A privacy protection method for a heterogeneous federated learning environment

Abstract

The application discloses a privacy protection method for a heterogeneous federated learning environment and belongs to the technical field of data labeling. The method comprises the following steps: a client uploads an encrypted gradient according to the requirements of a server; the server performs privacy protection clustering on the client based on the cosine distance of the encrypted gradient according to a preset training round, and optimizes the clustering result by using homomorphic encryption and secret sharing in the clustering process; according to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on the initial model held by each client to obtain a global model share; after the clustering is completed, the server sends the global model share to each client participating in the aggregation, and the client reconstructs and updates the initial model locally; and the updated model is used to realize privacy protection in the heterogeneous federated learning environment. The application provides an efficient and safe solution for privacy protection in federated learning.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data labeling, and particularly relates to a privacy protection method for a heterogeneous federated learning environment. BACKGROUND

[0002] Privacy leakage is a key challenge faced by federated learning. Although federated learning protects client data privacy by sharing model gradients rather than raw data, existing research has shown that attackers can infer relevant information about private data from transmitted gradients, which poses new challenges to the security of federated learning.

[0003] In addition, when introducing clustering operations to deal with data heterogeneity problems, the initial clustering data uploaded by each client and the intermediate algorithm output, such as the centroid data in k-means clustering, are vulnerable to reasoning attacks by malicious adversaries, further increasing the privacy risk. It is not simple to design a privacy-preserving clustering scheme, because in addition to encrypting the uploaded client private data, any intermediate results of the clustering process need to be protected from reasoning attacks by enemies. At the same time, in order to ensure the feasibility of the scheme, the client's computing operations cannot be too cumbersome.

[0004] In addition to the privacy leakage problem, federated learning also faces the negative impact of client heterogeneity on model performance and training efficiency. The local data sets of the participants in federated learning are usually non-identically distributed (Non-IID), i.e., there is data heterogeneity. In federated learning with a large number of client participation, in order to reduce the computational and communication overhead, only a part of the clients will be selected to participate in the model aggregation process in each iteration. However, this method does not fully utilize global information because only partial client iteration results are collected, which may cause the global model to converge to a local optimum rather than a global optimum in a heterogeneous federated learning environment, thereby reducing the accuracy of the global model.

[0005] In order to solve the above problems in the prior art, it is urgent to propose a privacy protection method for a heterogeneous federated learning environment. SUMMARY

[0006] To solve the above technical problems, the application provides a privacy protection method for a heterogeneous federated learning environment, which ensures client data privacy through encryption technology and optimizes clustering and aggregation processes to improve model performance and training efficiency.

[0007] The application provides a privacy protection method for a heterogeneous federated learning environment, which includes the following steps:

[0008] The client uploads encrypted gradients according to the requirements of the server;

[0009] The server performs privacy protection clustering on the clients according to the cosine distance of the encrypted gradient based on a preset training round, and homomorphic encryption and secret sharing are used to optimize the clustering result in the clustering process.

[0010] According to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on each client holding the initial model to obtain a global model share.

[0011] After the clustering is completed, the server sends the global model share to each client participating in the aggregation, and the client locally reconstructs and updates the initial model.

[0012] Based on the updated model, the privacy protection of the heterogeneous federated learning environment is realized.

[0013] Optionally, the process of performing privacy protection clustering on the clients according to the cosine distance of the encrypted gradient based on a preset training round in the clustering process includes:

[0014] The homomorphic encryption based on semantic security performs clustering calculation to generate a public key and a private key; based on the generated public key and private key, the client generates a secret share and sends it to the corresponding server, the server sets the gradient matrix share and calculates the related parameters, and cooperates to obtain the secret share of the non-overlapping cluster index matrix, and reconstructs the clustering result.

[0015] Optionally, the process of performing privacy protection clustering on the clients according to the cosine distance of the encrypted gradient based on a preset training round in the clustering process includes:

[0016] Based on the clustering result, the server calculates homomorphic ciphertext using homomorphic encryption and sends it, performs random arrangement and reordering, and obtains the permuted homomorphic ciphertext; based on the permuted homomorphic ciphertext and the secret share, a random value is selected for calculation, and the related result is decrypted.

