An efficient federated learning aggregation method and device with robustness, verifiability and privacy

Abstract

The application provides an efficient federated learning aggregation method and device with robustness, verifiability and privacy, and belongs to the field of distributed deep learning security. The specific steps are as follows: a trusted authorized institution sends verification preparation information to a client; the client locally trains a model, calculates auxiliary information and shares the auxiliary information with two servers; under a gradient lossless differential privacy enhancement algorithm, the two servers convert the Boolean sharing into lossless gradient arithmetic sharing, and simultaneously add client-level differential privacy; the two servers perform kernel principal component analysis (PCA) dimension reduction and DP tolerant clustering; the two servers aggregate the gradients and send global update information to the client; the client completes lightweight enhanced verification information transmission and verifies the aggregation integrity using the received information, and ensures strong verifiability; if the verification is passed, the method returns to step two, and the next round of training is continued until the model converges or the preset training round is reached.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of distributed deep learning security, and relates to the security protection, result verification, privacy protection and model efficiency of federated learning, in particular to an efficient federated learning aggregation method and device with robustness, verifiability and privacy. BACKGROUND

[0002] Federated learning is a distributed machine learning architecture with privacy protection, which allows clients to collaboratively train a globally shared model without sharing local data. Today, federated learning has been applied to privacy protection fields such as drug discovery, face recognition and medical diagnosis.

[0003] FedAvg[1] and FedSGD[2] are commonly used aggregation algorithms in federated learning, but they are vulnerable to poisoning attacks, which affect the global model. Label-flipping attack[3] and scaling attack[4] change the label, while outlier attack[5] and Gaussian noise attack[6] modify the gradient, causing the model to fail or perform poorly. Backdoor attack[4] implants triggers for specific data, while adaptive poisoning attack[7] further enhances the concealment. In addition, these attacks can be combined with Sybil attack[8] to control multiple clients to enhance the effect of poisoning attacks.

[0004] To defend against poisoning attacks, new robust aggregation algorithms are proposed, such as Dnc[9] based on singular value decomposition spectral method to detect and remove outliers. FLTrust[3] overcomes the limitation of honest majority by calculating noise gradients from clean small data sets. Bulyan

[10] combines Krum and Trimmed Mean to calculate the trimmed mean of the remaining updates after filtering malicious updates.

[11] uses k-means to cluster and group gradient updates. However, there is a conflict between hiding gradient updates and removing malicious gradients by calculating update similarity. These methods may lead to privacy leakage[12, 13], making them vulnerable to member inference attacks and attribute inference attacks

[14] . Although differential privacy can provide some protection, attackers can still infer private data through repeated queries or analysis[12, 15, 16]. To better protect privacy, secure multi-party computation and homomorphic encryption technology

[17] need to be combined with differential privacy.

[0005] To balance the robustness and privacy of poisoning attacks, under the single-server architecture, RoFL

[18] enforces and l ∝Defense. BREA

[19] filters malicious gradients by pairwise distance between updates and enhances privacy based on verifiable outlier detection. However, multiple rounds of interaction verification significantly reduces system efficiency while assuming server honesty is unrealistic. In the distributed trust architecture, PPRAgg [6] protects privacy by homomorphic encryption and random obfuscation techniques, and adopts cosine similarity to evaluate the reputation of the Byzantine node. However, this method has high computational overhead while being unable to resist the elevated malicious gradient. Prio

[20] based on arithmetic secret sharing non-interactive proof protocol (SNIPs) effectively filters malicious gradient updates and provides strong privacy protection under the collusion of the client and at most one server. However, the application of SNIPs results in low overall efficiency of Prio. Prio+

[21] avoids the use of zero-knowledge proof in Prio by replacing arithmetic secret sharing with Boolean secret sharing, improving efficiency while further limiting the operational capabilities of malicious clients. However, similar to other federated learning systems (such as LSFL

[22] , SecFedDMC

[23] ), Prio+ only guarantees privacy under the semi-honest server model. Although subsequent research

[24] has optimized SNIPs, the computational cost is still high. To this end, ELSA [5] ensures privacy and robustness under strong threat models through lightweight protocols and l2 norm defense mechanisms. However, carefully designed local models can easily bypass this defense [25, 26, 27], leading to training failure.

[0006] The above research ignores the possibility of server falsifying aggregated results. In research that balances verifiability and privacy, VerifyNet

[27] combines bilinear pairs and homomorphic hash functions to achieve verifiable secure aggregation. VERIFL

[28] improves VerifyNet by introducing linear homomorphic hash and equivocal commitment schemes, enabling resistance to client and server collusion forgery while significantly reducing communication overhead. VFL

[29] uses Lagrange interpolation to verify the correctness of aggregated gradients, but ignores the problem of client withdrawal. VOSA

[30] designs a dynamic group management mechanism that can handle user withdrawal and support these users to participate in future training rounds. PVFL

[31] proposes a perturbation mechanism that can be offset during aggregation, achieving verification independent of dropouts and dimensions. However, most integrity verification methods rely on masking routes, and there is a conflict between obfuscating gradient updates and detecting malicious gradients, while key negotiation also brings complex computational overhead. Therefore, the current research on building a robust, verifiable, private, and efficient federated learning secure aggregation framework that balances multiple security requirements is a blank in the current federated learning research field.

