Artificial intelligence data privacy protection system based on block chain and federal learning

Abstract

The invention discloses an artificial intelligence data privacy protection system based on a block chain and federated learning, and relates to the technical field of block chains and federated learning, and the system comprises a block chain module which employs a main chain-side chain double-chain architecture, a main chain stores a global model hash value and node reputation evaluation data, and a side chain module is used for storing node reputation evaluation data; the side chain stores the encrypted local model parameters through a fragmentation technology; the federated learning module comprises a dynamic difference privacy algorithm and a gradient ternary processing unit, and is used for adding noise to the gradient in a local training stage and converting the gradient into a ternary numerical format; the privacy protection module is used for integrating homomorphic encryption and zero-knowledge proof technologies and realizing ciphertext aggregation and verification of model parameters; and the malicious node detection module is used for identifying abnormal gradient update based on cosine similarity and Multi-Krum algorithm, and is linked with node reputation data in the block chain module. Through a system architecture and a privacy protection mechanism, the efficiency and performance of federal learning are improved while data privacy is ensured, and the method has a wide application prospect.

Description

Technical Field

[0001] The present invention relates to the technical fields of blockchain and federated learning, and in particular to an artificial intelligence data privacy protection system based on blockchain and federated learning. Background Art

[0002] With the wide application of artificial intelligence technology, data has become a key asset. However, data often contains a large amount of personal privacy information, such as medical data, financial data, etc. In the process of data sharing and utilization, how to protect this privacy information from being leaked has become an urgent problem to be solved. High-quality artificial intelligence models require a large amount of data for training, and the data of a single institution or individual is often limited; in order to make full use of the data of all parties to improve the model performance, it is necessary to realize the sharing and collaborative utilization of data on the premise of ensuring data privacy; high-quality artificial intelligence models require a large amount of data for training, and the data of a single institution or individual is often limited. In order to make full use of the data of all parties to improve the model performance, it is necessary to realize the sharing and collaborative utilization of data on the premise of ensuring data privacy.

[0003] The distributed characteristics of blockchain lead to relatively slow data processing speed. When dealing with large-scale data, performance bottlenecks may occur. At the same time, the encrypted transmission and aggregation of model parameters in federated learning will also increase the computing and communication overhead, affecting the training efficiency. For example, when dealing with tasks with high real-time requirements, such as real-time decision-making in autonomous driving, the rapid response requirements may not be met; in federated learning, in order to protect data privacy, some preprocessing or transformation may be required for the data, which may lead to a decrease in the accuracy of model training. In addition, due to the possible differences in the data distributions of each participating party, problems such as slow model convergence speed or low accuracy may also occur in the joint training process. Although blockchain and federated learning both provide a certain degree of security and privacy protection, there are still some potential vulnerabilities. There may also be privacy leakage problems such as model inversion attacks and membership inference attacks in federated learning, and the security protection mechanism needs to be continuously strengthened. Summary of the Invention

[0004] To solve the above technical problems, an artificial intelligence data privacy protection system based on blockchain and federated learning is provided. The technical solution solves the problem that the distributed characteristics of the blockchain lead to relatively slow data processing speed, and performance bottlenecks may occur when processing large-scale data. The encrypted transmission and aggregation of model parameters in federated learning also increase the computing and communication overhead, affecting the training efficiency. In federated learning, in order to protect data privacy, some preprocessing or transformation of the data may be required, which may lead to a decrease in the accuracy of model training. There may also be problems such as slow model convergence speed or low accuracy in the joint training process. Although both blockchain and federated learning provide a certain degree of security and privacy protection, there are still some potential vulnerability problems.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] An artificial intelligence data privacy protection system based on blockchain and federated learning, comprising:

[0007] Blockchain module: Adopting a main chain - side chain double-chain architecture, the main chain stores the global model hash value and node reputation evaluation data, and the side chain stores the encrypted local model parameters through sharding technology;

[0008] Federated learning module: Containing a differential privacy algorithm and a gradient ternarization processing unit, used to add noise to the gradient and convert it into a ternary numerical format during the local training stage;

[0009] Privacy protection module: Integrating homomorphic encryption and zero-knowledge proof technologies to achieve ciphertext aggregation and verification of model parameters;

[0010] Malicious node detection module: Identifying abnormal gradient updates based on cosine similarity and the Multi-Krum algorithm, and linking with the node reputation data in the blockchain module.

