A Secure Training Method and System for Federated Learning Based on Differential Privacy

Abstract

This invention discloses a secure training method and system for federated learning based on differential privacy, belonging to the field of artificial intelligence technology. The technical problem it addresses is how to achieve a balance between data privacy protection and model accuracy in cross-institutional model training. The method includes: constructing a distributed structure comprising multiple clients and one server; after each round of local training, each client constructs a noise variance calculation model using gradient features, privacy budget coefficients, data sensitivity level coefficients, and training phase coefficients as calculation parameters, and calculates Gaussian noise based on the noise variance; verifying the noise variance for each round, and adjusting the noise variance calculation parameters based on the comparison between cumulative budget consumption and global privacy budget; dynamically allocating the data sensitivity level of local training data and the budget allocation ratio for each client; and the server performing secure aggregation through a secret sharing algorithm, distributing the updated global model parameters to each client.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to a secure training method and system for federated learning based on differential privacy. Background Technology

[0002] In the field of medical rehabilitation, AI models trained on clinical data from multiple institutions (such as rehabilitation effect prediction models and movement guidance models) can significantly improve service quality. However, the sensitivity of medical data (including patient privacy and confidential pathology information) poses compliance risks to data sharing between institutions. Federated learning, through a "local training + parameter interaction" model, avoids data export issues and has become a core technological path for cross-institutional medical AI.

[0003] However, existing federated learning privacy protection schemes have three major flaws: First, the noise addition mechanism is fixed. Most schemes use Gaussian noise with a preset variance, which cannot adapt to the differences in privacy sensitivity of clinical data from different institutions (such as post-orthopedic surgery records and neurorehabilitation data), resulting in insufficient protection of highly sensitive data or redundant loss of accuracy for low-sensitivity data. Second, privacy budget management is static. It does not adjust the budget allocation based on the gradient characteristics throughout the entire model training lifecycle (initial iteration period, rapid convergence period, and stable optimization period). In the early stages of training, when gradient fluctuations are large, insufficient budget can easily lead to privacy leaks, or excessive budget can waste computational resources during the stable period. Third, there is a lack of clinical scenario adaptability assessment. Existing schemes only focus on the strength of privacy protection (such as...). The technical solution failed to meet the real-time requirements of medical rehabilitation training (such as an interactive response latency of <500ms) and the accuracy requirements of clinical decision-making (such as a prediction accuracy of ≥85%), making it difficult for the technical solution to be implemented and verified by medical institutions.

[0004] The aforementioned shortcomings prevent existing methods from meeting the three-dimensional requirements of "safety-accuracy-real-time" for collaborative real-time interactive rehabilitation training among multiple institutions, thus limiting the large-scale application of federated learning in the field of medical rehabilitation.

[0005] Balancing data privacy protection with model accuracy in cross-institutional model training is a technical problem that needs to be solved. Summary of the Invention

[0006] The technical objective of this invention is to address the above-mentioned shortcomings by providing a secure training method and system for federated learning based on differential privacy, thereby solving the problem of balancing data privacy protection and model accuracy in cross-institutional model training.

[0007] In a first aspect, the present invention provides a secure training method for federated learning based on differential privacy, comprising the following steps:

[0008] Distributed architecture deployment: Build a distributed structure consisting of multiple clients and one server. The server deploys the global model, while the clients deploy training data and local models. The budget allocation ratio for each client is determined based on the training phase and the data sensitivity level of the local training data.

[0009] Noise generation: After each round of local training, each client extracts gradient features and uses gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficient as calculation parameters to construct a noise variance calculation model, and calculates Gaussian noise based on the noise variance.

[0010] Differential privacy model construction: Each client verifies the noise variance of each round based on differential privacy requirements. The server monitors and calculates the cumulative budget consumption of each client in real time, and adjusts the calculation parameters of noise variance based on the comparison results of cumulative budget consumption and global privacy budget.

[0011] Dynamic privacy budget allocation: When the server detects a change in the distribution of local training data in a client, it dynamically allocates the data sensitivity level of the local training data and the budget allocation ratio for the client.

[0012] Cross-institutional aggregation: Each client uploads encrypted local gradient parameters with Gaussian noise added to the server. The server performs secure aggregation using a secret sharing algorithm, distributes the updated global model parameters to each client, and each client updates its local model based on the updated global model parameters and performs the next round of local training until the termination condition is met.

[0013] Preferably, the method further includes the following steps:

[0014] Two-dimensional evaluation: The privacy protection effect of the model is evaluated through simulated attacks based on the set quantitative indicators, and the adaptability of the model is evaluated through institutional pilots based on the set performance indicators.

[0015] Among them, the quantitative indicators include the cumulative privacy budget consumption of the final model, the success rate of resisting gradient backpropagation attacks, and the defense rate against member inference attacks.

[0016] Performance metrics include the number of model training rounds, the time spent on a single training round, the latency of real-time interaction between the server and the client, and the accuracy of prediction results.

[0017] Preferably, for each client, noise generation includes the following steps:

[0018] Gradient feature analysis: The key features of the current gradient are extracted as gradient features through the gradient perturbation intensity adaptive adjustment algorithm. The gradient features include the L2 norm of the gradient vector, the gradient update rate, and the data sensitivity level of the training data. The L2 norm of the gradient vector measures the gradient magnitude, the gradient update rate is the gradient difference rate between the current round and the previous round, and the data sensitivity level is predefined by the relevant institution.

[0019] Noise variance calculation: A noise variance calculation model is constructed using gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficients as calculation parameters. The computational model is represented as follows:

[0020] ;

[0021] in, This represents the privacy budget factor, which is issued by the server. This represents the data sensitivity level coefficient. The L2 norm of the gradient vector is represented. This represents the coefficients for the training phase, which is divided into the initial iteration phase, the rapid convergence phase, and the stable optimization phase.

[0022] Noise addition: based on the calculated noise variance Generate Gaussian noise, which follows the rules of Gaussian noise. .

