Security aggregation method and system based on reputation model and lightweight mask reconstruction

Abstract

The application belongs to the technical field of artificial intelligence and data security, and relates to a security aggregation method and system based on a reputation model and light-weighted mask reconstruction, which comprises the following steps: 1) each client locally performs local model training, and after completing the local model training, uses a light-weighted mask mechanism to disturb and encrypt model parameters, and uploads the encrypted model parameters to an aggregation server; 2) the aggregation server disturbs the encrypted model parameters through a light-weighted redundant mask mechanism to obtain disturbed model parameters; 3) the reputation of each client is calculated based on model update effectiveness and model update stability by using a reputation model to obtain the comprehensive reputation value of each client; and 4) the disturbed model parameters are combined with the comprehensive reputation value of each client for weighted aggregation to generate global model parameters. The application can improve the security and robustness of model parameter aggregation in the federated learning process.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and data security technology, and relates to a secure aggregation method and system for federated learning, specifically a secure aggregation method and system for federated learning that combines reputation model and lightweight mask reconstruction. Background Technology

[0002] Federated Learning (FL) is a distributed machine learning framework. Its main idea is to allow multiple clients (such as mobile devices and edge nodes) to independently train local models (local models) without centralizing data, and then upload the model parameters or gradients to a central server for aggregation, thereby achieving collaborative training of the global model. This mechanism effectively protects data privacy and is widely used in finance, healthcare, education, and the Industrial Internet of Things (IIoT).

[0003] In typical federated learning frameworks, to prevent model parameter leakage and resist malicious actors from interfering with model training, existing technologies have proposed a variety of secure aggregation mechanisms, mainly including the following categories:

[0004] 1. A cryptographic aggregation method based on secure multi-party computation (SMC).

[0005] For example, the Secure Aggregation protocol proposed by Google achieves the effect of obtaining the sum of parameters even though the central end cannot decrypt individual client parameters by sharing keys and masking perturbations among clients.

[0006] 2. Privacy protection methods based on differential privacy (DP).

[0007] By adding random noise on the client or server side, privacy perturbations can be implemented in model updates, preventing attackers from reconstructing individual data through differential analysis.

[0008] 3. Encryption computation method based on homomorphic encryption (HE).

[0009] Additive homomorphic encryption algorithms can be used to directly perform additive aggregation of model parameters in the ciphertext space, completing the training process without decryption.

[0010] 4. Robust aggregation algorithm based on Byzantine fault tolerance.

[0011] Methods such as Krum, Trimmed Mean, and Median can maintain the correctness of model aggregation even in the presence of malicious or abnormal updates.

[0012] 5. End-side isolated execution method based on Trusted Execution Environment (TEE).

[0013] Hardware isolation technologies such as SGX are used to perform training tasks on the client side to prevent model leakage or tampering.

[0014] Although the aforementioned existing secure aggregation schemes have made some progress in federated learning, they still have the following specific technical problems and shortcomings:

[0015] (1) Insufficient ability to identify malicious nodes.

[0016] Most existing solutions assume that all clients are honest or have static fault tolerance mechanisms, lacking dynamic reputation modeling mechanisms. They cannot effectively identify clients that upload abnormal parameters, low-quality models, or potential attacks over a long period of time, making the aggregation results easily contaminated.

[0017] (2) The secure aggregation mechanism has high computational and communication overhead.

[0018] While methods such as SMC and homomorphic encryption offer high security, they require complex key exchanges between clients or computations in the ciphertext space, making them unsuitable for resource-constrained or large-scale device environments, especially difficult to deploy in edge computing or mobile devices.

[0019] (3) The masking mechanism is highly dependent on the node online rate and has poor robustness.

[0020] Google's Secure Aggregation relies on all clients to participate in mask reconstruction. If some nodes go offline or lose connection, mask reconstruction will fail or aggregation will be interrupted, which will seriously affect the availability and scalability of the system.

[0021] (4) Lack of effective lightweight safety solutions.

[0022] Most current security aggregation mechanisms have a clear trade-off between security and efficiency, and there is a lack of an adaptation solution that is both highly secure and lightweight. In particular, in practical application scenarios such as edge computing and educational terminals, deployment-friendly solutions are scarce.

[0023] (5) Risk warning and node behavior tracking cannot be achieved.

[0024] Existing technologies lack mechanisms for recording, analyzing, and assessing node behavior, making it impossible to penalize, demote, or remove nodes that frequently upload abnormal parameters. They also lack long-term evolution capabilities and are not conducive to the reliable evolution of the system.

