Verifiable Byzantine robust privacy protection federated learning method based on block chain

Abstract

The invention relates to a verifiable Byzantine robust privacy protection federated learning method based on a block chain. The method comprises the following steps: S1, a task publisher publishes a federated learning task to a block chain platform; s2, selecting a server and a client, and generating a function key; s3, uploading the encrypted ciphertext and auxiliary data to a block chain platform; s4, the server calculates the confidence of all the encryption models through the function key; the task publisher returns the key for aggregating all the models and the key for aggregating the benign model to the server; s5, uploading the aggregation model to a block chain, sending the reference model to a task publisher, judging whether a task completion condition is met at the moment, if so, executing S6, and otherwise, returning to S2; and S6, distributing task rewards to the client and the server based on the accumulated confidence coefficient and the accumulated number of times of correctly executing the aggregation strategy. Compared with the prior art, the method has the advantages of reducing abnormal value misjudgment of federal learning, improving calculation efficiency and the like.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a blockchain-based verifiable Byzantine robust privacy-preserving federated learning method. Background Art

[0002] Federated learning is an advanced and promising distributed learning paradigm that enables clients (such as smartphones, vehicles, and sensors) to build a joint learning model without sharing their local training data with a central server. In federated learning, multiple clients train a global model locally and then submit model updates to a central server for aggregation, thereby building a higher-quality global model. Due to its advantages of applying machine learning techniques to distributed data scenarios and protecting data privacy during data processing, federated learning has become a foundational technology for real-world applications such as personalized recommendations, medical image analysis, and autonomous driving.

[0003] While federated learning has brought significant benefits to people's daily lives, it also introduces new privacy and security risks. One notable issue is privacy leakage caused by shared models. Another serious security risk faced by federated learning is poisoning attacks.

[0004] To address privacy concerns, existing research on privacy-preserving federated learning primarily focuses on three basic techniques: differential privacy, homomorphic encryption, and secure multi-party computation. However, federated learning schemes based on differential privacy can reduce global model accuracy, while those based on homomorphic encryption and secure multi-party computation incur significant computational and communication overhead. To address these challenges, lightweight functional encryption schemes have been applied to federated learning to achieve data privacy protection and non-interactive ciphertext computation and decryption, and have garnered widespread attention.

[0005] To defend against poisoning attacks launched by malicious clients, existing defense strategies typically detect malicious models by leveraging the server's validation dataset or evaluating the similarity between local models. However, these strategies rely on revealing the sensitive statistical distribution of local models, which conflicts with the design goals of privacy-preserving federated learning. Furthermore, to address the single-point-of-failure threat of malicious aggregation servers, existing solutions deploy clients or construct a group of committee nodes to complete the aggregation work, but this imposes a heavy communication burden on the clients. In recent years, blockchain technology has attracted widespread attention due to its excellent properties such as decentralization, open, transparent, traceable data, and data immutability. Therefore, introducing blockchain technology into federated learning can provide a new solution to the single-point-of-failure problem of federated learning servers. Furthermore, smart contracts deployed on the blockchain can facilitate the implementation of incentive mechanisms in federated learning and improve the training quality of federated learning.

[0006] Patent document CN117216556A discloses a blockchain-based, Byzantine-resistant, privacy-preserving federated learning method. This method divides working nodes into training nodes and verification nodes. Training nodes complete local model training and add Gaussian noise. Verification nodes use local data to test model accuracy, which serves as a score and then performs robust aggregation based on the score. While this method achieves the privacy protection and Byzantine robustness of federated learning, the introduced Gaussian noise compromises the quality of the aggregated model.

[0007] Patent document CN117113413A discloses a blockchain-based robust federated learning privacy protection system. This system achieves privacy protection and robustness in federated learning by introducing secure multi-party computing technology and modifying existing aggregation algorithms. However, this system significantly increases communication and computational overhead between clients.

[0008] In summary, solutions to privacy and security attacks in federated learning already exist. However, current federated learning suffers from issues such as misjudgment of outliers and low computational efficiency due to privacy-preserving generation. Summary of the Invention

[0009] The purpose of this invention is to provide a blockchain-based verifiable Byzantine robust privacy-preserving federated learning method in order to reduce the misjudgment of outliers in federated learning and improve computing efficiency.

