A multi-party collaborative data availability security detection method and system

Abstract

The application discloses a kind of multi-party collaborative data availability security detection method and system, comprising: initialization stage: client pre-processes local data;Verification server constructs projection matrix, and first encryption matrix generated according to projection matrix is distributed to each client, and the private key corresponding to the second encryption matrix and first encryption matrix is uploaded to central server;Gradient upload stage: adjacent client negotiates shared mask, obtains gradient data by training local data, uses shared mask to add disturbance to gradient data, and uploads the disturbed gradient data to central server;Data availability detection stage: in the mode of multi-party cooperation, after two rounds of verification, it is guaranteed that the shared mask uploaded by adjacent different clients is consistent, the gradient data uploaded by the same client for aggregation is consistent with the gradient data for availability detection, so that the result obtained by clustering analysis detection is meaningful.The application makes the detection more accurate while protecting the gradient privacy.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a multi-party cooperative data availability security detection method and system. BACKGROUND

[0002] In an open interconnected environment, the fusion and utilization of data resources have become an important foundation for effectively releasing the value of data elements and supporting the construction of digital economy. Since the proposal of federated learning as an effective way of data security fusion, it has received extensive attention from all walks of life. The defense problem of data poisoning attack of federated learning has always been a hot research field. The server may be damaged by the toxic data uploaded by some malicious clients, resulting in the inability of model training to converge or the significant decline of performance. In order to effectively resist data poisoning attacks and protect the security of clients, the data availability detection aggregation scheme against data poisoning attacks has emerged. This scheme mainly covers two detection aggregation methods of robust aggregation and anomaly detection. However, these schemes still have certain limitations in training accuracy, communication efficiency and security, and need to be further optimized and improved.

[0003] Specifically, in the detection scheme using robust aggregation, the inherent properties of model update are often further utilized to identify and weaken the effect of malicious model update to complete the detection and resistance of toxic data. For example, the paper "Robust aggregation for federated learning" published in 2022 proposes a new robust federated learning method based on the traditional Krum aggregation algorithm. By introducing geometric median instead of traditional arithmetic mean aggregation mechanism, it effectively resists the damage of model update caused by malicious use of toxic data or uploading of toxic gradient by clients. This method designs an iterative optimization framework based on the smoothing Weiszfeld algorithm, which protects user privacy while reducing communication overhead by using secure multi-party computation protocol. This method regards the model as a vector and extracts information by using its statistical characteristics, and the calculation is simple, which is suitable for detecting attacks that have a greater impact on model update. If the change caused by the attack is too small, or the evaluation criteria of statistical characteristics and similarity cannot well distinguish malicious gradient, the defense effect will be greatly reduced.

[0004] In addition, the patent "A federated learning robust aggregation method based on backdoor attack defense" (Application No. CN202410776571.8, Publication No. CN118965415A) applied by Beijing University of Technology. The invention analyzes the similarity of key parameters of the global model of federated learning, reduces the dimension of the model parameters, performs unsupervised clustering, and calculates the local proxy model. After dimension reduction, the cosine distance between model parameters divides malicious models and benign models, ensuring the performance of outlier detection and unsupervised clustering. Through the Euclidean distance, the local proxy model is pruned, which can effectively resist high amplitude value malicious backdoor attacks and improve the robustness of aggregation.

[0005] In the aggregation scheme using anomaly detection, statistical and analytical methods are often used to detect patterns, data sets or related events of the model, and to distinguish by defining one or more loss functions. If the system detects patterns, abnormal behavior or abnormal data that do not meet expectations, it will issue a warning and take action. The defense method of anomaly detection is similar to robust aggregation, and there is some overlap. The difference is that the latter only detects model updates and ultimately obtains global aggregated gradients, while the former detects maliciously injected data or false models without considering aggregation. For example, in 2022, "Anomaly Detection in Time Series with Robust Variational Quasi-Recurrent Autoencoders" proposed a new deep learning method called Variational Quasi-Recurrent Autoencoder (VQRAE) and its bidirectional expansion version (BiVQRAE). The robust objective function based on α, β and γ divergence is designed, and the weight of the abnormal point in the loss calculation is suppressed to make the model focus more on the learning of normal patterns in unlabeled training, so that it has strong robustness and optimal comprehensive performance in terms of detection accuracy and training efficiency.

[0006] Although the above existing aggregation scheme alleviates the harm of malicious clients uploading or using poisoned gradient data for server model aggregation to a certain extent, researchers still hope to make requirements for the detection of poisoned gradient data under the premise of protecting the privacy of client uploaded gradients, and are still skeptical about whether the model can be efficiently aggregated when the client uses or uploads poisoned gradient data. First, most existing robust aggregation schemes treat uploaded parameters as vectors and extract their statistical features as a judgment method, which makes the client uploaded gradient data saved in plaintext to the server, thereby posing a great threat to the privacy of the client data; second, when some discrimination operations are performed on the gradient data uploaded by each client in a non-public manner, the huge computational and communication overhead generated greatly reduces the practicability of the entire data availability and security detection scheme; finally, since all operations are performed under the condition that the gradient data is not disclosed, it is also a big problem to ensure the consistency of the detection data and the actual aggregation data. How to accurately and efficiently detect the availability of the gradient data uploaded by the client under the premise of ensuring the privacy of the uploaded gradient, has become a major problem that needs to be solved. SUMMARY

[0007] In order to solve the above problems existing in the prior art, the present application provides a multi-party collaborative data availability and security detection method and system. The technical problem to be solved by the present application is realized by the following technical scheme:

[0008] In a first aspect, the embodiments of the present application provide a multi-party collaborative data availability and security detection method, which comprises:

[0009] The initialization stage comprises: each client pre-processes the local data, and loads the global model parameters issued by the central server; the verification server constructs a projection matrix, and generates a first encryption matrix and a second encryption matrix according to the projection matrix, distributes the first encryption matrix to each client, and uploads the second encryption matrix and the private key corresponding to the first encryption matrix to the central server;

[0010] The gradient uploading stage comprises: each client negotiates a shared mask with the adjacent client, and obtains gradient data by training according to the global model parameters and the pre-processed local data, applies disturbance to the gradient data by using the shared mask to obtain disturbed gradient data, and uploads the disturbed gradient data to the central server;

[0011] The data availability detection stage comprises: each client uses the first encryption matrix to perform feature mapping on the preprocessed local data to generate a first verification parameter, uploads the first verification parameter to the central server, and uploads the shared mask to the verification server; the central server calculates a new first verification parameter according to the first verification parameter and the corresponding private key, and calculates a second verification parameter according to the second encryption matrix, and uploads the new first verification parameter and the second verification parameter to the verification server; the verification server verifies the shared mask uploaded by each client, if the verification is passed, verifies the consistency of the gradient data for detection and the gradient data for aggregation according to the second verification parameter, if the verification is passed, the central server performs clustering analysis on the first verification parameter to obtain secure available scrambled gradient data, aggregates all secure available scrambled gradient data, and distributes new global model parameters to each client, or ends the model training to complete the data security aggregation.