[0025] Therefore, there is an urgent need for a secure aggregation technology that combines node reputation assessment mechanisms with lightweight mask reconstruction methods. This technology can ensure system security and robustness while also taking into account computational resource consumption, node fault tolerance, and dynamic risk control capabilities, thereby improving the applicability and scalability of federated learning systems in complex real-world environments. Summary of the Invention

[0026] To overcome the shortcomings of existing technologies, this invention proposes a secure aggregation method and system based on a reputation model and lightweight mask reconstruction. It establishes a dynamically updated node reputation evaluation mechanism, reasonably assessing the trustworthiness of clients based on factors such as model quality and behavioral stability. A reputation weighting mechanism is introduced during the aggregation process, increasing the contribution of high-reputation nodes to the global model while reducing the impact of low-reputation nodes, which may even be removed. A lightweight mask generation and reconstruction mechanism is proposed, ensuring parameter encryption while reducing reliance on synchronous online nodes, thus improving system robustness. This enables a secure, robust, and efficient model parameter aggregation process, resisting attacks such as malicious uploads and gradient pollution. Therefore, it constructs a federated learning security mechanism with dynamic adaptability, risk control, and high computational efficiency, suitable for various distributed intelligent application scenarios such as education, healthcare, finance, and industrial IoT.

[0027] To achieve the above objectives, the present invention provides the following technical solution:

[0028] A secure aggregation method based on reputation model and lightweight mask reconstruction, characterized by the following steps:

[0029] 1) Each client performs local model training locally and, after completing local model training, uses a lightweight masking mechanism to perturb and encrypt the model parameters, and then uploads the encrypted model parameters to the aggregation server;

[0030] 2) The aggregation server descrambles the encrypted model parameters using a lightweight redundancy masking mechanism to obtain the descrambled model parameters;

[0031] 3) Calculate the reputation of each client based on the effectiveness and stability of the model update using the reputation model to obtain the comprehensive reputation value of each client;

[0032] 4) Based on the descrambled model parameters, the global model parameters are generated by weighted aggregation of the comprehensive reputation values ​​of each client.

[0033] Preferably, step 1) involves using a lightweight masking mechanism to perturb and encrypt the model parameters, specifically including:

[0034] 11) For each client, generate a local master seed and a shared seed with other clients;

[0035] 12) For each layer of the client's local model, calculate the layer importance weight and determine the layer mask density based on the layer importance weight, and then generate the base mask for this layer based on the local master seed and the layer mask density.

[0036] 13) Divide the base mask of this layer into multiple parts to obtain multiple mask shares;

[0037] 14) For this client, retain one mask share, and encrypt other mask shares based on the shared seed to obtain encrypted mask shares, and send the encrypted mask shares to other clients.

[0038] 15) Each client performs perturbation encryption on the model parameters based on the mask share.

[0039] Preferably, in step 1), the encrypted model parameters are quantized and compressed before being uploaded to the aggregation server.

[0040] Preferably, the aggregation server in step 2) descrambles the encrypted model parameters using a lightweight redundancy masking mechanism, specifically including:

[0041] 21) Receive the mask shares from each client and check the number of mask shares, then reconstruct the base mask of this layer based on the received mask shares using Lagrange interpolation;

[0042] 22) Receive the perturbed encrypted model parameters from each client and descramble the encrypted model parameters based on the reconstructed base mask of this layer.

[0043] Preferably, in step 2), the aggregation server performs a strict verification process when receiving the perturbed encrypted model parameters uploaded by each client, and after descrambling the encrypted model parameters based on the reconstructed base mask of this layer, it performs inverse quantization on the descrambled model parameters.

[0044] Preferably, step 3) specifically comprises:

[0045] 31) Determine the model update validity score:

[0046] ,

[0047] in, Update the model effectiveness score for the i-th client in round t. This represents the update difference for the i-th client in round t. This represents the average update difference among all valid clients in round t. This represents the variance threshold of the update differences for all valid clients in round t.

[0048] 32) Determine the model update stability score:

[0049] ,

[0050] in, Update the qualitative score of the model for the i-th client in round t. And it is the history of the i-th client. The moving average of the round-updated differences. This is the stability threshold;

[0051] 33) Determine the client's overall reputation score:

[0052] ,

[0053] in, Let i be the overall reputation value of the i-th client in round t. For balancing parameters.

[0054] Preferably, step 4) specifically comprises:

[0055]

[0056] in, These are the global model parameters for round t+1. Let be the model parameters for the i-th client in the t-th round. Let be the aggregate weight of the i-th client in the t-th round, and , Let be the number of valid clients in round t.

