Privacy protection distributed learning method and system based on multi-aggregator security aggregation

Abstract

The invention discloses a privacy protection distributed learning method and system based on security aggregation of multiple aggregators. The method comprises the following steps: firstly, configuring an encryption key for each aggregator; then training a local model on a local private data set by each client to obtain gradient update, identifying the first K most relevant gradient components, coding the selected gradient update into a polynomial structure, generating secret sharing and distributing the secret sharing to all aggregators; then, each aggregator collects the sharing from the participating client, accumulates the sharing by using the addition property of the secret sharing, encrypts the accumulated sharing, binds the aggregator identity and the current round number, and generates a partial decryption result through cooperative decryption; and finally, the client collects partial decryption results from at least a threshold number of aggregators, reconstructs a complete aggregation gradient, verifies the authenticity and correspondence of the aggregation gradient, updates a local model and prepares for the next round of training. According to the method, the communication overhead and the calculation overhead are remarkably reduced, and the equivalent model precision is kept.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and relates to a privacy protection method and system in distributed machine learning, in particular to a privacy protection distributed learning method and system based on multi-aggregator secure aggregation. BACKGROUND

[0002] Distributed learning allows multiple clients to collaboratively train a global model while keeping private data localized, exchanging only gradient update information. This approach has been successfully applied in banking, healthcare, and e-commerce, enabling cross-institutional machine learning without sharing raw data. However, recent research has shown that even without direct access to raw data, sensitive information can still be leaked by analyzing exchanged gradient updates.

[0003] Specifically, existing distributed learning faces the following privacy leakage risks: first, gradient reconstruction attacks, attackers can reconstruct training samples or extract member information by analyzing individual gradient updates; second, feature inference attacks, the active party can use feature reconstruction attacks to infer the sensitive features of the passive party; third, model inversion attacks, by observing model outputs, private information of training data can be inferred. These privacy vulnerabilities necessitate the use of privacy protection mechanisms during gradient aggregation.

[0004] To address the privacy leakage problem, secure aggregation technology has emerged. Secure aggregation ensures that no party can access individual updates while still being able to calculate the correct aggregation result, providing a key privacy guarantee for distributed learning. Existing privacy protection mechanisms can be mainly divided into two categories: encrypted privacy protection mechanisms and non-encrypted privacy protection mechanisms. Encrypted privacy protection mechanisms use secure computing techniques (such as homomorphic encryption, secret sharing) to perform calculations on multi-party data, but these methods impose a significant burden on computation and communication, especially for deep neural networks. Non-encrypted privacy protection mechanisms (such as differential privacy) are more efficient but can lead to a significant decrease in model accuracy, potentially posing security risks in sensitive areas such as medical diagnosis or finance.

[0005] Current mainstream secure aggregation solutions mainly rely on a single aggregator architecture. However, the single aggregator architecture has serious security vulnerabilities: first, single point of failure risk, failure or compromise of a single aggregator will affect the security of the entire system; second, replay attack vulnerability, a malicious aggregator can infer additional knowledge by replaying previously uploaded gradient updates in multiple training rounds, and since clients cannot independently verify the authenticity of aggregation results, these attacks are difficult to detect and defend against; third, privacy leakage risk, a compromised aggregator can leak all aggregation results in plaintext form, completely undermining the privacy protection mechanism.

[0006] To address the limitations of the single-aggregator architecture, some researches have proposed multi-aggregator schemes. The existing multi-aggregator solutions face two key challenges: first, the aggregator collusion problem, when multiple aggregators collaborate, they can reconstruct the private data of the client, making the secure aggregation invalid; second, the scalability bottleneck, the existing solutions require a large amount of inter-client collaboration communication and computation, which will produce a serious scalability bottleneck as the number of clients increases. In addition, the existing solutions also have deficiencies in communication efficiency. Traditional secret sharing schemes encode one secret per polynomial, resulting in high communication complexity. Therefore, there is an urgent need for a multi-aggregator secure aggregation scheme that can resist aggregator collusion attacks and provide good scalability and communication efficiency to meet the needs of actual distributed learning deployment. SUMMARY

[0007] The present application aims at the deficiencies of the prior art, and provides a privacy protection distributed learning method and system based on multi-aggregator secure aggregation, which accelerates the training of the model and improves the security of the system.