[0012] In an embodiment of the present application, if the data availability detection stage verifies that there is a verification failure, a malicious client is determined, and the corresponding method further comprises:

[0013] The data aggregation stage comprises: the central server performs clustering analysis on the first verification parameter to obtain the scrambled gradient data of the malicious client as the poisoned gradient data; the client adjacent to the malicious client uploads the shared mask negotiated with the malicious client to the central server; and the central server aggregates and recovers the scrambled gradient data uploaded by the remaining clients except the malicious client according to the poisoned gradient data and all shared masks negotiated with the malicious client.

[0014] In a second aspect, an embodiment of the present application provides a multi-party collaborative data availability security detection system, which comprises a client, a verification server and a central server; wherein,

[0015] The client comprises: a model parameter receiving module, configured to receive global model parameters issued by a central server; a preprocessing module, configured to preprocess local data; a model parameter loading module, configured to load the global model parameters issued by the central server; a shared mask negotiation module, configured to negotiate a shared mask with adjacent clients by each client; a shared mask uploading module, configured to upload the shared mask to a verification server; a gradient training module, configured to obtain gradient data by training according to the global model parameters and the preprocessed local data; a gradient scrambling processing module, configured to obtain scrambled gradient data by applying disturbance to the gradient data using the shared mask; a scrambled gradient uploading module, configured to upload the scrambled gradient data to the central server; an encryption matrix receiving module, configured to receive a first encryption matrix issued by the verification server; a first inspection parameter generating module, configured to generate a first inspection parameter by performing feature mapping on the preprocessed local data using the first encryption matrix; and a first inspection parameter uploading module, configured to upload the first inspection parameter to the central server.

[0016] The verification server comprises: an encryption matrix construction module, configured to construct a projection matrix, and generate a first encryption matrix and a second encryption matrix according to the projection matrix; an encryption matrix distribution and uploading module, configured to distribute the first encryption matrix to each client, and upload the second encryption matrix and a private key corresponding to the first encryption matrix to the central server; a first shared mask receiving module, configured to receive the shared mask uploaded by each client; a second inspection parameter receiving module, configured to receive the second inspection parameter uploaded by the central server; a shared mask verification module, configured to verify the shared mask uploaded by each client; and a consistency confirmation module, configured to verify the consistency of gradient data used for detection and gradient data used for aggregation according to the second inspection parameter.

[0017] The central server comprises: an encryption matrix and key receiving module, configured to receive the second encryption matrix issued by the verification server and the private key corresponding to the first encryption matrix; a gradient receiving module, configured to receive the scrambled gradient data uploaded by each client; a first inspection parameter receiving module, configured to receive the first inspection parameter uploaded by each client; a first detection parameter updating module, configured to calculate new first inspection parameters according to the first inspection parameters and the corresponding private keys; a second inspection parameter generating module, configured to calculate second inspection parameters according to the second encryption matrix; a second inspection parameter uploading module, configured to upload the second inspection parameters to the verification server; an availability security detection module, configured to obtain securely available scrambled gradient data by clustering analysis on the first inspection parameters; a secure aggregation module, configured to perform data aggregation on all securely available scrambled gradient data; a model parameter distribution module, configured to issue global model parameters to each client; and a model parameter updating module, configured to update the global model parameters issued to each client.

[0018] In an embodiment of the present application, the central server further comprises:

[0019] The availability security detection module is further configured to, when there is a malicious client, perform cluster analysis on the first verification parameter to obtain scrambling gradient data of the malicious client as poisoning gradient data.

[0020] The second shared mask receiving module is configured to receive shared masks uploaded by clients adjacent to the malicious client, the shared masks being respectively negotiated with the malicious client.

[0021] The aggregation recovery module is configured to perform aggregation recovery processing on the scrambling gradient data uploaded by the clients other than the malicious client using all the shared masks negotiated with the malicious client.

[0022] The present application has the following advantages:

[0023] The multi-party collaborative data availability security detection method provided by the present application efficiently realizes the secure aggregation of client gradient data under the premise of availability security detection and protection of user data.

[0024] In terms of gradient privacy protection, in the conventional data availability security detection scheme, the plaintext of the uploaded gradient data is mostly used or the client local data is directly sampled for inspection, and the privacy is difficult to protect. In order to protect the gradient privacy, further security detection technologies such as homomorphic encryption uploading are proposed, which to some extent realize the protection of gradient privacy, but have huge computational overhead and are difficult to apply in practice. The data availability security detection scheme provided by the present application performs scrambling processing on the gradient uploaded by the client, verifies the data security while ensuring that only the scrambled gradient data is uploaded, protects the gradient privacy while detecting the uploaded scrambled gradient data, effectively prevents unauthorized access and leakage, and thus protects the confidentiality of the client privacy data. Even if the gradient is aggregated at the central server, the original gradient still remains in the scrambled state to ensure that the entire training process is carried out under the premise of privacy protection.