[0011] Preferably, the blockchain module specifically includes:

[0012] Main chain core unit: Stores the unique hash value of the federated learning global model, verifies the model integrity and prevents tampering; Triggers hash updates through smart contracts, generates a new global model hash after each round of federated learning aggregation and uploads it to the chain; Records the historical behavior scores of participating nodes, and dynamically adjusts node permissions based on reputation values; Adopts an on-chain verifiable reputation algorithm, combines cosine similarity to detect abnormal model updates, and the reputation data is stored through a Merkle tree to optimize query efficiency; Adopts an improved Byzantine fault tolerance consensus, and dynamically selects verification nodes through a verifiable random function;

[0013] Side-chain technology unit: The local model parameters are divided according to data characteristics and participating parties. Each shard stores an encrypted subset of the parameters, and homomorphic encryption and threshold encryption are used. An independent verification node group is set for each shard, and the validity of the shard data is quickly verified through simplified payment verification. Combining zero-knowledge proofs, on-chain verification of encrypted parameters is achieved. Relay chain or hash locking technology is used to achieve data intercommunication between shards, support cross-shard model aggregation, and coordinate shard data calls through side-chain smart contracts. IPFS is used to store large-scale encrypted parameters, and the side-chain only records the IPFS content identifier, and data availability proofs are introduced.

[0014] Preferably, the blockchain module specifically includes:

[0015] Main-chain and side-chain cooperation unit: The main chain locks the anchor hash of the side-chain shard data through a smart contract, and the side-chain releases the corresponding resources after verification, realizing the secure cross-chain transfer of assets and data. The number of side-chain shards is dynamically adjusted according to the number of participating nodes and the amount of data in federated learning, and shard merging and splitting are automatically triggered through the main-chain smart contract. The main chain regularly conducts random sampling audits on the side-chain shards, and combines a trusted execution environment to verify the authenticity and consistency of the shard data.

[0016] Preferably, the federated learning module specifically includes:

[0017] Noise parameter adaptive adjustment unit: By monitoring the change rate of the loss function, the noise intensity is dynamically adjusted. When the model converges, the noise amount is reduced, and vice versa, the noise protection is enhanced. According to the historical behavior reputation scores of the nodes recorded by the blockchain module, less noise is added to high-reputation nodes, and more noise interference is added to low-reputation and suspicious nodes. Support for data owners to label sensitive level tags for local data, and the algorithm differentially configures the privacy budget according to the tag levels;

[0018] Gradient clipping and noise injection unit: An adaptive gradient clipping strategy is adopted, combined with Laplace noise and Gaussian noise, to balance privacy protection and model convergence efficiency;

[0019] Privacy budget allocation unit: Rényi differential privacy is used for privacy budget accumulation control, and through mathematical proof, the privacy consumption of multiple rounds of training is transformed into a standard differential privacy guarantee;

[0020] Gradient ternarization processing unit: Gradient sparsification is achieved through ternary mapping. The floating-point residual values discarded during quantization are accumulated into the next round of training gradient, and the quantization threshold is dynamically adjusted according to the model training stage. The format compliance of the ternary gradient is verified through a smart contract.

[0021] Preferably, the noise parameter adaptive adjustment unit specifically includes:

[0022] Dynamic noise intensity adjustment formula:

[0023]

[0024] where σ t is the noise intensity at the current moment; σ base is the basic noise intensity, representing the initial noise intensity; α is the adjustment coefficient, used to control the influence degree of the change rate of the loss function on the noise intensity; ΔL t is the change amount of the loss function at the current moment t, expressed as L t -L t-1 ; R S is the node reputation score, representing the historical behavior reputation of the node.

[0025] Preferably, the gradient ternarization processing unit specifically includes:

[0026] Gradient ternarization mapping formula:

[0027]

[0028] where g″′ j is the mapped gradient value, representing the result after ternarization processing; g″ j is the input gradient value, representing the gradient of a certain dimension; τ is the quantization threshold, used to judge whether the gradient value is large enough or small enough; if the gradient value g″ j is greater than the threshold τ, it is mapped to +1; if the gradient value g″ j is less than the negative threshold -τ, it is mapped to -1; if the gradient value g″ j is between -τ and τ, it is mapped to 0.

