Federal learning privacy protection method and system based on selective homomorphic encryption

Abstract

The invention discloses a federated learning privacy protection method and system based on selective homomorphic encryption, and the method comprises the steps: a client defines a sensitivity vector according to the sensitivity of a model parameter, and an aggregation server carries out the clustering of the client according to the similarity, and obtains a client cluster. Within each cluster, the server evaluates client system capabilities and derives an encryption budget. And the client constructs an encryption mask through a multi-objective optimization problem, iteratively updates the model parameter, the sensitivity vector and the encryption mask, partially encrypts the model parameter, and sends the encrypted model parameter and the encryption mask to the server. And the server completes model parameter aggregation, generates a union set of encrypted masks, and sends the union set back to the client. And the client decrypts the model parameters according to the union set, and performs training by taking the cluster as a unit until the model converges. According to the method, the problems of high homomorphic encryption communication and calculation cost and unbalanced security and encryption overhead under cross-device data isomerism and system isomerism in the prior art are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of federated learning and homomorphic encryption, and specifically relates to a federated learning privacy protection method and system based on selective homomorphic encryption. Background Art

[0002] Federated Learning (FL) is becoming increasingly popular because it enables collaborative machine learning model training without exposing the privacy of user sensitive data. However, multiple studies have shown that model parameters transmitted during FL training can be exploited by gradient inversion attacks to reconstruct user private data. To defend against such attacks, currently proposed methods include differential privacy (DP), secure multi-party computing (SMC), and homomorphic encryption (HE). DP has high theoretical security by perturbing the transmitted model parameters with noise, but may significantly reduce the accuracy of the model. SMC enables multiple parties to correctly perform distributed computing tasks without exposing private information, but requires the design of complex computing and synchronization protocols, making it unsuitable for devices with heterogeneous data and system capabilities. In contrast, HE has received widespread attention due to its strong privacy protection capabilities and ciphertext operability. However, homomorphic encryption involves multiple complex encryption operations, and both communication and computational overheads are relatively large. Especially in cross-device FL scenarios, client data and system capabilities are usually highly heterogeneous, and traditional homomorphic encryption methods cannot achieve the optimal balance between security and encryption overhead. Summary of the invention

[0003] The purpose of the present invention is to provide a federated learning privacy protection method and system based on selective homomorphic encryption, so as to overcome the high cost of homomorphic encryption communication and computing in the prior art, as well as the imbalance between security and encryption overhead in cross-device data heterogeneity and system heterogeneity scenarios.

[0004] In order to achieve the above object, the present invention provides the following technical solutions:

[0005] In a first aspect, the present invention provides a method for protecting privacy in federated learning based on selective homomorphic encryption, comprising the following steps:

[0006] The client obtains the sensitivity vector according to the model parameter sensitivity definition, and the server clusters the clients according to their similarities to obtain client clusters. The specific process is as follows:

[0007] Based on the definition of model parameter sensitivity, the client performs a federated learning training and then calculates the sensitivity vector and uploads it to the server. Considering that both the gradient and the sensitivity vector may reveal the change of the loss value, the client only uploads the sensitivity vector once during the entire training process;

[0008] The server measures the similarity of the client's sensitivity vectors;

[0009] Based on the similarity of the measured end sensitivity vectors, the server clusters the clients with independent and identically distributed data into their respective groups to obtain client clusters.

[0010] Furthermore, within the client cluster, the client's system capabilities are evaluated to derive the encryption budget of each client. The specific process is as follows:

[0011] Within each client cluster, the server measures each client’s CPU clock speed and bandwidth reflected in one iteration of federated learning training;

[0012] The encryption budget of each client is derived based on the client's CPU clock speed and the bandwidth reflected in one iteration of federated learning training as the client's system capability.

[0013] Furthermore, in the first iteration of the client-side federated learning training, the following formula is used to obtain the sensitivity vector of each client:

[0014]

[0015] Where w is the model parameter subset, Γ(w) is the sensitivity vector of the model parameter subset w, is the gradient of the loss function with respect to w, w T is the transpose of the model parameter subset w.

[0016] Furthermore, the Euclidean distance is used as the similarity measure of the sensitivity vectors.

[0017] Furthermore, the X-means method is used to dynamically estimate the number of client clusters.