[0025] In terms of availability security detection and overhead, in the traditional data availability security detection scheme, either feature extraction operation needs to be performed on gradient data, or multiple rounds of communication need to be added, resulting in a large amount of calculation overhead or communication overhead, and the traditional data availability security detection scheme is easy to be confused by low-level adversarial samples, and cannot maintain good detection accuracy under slight perturbation, which greatly reduces the defense effect when the model training is still in the change range generated by the attack, or the statistical features and similarity evaluation criteria cannot well distinguish malicious gradients, although some schemes have achieved data detection operations in a ciphertext environment such as homomorphic encryption, but often accompanied by huge calculation overhead, and the data availability security detection scheme provided by the present application designs a verification parameter, adopts a multi-party collaborative manner, and ensures the consistency of the shared masks uploaded by adjacent clients through two verifications, and at the same time ensures the consistency of the gradient data used for detection and the gradient data used for aggregation, so that the clustering analysis detection result is meaningful, and the availability of the gradient data used for aggregation by the central server can be ensured through such careful design, a strong binding relationship between the aggregated gradient and the detection gradient is realized, the detection result is more accurate, and at the same time, the secure uploading manner realized by using a non-homomorphic scrambling scheme reduces the communication overhead and calculation overhead, so that the data detection and model aggregation are efficiently completed under the premise of small-scale calculation and communication overhead.

[0026] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 is a flow diagram of a multi-party collaborative data availability security detection method provided by an embodiment of the present application;

[0028] Figure 2 is a flow diagram of another multi-party collaborative data availability security detection method provided by an embodiment of the present application;

[0029] Figure 3 is a structural diagram of a central server in a multi-party collaborative data availability security detection system provided by an embodiment of the present application;

[0030] Figure 4 is a structural diagram of each client in a multi-party collaborative data availability security detection system provided by an embodiment of the present application;

[0031] Figure 5 is a structural diagram of a verification server in a multi-party collaborative data availability security detection system provided by an embodiment of the present application;

[0032] Figure 6is another structure schematic diagram of a central server in a multi-party collaborative data availability security detection system provided by the embodiment of the present application. DETAILED DESCRIPTION

[0033] The present application will be further described in detail below in conjunction with specific embodiments, but the embodiments of the present application are not limited thereto.

[0034] In order to make accurate and efficient availability detection on the client uploaded gradient data under the premise of ensuring the privacy of the uploaded gradient, in a first aspect, referring to Figure 1 The embodiment of the present application provides a multi-party collaborative data availability security detection method, which specifically comprises the following steps:

[0035] S10, the initialization stage comprises: each client pre-processes local data, and loads global model parameters issued by the central server; the verification server constructs a projection matrix, and generates a first encryption matrix and a second encryption matrix according to the projection matrix, distributes the first encryption matrix to each client, and uploads the second encryption matrix and the private key corresponding to the first encryption matrix to the central server.

[0036] The initialization stage of the embodiment of the present application specifically comprises: the central server issues global model parameters; each client pre-processes local data, and loads global model parameters issued by the central server; the verification server randomly selects two global parameters, generates a plurality of hyperplane groups according to the selected two global parameters, each hyperplane group comprises a plurality of hyperplanes, and performs orthogonalization processing on each hyperplane group to generate a projection matrix; the verification server generates a corresponding first encryption vector according to each column vector in the projection matrix, integrates all the first encryption vectors to obtain a first encryption matrix, and distributes the first encryption matrix to each client, while integrating the private key corresponding to the first encryption matrix and uploading it to the central server; the verification server extends the projection matrix to obtain an extended projection matrix, generates a corresponding second encryption vector according to each column vector in the extended projection matrix, integrates all the second encryption vectors to obtain a second encryption matrix, and uploads the second encryption matrix to the central server. Wherein, the verification server extends the projection matrix to obtain the extended projection matrix, comprising: the verification server adds a row of row vectors of all 1s after the projection matrix to obtain the extended projection matrix. For more specifically:

[0037] Each client pre-processes local data, such as normalization, data enhancement and missing value processing, to improve data quality and ensure that it meets the requirements of model training, that is, the local data used subsequently is pre-processed local data. At the same time, each client receives and stores global model parameters issued by the central server, to ensure that the latest global model parameters are loaded and used to train the model.

[0038] The verification server randomly selects two global parameters num and num_v, which are used to determine the projection matrix W, that is, num groups of hyperplane groups are determined by the global parameter num, and each group of hyperplane groups has num_v hyperplanes, so that the projection matrix can be recorded as:

[0039] W = [V1, V2, …, V I , …, V num ];

[0040] Each group of hyperplane groups randomly generates num_v column vectors to form num_v hyperplanes, recorded as:

[0041] V I = [v I,1 , v I,2 , …, v I,l , …, v I,num_v ];

[0042] v I,l = rand(z, 1);

[0043] Where V I represents the Ith group of hyperplane groups, and I has a value range of 1 to num, v I,l represents the lth column vector in V I , l has a value range of 1 to num_v, z represents the dimension of each hyperplane, which is determined by the dimension of the gradient data in the training process, and rand() represents a random number generation function.

[0044] Next, the verification server orthogonalizes each group of hyperplane groups, so that it more comprehensively reflects the characteristics:

[0045]

[0046] Where the projection is defined as:

[0047]

[0048] Where, represents the transpose operation of v I,l , and the projection matrix W can be represented as a space spanned by multiple vectors u j .

[0049] Further, after the projection matrix W is generated by the embodiment of the application, the verification server further processes each column vector in each group of hyperplanes of the projection matrix W: randomly selects two large prime numbers alpha and P, selects a large random number s x ∈ Z p as a key, and selects z+2 random numbers, recorded as b = [b1, b2, …, b k..., b z+2 ], b k is the kth element in the b, k is 1 to z+2, and a k is the kth element in the column vector, and the column vector is extended a z+1 =a z+2 =0, and the first encrypted vector E x =(a, P, e x,1 , e x,2 ,..., e x,k ,..., e x,z+2 ) is calculated, x is 1 to num*num_v, and e x,k is calculated as follows:

[0050] e x,k =s x (a k ·a+b k )mod P;

[0051] The verification server integrates all the first encrypted vectors into the first encrypted matrix G=(E1, E2,..., E x ,..., E num*num_v ), and distributes the first encrypted matrix G to each client, and each client prepares for data feature extraction by receiving the first encrypted matrix G distributed by the verification server; and integrates the private key S=(s1, s2,..., s x ,..., s num*num_v ) corresponding to the first encrypted matrix G and the two large prime numbers a and P uploaded to the central server.

