Model training method, device and system based on federal learning and safety protection

Abstract

The invention provides a model training method, device and system based on federated learning and safety protection, and relates to the technical field of artificial intelligence, and the method comprises the steps: carrying out the current training of a target model based on local training data, and obtaining a current model parameter; the local training data is obtained by performing quantum encryption on the original training data; performing homomorphic encryption on the current model parameter to obtain a current encrypted model parameter; uploading the current encryption model parameter to an aggregation node; and receiving global model parameters distributed by the aggregation nodes, and carrying out next training on the target model based on the global model parameters. According to the method, the device and the system provided by the invention, quantum encryption is adopted in an acquisition stage, and homomorphic encryption is adopted in an interaction stage, so that the privacy of an aggregation process is ensured, and a potential attacker cannot obtain model updating details of any single node; in the collaborative training process, it is ensured that data privacy is strictly protected, data are not attacked or tampered, and the efficiency of multi-party collaborative training is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to a model training method, device and system based on federated learning and security protection. BACKGROUND

[0002] Federated learning is an emerging distributed machine learning technology that allows participants to collaboratively train a model without sharing raw data. The basic principle is to jointly optimize a global model by exchanging model parameters or intermediate calculation results, rather than raw data itself. In the federated learning process, the data owner trains the model on the local device or server with local data, then uploads the trained model parameters to the central server or interacts with other participants, and each party updates the local model according to the received parameters, and iterates until the expected training effect is achieved.

[0003] In related technologies, traditional data encryption, tamper-proofing and access control technologies are mainly used to protect data privacy and security. However, in the face of increasingly powerful computing power and new attack methods, the security is greatly challenged, and data privacy leakage is easy to occur; it is difficult to adapt to complex and variable attack scenarios, and cannot effectively protect the integrity and authenticity of the data. In addition, due to the increase in computing and communication overhead, the progress of model training will be significantly affected, and it cannot meet the needs of some real-time application scenarios.

[0004] Therefore, how to ensure data privacy in the process of collaborative model training is strictly protected, data is not tampered with, and the efficiency of multi-party collaborative training is improved has become a technical problem to be solved in the industry. SUMMARY

[0005] The present application provides a model training method, device and system based on federated learning and security protection, which solves the technical problem of how to ensure data privacy in the process of collaborative model training is strictly protected, data is not tampered with, and the efficiency of multi-party collaborative training is improved.

[0006] The present application provides a model training method based on federated learning and security protection, comprising: training a target model based on local training data to obtain current model parameters; the local training data is obtained by quantum encryption on original training data; homomorphically encrypting the current model parameters to obtain current encrypted model parameters; uploading the current encrypted model parameters to an aggregation node, so that the aggregation node aggregates the current encrypted model parameters sent by each training node to obtain global model parameters; receive global model parameters distributed by the aggregation node, and perform next training on the target model based on the global model parameters.

[0007] In some embodiments, the homomorphic encryption of the current model parameters comprises: determining a sensitivity of the current model parameters with respect to the local training data; generating Laplace noise of the current model parameters based on the sensitivity and a preset privacy budget; adding the Laplace noise to the current model parameters; homomorphic encryption of the current model parameters with added Laplace noise.

[0008] In some embodiments, the uploading of the current encrypted model parameters to the aggregation node comprises: sequentially pruning and quantizing the current encrypted model parameters to obtain a compression processing result corresponding to the current encrypted model parameters; taking a parameter difference between the compression processing result corresponding to the current encrypted model parameters and a compression processing result corresponding to a previous encrypted model parameter as an incremental update result corresponding to the current encrypted model parameters; uploading the incremental update result to the aggregation node.

[0009] In some embodiments, after receiving the global model parameters distributed by the aggregation node, the method further comprises: verifying an update record of the global model parameters based on a preset blockchain to obtain a first verification result; the preset blockchain is commonly maintained by each training node and is used to store an operation history of the local training data and / or an update record of model parameters of the target model; verifying a hash value of the global model parameters based on a preset hash chain to obtain a second verification result; the preset hash chain is used by each training node to store hash values of each data block in the local training data and / or hash values of each parameter block in the model parameters of the target model; in a case where the first verification result and the second verification result are both passed, determining that the global model parameters have not been tampered with.