[0010] The purpose of the present invention can be achieved by the following technical solutions:

[0011] A blockchain-based verifiable Byzantine robust privacy-preserving federated learning method, comprising the following steps:

[0012] S1. The task publisher publishes the federated learning task to the blockchain platform;

[0013] S2. Select a server and client in the smart contract. The task publisher generates a function key, distributes the function key to the server, and then deploys the payment contract.

[0014] S3: The client obtains the current global model in the federated learning task and optimizes it. It encrypts the optimized local model and uploads the encrypted ciphertext and auxiliary data to the blockchain platform.

[0015] S4. The server collects all ciphertexts from the blockchain platform and decrypts them using the function key. The cosine similarity between each local model and the current baseline model is calculated based on the inner product of the decrypted local model and the current baseline model. The confidence of each local model is obtained based on the cosine similarity. The task publisher generates a key for aggregating all models and a key for aggregating benign models based on the confidence. The task publisher returns the key for aggregating all models and the key for aggregating benign models to the server.

[0016] S5. The server inputs the ciphertext and the keys of all aggregated models into the decryption algorithm to obtain the aggregated model. At the same time, the server inputs the ciphertext and the keys of the aggregated benign models into the decryption algorithm to obtain a baseline model for testing the toxicity of the ciphertext model in the next iteration. The server uploads the aggregated model to the blockchain and sends the baseline model of the next iteration to the task publisher to determine whether the task completion conditions are met at this time. If so, execute S6; otherwise, return to S2.

[0017] S6. Distribute task rewards to the client and server based on the accumulated confidence and the cumulative number of correct executions of the aggregation strategy. Repeat the above steps. After training is completed, use the global model to perform actual data processing tasks.

[0018] Furthermore, the encrypted ciphertext is:

[0019]

[0020] Among them, g and h are generators, and x is the local model;

[0021]

[0022] r and μ represent encryption keys, aux represents auxiliary information, the incremental counter ctr, pk2 is the public key of the encryptor, sk1 is the private key of the generator, and i represents the client serial number.

[0023] Furthermore, the local model includes a local normal model obtained by training the current global model by a benign client and a local poisonous model obtained by training the current global model by a malicious client.

[0024] Furthermore, the server collects all the ciphertexts from the blockchain platform and decrypts them using the function key in the following specific steps:

[0025] The server collects the ciphertext and function keys Decryption is performed based on the system parameters pp, the encryptor's public and private keys pk2, sk2, the generator's public key pk1, the decryptor's public key sk3 and the current benchmark model W base , calculate the first intermediate result represents the local model, W base Represents the current benchmark model, using the big-step small-step algorithm to calculate the second intermediate result The inner product result of the local model and the current benchmark model is calculated based on the second intermediate result U′, where sk3 is the private key of the decryptor.

[0026] Furthermore, the function key is:

[0027]

[0028] Where W base Represents the current baseline model.

[0029] Furthermore, the cosine similarity is:

[0030]

[0031] in, represents the local model, W base Represents the current baseline model.

[0032] Furthermore, the specific steps for obtaining the confidence of each local model based on cosine similarity are as follows:

[0033] Normalize the cosine similarity and use the S-curve function to transform the normalized cosine similarity to obtain the transformed cosine similarity. Calculate the confidence of each local model based on the transformed cosine similarity.

[0034] Furthermore, the key to aggregate all models is:

[0035]

[0036] The key to aggregate good models is:

[0037]

[0038] in, Represents the set obtained by resetting the values in the interval [0, 0.5] in the confidence set to 0.

[0039] Furthermore, the server inputs the ciphertext and the key of all aggregated models into the decryption algorithm. The specific steps to obtain the aggregated model are:

[0040] Ciphertext-based The key of all aggregated models is decrypted using the same method as S4 to obtain the aggregated model The aggregated model serves as the global model for the next round of client training;

[0041] The specific steps for inputting the ciphertext and the key of the aggregated benign model into the decryption algorithm to obtain the baseline model for testing the toxicity of the ciphertext model in the next iteration are:

[0042] Ciphertext-based The key of the aggregated benign model is decrypted using the same method as S4 to obtain the benchmark model for testing the toxicity of the ciphertext model in the next iteration.