[0008] The technical scheme adopted by the method of the present application is: a privacy protection distributed learning method based on multi-aggregator secure aggregation, involving entities including a plurality of clients and a plurality of aggregators; comprising the following steps: Step 1: configuring an encryption key for each aggregator; Step 2: each client trains a local model on a local private data set to obtain gradient updates, identifies the top K most relevant gradient components, encodes the selected gradient updates into a polynomial structure, generates secret sharing and distributes it to all aggregators; Step 3: each aggregator collects shares from participating clients and uses the additive property of secret sharing to accumulate, encrypts the accumulated shares and binds the aggregator identity and the current round number, and generates a partial decryption result through collaborative decryption; Step 4: the client collects partial decryption results from at least a threshold number of aggregators, reconstructs the complete aggregated gradient, verifies its authenticity and correspondence, updates the local model and prepares for the next round of training.

[0009] As a preferred embodiment, the specific implementation of step 2 includes the following sub-steps: Step 2.1: local model training, the client uses the stochastic gradient descent algorithm to train the local model on the private data set in the first round to obtain gradient updates , calculates the dynamic weight factor , wherein is the participation frequency of the client , Client's Dataset size, Total dataset size for the current participating clients, after which the client computes ; Total number of clients currently participating in training, .

[0010] Step 2.2: Gradient quantization, using quantization function Converts real-valued gradient updates to representations over finite fields , where is an element-wise rounding function, is a mapping function that maps negative integers to finite fields.

[0011] Step 2.3: Top- Gradient selection, computes the relevance between the current round gradient and the previous round global gradient , sorts the gradient updates in descending order according to the relevance, and selects the top- most relevant gradient components for secret sharing, where denotes the relevance based on different metrics, denotes the gradient update dimension; is the gradient update of the -th dimension of the -th client in the -th round of training.

[0012] As a preference, the relevance computation of different metrics in step 2.3 uses one of the following measurement methods: Cosine similarity: ; Pearson correlation coefficient: , where and ; Euclidean distance: ; Kullback-Leibler divergence: .

[0013] Step 2.4: Packaging secret sharing, constructs a polynomial function of degree , where is a predefined secret point, is a random polynomial of degree , is a Lagrange polynomial , generates a shared sent to the aggregator , where​ These are pre-selected elements that are secretly shared; For consecutive multiplication, For the dimension of gradient update, The threshold number for collecting aggregators.

[0014] As a preferred embodiment, step 3 includes the following sub-steps: Step 3.1: Securely share accumulation, aggregator Collect all client shares And calculate the cumulative sum By leveraging the additive property of secret sharing, only the cumulative sum is maintained, rather than a single share; Step 3.2: Threshold encryption, using an algorithm and The aggregator encrypts the accumulated shares and binds them to the aggregator identity and the current training round. Generate ciphertext To prevent replay attacks; Preferably, the threshold function encryption in step 3.2 includes the following algorithm: Based on security parameters Generate Group Randomized matrix , Define a global hash function. and privacy parameters Output common parameters and the master private key ;in, Indicates safety parameters, Indicates the training batch size. Indicates the number of aggregators. Denotes the integer group based on a probabilistic multinomial-time algorithm. express prime number, group generator, express 3D random matrix, express 3D random matrix sample; Encrypted Entities Distribute secret key ;in, Represents encrypted entities The corresponding weight parameters are derived from the random matrix. The first in The line is used to generate the functional decryption key for this entity; : using secret key and training round on message encrypt, output ciphertext wherein ; denotes the encryption entity corresponding parameters derived from the random matrix in the th row, used for ciphertext computation, denotes randomly selected elements used to provide randomness in the encryption process; denotes the symbol of successive multiplication, indicating the successive multiplication operation on multiple elements.

[0015] Step 3.3: Collaborative decryption, the aggregator collaboratively computes the aggregated gradient without exposing the plaintext result through algorithms and , the threshold mechanism ensures that only at least a threshold number of aggregators cooperate to recover the aggregated gradient, resisting collusion attacks.