[0010] In some embodiments, the method further comprises: real-time monitoring of the training nodes and the aggregation node to obtain data transmission traffic of each node and / or a model parameter update frequency of the target model; in a case where the data transmission traffic is greater than a preset traffic threshold and / or the model parameter update frequency is greater than a preset update frequency, generating training anomaly alarm information of the target model.

[0011] In some embodiments, the method further comprises: Based on the computing performance parameters of each node in the federated learning architecture and / or the data volume of the local training data of each node, the nodes are divided into training nodes and aggregation nodes.

[0012] The application provides a model training device based on federated learning and security protection, comprising: A local training module is configured to perform current training on a target model based on local training data to obtain current model parameters, wherein the local training data is obtained by quantum encryption on original training data. A parameter encryption module is configured to perform homomorphic encryption on the current model parameters to obtain current encrypted model parameters. A parameter uploading module is configured to upload the current encrypted model parameters to an aggregation node, so that the aggregation node aggregates the current encrypted model parameters sent by each training node to obtain global model parameters. A parameter receiving module is configured to receive the global model parameters distributed by the aggregation node and perform next training on the target model based on the global model parameters.

[0013] The application provides a model training system based on federated learning and security protection, comprising a plurality of nodes. The plurality of nodes constitute a federated learning architecture and are configured to perform the model training method based on federated learning and security protection to train a target model.

[0014] The application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the model training method based on federated learning and security protection when executing the computer program.

[0015] The application provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the model training method based on federated learning and security protection.

[0016] The model training method, device and system based on federated learning and security protection provided by the application, the current model parameter is obtained by training the target model based on the local training data; the local training data is obtained by quantum encryption on the original training data; the current encryption model parameter is obtained by homomorphic encryption on the current model parameter; the current encryption model parameter is uploaded to the aggregation node, so that the aggregation node aggregates the current encryption model parameter sent by each training node to obtain the global model parameter; the global model parameter distributed by the aggregation node is received, and the next time training of the target model is performed based on the global model parameter; since quantum encryption is adopted in the data collection stage, high-level future-oriented security protection is provided for the static storage original training data; since homomorphic encryption is adopted in the model parameter interaction stage, the privacy of the aggregation process is ensured, and the aggregation node or potential attackers cannot obtain any single node model update details; the combination of the two encryption technologies is applied in the federated learning process, and the data privacy is strictly protected in the process of cooperative training model, the data is not attacked or tampered, and the efficiency of multi-party cooperative training is improved. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and serve to explain the principles of the application together with the description.

[0018] In order to more clearly illustrate the technical solutions in the application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description are some embodiments of the application, and those skilled in the art can also obtain other accompanying drawings without creative labor based on these accompanying drawings.

[0019] Figure 1 is one of the process schematic diagrams of the model training method based on federated learning and security protection provided by the application.

[0020] Figure 2 is the second process schematic diagram of the model training method based on federated learning and security protection provided by the application.

[0021] Figure 3 is the structural schematic diagram of the model training device based on federated learning and security protection provided by the application.

[0022] Figure 4 is the structural schematic diagram of the model training system based on federated learning and security protection provided by the application.

[0023] Figure 5 is the structural schematic diagram of the electronic device provided by the application. DETAILED DESCRIPTION

[0024] In order for those skilled in the art to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the present application are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units or modules does not necessarily limit to those steps or units or modules clearly listed, but can include other steps or units or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] ‌In the scenario of multi-party collaborative training of models under the federated learning framework, the related art has the following deficiencies: (1) the security of traditional encryption algorithms is threatened, and the interaction of model parameters is easy to cause privacy leakage; (2) attackers may use network delay or node failure and other situations to maliciously tamper with model parameters during data transmission, and the related art is difficult to adapt to complex and variable attack scenarios, and cannot effectively guarantee the integrity and authenticity of data; (3) the traditional permission management and encryption mechanism increases a large amount of calculation and communication overhead while ensuring security, affecting the progress of model training.

[0027] In order to solve the deficiencies of the related art, Figure 1 is one of the process schematic diagrams of the model training method based on federated learning and security protection provided by the present application, as Figure 1 shown, the method comprises steps 110, 120, 130 and 140.

[0028] Step 110, based on local training data, the current training of the target model is carried out, and the current model parameter is obtained; the local training data is obtained by quantum encryption on the original training data.