[0017] Optionally, the process of performing privacy protection clustering on the clients according to the cosine distance of the encrypted gradient based on a preset training round in the clustering process includes:

[0018] Based on the decryption result, the server sets parameters and performs a round of circulation, performs calculation and reconstruction, and decrypts to obtain a further result; based on the further result, the parameters are set, the permuted homomorphic ciphertext is restored, a new random sequence is generated and encrypted, and the secret share of the index vector is calculated; based on the secret share of the index vector, the server constructs the index matrix share, cooperates to calculate the matrix multiplication, and updates the secret share of the cluster center; the above steps are repeated until a preset iteration round is reached, and the clustering result is optimized.

[0019] Optionally, the clustering calculation is performed based on semantic security homomorphic encryption, and the generating of the public key and the private key further comprises the following steps of:

[0020] Based on the matrix multiplication requirement under secret sharing, a multiplication triple matrix is obtained; based on the multiplication triple matrix, a target matrix share is calculated locally, and based on the target matrix share, two servers reconstruct the matrix and complete the matrix multiplication; a preset comparison mechanism outputs a secret share, and a division protocol is used for blind processing, simplifying the division between the secret shares to local division operation to obtain a division result, and finally the server has a secret share of the cluster center.

[0021] Optionally, according to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on the initial model held by each client to obtain a global model share, and the process comprises the following steps of:

[0022] In the intra-cluster aggregation, each client sends a gradient share to the corresponding server, and for each cluster, each server collects the gradient share of the fastest client and locally calculates the global gradient share of the cluster.

[0023] Optionally, according to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on the initial model held by each client to obtain a global model share, and the process further comprises the following steps of:

[0024] In the inter-cluster aggregation, each server locally calculates inter-cluster aggregation to update the global model of the last training round to obtain the global model share of this round.

[0025] The application further provides a computer device comprising a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method.

[0026] The application further provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the method.

[0027] The application further provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the steps of the method.

[0028] Compared with the prior art, the application has the following advantages and technical effects:

[0029] The application realizes privacy protection clustering of client data in a federated learning environment by adopting homomorphic encryption and secret sharing technology. In the clustering process, the gradient data of the client always remains in an encrypted state and is transmitted and calculated in the form of ciphertext only, effectively preventing the leakage of privacy information. At the same time, through the secret sharing technology, the key data is divided into multiple shares and stored in different servers, further enhancing the security of the data. Even in the face of malicious attacks, it is difficult for attackers to infer the original data of the client from the encrypted gradient data and the dispersed shares. In addition, the application also optimizes the algorithm design, such as quickly generating multiplication triples and efficient division protocols, to ensure that the clustering process is computationally efficient and accurate while protecting privacy, providing an efficient and secure solution for privacy protection in federated learning. BRIEF DESCRIPTION OF DRAWINGS

[0030] The accompanying drawings, which form a part of this application, are intended to provide further understanding of the application and are incorporated herein in their entirety. The schematic embodiments of the application and their descriptions are used to explain the application and do not constitute an improper limitation on the application. In the drawings:

[0031] Figure 1 The method flowchart of the embodiments of the application. DETAILED DESCRIPTION

[0032] It should be noted that the embodiments and features in the embodiments of the application can be combined with each other without conflict. The application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0033] It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order than that shown.

[0034] Embodiment one

[0035] The present embodiment provides a privacy protection method for a heterogeneous federated learning environment, comprising the following steps:

[0036] The client uploads the encrypted gradient according to the requirements of the server;

[0037] The server performs privacy protection clustering on the client based on the cosine distance of the encrypted gradient according to the preset training round, and optimizes the clustering result by using homomorphic encryption and secret sharing in the clustering process;

[0038] According to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on the initial model held by each client to obtain a global model share;

[0039] After clustering is completed, the server sends the global model share to each client participating in aggregation respectively, and the client reconstructs and updates the initial model locally;

[0040] Privacy protection of the heterogeneous federated learning environment is realized based on the updated model.