[0057] Furthermore, this invention also provides a secure aggregation system based on reputation model and lightweight mask reconstruction, characterized in that it includes:

[0058] Multiple clients, each of which performs local model training locally and, after completing local model training, uses a lightweight masking mechanism to perturb and encrypt the model parameters, and then uploads the encrypted model parameters to the aggregation server;

[0059] An aggregation server includes a mask reconstruction and descrambling module, a reputation model, and a weighted aggregation module. The mask reconstruction and descrambling module descrambles the encrypted model parameters using a lightweight redundancy masking mechanism to obtain descrambled model parameters. The reputation model calculates the reputation of each client based on the model update effectiveness and stability to obtain a comprehensive reputation value for each client. The weighted aggregation module performs weighted aggregation based on the descrambled model parameters and the reputation values ​​of each client to generate global model parameters.

[0060] Furthermore, the present invention also relates to a device for secure aggregation based on reputation model and lightweight mask reconstruction, characterized in that it comprises:

[0061] One or more processors;

[0062] Memory, used to store one or more programs;

[0063] When the one or more programs are executed by the one or more processors, the one or more processors implement the secure aggregation method based on reputation model and lightweight mask reconstruction as described above.

[0064] Finally, the present invention also provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the program is executed by a processor, it implements the steps of the method for secure aggregation based on reputation model and lightweight mask reconstruction as described above.

[0065] Compared with existing technologies, the secure aggregation method and system based on reputation model and lightweight mask reconstruction of the present invention have one or more of the following beneficial technical effects:

[0066] 1. This invention introduces a node reputation mechanism to dynamically identify and defend against malicious upload behavior.

[0067] Compared with traditional aggregation methods that assume all clients are honest nodes, this invention constructs a dynamically updated node reputation evaluation mechanism. It can adjust the credibility of clients based on factors such as uploaded model deviation and historical behavior, effectively reducing the impact of malicious or abnormal nodes on the global model and improving the security and stability of aggregation results.

[0068] 2. This invention employs a lightweight mask reconstruction mechanism to reduce communication and computational overhead.

[0069] Compared to the traditional Secure Aggregation method, which relies on all participants being online and has complex communication requirements, the lightweight masking mechanism proposed in this invention supports the operation of some nodes even when they are offline and does not require two-way key exchange. This significantly reduces the system's communication burden and computational complexity, making it suitable for resource-constrained environments such as edge devices and mobile terminals.

[0070] 3. This invention supports client-side fault tolerance, improving system availability.

[0071] The mask reconstruction mechanism proposed in this invention supports the absence of some client nodes without affecting the aggregation task. The system operation does not depend on all clients being online, thus improving the robustness and scalability in actual deployment.

[0072] 4. This invention maintains high security while also taking into account deployment efficiency.

[0073] Unlike homomorphic encryption and other methods that offer strong security but come with high computational costs, this invention achieves a balance between security and practicality through lightweight perturbation masking and reputation control. Without sacrificing the strength of privacy protection, it significantly improves system operating efficiency and industrial application capabilities.

[0074] 5. This invention has strong scalability and is adaptable to various federated learning scenarios.

[0075] This invention supports deployment in various federated learning architectures, including horizontal, vertical, and transfer learning, and is compatible with optimization algorithms such as FedAvg, FedProx, and FedNova. It has good versatility and cross-scenario adaptability, making it easy to promote and apply in multiple data-sensitive fields such as education, healthcare, finance, and industry. Attached Figure Description

[0076] Figure 1 This is a flowchart of the secure aggregation method based on reputation model and lightweight mask reconstruction of the present invention.

[0077] Figure 2 This is a schematic diagram of the security aggregation system based on reputation model and lightweight mask reconstruction of the present invention. Detailed Implementation

[0078] Before detailing any embodiment of the invention, it should be understood that the invention, in its application, is not limited to the details of the construction and arrangement of the components set forth in the following description or illustrated in the following figures. The invention can have other embodiments and can be practiced or carried out in various ways. Furthermore, it should be understood that the wording and terminology used herein are for descriptive purposes and should not be considered limiting. The use of “comprising” or “having” and variations thereof is intended to cover the items set forth below and their equivalents, as well as any additional items. Unless otherwise specified or limited, the terms “installation,” “connection,” “support,” and “linkage,” and variations thereof are used broadly and cover both direct and indirect installation, connection, support, and linking. Moreover, “connection” and “linkage” are not limited to physical or mechanical connections or links.