[0043] Furthermore, the task reward includes the reward of each client and the reward of each server. The reward of each client is (η i / ∑η i )·(I / (I+K))·R, the reward for each server is (cmt k / ∑cmt k )·(K / (I+K))·R, where R is the task reward, K is the number of servers, cmt k It represents the cumulative number of times server k correctly executes the aggregation strategy.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] (1) The present invention uses a non-interactive functional encryption scheme to encrypt the uploaded local model, and adopts different encryption keys r and u to ensure that the ciphertext is more secure and more difficult to be cracked by the enemy's exhaustive attack and reasoning attack methods. At the same time, the single instruction multiple data technology is set and introduced, and applied to the encryption and decryption algorithms in the function encryption scheme, which can realize parallel batch model data encryption and batch model ciphertext decryption calculations, greatly saving calculation time, thereby solving the potential data privacy leakage and low calculation efficiency problems. In addition, the function encryption scheme adopted by the encryption method is to protect data privacy through encryption and decryption, which will not damage the accuracy of the model data, and thus will not damage the accuracy of the aggregate model. Differential privacy protects data privacy by adding Gaussian noise to the local model parameters to confuse the distribution of parameters, which will reduce the accuracy of the aggregate model. Therefore, function encryption can retain the model accuracy, so the present invention avoids the accuracy loss in the federated learning scheme based on differential privacy and the large amount of calculation and communication overhead in the federated learning scheme based on homomorphic encryption.

[0046] (2) The present invention improves on the existing aggregation mechanism based on cosine similarity, and dynamically constructs the benchmark model in the next round of detection based on the calculation results of cosine similarity in each round; at the same time, it improves the mapping relationship between contribution and aggregation weight, amplifies the aggregation weight of benign models, significantly improves the quality of the aggregation model, effectively aggregates the model and prevents the misjudgment of outliers. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Flowchart of the present invention. DETAILED DESCRIPTION

[0048] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0049] The present invention proposes a blockchain-based verifiable Byzantine robust privacy-preserving federated learning method, which includes the following steps:

[0050] S1. The task publisher publishes the federated learning task to the blockchain platform;

[0051] S2. Select a server and client in the smart contract. The task publisher generates a function key, distributes the function key to the server, and then deploys the payment contract.

[0052] S3: The client obtains the current global model in the federated learning task and optimizes it. It encrypts the optimized local model and uploads the encrypted ciphertext and auxiliary data to the blockchain platform.

[0053] S4. The server collects all ciphertexts from the blockchain platform and decrypts them using the function key. The cosine similarity between each local model and the current baseline model is calculated based on the inner product of the decrypted local model and the current baseline model. The confidence of each local model is obtained based on the cosine similarity. The task publisher generates a key for aggregating all models and a key for aggregating benign models based on the confidence. The task publisher returns the key for aggregating all models and the key for aggregating benign models to the server.

[0054] S5. The server inputs the ciphertext and the keys of all aggregated models into the decryption algorithm to obtain the aggregated model. At the same time, the server inputs the ciphertext and the keys of the aggregated benign models into the decryption algorithm to obtain a baseline model for testing the toxicity of the ciphertext model in the next iteration. The server uploads the aggregated model to the blockchain and sends the baseline model of the next iteration to the task publisher to determine whether the task completion conditions are met at this time. If so, execute S6; otherwise, return to S2.

[0055] S6. Distribute task rewards to the client and server based on the accumulated confidence and the cumulative number of correct executions of the aggregation strategy. Repeat the above steps. After training is completed, use the global model to perform actual data processing tasks.

[0056] The overall process of the present invention is as follows Figure 1As shown. Specifically, the method includes the following four steps: 1) Task publishing: The task publisher publishes a federated learning task request to the blockchain, confirms the participating members, assigns function keys, and initializes the payment smart contract. 2) Local training: In the tth training iteration, each participating client trains the global model, obtains a local model update, and sends the encrypted update and auxiliary data to the blockchain. 3) Privacy-preserving defensive aggregation: Once all encrypted updates and auxiliary data are collected, each server runs a secure cosine similarity calculation and incentive-based Byzantine-tolerant aggregation to generate an aggregated model. Then, each server uploads the aggregated model to the blockchain system. Subsequently, the task publisher can download the global model and check whether the correct aggregated model has achieved the expected accuracy. 4) Task reward issuance: When the training results meet the task requirements, the smart contract ensures that the participants will automatically receive the task rewards.

[0057] In the defensive aggregation step of local computation and privacy protection, the underlying technology for achieving privacy protection is the function encryption algorithm we proposed. They provide encryption services for local models and support secure inner product calculation of encrypted models. The proposed function encryption algorithm is divided into five small algorithms, with the following specific structure:

[0058] Initialization algorithm: It is executed by the generator. It starts with a security parameter 1 λ As input, the system public parameter p = (G, p, g, h, H1) is output, where G is the cyclic group of prime number p, g and h are generators, and H1 is a secure hash function.