[0029] Specifically, the method provided by the embodiments of the present application can be applied to a scenario in which multiple participants (also referred to as “training nodes” in the present application) collaboratively train a shared global model (also referred to as “target model” in the present application) through federated learning. For example, multiple medical institutions hope to collaboratively train a disease data analysis model, but due to patient privacy and data regulation restrictions, they cannot directly share their respective original medical data. Each training node can be an institution that has a local server, and the aggregation node can be a central server or a coordinator that is alternatively assumed by one or more training nodes.

[0030] The execution subject of the model training method based on federated learning and security protection provided by the embodiments of the present application is a model training apparatus. The apparatus can be implemented by software, for example, a model training program running in a training node, or by hardware, for example, a computer, a server, or a cloud platform serving as a training node. The model training method described above can be executed by any training node.

[0031] The original training data refers to the initial data set collected by the training node locally and used for model training without any encryption processing. The form of these data can be diverse, for example, image data, text data, voice data, or structured table data, etc. Since these data usually have high sensitivity and privacy, direct use for training or sharing will bring huge security risks.

[0032] In order to provide a high level of security guarantee in the data collection stage, the original training data is processed by using quantum encryption technology in this step. Quantum encryption is not a single specific algorithm, but a general term for a class of information encryption methods using quantum mechanics principles. Its core advantage is that it can resist the cracking attacks of future quantum computers, thus realizing forward security (Forward Secrecy) and ensuring that the currently encrypted data is still secure even if the computing power breaks through in the future.

[0033] For example, the one-time quantum key can be generated by using quantum key distribution (QKD) technology . The original training data is , which is encrypted by using a quantum encryption algorithm , and the encrypted data is . . Quantum encryption is based on the basic principles of quantum mechanics and has the characteristics of non-cloning and measurement collapse, which can resist quantum computing attacks and provide extremely high security for data. The encrypted data is stored as local training data in the training node.

[0034] The target model refers to a machine learning model or a deep learning model that all training nodes hope to jointly optimize and improve through federated learning. For example, it can be a convolutional neural network for natural language processing or image recognition, or a large language model (LLM). At the beginning of each round (i.e., the current round) of training of federated learning, each training node has a version of the target model.

[0035] The training process itself can be a conventional training algorithm known to those skilled in the art, such as a backpropagation algorithm based on gradient descent. After the current round of training is completed, the internal model parameters of the target model (such as the weight parameters and bias parameters of a neural network) are updated, and these updated model parameters are the current model parameters. These parameters represent the knowledge learned by the training node from its local training data.

[0036] Step 120: Homomorphically encrypt the current model parameters to obtain the current encrypted model parameters.

[0037] Specifically, before the training node shares the locally learned knowledge (i.e., the current model parameters), in order to prevent potential attackers from inferring the corresponding original training data information by analyzing these parameters, the current model parameters are further processed for security in this step.

[0038] Homomorphic encryption technology, such as the Paillier homomorphic encryption algorithm, can be used during model training and parameter interaction. Considering that the aggregation process of federated learning usually involves weighted averaging, mainly involving addition and scalar multiplication operations, a partially homomorphic encryption scheme that supports these operations can meet the demand with relatively low computational overhead. For example, the current model parameters represented in plaintext are , the homomorphic encryption key is , and the encrypted current encrypted model parameters are . Homomorphic encryption allows certain computations to be performed on ciphertext, such as addition and multiplication, i.e., for ciphertext and , there are ( , ) and ( is a constant), and the decrypted result is consistent with the result of the same computation on plaintext. In this way, other training nodes or aggregation nodes can perform computations and updates on the ciphertext-form model parameters without decrypting the data, avoiding the risk of privacy leakage of model parameters during interaction.

[0039] After the above processing, the current model parameters in plaintext state are converted to the current encrypted model parameters in ciphertext state.

[0040] Step 130, upload the current encrypted model parameters to the aggregation node, so that the aggregation node aggregates the current encrypted model parameters sent by each training node to obtain global model parameters.

[0041] Specifically, the training node can upload the current encrypted model parameters to the aggregation node through a secure network channel. The core responsibility of the aggregation node is to collect encrypted model parameters from all (or part of) training nodes participating in this round of training and aggregate them.