[0007] The references are as follows:

[0008] [1] Mcmahan H B, Moore E, Ramage D, et al. Communication-Efficient Learning of Deep Networks from Decentralized Data [J]. 2016. DOI:10.48550 / arXiv.1602.05629.

[0009] [2] Mcmahan H B, Moore E, Ramage D, et al. Federated Learning of Deep Networks using Model Averaging [J]. 2016. DOI:10.48550 / arXiv.1602.05629.

[0010] [3] Cao X, Fang M, Liu J, et al. FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping. [C] / / Network and Distributed System Security Symposium. Internet Society, 2021. DOI:10.14722 / NDSS.2021.24434.

[0011] [4] Bagdasaryan E, Veit A, Hua Y, et al. How To Backdoor Federated Learning [J]. 2018. DOI:10.48550 / arXiv.1807.00459.

[0012] [5] Rathee M, Shen C, Wagh S, et al. Elsa: Secure aggregation for federated learning with malicious actors [C] / / 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023:1961-1979.

[0013] [6] Ma X, LI Q, JIANG Q, et al. Byzantine-robust federated learning over non-IID data[J]. Journal on Communications, 2023, 44(6): 138-153.

[0014] [7] Qi X, Xie T, Li Y, et al. Revisiting the assumption of latent separability for backdoor defenses[C] / / The eleventh international conference on learning representations. 2023.

[0015] [8] Fung C, Yoon C J M, Beschastnikh I. The Limitations of Federated Learning in Sybil Settings[C] / / Recent Advances in Intrusion Detection. 2020.

[0016] [9] Shejwalkar V, Houmansadr A. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning[C] / / NDSS. 2021.

[0017]

[10] Guerraoui R, Rouault S. The hidden vulnerability of distributed learning in byzantium[C] / / International conference on machine learning. PMLR, 2018: 3521-3530.

[0018]

[11] Yu L,Wu L.Towards byzantine-resilient federated learning viagroup-wise robust aggregation[J].Federated Learning:Privacy and Incentive,2020:81-92.

[0019]

[12] Shokri R,Stronati M,Song C,et al.Membership inference attacksagainst machine learning models[C] / / 2017 IEEE symposium on security andprivacy(SP).IEEE,2017:3-18.

[0020]

[13] Lee D D,Pham P,Largman Y,et al.Advances in neural informationprocessing systems 22[J].Tech Rep,2009.

[0021]

[14] Hu K,Gong S,Zhang Q,et al.An overview of implementing securityand privacy in federated learning[J].Artificial Intelligence Review,2024,57(8):204.

[0022]

[15] Yeom S,Giacomelli I,Fredrikson M,et al.Privacy risk in machinelearning:Analyzing the connection to overfitting[C] / / 2018 IEEE 31st computersecurity foundations symposium(CSF).IEEE,2018:268-282.

[0023]

[16] Carlini N,Liu C,Erlingsson Carlin A,Tramer F,Baruch A,et al.The secret sharer:Evaluating and testing unintended memorization in neural networks[C] / / 28th USENIX security symposium(USENIX security 19).2019:267-284.

[0024]

[17] Domingo-Enrich C,Mroueh Y.Auditing Differential Privacy in High Dimensions with the Kernel Quantum R'enyi Divergence[J].arXiv preprint arXiv:2205.13941,2022.

[0025]

[18] Burkhalter L,Lycklama H,Viand A,et al.Rofl:Attestable robustness for secure federated learning[J].arXiv preprint arXiv:2107.03311,2021,21.

[0026]

[19] So J,Güler B,Avestimehr A S.Byzantine-resilient secure federated learning[J].IEEE Journal on Selected Areas in Communications,2020,39(7):2168-2181.

[0027]

[20] Corrigan-Gibbs H,Boneh D.Prio:Private,robust,and scalable computation of aggregate statistics[C] / / 14th USENIX symposium on networked systems design and implementation(NSDI 17).2017:259-282.

[0028]

[21] Addanki S, Garbe K, Jaffe E, et al. Prio+: Privacy preserving aggregate statistics via boolean shares[C] / / International Conference on Security and Cryptography for Networks. Cham: Springer International Publishing, 2022:516-539.

[0029]

[22] Zhang Z, Wu L, Ma C, et al. LSFL: A lightweight and secure federated learning scheme for edge computing[J]. IEEE Transactions on Information Forensics and Security, 2022, 18:365-379.

[0030]

[23] Mu X, Cheng C, Song A, et al. Byzantine attack resistant privacy preserving federated learning[J]. Journal of Computer Science and Technology, 2024, 47(04):842-861.

[0031]

[24] Boneh D, Boyle E, Corrigan-Gibbs H, et al. Zero-knowledge proofs on secret-shared data via fully linear PCPs[C] / / Annual International Cryptology Conference. Cham: Springer International Publishing, 2019:67-97.

