Federal learning method and device based on zero knowledge proof

Abstract

The invention provides a federal learning method and device based on zero knowledge proof, and the method comprises the steps: obtaining a training task from a task publishing server through a communication address, updating the model parameters of a to-be-trained model according to local privacy data, and obtaining a first target parameter, according to the first target parameter and an updating model parameter of a matching training server, performing aggregation through a task publishing server, and performing repeated iteration until an aggregated model is converged; receiving a random round set, screening model parameters, and performing consistency verification through a task publishing server; meanwhile, local privacy data and initial model parameters are screened, correctness of data traceability, parameter iteration and model training processes is verified through a task publishing server based on zero-knowledge proof, and training is determined to be completed under the condition that verification is passed. According to the method, the problems of relatively low model training efficiency and slow updating caused by multi-server federated learning based on zero knowledge proof in the prior art in order to ensure data security are solved.

Description

Technical Field

[0001] The present invention relates to the field of multi-server DELL model training, and in particular to a zero-knowledge proof-based federated learning method, device, computer-readable storage medium and distributed business system. Background Art

[0002] Federated learning is an emerging machine learning paradigm that allows multiple decentralized edge devices or servers to work together to train local models using local data. These local model parameters are then iteratively integrated to calculate global model parameters. Unlike traditional centralized machine learning, federated learning eliminates the need for centralized storage of training data, providing a new approach to collaborative learning among multiple, untrusted organizations and enterprises.

[0003] However, traditional federated learning technology faces the following problems:

[0004] 1) Privacy Leakage: Although designed to protect the privacy of participants, gradient transfer may leak sensitive information. Encryption technology can alleviate privacy concerns but adds complexity to the federated learning system.

[0005] 2) Malicious clients and data: Attacked clients can manipulate the global model by constructing data. Detecting malicious behavior is burdensome for the system but crucial for security.

[0006] 3) Low training efficiency: Factors such as communication delays, data verification, and the efficiency of cryptographic tools may hinder the training speed of federated learning, greatly reducing the practicality of the federated learning framework.

[0007] To address the above issues and enable verifiable and secure multi-party training in an untrusted distributed system, existing technologies have introduced zero-knowledge proof technology into federated learning. Zero-knowledge proof is a cryptographic technology that allows one party to prove to another party that a statement is correct without revealing any useful information.

[0008] Specifically, during federated learning, federated trainers use zero-knowledge proofs to prove they are performing calculations according to the model initialization parameters and specific model published by the federated task issuer, without exposing their own private data. However, the zero-knowledge proofs generated for each node participating in each round of training consume significant computational resources for both the proof generator and the proof verifier, resulting in lower model training efficiency. Summary of the Invention

[0009] The main purpose of this application is to provide a federated learning method, device, computer-readable storage medium and distributed business system based on zero-knowledge proof, so as to at least solve the problem in the prior art that multi-server federated learning based on zero-knowledge proof leads to low model training efficiency and slow update in order to ensure data security.

[0010] To achieve the above objectives, according to one aspect of the present application, a federated learning method based on zero-knowledge proof is provided, comprising: obtaining a training task from a task publishing server via a communication address, updating model parameters of a to-be-trained model using local private data according to the training task to obtain a first target parameter; aggregating the first target parameter with the model parameters obtained by updating the to-be-trained model using the corresponding local private data by a matching training server based on the first target parameter, to obtain an aggregated to-be-trained model; repeating the obtaining step and the aggregating step at least once until the aggregated to-be-trained model converges; receiving a random round set issued by the task publishing server, filtering the first target parameter based on the random round set to obtain a second target parameter, and performing a consistency check on the second target parameter through the task publishing server; filtering the local private data based on the random round set to obtain a third target parameter, determining the local private data participating in the training other than the third target parameter as a fourth target parameter, filtering the initial model parameters based on the random round set to obtain a fifth target parameter; performing a zero-knowledge proof on at least the third, fourth, and fifth target parameters through the task publishing server; and determining the to-be-trained model as the target model if both the consistency check and the zero-knowledge proof pass.

[0011] Optionally, after obtaining the training task from the task publishing server via the communication address, the above method also includes: parsing the training task to extract the initial model parameters of the current round to obtain the sixth target parameter; performing a hash operation based on the sixth target parameter to obtain a first hash value, and performing an on-chain consistency check based on the first hash value and the second hash value stored in the alliance chain, the second hash value is obtained by the task publishing server performing a hash operation on the initial model parameters of the current round and uploading it to the alliance chain; if the on-chain consistency check passes, creating a Merkle tree in the alliance chain with the first hash value as the root hash; generating a public key to obtain a first public key, uploading the first public key to the alliance chain and determining the matching training server through the smart contract of the alliance chain; obtaining the public key of the matching training server through the smart contract to obtain the second public key, and recording the matching round in the alliance chain; in response to a preset instruction, uploading the local first matching factor to the alliance chain, and receiving the second matching factor of the matching training server; generating a shared key based on the second public key.

[0012] Optionally, the first target parameter and the model parameter of the matching training server are aggregated through the task publishing server according to the first target parameter, including: updating the Merkle tree according to the first target parameter; generating a target mask based on the first matching factor and the shared key; masking and encrypting the first target parameter according to the target mask to obtain a first target instruction; sending the first target instruction to the task publishing server, wherein the first target instruction is used to instruct the task publishing server to aggregate the first target parameter and the model parameter of the matching training server and store the aggregation result on the chain.

[0013] Optionally, a consistency check is performed through the task issuing server according to the second target parameter, including: generating multiple target masks according to each first matching factor and the corresponding shared key, and the first matching factor corresponds one-to-one to the target round in the random round set; masking and encrypting the corresponding second target parameter according to each target mask to obtain multiple second target instructions; sending the second target instruction to the task issuing server, wherein the second target instruction is used to instruct the task issuing server to perform an aggregation operation according to the second target parameter and perform a consistency check with the corresponding aggregation result on the alliance chain.

[0014] Optionally, a zero-knowledge proof is performed through the task publishing server based on at least the third target parameter, the fourth target parameter and the fifth target parameter, including: generating a data traceability proof, a parameter iteration proof and a model training proof based on the Merkle tree, the third target parameter, the fourth target parameter and the fifth target parameter; generating a third target instruction based on at least the data traceability proof, the parameter iteration proof and the model training proof and sending it to the task publishing server, the third target instruction being used to instruct the task publishing server to perform consistency verification with the data stored on the chain based on the data traceability proof, the parameter iteration proof and the model training proof carried by the third target instruction.

[0015] Optionally, data traceability proof, parameter iteration proof and model training proof are generated based on the Merkle tree, the third target parameter, the fourth target parameter and the fifth target parameter, including: using the third target parameter as a private input, the hash value corresponding to the third target parameter stored in the consortium chain as a public output, and the hash function as a circuit to generate a data traceability proof; using the third target parameter as a private input, the hash value of the fourth target parameter stored in the consortium chain as a public input, the Merkle tree as a public output, and the hash function as a circuit to generate a parameter iteration proof; using the third target parameter as a private input, the fifth target parameter as a public input, the first target instruction as a public output, and the parameter iteration algorithm and mask encryption algorithm of the target model as a circuit to generate a model training proof.

[0016] Optionally, a third target instruction is generated based on at least the data traceability proof, the parameter iteration proof and the model training proof, including: generating a target mask based on the first matching factor and the shared key; masking and encrypting the data traceability proof, the parameter iteration proof and the model training proof according to the target mask to obtain the third target instruction.