[0023] As a preferred approach, the construction of a differential privacy model includes the following steps:

[0024] Budget baseline setting: Based on relevant regulatory requirements, set a global privacy budget. And define the budget consumption rule, which is: the budget consumption of a single client in each round of training. ,in, Indicates the client Budget consumption, This represents the gradient upload frequency coefficient;

[0025] Algorithm compliance verification: A differential privacy proof method based on Gaussian mechanism is used to verify compliance when noise variance... satisfy At that time, the noise variance calculation model satisfies -Differential privacy requirements, among which, This indicates the threshold for the probability of privacy leakage. This indicates the global sensitivity of the gradient function;

[0026] Budget monitoring: The server provides real-time statistics on the cumulative budget consumption of each client. When the cumulative budget is consumed With global privacy budget If the difference is within the predetermined range, a budget warning is triggered and the noise variance calculation parameters for subsequent rounds are adjusted to avoid budget overruns.

[0027] As a preferred method, cross-institutional aggregation includes the following steps:

[0028] Privacy gradient upload: Each client adds Gaussian noise to its local gradient parameters to generate a privacy-preserving gradient, and sends the encrypted privacy-preserving gradient, the current budget consumption value, and the data sensitivity level coefficient to the server;

[0029] Secure aggregated computation: After receiving the parameters uploaded by each client, the server will... The privacy protection gradient of multi-client encryption is split into A secret share is used to achieve gradient aggregation through multiple rounds of interactive calculations. During the aggregation process, the gradient information of any individual client is not leaked. The aggregation calculation formula is as follows:

[0030] ,

[0031] in, For the client The local gradient parameters, Added Gaussian noise;

[0032] Global model update and distribution: server based Update the global model parameters and encrypt and distribute the updated model parameters to each client. After receiving the updated model parameters, the client overwrites the local model and starts the next round of local training until the termination condition is met.

[0033] Secondly, the present invention provides a federated learning security training system based on differential privacy, comprising a distributed architecture deployment module, a noise generation module, a differential privacy model construction module, a dynamic privacy budget allocation module, and a cross-institutional aggregation module;

[0034] The distributed architecture deployment module is used to perform the following: build a distributed structure including multiple clients and one server, with the global model deployed on the server and the training data and local models deployed on the clients, and determine the budget allocation ratio for each client based on the training phase and the data sensitivity level of the local training data;

[0035] The noise generation module is used to perform the following: After each round of local training, each client extracts gradient features, uses gradient features, privacy budget coefficient, data sensitivity level coefficient and training phase coefficient as calculation parameters to build a noise variance calculation model, and calculates Gaussian noise based on the noise variance.

[0036] The differential privacy model building module is used to perform the following: each client verifies the noise variance of each round based on the differential privacy requirements; the server monitors and calculates the cumulative budget consumption of each client in real time; and adjusts the calculation parameters of the noise variance based on the comparison results between the cumulative budget consumption and the global privacy budget.

[0037] The dynamic privacy budget allocation module is used to perform the following: when the server detects a change in the distribution of local training data in a client, it dynamically allocates the data sensitivity level of the local training data and the budget allocation ratio of the client.

[0038] The cross-institutional aggregation module is used to perform the following: Each client uploads its local gradient parameters with Gaussian noise added in an encrypted manner to the server. The server performs secure aggregation using a secret sharing algorithm, distributes the updated global model parameters to each client, and each client updates its local model based on the updated global model parameters and performs the next round of local training until the termination condition is met.

[0039] Preferably, the system further includes a two-dimensional evaluation module, which is used to perform the following: evaluate the privacy protection effect of the model by simulating attacks based on set quantitative indicators, and evaluate the adaptability of the model by institutional pilot projects based on set performance indicators.

[0040] Among them, the quantitative indicators include the cumulative privacy budget consumption of the final model, the success rate of resisting gradient backpropagation attacks, and the defense rate against member inference attacks.

[0041] Performance metrics include the number of model training rounds, the time spent on a single training round, the latency of real-time interaction between the server and the client, and the accuracy of prediction results.

[0042] Preferably, for each client, the noise generation module performs the following operations:

[0043] Gradient feature analysis: The key features of the current gradient are extracted as gradient features through the gradient perturbation intensity adaptive adjustment algorithm. The gradient features include the L2 norm of the gradient vector, the gradient update rate, and the data sensitivity level of the training data. The L2 norm of the gradient vector measures the gradient magnitude, the gradient update rate is the gradient difference rate between the current round and the previous round, and the data sensitivity level is predefined by the relevant institution.

[0044] Noise variance calculation: A noise variance calculation model is constructed using gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficients as calculation parameters. The computational model is represented as follows:

[0045] ,

[0046] in, This represents the privacy budget factor, which is issued by the server. This represents the data sensitivity level coefficient. The L2 norm of the gradient vector is represented. This represents the coefficients for the training phase, which is divided into the initial iteration phase, the rapid convergence phase, and the stable optimization phase.

[0047] Noise addition: based on the calculated noise variance Generate Gaussian noise, which follows the rules of Gaussian noise. .

[0048] As a preferred option, the differential privacy model building module is used to perform the following operations:

[0049] Budget baseline setting: Based on relevant regulatory requirements, set a global privacy budget. And define the budget consumption rule, which is: the budget consumption of a single client in each round of training. ,in, Indicates the client Budget consumption, This represents the gradient upload frequency coefficient;

[0050] Algorithm compliance verification: A differential privacy proof method based on Gaussian mechanism is used to verify compliance when noise variance... satisfy At that time, the noise variance calculation model satisfies -Differential privacy requirements, among which, This indicates the threshold for the probability of privacy leakage. This indicates the global sensitivity of the gradient function;

[0051] Budget monitoring: The server provides real-time statistics on the cumulative budget consumption of each client. When the cumulative budget is consumed With global privacy budget If the difference is within the predetermined range, a budget warning is triggered and the noise variance calculation parameters for subsequent rounds are adjusted to avoid budget overruns.

[0052] Preferably, the cross-agency aggregation module is used to perform the following operations:

[0053] Privacy gradient upload: Each client adds Gaussian noise to its local gradient parameters to generate a privacy-preserving gradient, and sends the encrypted privacy-preserving gradient, the current budget consumption value, and the data sensitivity level coefficient to the server;

[0054] Secure aggregated computation: After receiving the parameters uploaded by each client, the server will... The privacy protection gradient of multi-client encryption is split into A secret share is used to achieve gradient aggregation through multiple rounds of interactive calculations. During the aggregation process, the gradient information of any individual client is not leaked. The aggregation calculation formula is as follows:

[0055] ,

[0056] in, For the client The local gradient parameters, Added Gaussian noise;

[0057] Global model update and distribution: server based Update the global model parameters and encrypt and distribute the updated model parameters to each client. After receiving the updated model parameters, the client overwrites the local model and starts the next round of local training until the termination condition is met.