[0016] As a preferred, the collaborative decryption described in step 3.3 includes the following algorithms: : generating functional decryption keys for decryption entities and training rounds , defining a polynomial function wherein , , generating functional decryption keys wherein , output ; wherein, denotes the input message of the decryption entity , denotes the coefficient in the polynomial function , denotes the integer ring modulo , denotes the th element in the functional related vector , denotes the th row parameter in the random matrix , denotes the th row parameter in the random matrix ; denotes the selected subset of decryption parties, satisfying ; : given public parameters , ciphertext , vector and from the subset functional decryption key wherein output partial decrypted ciphertext wherein , , is a Lagrange polynomial ; wherein, denotes the functional vector associated with the encryption entity , corresponding element in denotes the first component of the partial decrypted ciphertext, denotes the second component of the ciphertext ; : Given public parameters and all partial decrypted ciphertexts , compute the inner product , return the final decryption result , compute recover wherein , , denotes the accumulated secret share of the aggregator , denotes the multiply-by computation, denotes the element in the functional related vector , denotes the gradient update dimension information.

[0017] As a preference, the specific implementation of step 4 includes the following sub-steps: Step 4.1: Collect partial decryption results, the client collects partial decryption results from at least aggregators and verifies their authenticity and corresponding current training round; Step 4.2: Gradient reconstruction, use polynomial interpolation technology to reconstruct the complete aggregated gradient from effective sharing, compute ; wherein is a predefined secret point, is a pre-selected element of secret sharing; is the dimension of the gradient update, is the threshold number of collected aggregators.

[0018] Step 4.3: Model update, the client uses the aggregated gradient to update the local model wherein is the learning rate, is the batch size, continue the next round of local model training until the maximum training round is reached.

[0019] The technical scheme adopted by the system of the present application is: a privacy protection distributed learning system based on multi-aggregator secure aggregation, comprising: one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the privacy protection distributed learning method based on multi-aggregator secure aggregation.

[0020] Compared with the prior art, the beneficial effects of the present application include: (1) The present application adopts a multi-aggregator architecture, which fundamentally solves the single point failure and replay attack problems of the single aggregator scheme. By distributing trust to multiple aggregators, it is ensured that no single aggregator can access the complete gradient information, and even if part of the aggregators are compromised, the overall security will not be affected; (2) The present application realizes linear optimization of communication overhead by packing secret sharing technology. Combined with Top- Gradient selection method, further reduces the amount of data that needs to be transmitted; (3) The present application eliminates the need for collaborative communication between clients, avoiding the scalability bottleneck of existing schemes as the number of clients increases. The multi-aggregator architecture naturally supports horizontal expansion, and the number of aggregators and threshold parameters can be adjusted according to actual needs to adapt to different scale distributed learning scenarios; (4) The present application provides comprehensive protection against gradient reconstruction attacks, replay attacks, collusion attacks and other threats. Through multiple security measures such as encryption protection, timestamp binding and threshold mechanism, a three-dimensional privacy protection system is constructed, which has stronger security than existing schemes with single protection mechanism; (5) While maintaining theoretical security, the present application fully considers the efficiency requirements of actual deployment. Significant performance improvement makes it particularly suitable for large-scale distributed learning scenarios, providing practical technical solutions for industries such as finance, medical care, Internet of Things and other industries with high requirements for privacy protection, and has good application prospects. BRIEF DESCRIPTION OF DRAWINGS

[0021] The technical scheme of the present application is further illustrated below using examples and specific embodiments. In addition, some drawings are also used in the process of explaining the technical scheme. For those skilled in the art, other drawings and the intent of the present application can also be obtained from these drawings without creative labor.

[0022] Figure 1 is the method principle diagram of the embodiment of the present application. DETAILED DESCRIPTION

[0023] For the convenience of those skilled in the art to understand and implement the present application, the present application will be further described in detail below in conjunction with the drawings and examples. It should be understood that the examples described herein are only used to illustrate and explain the present application, and are not intended to limit the present application.

[0024] Distributed learning allows multiple clients to collaboratively train a global model while keeping private data localized, exchanging only gradient update information. However, existing distributed learning faces privacy leakage risks such as gradient reconstruction attacks, replay attacks and collusion attacks. The current mainstream single aggregator secure aggregation scheme has single point failure and replay attack vulnerabilities, while the existing multi-aggregator scheme faces aggregator collusion problems and scalability bottlenecks.