[0017] According to another aspect of the present application, a federated learning device based on zero-knowledge proof is provided, the device comprising: a first acquisition unit, configured to obtain a training task from a task issuing server via a communication address, and update the model parameters of a model to be trained using local private data according to the training task to obtain a first target parameter; an aggregation unit, configured to perform an aggregation step, and aggregate the first target parameter with the model parameters obtained by updating the model to be trained based on the corresponding local private data by the matching training server according to the first target parameter, to obtain an aggregated model to be trained; a repetition unit, configured to sequentially repeat the acquisition step and the aggregation step at least once until the aggregated model to be trained converges; a first verification unit, configured to receive the training data from the task issuing server; and a verification unit, configured to verify the training data from the task issuing server. A random round set is received from a task publishing server, a first target parameter is filtered according to the random round set to obtain a second target parameter, and a consistency check is performed through the task publishing server based on the second target parameter; a second acquisition unit is used to filter local private data according to the random round set to obtain a third target parameter, determine the local private data participating in training except the third target parameter as a fourth target parameter, filter the initial model parameters according to the random round set to obtain a fifth target parameter; a second verification unit is used to perform zero-knowledge proof through the task publishing server based on at least the third target parameter, the fourth target parameter, and the fifth target parameter; a determination unit is used to determine the model to be trained as the target model if both the consistency check and the zero-knowledge proof pass.

[0018] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the methods described above.

[0019] According to another aspect of the present application, a distributed business system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include a method for executing any one of the methods described.

[0020] Applying the technical solution of the present application, in the above-mentioned federated learning method based on zero-knowledge proof, first, the acquisition step is executed, and the training task is obtained from the task publishing server through the communication address. The model parameters of the to-be-trained model are updated through the local private data according to the training task to obtain the first target parameter; then, the aggregation step is executed, and the first target parameter is aggregated with the model parameters obtained by the matching training server based on the corresponding local private data to update the to-be-trained model according to the first target parameter through the task publishing server to obtain the aggregated model to be trained; thereafter, the acquisition step and the aggregation step are repeated at least once in sequence until the aggregated model to be trained converges; thereafter, the task publishing server is received. The server sends a random round set, filters the first target parameter according to the random round set, obtains the second target parameter, and performs a consistency check on the second target parameter through the task release server. Then, the local private data is filtered according to the random round set to obtain the third target parameter. The local private data participating in the training except the third target parameter is determined as the fourth target parameter. The initial model parameters are filtered according to the random round set to obtain the fifth target parameter. Then, a zero-knowledge proof is performed through the task release server based on at least the third target parameter, the fourth target parameter, and the fifth target parameter. Finally, if both the consistency check and the zero-knowledge proof pass, the model to be trained is determined as the target model. This application is set to implement zero-knowledge verification only for randomly selected rounds of training data based on a random multi-round selection set when the model converges. Compared with the existing technology, which performs zero-knowledge proof in each round of training, it reduces the amount of calculation and thus improves the training efficiency. At the same time, this application concentrates the aggregation process and zero-knowledge proof process in the training process on one server for execution, which is convenient for configuring a dedicated acceleration environment for the calculation process, and reduces the data interaction based on the blockchain in the on-chain aggregation and on-chain proof processes, thereby improving the training efficiency of the model. In summary, this method solves the problem in the existing technology that multi-server federated learning based on zero-knowledge proof leads to low model training efficiency and slow updates in order to ensure data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of a federated learning method based on zero-knowledge proof is shown according to an embodiment of the present application;

[0022] Figure 2 A schematic diagram of a process for issuing a model training task according to an embodiment of the present application is shown;

[0023] Figure 3 A flow chart of a model training process according to an embodiment of the present application is shown;

[0024] Figure 4 A schematic diagram of a zero-knowledge proof process according to an embodiment of the present application is shown;

[0025] Figure 5 The figure shows a structural block diagram of a federated learning device based on zero-knowledge proof provided according to an embodiment of the present application.

[0026] The above drawings include the following reference numerals:

[0027] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. DETAILED DESCRIPTION

[0028] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0029] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] For ease of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0032] Blockchain: Blockchain is a distributed ledger technology that uses cryptographic algorithms to ensure data immutability and transparency. Each block contains a certain number of transaction records and is linked to the previous block via hash pointers, forming a chain structure.

[0033] Federated Learning: Federated learning is a machine learning technique that allows multiple participants to jointly train a model while maintaining data privacy. Each participant trains the data locally and only shares model updates rather than the original data.

[0034] Zero-knowledge proof: Zero-knowledge proof is a technology that can prove the correctness of a proposition to the verifier without leaking any valid information to the verifier.

[0035] Merkle trees are a key data structure in blockchains, used to quickly summarize and verify the existence and integrity of block data. Generally speaking, they are a method of hashing large aggregated data blocks. This method relies on breaking these blocks into smaller units, each containing only a few data blocks. Each bucket is then hashed again, repeating the process until the total number of remaining hashes is only 1.

[0036] FedAVG algorithm: The model trainer uses the model initial parameters and local private data to calculate the gradient locally, updates the local model parameters, and returns the updated model parameters. The task publisher summarizes the returned model parameters to aggregate the parameters.

[0037] Semi-honest model: Semi-honest participants execute the protocol honestly and completely according to its requirements. However, they may record information collected during the execution of the protocol and attempt to infer the private information of other participants based on this information. If all participants are semi-honest, such a model is called a semi-honest model. The protocols designed in this article are all secure multi-party computation protocols under the semi-honest model.

[0038] ZK-SNARK: Zero-Knowledge Succinct Non-Interactive Argument of Knowledge. This protocol transforms a problem (or function) into an arithmetic circuit and, through further mathematical transformation, enables a verifier to confirm that a prover possesses certain knowledge, called a witness, that satisfies a specific relationship without revealing any information about the witness itself.

[0039] Randomized Multi-Round Selection Set: This specifies the rounds in all federated learning training iterations for which zero-knowledge proofs need to be generated. Rounds in this set are random and unique. For example, for a federated learning model trained for 10 iterations, if zero-knowledge proofs and verification of secure aggregation results are required for rounds 2, 3, and 6, the randomized multi-round selection set is {2, 3, 6}.

[0040] As introduced in the background technology, in the prior art, a federated trainer uses zero-knowledge proof to prove that it has indeed performed calculations in accordance with the model initial parameters and specific model published by the federated task publisher without exposing its own private data. However, the zero-knowledge proof generated by each node participating in each round of training in the zero-knowledge proof process will cause a large amount of computing occupancy for both the proof generator and the proof verifier, resulting in a lower efficiency in the model training process. In order to solve the problem in the prior art that multi-server federated learning based on zero-knowledge proof leads to low model training efficiency and slow updates due to the need to ensure data security, the embodiments of the present application provide a federated learning method, device, computer-readable storage medium, and distributed business system based on zero-knowledge proof.

[0041] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0042] In this embodiment, a federated learning method based on zero-knowledge proof is provided that runs on a mobile terminal, a computer terminal, or a similar computing device. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] Figure 1 Flowchart of the federated learning method based on zero-knowledge proof according to the embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0044] Step S201, an acquisition step, obtains a training task from a task issuing server via a communication address, and updates the model parameters of the to-be-trained model using the local private data according to the training task to obtain a first target parameter;

[0045] Specifically, the model trainer first obtains the training task, including the model's initial parameters and training requirements, from the task publisher (server) via the communication address. The model trainer then trains the model using its own local private data, updates the model parameters, and obtains the first target parameters, i.e., the locally trained model parameters.