[0032]

[25] Xie C, Koyejo O, Gupta I. Fall of empires: Breaking byzantine-tolerant sgd by inner product manipulation[C] / / Uncertainty in Artificial Intelligence. PMLR, 2020:261-270.

[0033]

[26] Tolpegin V, Truex S, Gursoy M E, et al. Data poisoning attacks against federated learning systems [C] / / Computer security - ESO Ric s 2020: 25th European symposium on research in computer security, ESO Ric s 2020, guildford, UK, September 14-18, 2020, proceedings, part i 25. Springer International Publishing, 2020: 480-501.

[0034]

[27] Zhang J, Chen B, Cheng X, et al. PoisonGAN: Generative poisoning attacks against federated learning in edge computing systems [J]. IEEE Internet of Things Journal, 2020, 8(5): 3310-3322.

[0035]

[27] Xu G, Li H, Liu S, et al. VerifyNet: Secure and verifiable federated learning [J]. IEEE Transactions on Information Forensics and Security, 2019, 15: 911-926.

[0036]

[28] Guo X, Liu Z, Li J, et al. Veri fl: Communication-efficient and fast verifiable aggregation for federated learning [J]. IEEE Transactions on Information Forensics and Security, 2020, 16: 1736-1751.

[0037]

[29] Fu A, Zhang X, Xiong N, et al. VFL: A verifiable federated learning with privacy-preserving for big data in industrial IoT [J]. IEEE Transactions on Industrial Informatics, 2020, 18(5): 3316-3326.

[0038]

[30] Wang Y, Zhang A, Wu S, et al. VOSA: Verifiable and oblivious secure aggregation for privacy-preserving federated learning [J]. IEEE Transactions on Dependable and Secure Computing, 2022, 20(5): 3601-3616.

[0039]

[31] Zhou H, Yang G, Huang Y, et al. Privacy-preserving and verifiable federated learning framework for edge computing [J]. IEEE Transactions on Information Forensics and Security, 2022, 18: 565-580. SUMMARY

[0040] In view of the above problem that multiple security requirements are difficult to balance in federated learning, the application provides an efficient federated learning aggregation method and device with robustness, verifiability and privacy. The specific design includes: (1) through the privacy-protected two-party kernel principal component analysis and the two-party density space clustering algorithm tolerant to differential privacy, the effective filtering of malicious gradient and noise resistance are realized; (2) using aggregation integrity verification under distributed trust, combined with linear homomorphic hash and commitment scheme, it is ensured that even when a server and a client collude, the aggregation result cannot be forged; (3) using gradient lossless client-level differential privacy enhancement, through lossless gradient sharing and differential privacy injection, the gradient privacy protection is ensured; (4) the overall framework is lightweight, avoiding expensive encryption operations, the verification communication overhead is low, and the system efficiency is significantly improved. The framework efficiently realizes the unity of robustness, verifiability and privacy under a strong threat model, and solves the shortcomings of existing research.

[0041] The efficient federated learning aggregation method and device with robustness, verifiability and privacy, specifically includes the following steps:

[0042] Step one, verification preparation: the trusted authority sends the linear homomorphic hash function preparation information LHHpp and the commitment scheme preparation information COMpp required for verification to the client.

[0043] Step two, training and uploading: the client trains the model locally through independent local data, calculates auxiliary information, and shares these information with the server through secret sharing.

[0044] Step three, gradient lossless client-level differential privacy enhancement: the server S (1) and S (0) convert the Boolean sharing into lossless gradient arithmetic sharing. (1) Add client-level differential privacy to ensure strong privacy. The sub-process is as follows:

[0045] (1) Lossless arithmetic sharing conversion: two servers use COT (correlation oblivious transfer) based bit multiplication and bit combination to convert the Boolean sharing of gradient updates into lossless arithmetic sharing. In order to reduce communication overhead, the server only needs to verify the auxiliary related information generated by the client. A malicious server may try to break the gradient privacy by sending a message with incorrect format. Since each client performs independent operations in the first stage, honest clients can simulate the interaction with the two servers in advance. The present application ensures the privacy safety of malicious servers in collusion by polling the consistency between the verification session record and the actual interaction once.

[0046] (2) Server-based client-level differential privacy injection: since the defense interaction is not independent between clients, a client-level differential privacy mechanism based on semi-honest server S (1) is designed to ensure that even if a malicious server S (0) obtains the gradient update, it is still difficult to break the data privacy. First, the query function Q and its bounded sensitivity S Q are defined as follows:

[0047]

[0048] Where, is the gradient obtained by training on the batch data on the data set d i . U t represents the samples of all clients in the t-th round, w t-1 is the global model weight of the t-1-th round.