[0079] Furthermore, firstly, in the disclosure of this invention, the terms "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the above terms should not be construed as limiting this invention. Secondly, the term "a" should be understood as "at least one" or "one or more," that is, in one embodiment, the number of an element can be one, while in another embodiment, the number of the element can be multiple. The term "a" should not be construed as a limitation on the quantity.

[0080] The purpose of this invention is to address several problems existing in the current federated learning secure aggregation mechanism, particularly: the inability to dynamically identify unreliable or malicious participating nodes; the mask reconstruction mechanism's over-reliance on client online rates, resulting in poor robustness; the high computational and communication overhead of the security mechanism, making it difficult to apply in edge devices or large-scale deployments; the lack of effective measures to address the risk of model contamination; and the lack of the ability to evaluate and provide feedback on the long-term behavior of participating nodes. Therefore, this invention proposes a secure aggregation method and system for federated learning based on a reputation model and lightweight mask reconstruction. The aim is to: establish a dynamically updated node reputation evaluation mechanism to reasonably assess the trustworthiness of clients based on factors such as model quality and behavioral stability; introduce a reputation weighting mechanism during the aggregation process to increase the contribution of high-reputation nodes to the global model while reducing the impact of low-reputation nodes, or even eliminating them; propose a lightweight mask generation and reconstruction mechanism to reduce reliance on synchronous online nodes while ensuring parameter encryption, thus improving system robustness; achieve a secure, robust, and efficient model parameter aggregation process to resist attacks such as malicious uploads and gradient pollution; and construct a secure federated learning mechanism with dynamic adaptability, risk control, and high computational efficiency, suitable for various distributed intelligent application scenarios such as education, healthcare, finance, and industrial IoT.

[0081] By achieving the above objectives, this invention can significantly improve the stability, security, and scalability of federated learning systems while ensuring data privacy.

[0082] Figure 1 A flowchart of the secure aggregation method based on reputation model and lightweight mask reconstruction of the present invention is shown. Figure 1 As shown, the secure aggregation method based on reputation model and lightweight mask reconstruction of the present invention includes the following main steps:

[0083] I. Local model training on the client side and lightweight mask perturbation encryption.

[0084] After each participating client completes local model training, it uses a lightweight masking mechanism to perturb and encrypt the model parameters, and then uploads the encrypted model parameters to the aggregation server. This process specifically includes:

[0085] 1. Local model training on the client side.

[0086] Each client Upon receiving the global model parameters from the aggregation server Then, based on the local private dataset Perform training on the local model. The training process is as follows:

[0087] (1) Initialize local model parameters: ;

[0088] (2) Set the number of local training rounds: (Usually 5-10 rounds);

[0089] (3) Use stochastic gradient descent (SGD) or its variants for optimization;

[0090] (4) The learning rate adopts an adaptive adjustment strategy.

[0091] Obtain updated local model parameters after training is complete. Difference between model update and .

[0092] 2. Use a lightweight masking mechanism to perturb and encrypt the model parameters.

[0093] This invention proposes a lightweight mask generation algorithm based on secret sharing. The core idea is to distribute the mask generation task to multiple clients, with each client generating and holding only a part of the mask. This achieves the following: a single client cannot know the complete mask, it supports fault tolerance for partial client disconnection, and it reduces the computational burden on a single client.

[0094] In this invention, the lightweight mask generation algorithm based on secret sharing is a Distributed Lightweight Mask Generation (DLMG) algorithm, whose inputs include: client identifier. Current round Total number of clients Fault tolerance parameters (Maximum tolerance) (Client disconnection), local model structure (Total) (layer); its output includes: the base mask of this layer. Mask share set .

[0095] In this invention, the perturbation and encryption of model parameters using a lightweight masking mechanism specifically includes:

[0096] (1) Initialize seed generation.

[0097] For the client Generate local master seed :

[0098] .

[0099] in, This is a key derivation function based on HMAC (Hash-based Message Authentication Code). The global salt is a random value shared by all participating clients to enhance the security of cryptographic operations.

[0100] In addition to the client In addition, for other clients Generate a shared seed. This includes seeding for users other than the client. Each client outside Their shared seed :

[0101] ,

[0102] in, For the client private key, For the client ECDH is a key exchange algorithm that uses the public key of a key exchange.

[0103] (2) Layered mask generation.

[0104] For the client Each layer of the local model Perform the following operations:

[0105] ①Calculate the importance weight of the calculation layer .

[0106] .