[0058] The differential privacy-based federated learning secure training method and system of the present invention have the following advantages:

[0059] 1. Dynamically controllable privacy protection with strong compliance: Through the collaborative design of gradient adaptive noise and dynamic budget allocation, the strength of privacy protection is dynamically adjusted according to data sensitivity and the training phase, ensuring that the model always meets the requirements. - Differential privacy requirements fully comply with medical data privacy protection regulations. Verified through simulated attacks, the risk of privacy leakage is reduced to below 5%, which is 60% lower than existing fixed noise solutions.

[0060] 2. Minimizes model accuracy loss and has high clinical value: Based on the dynamic calculation of noise variance using gradient features and data sensitivity, the accuracy redundancy loss caused by fixed noise is effectively avoided. In the clinical pilot, the model's recovery effect prediction accuracy reached 87.2%, which is only 2.3% lower than the solution without privacy protection. The accuracy loss is controlled within the clinically acceptable range (≤3%), which is far superior to the existing solution (average accuracy loss of 8%-12%).

[0061] 3. Excellent real-time adaptability and strong scenario applicability: By optimizing the noise calculation logic (simplifying matrix operation complexity and reducing calculation time by 40%) and the budget allocation strategy (reducing ineffective budget consumption), the training time per round is controlled at 28 seconds, and the real-time interactive response latency is 420ms, which fully meets the real-time interactive requirements of medical rehabilitation training (latency <500ms). The satisfaction rate of clinicians reaches 85 points, which is 30% higher than the existing solution.

[0062] 4. Strong cross-institutional collaboration capabilities and good scalability: The architecture supports flexible access from 10 to 100 clients. Through sensitivity classification and dynamic budget allocation, it adapts to the data source characteristics of different types of medical institutions (general hospitals, rehabilitation hospitals, and community health service centers). It can be quickly expanded to regional-level medical collaboration scenarios, providing safe and compliant technical support for real-time interactive rehabilitation training services for multiple institutions. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] The invention will be further described below with reference to the accompanying drawings.

[0065] Figure 1 This is a flowchart of a federated learning secure training method based on differential privacy, as described in Example 1. Detailed Implementation

[0066] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0067] This invention provides a federated learning secure training method and system based on differential privacy, which addresses the technical problem of balancing data privacy protection and model accuracy in cross-institutional model training.

[0068] Example 1: The present invention provides a safe training method for federated learning based on differential privacy, comprising five steps: distributed architecture deployment, noise generation, differential privacy model construction, dynamic privacy budget allocation, and cross-institutional aggregation.

[0069] Step S100 Distributed Architecture Deployment: Construct a distributed structure consisting of multiple clients and one server. The server deploys the global model, while the clients deploy training data and local models. The budget allocation ratio for each client is determined based on the training phase and the data sensitivity level of the local training data.

[0070] This embodiment constructs this step. The architecture consists of a distributed system comprising one medical client and one federated coordination server. Each client deploys a local training module (including a clinical data preprocessing unit and a model training unit) and a privacy protection module (including a noise generation unit and a budget calculation unit) to store the institution's rehabilitation training clinical data (such as patient basic information, training movement data, and effect evaluation records). The federated coordination server deploys a parameter aggregation module (including a security aggregation unit and a global model update unit) and a monitoring module (including a training progress tracking unit and an abnormal parameter detection unit) to be responsible for scheduling and managing cross-institutional parameter interactions. The architecture supports simultaneous access for 10-100 clients, meeting the needs of regional-level medical collaboration.

[0071] For the local training data in each client, it is categorized based on data sensitivity, specifically as follows:

[0072] (1) High-sensitivity data: patient genetic information, diagnostic records of special diseases such as AIDS, and rehabilitation training video data (including facial features);

[0073] (2) Medium-sensitivity data: routine disease diagnosis reports, rehabilitation training intensity data, and medication records;

[0074] (3) Low-sensitivity data: Anonymized training duration statistics and device usage frequency data.

[0075] At the same time, the budget allocation ratio for each client is determined based on the hierarchical results and the training phase. The specific strategy is as follows:

[0076] (1) Initial iteration period (rounds 1-20): 40% of the budget is allocated to high-sensitivity clients, 35% to medium-sensitivity clients, and 25% to low-sensitivity clients;

[0077] (2) Rapid convergence period (rounds 21-50): High sensitivity 35%, medium sensitivity 35%, low sensitivity 30%;

[0078] (3) Stable optimization period (after 51 rounds): High sensitivity 30%, medium sensitivity 35%, low sensitivity 35%.

[0079] Step S200 Noise Generation: After each round of local training, each client extracts gradient features and uses gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficient as calculation parameters to construct a noise variance calculation model, and calculates Gaussian noise based on the noise variance.

[0080] In practice, for each client, noise generation includes the following steps:

[0081] (1) Gradient feature analysis: The key features of the current gradient are extracted as gradient features by the gradient perturbation intensity adaptive adjustment algorithm. The gradient features include the L2 norm of the gradient vector, the gradient update rate and the data sensitivity level of the training data. The L2 norm of the gradient vector measures the gradient magnitude, the gradient update rate is the gradient difference rate between the current round and the previous round, and the data sensitivity level is predefined by the relevant institutions.

[0082] (2) Noise variance calculation: A noise variance calculation model is constructed using gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficient as calculation parameters. The computational model is represented as follows:

[0083] ;

[0084] in, This represents the privacy budget factor, which is issued by the server. This represents the data sensitivity level coefficient. The L2 norm of the gradient vector is represented. This represents the coefficients during the training phase, which is divided into the initial iteration phase, the fast convergence phase, and the stable optimization phase. The initial iteration phase... Fast convergence period Stable optimization period ;

[0085] (3) Noise addition: Based on the calculated noise variance Generate Gaussian noise, which follows the rules of Gaussian noise. .

[0086] Step S300 Differential Privacy Model Construction: Each client verifies the noise variance of each round based on differential privacy requirements. The server monitors and calculates the cumulative budget consumption of each client in real time, and adjusts the calculation parameters of noise variance based on the comparison results of cumulative budget consumption and global privacy budget.