[0046] Step S202, an aggregation step, aggregating the first target parameter and the model parameters obtained by the matching training server updating the to-be-trained model based on the corresponding local privacy data through the task issuing server according to the first target parameter, to obtain an aggregated to-be-trained model;

[0047] Specifically, the model trainer aggregates the first target parameters through the task publisher and merges them with the model parameters trained by the matching model trainer based on local private data to obtain the aggregated model to be trained. The matching model trainer is the other model trainer that responds to the training of this round after the model trainer parses the initial parameters of the model in each training round.

[0048] Step S203, repeating the acquisition step and the aggregation step at least once in sequence until the aggregated model to be trained converges;

[0049] Specifically, the process of obtaining the initial parameters and the process of updating the model parameters based on the local data are repeated iteratively until the above-mentioned model to be trained converges.

[0050] Step S204: receiving a random round set issued by the task issuing server, filtering the first target parameter according to the random round set to obtain a second target parameter, and performing a consistency check on the second target parameter through the task issuing server;

[0051] Specifically, the model trainer receives a random round set from the task publisher, which is a few rounds of training randomly selected by the task publisher for subsequent verification. The model trainer selects the first target parameters involved in the random round set, obtains the second target parameters, and performs consistency verification.

[0052] Step S205: Filter the local private data according to the random round set to obtain a third target parameter. Determine the local private data participating in the training except the third target parameter as a fourth target parameter. Filter the initial model parameters according to the random round set to obtain a fifth target parameter.

[0053] Specifically, the local privacy data and the initial model parameters are simultaneously filtered to obtain the third target parameter (filtered local privacy data), the fourth target parameter (unfiltered local privacy data), and the fifth target parameter (filtered initial model parameter).

[0054] Step S206: performing zero-knowledge proof through the task issuing server based on at least the third target parameter, the fourth target parameter, and the fifth target parameter;

[0055] Specifically, a zero-knowledge proof is performed based on these parameters to prove the correctness of the model training process without revealing private data.

[0056] Step S207: If both the consistency check and the zero-knowledge proof are passed, the model to be trained is determined as the target model.

[0057] Specifically, when all consistency checks and zero-knowledge proofs are passed, the task publisher confirms that the model training process is correct and the results are credible. At this time, the converged model is regarded as the final target model.

[0058] It is understandable that the above technical solution allows different participants (such as financial institutions and medical institutions, etc.) to jointly train the same machine learning model without sharing the original data with other participants through the federated learning mechanism. Each participant only uses its local privacy data (such as patient medical records, customer transaction records) to update the model parameters, and then sends these updated parameters (first target parameters) to the task publishing server for aggregation to build a more comprehensive model. This method effectively solves the data island problem, because the data does not need to leave its native environment, thereby protecting data privacy. In addition, the present application sets the aggregation and proof processes of the model to run on the task publishing server, reducing the interaction process between servers during online aggregation and verification, and reducing the decline in training efficiency caused by multiple data transmissions. In addition, by introducing a random round set, the scheme increases the unpredictability of the model training process, and realizes the verification of the compliance of the training process while reducing the number of zero-knowledge proof rounds, further reducing the large amount of computing resources and communication resources occupied by the zero-knowledge proof process.

[0059] In specific implementation, technologies such as homomorphic encryption and differential privacy can be further introduced to further enhance data security, or asynchronous communication protocols can be used to optimize the efficiency of model training.

[0060] According to this embodiment, first, an acquisition step is executed to acquire a training task from a task issuing server via a communication address. Based on the training task, model parameters of the model to be trained are updated using local private data to obtain a first target parameter. Then, an aggregation step is executed to aggregate the first target parameter with the model parameters obtained by updating the model to be trained using the corresponding local private data by the matching training server based on the first target parameter, thereby obtaining an aggregated model to be trained. The acquisition step and the aggregation step are then repeated at least once until the aggregated model to be trained converges. A random round set is then received from the task issuing server. The first target parameter is filtered based on the random round set to obtain a second target parameter. A consistency check is then performed on the task issuing server based on the second target parameter. The local private data is then filtered based on the random round set to obtain a third target parameter. The local private data participating in the training, excluding the third target parameter, is determined as a fourth target parameter. Initial model parameters are filtered based on the random round set to obtain a fifth target parameter. A zero-knowledge proof is then performed on the task issuing server based on at least the third, fourth, and fifth target parameters. Finally, if both the consistency check and the zero-knowledge proof pass, the model to be trained is determined as the target model. This application is set to implement zero-knowledge verification only for randomly selected rounds of training data based on a random multi-round selection set when the model converges. Compared with the existing technology, which performs zero-knowledge proof in each round of training, it reduces the amount of calculation and thus improves the training efficiency. At the same time, this application concentrates the aggregation process and zero-knowledge proof process in the training process on one server for execution, which is convenient for configuring a dedicated acceleration environment for the calculation process, and reduces the data interaction based on the blockchain in the on-chain aggregation and on-chain proof processes, thereby improving the training efficiency of the model. In summary, this method solves the problem in the existing technology that multi-server federated learning based on zero-knowledge proof leads to low model training efficiency and slow updates in order to ensure data security.

[0061] In order to complete the matching with the matching training server and introduce different participants, in an optional embodiment, after obtaining the training task from the task issuing server via the communication address, the above method further includes:

[0062] Step S301: parsing the training task to extract the initial model parameters of the current round to obtain the sixth target parameters;

[0063] Specifically, the training task is parsed and the initial model parameters of the current round are extracted as the sixth target parameters.

[0064] Step S302: Perform a hash operation based on the sixth target parameter to obtain a first hash value. Perform an on-chain consistency check based on the first hash value and a second hash value stored in the consortium chain. The second hash value is obtained by performing a hash operation on the initial model parameters of the current round by the task issuing server and uploading it to the consortium chain.

[0065] Specifically, a hash operation is performed based on the sixth target parameter to obtain a first hash value. The model trainer performs an on-chain consistency check on the first hash value and the second hash value stored on the consortium chain. The second hash value h2 is calculated and uploaded to the consortium chain by the task issuing server before uploading the initial model parameters for the current round.

[0066] Step S303: If the on-chain consistency check passes, a Merkle tree is created on the consortium chain using the first hash value as the root hash;

[0067] Specifically, if the on-chain consistency check passes, the model trainer will use the first hash value as the root hash and create a Merkle tree on the consortium chain to record the subsequently updated model parameter hash values ​​and verify the integrity of the process data.

[0068] Step S304: Generate a public key to obtain a first public key, upload the first public key to the alliance chain, and determine the matching training server through the smart contract of the alliance chain;

[0069] Specifically, the model trainer generates a public key, obtains the first public key, and uploads it to the alliance chain, and determines the matching training server (not limited to one, there is a possibility of multiple) through the smart contract mechanism of the alliance chain.

[0070] Step S305: Obtain the public key of the matching training server through the smart contract, obtain the second public key, and record the matching round in the alliance chain;

[0071] Specifically, the public key of the matching training server is obtained through the smart contract, and the matching rounds are recorded in the alliance chain for subsequent verification and auditing.

[0072] Step S306: In response to a preset instruction, the local first matching factor is uploaded to the alliance chain, and the second matching factor of the matching training server is received;

[0073] Specifically, at a preset time point or round, the model trainer uploads the locally generated first matching factor to the consortium chain and receives the second matching factor from the matching training server. These matching factors will be used in the subsequent secure aggregation process to ensure the security of the encryption and decryption of model parameters. The second matching factor of the matching training server is generated based on the first matching factor of the training participant to ensure the correspondence of each matching round.

[0074] Step S307: Generate a shared key based on the second public key.

[0075] Specifically, based on the obtained second public key, the model trainer generates a key shared with the matching training server for securely exchanging model parameters and other training data.