[0052] Similarly, the verification server extends the projection matrix W to obtain the extended projection matrix , that is, a row vector of all 1 is added to the projection matrix W, and the above processing similar to the projection matrix W is performed again to obtain the projection matrix All column vectors correspond to the second encrypted vector, and all the second encrypted vectors are integrated into the second encrypted matrix G s , and the second encrypted matrix G s is uploaded to the central server, and the verification server integrates and retains the private key S s corresponding to the second encrypted matrix G s .

[0053] S20, the gradient uploading stage includes: each client negotiates a shared mask with adjacent clients, and obtains gradient data by training according to global model parameters and preprocessed local data, applies perturbation to the gradient data by using the shared mask to obtain perturbed gradient data, and uploads the perturbed gradient data to the central server.

[0054] Assuming there are n clients, the total data amount of the n clients is N, each client negotiates a common random number with adjacent clients as a shared mask, for example, the ith client negotiates a shared mask with adjacent clients, and the shared mask of client i and client i-1mod n is [r i-1modn,i ], and the shared mask of client i and client i+1mod n is [r i+1modn,i ].

[0055] Each client uses an existing optimization algorithm to train gradient data according to the global model parameters and the preprocessed local data, and uses the shared mask to disturb the gradient data to obtain disturbed gradient data, for example, the gradient data obtained after training by the ith client is plaintext, and the gradient data is denoted as m i , the data amount is n i , and the gradient data used for uploading detection is denoted as Further, according to the set security protocol, the disturbed gradient data m is calculated to ensure the privacy and security of the gradient data, and is uploaded to the central server for the central server to perform subsequent detection and aggregation, and each client performs this operation.

[0056] S30, the data availability detection stage includes: each client uses a first encryption matrix to perform feature mapping on the local data to generate a first verification parameter, uploads the first verification parameter to the central server, and uploads the shared mask to the verification server; the central server calculates a new first verification parameter according to the first verification parameter and the corresponding private key, and calculates a second verification parameter according to a second encryption matrix, uploads the new first verification parameter and the second verification parameter to the verification server; the verification server verifies the shared mask uploaded by each client, if the verification is passed, according to the second verification parameter, the consistency of the gradient data used for detection and the gradient data used for aggregation is verified, if the verification is passed, the central server performs clustering analysis on the first verification parameter to obtain the disturbed gradient data which is safe and available, aggregates all the disturbed gradient data which is safe and available, and distributes new global model parameters to each client, or ends the model training to complete the data security aggregation.

[0057] The data availability detection stage in this embodiment of the invention specifically includes: a central server broadcasting a notification to each client to perform data availability detection; each client negotiating a shared mask with its neighboring clients, and using a first encryption matrix to perform feature mapping on local data to generate a first verification parameter, uploading the first verification parameter to the central server, and uploading the shared mask to the verification server; the central server receiving the first verification parameter uploaded by each client, decrypting the corresponding first verification parameter using the private key uploaded by the verification server, randomly generating a random number, calculating a new first verification parameter based on the random number and the decryption result, and sending it to the verification server; the central server constructing a random number vector based on the random number, expanding the scrambled gradient data uploaded by each client based on the random number vector to obtain expanded scrambled gradient data, and then... The second encryption matrix and the extended scrambling gradient data are used to calculate the second verification parameters, which are then sent to the verification server. The verification server receives the shared mask uploaded by each client and verifies it. If the verification fails, the corresponding client is determined to be a malicious client. If the verification passes, based on the linear additive property of the dot product, the consistency between the gradient data used for detection and the gradient data used for aggregation is verified according to the new first and second verification parameters. If the verification fails, the corresponding client is determined to be a malicious client. If the verification passes, the central server performs cluster analysis on the first verification parameters to obtain secure and usable scrambling gradient data, aggregates all secure and usable scrambling gradient data, and sends new global model parameters to each client, or terminates model training to complete secure data aggregation. More specifically:

[0058] The central server broadcasts a notification to each client to perform a data availability check.

[0059] Each client, such as client i, has its own gradient data used for detection. and the shared mask negotiated with neighboring clients [r i-1modn,i ] and [r i+1modn,i The first encryption matrix G is used to perform F1 operation to obtain the first verification parameter D. i The first test parameter D i Uploaded to the central server, the central server detects the scrambled gradient data and related parameters uploaded by the client, and sets the shared mask [r] i-1modn,i ] and [r i+1modn,i Uploaded to the verification server. The F1 calculation formula is as follows:

[0060]

[0061] The operation F1(T,G) will be explained in detail below, where T is the data. Suppose the k-th element of vector T is t k First, the vector T is expanded by t.z+1 = t z+2 = 0, for each E x , perform the following calculation, first calculate j x,k :

[0062]

[0063] where r k is a random number randomly selected.

[0064] Further calculation:

[0065]

[0066] The first verification parameter D i = (J1, J2, …, J x , …, J num*num_v ) is obtained by integration, and the first verification parameter D i is uploaded to the central server, and each client performs the above first verification parameter generation process.

[0067] The central server receives the first verification parameter of each client, such as receiving the first verification parameter D i , uses the corresponding private key S uploaded by the verification server to decrypt it, and performs F2 operation to obtain the verification parameter and randomly generates a random number r, calculates the new first verification parameter d i +r and sends it to the verification server. The F2 operation formula is represented as:

[0068] d i = F2(D i , S);

[0069] The operation F2(D, S) is explained in detail below, where D is the first verification parameter D i : Assume J x is the xth element in D i , calculate:

[0070] q x = s x -1 ·J x mod P;

[0071] Further calculation:

[0072]

[0073] The verification parameter d i = (Q1, Q2, …, Q x , …, Q num*num_v ) is obtained by integration.

[0074] Further, the central server uses the random number r generated before to construct a random number vector [r], i.e. each element in the vector is r, and constructs the scrambled gradient data C i for each client di :

[0075]

[0076] The central server uses the second encryption matrix G s and the expanded scrambled gradient data S di to perform F1 operation to obtain the second verification parameter D si , and sends it to the verification server:

[0077] D si = F1(S di , G s );

[0078] The verification server receives the shared mask of each client, such as the shared mask [r i-1modn,i ] and [r i+1modn,i ] of the client i, and verifies the shared mask:

[0079] r (i-1)+1mod n,i-1 = r i-1 mod n,i ;

[0080] r i+1 mod n,i = r (i+1)-1 mod n,i+1 ;

[0081] The authenticity of the features of [r ii1 mod n,i ] and [r i+1 mod n,i ] uploaded by each client is ensured in a multi-party collaborative manner. If the verification fails, it is determined that the client is malicious.