[0018] In a second aspect, the present invention further provides a system for applying the above-mentioned federated learning privacy protection method based on selective homomorphic encryption, which mainly includes:

[0019] Clustering unit: obtains a sensitivity vector based on the sensitivity definition of model parameters, and clusters clients according to the similarity of the sensitivity vectors to obtain client clusters;

[0020] Encryption budget calculation unit: evaluates the client's system capabilities within the client cluster and derives the encryption budget of each client;

[0021] Encryption mask acquisition unit: Each client constructs and solves a multi-objective optimization problem for selecting model parameters to obtain the encryption mask;

[0022] Model parameter encryption unit: iteratively updates model parameters, sensitivity vectors, and encryption masks. The client uses the encryption mask to partially encrypt the model parameters.

[0023] Model parameter aggregation unit: The client sends partially encrypted model parameters and encryption masks to the server, and the server aggregates the partially encrypted model parameters and generates a union of the encryption masks;

[0024] Model parameter decryption unit: The client receives the union of the model parameters and the encryption mask sent by the server and decrypts the model parameters;

[0025] Model convergence unit: Perform regular federated learning training in each client cluster until the model converges.

[0026] In a third aspect, the present invention provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the above-mentioned federated learning privacy protection method based on selective homomorphic encryption is implemented.

[0027] In a fourth aspect, the present invention provides a computer-readable storage medium, which stores a computer program, and is characterized in that when the computer program is executed by a processor, the above-mentioned federated learning privacy protection method based on selective homomorphic encryption is implemented.

[0028] Compared with the prior art, the present invention has the following beneficial technical effects:

[0029] The present invention provides a privacy protection method for federated learning based on selective homomorphic encryption. By clustering clients with similar data distribution using model parameter sensitivity vectors, the degradation of model performance caused by data heterogeneity can be avoided. At the same time, by determining the encryption budget according to the client's bandwidth and device processing speed, and constructing and solving a multi-objective optimization problem for selective encryption of model parameters, it can be ensured that the overhead of homomorphic encryption is minimized without causing delays, while maximizing the security of the model and effectively resisting the most advanced gradient inversion attacks.

[0030] Specifically, this method uses the sensitivity vector of the model parameters defined by the client to accurately locate sensitive data and only encrypt the key sensitive parts. This selective encryption method minimizes unnecessary encryption calculations and reduces encryption overhead while ensuring privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 Schematic diagram of the process of a federated learning privacy protection method based on selective homomorphic encryption in an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] like Figure 1 As shown, the present invention provides a federated learning privacy protection method based on selective homomorphic encryption to adaptively balance the security of each client of cross-device federated learning and the overhead of homomorphic encryption, specifically comprising the following steps:

[0035] S1, the client obtains the sensitivity vector according to the model parameter sensitivity definition, and the server clusters the clients according to their similarities to obtain client clusters;

[0036] S2: In each cluster, the server evaluates the client's system capabilities and derives the client's encryption budget. After clustering, clients with similar data distribution are grouped together, so that subsequent evaluation of system capabilities, derivation of encryption budgets, and optimization of encryption strategies can be customized according to cluster characteristics, simplifying management complexity and achieving resource allocation.

[0037] S3, the client constructs and solves a multi-objective optimization problem for selective model parameter encryption to obtain the encryption mask;

[0038] S4, the client iteratively updates the model parameters, sensitivity vectors, and encryption masks, partially encrypts the model parameters using the encryption mask, and sends the partially encrypted model parameters and encryption mask to the server; selectively encrypts the model parameters to control the encryption overhead to the minimum necessary limit to ensure training efficiency and privacy security;

[0039] S5, the server aggregates the partially encrypted model parameters and generates a union of encryption masks, and sends it to the client;

[0040] S6, the client decrypts the model parameters through the union of the encryption masks and starts a new round of federated learning training;

[0041] S7: Repeat S4 to S6 to perform federated learning training in each client cluster until the model converges.

[0042] In one embodiment of the present invention, the client obtains a sensitivity vector according to the model parameter sensitivity definition, and the server clusters the clients according to the similarity of the sensitivity vectors. The specific process of obtaining the client cluster is as follows:

[0043] According to the definition of model parameter sensitivity, each client performs one federated learning training iteration and uploads the calculated sensitivity vector to the server;

[0044] The server measures the similarity of each client’s sensitivity vector;

[0045] Based on the measured similarity, the server clusters the clients with independent and identically distributed data into their respective groups to obtain client clusters.