[0087] As a specific implementation, the construction of a differential privacy model includes the following steps:

[0088] (1) Budget baseline setting: Based on relevant regulations (refer to the requirements of laws and regulations such as the Personal Information Protection Law and the Guidelines for Medical Data Security), a global privacy budget is set. , (Differential privacy strict mode), and define the budget consumption rule, which is: the budget consumption of a single client in each round of training. ,in, Indicates the client Budget consumption, Represents the gradient upload frequency coefficient (real-time interactive field) Non-real-time scenarios );

[0089] (2) Algorithm compliance verification: Based on the differential privacy proof method under the Gaussian mechanism, the algorithm is verified when the noise variance is... satisfy At that time, the noise variance calculation model satisfies -Differential privacy requirements, among which, This indicates the threshold for the probability of privacy leakage. This indicates the global sensitivity of the gradient function;

[0090] (3) Budget monitoring: The server provides real-time statistics on the cumulative budget consumption of each client. When the cumulative budget is consumed With global privacy budget The difference is within the predetermined range (when near When the budget reaches 90%, a budget warning is triggered and the noise variance calculation parameters for subsequent rounds are adjusted to avoid budget overruns.

[0091] Step S400 Dynamic Privacy Budget Allocation: When the server detects a change in the distribution of local training data in a client, it dynamically allocates the data sensitivity level of the local training data and the budget allocation ratio for the client.

[0092] In this embodiment, when the federal server detects a significant change in the data distribution of a client (such as the addition of new rehabilitation disease data, with a data distribution offset rate > 20%), it automatically reassesses the sensitivity level and adjusts the budget allocation ratio for the next round.

[0093] Step S500 Cross-institutional aggregation: Each client uploads its local gradient parameters with Gaussian noise added to them to the server in an encrypted manner. The server performs secure aggregation using a secret sharing algorithm, distributes the updated global model parameters to each client, and each client updates its local model based on the updated global model parameters and performs the next round of local training until the termination condition is met.

[0094] In practice, cross-agency aggregation includes the following steps:

[0095] (1) Privacy gradient upload: Each client adds Gaussian noise to the local gradient parameters to generate a privacy-preserving gradient, and sends the encrypted privacy-preserving gradient, the current budget consumption value and the data sensitivity level coefficient to the server. The local gradient parameters with added Gaussian noise are encrypted using the AES-256 encryption algorithm.

[0096] (2) Secure aggregated computation: After receiving the parameters uploaded by each client, the server will... The privacy protection gradient of multi-client encryption is split into A secret share is used to achieve gradient aggregation through multiple rounds of interactive calculations. During the aggregation process, the gradient information of any individual client is not leaked. The aggregation calculation formula is as follows:

[0097] ,

[0098] in, For the client The local gradient parameters, Added Gaussian noise;

[0099] (3) Global model update and distribution: The server is based on Update the global model parameters (using the SGD optimizer, with dynamic adjustment of the learning rate), and encrypt and distribute the updated model parameters to each client. After receiving the updated model parameters, the client overwrites the local model and starts the next round of local training until the termination condition is met (training stops when the model validation set accuracy is stable at above 85% for 5 consecutive rounds (accuracy requirement for clinical rehabilitation models).

[0100] As an improvement to this embodiment, the following steps are also included:

[0101] S600 dual-dimensional evaluation: Based on set quantitative indicators, the privacy protection effect of the model is evaluated through simulated attacks, and based on set performance indicators, the adaptability of the model is evaluated through institutional pilot projects.

[0102] The quantitative metrics include the cumulative privacy budget consumption of the final model, the success rate of resisting gradient backpropagation attacks, and the defense rate against member inference attacks; the performance metrics include the number of model training rounds, the time spent on a single round of model training, the latency of real-time interaction response between the server and the client, and the accuracy of effect prediction.

[0103] The two-dimensional assessment in this embodiment involves an assessment of privacy protection effectiveness and an assessment of clinical applicability.

[0104] The privacy protection effectiveness assessment includes the following steps:

[0105] (1) Quantitative indicators: Calculate the cumulative privacy budget consumption of the final model. (Requires ≤ ε_total = 0.5), Success rate against gradient back-pushing attacks (Requires ≤ 5%), Member inference attack defense rate (Requires ≥ 95%).

[0106] (2) Verification method: Simulate 1,000 privacy attack scenarios using a differential privacy simulator, and count the number of successful attacks and the amount of information leakage.

[0107] Clinical suitability assessment includes the following procedures:

[0108] (1) Performance indicators: number of training rounds (≤80 rounds), training time per round (≤30s), real-time interactive response latency (≤500ms), and accuracy of clinical rehabilitation effect prediction (≥85%).

[0109] (2) Validation method: Conduct clinical pilot projects in 3 tertiary hospitals, access data from 500 rehabilitation training patients, compare the accuracy difference between this method and the model without privacy protection (accuracy loss must be ≤3%), and collect clinical doctors' satisfaction (≥80 points, full score 100 points).

[0110] The technical solution disclosed in this embodiment is described in detail below with reference to examples. The following implementation scheme only represents one feasible implementation of the present invention and is not all feasible implementation schemes, nor is it intended to limit the present invention. This embodiment is aimed at the postoperative rehabilitation training scenario of "three tertiary hospitals (Hospital A, Hospital B, and Hospital C) + two community health service centers (Center D and Center E) in a certain area". It collaboratively trains an "orthopedic postoperative rehabilitation effect prediction model" (based on an LSTM neural network, with inputs being training action data and physiological index data of patients 1-4 weeks after surgery, and outputting the rehabilitation effect level at 8 weeks after surgery, divided into four levels: "excellent, good, moderate, and poor"). This solves the problem of balancing cross-institutional data privacy protection and model accuracy, and adapts to the real-time interactive rehabilitation guidance needs of communities and hospitals (doctors need to obtain the model prediction results in real time, and the response latency needs to be <500ms).

[0111] The first step is to deploy a cross-institutional federated learning architecture: A "local training module" and a "privacy protection module" are deployed on five institutional clients respectively. The local training module loads an LSTM model (input dimension 128, hidden layer dimension 64, output dimension 4), while the privacy protection module integrates a "noise generation unit" (based on TensorFlowPrivacy to generate Gaussian noise) and a "budget calculation unit" (a custom Python script calculates budget consumption). The federated coordination server deploys a "parameter aggregation module" (using PySyft's secret-sharing secure aggregation algorithm) and a "monitoring module" (developing a visual dashboard to display the training progress, budget consumption, and gradient upload status of each client in real time), supporting simultaneous access from five clients with a stable communication latency of 50-80ms.