[0029] Preferably, the privacy protection module specifically includes:

[0030] The homomorphic encryption technology unit includes:

[0031] Threshold homomorphic encryption algorithm sub-unit: Adopt Paillier threshold homomorphic encryption, support the ciphertext aggregation operation of model parameters, the client encrypts the local gradient and uploads it to the blockchain, and the server can directly perform addition operations on the ciphertext without decryption; only when more than the threshold number of nodes cooperate to decrypt can the aggregation result be obtained, avoiding the risk of leakage of the private key of a single node;

[0032] Dynamic key management sub-unit: Generate public parameters and private key shards through a multi-party secure computing protocol to ensure that there is no centralized trusted node in the key generation process; automatically update the encryption key after each round of federated learning training, and combine the blockchain smart contract to record the key version history;

[0033] The zero-knowledge proof verification unit includes:

[0034] Model Parameter Validity Proof Unit: It uses zk-SNARKs to generate non-interactive zero-knowledge proofs of gradient parameters. The verifier can confirm through the proof that the gradient calculation conforms to the predefined rules without obtaining the original data; it uses the Bulletproofs protocol to verify the range constraints of encrypted gradients;

[0035] Verifiable Aggregation Process Subunit: It automatically verifies the validity of zero-knowledge proofs through smart contracts and records the verification results on the blockchain. Combining Pedersen commitments and Merkle tree structures, it performs batch verification on batch parameters, reducing the computational overhead of single verification.

[0036] Preferably, the homomorphic encryption technology unit specifically includes:

[0037] Homomorphic Encryption Aggregation Formula:

[0038]

[0039] In the formula, c agg is the aggregated ciphertext, representing the result after performing homomorphic operations on multiple ciphertexts c i ; c i is a single ciphertext, representing the encrypted message m i ; k is the number of ciphertexts participating in the aggregation; g is the generator, which is a fixed parameter in the encryption scheme and is used to generate ciphertexts; m i is the plaintext message, representing the original data to be encrypted; r i is a random number used in the encryption process to ensure the indistinguishability of each ciphertext; n 2 is the square of the modulus, which is used to define the range of the ciphertext space.

[0040] Preferably, the privacy protection module specifically includes:

[0041] Encryption and Verification Process Fusion Unit: Two-stage privacy protection. In the first stage, the client uses homomorphic encryption to encrypt the gradients and generates zero-knowledge proofs; in the second stage, after the server aggregates the ciphertexts, it verifies the legitimacy of the aggregation result through zero-knowledge proofs; homomorphic encryption is enabled in the model update stage, and zero-knowledge proofs are enabled in the parameter verification stage to balance computational efficiency and security.

[0042] Preferably, the malicious node detection module specifically includes:

[0043] Gradient Similarity Analysis Unit: It calculates the cosine similarity between the local model gradient and the global model parameters, evaluates the consistency between the node update and the overall training direction. If the similarity is lower than the preset threshold, it is marked as a suspicious update; the threshold is dynamically adjusted according to the training stage; a node behavior baseline is established by combining historical similarity data to detect abnormal patterns deviating from the baseline;

[0044] Multi-Krum Algorithm Screening Unit: Calculate the comprehensive score of node updates by integrating the gradient direction, norm magnitude, and update frequency, and filter out the abnormal nodes with the lowest scores; Verify the node group through random sampling to prevent malicious nodes from colluding to lower the scores of normal nodes; Retain the residual parameters for nodes suspected of misjudgment, and restore the contributions of trusted nodes after verification in subsequent rounds.

[0045] Blockchain Reputation Data Linkage Unit: Record the historical behavior data of nodes in the main chain of the blockchain, generate dynamic reputation scores, increase the gradient update weights of high-reputation nodes, and temporarily freeze the participation qualifications of low-reputation nodes; When detecting abnormal gradients, automatically retrieve the historical reputation records of the nodes through smart contracts to accelerate the decision-making process.

[0046] Dual Verification and Penalty Unit: The first layer of verification is to real-time mark suspicious nodes based on cosine similarity and the Multi-Krum algorithm; The second layer of verification initiates on-chain data verification for suspicious nodes, requiring them to provide the encrypted original data feature hash value, and verify the data authenticity through zero-knowledge proof; The penalty strategies include short-term penalties, such as deducting token rewards and reducing the priority of computing tasks; Long-term penalties, when the reputation score is lower than the established threshold, permanently add to the blacklist and synchronize to other blockchain networks through cross-chain protocols.

[0047] Dynamic Reputation Update Algorithm Unit: Positive incentive is to increase the reputation score for nodes that contribute effective updates in consecutive rounds; Negative decay is that when malicious behavior is detected, the reputation score decays exponentially; For accidental anomalies caused by network fluctuations, apply for reputation restoration by submitting a trusted execution environment proof.