[0076] The above embodiment ensures the integrity and consistency of model parameters by storing hash values ​​on the consortium chain. Any parameter changes during transmission will cause the hash to change. Using Merkle trees to store digests allows for efficient verification of the integrity of large amounts of data without requiring individual checks, improving the efficiency of zero-knowledge verification. Furthermore, smart contracts automatically determine matching training servers and generate shared keys, streamlining the collaborative process and increasing the automation and efficiency of federated learning.

[0077] In specific implementation, it includes but is not limited to using other blockchain technologies (such as side chains and sharding) to optimize the performance of the alliance chain, or integrating more security protocols (such as threshold signatures) to enhance the security of key management.

[0078] In order to improve the efficiency of the polymerization process, in an optional embodiment, the above step S202 includes:

[0079] Step S2021, updating the Merkle tree according to the first target parameter;

[0080] Specifically, the hash value of the first target parameter is added to the existing Merkle tree and the tree structure is updated to ensure that parameter changes during the model iteration process are traceable, while also providing the necessary public information for subsequent zero-knowledge proofs.

[0081] Step S2022: generating a target mask based on the first matching factor and the shared key;

[0082] Specifically, the model trainer and the matching training server have generated a shared key through the smart contract mechanism before training and hold the matching factor. On this basis, the first matching factor and the shared key are used to generate a target mask, which will be used to encrypt the model parameters to ensure the privacy of the parameters during the aggregation process.

[0083] Step S2023, masking and encrypting the first target parameter according to the target mask to obtain a first target instruction;

[0084] Specifically, the model trainer uses the generated target mask to encrypt the first target parameter to obtain the encrypted target instruction.

[0085] Step S2024: Send the first target instruction to the task issuing server, wherein the first target instruction is used to instruct the task issuing server to aggregate the first target parameter with the model parameter of the matching training server and store the aggregation result on the chain.

[0086] Specifically, the model trainer sends the encrypted target instructions to the task publishing server. After receiving the encrypted instructions from all trainers, the task publishing server unmasks them, aggregates the parameters using the FedAVG algorithm, and stores the hash value of the aggregation result on the chain to ensure the transparency of the parameter aggregation process and the verifiability of the results.

[0087] Through the above-described embodiments, model parameters in federated learning can be effectively aggregated while ensuring privacy and security. Blockchain technology also ensures the traceability of the model training process and the immutability of the results. Furthermore, the use of Merkle trees reduces the amount of data uploaded to the blockchain, improving blockchain performance. The shared key and masked encryption mechanisms enhance the security of model parameter transmission and storage, preventing data leakage during transmission. Furthermore, the aggregation process is independently completed by the task publishing server, facilitating the deployment of an accelerated computing environment within the task publishing server and reducing data transmission between different servers involved in the aggregation process.

[0088] In specific implementation, it includes but is not limited to adopting more complex encryption algorithms (such as fully homomorphic encryption) to enhance data protection, or designing more efficient consensus mechanisms (such as Byzantine fault tolerance algorithms) to accelerate the process of chain storage.

[0089] In order to verify the correctness and compliance of the model training process, in an optional embodiment, the above step S204 includes:

[0090] Step S2041: Generate multiple target masks based on each first matching factor and the corresponding shared key, where the first matching factor corresponds one-to-one to the target round in the random round set;

[0091] Specifically, the model trainer uses the first matching factor of the corresponding matching trainer to generate a target mask. Each target mask corresponds to a target round in the random round set. The target mask serves to obfuscate the model parameters when they are encrypted, protecting their privacy.

[0092] Step S2042: Mask and encrypt the corresponding second target parameters according to each target mask to obtain multiple second target instructions;

[0093] Specifically, the model trainer encrypts the model parameters (second target parameters) of the round that need to be verified through the corresponding target mask to generate the second target instruction.

[0094] Step S2043: Send the second target instruction to the task issuing server, wherein the second target instruction is used to instruct the task issuing server to perform an aggregation operation according to the second target parameter and perform a consistency check with the corresponding aggregation result on the alliance chain.

[0095] Specifically, the model trainer sends the encrypted second target instructions to the task publishing server, which is responsible for decrypting and aggregating these instructions. After receiving the second target instructions from all trainers, the server aggregates the parameters based on the FedAVG algorithm and performs a consistency check on the aggregated results with the historical aggregation results on the consortium chain to confirm whether the model training process is compliant.

[0096] Through the above embodiment, by comparing the model parameter hash values ​​recorded on-chain, it is possible to verify the correctness of parameter updates during model training, thus preventing training bias caused by dishonest behavior or errors. Consistency checks are only performed on a randomly selected portion of rounds, rather than all rounds. This reduces the total number of verification operations and thus improves the efficiency of the entire federated learning training process.

[0097] In specific implementation, this includes but is not limited to using more advanced cryptographic techniques (such as ring signatures and blind signatures) to enhance the security of the verification process, or developing more flexible verification strategies (such as dynamic threshold verification) to adapt to federated learning tasks of different scales and types.

[0098] In order to verify the correctness and compliance of the model training process, in an optional embodiment, the above step S205 includes:

[0099] Step S2051: Generate a data traceability certificate, a parameter iteration certificate, and a model training certificate based on the Merkle tree, the third target parameter, the fourth target parameter, and the fifth target parameter;

[0100] Specifically, the data provenance proof generation model trainer compares the third target parameter, that is, the hash value of the local private data, with the root hash of the Merkle tree to generate a data provenance proof, proving that the data used is indeed derived from the data recorded on the chain. The parameter iteration proof generation is based on the fourth target parameter (model parameter not involved in the proof) and the fifth target parameter (model parameter used for proof). The model trainer generates a parameter iteration proof to prove that the model parameters are generated based on the correct iterative process. The model training proof generation model trainer uses the third target parameter (local private data) and the fifth target parameter (model parameter used for proof) to generate a model training proof to prove that the model training process complies with the specified algorithm and data usage rules.

[0101] Step S2052: Generate a third target instruction based on at least the data traceability proof, parameter iteration proof, and model training proof and send it to the task issuing server. The third target instruction is used to instruct the task issuing server to perform consistency verification with the data stored on the chain based on the data traceability proof, parameter iteration proof, and model training proof carried by the third target instruction.

[0102] Specifically, the model trainer generates a third target instruction based on at least the generated data traceability proof, parameter iteration proof, and model training proof, and sends it to the task publishing server. After receiving the third target instruction, the server performs a consistency check on these proofs with the data stored on the chain to verify whether the model trainer has correctly executed the training process. This zero-knowledge proof relies solely on the matching of the proof and the relevant public output, without requiring knowledge of the specific data or intermediate results used by the prover.

[0103] Through the above-described embodiments, zero-knowledge proofs ensure that data and intermediate results during model training are not leaked. Even if a verifier can confirm the correctness of the results, the specific content of the data cannot be determined. By storing key data from the model training process on-chain and verifying these processes using zero-knowledge proofs, non-participants or third parties can verify the correctness of model training, increasing the transparency and credibility of the federated learning framework. Generating and verifying zero-knowledge proofs only in randomly selected rounds, rather than verifying all training rounds, significantly reduces the computational cost of verification and improves the overall efficiency of federated learning. Furthermore, the introduction of Merkle trees ensures that the verification process is based only on the summarized data, reducing the amount of data compared during the verification process.

[0104] In specific implementation, it includes but is not limited to adopting more advanced zero-knowledge proof protocols (such as zk-SNARKs, zk-STARKs), or combining other privacy protection technologies (such as secure multi-party computing) to further enhance the efficiency of data protection and verification.