[0082] The verification server uses the reserved private key S s to perform F2 operation on the second verification parameter D si to obtain the verification parameter , wherein the F2 operation formula is represented as:

[0083] d si = F2(D s i , S s ).

[0084] Further, based on the linear additive property of dot product, the verification server performs the following calculation to verify the consistency between the gradient data uploaded by the client for detection and the gradient data for aggregation:

[0085]

[0086] Where, d i For the gradient data used for detection, d si This is the gradient data used for aggregation. The validation server verifies whether the calculation results match d. si If they are equal, then it means that the value used to calculate d is equal. i of With the calculation of d si Contained in Consistency is ensured to guarantee that the gradient data used for detection is consistent with the gradient data used for aggregation; if they are not equal, the client is identified as malicious.

[0087] Finally, the central server performs cluster analysis on the first verification parameter uploaded by each client, and decrypts the first verification parameter. For example, the first verification parameter D uploaded by the i-th client normally... i Decrypted Further analysis revealed safe and usable scrambled gradient data. The first verification parameter D uploaded by the malicious client j j Decrypted Further analysis revealed toxicity gradient data that deviated from safe and usable levels. For detecting and outputting secure and usable scrambled gradient data Data aggregation is performed on all safe and usable scrambled gradient data; for poisoned gradient data that deviates from safe and usable data... Continue with the subsequent data aggregation phase.

[0088] The central server updates the weights of the global model, adjusts the global model parameters using optimization algorithms to improve the overall performance of the global model, and distributes the new global model parameters to each client, or terminates model training to complete secure data aggregation. The updated model is distributed to each client for local training, ensuring all clients always use the latest model parameters, thereby enhancing the system's collaborative learning capabilities and improving overall model performance. After the model update, a comprehensive evaluation is performed to test its performance on the validation or test sets. By calculating accuracy, loss value, and other key metrics, the model's improvement is analyzed to ensure that the optimized model has better generalization ability and stability in practical applications.

[0089] Furthermore, if any verification fails during the data availability testing phase, a malicious client is identified. Please refer to [link to relevant documentation]. Figure 2 The corresponding methods also include:

[0090] S40. The data aggregation stage includes: the central server performs cluster analysis on the first verification parameter to obtain the scrambled gradient data of the malicious client as poisoning gradient data; the clients adjacent to the malicious client upload their respective shared masks negotiated with the malicious client to the central server; the central server performs aggregation and recovery processing on the scrambled gradient data uploaded by the clients other than the malicious client based on the poisoning gradient data and all the shared masks negotiated with the malicious client.

[0091] In this embodiment of the invention, the data aggregation stage specifically includes: the central server summing the scrambling gradient data uploaded by each client to obtain first accumulated perturbation gradient data; calculating second accumulated perturbation gradient data based on the first accumulated perturbation gradient data and all shared masks negotiated with malicious clients; the central server performing cluster analysis on the first verification parameters to obtain the scrambling gradient data of malicious clients as poisoning gradient data; calculating the new total data volume excluding malicious clients based on the poisoning gradient data; and performing aggregation and recovery processing on the scrambling gradient data uploaded by clients other than malicious clients based on the new total data volume and the second accumulated perturbation gradient data. More specifically:

[0092] The central server receives scrambled gradient data C uploaded by each client. i All scrambled gradient data C i By performing cumulative summation calculations, the first accumulated perturbation gradient data is obtained:

[0093]

[0094] Among them, M temp1 This represents the first accumulated perturbation gradient data.

[0095] When a malicious client j exists, query the two adjacent clients of malicious client j for the shared mask [r] negotiated with malicious client j. j-1modn,j ] and [r j+1modn,j ].

[0096] The central server uses a shared mask [r j-1modn,j ] and [r j+1modn,j For the first accumulated perturbation gradient data M temp1 The second accumulated perturbation gradient data is obtained through processing:

[0097]

[0098] The central server performs cluster analysis on the first test parameter to obtain the scrambled gradient data C of the malicious client j. j As the poisoning gradient data, the data volume of this poisoning gradient data is counted and denoted as n. j Then calculate the new total data N. ’ =Nn jand the second accumulated perturbation gradient data M temp2 Further processing is performed to obtain the aggregated recovery result of the perturbed gradient data of the remaining available clients except the malicious client:

[0099]

[0100] The embodiment of the present application adopts the multi-party collaborative availability security data aggregation result recovery method in the data aggregation stage, detects the poisoning gradient data, and recovers the aggregation result of the remaining available gradient data. It is assumed that the malicious client j and the adjacent client negotiate the shared masks [r j-1modn,j ] and [r j+1modn,j ], the remaining clients have the shared masks [r i-1modn,i ] and [r i+1modn,i ] negotiated with the adjacent client, and the central server has the perturbed gradient data C i After performing the multi-party collaborative availability security data aggregation result recovery process, the central server will obtain the real value of the perturbed gradient data uploaded by the honest client after data aggregation processing

[0101] It should be noted that the embodiment of the present application can detect and judge the offline client as a malicious client, and can realize the recovery of the remaining client availability data security aggregation result when the client is offline.

[0102] As can be seen, the multi-party collaborative data availability security detection method provided by the embodiment of the present application includes:

[0103] Central server: The central server hopes to train an efficient global model by fusing multi-party data. However, due to the lack of data faced by a single data set and the calculation and storage pressure brought by centralized storage, the traditional training method is difficult to break through the performance bottleneck. In order to solve this problem, the central server adopts the federated learning method to obtain the local training generated gradient or model parameter from multiple clients (such as terminal equipment or institutions), and performs safe aggregation in the central server. In this way, not only the heterogeneous data and computing resources in distributed devices can be fully tapped, but also the generalization ability of the model can be improved, so that it can still maintain good adaptability in more complex and variable environments.