[0041] The method can be implemented as shown in the figure, which includes two servers Figure 1 and multiple clients, each client having Non-IID data distribution and different local training time. In order to realize efficient and privacy-protected federated learning in such a heterogeneous environment, the embodiment combines clustering and phased aggregation with homomorphic encryption, secret sharing and other cryptographic primitives.

[0042] Specifically, the client uploads encrypted gradients according to the requirements of the server, and then the server performs privacy-protected clustering on the clients according to the cosine distance of the encrypted gradients every certain training round, which does not expose the gradient data of the clients. Then the server first performs asynchronous intra-cluster aggregation on the encrypted model updates, which greatly reduces the communication overhead of each iteration training, so as to realize high-throughput privacy aggregation calculation. Finally, inter-cluster aggregation is performed to obtain an encrypted global model, which can more fully utilize global information and eliminate the risk of global model biasing local convergence caused by asynchronous aggregation. After two-stage aggregation is completed, the server distributes the new global model to the clients participating in the current round, and the clients decrypt and update their local models, thereby completing the current training round.

[0043] As an implementable way, the method includes the following steps:

[0044] S1, setting the total training round as , the total number of clients as , clustering the clients once every round, and obtaining clusters; intra-cluster aggregation selects the fastest client in the cluster to participate in aggregation; and each client holds an initial model .

[0045] S2, each client locally trains to obtain a gradient . Every round, the client generates a secret share , the present application flattens the gradient into a dimensional vector, each secret share is an element on a ring , and is sent to the corresponding server. and cooperate to perform to obtain​ V-index matrix share wherein each element of or if the first row and the first column is , it indicates that the client is assigned to the th cluster, and is equal to , it indicates that the client does not belong to the th cluster.

[0046] In step 2, in order to realize the aforementioned clustering of clients based on encrypted gradients, the embodiment proposes a privacy-preserving clustering scheme suitable for processing the heterogeneity of federated learning , which uses homomorphic encryption and secret sharing technology to group clients with similar system and data characteristics together without revealing the clustering results, ensuring that the adversary cannot infer any private information about the client's gradient from the clustering process. Since clients with similar data distribution have consistent local model update directions, and their update frequencies are also similar, the embodiment clusters clients according to the similarity of gradient descent directions, so that the clients in each cluster after clustering are approximately isomorphic in data and system characteristics.

[0047] The embodiment uses cosine distance to measure the similarity of gradient directions between clients. The larger the cosine distance, the more consistent the gradient descent directions of two clients, and the more similar the data and system characteristics of the two clients. Since it is necessary to prevent the leakage of client gradient data, the embodiment implements the division of the client set based on secret sharing and homomorphic encryption technology, and does not disclose the division details and results of the client set. In order to realize high-throughput calculation in the ciphertext state, the embodiment uses the square of the cosine similarity to replace the cosine similarity for calculation, and proposes an efficient and fast multiplication triple generation algorithm, which can meet the needs of large-scale ciphertext matrix operations.

[0048] As an implementable way, the aforementioned privacy-preserving clustering process includes the following steps:

[0049] S21, set the scheme to use a semantically secure homomorphic encryption scheme to perform clustering calculation. It contains three algorithms: wherein represents a security parameter used to generate a public key and a private key ; The encryption function uses the public key to encrypt the message , represents the homomorphic ciphertext obtained by encryption; with the private key decrypting the homomorphic ciphertext The required homomorphic encryption system satisfies the following properties:

[0050] ,

[0051] ,

[0052] Each server independently generates the above cryptographic system. generate a key pair , generate a key pair Both servers publish the public key and keep the private key.