[0049] To solve the problem of computing sensitivity without prior knowledge, norm clipping is needed. Specifically, a threshold τ is set for updating, and the model update g is replaced by

[0050] Since the server S (1) cannot clip the plaintext gradient, each client must normalize the l2 norm in advance, and cooperate with the server S (0) to verify whether the fixed update norm ||g||2≤τ holds, ensuring that the uploaded gradient update is consistent with the result after norm clipping. Since the verification process is independent of the client, privacy is ensured by one round of polling. The sensitivity S t and the noise scale σ t of the t-th round are expressed as:

[0051]

[0052] where η t is the learning rate, and ε is the privacy budget - the smaller the privacy budget, the larger the noise.

[0053] Adding noise to the locally shared update g (1) , we can get the local model g ′ that satisfies the client-level differential privacy, whose expression is:

[0054]

[0055] Step four, two-party kernel principal component analysis with privacy protection and two-party density space clustering algorithm tolerant to differential privacy: the dual server performs kernel principal component PCA dimensionality reduction and DP tolerant clustering, ensuring strong protection against malicious updates. The detailed process is as follows:

[0056] (1) Kernel matrix calculation: use the Laplace kernel function to amplify and separate data differences in high-dimensional space, efficiently realize linear separability:

[0057]

[0058] where exp is the exponential function, σ is the standard deviation, and ||·|| represents the Manhattan distance between z i and z j . The calculation of k(z i , z j ) depends on SecMSB and SecMul. The server S (b) finally obtains the kernel matrix K (b) .

[0059] (2) Kernel matrix centering: before performing eigenvalue decomposition, the kernel matrix needs to be normalized:

[0060]

[0061] where 1 N is an N x N matrix whose each element is equal to

[0062] (3) Eigenvalue decomposition: The kernel matrix is decomposed into a set of eigenvalues and eigenvectors. Using Theorem 1, the eigen decomposition is transformed into a simpler secure operation, thus reducing the computation and communication overhead.

[0063] Theorem 1: If matrices A and B satisfy B = P -1 AP, then the two matrices have the same eigenvalues. If matrix A has an eigenvector v corresponding to eigenvalue λ, then P -1 v is an eigenvector of matrix B corresponding to eigenvalue λ.

[0064] Two-party kernel principal component analysis with privacy protection uses the arithmetic sharing P (b) of random matrix P to blind the secret sharing of kernel matrix , thus obtaining After the server recovers , it computes its eigenvalues and eigenvectors Based on Theorem 1, the server S (b) safely computes the eigenvalues and eigenvectors of the kernel matrix and shares

[0065] (4) Reconstruct principal component: Before selecting the principal component vectors, normalization is performed to obtain new eigenvector sharing The first n eigenvectors are selected in descending order as the principal components

[0066] (5) Data projection: To achieve dimensionality reduction, secure multiplication is performed between the original local model and the principal components to obtain the dimensionally reduced local model sharing

[0067] (6) Pre-adjust the neighborhood radius eps: Only in the first round of training, adjust eps adaptively based on the linear correlation between the neighborhood radius eps and the noise scale σ t , which is expressed as eps = a · σ t + β, where a and β are constants.

[0068] The values of constants a and β are determined based on the training results of the auxiliary dataset D by the server S (1) in the offline phase. To obtain n sets of model updates W, the server S(1) The enhanced dataset D will be divided into n parts for training in the offline phase. The neighborhood radius eps is computed by the ordered k-distance graph method, resulting from the clean model update set W and the noisy t The model update set of scale Since σ t is known, the values of a and β can be approximated using the following equations:

[0069]

[0070] (7) On the defined neighborhood radius eps, the server S (1) and the server S (0) perform the density space clustering algorithm based on secure multi-party computation to remove malicious gradient updates from all client uploaded gradient updates.

[0071] Step five, aggregation and download: the server S (1) and the server S (0) aggregate the gradients and send the global update information to the clients.

[0072] Step six, aggregation integrity verification under distributed trust: after completing the lightweight enhanced verification information transmission, the client uses the received information to verify the aggregation integrity, ensuring strong verifiability. The detailed process is as follows:

[0073] (1) Lightweight enhanced verification transmission: each client uses the LHHpp and Compp obtained from the trusted authority (TA) to locally calculate the verification information V (hash value h, commitment value c, random number r) of the gradient update g i and sends it to the server S (0) and S (1) . After aggregation, the server sends the received verification information share set to each client for verification. The length of the verification information is fixed and no longer depends on the dimension of the gradient update, and the communication overhead is limited to O (|C|), where C is the set of participating clients.

[0074] (h i,0 , h i,1 ) = SS (HH.hash (g i ))

[0075] (c i,0 , c i,1 ) = SS (COM.commit (h i ))

[0076] (r i,0 , r i,1 ) = SS (r i )

[0077] (2) Aggregation result integrity verification: First, the Decommit process is performed to verify whether the hash value of the gradient update has been tampered with.

[0078]

[0079] Second, in order to verify the aggregation result, it needs to be associated with the hash value and reduced to a discrete logarithm problem. Taking federated averaging aggregation as an example (with equal weight coefficients, i.e. ), the verification can be completed by checking whether the hash value of the aggregation result is the same as the product of the multi-party hash value h * (k). After integrity verification, a new round of training can begin.