[0107] in, Represents the gradient norm. Assuming the first The layer is a 3×3 weight matrix. ,but The corresponding gradient matrix for: ,but . The gradient reflects the degree of influence of the layer on the loss function. The larger the gradient, the more important the parameters of the layer are for model training and the better they need to be protected. The smaller the gradient, the closer it may be to convergence and sparse masks can be used.

[0108] .in, , For the first The number of parameters in the layer Let be the weight matrix for the i-th parameter. The variance measures the dispersion of parameter values ​​in this layer. A large variance indicates that the parameters are significantly different and contain rich information, while a small variance indicates that the parameters are relatively uniform and contain less information.

[0109] The layer depth weights were calculated, with the weights closer to the output layer being greater ( The larger the value, the higher the weight, reflecting the principle of "the deeper the layer, the more important it is" in deep learning.

[0110] For the weighting coefficients, satisfying , Common configuration 1 (balanced): α = 0.33, β = 0.33, γ = 0.34; Common configuration 2 (gradient priority): α = 0.5, β = 0.3, γ = 0.2; Common configuration 3 (structure priority): α = 0.2, β = 0.3, γ = 0.5.

[0111] ② Determine the mask density .

[0112] if ,but (Dense mask); if ,but (Medium mask); otherwise, (Sparse mask).

[0113] ③ Generate the base layer mask .

[0114] ,

[0115] .

[0116] in, A pseudo-random function is a cryptographic function that takes a seed and data as input and outputs a seemingly random but actually deterministic value. Common implementations include HMAC-SHA256, AES-CTR, and ChaCha20.

[0117] Indicates client The The mask matrix of the layer, For the client The The parameter scale of the layer.

[0118] This is a core function for generating sparse mask matrices, used to cryptographically perturb model parameters in federated learning. For Its input parameters For the first Random seed for the layer (to ensure the generated mask is reproducible); For the first The parameter scale of the layer is also the first The dimension of the layer's mask matrix (e.g., (784, 128) represents a 784×128 matrix); For the first Layer mask density (between 0 and 1, representing the proportion of non-zero elements); output It is a sparse mask matrix containing randomly distributed non-zero values.

[0119] Furthermore, it can be based on Determine the mask matrix Sparsity:

[0120] Dense mask ( >0.7): Directly generate random values ​​for a full matrix.

[0121] Random sparsity (0.3 < ≤ 0.7): Randomly select positions to fill with non-zero values.

[0122] Structured sparsity ( ≤ 0.3): Distributed by block, the entire block is set to zero or non-zero.

[0123] (3) Mask share distribution.

[0124] mask Decomposed into For each share, the V must satisfy... Threshold scheme, i.e., greater than or equal to less than or equal to Specifically, it includes:

[0125] a) Construction degree is random polynomials:

[0126] .

[0127] in, These are random coefficients.

[0128] b) Calculation Mask share:

[0129] .

[0130] c) Generate share verification information:

[0131] .

[0132] (4) Share encryption.

[0133] First, for each mask share Encryption is performed. Specifically, for Encrypted mask share , For the client, it is an AES encryption function; Reserve a share of the mask. The remaining encrypted mask shares Send to the corresponding client .

[0134] Then, the model parameters are perturbed and encrypted.

[0135] After obtaining the mask share, the local model parameters on the client are perturbed and encrypted using the mask share to obtain the perturbed and encrypted model parameters: or , For the client The perturbation-encrypted model parameters For the client The perturbation-encrypted model parameters.

[0136] To reduce communication overhead, the perturbation-encrypted model parameters are compressed. This invention employs quantization compression, the basic idea of ​​which is to compress floating-point numbers originally represented by 32 or 16 bits to fewer bits (such as 8 bits, 4 bits, or even 2 bits), thereby reducing the data volume. The specific implementation steps are as follows:

[0137] a) Determine the quantification range,

[0138] .

[0139] b) Determining the quantization bit depth: If Then the number of quantization bits ;if Then the number of quantization bits Otherwise, the number of quantization bits is... , among which, Maximum quantization threshold This is the minimum quantization threshold.

[0140] c) Perform quantification operations.

[0141] An example quantization operation is as follows:

[0142] Original encryption model parameters (32-bit floating-point number);

[0143] Quantization parameters: , , ;

[0144] The quantification steps are as follows:

[0145] First, normalization:

[0146] ;

[0147] Next, we will quantify the results: (8-digit integer);

[0148] Finally, the data is stored: 208 bits and quantization parameters (min=-5.0, max=5.0, bits=8) are sent.

[0149] 3. Upload encrypted model parameters.