[0053] S22, set represent the result share. Since matrix multiplication under secret sharing requires generating a large number of multiplication triples, the embodiment provides a fast multiplication triple generation algorithm suitable for high-throughput ciphertext computation: first generate a random matrix , random matrix , random matrix , then calculate the sequence satisfies , ; generate random matrix , random matrix , and calculate the sequence satisfies . Next generate a new random sequence according to the format of the sequence , where is a random matrix, is a random matrix, is a random matrix. Then generate a random value , and calculate:

[0054] ;

[0055] Then send the sequence to . Then calculate:

[0056] ;

[0057] and:

[0058] ;

[0059] and send to . Finally is calculated , so that both sides get the multiplication of the three matrix satisfies and . For the matrix share , respectively, local , . Then the two servers reconstruct the matrix and , and local . It is easy to verify . Where, refers to both secret shares, denotes the secret share held by the server , each secret share is an element on the ring , denotes the dot product.

[0060] S23, set to compare the size of and only with both secret shares , output the secret share of the comparison result , when , when , the whole process will not leak the true value of and . Set holds the secret share and a random positive secret share generated before the protocol begins. Local . Then and call to calculate , and then both sides recover the secret value , when , output , indicating ; when , output , indicating .

[0061] S24, set output where the entire process does not leak and the true values. The division protocol blindingly multiplies the random number share with both the numerator and the denominator to obtain and then and restore the blinded denominator and finally converts the division between secret shares into two local division operations, i.e. .

[0062] S25, server and generate random cluster center secret shares before clustering begins each element is a dimensional vector. The client locally trains to obtain a dimensional local gradient vector and splits each vector into two secret shares and and sends them to the corresponding servers and . The server sets the gradient matrix share and calls to compute , where . Then calls

[0063] to collaboratively compute . The update iteration process of the cluster center in each round is as follows: S26, server uses to compute homomorphic ciphertext , where is the homomorphic ciphertext about the secret share encrypted using and sends the ciphertext vector to . The received ciphertexts are reordered to obtain permuted homomorphic ciphertexts where denotes reordering all elements in a vector , denotes the new element of the th element of the reordered vector.

[0064] S27, for each permuted homomorphic ciphertext and secret share, select a random value and compute , , . Then send and to . Decrypt the received homomorphic ciphertexts to obtain .

[0065] S28, the server sets , and . Next, execute rounds of loop, for , and invoke the protocol to compute and select a random number . If , compute , ; if , compute , and set . After that send to . Decrypt the received ciphertexts to obtain .

[0066] S29, set , where for , ; and . send to . Restore the permuted ciphertexts to , where denotes restoring the elements of the reordered vector back to their original positions. Then generate a new random sequence and encrypted to get homomorphic ciphertext Then set . Calculate and send the ciphertext to . Decrypt to get the secret share of the index vector .

[0067] S210, the server constructs the index matrix share The first column of the matrix is . and Calculate the row sum share of the matrix Locally , where . Then the two servers cooperatively calculate the matrix multiplication . Set as the first row of the matrix , and Update the secret share of the cluster center of this round , where .

[0068] S211, repeat the above steps until the pre-set iteration round is reached, and the clustering result is optimized.

[0069] S3, in the training phase after clustering is completed, each client sends the gradient share to the corresponding server and . For each cluster , each server collects the gradient share of the fastest client and locally calculates the global gradient share of the cluster :

[0070] ,

[0071] where, where represents the ID set of the fastest client, is the current training round, is the last round in which the client participated in intra-cluster aggregation, is the size of the local data set of the client .

[0072] S4, each server locally calculates the inter-cluster aggregation to update the global model of the last round​​​ , get the global model share of this round :

[0073] ,

[0074] wherein, denotes the total number of data samples in the cluster , , is the learning rate.

[0075] S5, the server sends the global model share to the clients participating in the aggregation of this round respectively. The clients reconstruct the model locally and prepare for the next training iteration.

[0076] Embodiment Two

[0077] The embodiment also discloses a computer device, comprising a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method in Embodiment One.

[0078] Embodiment Three

[0079] The embodiment also discloses a computer readable storage medium, wherein a computer program is stored on the computer readable storage medium, and the computer program is executed by a processor to implement the steps of the method in Embodiment One.

[0080] Embodiment Four

[0081] The embodiment also discloses a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the steps of the method in Embodiment One.