[0080]

[0081] Step seven, repeat execution: if the verification is passed, go back to step two and continue the next round of training until the model converges or the preset training round is reached.

[0082] The advantages of the present application are:

[0083] (1) In view of the severe challenge of difficult to balance multiple security requirements in federated learning, the present application innovatively proposes a new aggregation framework with robustness, verifiability, privacy and high efficiency.

[0084] (2) In terms of strong robustness of aggregation, the present application proposes a new algorithm of two-party kernel principal component analysis with privacy protection and two-party density space clustering tolerant to differential privacy, which combines secure two-party computation and kernel principal component analysis to significantly improve the robustness under high-dimensional gradient attack, and realizes efficient malicious gradient filtering by maintaining the quasi-clustering boundary.

[0085] (3) In terms of strong verifiability of aggregation, the present application designs a new mechanism for aggregation integrity verification under distributed trust, which uses linear homomorphic hash and commitment scheme to prevent server and client collusion to fake aggregation results, while ensuring verification efficiency.

[0086] (4) In terms of strong privacy of individual gradient, the present application proposes a new strategy of gradient lossless client-level differential privacy enhancement, which ensures the protection of gradient privacy even if the malicious client and server collude by lossless gradient sharing and client-level differential privacy injection.

[0087] (5) The present application adopts lightweight design as a whole, avoids expensive encryption operations, and uses linear homomorphic hash function to reduce communication overhead, significantly improving system efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0088] Figure 1 A schematic diagram of a robust, verifiable, and privacy-preserving efficient federated learning aggregation method and device

[0089] Figure 2 A flowchart of a robust, verifiable, and privacy-preserving efficient federated learning aggregation method and device

[0090] Figure 3 A gradient lossless client-level differential privacy enhancement schematic diagram

[0091] Figure 4 A two-party kernel principal component analysis with privacy protection schematic diagram

[0092] Figure 5 A two-party density space clustering tolerant differential privacy schematic diagram

[0093] Figure 6 An aggregation integrity verification schematic diagram under distributed trust

[0094] Figure 7 A time overhead comparison experiment diagram of various verification methods under different gradient and client numbers DETAILED DESCRIPTION

[0095] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and specific examples.

[0096] The present application proposes a robust, verifiable, and privacy-preserving efficient federated learning aggregation method and device, which has significant robustness, verifiability, efficiency, and privacy protection advantages. Through the two-party kernel principal component analysis with privacy protection and the density space clustering algorithm tolerant differential privacy, malicious gradients can be effectively filtered and noise interference can be resisted. Combined with linear homomorphic hash and commitment scheme, aggregation integrity verification is realized under distributed trust, and even if the server and the client collude, the result cannot be forged. At the same time, the gradient lossless client-level differential privacy enhancement technology is adopted to ensure the privacy and security of the gradient. The overall design is lightweight, avoiding high-cost encryption operations, with low communication overhead, significantly improving the system efficiency. The method realizes the unity of robustness, verifiability, and privacy under a strong threat model, solving the shortcomings of existing research.

[0097] The specific steps of the robust, verifiable, and privacy-preserving efficient federated learning aggregation method and device under the implementation method are as shown in Figure 1 and Figure 2 , including the following processes:

[0098] Step one, verification preparation: the trusted authority TA sends the linear homomorphic hash function preparation information LHHpp and the commitment scheme preparation information COMpp required for verification to the client c respectively.

[0099] Step two, training and uploading: the client c trains the model locally by independent training of local data, and uses norm clipping to replace the model update g with At the same time, the auxiliary information Aux is calculated, and the secret sharing is shared with the server S (1) and S (0) The auxiliary information includes OT correlation, square correlation, Beaver triple correlation, and session record information generated by the server for each client in the lossless arithmetic sharing transformation stage.

[0100] Step three, gradient lossless client-level differential privacy enhancement Figure 3 ): the server S (1) and S (0) convert the Boolean sharing into lossless gradient arithmetic sharing. S (1) Add client-level differential privacy to ensure strong privacy. The detailed process is as follows:

[0101] (1) Lossless arithmetic sharing transformation: two servers use COT (correlation oblivious transfer) based bit multiplication and bit combination to convert the Boolean sharing of gradient updates into lossless arithmetic sharing. By one-time polling to verify the consistency between session records and actual interactions, it ensures the privacy safety in collusion cases.

[0102] (2) Server-based client-level differential privacy injection: servers S (1) and S (0) collaborate to verify whether the fixed update norm ||g||2≤τ is true, ensuring that the uploaded gradient update is consistent with the result after norm clipping.

[0103] The server S (1) adds noise to the locally shared update g (1) , and the local model g ′ that satisfies the client-level differential privacy can be obtained, and its expression is:

[0104]

[0105] Step four, two-party kernel principal component analysis with privacy protection and two-party density space clustering algorithm tolerant to differential privacy Figure 4 and Figure 5 ): the double server performs kernel principal component PCA dimension reduction and DP tolerant clustering to ensure strong protection against malicious updates. The detailed process is as follows:

[0106] (1) Kernel matrix computation: Server S (0) and Server S (1) Efficiently achieve linear separability based on secure multi-party computation and Laplacian kernel function to amplify and separate data differences in high-dimensional space:

[0107]

[0108] where exp is the exponential function, σ is the standard deviation, and ||·|| represents the Manhattan distance between z i and z j . The calculation of k(z i , z j ) relies on SecMSB and SecMul. Server S (b) finally obtains the kernel matrix K (b) .