[0046] In the first federated learning training iteration, the formula is applied:

[0047]

[0048] Where w is the model parameter subset, Γ(w) is the sensitivity vector of the model parameter subset w, is the gradient of the loss function with respect to w, w T is the transpose of the model parameter subset w. The Euclidean distance is used as the similarity measure between sensitivity vectors.

[0049] For the i-th client (denoted as Γ i ) and the jth client (denoted as Γ j ), their similarity measure is:

[0050]

[0051] in, is Γ i The Kth element in is Γ j The Kth element in N w Indicates the total number of model parameters; considering that the server has no prior knowledge of the client data distribution, the X-means method is used to dynamically estimate the optimal number of client clusters, and divide the clients with independent and identically distributed data into corresponding groups to form client clusters. In this way, subsequent processing can be optimized separately within client groups with similar characteristics, improving overall efficiency.

[0052] In one embodiment of the present invention, the encryption budget of different clients must be set according to their system capabilities, considering that the device CPU clock speed and bandwidth are the most determining factors in determining the device in the system in federated learning. Therefore, the server uses the CPU clock speed and bandwidth to derive the encryption budget of each client, and the specific process is:

[0053] Within each client cluster, the server measures each client’s CPU clock speed and the bandwidth reflected in one federated learning training iteration;

[0054] The encryption budget of each client is derived based on the client's CPU clock speed and the bandwidth reflected in one federated learning training iteration.

[0055] Furthermore, since the system capacity of a client in federated learning is always bottlenecked by its most limited resource, we use the smaller of bandwidth and clock speed to derive the encryption budget for each client. Considering that both gradients and sensitivity vectors may reveal changes in loss values, clients are required to upload their sensitivity vectors only once throughout the training process. This approach prevents adversaries from continuously observing the client's sensitivity vector, thus hindering their ability to infer the direction of model updates.

[0056] It should be noted that the client's CPU clock speed and the client's bandwidth have different measurement scales and are independent of each other. Therefore, in order to score the client's relative system capabilities, the server first normalizes them to the same scale by the maximum absolute scaling, expressed as: The normalized bandwidth is expressed as and the normalized CPU clock speed is expressed as By absolute maximum scaling:

[0057]

[0058] Among them, u i ∈{r i ,v i} is r i or v i The original value of In all N c r in the customer clusteri or v i After this normalization, the system capability of client i can be expressed as and The minimum value of Finally, the server further normalizes the system capabilities of each client and uses it as its encryption budget α i Sent back to the client. Encryption budget α i The calculation formula is as follows:

[0059]

[0060] It can be seen that the encryption budget α of the client with the best system performance i Yes 1.

[0061] For multi-objective optimization problems of model parameters, use a binary mask vector To represent the corresponding encryption decision of the model parameters. i is the encryption mask of client i, N w is the total number of model parameters. Specifically, if If it is 1, it means The corresponding model parameters will be encrypted, otherwise they will remain unencrypted.

[0062] The present invention also provides a system for applying the federated learning privacy protection method based on selective homomorphic encryption, comprising:

[0063] Clustering unit: obtains a sensitivity vector based on the sensitivity definition of model parameters, and clusters clients according to the similarity of the sensitivity vectors to obtain client clusters;

[0064] Encryption budget calculation unit: evaluates the client's system capabilities within the client cluster and derives the encryption budget of each client;

[0065] Encryption mask acquisition unit: Each client constructs and solves a multi-objective optimization problem for selecting model parameters to obtain the encryption mask;

[0066] Model parameter encryption unit: iteratively updates model parameters, sensitivity vectors, and encryption masks. The client uses the encryption mask to partially encrypt the model parameters.

[0067] Model parameter aggregation unit: The client sends partially encrypted model parameters and encryption masks to the server, and the server aggregates the partially encrypted model parameters and generates a union of the encryption masks;

[0068] Model parameter decryption unit: The client receives the union of the model parameters and the encryption mask sent by the server and decrypts the model parameters;

[0069] Model convergence unit: Perform regular federated learning training in each client cluster until the model converges.

[0070] In another embodiment of the present invention, a terminal device is provided, the terminal device includes a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), off-the-shelf programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal, which are suitable for implementing one or more instructions, and are specifically suitable for loading and executing one or more instructions to implement the corresponding method flow or corresponding functions; the processor described in the embodiment of the present invention can be used for the operation of the sensitivity-guided selective homomorphic encryption method of cross-device federated learning.