[0150] After perturbing, encrypting, and compressing the model parameters, the client needs to upload the encrypted model parameters to the aggregation server. First, the client packages the encrypted model parameters into a standard format. The uploaded data packet includes the following: client identifier. The data packet contains the following: a training round number t, used by the aggregation server to identify participants; model parameters encrypted and compressed after perturbation, which are the core content of the data packet; compression information, including metadata such as the compression method used and the number of quantization bits, to facilitate correct decompression by the server; share commitment information, containing the hash values ​​of all mask shares and the reconstruction threshold, used for subsequent mask recovery; and finally, an appended digital signature, which uses the client's private key to sign the hash value of the entire data packet, ensuring data integrity and non-repudiation.

[0151] II. Mask Reconstruction and Model Descrambling

[0152] The aggregation server uses a lightweight redundant masking mechanism to descramble the encryption model parameters, supporting mask recovery in the event of some client disconnections, thus improving fault tolerance.

[0153] In this invention, the mask reconstruction and model descrambling specifically include:

[0154] 1. Data collection and verification.

[0155] The aggregation server collects encrypted model parameters uploaded by each client within a specified time window and performs a strict verification process. The steps of this verification process are as follows:

[0156] (1) For each received data packet, first verify the digital signature to ensure the source is trustworthy.

[0157] (2) Check whether the round number is consistent with the current aggregation round t.

[0158] (3) Verify data integrity by comparing hash values.

[0159] (4) Check the correctness of the data format and compression information.

[0160] (5) Count the number of valid clients. If the minimum threshold Nf is reached, continue; otherwise, wait or terminate this round.

[0161] 2. Mask reconstruction.

[0162] For each client participating in the aggregation The server needs to rebuild the underlying mask it uses at this layer. .

[0163] The inputs for the mask reconstruction include:

[0164] (1) Target client identifier: , (Clients that need to rebuild their masks);

[0165] (2) Data set uploaded by the client: V is the set of valid clients verified, where each include:

[0166] Client The set of mask shares: (The mask share of other clients held by client j);

[0167] Share Commitment: (The share hash of each client's own mask share).

[0168] (3) Server key information: the key required to decrypt data from each client.

[0169] The output of the mask reconstruction is the reconstructed mask. Or, a failure to rebuild is indicated by the symbol ⊥.

[0170] The mask reconstruction steps are as follows:

[0171] (1) Collect client data The mask shares include:

[0172] ① Initialize the mask share set: ;

[0173] ② Extract client data from the upload data of each client The share, specifically:

[0174] for each , :

[0175] a. From Obtain the encrypted mask share ;

[0176] b. Decryption mask share:

[0177] ;

[0178] c. From Share Acquisition Commitment ;

[0179] d. Verify share:

[0180] if then

[0181] .

[0182] (2) Check the number of mask shares to verify whether there are enough mask shares, specifically:

[0183] if then

[0184] return ⊥ / / Insufficient shares, unable to rebuild;

[0185] if then

[0186] return .

[0187] (3) Lagrange interpolation reconstruction, specifically:

[0188] ①Choose Interpolation is performed on each mask share, specifically as follows:

[0189] Let

[0190] Select first shares: ;

[0191] ② Reconstruct the original polynomial using polynomial interpolation. value at :

[0192] ,in, .

[0193] For example, client 1 performs masked encryption as follows:

[0194] First, construct a quadratic polynomial: ;

[0195] Next, calculate the mask share: .

[0196] The aggregation server then reconstructs the mask as follows:

[0197] First, collect the mask shares: (3 points in total).

[0198] Then, polynomial interpolation is performed using these three points.

[0199] Then, the reconstructed polynomial must be equal to the original quadratic polynomial. .

[0200] Finally, calculate .

[0201] 3. Decryption and inverse quantization of encrypted model parameters.

[0202] After successfully reconstructing the mask, the aggregation server can decrypt the model parameters for each client: or The client performs quantization compression before uploading, and the aggregation server needs to perform dequantization based on the quantization metadata. Dequantization mainly includes three steps: calculating the quantization step size, restoring the normalized value, and restoring the original range.

[0203] The following example illustrates how to perform inverse quantization.

[0204] If receiving data Given min=-5.0, max=5.0, and bits=8, the specific dequantization process is as follows:

[0205] (1) Calculate the quantization step size: ;

[0206] (2) Restore the normalized value: .

[0207] (3) Restore the original range: .

[0208] Result: 3.157 (loss of precision: 3.14159265 → 3.157).