[0109] (2) Kernel matrix centering: Before performing eigenvalue decomposition, Server S (0) and Server S (1) normalize the kernel matrix:

[0110]

[0111] where 1 N is an N x N matrix, each element of which is equal to

[0112] (3) Eigenvalue decomposition: The kernel matrix is decomposed into a set of eigenvalues and eigenvectors. Use the arithmetic sharing P (b) of the random matrix P to blind the secret sharing of the kernel matrix , so as to obtain Server S (0) and Server S (1) restore , and then Server S (1) calculates its eigenvalues and eigenvectors Subsequently, Server S (b) safely calculates the eigenvalues and eigenvector shares of the kernel matrix

[0113] (4) Reconstruct principal components: Before selecting principal component vectors, Server S (0) and Server S (1) perform normalization to obtain new eigenvector shares Select the top n eigenvectors in descending order as principal components

[0114] ​(5) Data projection: To achieve dimensionality reduction, server S (0) and server S (1) perform secure multiplication between original local model and principal components to get the reduced dimension local model share

[0115] (6) Pre-adjustment of neighborhood radius eps: Only in the first round of training, adjust eps adaptively based on the linear correlation between neighborhood radius eps and noise scale σ t , which is expressed as eps = a · σ t + β, where a and β are constants, based on the training results of the auxiliary data set D in the offline stage of server S (1) .

[0116] (7) Based on the defined neighborhood radius eps, server S (0) and server S (1) perform density space clustering algorithm based on secure multi-party computation to remove malicious gradient updates from all client uploaded gradient updates.

[0117] Step five, aggregation and download: server S (0) and server S (1) aggregate the gradients and send the global update to the clients participating in the aggregation.

[0118] Step six, aggregation integrity verification under distributed trust Figure 6 ): After completing the lightweight enhanced verification information transmission, the client verifies the aggregation integrity using the received information to ensure strong verifiability. The detailed process is as follows:

[0119] (1) Lightweight enhanced verification transmission: Each client uses LHHpp and Compp obtained from the trusted authority (TA) to locally calculate the verification information V (hash value h = HH.hash(g i ), commitment value c = COM.Commit(h i ), random number r) of the gradient update g i , and sends it to servers S (0) and S (1) arithmetically shared (h i,0 , h i,1 ), (c i,0 , c i,1 ), (r i,0 , r i,1 ). After aggregation, the server sends the received verification information share set to each client for verification.

[0120] (2) Verify the integrity of the aggregation result: first, execute the COM.Decommit(c i ,h i ,r i ) process to determine whether it is 1 to verify whether the hash value of the gradient update has been tampered with.

[0121] Second, in order to verify the aggregation result, it needs to be associated with the hash value and reduced to a discrete logarithm problem. Taking federated averaging aggregation as an example (with equal weight coefficients, i.e. ), verification can be completed by checking whether the hash value of the aggregation result is the same as the product of the hash values of the parties. After integrity verification, a new round of training can begin.

[0122] Step seven, repeat execution: if the verification is passed, go back to step two and continue the next round of training until the model converges or the preset training round is reached.

[0123] Experimental setup: the method is implemented based on PyTorch, and the experimental environment is 2 NVIDIA RTX 2080Ti GPUs, Intel Xeon Gold 5218 CPUs, 64GB RAM, and Ubuntu 18.04.6LTS, and NVIDIA A100 GPUs are used for large-scale dataset training. The dataset includes MNIST, Fashion-MNIST, CIFAR10, ImageNet and THUCNews, and non-IID data is generated through Dirichlet distribution. MNIST uses MLP, Fashion-MNIST uses CNN, CIFAR10 uses LeNet5, ImageNet uses ResNet-50, THUCNews uses ALBERT, RoBERTa and BERT. Attack methods include LF-attack, GS-attack, Scaling attack, Sybil attack and Outlier attack. The baseline comparison covers Bulyan, BREA, LSFL, PPRAgg, Prio, ELSA, etc., and the evaluation indicators include DAR, FPR, TACC, PSR, SDO and SVO. The experimental setup is 100 clients, 45 malicious clients, 100 training rounds, local Adam optimizer, learning rate 0.01, batch size 128, Dirichlet distribution parameter β = 5, and the verification scheme is based on NIST P-256 elliptic curve, SHA-256 hash and Shamir secret sharing technology. The method of the present application is abbreviated as EARVP in the experiment.