[0071] In another embodiment of the present invention, the present invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device for storing programs and data. It is understandable that the computer-readable storage medium here may include both a built-in storage medium in the terminal device and an extended storage medium supported by the terminal device. The computer-readable storage medium provides a storage space that stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions may be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here may be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor may load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the sensitivity-guided selective homomorphic encryption method for cross-device federated learning in the above embodiment.

[0072] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0073] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0074] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory generate a manufacturer including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A privacy protection method for federated learning based on selective homomorphic encryption, characterized in that: The following steps are involved: S1, the client obtains the sensitivity vector according to the model parameter sensitivity definition, and the server clusters the clients according to their similarities to obtain client clusters; S2, within each cluster, the server evaluates the client’s system capabilities and derives the client’s encryption budget; S3, the client constructs and solves a multi-objective optimization problem for selective model parameter encryption to obtain the encryption mask; S4, the client iteratively updates the model parameters, sensitivity vectors and encryption masks, partially encrypts the model parameters using the encryption mask, and sends the partially encrypted model parameters and encryption mask to the server; S5, the server aggregates the partially encrypted model parameters and generates a union of encryption masks, and sends it to the client; S6, the client decrypts the model parameters through the union of the encryption masks and starts a new round of federated learning training; S7: Repeat S4 to S6 to perform federated learning training in each client cluster until the model converges.

2. The method for protecting privacy in federated learning based on selective homomorphic encryption according to claim 1, characterized in that: Based on the sensitivity definition of model parameters, the sensitivity vector is obtained, and the server clusters the clients according to the similarity of the sensitivity vector. The specific process of obtaining the client cluster is as follows: Based on the definition of model parameter sensitivity, the client performs a federated learning training and then calculates the sensitivity vector and uploads the sensitivity vector to the server; The server measures the similarity of the client's sensitivity vectors; Based on the similarity of the measured sensitivity vectors, the server clusters the clients with independent and identically distributed data into their respective groups to obtain client clusters.

3. The method for protecting privacy in federated learning based on selective homomorphic encryption according to claim 1, characterized in that: In the client cluster, the client's system capabilities are evaluated and the encryption budget of each client is derived. The specific process is as follows: Within each client cluster, the server measures each client’s CPU clock speed and bandwidth reflected in one iteration of federated learning training; The encryption budget of each client is derived based on the client's CPU clock speed and the bandwidth reflected in one iteration of federated learning training as the client's system capability.

4. The method for protecting privacy in federated learning based on selective homomorphic encryption according to claim 2, characterized in that: The client uploads the sensitivity vector only once during the entire training process.

5. The method for protecting privacy in federated learning based on selective homomorphic encryption according to claim 2, characterized in that: In the first iteration of federated learning training on the client side, the following formula is used to obtain the sensitivity vector of each client: Where w is the model parameter subset, Γ(w) is the sensitivity vector of the model parameter subset w, is the gradient of the loss function with respect to w, w T is the transpose of the model parameter subset w.

6. The method for protecting privacy in federated learning based on selective homomorphic encryption according to claim 2, characterized in that: The Euclidean distance is used as the similarity measure of sensitivity vectors.

7. The method for protecting privacy in federated learning based on selective homomorphic encryption according to claim 1, characterized in that: Use the X-means method to dynamically estimate the number of client clusters.

8. A system using the method for protecting privacy in federated learning based on selective homomorphic encryption as described in any one of claims 1 to 7, characterized in that: Clustering unit: obtains a sensitivity vector based on the sensitivity definition of model parameters, and clusters clients according to the similarity of the sensitivity vectors to obtain client clusters; Encryption budget calculation unit: evaluates the client's system capabilities within the client cluster and derives the encryption budget of each client; Encryption mask acquisition unit: Each client constructs and solves a multi-objective optimization problem for selecting model parameters to obtain the encryption mask; Model parameter encryption unit: iteratively updates model parameters, sensitivity vectors, and encryption masks. The client uses the encryption mask to partially encrypt the model parameters. Model parameter aggregation unit: The client sends partially encrypted model parameters and encryption masks to the server, and the server aggregates the partially encrypted model parameters and generates a union of the encryption masks; Model parameter decryption unit: The client receives the union of the model parameters and the encryption mask sent by the server and decrypts the model parameters; Model convergence unit: Perform regular federated learning training in each client cluster until the model converges.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the federated learning privacy protection method based on selective homomorphic encryption as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the federated learning privacy protection method based on selective homomorphic encryption as described in any one of claims 1 to 7 is implemented.

Images