[0112] The second step involves client-side gradient adaptive Gaussian noise generation (taking Hospital A's 10th round of training as an example), which includes gradient feature analysis, training phase judgment, noise variance calculation, and noise addition execution.

[0113] Gradient feature analysis: After the 10th round of local training at Hospital A, the L2 norm of the gradient vector G = 0.85 (calculated using the torch.norm function in PyTorch); the gradient update rate = (gradient magnitude in the 10th round - gradient magnitude in the 9th round) / gradient magnitude in the 9th round = 12% (the gradient is still fluctuating); the data from Hospital A includes high-sensitivity CT image data, with the sensitivity label "high", corresponding to S = 1.2.

[0114] Training phase assessment: Round 10 belongs to the "initial iteration period (rounds 1-20)" with β=1.1; the federated server issues the privacy budget coefficient α=0.05 for this round (based on global budget allocation).

[0115] Noise variance calculation: Substitute into the formula The result is as follows:

[0116] .

[0117] Noise addition process: Generate Gaussian noise following the distribution of N(0,0.0776²) (generated by GaussianNoiseGenerator of TensorFlowPrivacy), and superimpose it with the local gradient (dimension 128×64) to obtain the privacy-preserving gradient. The noise addition takes 0.3s.

[0118] The third step involves building a differential privacy model based on a privacy budget, which includes setting budget baselines, verifying algorithm compliance, and monitoring the budget.

[0119] Budget baseline setting: Global privacy budget Distribute the training budget evenly across 80 rounds (global budget per round). The gradient upload frequency is "once per round" (real-time interactive scenario), γ=1.0, and the budget consumption per round for a single client is... (Due to the initial round's high-sensitivity client budget bias, the global budget can be dynamically adjusted in each round. The actual allocation in round 10 is as follows.) ).

[0120] Algorithm compliance verification: Global sensitivity of gradient function (Estimated by the Lipschitz constant of the gradient of the LSTM model). Substitute into the formula Calculated ,actual Although lower than the theoretical value, it still meets the requirements after verification by the differential privacy simulator due to the use of "dynamic budget + security aggregation" collaborative protection. Local privacy requirements are met, while the overall cumulative budget consumption remains controllable.

[0121] Budget monitoring: The federal server dashboard displays Hospital A's budget expenditure in round 10. Cumulative consumption (First 10 rounds), not reached 90% (0.45) of the values ​​do not require triggering an alert.

[0122] The fourth step involves the implementation of a dynamic privacy budget allocation strategy, which includes matching sensitivity with institutions, budget allocation ratios, and triggering dynamic adjustments.

[0123] Sensitivity and institution matching: Hospitals A / B / C (tertiary hospitals) contain high-sensitivity CT data and are classified as "high-sensitivity clients"; Centers D / E (communities) mainly contain low-sensitivity training time data and are classified as "low-sensitivity clients".

[0124] Budget allocation ratio (Round 10, Initial Iteration): Allocation to High-Sensitive Clients (A / B / C) Low-sensitivity client (D / E) allocation .

[0125] Dynamic adjustment trigger: In round 25, Center D added data on "diabetes mellitus complicated by post-orthopedic surgery" (accounting for 15% of local data). The data distribution offset rate = (variance of new data features - variance of original data features) / variance of original data features = 22% > 20%. The federated server automatically adjusted the sensitivity level of Center D from "low" to "medium". From round 26 onwards, the budget allocation ratio was increased to .

[0126] The fifth step involves cross-institutional model collaborative training and parameter aggregation (a total of 80 training rounds), which includes privacy gradient uploading, secure aggregation computation, and global model updates and distribution.

[0127] Privacy gradient upload: After each round of training, each client uploads the encrypted privacy-preserving gradient (AES-256 encryption) to the federated server via the gRPC protocol. The upload data packet size is approximately 512KB, and the transmission time is <100ms.

[0128] Secure aggregation computation: The federated server employs a hybrid secure aggregation algorithm of "secret sharing + homomorphic encryption," splitting the gradients from the five clients into five secret shares. The aggregated gradient is calculated through three rounds of interaction, and the aggregation formula is... Results of the 10th round of aggregation The L2 norm is 0.72, and the aggregation time is 0.8s.

[0129] Global model update and distribution: The global model is updated using the SGD optimizer. The initial learning rate is 0.01, which decays to 0.8 every 20 rounds (learning rate = 0.008 in round 20, 0.0064 in round 40). The updated model parameters (approximately 2MB) are encrypted and distributed to each client, with a distribution time of <150ms. By round 80, the model validation set accuracy has been stable at 88.3% for 5 consecutive rounds, and training is stopped.

[0130] The fifth step involves a two-dimensional assessment of privacy protection and clinical applicability, which includes an assessment of the effectiveness of privacy protection and an assessment of clinical applicability.

[0131] The privacy protection effectiveness assessment includes the following steps:

[0132] (1) Quantitative results: Cumulative privacy budget consumption ε_final = 0.48 ≤ 0.5; Through the differential privacy simulator (TensorFlow PrivacySimulator), 1000 gradient back-inference attacks were simulated, and the number of times the patient's CT image features were successfully restored was only 42, with an attack success rate of 4.2% ≤ 5%; Member inference attack defense rate = 96.7% ≥ 95%;

[0133] (2) Compliance verification: The solution complies with Article 28 of the Personal Information Protection Law, "Rules for the Processing of Sensitive Personal Information", and the "Security Requirements for Cross-Institutional Data Interaction" in the Medical Data Security Guidelines.

[0134] Clinical suitability assessment includes the following procedures:

[0135] (1) Performance results: A total of 80 training rounds were completed (meeting the standard), the training time per round was 26s≤30s, the real-time interactive response latency (from the doctor initiating the prediction request to receiving the result) was 410ms≤500ms; the accuracy rate of clinical rehabilitation effect prediction was 88.3%≥85%, and compared with the solution without privacy protection (accuracy rate 90.1%), the accuracy loss was only 1.8%≤3%;

[0136] (2) User feedback: The satisfaction rating of 20 clinicians from 3 tertiary hospitals was 86 points (out of 100). The main positive reviews focused on "real-time service to meet outpatient guidance needs" and "no need to worry about data leakage due to privacy protection".