[0104] Client: The client participates in the joint training of the global model by providing model gradients or parameter updates calculated during the local training process, expecting to obtain a model with superior performance and stronger generalization ability in this collaborative process to meet its actual application needs. However, due to privacy protection considerations, clients are generally unwilling to directly share local data to prevent potential leakage risks caused by data transmission. At the same time, in an open collaborative training process, there may be malicious clients that affect the training of the global model by uploading gradients or parameter updates with malicious interference (i.e., "poisoning" data). For example, attackers may inject adversarial samples to make the model perform abnormally on specific tasks, or even deliberately reduce the model's accuracy in critical scenarios to mislead decision-making.

[0105] Verification server: The verification server acts as a neutral third party in federated learning, responsible for verifying the consistency of the model gradients or parameter updates uploaded by the client without obtaining any private information, ensuring that they are consistent with the version participating in aggregation during the detection phase, thereby preventing malicious clients from launching poisoning attacks by uploading fake or tampered model updates, and improving the credibility and security of global model training.

[0106] The application scenarios of the application have two important features: data availability security detection and recovery of aggregation results after excluding toxic data. Specifically, in the federated learning process, it cannot be guaranteed that every client is honest, and there are malicious clients uploading toxic data to interfere with the convergence of the global model parameters of the central server, so data availability security detection is needed, and after detecting toxic data, in order to obtain the true aggregation result, the aggregation result needs to be recovered. Based on these two features, in the application, a multi-party collaborative data availability security detection process (data availability detection stage) and a multi-party collaborative availability security data aggregation result recovery process (data aggregation stage) are designed, the client performs feature mapping on the uploaded scrambled gradient data and the shared mask, ensures the consistency of the encrypted gradient used for detection and the gradient used for aggregation, and then performs clustering analysis on the detection data, so that data availability security detection can be realized. Compared with the traditional scheme that can only collect and aggregate client data, but cannot perform data availability security detection to resist client poisoning attacks, the application is more secure; compared with using homomorphic encryption to perform consistency detection in the ciphertext state, the application is more efficient. At the same time, the embodiments of the application use a multi-party collaborative manner to enhance the binding of the encrypted gradient data used for detection and the gradient data used for aggregation, compared with the traditional scheme, the problem of the encrypted gradient data used for detection being difficult to bind with the gradient data used for aggregation caused by the evil of a single malicious client is reduced. In addition, when toxic gradient data is found, a multi-party collaborative manner is used to recover the shared mask, and then the aggregation result is recovered, compared with the traditional scheme of retraining for a round, the utilization rate of client gradient data in a single training is improved. These careful designs can ensure the availability of the gradient data used for aggregation, and as much as possible to enhance the consistency of the encrypted gradient data used for detection and the gradient data used for aggregation.

[0107] In summary, the multi-party collaborative data availability security detection method proposed in the embodiments of the application efficiently realizes the secure aggregation of client gradient data under the premise of availability security detection and protection of user data. Specifically:

[0108] In the aspect of gradient privacy protection, in the traditional data availability security detection scheme, the plaintext of uploaded gradient data or direct local data detection of the client is mostly used, and the privacy is difficult to protect. In order to realize the protection of gradient privacy, the security detection technology such as homomorphic encryption upload is further put forward. Although the gradient privacy protection is realized to a certain extent, there is a huge calculation overhead, which is difficult to apply in practice. The data availability security detection scheme proposed in the application performs scrambling processing on the gradient uploaded by the client, verifies the data security while ensuring that only the scrambled gradient data is uploaded, protects the gradient privacy while detecting the uploaded scrambled gradient data, effectively prevents unauthorized access and leakage, thereby protecting the confidentiality of the client privacy data. Even if the gradient aggregation is performed on the central server, the original gradient still remains in the scrambled state to ensure that the entire training process is safe under the premise of privacy protection.

[0109] In the aspect of availability security detection and overhead, in the traditional data availability security detection scheme, feature extraction operation needs to be performed on the gradient data, or multiple rounds of communication need to be increased, resulting in a large amount of calculation overhead or communication overhead. The traditional data availability security detection scheme is easy to be confused by low-level adversarial samples, and cannot maintain good detection accuracy under slight perturbation, which makes the model training still in the change range generated by the attack, or the evaluation standard of statistical features and similarity cannot well distinguish malicious gradient, so that the defense effect is greatly reduced. Although some schemes realize the data detection operation in the ciphertext environment such as homomorphic encryption, they often accompany with huge calculation overhead. The data availability security detection scheme proposed in the application designs verification parameters, adopts the way of multi-party cooperation, and ensures the consistency of the shared mask uploaded by adjacent clients through two verifications, and ensures the consistency of the gradient data used for detection and the gradient data used for aggregation at the same time, so that the clustering analysis detection result is meaningful. Through such careful design, the availability of the gradient data used for aggregation by the central server can be guaranteed, the strong binding relationship between the aggregated gradient and the detection gradient is realized, the detection result is more accurate, and the secure upload mode realized by using the non-homomorphic scrambling scheme reduces the communication overhead and calculation overhead. The data detection and model aggregation are efficiently completed under the premise of small-scale calculation and communication overhead.

[0110] In terms of robustness of availability detection, considering the existence of malicious clients, the embodiments of the present application further perform cluster analysis on the scrambled gradient data to screen out the poisoned gradient data. Further, in order to enable the aggregation result of the gradient data of the remaining clients to be restored after the poisoned gradient data of the malicious clients is removed, the present application also designs a multi-party collaborative availability security data aggregation result recovery scheme. Through such careful design, the recoverability of the aggregation result can be guaranteed, so that it can not only remove the gradient data of malicious clients and restore the availability data security aggregation result when malicious clients exist, but also can achieve the recovery of the availability data security aggregation result of the remaining clients when a client is offline. Since the overhead of performing a new round of training is reduced, the utilization efficiency of data is improved. The present application is applicable to the scenario of existence of malicious clients in federated learning, and a multi-party collaborative availability security data aggregation result recovery scheme is designed. In the scenario where malicious clients deliberately use malicious data to interfere with model training, the poisoned data is detected, and the aggregation recovery result of the remaining available data can be obtained, and the federated learning is safely and effectively performed.