[0048] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0049] The present invention proposes a main chain - side chain double-chain architecture, which realizes the efficient storage and management of data, while ensuring the privacy and immutability of data; Dynamically adjust the noise intensity according to the change rate of the loss function to ensure reducing noise interference when the model converges, and at the same time enhance noise protection for low-reputation nodes, effectively balancing privacy protection and model convergence efficiency; Realize the ciphertext aggregation of model parameters through homomorphic encryption, and zero-knowledge proof ensures that the verification process does not disclose parameter information, further enhancing privacy protection; Achieve gradient sparsification through ternary mapping, reduce communication overhead, and improve training efficiency; The side chain uses sharding technology to store encrypted parameters and stores large-scale data through IPFS, only recording the content identifier, optimizing storage and query efficiency; Dynamically adjust the noise intensity according to the node reputation score, reduce noise addition for high-reputation nodes, and enhance noise interference for low-reputation nodes, improving the overall performance of the system; This system is applicable to multiple fields such as medical, finance, and Internet of Things, and can effectively protect data privacy while improving model performance. Brief Description of the Drawings

[0050] Figure 1 It is the internal framework diagram of the artificial intelligence data privacy protection system based on blockchain and federated learning;

[0051] Figure 2 It is the internal flow chart of the blockchain module;

[0052] Figure 3 It is the internal flow chart of the federated learning module. Detailed implementation manners

[0053] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments in the following description are only examples, and those skilled in the art can think of other obvious variations.

[0054] Referring to Figure 1 As shown, the artificial intelligence data privacy protection system based on blockchain and federated learning includes:

[0055] Blockchain module: Adopting a main chain - side chain double - chain architecture, the main chain stores the global model hash value and node reputation evaluation data, and the side chain stores the encrypted local model parameters through sharding technology;

[0056] Federated learning module: Containing a differential privacy algorithm and a gradient ternarization processing unit, used to add noise to the gradient and convert it into a ternary numerical format during the local training phase;

[0057] Privacy protection module: Integrating homomorphic encryption and zero - knowledge proof technologies to achieve ciphertext aggregation and verification of model parameters;

[0058] Malicious node detection module: Based on cosine similarity and the Multi - Krum algorithm to identify abnormal gradient updates and link with the node reputation data in the blockchain module.

[0059] It should be noted that the cross - module collaborative enhancement design includes a privacy - reputation dynamic feedback mechanism and the collaborative optimization of encryption and sharding storage:

[0060] After the malicious node detection module discovers an abnormal gradient, it updates the blockchain reputation score in real time (such as deducting 0.2 reputation points), triggering the federated learning module to dynamically adjust the privacy budget of this node (such as increasing the noise intensity by 30%);

[0061] The reputation data of the blockchain main chain is synchronized to the privacy protection module through a smart contract, restricting the homomorphic encryption key update permission of low - reputation nodes (such as freezing key applications for 48 hours).

[0062] When storing data in the side chain through sharding, select the encryption algorithm according to the data sensitivity level (high / medium / low):

[0063] High-sensitivity sharding: Paillier homomorphic encryption + zero-knowledge proof verification;

[0064] Low-sensitivity sharding: AES symmetric encryption + Merkle tree verification.

[0065] The main-chain smart contract records the sharding encryption policy metadata to ensure algorithm consistency during cross-sharding aggregation.

[0066] Refer to Figure 2 As shown, the blockchain module includes:

[0067] Main-chain core unit: Stores the unique hash value of the federated learning global model, verifies the model integrity and prevents tampering; Triggers hash update through smart contracts, generates a new global model hash after each round of federated learning aggregation and uploads it to the chain; Records the historical behavior scores of participating nodes, dynamically adjusts node permissions based on reputation values; Adopts an on-chain verifiable reputation algorithm, combines cosine similarity to detect abnormal model updates, and stores reputation data through Merkle trees to optimize query efficiency; Adopts an improved Byzantine fault-tolerant consensus, dynamically selects verification nodes through a verifiable random function;

[0068] Side-chain technology unit: Divides local model parameters according to data characteristics and participating parties, stores encrypted parameter subsets in each shard, and adopts homomorphic encryption and threshold encryption; Sets up an independent verification node group for each shard, quickly verifies the validity of shard data through simplified payment verification, combines zero-knowledge proof, and realizes on-chain verification of encrypted parameters; Adopts relay chain or hash locking technology to achieve data intercommunication between shards, supports cross-shard model aggregation, and coordinates shard data calls through side-chain smart contracts; Uses IPFS to store large-scale encrypted parameters, the side-chain only records the IPFS content identifier, and introduces a data availability proof;

[0069] Main-chain and side-chain coordination unit: The main chain locks the anchor hash of the side-chain shard data through a smart contract, and the side chain releases the corresponding resources after verification to achieve secure cross-chain transfer of assets and data; Dynamically adjusts the number of side-chain shards according to the number of federated learning participating nodes and data volume, and automatically triggers shard merging and splitting through the main-chain smart contract; The main chain randomly samples and audits the side-chain shards regularly, and combines a trusted execution environment to verify the authenticity and consistency of shard data.