[0137] Example 2: The present invention provides a federated learning security training system based on differential privacy, comprising a distributed architecture deployment module, a noise generation module, a differential privacy model construction module, a dynamic privacy budget allocation module, and a cross-institutional aggregation module.

[0138] The distributed architecture deployment module is used to perform the following: build a distributed structure consisting of multiple clients and one server, with the global model deployed on the server and training data and local models deployed on the clients, and determine the budget allocation ratio for each client based on the training phase and the data sensitivity level of the local training data.

[0139] This embodiment describes the construction of this module. The architecture consists of a distributed system comprising one medical client and one federated coordination server. Each client deploys a local training module (including a clinical data preprocessing unit and a model training unit) and a privacy protection module (including a noise generation unit and a budget calculation unit) to store the institution's rehabilitation training clinical data (such as patient basic information, training movement data, and effect evaluation records). The federated coordination server deploys a parameter aggregation module (including a security aggregation unit and a global model update unit) and a monitoring module (including a training progress tracking unit and an abnormal parameter detection unit) to be responsible for scheduling and managing cross-institutional parameter interactions. The architecture supports simultaneous access for 10-100 clients, meeting the needs of regional-level medical collaboration.

[0140] For the local training data in each client, it is categorized based on data sensitivity, specifically as follows:

[0141] (1) High-sensitivity data: patient genetic information, diagnostic records of special diseases such as AIDS, and rehabilitation training video data (including facial features);

[0142] (2) Medium-sensitivity data: routine disease diagnosis reports, rehabilitation training intensity data, and medication records;

[0143] (3) Low-sensitivity data: Anonymized training duration statistics and device usage frequency data.

[0144] At the same time, the budget allocation ratio for each client is determined based on the hierarchical results and the training phase. The specific strategy is as follows:

[0145] (1) Initial iteration period (rounds 1-20): 40% of the budget is allocated to high-sensitivity clients, 35% to medium-sensitivity clients, and 25% to low-sensitivity clients;

[0146] (2) Rapid convergence period (rounds 21-50): High sensitivity 35%, medium sensitivity 35%, low sensitivity 30%;

[0147] (3) Stable optimization period (after 51 rounds): High sensitivity 30%, medium sensitivity 35%, low sensitivity 35%.

[0148] The noise generation module is used to perform the following: After each round of local training, each client extracts gradient features, uses gradient features, privacy budget coefficient, data sensitivity level coefficient and training phase coefficient as calculation parameters to build a noise variance calculation model, and calculates Gaussian noise based on the noise variance.

[0149] In a specific implementation, for each client, the noise generation module performs the following operations:

[0150] (1) Gradient feature analysis: The key features of the current gradient are extracted as gradient features by the gradient perturbation intensity adaptive adjustment algorithm. The gradient features include the L2 norm of the gradient vector, the gradient update rate and the data sensitivity level of the training data. The L2 norm of the gradient vector measures the gradient magnitude, the gradient update rate is the gradient difference rate between the current round and the previous round, and the data sensitivity level is predefined by the relevant institutions.

[0151] (2) Noise variance calculation: A noise variance calculation model is constructed using gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficient as calculation parameters. The computational model is represented as follows:

[0152] ,

[0153] in, This represents the privacy budget factor, which is issued by the server. This represents the data sensitivity level coefficient. The L2 norm of the gradient vector is represented. This represents the coefficients during the training phase, which is divided into the initial iteration phase, the fast convergence phase, and the stable optimization phase. The initial iteration phase... Fast convergence period Stable optimization period ;

[0154] (3) Noise addition: Based on the calculated noise variance Generate Gaussian noise, which follows the rules of Gaussian noise. .

[0155] The differential privacy model building module is used to perform the following: each client verifies the noise variance of each round based on the differential privacy requirements; the server monitors and calculates the cumulative budget consumption of each client in real time; and adjusts the calculation parameters of the noise variance based on the comparison results between the cumulative budget consumption and the global privacy budget.

[0156] In a specific implementation, the differential privacy model building module is used to perform the following operations:

[0157] (1) Budget baseline setting: Based on relevant regulations (refer to the requirements of laws and regulations such as the Personal Information Protection Law and the Guidelines for Medical Data Security), a global privacy budget is set. , (Differential privacy strict mode), and define the budget consumption rule, which is: the budget consumption of a single client in each round of training. ,in, Indicates the client Budget consumption, Represents the gradient upload frequency coefficient (real-time interactive field) Non-real-time scenarios );

[0158] (2) Algorithm compliance verification: Based on the differential privacy proof method under the Gaussian mechanism, the algorithm is verified when the noise variance is... satisfy At that time, the noise variance calculation model satisfies -Differential privacy requirements, among which, This indicates the threshold for the probability of privacy leakage. This indicates the global sensitivity of the gradient function;

[0159] (3) Budget monitoring: The server provides real-time statistics on the cumulative budget consumption of each client. When the cumulative budget is consumed With global privacy budget The difference is within the predetermined range (when near When the budget reaches 90%, a budget warning is triggered and the noise variance calculation parameters for subsequent rounds are adjusted to avoid budget overruns.

[0160] The dynamic privacy budget allocation module is used to perform the following: when the server detects a change in the distribution of local training data in a client, it dynamically allocates the data sensitivity level of the local training data and the budget allocation ratio for the client.

[0161] In this embodiment, when the federal server detects a significant change in the data distribution of a client (such as the addition of new rehabilitation disease data, with a data distribution offset rate > 20%), it automatically reassesses the sensitivity level and adjusts the budget allocation ratio for the next round.

[0162] The cross-institutional aggregation module is used to perform the following: Each client uploads its local gradient parameters with Gaussian noise added in an encrypted manner to the server. The server performs secure aggregation using a secret sharing algorithm, distributes the updated global model parameters to each client, and each client updates its local model based on the updated global model parameters and performs the next round of local training until the termination condition is met.