[0111] In a second aspect, referring to Figures 3-5 The embodiments of the present application provide a multi-party collaborative data availability security detection system, which comprises a client, a verification server and a central server; wherein,

[0112] The client comprises: a model parameter receiving module configured to receive global model parameters issued by the central server; a preprocessing module configured to preprocess local data; a model parameter loading module configured to load the global model parameters issued by the central server; a shared mask negotiation module configured to negotiate a shared mask with adjacent clients; a shared mask uploading module configured to upload the shared mask to the verification server; a gradient training module configured to train to obtain gradient data according to the global model parameters and the local data; a gradient scrambling processing module configured to apply disturbance to the gradient data by using the shared mask to obtain scrambled gradient data; a scrambled gradient uploading module configured to upload the scrambled gradient data to the central server; an encryption matrix receiving module configured to receive a first encryption matrix issued by the verification server; a first inspection parameter generating module configured to generate a first inspection parameter by using the first encryption matrix to perform feature mapping on the local data; and a first inspection parameter uploading module configured to upload the first inspection parameter to the central server;

[0113] The verification server comprises: an encryption matrix construction module, configured to construct a projection matrix, and generate a first encryption matrix and a second encryption matrix according to the projection matrix; an encryption matrix distribution and uploading module, configured to distribute the first encryption matrix to each client, and upload the second encryption matrix and a private key corresponding to the first encryption matrix to a central server; a first shared mask receiving module, configured to receive a shared mask uploaded by each client; a second verification parameter receiving module, configured to receive a second verification parameter uploaded by the central server; a shared mask verification module, configured to verify the shared mask uploaded by each client; and a consistency confirmation module, configured to verify consistency of gradient data used for detection and gradient data used for aggregation according to the second verification parameter.

[0114] The central server comprises: an encryption matrix and key receiving module, configured to receive the second encryption matrix and the private key corresponding to the first encryption matrix issued by the verification server; a gradient receiving module, configured to receive scrambled gradient data uploaded by each client; a first verification parameter receiving module, configured to receive a first verification parameter uploaded by each client; a first detection parameter updating module, configured to calculate a new first verification parameter according to the first verification parameter and the corresponding private key; a second verification parameter generating module, configured to calculate a second verification parameter according to the second encryption matrix; a second verification parameter uploading module, configured to upload the second verification parameter to the verification server; an availability security detection module, configured to perform clustering analysis on the first verification parameter to obtain safe and available scrambled gradient data; a security aggregation module, configured to perform data aggregation on all safe and available scrambled gradient data; a model parameter distribution module, configured to issue global model parameters to each client; and a model parameter updating module, configured to update the global model parameters issued to each client.

[0115] See Figure 6 The central server of the embodiment of the application further comprises:

[0116] The availability security detection module is further configured to, when there is a malicious client, perform clustering analysis on the first verification parameter to obtain scrambled gradient data of the malicious client as poisoned gradient data.

[0117] The second shared mask receiving module is configured to receive shared masks negotiated by clients adjacent to the malicious client with the malicious client.

[0118] The aggregation recovery module is configured to perform aggregation recovery processing on scrambled gradient data uploaded by clients other than the malicious client using all shared masks negotiated by the clients with the malicious client.

[0119] See Figure 6 The central server of the embodiment of the application further comprises:

[0120] The model performance evaluation module is configured to evaluate the model corresponding to the new global model parameters, to ensure the generalization ability and stability of the model corresponding to the new global model parameters.

[0121] For the system embodiment of the second aspect, since it is basically similar to the method embodiment of the first aspect, the description is relatively simple, and the relevant parts are referred to the part of the method embodiment of the first aspect.

[0122] In the description of the present application, it should be understood that the terms "first", "second" are only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0123] Although the present application is described herein in conjunction with various embodiments, other variations of the disclosed embodiments can be understood and implemented by those skilled in the art with reference to the specification and drawings. In the specification, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude a plurality. Some measures are described in mutually different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0124] The above is a further detailed description of the present application in conjunction with specific preferred embodiments, and the specific implementation of the present application cannot be limited to these descriptions. For those skilled in the art to which the present application belongs, without departing from the concept of the present application, a number of simple deductions or substitutions can be made, which should be regarded as falling within the scope of protection of the present application.

Claims

1. A multi-party collaborative data availability security detection method, characterized in that, The method includes: The initialization phase includes: each client preprocesses local data and loads global model parameters issued by the central server; the verification server constructs a projection matrix and generates a first encryption matrix and a second encryption matrix based on the projection matrix; the first encryption matrix is ​​distributed to each client; and the second encryption matrix and the private key corresponding to the first encryption matrix are uploaded to the central server. The gradient upload stage includes: each client negotiates and shares a mask with its neighboring clients, and trains gradient data based on the global model parameters and preprocessed local data. The gradient data is perturbed using the shared mask to obtain scrambled gradient data, and the scrambled gradient data is uploaded to the central server. The data availability detection phase includes: each client using the first encryption matrix to perform feature mapping on preprocessed local data to generate a first verification parameter, uploading the first verification parameter to the central server, and uploading the shared mask to the verification server; the central server calculating a new first verification parameter based on the first verification parameter and the corresponding private key, and calculating a second verification parameter based on the second encryption matrix, uploading the new first verification parameter and the second verification parameter to the verification server; the verification server verifying the shared mask uploaded by each client, if the verification passes, then verifying the consistency between the gradient data used for detection and the gradient data used for aggregation based on the second verification parameter, if the verification passes, then the central server performing cluster analysis on the first verification parameter to obtain secure and usable scrambled gradient data, aggregating all secure and usable scrambled gradient data, and issuing new global model parameters to each client, or ending model training to complete secure data aggregation.

2. The multi-party collaborative data availability security detection method according to claim 1, characterized in that, The initialization phase specifically includes: Global model parameters issued by the central server; Each client preprocesses its local data and loads the global model parameters issued by the central server; The verification server randomly selects two global parameters, generates multiple hyperplane groups based on the selected two global parameters, each hyperplane group includes multiple hyperplanes, and performs orthogonalization processing on each hyperplane group to generate a projection matrix; The verification server generates a corresponding first encryption vector based on each column vector in the projection matrix, integrates all the first encryption vectors to obtain a first encryption matrix, distributes the first encryption matrix to each client, and uploads the private key corresponding to the first encryption matrix to the central server. The verification server expands the projection matrix to obtain an expanded projection matrix, generates a corresponding second encryption vector based on each column vector in the expanded projection matrix, integrates all the second encryption vectors to obtain a second encryption matrix, and uploads the second encryption matrix to the central server.