[0070] It should be noted that as the trust infrastructure of the federated learning privacy protection system, this module realizes three core capabilities of data immutability, cross-chain verifiability, and dynamic expansion through the main-chain - side-chain collaborative architecture;

[0071] The global model hash anti-tampering mechanism includes:

[0072] After each round of federated learning aggregation, the main-chain smart contract calls the SHA-256 algorithm to generate the global model hash value (e.g., H = sha256), and broadcasts it to all nodes; more than 51% of the verification nodes sign to confirm the model's validity; any tampering with the local model (such as weight fine-tuning) will result in a hash value mismatch, triggering an automatic rollback to the previous trusted version.

[0073] The improved Byzantine fault tolerance consensus includes: randomly selecting a verification group from a high-reputation node pool through a verifiable random function (VRF) (30% of the members are replaced in each round); the VRF input includes the block height + the previous hash value to ensure the unpredictability of the election; it can tolerate ≤ 33% Byzantine nodes, and the cost of collusion attacks is increased by 5 times (due to the dynamic election mechanism).

[0074] The side-chain technology unit includes:

[0075] The sharding encryption storage strategy, and the data sharding rules are as follows:

[0076] Horizontal sharding: Organized by participants (e.g., the data of Hospital A is stored in Shard 1, and the data of Bank B is stored in Shard 2);

[0077] Vertical sharding: Divided by feature dimensions (e.g., the convolutional layer parameters of an image model are stored in Shard 3, and the fully connected layer is stored in Shard 4).

[0078] The encryption scheme is: Homomorphic encryption is used for the parameters to be aggregated (such as the gradient mean); threshold encryption is used for sensitive metadata (such as the identity of the data owner).

[0079] The lightweight cross-shard verification includes: The shard verification group generates a Merkle proof to prove that a certain parameter exists in the shard block; the main-chain smart contract verifies the consistency between the Merkle root and the side-chain anchored hash; zero-knowledge proof is used to verify that the encrypted parameters conform to the format specifications (such as numerical range constraints).

[0080] The main-chain and side-chain coordination unit includes:

[0081] The two-way anchoring process is that the main chain locks the Merkle root hash of the side-chain shard data (Lock_H = sha256(CID||Nonce)); the side-chain verification node group releases the corresponding data access rights through threshold signatures; the cross-chain communication delay ≤ 1.5 seconds (in a 5G network environment);

[0082] In the random sampling audit of the trusted execution environment audit, the main chain randomly selects 5% of the shards every day, and requires their verification nodes to decrypt and verify the data hash consistency in the TEE; the abnormal shards will be isolated, and the data reconstruction process will be started (based on the IPFS multi-copy redundancy).

[0083] Refer to Figure 3 As shown, the federated learning module includes:

[0084] Noise Parameter Adaptive Adjustment Unit: By monitoring the change rate of the loss function, it dynamically adjusts the noise intensity, reducing the noise amount when the model converges and enhancing the noise protection otherwise; According to the node historical behavior reputation score recorded by the blockchain module, it reduces the noise addition for high-reputation nodes and enhances the noise interference for low-reputation and suspicious nodes; It supports the data owner to label sensitive level tags for local data, and the algorithm differentially configures the privacy budget according to the tag levels.

[0085] Gradient Clipping and Noise Injection Unit: Adopts an adaptive gradient clipping strategy, combines Laplace noise and Gaussian noise to balance privacy protection and model convergence efficiency.

[0086] Privacy Budget Allocation Unit: Uses Rényi differential privacy for privacy budget accumulation control, and through mathematical proof, converts the privacy consumption of multiple rounds of training into standard differential privacy guarantee.

[0087] Gradient Triangulation Processing Unit: Achieves gradient sparsification through ternary mapping, accumulates the floating-point residual values discarded during quantization into the next round of training gradient, and dynamically adjusts the quantization threshold according to the model training stage; Verifies the format compliance of the ternary gradient through a smart contract.

[0088] The Noise Parameter Adaptive Adjustment Unit specifically includes:

[0089] Dynamic Noise Intensity Adjustment Formula:

[0090]

[0091] In the formula, σ t is the noise intensity at the current moment; σ base is the basic noise intensity, representing the initial noise intensity; α is the adjustment coefficient, used to control the influence degree of the change rate of the loss function on the noise intensity; ΔL t is the change amount of the loss function at the current moment t, expressed as L t -L t-1 ; R S is the point reputation score, representing the historical behavior reputation of the node.