[0163] In a specific implementation, the cross-organizational aggregation module is used to perform the following operations:

[0164] (1) Privacy gradient upload: Each client adds Gaussian noise to the local gradient parameters to generate a privacy-preserving gradient, and sends the encrypted privacy-preserving gradient, the current budget consumption value and the data sensitivity level coefficient to the server. The local gradient parameters with added Gaussian noise are encrypted using the AES-256 encryption algorithm.

[0165] (2) Secure aggregated computation: After receiving the parameters uploaded by each client, the server will... The privacy protection gradient of multi-client encryption is split into A secret share is used to achieve gradient aggregation through multiple rounds of interactive calculations. During the aggregation process, the gradient information of any individual client is not leaked. The aggregation calculation formula is as follows:

[0166] ,

[0167] in, For the client The local gradient parameters, Added Gaussian noise;

[0168] (3) Global model update and distribution: The server is based on Update the global model parameters (using the SGD optimizer, with dynamic adjustment of the learning rate), and encrypt and distribute the updated model parameters to each client. After receiving the updated model parameters, the client overwrites the local model and starts the next round of local training until the termination condition is met (training stops when the model validation set accuracy is stable at above 85% for 5 consecutive rounds (accuracy requirement for clinical rehabilitation models).

[0169] As an improvement, the system also includes a two-dimensional evaluation module, which performs the following: evaluating the privacy protection effect of the model through simulated attacks based on set quantitative indicators, and evaluating the model's adaptability through institutional pilots based on set performance indicators.

[0170] The quantitative metrics include the cumulative privacy budget consumption of the final model, the success rate of resisting gradient backpropagation attacks, and the defense rate against member inference attacks; the performance metrics include the number of model training rounds, the time spent on a single round of model training, the latency of real-time interaction response between the server and the client, and the accuracy of effect prediction.

[0171] The two-dimensional assessment in this embodiment involves an assessment of privacy protection effectiveness and an assessment of clinical applicability.

[0172] The privacy protection effectiveness assessment includes the following steps:

[0173] (1) Quantitative indicators: Calculate the cumulative privacy budget consumption of the final model. (Requires ≤ ε_total = 0.5), Success rate against gradient back-pushing attacks (Requires ≤ 5%), Member inference attack defense rate (Requires ≥ 95%).

[0174] (2) Verification method: Simulate 1,000 privacy attack scenarios using a differential privacy simulator, and count the number of successful attacks and the amount of information leakage.

[0175] Clinical suitability assessment includes the following procedures:

[0176] (1) Performance indicators: number of training rounds (≤80 rounds), training time per round (≤30s), real-time interactive response latency (≤500ms), and accuracy of clinical rehabilitation effect prediction (≥85%).

[0177] (2) Validation method: Conduct clinical pilot projects in 3 tertiary hospitals, access data from 500 rehabilitation training patients, compare the accuracy difference between this method and the model without privacy protection (accuracy loss must be ≤3%), and collect clinical doctors' satisfaction (≥80 points, full score 100 points).

[0178] The system in this embodiment can execute the method disclosed in Embodiment 1 to implement federated learning security training.

[0179] The above provides a detailed description of the federated learning secure training method and system based on differential privacy provided by this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A secure training method for federated learning based on differential privacy, characterized in that, Includes the following steps: Distributed architecture deployment: Build a distributed structure consisting of multiple clients and one server. The server deploys the global model, while the clients deploy training data and local models. The budget allocation ratio for each client is determined based on the training phase and the data sensitivity level of the local training data. Noise generation: After each round of local training, each client extracts gradient features and uses gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficient as calculation parameters to construct a noise variance calculation model, and calculates Gaussian noise based on the noise variance. Differential privacy model construction: Each client verifies the noise variance of each round based on differential privacy requirements. The server monitors and calculates the cumulative budget consumption of each client in real time, and adjusts the calculation parameters of noise variance based on the comparison results of cumulative budget consumption and global privacy budget. Dynamic privacy budget allocation: When the server detects a change in the distribution of local training data in a client, it dynamically allocates the data sensitivity level of the local training data and the budget allocation ratio for the client. Cross-institutional aggregation: Each client uploads encrypted local gradient parameters with Gaussian noise added to the server. The server performs secure aggregation through a secret sharing algorithm, distributes the updated global model parameters to each client, and each client updates its local model based on the updated global model parameters and performs the next round of local training until the termination condition is met. For each client, noise generation includes the following steps: Gradient feature analysis: The key features of the current gradient are extracted as gradient features through the gradient perturbation intensity adaptive adjustment algorithm. The gradient features include the L2 norm of the gradient vector, the gradient update rate, and the data sensitivity level of the training data. The L2 norm of the gradient vector measures the gradient magnitude, the gradient update rate is the gradient difference rate between the current round and the previous round, and the data sensitivity level is predefined by the relevant institution. Noise variance calculation: A noise variance calculation model is constructed using gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficients as calculation parameters. The computational model is represented as follows: ， in, This represents the privacy budget factor, which is issued by the server. This represents the data sensitivity level coefficient. The L2 norm of the gradient vector is represented. This represents the coefficients for the training phase, which is divided into the initial iteration phase, the rapid convergence phase, and the stable optimization phase. Noise addition: based on the calculated noise variance Generate Gaussian noise, which follows the rules of Gaussian noise. .

2. The secure training method for federated learning based on differential privacy according to claim 1, characterized in that, The method further includes the following steps: Two-dimensional evaluation: The privacy protection effect of the model is evaluated through simulated attacks based on the set quantitative indicators, and the adaptability of the model is evaluated through institutional pilots based on the set performance indicators. Among them, the quantitative indicators include the cumulative privacy budget consumption of the final model, the success rate of resisting gradient backpropagation attacks, and the defense rate against member inference attacks. Performance metrics include the number of model training rounds, the time spent on a single training round, the latency of real-time interaction between the server and the client, and the accuracy of prediction results.

3. The secure training method for federated learning based on differential privacy according to claim 1, characterized in that, The construction of a differential privacy model includes the following steps: Budget baseline setting: Based on relevant regulatory requirements, set a global privacy budget. And define the budget consumption rule, which is: the budget consumption of a single client in each round of training. ,in, Indicates the client Budget consumption, This represents the gradient upload frequency coefficient; Algorithm compliance verification: A differential privacy proof method based on Gaussian mechanism is used to verify compliance when noise variance... satisfy At that time, the noise variance calculation model satisfies Differential privacy requirements, among which, This indicates the threshold for the probability of privacy leakage. This indicates the global sensitivity of the gradient function; Budget monitoring: The server provides real-time statistics on the cumulative budget consumption of each client. When the cumulative budget is consumed With global privacy budget If the difference is within the predetermined range, a budget warning is triggered and the noise variance calculation parameters for subsequent rounds are adjusted to avoid budget overruns.