[0025] The present application provides a privacy protection distributed learning method and system based on multi-aggregator secure aggregation to solve the above technical problems. The method adopts a multi-aggregator architecture, which fundamentally solves the security vulnerabilities of the single aggregator scheme by distributing trust to multiple aggregators.

[0026] The core innovation of the present application lies in two protocols that work together: a selective packed gradient sharing protocol and a threshold gradient aggregation protocol. The selective packed gradient sharing protocol uses packed secret sharing technology to encode multiple gradient values into a single polynomial, combined with Top- The selection method identifies the most relevant gradient updates, further reducing communication complexity. The threshold gradient aggregation protocol is based on threshold function encryption technology, which uses the additive property of secret sharing to make each aggregator store only the cumulative shared sum, ensuring that only a threshold number of aggregators cooperate to recover the aggregated gradient, effectively resisting collusion attacks and replay attacks.

[0027] See Figure 1 The privacy protection distributed learning method based on multi-aggregator secure aggregation provided by the present embodiment involves entities including a client and an aggregator, wherein and are all preset values. Step 1: System initialization, the cryptography infrastructure configures encryption keys for each aggregator; Step 2: Selective packed gradient sharing, each client trains a local model on a local private data set to obtain gradient updates, identifies the Top- most relevant gradient components through correlation analysis, encodes the selected gradient updates into a polynomial structure using packed secret sharing technology, generates secret sharing and distributes it to all aggregators; In one embodiment, the specific implementation of step 2 includes the following sub-steps: Step 2.1: Local model training, the client In the first Rounds using stochastic gradient descent algorithm on a private dataset Gradient updates are obtained by training a local model. Calculate dynamic weighting factors ,in For the client Frequency of participation For the client Dataset size, This is the total dataset size currently being used by participating clients, after which the client will calculate... ; This represents the total number of clients currently participating in the training. .

[0028] Step 2.2: Gradient quantization, using a quantization function. Transform real-valued gradient updates into finite field updates The above indicates, among which This is a function for element-wise rounding. A mapping function maps negative integers to a finite field; Step 2.3: Top- Gradient selection, calculating the gradient of the current round. Compared with the previous round of global gradient Correlation between Gradient updates are sorted in descending order based on correlation, and Top-ranked gradients are selected. The most relevant gradient components are secretly shared, among which This indicates the correlation based on different indicators. Indicates the gradient update dimension; For the client In the The first round of training Gradient update of dimensions; The correlation between different indicators is calculated using one of the following measurement methods: Cosine similarity: ; Pearson correlation coefficient: ,in and ; Euclidean distance: ; Kullback-Leibler divergence: .

[0029] Step 2.4: Pack and share the secret, constructing the degree as follows. polynomial function ,in For predefined secret points, random degree polynomial, is a Lagrange polynomial , generating shares sent to aggregators , where is a pre-selected element of the secret sharing, is a multiplication operation, is the dimension of the gradient update, is the threshold number of collecting aggregators.

[0030] Step 3: Threshold gradient aggregation, each aggregator collects shares from participating clients and accumulates using the additive property of secret sharing, encrypts the accumulated shares using a threshold function and binds the aggregator identity and the current round number, generates a partial decryption result by collaborative decryption; In an embodiment, the specific implementation of step 3 includes the following sub-steps: Step 3.1: Securely shared accumulation, the aggregator collects all client shares and calculates the accumulated sum , using the additive property of secret sharing to maintain only the accumulated sum rather than individual shares; Step 3.2: Threshold encryption, using algorithms and , the aggregator encrypts the accumulated shares and binds the aggregator identity and the current training round , generating ciphertext , preventing replay attacks; The threshold function encryption includes the following algorithms: : Based on the security parameter generate a group , randomize the matrix , , define the universal hash function and the privacy parameter , output the public parameter and the master private key ; wherein, respectively represent the security parameter, the training batch size, the number of aggregators, an integer group based on a probabilistic polynomial time algorithm, a prime number, a generator of the group , a dimensional random matrix, a dimensional random matrix sample; : The encryption entity distributes the secret key ; wherein, The corresponding weight parameters are derived from the random matrix. The first in The line is used to generate the functional decryption key for this entity; Using a secret key and training rounds Regarding the message Encrypt and output ciphertext ,in ;in, Represents encrypted entities The corresponding parameters are derived from the random matrix. The first in Line, used for encrypted calculation, This represents a randomly selected element used to provide randomness during the encryption process; The multiplication symbol indicates a multiplication operation performed on multiple elements.