[0059] Key generation algorithm: It takes the system public parameters as input, selects a random number s as the key, and outputs the public key pk = g s .set up and Represents the public and private key pairs of the generator, encryptor, and decryptor respectively.

[0060] Function key generation algorithm: It is executed by the generator. It inputs (pk1, sk1), the encryptor's public key pk2, an incremental counter ctr, a vector y that needs to be calculated with the ciphertext and auxiliary information aux as input, and outputs the function key in

[0061] Encryption algorithm: It is performed by the encryptor. It takes the system parameters pp, pk1, pk2, sk2, ctr, pk3 and sensitive data x as input and outputs the ciphertext of x

[0062] Decryption algorithm: It is performed by the decryptor. It is in the form of pp, pk1, sk f, sk3, ciphertext ct and y as input, and calculate Then, the big-step-small-step algorithm is used to calculate And output log(U′)=<x,y> .

[0063] The task release process mainly includes four parts: task issuance, member determination, key distribution and smart contract initialization:

[0064] Task release: The task publisher publishes the federated learning task T to the blockchain platform, where T contains the task publisher identity, the link to the initial global model, the dataset requirements, the task status, the expected number of training iterations, the expected processing time, and the task reward R. In this stage, multiple task publishers can publish their tasks at the same time, and these tasks are processed in descending order of task rewards.

[0065] Membership determination: The task publisher executes a random algorithm in the smart contract to select K servers that share a public-private key pair (pk S ,sk S At the same time, the task publisher confirms I clients from the clients that meet the task dataset requirements. The task publisher then changes the task status to training and broadcasts the participant list to the blockchain.

[0066] 3) Key distribution: The task publisher executes the key generation algorithm of the function encryption to generate the function key W base is the baseline model for the current training round, and the initial baseline model is the initial global model. Then the task publisher will use the function key Sent to each server.

[0067] 4) Contract Initialization: The task publisher generates a signature containing the task T and the participant as the payment token. The task publisher then deploys a payment contract to specify the payment strategy for paying rewards to participants.

[0068] In the local training step, it mainly includes two parts: local training and model encryption.

[0069] Local training: In the tth round of training, after obtaining the global model from the blockchain, the benign client starts to optimize the global model based on its private data and obtains the updated model by minimizing the loss function. For malicious clients, they will mark l before training. src The training samples are flipped to the selected target class l tar Then, they complete local training based on the wrong dataset, resulting in a local toxic model.

[0070] Model encryption: The client will encrypt the model before uploading it to the blockchain. The client uses the encryption algorithm of the function encryption Encrypt and get ciphertext The client will then and auxiliary data Send to the blockchain.

[0071] The privacy-preserving defense aggregation step mainly includes two parts: secure cosine similarity calculation and incentive-based Byzantine tolerance aggregation.

[0072] Secure cosine similarity calculation: Once the server has collected all the encrypted updates from the blockchain Each server first computes a local model and the baseline model W base The cosine similarity of is used to detect toxic models. With W base The smaller the similarity, The more likely it is a toxic model. Cosine similarity cs i The calculation of is defined as:

[0073]

[0074] In order to obtain the cosine similarity cs of each model i , the server first inputs the ciphertext and key To the decryption algorithm of the function encryption, get the decryption result The server then passes Get the cosine similarity value cs of each local model i .

[0075] Incentive-based Byzantine-tolerant aggregation: To avoid misjudging benign models, an incentive-based Byzantine-tolerant aggregation strategy is designed. This strategy uses confidence η∈[0, 1] as the aggregation weight to aggregate models instead of discarding abnormal models. The details are as follows:

[0076] The server first collects the cs of each local model i , and by calculating cs i =0.5+0.5*cs i , cs i The range of cs is normalized to [0, 1]. In order to encourage the client to honestly train a high-quality local model, the server uses an S-shaped curve function centered at 0.5 to i Convert to Among them, β is an adjustable parameter, which can be used to obtain the best incentive effect by scaling the S-curve function.

[0077] The server then sets the confidence level for each model. Instead of discarding abnormal models, the server uses confidence As the discriminator, all local models are estimated and Sent to the task publisher to obtain the function key for aggregate computing.