[0042] Since the parameters uploaded by each training node are homomorphically encrypted, the aggregation node can perform aggregation operations without knowing the real parameter values. A typical aggregation algorithm is the federated averaging algorithm, which can be completed in the encrypted domain. For example, if Paillier algorithm is used for encryption, the aggregation node can perform addition operation in the encrypted domain on all received current encrypted model parameters (all in ciphertext), and then perform scalar multiplication (multiply the weight of the data volume of each node) in the encrypted domain, thereby obtaining the aggregated global model parameters. During the entire aggregation process, the data always remains encrypted, and the aggregation node cannot peek at the specific parameter update values of any single training node.

[0043] Global model parameters refer to model parameters obtained by aggregating encrypted model parameters calculated by all training nodes.

[0044] Step 140, receive the global model parameters distributed by the aggregation node, and perform the next training of the target model based on the global model parameters.

[0045] Specifically, after completing the aggregation operation, the aggregation node will distribute the calculated global model parameters to all participating training nodes. After receiving this global model parameter representing the collective learning achievement, the training node will use it to update or replace the model parameters of its local target model. For example, if the global model parameters are distributed in plaintext (the aggregation node has the ability to decrypt the final result, or collaborative decryption), the training node directly updates the local model with them. If the global model parameters are still encrypted, the training node needs to use its private key (in the asymmetric homomorphic encryption scheme) or shared key to decrypt and obtain the plaintext global model parameters, and then update the local model.

[0046] After the update is completed, the training node has a new target model that absorbs the knowledge of other nodes. Based on this model, the next training of federated learning can be started, that is, the above steps are repeatedly executed until the global model performance converges or reaches the preset training round.

[0047] The model training method based on federated learning and security protection provided by the embodiments of the present application performs current training on the target model based on local training data to obtain current model parameters; the local training data is obtained by quantum encryption on original training data; the current model parameters are homomorphically encrypted to obtain current encrypted model parameters; the current encrypted model parameters are uploaded to an aggregation node, so that the aggregation node aggregates the current encrypted model parameters sent by each training node to obtain global model parameters; the global model parameters distributed by the aggregation node are received, and the next training on the target model is performed based on the global model parameters; since quantum encryption is adopted in the data collection stage, high-level future-oriented security protection is provided for the original training data stored statically; since homomorphic encryption is adopted in the model parameter interaction stage, the privacy of the aggregation process is ensured, and the aggregation node or potential attackers cannot obtain the model update details of any single node; the combination of the two encryption technologies is applied in the federated learning process, and the data privacy is strictly protected in the process of collaborative training of the model, the data is not attacked or tampered with, and the efficiency of multi-party collaborative training is improved.

[0048] It should be noted that each embodiment of the present application can be freely combined, the order can be changed or executed alone, and does not need to rely on or depend on a fixed execution order.

[0049] In some embodiments, the homomorphic encryption is performed on the current model parameters, including: determining the sensitivity of the current model parameters with respect to the local training data; generating Laplace noise of the current model parameters based on the sensitivity and a preset privacy budget; adding the Laplace noise to the current model parameters; homomorphically encrypting the current model parameters to which the Laplace noise is added.

[0050] Specifically, in the model training process, noise conforming to a specific distribution is added to the model parameters for further protection of data privacy. Specifically, before homomorphic encryption is performed, a differential privacy (DP) mechanism is first introduced to provide a quantifiable privacy guarantee for the model parameters themselves, thereby constructing a double protection system of "differential privacy + homomorphic encryption".

[0051] The sensitivity is used to measure the sensitivity of the output (i.e., the current model parameters) of the model training algorithm to the change of its input (i.e., the local training data). Specifically, it is defined as the maximum change amount of the current model parameters output by the model training algorithm when an arbitrary data record is added or deleted from the local training data set. This change amount is usually measured by L1 norm or L2 norm. The current model parameters are , and the sensitivity is represented as .

[0052] The privacy budget is a core control parameter in differential privacy, used to quantify the strength of privacy protection. It is a non-negative real number, which is pre-set by the system designer or data owner. In the embodiments of the present application, a preset privacy budget The smaller the value of the preset privacy budget, the higher the privacy protection level, the more noise needs to be added, but at the same time, it may have a greater impact on the final accuracy of the model; on the contrary, the larger the preset privacy budget, the lower the privacy protection level, the smaller the noise, and the smaller the loss of model accuracy. It represents a trade-off between privacy and usability.

[0053] According to the sensitivity and the preset privacy budget, Laplace noise of the current model parameter can be generated . , where Lap represents the Laplace transform. Adding the Laplace noise to the current model parameter can be represented as . The current model parameter after adding noise. By carefully designing the distribution and strength of the noise, it is difficult for attackers to infer the original data information from the model parameters without significantly affecting the training effect of the model, ensuring that the privacy protection level of the model parameters can be quantitatively controlled.