[0124] Experimental results:

[0125] (1) Malicious gradient defense comparison experiment: all attacks are combined with Sybil attack, and the attack effect is intensified through multi-client cooperation. As shown in the following table, Prio and Prio+ rely on weak l p norm defense, which is invalid for most poisoning attacks; BREA selects similar models based on Krum algorithm, and Bulyan combines Krum and Trimmed-Mean, which has better performance than BREA, but the test accuracy (TACC) is 1.86% and 4.85% lower than EARVP respectively, and the poisoning success rate (PSR) is higher. ELSA uses l2 norm threshold, which only performs well under Outlier attack, and the overall robustness is insufficient. LSFL adopts K-Nearest Neighbor method, which performs poorly under non-IID data. PPRAgg relies on unreliable reference gradients, and is vulnerable to 45% malicious gradients. SecFedDMC uses RPCA+K-means algorithm, which has poor effect on LF attack on CIFAR10, and the poisoning success rate is nearly 10% higher. Although the accuracy rate in Outlier attack detection reaches 99.33%, the overall test accuracy is affected by the missed detection. In contrast, EARVP performs best on ImageNet and other datasets, reduces the poisoning success rate by 1.56% and improves the test accuracy by 3.61% through l_2 norm normalization and gradient clipping, which is significantly better than SecFedDMC.

[0126] Table 1. Comparison of the effects of poisoning attack detection methods on different datasets and different attacks

[0127]

[0128]

[0129]

[0130] (2) Overall time overhead comparison experiment: To evaluate the defense overhead of gradient lossless client-level differential privacy enhancement, two-party kernel principal component analysis with privacy protection and two-party density space clustering algorithm that tolerates differential privacy in EARVP, we measured the time of key steps (excluding local training). As shown in the following table, Prio adopts a non-interactive proof protocol with secret sharing and affine aggregation encoding, which has both robustness and privacy protection, but the time overhead is the highest. PPPAgg relies on homomorphic encryption and obfuscation technology, which is computationally complex and has the second highest running time. LSFL, Prio+, ELSA and SecFedDMC use secure multi-party computation for lightweight gradient detection, among which ELSA has the shortest running time due to the simple l2 norm defense, but the protection is weaker; LSFL improves the detection effect by increasing the gradient comparison time; SecFedDMC enhances detection by dimension reduction and clustering. EARVP is superior to SecFedDMC in detection effect, and the running time is similar, showing high efficiency. Its computational overhead is feasible in practical applications and suitable for widespread deployment.

[0131] Table 2. Time overhead (SDO) comparison of different secure defense methods under different data sets

[0132]

[0133] Secondly, we further explore the time overhead (SVO) comparison between the aggregation integrity verification under distributed trust and other advanced aggregation result verification methods. As shown in Figure 7 the table, whether increasing the gradient update dimension or increasing the number of clients, the overall verification time overhead of the aggregation integrity verification under distributed trust is always lower than that of other algorithms. When |U| = 100, |G| = 1000, its verification overhead is only 0.76% of VerifyNet, 2.42% of VERIFL, 3.13% of PVFL and 58.89% of VOSA.

Claims

1. An efficient federated learning aggregation method with robustness, verifiability, privacy, characterized in that, The steps are as follows: Step one, verification preparation: the trusted authority sends the linear homomorphic hash function preparation information LHHpp and the commitment scheme preparation information COMpp required for verification to the client; Step two, training and uploading: the client locally trains the model independently, calculates the auxiliary information, and shares the information with the server through secret sharing; Step three, gradient-preserving client-level differential privacy enhancement: server S (1) and S (0) Convert the Boolean share to lossless gradient arithmetic share, S (1) Add client-level differential privacy to ensure strong privacy; Step four, two-party kernel principal component analysis with privacy protection and two-party density space clustering algorithm tolerant to differential privacy: the two servers perform kernel principal component PCA dimension reduction and DP tolerant clustering to ensure strong protection against malicious updates; Step five, aggregation and download: server S (1) and server S (0) aggregate the gradients and send global update information to the clients; Step six, aggregation integrity verification under distributed trust: after completing the lightweight enhanced verification information transmission, the client verifies the aggregation integrity using the received information to ensure strong verifiability; Step seven, repeat execution: if the verification is passed, go back to step two and continue the next round of training until the model converges or the preset training rounds are reached.