[0082] The above, only for the preferred specific embodiments of the present application, but the scope of protection of the present application is not limited to this, any skilled in the technical field of the present application disclosed in the technical range, can easily think of changes or replacements, should be covered in the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the scope of protection of the claims.

Claims

1. A privacy protection method for a heterogeneous federated learning environment, characterized in that, The method comprises the following steps: The client uploads the encrypted gradient according to the requirements of the server; The server performs privacy protection clustering on the client based on the cosine distance of the encrypted gradient according to the preset training round, and optimizes the clustering result by using homomorphic encryption and secret sharing in the clustering process; According to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on each client holding the initial model to obtain a global model share; After the clustering is completed, the server sends the global model share to each client participating in the aggregation, and the client reconstructs and updates the initial model locally; Based on the updated model, the privacy protection of the heterogeneous federated learning environment is realized; The process of the server performing privacy protection clustering on the client based on the cosine distance of the encrypted gradient according to the preset training round and optimizing the clustering result by using homomorphic encryption and secret sharing in the clustering process comprises: Perform clustering calculation based on semantic security homomorphic encryption to generate public key and private key; based on the generated public key and private key, the client generates a secret share and sends it to the corresponding server, the server sets the gradient matrix share and calculates the related parameters, and cooperatively executes to obtain the secret share of the cluster index matrix that does not overlap with each other, and reconstructs the clustering result; After performing clustering calculation based on semantic security homomorphic encryption to generate public key and private key, the process further comprises: Based on the matrix multiplication requirement under secret sharing, obtain a multiplication triple matrix; based on the multiplication triple matrix, locally calculate the target matrix share, and based on the target matrix share, two servers reconstruct the matrix and complete the matrix multiplication; a preset comparison mechanism outputs a secret share, and a division protocol is used for blind processing, simplifying the division between secret shares to local division operation to obtain the division result, and finally the server has the secret share of the cluster center.

2. The method of claim 1, wherein The process of the server performing privacy protection clustering on the client based on the cosine distance of the encrypted gradient according to the preset training round and optimizing the clustering result by using homomorphic encryption and secret sharing in the clustering process further comprises: Based on the clustering result, the server calculates homomorphic ciphertext by using homomorphic encryption and sends it, performs random arrangement and reordering, and obtains the permuted homomorphic ciphertext; based on the permuted homomorphic ciphertext and the secret share, a random value is selected for calculation, and the related result is decrypted.

3. The method of claim 2, wherein The process of the server performing privacy protection clustering on the client based on the cosine distance of the encrypted gradient according to the preset training round and optimizing the clustering result by using homomorphic encryption and secret sharing in the clustering process further comprises: Based on the decryption result, the server sets parameters and performs a round cycle, performs calculation and reconstruction, and decrypts to obtain a further result; based on the further result, the server sets parameters, restores the permuted homomorphic ciphertext, generates a new random sequence and encrypts, calculates to obtain the secret share of the index vector; based on the secret share of the index vector, the server constructs the index matrix share, cooperatively calculates the matrix multiplication, and updates the secret share of the cluster center; the above steps are repeated until a preset iteration round is reached, and the clustering result is optimized.

4. The method of claim 1, wherein According to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on the initial model held by each client to obtain a global model share, and the process includes: In the intra-cluster aggregation, each client sends a gradient share to the corresponding server, and for each cluster, each server collects the gradient share of the fastest client and locally calculates the global gradient share of the cluster.

5. The method of claim 1, wherein, According to the clustering result, the server performs intra-cluster aggregation and inter-cluster aggregation on the initial model held by each client to obtain a global model share, and the process further includes: In the inter-cluster aggregation, each server locally calculates the inter-cluster aggregation to update the global model of the last training round to obtain the global model share of this round.

6. A computer apparatus comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program, when executed by the processor, causes the processor to perform the method of any one of claims 1 to 5. The processor executes the computer program to implement the steps of the method of any one of claims 1-5.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-5.

8. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1-5.

Images