[0078] The task publisher first enters To the function encryption function key generation algorithm and obtain the key for all models aggregated Then, the task publisher will collect The values in the interval [0, 0.5] are reset to 0, and we get Task publisher calculation Then enter to the function key generation algorithm of the function encryption and obtain the key of the aggregated benign model The task publisher will and Return to the server.

[0079] The server first inputs the ciphertext and function keys The decryption algorithm of the function encryption scheme is used to implement the weighted aggregation of the encrypted local model and obtain the aggregated model Similarly, the server enters the ciphertext and function keys The decryption algorithm of the function encryption scheme is used to implement weighted aggregation of good models and obtain the benchmark model for the next round. Finally, the server aggregates the model W t+1 Upload to the blockchain and convert the benchmark model W base Sent to the task publisher to generate the function key for the next round

[0080] During the task reward distribution step, the payment smart contract deployed on the blockchain ensures that each participant can receive fair rewards. The specific steps are as follows:

[0081] When the training task is completed, each participating client can trigger the payment contract to obtain the task reward. The participating client submits the task T and the aggregation model W to the payment contract. t+1 The contract needs to determine whether T exists in the task pool, W t+1 Whether it is the latest global model of task T, and whether the task status of T is completed. Only after all the above conditions are met will the contract initiate a payment transaction from the task publisher to the participant.

[0082] The task publisher can set the task status of T to Completed or automatically change it to Completed. During the tth training iteration, the task publisher can download the latest aggregated model generated by all servers from the blockchain and use the most common aggregated model as the correct model. The task publisher needs to test the performance of the correct model on its own private dataset. When the global model converges or reaches the expected accuracy, the task publisher can set the task status to Completed. Otherwise, when the preset number of iterations is reached, the task status of T will automatically change to Completed.

[0083] In order to ensure the fairness of reward distribution, the payment strategy is set to distribute task rewards based on cumulative contribution. For clients, their cumulative contribution is the cumulative confidence η i , so each client can get rewards (η i / ∑η i )·(I / (I+K))·R. For servers, their cumulative contribution is the cumulative number of times they correctly execute the aggregation strategy cmt k , so each server can get rewards (cmt k / ∑cmt k )·(K / (I+K))·R. It can be found that each participant can obtain the task reward they deserve.

[0084] The key points of the present invention are:

[0085] Applications that combine emerging functional encryption algorithms with federated learning;

[0086] Introduction of function encryption algorithm: A new non-interactive function encryption scheme is proposed and introduced into federated learning, which can maintain high computing and communication performance while protecting model privacy.

[0087] Privacy-preserving defensive aggregation strategies;

[0088] Based on secure cosine similarity: Dynamic calculation of the baseline model in each round of training is designed, and the similarity between the encrypted local model and the baseline model is detected through secure cosine similarity, achieving an efficient model detection process.

[0089] Incentive-based Byzantine fault-tolerant aggregation mechanism: A mapping relationship between the contribution of each local model and the aggregation weight is designed, which can amplify the contribution of benign models, effectively aggregate models and prevent misjudgment of outliers.

[0090] Implementation of blockchain-based model verification and incentive mechanisms: The blockchain system is used to assist the federated learning process and protocol implementation, which improves the transparency of the server workflow and the credibility of the calculation results.

[0091] Regarding privacy protection, this paper uses a non-interactive functional encryption scheme to encrypt uploaded local models. By employing different encryption key settings and introducing single instruction multiple data (SIMD) technology, this approach addresses potential data privacy leaks and computational inefficiency. Furthermore, this encryption scheme avoids both the precision loss associated with differentially private federated learning schemes and the significant computational and communication overhead associated with homomorphic encryption-based federated learning schemes.

[0092] In terms of poisoning defense, this invention improves on the existing aggregation mechanism based on cosine similarity, and dynamically constructs the baseline model in the next round of detection based on the calculation results of cosine similarity in each round; at the same time, it improves the mapping relationship between contribution and aggregation weight, amplifies the aggregation weight of benign models, and significantly improves the quality of the aggregation model.

[0093] In terms of model verification, this invention expands upon the capabilities of existing blockchain-based federated learning. By leveraging blockchain technology, in addition to providing an open and transparent data trading platform, this invention can also monitor server behavior and verify the correctness of aggregated results.