[0105] In order to generate the above-mentioned data traceability proof, parameter iteration proof and model training proof, in an optional embodiment, the above-mentioned step S2051 includes:

[0106] Step S20511: Using the third target parameter as a private input, the hash value corresponding to the third target parameter stored in the consortium chain as a public output, and the hash function as a circuit, a data traceability certificate is generated;

[0107] Specifically, the model trainer uses the third target parameter (local private data) as the private input and the hash value of the third target parameter stored on the consortium chain as the public output, using the hash function as a circuit to generate a data traceability proof. This proof is used to verify that the data used by the model trainer during training is indeed derived from the records on the chain and has not been tampered with.

[0108] Step S20512: Generate a parameter iteration proof using the third target parameter as the private input, the hash value of the fourth target parameter stored in the consortium chain as the public input, the Merkle tree as the public output, and the hash function as the circuit;

[0109] Specifically, the model trainer uses the third target parameter (local private data) as the private input, the fourth target parameter stored in the consortium chain (the hash value of the model parameter not involved in the proof) as the public input, and the root hash value of the Merkle tree as the public output. The hash function is also used as a circuit to generate the parameter iteration proof. This proves that the iterative update process of the model parameters is carried out according to the established algorithm and the result is consistent with the state recorded in the Merkle tree.

[0110] Step S20513, using the third target parameter as the private input, the fifth target parameter as the public input, the first target instruction as the public output, and the parameter iteration algorithm and mask encryption algorithm of the target model as the circuit to generate a model training certificate.

[0111] Specifically, the model trainer uses the third target parameter (local private data) as the private input, the fifth target parameter (model parameter used for proof) as the public input, the first target instruction (encrypted model parameter) as the public output, and the model's parameter iteration algorithm and mask encryption algorithm as the circuit to generate a model training proof. This proves that the model trainer has trained according to the correct training algorithm and encryption standard and submitted the encrypted model parameters.

[0112] Through the above embodiments, the correct use of data is proven without revealing the data itself, protecting the data privacy of the model trainer. This proves that the model trainer has used data, updated model parameters, and aggregated them securely according to the rules, increasing the transparency and credibility of the training process. By generating zero-knowledge proofs in randomly selected rounds rather than verifying all rounds, the computational burden and network transmission overhead of model verification are reduced. In summary, this technical solution effectively verifies the correctness of federated learning model training through zero-knowledge proofs, while protecting data privacy during training, achieving a balance between efficiency and security.

[0113] In specific implementations, this includes but is not limited to using more complex circuit structures (such as Boolean circuits, arithmetic circuits) to adapt to different types of data and model training requirements, or combining other zero-knowledge proof technologies (such as non-interactive zero-knowledge proof) to simplify the proof process.

[0114] In order to complete the zero-knowledge proof, in an optional implementation, the above step S2052 includes:

[0115] Step S20521: Generate a target mask based on the first matching factor and the shared key;

[0116] Specifically, the model trainer uses the first matching factor (private random number) and the shared key with the training server to generate the target mask. This mask is used to further encrypt the zero-knowledge proof, ensuring the privacy of the proof during transmission.

[0117] Step S20522: Mask and encrypt the data traceability proof, parameter iteration proof, and model training proof according to the target mask to obtain a third target instruction.

[0118] Specifically, the model trainer combines the generated data traceability proof, parameter iteration proof, and model training proof with the target mask, encrypts the proof, and generates a third target instruction. This instruction contains the encrypted proof information, and the model trainer uses this instruction to indicate to the task issuing server that it has completed the specific proof process, while ensuring the security of the proof transmission.

[0119] Through the above embodiments, in addition to the inherent characteristics of zero-knowledge proofs, the addition of a target mask further ensures the security of the proof during transmission. Even if the proof is intercepted during transmission, it cannot be decrypted, thus protecting the privacy of the training data. The generation and verification process of zero-knowledge proofs can be relatively complex. By applying a target mask to the proof, the verification process for the verifier (in this case, the task issuing server) can be simplified. They only need to verify the correctness of the ciphertext without having to deeply understand the details of the zero-knowledge proof.

[0120] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the zero-knowledge proof-based federated learning method of the present application will be described in detail below with reference to specific embodiments.

[0121] This embodiment relates to a specific federated learning method based on zero-knowledge proof, including the process of establishing a training alliance, publishing training tasks, iterative model training, generating and verifying training proofs, and publishing converged models.

[0122] Specifically, this application proposes the following requirements for participants in model training:

[0123] 1) Participants include publishers of training tasks, trainers who perform specific training tasks, and users of models. Participants can have multiple identities at the same time. Publishers own training tasks, can publish federated learning tasks, and provide incentives. Trainers own local private data used for training, can use private data to complete training tasks, and obtain incentives. After obtaining incentives, they can use them to use the trained model.

[0124] 2) Assume that the three types of participants mentioned above are all curious, that is, the participants will be able to infer the private data of other participants through the information they obtain; at the same time, assume that the trainer is lazy, that is, the trainer will try to generate training results that can be verified by the publisher with lower computational effort without being discovered; assume that the user is curious, that is, he will try to use the results of model derivation to infer the model.

[0125] 3) All participants in model training will verify the convergence of the model and reach a training consensus on the chain to ensure that the distributed system is not subject to Byzantine attacks.

[0126] Further, among others, a training alliance is established, including:

[0127] The publisher initiates an invitation to establish an alliance on the blockchain, and the trainer accepts the invitation to form an alliance chain. The publisher and trainer maintain the model version through the alliance chain.

[0128] Further, such as Figure 2 As shown, the training task release includes:

[0129] (1) The task publisher determines the training task, initializes the training task through the zero-knowledge proof initialization algorithm, obtains the proof generation key (zero-knowledge proof public key) and proof verification key (zero-knowledge proof private key) used to generate and verify the zero-knowledge proof, and uploads the zero-knowledge proof public key and communication address to the chain through the zero-knowledge proof smart contract.

[0130] The model trainer (x in xi indicates the model trainer and i is the serial number) subscribes to the training event to obtain the publisher's mailing address and the corresponding zero-knowledge proof generation key required for this training.

[0131] (2) Furthermore, the model publisher publishes the multiplicative homomorphic encryption public key to the model trainer.

[0132] (3) The task publisher uploads the hash of the initial model parameters to the blockchain for evidence storage. At the same time, the current model status is recorded as the model has not converged and the training task is in progress.

[0133] (4) The model trainer obtains the initial model parameters of the initial model of this round of training tasks through the communication address of the task publisher.

[0134] (5) The model trainer hashes the initial model parameters of the training task initial model provided by the task publisher, and compares them with the hash of the initial model parameters on the chain to confirm whether the model parameters received from the task publisher have been modified.

[0135] Among them, the initial parameters of the model after verification are used as the model trainer x iThe root hash of the Merkle tree is stored on-chain.

[0136] (6) Model trainer x i Generate a pair of public and private keys (Sk i ,Pk i ), model trainer x i Call the blockchain mask to generate the smart contract and pass the public key Pk i Upload to the blockchain, where the public and private keys are generated as follows: g is the generator of a prime number p-order cyclic group, Z p is a finite field of integer modulo p residue classes, and the model trainer x i Generate its own corresponding private key Sk i =z i ∈Z p Public Key

[0137] (7) Model trainer x i Call the mask matching smart contract. The mask matching smart contract returns x i Matching trainer x b Corresponding public key Pk b To model trainer x i At the same time, the contract records the corresponding matching situation on the chain (including the corresponding matching parties and the corresponding rounds) and randomly selects the matching factor generator.

[0138] Among them, the generator is the model trainer x i For example, x i Generate matching factor - random number a i Send to matching x off-chain b , used for subsequent mask generation and mask recovery. b Upon receipt of x i After sending the matching factor, the opposite number will be used as its own matching factor.