[0031] Step 3.3: Collaborative decryption, using an algorithm and Aggregators collaboratively compute the aggregation gradient without exposing the plaintext results. A threshold mechanism ensures that only a minimum threshold number of aggregators can cooperate to recover the aggregation gradient, thus resisting collusion attacks.

[0032] The collaborative decryption includes the following algorithms: : for decrypting entities and training rounds Generate the decryption key and define the polynomial function. ,in , Generate decryption key ,in Output in, Representing the decrypted entities Input message, polynomial function The coefficients in the modulus Integer ring, function-related vector The first in n elements, random matrix The first in Row parameters, random matrix The first in Row parameters, the selected subset of decryption methods, satisfying ; Given common parameters ciphertext ,vector and from subset Function decryption key wherein , outputting a partially decrypted ciphertext wherein , , is a Lagrange polynomial ; wherein, denote the corresponding elements in the function vector associated with the encryption entity , the first component of the partially decrypted ciphertext, the second component of the ciphertext ; : Given public parameters and all the partially decrypted ciphertexts , compute the inner product , return the final decryption result , compute recover wherein , , denote the accumulated secret share of the aggregator , the component-wise multiplication computation, the th element in the function-related vector , denotes the gradient update dimension information.

[0033] Step 4: Secure reconstruction and model update, the client collects the partially decrypted results from at least a threshold number of aggregators, reconstructs the complete aggregated gradient using polynomial interpolation techniques, verifies its authenticity and correspondence, updates the local model and prepares for the next round of training; In an embodiment, the specific implementation of step 4 includes the following sub-steps: Step 4.1: Collecting partially decrypted results, the client collects the partially decrypted results from at least aggregators and verifies their authenticity and correspondence to the current training round; Step 4.2: Gradient reconstruction, reconstruct the complete aggregated gradient from the effective shares using polynomial interpolation techniques, compute ; wherein is a pre-defined secret point, is a pre-selected element of the secret sharing; is the dimension of the gradient update, is the threshold number of collected aggregators.

[0034] Step 4.3: Model update, the client updates the local model using the aggregated gradient, wherein is the learning rate, For batch size, continue the next round of local model training until the maximum number of training rounds is reached .

[0035] The embodiment also provides a privacy protection distributed learning system based on multi-aggregator secure aggregation, comprising: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the privacy protection distributed learning method based on multi-aggregator secure aggregation.

[0036] The method of the present application can provide security protection against the following attacks: (1) Gradient reconstruction attack protection: by encrypting the gradient update, the attacker cannot access the plaintext gradient; (2) Replay attack protection: by binding the current training round label when encrypting Prevent malicious combination of gradient updates of different rounds; (3) collusion attack protection: based on Threshold function encryption ensures that less than aggregators cannot obtain the plaintext aggregated gradient.

[0037] The following further illustrates the present application through specific experiments. Table 1 is the test accuracy (%) experimental results of the present embodiment and other schemes. Table 2 is the calculation overhead (s) experimental results of the present embodiment and other schemes. Table 3 is the communication overhead (MB) experimental results of the present embodiment and other schemes.

[0038] Table 1

[0039] Table 2

[0040] Table 3

[0041] The experiment compares the model accuracy, computational overhead and communication overhead of the present embodiment and other secure aggregation schemes. Five data sets (MNIST, CIFAR-10, Tiny-ImageNet, SpeechCommands, and AGNews) are selected, covering different fields such as image classification, speech recognition and text classification. As can be seen from Table 1, the model accuracy of the present embodiment is comparable to other schemes, and is close to the result of centralized training, indicating that the secure aggregation process does not significantly affect the model performance. As can be seen from Table 2, the present embodiment is significantly superior to other schemes in terms of computational overhead. For example, on the Tiny-ImageNet dataset, the present embodiment achieves 3.18 times, 2.72 times, 1.80 times and 1.65 times acceleration compared with SecAgg, Prio+, Flamingo and Elsa, respectively. As can be seen from Table 3, the present embodiment also performs well in terms of communication overhead, reducing the communication overhead by about 68%, 59%, 79% and 60% compared with SecAgg, Prio+, Flamingo and Elsa, respectively, on the Tiny-ImageNet dataset. The above experimental results show that the present embodiment significantly reduces the computational overhead and communication overhead while maintaining equivalent model accuracy, verifying the effectiveness of the packed secret sharing technique and the threshold gradient aggregation protocol.