[0209] III. Calculate the overall credit score.

[0210] A reputation model is built for each client to maintain a dynamically updated reputation value. The reputation of each client is calculated based on dimensions such as model bias and behavioral stability. The reputation model aims to improve the quality of global model updates by identifying high-quality client contributions and suppressing low-quality or malicious updates, thus ensuring the convergence and robustness of federated learning.

[0211] Among them, the client In the round The reputation score is defined as The construction of a reputation model considers the following factors:

[0212] 1. Model update effectiveness measure, i.e., model update effectiveness score. :

[0213] ,

[0214] in, Update the model effectiveness score for the i-th client in round t. This represents the update difference for the i-th client in round t. This represents the average update difference among all valid clients in round t. This represents the variance threshold of the update difference for all valid clients in round t.

[0215] This indicator takes into account both the consistency of the update direction and the reasonableness of the update magnitude.

[0216] 2. Model update stability, i.e., model update stability score. :

[0217] ,

[0218] in, Update the qualitative score of the model for the i-th client in round t. And it is the history of the i-th client. The moving average of the round-updated differences. This is the stability threshold.

[0219] Finally, the client's overall reputation score is determined. :

[0220] ,

[0221] in, Let i be the overall reputation value of the i-th client in round t. The balancing parameters can be set as needed.

[0222] IV. Reputation-Weighted Security Aggregation:

[0223] Based on the descrambled model parameters, the aggregation server performs weighted aggregation by combining the comprehensive reputation values ​​of each client to generate global model parameters, reducing the impact of low-reputation or abnormal clients. Specifically:

[0224] ,

[0225] in, These are the global model parameters for round t+1. Let be the model parameters for the i-th client in the t-th round. Let be the aggregate weight of the i-th client in the t-th round, and , Let be the number of valid clients in round t.

[0226] This invention can effectively improve the security, aggregation quality and system robustness in federated learning, and is suitable for real distributed environments with limited resources, asynchronous nodes and attack threats.

[0227] Figure 2 A schematic diagram of the secure aggregation system based on reputation model and lightweight mask reconstruction of the present invention is shown. Figure 2 As shown, the security aggregation system based on reputation model and lightweight mask reconstruction of the present invention includes:

[0228] 1. Multiple clients.

[0229] Each client performs local model training locally and, after completing local model training, uses a lightweight masking mechanism to perturb and encrypt the model parameters, and then uploads the encrypted model parameters to the aggregation server.

[0230] II. Aggregation Server.

[0231] The aggregation server includes a mask reconstruction and descrambling module, a reputation model, and a weighted aggregation module. The mask reconstruction and descrambling module descrambles the encrypted model parameters using a lightweight redundancy masking mechanism to obtain descrambled model parameters. The reputation model calculates the reputation of each client based on model update effectiveness and stability to obtain a comprehensive reputation value for each client. The weighted aggregation module performs weighted aggregation based on the descrambled model parameters and the reputation values ​​of each client to generate global model parameters.

[0232] Furthermore, the present invention also relates to an apparatus for secure aggregation based on reputation model and lightweight mask reconstruction, comprising: one or more processors; a memory for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the secure aggregation method based on reputation model and lightweight mask reconstruction as described above.

[0233] Finally, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for secure aggregation based on reputation model and lightweight mask reconstruction as described above.

[0234] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit the scope of protection of the present invention. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention based on the concept of the present invention, without departing from the essence and scope of the technical solutions of the present invention.

Claims

1. A secure aggregation method based on a reputation model and lightweight masking reconstruction, characterized in that, The method comprises the following steps: 1) Each client locally performs local model training, and after completing the local model training, uses a lightweight masking mechanism to perturb and encrypt the model parameters, and uploads the encrypted model parameters to an aggregation server; The perturbation and encryption of the model parameters using the lightweight masking mechanism specifically comprises: 11) generating a local master seed and a shared seed with each of the other clients for each client; 12) for each layer of the local model of the client, calculating a layer importance weight and determining a layer mask density based on the layer importance weight, and then generating a layer basis mask based on the local master seed and the layer mask density; 13) dividing the layer basis mask into multiple parts to obtain multiple mask shares; 14) for the client, retaining one mask share, and encrypting the other mask shares based on the shared seed to obtain encrypted mask shares and sending the encrypted mask shares to the other clients; 15) each client perturbs and encrypts the model parameters based on the mask shares; 2) The aggregation server decrypts the encrypted model parameters by a lightweight redundant masking mechanism to obtain decrypted model parameters; the aggregation server decrypts the encrypted model parameters by the lightweight redundant masking mechanism specifically comprises: 21) receiving the mask shares of each client and verifying the number of mask shares, and then reconstructing the layer basis mask by Lagrange interpolation based on the received mask shares; 22) receiving the perturbed and encrypted model parameters of each client and decrypting the encrypted model parameters based on the reconstructed layer basis mask; 3) Using a reputation model to calculate the reputation of each client based on model update effectiveness and model update stability to obtain a comprehensive reputation value of each client; 4) On the basis of the decrypted model parameters, combining the comprehensive reputation values of the clients to perform weighted aggregation to generate global model parameters.