[0139] The matching trainer x returned by the mask matching smart contract b Corresponding public key Pk b and matching factor a b And record the corresponding matching situation (including the corresponding matching parties and the corresponding rounds) to the blockchain.

[0140] (8) Model trainer x i Using your own private key Sk i , matching trainer x b Corresponding public key Pk b Generate a public shared key Where H: {0,1} * →Z pis a standard collision-resistant hash function. The shared keys obtained by this scheme are equal, and the formula is as follows:

[0141]

[0142] Further, such as Figure 3 As shown, the model training iteration includes:

[0143] It is understandable that the process is the same for every model trainer participating in model training and for each round of training. Here is a detailed description of the detailed process of model training in round T-1 for a single model trainer:

[0144] (1) The task publisher stores the hash value of the global model parameters for this round of training on the chain.

[0145] (2) Model trainer x i Communicate with the task publisher off-chain to obtain the global model parameters for the T-1 round of training.

[0146] (3) Model trainer x i The global model parameter hash of this round uploaded to the blockchain by the task publisher is obtained on the chain to verify the correctness of the obtained model parameters.

[0147] (4) Model trainer x i Hash the local privacy data used in this round on the chain for training the model trainer x in round T-1 i The usage of local private data is recorded. According to the training plan published by the task publisher, if the training set between different rounds in the training plan changes, the local private data hash of the corresponding round should be updated on the chain.

[0148] (5) Model trainer x i The local training node uses local private data to train the model to obtain training results and update the local model parameters.

[0149] (6) Use the local model parameter hash to train the on-chain model x i The Merkle root hash is updated.

[0150] (7) Model trainer x i The local model parameters are passed through the aggregation algorithm mask encryption module to generate a masked model parameter vector Among them, w i For the model trainer x i The original model parameter vector of . The mask after the left plus sign is obtained by the trainer x i Sharing public keys with masks The generated masked model parameter vector will be sent to the task publisher for secure aggregation. At the same time, the model trainer x i The corresponding masked model parameter vector sent by the model trainer is:

[0151] (8) The task publisher uses the x b The model trainer uses the FedAVG scheme to securely aggregate the masked model parameters. The masked model parameters w i ′ performs security aggregation, and the aggregation result is z=∑w i ′=∑w i .

[0152] (9) The task publisher calls the model convergence judgment module to determine whether the model has converged.

[0153] Further, such as Figure 4 As shown, the training proof generation verification includes:

[0154] (1) The task publisher sends a random multi-round selection set to all model trainers. The random multi-round selection set includes three randomly selected rounds of iteration as the target of security aggregation. The random multi-round selection set sent to each model trainer is different except for the two determined rounds.

[0155] (2) The model trainer sends back the three rounds of masked model parameters selected by the random multi-round selection set to the task publisher.

[0156] (3) The task publisher calls the security aggregation algorithm to perform security aggregation and generates a hash for the aggregation result.

[0157] (4) The task publisher obtains the hash verification aggregation results of the corresponding round to see if they are consistent.

[0158] (5) Model trainer x i A random multi-round selection set is used to select the local initial model parameters for the corresponding round. The resulting results and local private data are used as hidden inputs. The zero-knowledge proof generation module is called to generate three zero-knowledge proofs: data traceability, model parameter iteration, and model training process. The data traceability proof uses the model trainer's local private data as private input, a hash function as the circuit, and the corresponding hash value as the public output. The model parameter iteration proof uses the local private model parameters as private input, a hash function as the circuit, the hash of the local private model parameters of the remaining rounds as public input, and the corresponding Merkle tree root hash as the public output. The model training process proof uses the local private data as private input, the model parameter iteration algorithm and masked encryption as the specific circuit, the initial model parameters of the corresponding round as public input, and the masked training result as the public output.

[0159] (6) Model trainer x i Call zero-knowledge proof to verify the contract, and the contract obtains the on-chain model trainer x i The model parameter Merkle tree and local privacy data hash are verified, and the verification results are sent to the task publisher.

[0160] (7) After the task publisher verifies all proof results and all training results pass, the proof generation and verification phase ends.

[0161] Convergent model releases include:

[0162] After the training publisher determines that the model has converged through the model convergence module, it verifies the model through zero-knowledge proof and secure aggregation proof. If the verification is successful, the corresponding model's on-chain status is modified to converged. The training is completed and the training session is concluded. It is published for subscribers to use.

[0163] In one embodiment, the present application also includes a method for handling participant disconnection during a security aggregation process:

[0164] If the task publisher does not receive the corresponding model trainer x k The returned masked model parameter w k ′, then initiate an application to the mask matching smart contract to confirm the model trainer x k Is the line disconnected? If the model trainer x k Can return the corresponding masked model parameter result hash H(w k ′) and it is the same as the record on the chain, it is considered to be unbroken, requiring the model trainer x k Resend w k ' to the task publisher. If the message cannot be sent back, it is considered disconnected. The task publisher obtains matching information through the smart contract and records the matching information on the chain. k The matching model trainer is Towards Get the corresponding mask Among them Sk b To match the model trainer The private key, PK k is x k The public key of b To correspond to the mask factor, the task publisher obtains the aggregated results of the remaining successfully returned model trainers.

[0165] By definition: Z i≠k =∑ i≠k w′ i =∑ i≠k w i +b′ b, then to get the final result not affected by the mask, we have: Among them, b′ b is x k Matching model trainer The mask of k For the model trainer x k mask.

[0166] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0167] The embodiment of the present application also provides a federated learning device based on zero-knowledge proof. It should be noted that the federated learning device based on zero-knowledge proof in the embodiment of the present application can be used to execute the federated learning method based on zero-knowledge proof provided in the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation methods, and the details that have been explained will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0168] The following introduces the federated learning device based on zero-knowledge proof provided in the embodiments of the present application.

[0169] Figure 5 : is a structural block diagram of a federated learning device based on zero-knowledge proof according to an embodiment of the present application. Figure 5 As shown, the device includes:

[0170] A first acquisition unit 10 is configured to execute an acquisition step, obtain a training task from a task issuing server via a communication address, and update model parameters of a to-be-trained model using local private data according to the training task to obtain first target parameters;

[0171] An aggregation unit 20 is configured to perform an aggregation step, aggregating the first target parameter and the model parameters obtained by updating the to-be-trained model based on the corresponding local privacy data by the matching training server according to the first target parameter through the task issuing server, to obtain an aggregated to-be-trained model;

[0172] a repeating unit 30, configured to sequentially repeat the obtaining step and the aggregating step at least once until the aggregated model to be trained converges;

[0173] A first verification unit 40 is configured to receive a random round set issued by a task issuing server, filter the first target parameter according to the random round set, obtain a second target parameter, and perform a consistency check on the second target parameter through the task issuing server;

[0174] A second acquisition unit 50 is configured to filter the local private data according to the random round set to obtain a third target parameter, determine the local private data participating in the training other than the third target parameter as a fourth target parameter, and filter the initial model parameters according to the random round set to obtain a fifth target parameter;

[0175] A second verification unit 60 is configured to perform zero-knowledge proof through the task issuing server based on at least the third target parameter, the fourth target parameter, and the fifth target parameter;

[0176] The determination unit 70 is configured to determine the model to be trained as the target model when both the consistency check and the zero-knowledge proof are passed.