[0042] The privacy-preserving distributed learning method based on multi-aggregator secure aggregation designed by the present application reduces the communication complexity from to , where is the number of aggregators, is the gradient dimension, and the communication efficiency is optimized by encoding multiple gradient values in a single polynomial through the packed secret sharing technique, effectively solving the security vulnerabilities of single-aggregator architecture and the efficiency problems of existing multi-aggregator schemes. Compared with existing schemes, the present application maintains model accuracy while significantly improving computational efficiency and communication efficiency, providing a practical technical solution for large-scale privacy-preserving distributed learning.

[0043] It should be understood that the above-described embodiments are part of the embodiments of the present application, but not all of the embodiments. In addition, the technical features of each embodiment or individual embodiment provided by the present application can be combined with each other in any manner to form a feasible technical solution, and such combination is not subject to the order of steps and / or structure composition mode, but must be based on the implementation by a person skilled in the art. When the combination of technical solutions appears contradictory or unfeasible, it should be considered that such combination of technical solutions does not exist and is not within the protection scope required by the present application.

[0044] It should be understood that the above description is merely a detailed explanation of the preferred embodiments and is not intended to limit the patent protection scope of the present application. Any modification or alternation made by those skilled in the art without departing from the scope of the present application shall fall within the patent protection scope of the present application. The patent protection scope of the present application shall be subject to the appended claims.

Claims

1. A privacy-preserving distributed learning method based on multi-aggregator secure aggregation, involving entities comprising a client and aggregators; characterized in that, The method comprises the following steps: Step 1: configure an encryption key for each aggregator; Step 2: each client trains a local model on a local private dataset to obtain gradient updates, identifies the top K most relevant gradient components, encodes the selected gradient updates into a polynomial structure, generates a secret sharing and distributes it to all aggregators; Step 3: each aggregator collects shares from participating clients and accumulates them using the additive property of secret sharing, encrypts the accumulated shares and binds the aggregator identity and the current round number, generates a partial decryption result through collaborative decryption; Step 4: the client collects partial decryption results from at least a threshold number of aggregators, reconstructs the complete aggregated gradient, verifies its authenticity and correspondence, updates the local model and prepares for the next round of training.

2. The privacy-preserving distributed learning method based on multi-aggregator secure aggregation according to claim 1, the specific implementation of step 2 comprises the following sub-steps: Step 2.1: local model training; Client In a first round, the client uses a stochastic gradient descent algorithm to train a local model on the private dataset obtains gradient updates , computes a dynamic weight factor ; Client computing real-valued gradient updates ; Step 2.2: gradient quantization; Adopting a quantization function Converting real-valued gradient updates to representations over finite fields where is an element-wise rounding function, is a mapping function that maps negative integers to finite fields; Step 2.3: Top- Gradient selection; Compute current round gradient Correlation between the previous round global gradient , according to the correlation of the gradient update descending order, select Top- The most relevant gradient components are secret shared, where Indicates the correlation based on different indicators, Indicates the gradient update dimension, For the client In the first Round of training in the first Dimension of gradient update;​ Step 2.4: packing secret sharing; A polynomial function of degree is constructed , generating shares sent to the aggregator , where are pre-selected elements of a secret share.

3. The privacy-preserving distributed learning method based on multi-aggregator secure aggregation of claim 2: in step 2.1, wherein is the participation frequency of the client is the dataset size of the client, is the total dataset size of the currently participating clients, is the total dataset size of the currently participating clients, is the total number of clients currently participating in training, . is the total number of clients currently participating in training, .

4. The privacy-preserving distributed learning method based on multi-aggregator secure aggregation according to claim 2, the relevance calculation in step 2.3 uses one of the following measurement methods: Cosine similarity: ; Pearson correlation coefficient: wherein , ; Euclidean distance: ; Kullback-Leibler divergence: .