[0054] Then the current model parameter with added Laplace noise is homomorphically encrypted.

[0055] The model training method based on federated learning and security protection provided by the embodiments of the present application combines differential privacy and homomorphic encryption organically, realizes complementary advantages and double protection. Homomorphic encryption solves the problem of privacy leakage of model parameters in the transmission and aggregation process, ensuring that the intermediate party (aggregation node) cannot steal information. Differential privacy solves the privacy problem that the "calculation result" (i.e. the model parameter itself) may leak training information. This combination scheme not only protects the confidentiality of the model parameters in the circulation process, but also provides strict and quantifiable mathematical privacy guarantees for the model itself, effectively defending against higher-level privacy attacks such as member inference and model reverse engineering, thereby improving the security protection capability of federated learning to a new height without sacrificing the collaboration of multiple parties.

[0056] In some embodiments, uploading the current encrypted model parameter to the aggregation node includes: sequentially pruning and quantizing the current encrypted model parameter to obtain a compression processing result corresponding to the current encrypted model parameter; the parameter difference between the compression processing result corresponding to the current encrypted model parameter and the compression processing result corresponding to the last encrypted model parameter is taken as an incremental update result corresponding to the current encrypted model parameter; The incremental update result is uploaded to the aggregation node.

[0057] Specifically, before uploading the current encrypted model parameters, a series of compression and difference processing is performed on the current encrypted model parameters, aiming to significantly reduce network communication overhead, reduce transmission delay, and improve the overall training efficiency of federated learning, especially in scenarios where bandwidth is limited or there are a large number of participating nodes, the effect is particularly significant. In the federated learning framework, especially when training large models (such as language models with tens of billions of parameters), a large amount of model parameters needs to be transmitted between a large number of training nodes and aggregation nodes in each round, which constitutes the main bottleneck of system performance. The embodiments of the present application effectively alleviate this problem by combining model compression and incremental update.

[0058] Pruning is a model compression technique, the basic idea of which is to remove unimportant parameters in the model and set them to zero, so that the model parameters become sparse. These unimportant parameters usually refer to weights whose absolute values are close to zero, because their contribution to the final output of the model is minimal. The training node can set a pruning threshold. Traverse all weights in the current model parameters , if the absolute value of a weight is less than the threshold, set its value to 0. The pruned model parameters can be represented as .

[0059] Pruning can be unstructured (removing individual weights at arbitrary positions) or structured (removing entire neurons or convolution kernels), the latter being more advantageous in hardware acceleration. The pruned parameter matrix will contain a large number of zeros, creating conditions for subsequent compressed storage (such as sparse matrix representation).

[0060] Quantization reduces storage and computational requirements by reducing the number of bits required to represent each parameter. For example, converting standard 32-bit floating-point numbers (FP32) to 16-bit floating-point numbers (FP16), 8-bit integers (INT8), or even lower bit numbers.

[0061] After pruning, the non-zero parameters in the model are quantized. A common quantization method is linear quantization. The training node first determines the value range (minimum and maximum) of the parameters, and then linearly maps this range to the 256 levels of the target data type (such as INT8). Each original floating-point parameter will be converted to a corresponding integer value. During quantization, the scale factor (scale) and zero point (zero-point) are recorded so that when needed, the quantized integer can be approximately dequantized back to a floating-point number.

[0062] Meanwhile, the embodiment of the present application also introduces an incremental update mechanism, which takes advantage of the fact that the model parameters change little between adjacent training rounds in federated learning, to realize differential update or incremental update.

[0063] The training node needs to store on its local storage the parameters uploaded by the previous round, which are also compressed, i.e. the compressed results of the previous encrypted model parameters . Then, the compressed results obtained in the current round are subtracted from the results stored in the previous round element by element to obtain the parameter difference between them . The parameter difference is usually more sparse than the complete model parameter vector (because many parameters may not change or change little in the current round, and the difference is zero or close to zero), and the numerical range is smaller. This difference vector is the incremental update result corresponding to the current encrypted model parameters.

