hospital H i Receive the aggregate gradient ciphertext from SM Afterwards, using RI's private key sk r , combined with the decryption function Get the plaintext polynomial P(X): Then, RI and Hospital H i Use the decoding function Dcd(P(X),Δ) to get the global aggregate gradient of this round Finally, RI and Hospital H i Using Global Aggregate Gradients To update your local model W r : S505, RI tests the accuracy of the updated model on the test set. If the accuracy reaches the expected value, it means that the training is completed. Otherwise, each hospital H i The process proceeds to stage S201, and on this basis, the r+1th round of local model training is performed.

Images