5. The privacy-preserving distributed learning method based on secure aggregation of multi-aggregator according to claim 2: in step 2.4, wherein is a predefined secret point, is a random degree polynomial, is a Lagrange polynomial , is a multiply operation, is a dimension of gradient update, is a threshold number of collecting aggregators.

6. The privacy-preserving distributed learning method based on multi-aggregator secure aggregation according to claim 1, the specific implementation of step 3 comprises the following sub-steps: Step 3.1: secure sharing accumulation; aggregator collecting shares from all clients and computing cumulative sums maintain only cumulative sums rather than individual shares, exploiting the additive property of secret sharing; Step 3.2: threshold encryption; Using an algorithm And The aggregator encrypts the accumulated shares and binds the aggregator identity and the current training round Generating a ciphertext Preventing replay attacks; Step 3.3: collaborative decryption; By algorithm and , the aggregators collaboratively compute the aggregated gradient without exposing the plaintext result, and the threshold mechanism ensures that only when at least a threshold number of aggregators collaborate can the aggregated gradient be recovered, resisting collusion attacks.

7. The privacy-preserving distributed learning method based on secure aggregation of multi-aggregator according to claim 6, characterized in that, The threshold function encryption in step 3.2 comprises the following algorithm: : based on a security parameter generate a group , a randomization matrix , , define a universal hash function and a privacy parameter , output public parameters and a master private key ; wherein, represents a security parameter, represents a training batch size, represents an aggregator number, represents an integer group based on a probabilistic polynomial time algorithm, represents a prime number, represents a generator of a group , represents a random matrix of dimension , a random matrix sample of dimension Encrypted Entities Distribute secret key ;in, Represents encrypted entities The corresponding weight parameters are derived from the random matrix. The first in The line is used to generate the functional decryption key for this entity; : using a secret key and training rounds on a message encrypting, outputting ciphertext wherein ; denotes an encryption entity corresponding parameters derived from a random matrix in the first row, used for ciphertext computation, denotes a randomly selected element used to provide randomness in the encryption process; denotes a concatenation symbol, indicating a concatenation operation on multiple elements.

8. The privacy-preserving distributed learning method based on secure aggregation of multi-aggregator according to claim 7, characterized in that, The collaborative decryption in step 3.3 comprises the following algorithm: : for decrypting entities and training rounds Generate the decryption key and define the polynomial function. ,in , Generate decryption key ,in Output ;in, Indicates the entity to be decrypted Input message, Represents a polynomial function The coefficients in Modulus Integer ring, Represents the functionally related vector The first in One element, Represents a random matrix The first in row parameters, Represents a random matrix The first in row parameters; Denotes the selected subset of decryption methods that satisfies ; : given public parameters , ciphertext , vector and a function decryption key from a subset where , output partially decrypted ciphertext where , , is a Lagrange polynomial ; where, denotes the corresponding element in the function vector associated with the encrypting entity , denotes the first component of the partially decrypted ciphertext , denotes the second component of the ciphertext​ : given public parameters and all partial decrypted ciphertexts , compute inner product , return final decrypted result , compute restore where , , denotes the accumulated secret share of the aggregator denotes the compute of the product denotes the element in the function related vector denotes the element in the function related vector denotes the element in the function related vector denotes the element in the function related vector denotes the gradient update dimension information.

9. The privacy-preserving distributed learning method based on secure aggregation of multi-aggregator according to any one of claims 1-8, characterized in that, The specific implementation of step 4 comprises the following sub-steps: Step 4.1: Collecting partial decryption results, the client collects partial decryption results from at least aggregators and verifies their authenticity and correspondence to the current training round; Step 4.2: Gradient reconstruction, using polynomial interpolation technique to reconstruct complete aggregated gradient from effective share, compute ; where is a predefined secret point, is a pre-selected element of the secret share; is the dimension of the gradient update, is the threshold number of the collector aggregator. Step 4.3: Model Update, Client updates local model using aggregated gradient where is the learning rate, is the batch size, continue next round of local model training until maximum number of training rounds is reached .

10. A privacy-preserving distributed learning system based on secure aggregation of multiple aggregators, characterized in that, comprise: one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the privacy-preserving distributed learning method based on multi-aggregator secure aggregation according to any one of claims 1 to 9.

Images