2. The secure aggregation method based on reputation model and light-weighted mask reconstruction according to claim 1, characterized in that, In step 1), the encrypted model parameters are quantized and compressed before being uploaded to the aggregation server.

3. The secure aggregation method based on reputation model and light-weighted mask reconstruction according to claim 2, characterized in that, In step 2), the aggregation server performs a verification process when receiving the perturbed and encrypted model parameters uploaded by each client, and performs dequantization on the decrypted model parameters after decrypting the encrypted model parameters based on the reconstructed layer basis mask.

4. The security aggregation method based on the reputation model and the lightweight mask reconstruction of claim 1, wherein, Step 3) specifically comprises: 31) determining a model update effectiveness score: ， wherein, is the model update effectiveness score of the i-th client at the t-th round, denotes the update difference of the i-th client at the t-th round, denotes the average update difference of all active clients at the t-th round, denotes the variance threshold of the update difference of all active clients at the t-th round; 32) determining a model update stability score: ， wherein, is the model update qualitative score for the i-th client at the t-th round, and is the history of the i-th client is the moving average of the update difference values for the i-th client at the t-th round, is a stability threshold value; 33) determining a comprehensive reputation value of the client: ， wherein, is the overall reputation value of the i-th client at the t-th round, is a balancing parameter.

5. The security aggregation method based on the reputation model and the lightweight mask reconstruction according to claim 4, characterized in that, Step 4) specifically comprises: ， wherein, is the global model parameter for the t+1th round, is the model parameter for the tth round for the ith client, is the aggregation weight for the tth round for the ith client and , is the number of active clients for the tth round.

6. A secure aggregation system based on a reputation model and lightweight mask reconstruction, characterized in that, Comprise: A plurality of clients, each of which locally performs local model training and, after completing the local model training, uses a lightweight masking mechanism to perturb and encrypt the model parameters, and uploads the encrypted model parameters to an aggregation server; The perturbation encryption of the model parameters using the lightweight mask mechanism specifically includes: 11) generating a local master seed and shared seeds with other clients respectively for each client; 12) calculating layer importance weights and determining layer mask densities based on the layer importance weights for each layer of the local model of the client, and then generating a layer basis mask based on the local master seed and the layer mask densities; 13) dividing the layer basis mask into multiple parts to obtain multiple mask shares; 14) for the client, retaining one mask share, and encrypting the other mask shares based on the shared seeds to obtain encrypted mask shares and sending the encrypted mask shares to other clients; 15) each client perturbs and encrypts the model parameters based on the mask shares. The aggregation server includes a mask reconstruction and de-perturbation module, a reputation model, and a weighted aggregation module. The mask reconstruction and de-perturbation module is used to de-perturb the encrypted model parameters through a lightweight redundant mask mechanism to obtain de-perturbed model parameters. The reputation model is used to calculate the reputation of each client based on model update effectiveness and model update stability to obtain comprehensive reputation values of each client. The weighted aggregation module is used to perform weighted aggregation based on the de-perturbed model parameters and the reputation values of each client to generate global model parameters. The aggregation server de-perturbs the encrypted model parameters through a lightweight redundant mask mechanism specifically includes: 21) receiving mask shares of each client and verifying the number of mask shares, and then reconstructing a layer basis mask through Lagrange interpolation based on the received mask shares; 22) receiving perturbed and encrypted model parameters of each client and de-perturbing the encrypted model parameters based on the reconstructed layer basis mask.

7. A device for secure aggregation based on reputation model and lightweight mask reconstruction, characterized in that, Comprise: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method for secure aggregation based on a reputation model and lightweight mask reconstruction as claimed in any one of claims 1-5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps of the method for secure aggregation based on a reputation model and lightweight mask reconstruction as claimed in any one of claims 1-5. The program is executed by the processor to implement the steps of the method for secure aggregation based on a reputation model and lightweight mask reconstruction as claimed in any one of claims 1-5.

Images