2. The robust, verifiable, privacy-preserving federated learning aggregation method of claim 1, wherein, The gradient lossless client-level differential privacy enhancement algorithm designed in step three ensures gradient privacy protection through lossless gradient sharing and differential privacy injection: Gradient lossless client-level differential privacy enhancement: server S (1) and S (0) Convert boolean shares to lossless gradient arithmetic shares, S (1) Add client-level differential privacy, ensuring strong privacy, flow as follows: (1) Lossless arithmetic sharing conversion: two servers use COT-based bit multiplication and bit combination to convert the Boolean sharing of gradient updates to lossless arithmetic sharing. The server only needs to verify the auxiliary information generated by the client. Malicious servers may try to compromise gradient privacy by sending format error messages. Since each client performs independent operations in the first stage, honest clients can simulate the interaction with the two servers in advance. The present application ensures the consistency between the polling verification session record and the actual interaction in the collusion case, ensuring malicious privacy security in the collusion case; (2) Server-based client-level differential privacy injection: Since the defense interactions are not independent between clients, a client-level differential privacy mechanism based on semi-honest server S (1) is designed to ensure that even if a malicious server S (0) obtains the gradient update, it is still difficult to break data privacy. First, the query function Q and its bounded sensitivity S Q are defined as follows: wherein, is the gradient obtained by training on the batch data on the dataset d i t represents the samples of all clients in the tth round, w t-1 is the global model weight of the t-1th round;​ Using norm clipping, set a threshold τ for updates, and the model update g is replaced by Since the server S (1) cannot clip the plaintext gradient, each client must normalize the l2-norm in advance and collaborate with the server S (0) to verify whether the fixed update norm ||g||2≤v holds, ensuring that the uploaded gradient update is consistent with the result after norm clipping. Since the verification process is independent of the client, privacy is ensured by one round of polling. The sensitivity S t and the noise scale σ t in the t-th round are represented as: where η t is the learning rate and ε is the privacy budget - the smaller the privacy budget, the larger the noise. adding noise to the local shared updates g adding noise to the local shared updates g (1) The local model g' satisfying client-level differential privacy can be obtained as 3. The robust, verifiable, privacy-preserving federated learning aggregation method of claim 1, wherein, The two-party kernel principal component analysis with privacy protection and two-party density space clustering algorithm tolerant to differential privacy designed in step four: (1) Kernel matrix calculation: use the Laplace kernel function to amplify and separate data differences in high-dimensional space: (2) Kernel matrix centering: before performing eigenvalue decomposition, the kernel matrix needs to be normalized: where exp is the exponential function, s is the standard deviation, || · || denotes the Manhattan distance between z i and z j , and the computation of k(z i ,z j ) relies on SecMSB and SecMul, the server S (b) eventually obtains the kernel matrix K (b) ; (3) Eigenvalue decomposition: the kernel matrix is decomposed into a set of eigenvalues and eigenvectors. Feature decomposition is converted into a simpler security operation, thereby reducing computational and communication overheads; where 1 N is an NxN matrix whose elements are equal to The aggregation integrity verification algorithm under distributed trust designed in step six combines linear homomorphic hash and commitment scheme to ensure that even when one server and client collude, the aggregation result cannot be forged: Two-party kernel principal component analysis with privacy protection uses arithmetic sharing of a random matrix P (b) to blind the kernel matrix using a secret sharing of the kernel matrix, thereby obtaining the server recovers the eigenvalues and eigenvectors of the kernel matrix (b) The server S securely computes the eigenvalues and eigenvectors of the kernel matrix (4) Reconstruct principal components: Before selecting principal component vectors, normalization processing is performed to obtain new feature vectors Select the first n feature vectors in descending order as principal components (5) Data projection: To achieve dimension reduction, perform secure multiplication between the original local model and principal components Obtain the shared local model after dimension reduction (6) Pre-adjustment of the neighborhood radius eps: only in the first round of training, eps is adapted based on a linear correlation between the neighborhood radius eps and the noise scale σ t eps is adapted adaptively based on a linear correlation between the neighborhood radius eps and the noise scale σ, expressed as eps = a · σ + β, where a and β are constants t + β, where a and β are constants The values of the constants a and b are based on the server S (1) The training results on the auxiliary dataset D in the offline phase determine, in order to obtain n sets of model updates W, the server S (1) The enhancement dataset D will be divided into n parts for training in the offline phase, the neighborhood radius eps is calculated by the ordered k-distance graph method, resulting from the clean model update set W and and the noisy t The scale of the model update set Since t The values of a and b can be approximated using the following equations, since (7) On the defined neighborhood radius eps, the server S (1) performs the density space clustering algorithm based on secure multi-party computation between the server S (0) and the server S, to remove the malicious gradient updates from all the gradient updates uploaded by the clients.

4. The robust, verifiable, privacy-preserving federated learning aggregation method of claim 1, wherein, Aggregation integrity verification under distributed trust: after completing the lightweight enhanced verification information transmission, the client verifies the aggregation integrity using the received information, and the process is as follows: ​ (1) Lightweight enhanced verification transmission: each client computes the gradient update g i at the local using LHHppand Comppobtained from a trusted authority, the verification information V including the hash value h, the commitment value c, and the random number r, and sends it to the server S (0) and S (1) After aggregation, the server sends the received set of verification information shares to each client for verification. The length of the verification information is fixed and no longer dependent on the dimension of the gradient update, and the communication overhead is limited to O(|C|), where C is the set of participating clients; (2) Verification of integrity of the aggregation result: first, the Decommit process is executed to verify whether the hash value of the gradient update has been tampered with, if COM.Decommit(c i ,h i ,r i ) is equal to 1, it has not been tampered with, otherwise it has been tampered with; Second, in order to verify the aggregation result, it needs to be associated with the hash value, and it is reduced to the discrete logarithm problem, for example, federated average aggregation, verification can be completed by checking whether the hash value of the aggregation result is the same as the product of the hash values h * (k) of the parties, after integrity verification, a new round of training can begin;

Images