3. The multi-party collaborative data availability security detection method according to claim 2, characterized in that, The verification server expands the projection matrix to obtain an expanded projection matrix, including: The verification server adds a row vector of all 1s after the projection matrix to obtain the expanded projection matrix.

4. The multi-party collaborative data availability security detection method according to claim 1, characterized in that, The data availability testing phase specifically includes: The central server broadcasts a notification to each client to perform a data availability check. Each client negotiates and shares a mask with its neighboring clients, and uses the first encryption matrix to perform feature mapping on the preprocessed local data to generate a first verification parameter. The first verification parameter is then uploaded to the central server, and the shared mask is uploaded to the verification server. The central server receives the first verification parameter uploaded by each client, decrypts the corresponding first verification parameter using the private key uploaded by the verification server, randomly generates a random number, calculates a new first verification parameter based on the random number and the decryption result, and sends it to the verification server; the central server constructs a random number vector based on the random number, expands the scrambling gradient data uploaded by each client based on the random number vector to obtain expanded scrambling gradient data, calculates the second verification parameter based on the second encryption matrix and the expanded scrambling gradient data, and sends the second verification parameter to the verification server; The verification server receives and verifies the shared mask uploaded by each client. If the verification fails, the corresponding client is determined to be a malicious client. If the verification passes, based on the linear additive property of the dot product, the consistency between the gradient data used for detection and the gradient data used for aggregation is verified according to the new first verification parameter and the second verification parameter. If the verification fails, the corresponding client is determined to be a malicious client. If the verification passes, the central server performs cluster analysis on the first verification parameter to obtain secure and usable scrambled gradient data, aggregates all secure and usable scrambled gradient data, and issues new global model parameters to each client, or terminates model training to complete secure data aggregation.

5. The multi-party collaborative data availability security detection method according to claim 1, characterized in that, If a data availability test fails verification, and a malicious client is identified, the corresponding methods include: The data aggregation stage includes: the central server performing cluster analysis on the first verification parameter to obtain the scrambled gradient data of the malicious client as poisoning gradient data; the clients adjacent to the malicious client uploading their respective shared masks negotiated with the malicious client to the central server; and the central server performing aggregation and recovery processing on the scrambled gradient data uploaded by the clients other than the malicious client based on the poisoning gradient data and all the shared masks negotiated with the malicious client.

6. The multi-party collaborative data availability security detection method according to claim 5, characterized in that, The data aggregation phase specifically includes: The central server sums up the scrambled gradient data uploaded by each client to obtain the first accumulated perturbation gradient data, and calculates the second accumulated perturbation gradient data based on the first accumulated perturbation gradient data and all shared masks negotiated with malicious clients. The central server performs cluster analysis on the first verification parameters to obtain the scrambling gradient data of the malicious client as poisoning gradient data. Based on the poisoning gradient data, it calculates the total new data volume excluding the malicious client. Based on the total new data volume and the second accumulated perturbation gradient data, it performs aggregation and recovery processing on the scrambling gradient data uploaded by the other clients excluding the malicious client.

7. A multi-party collaborative data availability security detection system, characterized in that, The system includes a client, an authentication server, and a central server; wherein... The client includes: a model parameter receiving module for receiving global model parameters from a central server; a preprocessing module for preprocessing local data; a model parameter loading module for loading global model parameters from the central server; a shared mask negotiation module for each client to negotiate a shared mask with neighboring clients; a shared mask uploading module for uploading the shared mask to a verification server; a gradient training module for training gradient data based on the global model parameters and preprocessed local data; a gradient scrambling module for applying perturbation to the gradient data using the shared mask to obtain scrambled gradient data; a scrambled gradient uploading module for uploading the scrambled gradient data to the central server; an encryption matrix receiving module for receiving a first encryption matrix from the verification server; a first verification parameter generation module for using the first encryption matrix to perform feature mapping on the preprocessed local data to generate a first verification parameter; and a first verification parameter uploading module for uploading the first verification parameter to the central server. The verification server includes: an encryption matrix construction module for constructing a projection matrix and generating a first encryption matrix and a second encryption matrix based on the projection matrix; an encryption matrix distribution and uploading module for distributing the first encryption matrix to each client and uploading the second encryption matrix and the private key corresponding to the first encryption matrix to a central server; a first shared mask receiving module for receiving a shared mask uploaded by each client; a second verification parameter receiving module for receiving a second verification parameter uploaded by the central server; a shared mask verification module for verifying the shared mask uploaded by each client; and a consistency confirmation module for verifying the consistency between the gradient data used for detection and the gradient data used for aggregation based on the second verification parameter. The central server includes: an encryption matrix and key receiving module for receiving the second encryption matrix and the private key corresponding to the first encryption matrix issued by the verification server; a gradient receiving module for receiving scrambled gradient data uploaded by each client; a first verification parameter receiving module for receiving the first verification parameter uploaded by each client; a first verification parameter updating module for calculating a new first verification parameter based on the first verification parameter and the corresponding private key; a second verification parameter generation module for calculating the second verification parameter based on the second encryption matrix; a second verification parameter uploading module for uploading the second verification parameter to the verification server; an availability and security detection module for performing cluster analysis on the first verification parameter to obtain secure and usable scrambled gradient data; a security aggregation module for aggregating all secure and usable scrambled gradient data; a model parameter distribution module for distributing global model parameters to each client; and a model parameter updating module for updating the global model parameters distributed to each client.

8. The multi-party collaborative data availability security detection system according to claim 7, characterized in that, The central server also includes: The availability security detection module is also used to perform cluster analysis on the first detection parameters to obtain the scrambled gradient data of the malicious client as poisoning gradient data when a malicious client exists. The second shared mask receiving module is used to receive the shared mask negotiated with the malicious client by each client that is adjacent to the malicious client. The aggregation and recovery module is used to aggregate and recover scrambled gradient data uploaded by clients other than the malicious client using all shared masks negotiated with the malicious client.

9. The multi-party collaborative data availability security detection system according to claim 7, characterized in that, The central server also includes: The model performance evaluation module is used to evaluate the model corresponding to the new global model parameters to ensure the generalization ability and stability of the model corresponding to the new global model parameters.

Images