[0177] According to this embodiment, the first acquisition unit executes the acquisition step, obtains the training task from the task issuing server through the communication address, updates the model parameters of the to-be-trained model through the local privacy data according to the training task, and obtains the first target parameter; the aggregation unit executes the aggregation step, aggregates the first target parameter and the model parameters obtained by the matching training server based on the corresponding local privacy data to update the to-be-trained model according to the first target parameter through the task issuing server, and obtains the aggregated to-be-trained model; the repetition unit repeats the acquisition step and the aggregation step at least once in sequence until the aggregated to-be-trained model converges; the first verification unit receives the random round set issued by the task issuing server, and obtains the aggregated to-be-trained model ... , filtering the first target parameter according to the random round set to obtain the second target parameter, and performing a consistency check through the task publishing server based on the second target parameter; the second acquisition unit filters the local privacy data according to the random round set to obtain the third target parameter, determines the local privacy data participating in the training except the third target parameter as the fourth target parameter, and filters the initial model parameters according to the random round set to obtain the fifth target parameter; the second verification unit performs zero-knowledge proof through the task publishing server based on at least the third target parameter, the fourth target parameter, and the fifth target parameter; the determination unit determines the to-be-trained model as the target model if both the consistency check and the zero-knowledge proof pass. This application is set to implement zero-knowledge verification only for randomly selected rounds of training data based on a random multi-round selection set when the model converges. Compared with the existing technology, which performs zero-knowledge proof in each round of training, it reduces the amount of calculation and thus improves the training efficiency. At the same time, this application concentrates the aggregation process and zero-knowledge proof process in the training process on one server for execution, which is convenient for configuring a dedicated acceleration environment for the calculation process, and reduces the data interaction based on the blockchain in the on-chain aggregation and on-chain proof processes, thereby improving the training efficiency of the model. In summary, this method solves the problem in the existing technology that multi-server federated learning based on zero-knowledge proof leads to low model training efficiency and slow updates in order to ensure data security.

[0178] In order to complete the matching with the matching training server and introduce different participants, in an optional embodiment, the above-mentioned device further includes:

[0179] a third acquiring unit, configured to, after acquiring the training task from the task issuing server via the communication address, parse the training task to extract the initial model parameters of the current round to obtain the sixth target parameter;

[0180] a first computing unit, configured to perform a hash operation based on the sixth target parameter to obtain a first hash value, and perform an on-chain consistency check based on the first hash value and a second hash value stored in the consortium chain, where the second hash value is obtained by performing a hash operation on the initial model parameters of the current round by the task issuing server and uploading the result to the consortium chain;

[0181] A construction unit, configured to create a Merkle tree on the consortium chain using the first hash value as the root hash when the on-chain consistency check passes;

[0182] A first generation unit is configured to generate a public key, obtain a first public key, upload the first public key to the alliance chain, and determine a matching training server through a smart contract of the alliance chain;

[0183] The fourth acquisition unit is used to obtain the public key of the matching training server through the smart contract, obtain the second public key, and record the matching round in the alliance chain;

[0184] a fifth acquiring unit, configured to upload the local first matching factor to the alliance chain in response to a preset instruction, and receive the second matching factor from the matching training server;

[0185] The second generating unit is configured to generate a shared key according to the second public key.

[0186] In order to improve the efficiency of the polymerization process, in an optional embodiment, the above-mentioned polymerization unit includes:

[0187] An updating module, configured to update the Merkle tree according to the first target parameter;

[0188] A first generating module, configured to generate a target mask based on a first matching factor and a shared key;

[0189] A first processing module is configured to perform mask encryption on the first target parameter according to the target mask to obtain a first target instruction;

[0190] The first sending module is used to send the first target instruction to the task issuing server, wherein the first target instruction is used to instruct the task issuing server to aggregate the first target parameter with the model parameter of the matching training server and store the aggregation result on the chain.

[0191] In order to verify the correctness and compliance of the model training process, in an optional embodiment, the first verification unit includes:

[0192] a second generating module, configured to generate a plurality of target masks according to each first matching factor and the corresponding shared key, wherein the first matching factor corresponds one-to-one to the target round in the random round set;

[0193] A second processing module is used to mask and encrypt the corresponding second target parameters according to each target mask to obtain multiple second target instructions;

[0194] The second sending module is used to send the second target instruction to the task issuing server, wherein the second target instruction is used to instruct the task issuing server to perform an aggregation operation according to the second target parameter and perform consistency verification with the corresponding aggregation result on the alliance chain.

[0195] In order to verify the correctness and compliance of the model training process, in an optional embodiment, the second acquisition unit includes:

[0196] A third generation module is used to generate a data traceability certificate, a parameter iteration certificate, and a model training certificate based on the Merkle tree, the third target parameter, the fourth target parameter, and the fifth target parameter;

[0197] The third sending module is used to generate a third target instruction and send it to the task issuing server based on at least the data traceability proof, parameter iteration proof and model training proof. The third target instruction is used to instruct the task issuing server to perform consistency verification with the data stored on the chain based on the data traceability proof, parameter iteration proof and model training proof carried by the third target instruction.

[0198] In order to generate the above-mentioned data traceability proof, parameter iteration proof and model training proof, in an optional embodiment, the above-mentioned third generation module includes:

[0199] The first generation submodule is configured to use the third target parameter as a private input, the hash value corresponding to the third target parameter stored in the consortium chain as a public output, and the hash function as a circuit to generate a data traceability certificate;

[0200] The second generation submodule is used to generate a parameter iteration proof using the third target parameter as a private input, the hash value of the fourth target parameter stored in the consortium chain as a public input, the Merkle tree as a public output, and the hash function as a circuit;

[0201] The third generation submodule is used to generate a model training proof using the third target parameter as a private input, the fifth target parameter as a public input, the first target instruction as a public output, and the parameter iteration algorithm and mask encryption algorithm of the target model as a circuit.

[0202] In order to complete the zero-knowledge proof, in an optional implementation, the third sending module includes:

[0203] a fourth generating submodule, configured to generate a target mask based on the first matching factor and the shared key;

[0204] The processing submodule is used to mask and encrypt the data traceability proof, parameter iteration proof and model training proof according to the target mask to obtain a third target instruction.

[0205] The zero-knowledge proof-based federated learning device includes a processor and a memory. The first acquisition unit, aggregation unit, first verification unit, second acquisition unit, second verification unit, and determination unit are all stored as program units in the memory. The processor executes the program units stored in the memory to implement the corresponding functions. The above modules are all located in the same processor; alternatively, the above modules can be located in different processors in any combination.

[0206] The processor contains a kernel, which retrieves the corresponding program unit from the memory. You can set one or more kernels, and improve the efficiency of model training by adjusting the kernel parameters.

[0207] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0208] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program. When the program is run, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned federated learning method based on zero-knowledge proof.

[0209] An embodiment of the present invention provides a distributed business system, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, at least the steps of the above method are implemented.

[0210] The present application also provides a computer program product, which, when executed on a data processing device, is adapted to execute a program initialized with at least the steps of the above method.