[0094] The above describes in detail the preferred embodiments of the present invention. It should be understood that those skilled in the art can make numerous modifications and variations based on the concepts of the present invention without inventive effort. Therefore, any technical solutions that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. A blockchain-based verifiable Byzantine robust privacy-preserving federated learning method, characterized by: The method comprises the following steps: S1. The task publisher publishes the federated learning task to the blockchain platform; S2. Select a server and client in the smart contract. The task publisher generates a function key, distributes the function key to the server, and then deploys the payment contract. S3: The client obtains the current global model in the federated learning task and optimizes it. It encrypts the optimized local model and uploads the encrypted ciphertext and auxiliary data to the blockchain platform. S4. The server collects all ciphertexts from the blockchain platform and decrypts them using the function key. The cosine similarity between each local model and the current baseline model is calculated based on the inner product of the decrypted local model and the current baseline model. The confidence of each local model is obtained based on the cosine similarity. The task publisher generates a key for aggregating all models and a key for aggregating benign models based on the confidence. The task publisher returns the key for aggregating all models and the key for aggregating benign models to the server. S5. The server inputs the ciphertext and the keys of all aggregated models into the decryption algorithm to obtain the aggregated model. At the same time, the server inputs the ciphertext and the keys of the aggregated benign models into the decryption algorithm to obtain a baseline model for testing the toxicity of the ciphertext model in the next iteration. The server uploads the aggregated model to the blockchain and sends the baseline model of the next iteration to the task publisher to determine whether the task completion conditions are met at this time. If so, execute S6; otherwise, return to S2. S6. Distribute task rewards to the client and server based on the accumulated confidence and the cumulative number of correct executions of the aggregation strategy. Repeat the above steps. After training is completed, use the global model to perform actual data processing tasks.

2. A blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 1, characterized in that: The encrypted ciphertext is: Among them, g and h are generators, and x is the local model; r and μ represent encryption keys, aux represents auxiliary information, the incremental counter ctr, pk2 is the public key of the encryptor, sk1 is the private key of the generator, and i represents the client serial number.

3. A blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 2, characterized in that: The local model includes a local normal model obtained by a benign client training the current global model and a local poisonous model obtained by a malicious client training the current global model.

4. A blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 3, characterized in that: The specific steps for the server to collect all ciphertexts from the blockchain platform and decrypt them with the function key are as follows: The server collects the ciphertext and function keys Decryption is performed based on the system parameters pp, the encryptor's public and private keys pk2, sk2, the generator's public key pk1, the decryptor's public key sk3 and the current benchmark model W base , calculate the first intermediate result represents the local model, W base Represents the current benchmark model, using the big-step small-step algorithm to calculate the second intermediate result The inner product result of the local model and the current benchmark model is calculated based on the second intermediate result U′, where sk3 is the private key of the decryptor.

5. The blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 4, characterized in that: The function key is: Where W base Represents the current baseline model.

6. The blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 1, characterized in that: The cosine similarity is: in, represents the local model, W base Represents the current baseline model.

7. The blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 6, characterized in that: The specific steps to obtain the confidence of each local model based on cosine similarity are: Normalize the cosine similarity and use the S-curve function to transform the normalized cosine similarity to obtain the transformed cosine similarity. Calculate the confidence of each local model based on the transformed cosine similarity.

8. The blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 7, characterized in that: The key to aggregate all models is: The key to aggregate good models is: in, Represents the set obtained by resetting the values in the interval [0, 0.5] in the confidence set to 0.

9. The blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 8, characterized in that: The server inputs the ciphertext and the key for all aggregated models into the decryption algorithm. The specific steps to obtain the aggregated model are as follows: Ciphertext-based The key of all aggregated models is decrypted using the same method as S4 to obtain the aggregated model The aggregated model serves as the global model for the next round of client training; The specific steps for inputting the ciphertext and the key of the aggregated benign model into the decryption algorithm to obtain the baseline model for testing the toxicity of the ciphertext model in the next iteration are: Ciphertext-based The key of the aggregated benign model is decrypted using the same method as S4 to obtain the benchmark model for testing the toxicity of the ciphertext model in the next iteration.

10. A blockchain-based verifiable Byzantine robust privacy-preserving federated learning method according to claim 1, characterized in that: The task reward includes the reward of each client and the reward of each server. The reward of each client is (η i / ∑η i )·(I / (I+K))·R, the reward for each server is (cmt k / ∑cmt k )·(K / (I+K))·R, where R is the task reward, K is the number of servers, cmt k It represents the cumulative number of times server k correctly executes the aggregation strategy.

Images