[0092] The Gradient Triangulation Processing Unit specifically includes:

[0093] Gradient Triangulation Mapping Formula:

[0094]

[0095] In the formula, g″ j is the mapped gradient value, representing the result after triangulation processing; g″ jg″ is the input gradient value, representing the gradient in a certain dimension; τ is the quantization threshold, used to determine whether the gradient value is large enough or small enough; if the gradient value g″ j is greater than the threshold τ, it is mapped to +1; if the gradient value g″ j is less than the negative threshold -τ, it is mapped to -1; if the gradient value g″ j is between -τ and τ, it is mapped to 0.

[0096] It should be noted that as the core engine of privacy-preserving federated learning, this module achieves the triangular balance of "privacy - efficiency - accuracy" through three major technical pillars: dynamic noise regulation, gradient optimization, and privacy quantization control;

[0097] In the noise parameter adaptive adjustment unit:

[0098] For the dynamic noise intensity adjustment formula, when the loss change rate |ΔL t | is large (the model is not converged), the noise is enhanced (σ t ↑), otherwise the noise is reduced (σ t ↓); in the initial stage of medical image training (high change rate), the noise intensity can reach 2 times the default value to protect sensitive data; in the later stage of convergence (such as the loss fluctuation < 1%), the noise is reduced to 0.5 times.

[0099] For the sensitive data hierarchical protection strategy, the label types are: highly sensitive (such as medical diagnosis records, financial transaction data): α = 1.5, privacy budget ∈ RDP = 0.05 / round; moderately sensitive (such as user behavior logs): α = 1.0, ∈ RDP = 0.03 / round; low sensitive (such as public product reviews) α = 0.5, ∈ RDP = 0.01 / round;

[0100] If a surge in a certain type of data attack is detected (such as a medical data leakage alert), the α of the relevant label is automatically increased to 2.0; the total privacy budget ∈ total ≤5.0 ∈ total ≤ 5.0 (meeting the GDPR medical data requirements).

[0101] Real-time interaction with the blockchain module: After each round of training of the federated learning node, the gradient update hash is submitted to the blockchain; the blockchain reputation algorithm calculates the node behavior similarity (cosine similarity) and updates R s ; the updated R s is synchronously sent to the noise adjustment unit in real time through an off-chain oracle.

[0102] In the gradient clipping and noise injection unit:

[0103] The privacy-efficiency balance provides strict differential privacy by applying Laplace noise, which may increase the model variance; applying Gaussian noise reduces the variance through differential privacy and is suitable for dense parameter updates;

[0104] The mixed noise makes it impossible for attackers to reverse-engineer the original data through the gradient mean (e.g., the attack success rate on the MNIST dataset drops from 58% to 7%); the dynamic pruning + Gaussian noise smoothing stabilizes the test accuracy of the image classification task above 92% (compared with only 85% for the pure Laplace noise scheme).

[0105] Gradient ternarization processing unit:

[0106] The cooperation with the noise injection unit is a noise-sparse joint defense: ternarization masks the details of the gradient distribution, and noise injection further confuses sensitive information; in the medical imaging task, the combination of the two reduces the gradient reverse-engineering attack success rate from 15% to 0.5%;

[0107] The linkage with the blockchain module directly triggers the update of the blockchain reputation score when the smart contract verification fails; the ternary gradient hash value is stored in the blockchain, supporting post-event auditing and model version traceability.

[0108] In summary, the advantages of the present invention are as follows: the main-chain side-chain double-chain architecture realizes the efficient storage and management of data, ensuring the privacy and immutability of data; the dynamic differential privacy algorithm dynamically adjusts the noise intensity according to the change rate of the loss function, and the homomorphic encryption and zero-knowledge proof technologies further enhance privacy protection; gradient ternarization processing reduces communication overhead, and data sharding and IPFS storage optimize storage and query efficiency; dynamic noise adjustment and quantization threshold optimization improve the overall performance of the system, and the system design supports large-scale data and high-concurrency scenarios; the improved Byzantine fault-tolerant consensus and anomaly detection and reputation linkage enhance the security and credibility of the system; the system is applicable to multiple fields such as medical, finance, and the Internet of Things, and can effectively protect data privacy and improve model performance.

[0109] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and what is described in the above embodiments and the specification is only the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements all fall within the scope of the present invention claimed. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. An artificial intelligence data privacy protection system based on blockchain and federated learning, characterized in that, include: Blockchain module: adopts a main chain-side chain dual chain architecture. The main chain stores the global model hash value and node reputation evaluation data, and the side chain uses sharding technology to store encrypted local model parameters. Federated Learning Module: This module includes a dynamic differential privacy algorithm and a gradient ternary processing unit, which is used to add noise to the gradient during local training and convert it into a ternary numerical format. Privacy protection module: Integrates homomorphic encryption and zero-knowledge proof technology to achieve ciphertext aggregation and verification of model parameters; Malicious node detection module: Identifies abnormal gradient updates based on cosine similarity and Multi-Krum algorithm, and links with the node reputation data in the blockchain module.

2. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 1, wherein, The blockchain module specifically includes: The core unit of the main chain: stores the unique hash value of the federated learning global model, verifies the model integrity and prevents tampering; triggers hash updates through smart contracts, generates a new global model hash after each round of federated learning aggregation and uploads it to the chain; records the historical behavior scores of participating nodes, and dynamically adjusts node permissions based on reputation values; uses an on-chain verifiable reputation algorithm combined with cosine similarity to detect abnormal model updates, and stores reputation data in a Merkle tree to optimize query efficiency; uses an improved Byzantine fault-tolerant consensus, and dynamically selects verification nodes through a verifiable random function; Sidechain technology unit: local model parameters are divided into groups according to data characteristics and participants, and each shard stores an encrypted parameter subset, using homomorphic encryption and threshold encryption; each shard sets up an independent verification node group, and quickly verifies the validity of the shard data by simplifying payment verification, combined with zero-knowledge proof to achieve on-chain verification of encryption parameters; relay chain or hash locking technology is used to achieve data interoperability between shards, support cross-shard model aggregation, and coordinate shard data calls through sidechain smart contracts; use IPFS to store large-scale encryption parameters, the side chain only records IPFS content identifiers, and introduces data availability proof.

3. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 2, characterized in that, The blockchain module specifically includes: Main chain and side chain collaboration unit: The main chain locks the anchor hash of the side chain shard data through a smart contract, and the side chain releases the corresponding resources after verification to achieve secure cross-chain transfer of assets and data; the number of side chain shards is dynamically adjusted according to the number of participating nodes and data volume of federated learning, and shard mergers and splits are automatically triggered through the main chain smart contract; the main chain regularly conducts random sampling audits on the side chain shards, and verifies the authenticity and consistency of the shard data in combination with the trusted execution environment.

4. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 3, wherein The federated learning module specifically includes: Noise parameter adaptive adjustment unit: By monitoring the rate of change of the loss function, the noise intensity is dynamically adjusted, reducing the noise amount when the model converges and increasing noise protection when it converges. Based on the reputation score of the node's historical behavior recorded by the blockchain module, the noise addition is reduced for high-reputation nodes and increased for low-reputation and suspicious nodes. The unit also supports data owners to label local data with sensitivity levels, and the algorithm differentially configures privacy budgets based on the label level. Gradient clipping and noise injection unit: Adopts an adaptive gradient clipping strategy, combined with Laplace noise and Gaussian noise, to balance privacy protection and model convergence efficiency; Privacy Budget Allocation Unit: It uses Rényi differential privacy for privacy budget accumulation control, and through mathematical proof, it converts the privacy consumption of multiple rounds of training into a standard differential privacy guarantee; Gradient Triangulation Processing Unit: It realizes gradient sparsification through ternary mapping, accumulates the floating-point residual values discarded during quantization into the next round of training gradient, and dynamically adjusts the quantization threshold according to the model training stage; it verifies the format compliance of the ternary gradient through a smart contract.

5. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 4, characterized in that, The Noise Parameter Adaptive Adjustment Unit specifically includes: Dynamic Noise Intensity Adjustment Formula: where, σ t is the noise intensity at the current moment; σ base is the basic noise intensity, representing the initial noise intensity; α is the adjustment coefficient, used to control the influence degree of the change rate of the loss function on the noise intensity; ΔL t is the change amount of the loss function at the current moment t, expressed as L t -L t-1 ; R S is the point reputation score, representing the historical behavior reputation of the node.

6. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 4, characterized in that, The Gradient Triangulation Processing Unit specifically includes: Gradient Triangulation Mapping Formula: where, g″′ j is the gradient value after mapping, representing the result after ternarization; g″ j is the input gradient value, representing the gradient of a certain dimension; τ is the quantization threshold, used to determine whether the gradient value is large enough or small enough; if the gradient value g″ j is greater than the threshold τ, it is mapped to +1; if the gradient value g″ j is less than the negative threshold -τ, it is mapped to -1; if the gradient value g″ j is between -τ and τ, it is mapped to 0.

7. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 6, wherein, The Privacy Protection Module specifically includes: The Homomorphic Encryption Technology Unit includes: Threshold Homomorphic Encryption Algorithm Sub-Unit: It uses the Paillier threshold homomorphic encryption, supports the ciphertext aggregation operation of model parameters, the client encrypts the local gradient and uploads it to the blockchain, and the server can directly perform addition operations on the ciphertext without decryption; only when more than the threshold number of nodes cooperate to decrypt can the aggregation result be obtained, avoiding the risk of single-node private key leakage; Dynamic Key Management Sub-Unit: It generates public parameters and private key shards through a multi-party secure computing protocol to ensure that there is no centralized trusted node in the key generation process; the encryption key is automatically updated after each round of federated learning training, and the blockchain smart contract is combined to record the key version history; The Zero-Knowledge Proof Verification Unit includes: Model Parameter Validity Proof Unit: It uses zk-SNARKs to generate non-interactive zero-knowledge proofs of gradient parameters. The verifier can confirm that the gradient calculation complies with the predefined rules through the proof without obtaining the original data; it uses the Bulletproofs protocol to verify the range constraint of the encrypted gradient; Aggregation Process Verifiability Sub-Unit: It automatically verifies the validity of the zero-knowledge proof through a smart contract and records the verification result on the blockchain. Combining the Pedersen commitment and the Merkle tree structure, it performs batch verification on batch parameters to reduce the single-verification calculation overhead.

8. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 7, characterized in that The Homomorphic Encryption Technology Unit specifically includes: Homomorphic Encryption Aggregation Formula: Where c agg is the aggregated ciphertext, representing the result after performing a homomorphic operation on multiple ciphertexts c i ; c i is a single ciphertext, representing the encrypted message m i ; k is the number of ciphertexts participating in the aggregation; g is the generator, which is a fixed parameter in the encryption scheme and is used to generate ciphertexts; m i is the plaintext message, representing the original data to be encrypted; r i is a random number used in the encryption process to ensure the indistinguishability of each ciphertext; n 2 is the square of the modulus, which is used to define the range of the ciphertext space.

9. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 8, wherein, The Privacy Protection Module specifically includes: Encryption and Verification Process Fusion Unit: Two-stage privacy protection. In the first stage, the client encrypts the gradient using homomorphic encryption and generates a zero-knowledge proof; in the second stage, after the server aggregates the ciphertext, it verifies the legality of the aggregation result through the zero-knowledge proof; homomorphic encryption is enabled in the model update stage, and zero-knowledge proof is enabled in the parameter verification stage to balance computational efficiency and security.

10. The artificial intelligence data privacy protection system based on blockchain and federated learning according to claim 9, wherein, The Malicious Node Detection Module specifically includes: Gradient Similarity Analysis Unit: It calculates the cosine similarity between the local model gradient and the global model parameters, evaluates the consistency between the node update and the overall training direction. If the similarity is lower than the preset threshold, it is marked as a suspicious update; the threshold is dynamically adjusted according to the training stage; it combines historical similarity data to establish a node behavior baseline and detects abnormal patterns deviating from the baseline; Multi-Krum Algorithm Screening Unit: Calculate the comprehensive score of node updates by integrating the gradient direction, norm size, and update frequency, and filter out the abnormal nodes with the lowest scores; Verify the node group through random sampling to prevent malicious nodes from colluding to lower the scores of normal nodes; Retain the residual parameters for nodes suspected of misjudgment, and restore the contributions of trusted nodes after verification in subsequent rounds. Blockchain Reputation Data Linkage Unit: Record the historical behavior data of nodes in the main blockchain to generate a dynamic reputation score. The gradient update weight of high-reputation nodes is increased, and the participation qualification of low-reputation nodes is temporarily frozen; When an abnormal gradient is detected, the historical reputation record of the node is automatically retrieved through a smart contract to accelerate the decision-making process. Dual Verification and Penalty Unit: The first layer of verification is to real-time mark suspicious nodes based on cosine similarity and the Multi-Krum algorithm; The second layer of verification initiates on-chain data verification for suspicious nodes, requiring them to provide the encrypted original data feature hash value, and verify the data authenticity through zero-knowledge proof; Penalty strategies include short-term penalties, such as deducting token rewards and reducing the priority of computing tasks; Long-term penalty, when the reputation score is lower than the established threshold, permanently add it to the blacklist and synchronize it to other blockchain networks through a cross-chain protocol. Dynamic Reputation Update Algorithm Unit: Positive incentive is to increase the reputation score for nodes that contribute effective updates for multiple consecutive rounds; Negative attenuation is that when malicious behavior is detected, the reputation score decays exponentially; For accidental anomalies caused by network fluctuations, apply for reputation restoration by submitting a trusted execution environment proof.

Images