[0211] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing device, can be centralized on a single computing device, or can be distributed across a network of multiple computing devices. They can be implemented using program code executable by the computing device, and thus, can be stored in a storage device and executed by the computing device. In some cases, the steps shown or described herein can be performed in a different order than that shown, or can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0212] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0213] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0214] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0215] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0216] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0217] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0218] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0219] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0220] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0221] The federated learning method based on zero-knowledge proof of the present application first performs an acquisition step, obtains a training task from a task issuing server through a communication address, updates the model parameters of the to-be-trained model through local private data according to the training task, and obtains a first target parameter; then, performs an aggregation step, aggregates the first target parameter with the model parameters obtained by updating the to-be-trained model based on the corresponding local private data by the matching training server through the task issuing server according to the first target parameter, and obtains an aggregated model to be trained; then, repeats the acquisition step and the aggregation step at least once in sequence until the aggregated model to be trained converges; then, receives the data sent by the task issuing server. A random round set is used. The first target parameter is filtered according to the random round set to obtain the second target parameter, and a consistency check is performed through the task publishing server based on the second target parameter. Then, the local private data is filtered according to the random round set to obtain the third target parameter. The local private data participating in the training except the third target parameter is determined as the fourth target parameter. The initial model parameters are filtered according to the random round set to obtain the fifth target parameter. Then, a zero-knowledge proof is performed through the task publishing server based on at least the third target parameter, the fourth target parameter, and the fifth target parameter. Finally, if both the consistency check and the zero-knowledge proof pass, the model to be trained is determined as the target model. This application is set to implement zero-knowledge verification only for randomly selected rounds of training data based on a random multi-round selection set when the model converges. Compared with the existing technology, which performs zero-knowledge proof in each round of training, it reduces the amount of calculation and thus improves the training efficiency. At the same time, this application concentrates the aggregation process and zero-knowledge proof process in the training process on one server for execution, which is convenient for configuring a dedicated acceleration environment for the calculation process, and reduces the data interaction based on the blockchain in the on-chain aggregation and on-chain proof processes, thereby improving the training efficiency of the model. In summary, this method solves the problem in the existing technology that multi-server federated learning based on zero-knowledge proof leads to low model training efficiency and slow updates in order to ensure data security.

[0222] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A federated learning method based on zero-knowledge proof, characterized in that: include: An acquisition step of acquiring a training task from a task publishing server via a communication address, and updating model parameters of the to-be-trained model using local private data according to the training task to obtain a first target parameter; an aggregation step of aggregating, through a task issuing server, the first target parameter and a model parameter obtained by a matching training server updating the to-be-trained model based on the corresponding local private data according to the first target parameter, to obtain the aggregated to-be-trained model; Repeat the obtaining step and the aggregating step at least once in sequence until the aggregated model to be trained converges; receiving a random round set issued by the task issuing server, screening a first target parameter according to the random round set to obtain a second target parameter, and performing a consistency check through the task issuing server according to the second target parameter; Filtering the local private data according to the random round set to obtain a third target parameter, determining the local private data participating in the training except the third target parameter as a fourth target parameter, and filtering the initial model parameters according to the random round set to obtain a fifth target parameter; Performing zero-knowledge proof by the task issuing server at least according to the third target parameter, the fourth target parameter, and the fifth target parameter; When both the consistency check and the zero-knowledge proof are passed, the model to be trained is determined as the target model.

2. The method according to claim 1, characterized in that After obtaining the training task from the task issuing server via the communication address, the method further includes: Parsing the training task to extract initial model parameters of the current round to obtain sixth target parameters; Performing a hash operation on the sixth target parameter to obtain a first hash value, performing an on-chain consistency check based on the first hash value and a second hash value stored in the consortium chain, where the second hash value is obtained by performing a hash operation on the initial model parameters of the current round by the task issuing server and uploading the result to the consortium chain; If the on-chain consistency check passes, a Merkle tree is created on the consortium chain using the first hash value as the root hash; Generate a public key to obtain a first public key, upload the first public key to the alliance chain, and determine the matching training server through the smart contract of the alliance chain; Obtaining the public key of the matching training server through the smart contract to obtain a second public key, and recording the matching round in the alliance chain; In response to a preset instruction, uploading a local first matching factor to the alliance chain and receiving a second matching factor from the matching training server; A shared key is generated according to the second public key.

3. The method according to claim 2, characterized in that Aggregating the first target parameter with the model parameter of the matching training server through the task issuing server according to the first target parameter includes: Updating the Merkle tree according to the first target parameter; generating a target mask based on the first matching factor and the shared key; Masking and encrypting the first target parameter according to the target mask to obtain a first target instruction; The first target instruction is sent to the task issuing server, wherein the first target instruction is used to instruct the task issuing server to aggregate the first target parameter with the model parameter of the matching training server and store the aggregation result on the chain.

4. The method according to claim 2, characterized in that Performing a consistency check through the task issuing server according to the second target parameter includes: generating a plurality of target masks according to each of the first matching factors and the corresponding shared key, wherein the first matching factors correspond one-to-one to the target rounds in the random round set; Masking and encrypting the corresponding second target parameters according to each target mask to obtain a plurality of second target instructions; The second target instruction is sent to the task issuing server, wherein the second target instruction is used to instruct the task issuing server to perform an aggregation operation according to the second target parameter and perform a consistency check with the corresponding aggregation result on the alliance chain.

5. The method according to claim 3, characterized in that Performing zero-knowledge proof by the task issuing server according to at least the third target parameter, the fourth target parameter, and the fifth target parameter, includes: Generate a data traceability certificate, a parameter iteration certificate, and a model training certificate according to the Merkle tree, the third target parameter, the fourth target parameter, and the fifth target parameter; A third target instruction is generated at least based on the data traceability proof, the parameter iteration proof and the model training proof and sent to the task issuing server. The third target instruction is used to instruct the task issuing server to perform consistency verification with the data stored on the chain based on the data traceability proof, the parameter iteration proof and the model training proof carried by the third target instruction.

6. The method according to claim 5, characterized in that Generating a data traceability certificate, a parameter iteration certificate, and a model training certificate according to the Merkle tree, the third target parameter, the fourth target parameter, and the fifth target parameter, including: The data traceability proof is generated using the third target parameter as a private input, the hash value corresponding to the third target parameter stored in the consortium chain as a public output, and the hash function as a circuit; Generate the parameter iteration proof using the third target parameter as a private input, the hash value of the fourth target parameter stored in the consortium chain as a public input, the Merkle tree as a public output, and the hash function as a circuit; The model training proof is generated using the third target parameter as the private input, the fifth target parameter as the public input, the first target instruction as the public output, and the parameter iteration algorithm and mask encryption algorithm of the target model as the circuit.

7. The method according to claim 5, characterized in that Generating a third target instruction based at least on the data traceability proof, the parameter iteration proof, and the model training proof includes: generating a target mask based on the first matching factor and the shared key; The data traceability proof, the parameter iteration proof and the model training proof are masked and encrypted according to the target mask to obtain the third target instruction.

8. A federated learning device based on zero-knowledge proof, characterized in that: The device comprises: A first acquisition unit is used for the acquisition step, obtaining a training task from a task issuing server via a communication address, and updating a model parameter of a to-be-trained model using local private data according to the training task to obtain a first target parameter; an aggregation unit, configured to perform an aggregation step, aggregating, through a task issuing server, the first target parameter and a model parameter obtained by updating the to-be-trained model based on the corresponding local private data by a matching training server according to the first target parameter, to obtain the aggregated to-be-trained model; A repeating unit, configured to sequentially repeat the obtaining step and the aggregating step at least once until the aggregated model to be trained converges; a first verification unit, configured to receive a random round set issued by the task issuing server, filter a first target parameter according to the random round set to obtain a second target parameter, and perform a consistency check through the task issuing server according to the second target parameter; a second acquisition unit, configured to filter the local private data according to the random round set to obtain a third target parameter, determine the local private data participating in the training other than the third target parameter as a fourth target parameter, and filter initial model parameters according to the random round set to obtain a fifth target parameter; a second verification unit, configured to perform zero-knowledge proof through the task issuing server according to at least the third target parameter, the fourth target parameter, and the fifth target parameter; A determination unit is used to determine the model to be trained as a target model if both the consistency check and the zero-knowledge proof are passed.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A distributed business system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for executing the method of any one of claims 1 to 7.

Images