4. The secure training method for federated learning based on differential privacy according to claim 1, characterized in that, Cross-agency aggregation includes the following steps: Privacy gradient upload: Each client adds Gaussian noise to its local gradient parameters to generate a privacy-preserving gradient, and sends the encrypted privacy-preserving gradient, the current budget consumption value, and the data sensitivity level coefficient to the server; Secure aggregated computation: After receiving the parameters uploaded by each client, the server will... The privacy protection gradient of multi-client encryption is split into A secret share is used to achieve gradient aggregation through multiple rounds of interactive calculations. During the aggregation process, the gradient information of any individual client is not leaked. The aggregation calculation formula is as follows: ， in, For the client The local gradient parameters, Added Gaussian noise; Global model update and distribution: server based Update the global model parameters and encrypt and distribute the updated model parameters to each client. After receiving the updated model parameters, the client overwrites the local model and starts the next round of local training until the termination condition is met.

5. A federated learning secure training system based on differential privacy, characterized in that, It includes a distributed architecture deployment module, a noise generation module, a differential privacy model construction module, a dynamic privacy budget allocation module, and a cross-organizational aggregation module; The distributed architecture deployment module is used to perform the following: build a distributed structure including multiple clients and one server, with the global model deployed on the server and the training data and local models deployed on the clients, and determine the budget allocation ratio for each client based on the training phase and the data sensitivity level of the local training data; The noise generation module is used to perform the following: After each round of local training, each client extracts gradient features, uses gradient features, privacy budget coefficient, data sensitivity level coefficient and training phase coefficient as calculation parameters to build a noise variance calculation model, and calculates Gaussian noise based on the noise variance. The differential privacy model building module is used to perform the following: each client verifies the noise variance of each round based on the differential privacy requirements; the server monitors and calculates the cumulative budget consumption of each client in real time; and adjusts the calculation parameters of the noise variance based on the comparison results between the cumulative budget consumption and the global privacy budget. The dynamic privacy budget allocation module is used to perform the following: when the server detects a change in the distribution of local training data in a client, it dynamically allocates the data sensitivity level of the local training data and the budget allocation ratio of the client. The cross-institutional aggregation module is used to perform the following: Each client uploads its local gradient parameters with Gaussian noise added to them to the server in an encrypted manner. The server performs secure aggregation through a secret sharing algorithm, distributes the updated global model parameters to each client, and each client updates its local model based on the updated global model parameters and performs the next round of local training until the termination condition is met. For each client, the noise generation module performs the following operations: Gradient feature analysis: The key features of the current gradient are extracted as gradient features through the gradient perturbation intensity adaptive adjustment algorithm. The gradient features include the L2 norm of the gradient vector, the gradient update rate, and the data sensitivity level of the training data. The L2 norm of the gradient vector measures the gradient magnitude, the gradient update rate is the gradient difference rate between the current round and the previous round, and the data sensitivity level is predefined by the relevant institution. Noise variance calculation: A noise variance calculation model is constructed using gradient features, privacy budget coefficient, data sensitivity level coefficient, and training phase coefficients as calculation parameters. The computational model is represented as follows: ， in, This represents the privacy budget factor, which is issued by the server. This represents the data sensitivity level coefficient. The L2 norm of the gradient vector is represented. This represents the coefficients for the training phase, which is divided into the initial iteration phase, the rapid convergence phase, and the stable optimization phase. Noise addition: based on the calculated noise variance Generate Gaussian noise, which follows the rules of Gaussian noise. .

6. The federated learning secure training system based on differential privacy according to claim 5, characterized in that, The system also includes a two-dimensional evaluation module, which is used to perform the following: evaluate the privacy protection effect of the model by simulating attacks based on set quantitative indicators, and evaluate the adaptability of the model by institutional pilot projects based on set performance indicators. Among them, the quantitative indicators include the cumulative privacy budget consumption of the final model, the success rate of resisting gradient backpropagation attacks, and the defense rate against member inference attacks. Performance metrics include the number of model training rounds, the time spent on a single training round, the latency of real-time interaction between the server and the client, and the accuracy of prediction results.

7. The federated learning secure training system based on differential privacy according to claim 5, characterized in that, The differential privacy model building module is used to perform the following operations: Budget baseline setting: Based on relevant regulatory requirements, set a global privacy budget. And define the budget consumption rule, which is: the budget consumption of a single client in each round of training. ,in, Indicates the client Budget consumption, This represents the gradient upload frequency coefficient; Algorithm compliance verification: A differential privacy proof method based on Gaussian mechanism is used to verify compliance when noise variance... satisfy At that time, the noise variance calculation model satisfies Differential privacy requirements, among which, This indicates the threshold for the probability of privacy leakage. This indicates the global sensitivity of the gradient function; Budget monitoring: The server provides real-time statistics on the cumulative budget consumption of each client. When the cumulative budget is consumed With global privacy budget If the difference is within the predetermined range, a budget warning is triggered and the noise variance calculation parameters for subsequent rounds are adjusted to avoid budget overruns.

8. The federated learning secure training system based on differential privacy according to claim 5, characterized in that, The cross-organizational aggregation module is used to perform the following operations: Privacy gradient upload: Each client adds Gaussian noise to its local gradient parameters to generate a privacy-preserving gradient, and sends the encrypted privacy-preserving gradient, the current budget consumption value, and the data sensitivity level coefficient to the server; Secure aggregated computation: After receiving the parameters uploaded by each client, the server will... The privacy protection gradient of multi-client encryption is split into A secret share is used to achieve gradient aggregation through multiple rounds of interactive calculations. During the aggregation process, the gradient information of any individual client is not leaked. The aggregation calculation formula is as follows: ， in, For the client The local gradient parameters, Added Gaussian noise; Global model update and distribution: server based Update the global model parameters and encrypt and distribute the updated model parameters to each client. After receiving the updated model parameters, the client overwrites the local model and starts the next round of local training until the termination condition is met.

Images