[0064] The incremental update result is uploaded to the aggregation node instead of the entire model parameter. In this way, the network bandwidth occupation is greatly reduced, the data transmission time is reduced, and the efficiency of collaborative training is improved The model training method based on federated learning and security protection provided by the embodiment of the present application introduces a set of combined optimization strategies of pruning, quantization and incremental update in the communication link of federated learning. Pruning and quantization significantly reduce the data volume of the model parameters uploaded at a time, and incremental update further takes advantage of the continuity of training to only transmit the changed part of the parameters, greatly compressing the communication load. This way significantly reduces the requirement for network bandwidth and shortens the time of model uploading, thereby accelerating the overall convergence speed and training efficiency of federated learning.

[0065] In some embodiments, after receiving the global model parameters distributed by the aggregation node, the method further comprises: verifying the update record of the global model parameters based on a preset blockchain to obtain a first verification result; the preset blockchain is commonly maintained by each training node and is used to store the operation history of the local training data and / or the update record of the model parameters of the target model; verifying the hash value of the global model parameters based on a preset hash chain to obtain a second verification result; the preset hash chain is used by each training node to store the hash value of each data block in the local training data and / or the hash value of each parameter block in the model parameters of the target model; In the case where the first verification result and the second verification result are both passed, it is determined that the global model parameters have not been tampered with.

[0066] Specifically, after receiving the global model parameters distributed by the aggregation node, in order to ensure the authenticity, integrity and reliability of the source of the parameters in the distribution and receiving process, prevent malicious attacks and tampering, a double verification mechanism based on blockchain and hash chain is introduced.

[0067] A preset blockchain can be established. The operation history of the data and the update record of the model parameters are recorded by using the blockchain technology. Each participant (training node) locally maintains a blockchain node, and each block in the preset blockchain contains a block header and a block body . is the number of the current training. The block header contains the hash value of the previous block , the timestamp of the current block , the Merkle root hash value and the like. The Merkle root is the root node of the Merkle tree, which is generated by hashing all leaf nodes through layer-by-layer hashing operation, and is used for verifying data integrity and quickly locating data changes. The block body contains the operation history of the local training data and the update record of the model parameters of the target model. When the data exists operation or the model parameter changes, the relevant information is packaged into a block, a consensus is reached through the practical Byzantine fault tolerance algorithm (PBFT), and the block is added to the blockchain.

[0068] Meanwhile, a preset hash chain is created. The preset hash chain is used to store the hash values of each data block in the local training data and / or the hash values of each parameter block in the model parameters of the target model. Assuming that the th data block or parameter block is , the hash value , is the hash value of the previous data block or parameter block.

[0069] In the process of data transmission and use, the integrity of the record on the blockchain and the hash chain is verified to quickly detect whether the data is tampered with. If the hash values do not match or the blockchain record is abnormal, it can be determined that the data is tampered with, and the node where the tampering occurs can be located through the traceability function of the blockchain.

[0070] The aggregation node, after successfully generating a new global model, will act as the transaction initiator to construct a new transaction. This transaction will contain key metadata, such as the version number or iteration round of the global model, the timestamp of generating the model, the list or number of training nodes participating in this round of aggregation, and most importantly, the overall hash value of the global model parameters (usually the root hash value of the Merkle tree) for the second step of verification. The aggregation node will sign this transaction and broadcast it to the preset blockchain network maintained by all nodes. Through the consensus mechanism, this transaction is packaged into a new block and becomes an immutable public record.

[0071] When the training node receives the new global model parameter package from the aggregation node, it does not immediately accept it. The node will first access the preset blockchain and query the latest valid record on the blockchain according to the current expected iteration round. The node will compare the metadata (such as the version number) in the received model parameter package with the information recorded on the blockchain. If it can find a valid transaction record on the blockchain that matches the current iteration round and is confirmed by network consensus, it proves that the distribution behavior is authorized, legal, and the version is correct. At this time, the first verification result is passed; otherwise, it is failed, indicating that the data may be tampered with or damaged.

[0072] The training node safely extracts the overall hash value of the global model parameters from the verified blockchain transaction record. This hash value is trusted because it is recorded on an immutable blockchain.

[0073] The preset hash chain is usually implemented in the form of a Merkle tree to improve efficiency and flexibility. The aggregation node, when generating the global model, has divided the massive model parameters into blocks according to the preset rules (e.g., by neural network layer or by fixed-size data blocks). Then it calculates the hash value of each parameter block (leaf node) and constructs a Merkle tree layer by layer to finally obtain a unique root hash value. After receiving the global model parameters, the training node divides the received parameters into blocks using the same rules as the aggregation node and independently calculates the hash value of each block. Based on these block hashes, the node reconstructs a complete Merkle tree locally and calculates the final root hash value.

[0074] The training node compares the locally calculated Merkle tree root hash value with the authoritative root hash value obtained from the blockchain. If they are exactly the same, it proves that the content of the global model parameters is complete and has not been modified during the entire process from the aggregation node to the local node. At this time, the second verification result is passed; otherwise, it is failed, indicating that the data may be tampered with or damaged.

[0075] The training node performs a logical AND operation on the two verification results. Only when the first verification result and the second verification result are both passed, the node will finally determine that the received global model parameters are safe, reliable and not tampered with.

[0076] The model training method based on federated learning and security protection provided by the embodiments of the application uses the non-tamperability and traceability of the blockchain to ensure the legitimacy of the model update source, and uses the efficient verification feature of the hash chain to ensure the integrity of the model data content, thereby constructing a robust and reliable security protection system.

[0077] In some embodiments, the method further comprises: monitoring the training nodes and the aggregation node in real time to obtain data transmission traffic of each node and / or model parameter update frequency of the target model; generating training anomaly alarm information of the target model in a case where the data transmission traffic is greater than a preset traffic threshold and / or the model parameter update frequency is greater than a preset update frequency.

[0078] Specifically, the embodiments of the application provide a method of real-time monitoring and anomaly detection, which aims to discover and prevent potential malicious behavior in real time, rather than relying on encryption technology for protection. The method can be performed by a training node or an aggregation node, or a third-party node in a federated learning framework.

[0079] The training nodes and the aggregation node are monitored in real time in the whole process of data transmission, data storage and model training. The monitoring indicators mainly include, but are not limited to, the following two kinds: (1) Data transmission traffic: refers to the amount of data sent or received by a node (training node or aggregation node) in a unit of time, which can be measured in bits per second (bps) or bytes per second (B / s). The network traffic of each node in the process of uploading the current encrypted model parameters to the aggregation node is continuously tracked. The data amount uploaded by a normal training node should be related to the size and compression rate of its target model, and should be within a predictable range.

[0080] (2) Model parameter update frequency of the target model: refers to the number of times a training node attempts to upload model parameters within a certain time window (for example, within a training cycle). In the standard federated learning process, a training node should only upload the current encrypted model parameters once in a round.

[0081] The monitoring indicator vector can be defined as wherein represents data transmission traffic, represents model parameter update frequency, etc. The number of indicators. Machine learning algorithms such as the Isolation Forest algorithm or One-Class SVM can be used to analyze the monitoring data. Taking the Isolation Forest algorithm as an example, an Isolation Forest model F is constructed, and for a new monitoring data point , the path length in the Isolation Forest is calculated , if exceeds the set threshold , it is determined to be abnormal. Once an anomaly is detected, the system immediately issues an alert and suspends the related operation to prevent the tampered data from further affecting model training.

[0082] The preset traffic threshold is a critical value for determining whether the data transmission is abnormal. The preset traffic threshold can be statically set according to the size of the target model and the expected communication overhead, or dynamically set by statistically calculating the average upload traffic of certain training nodes in the past multiple rounds of training.

[0083] The preset update frequency is a critical value for determining whether the node behavior is abnormal. Typically, this value can be set to 1 time per training round.

[0084] In the case where the data transmission traffic is greater than the preset traffic threshold and / or the model parameter update frequency is greater than the preset update frequency, it can be determined that the training process of the target model is abnormal, and a training anomaly alert information can be generated. The training anomaly alert information is structured data and can include: an alert timestamp, a node identifier that triggered the anomaly, an anomaly type (traffic anomaly or frequency anomaly), a specific anomaly value, and a corresponding preset threshold. This information will be sent to the system administrator and recorded in the tamper-proof audit log. The training anomaly alert information can indicate that the data is at risk of being tampered with.

[0085] In the determination process, as long as either indicator is out of range (or logic), it can also be set to alarm only when both indicators are out of range (and logic) to balance sensitivity and false positive rate.

[0086] Thereafter, the training of the target model can be suspended based on the training anomaly alert information. The aggregation node immediately rejects and discards the current encrypted model parameters submitted by the node marked as abnormal, preventing it from polluting the global model; the aggregation calculation process of the current round can also be suspended, and no other node's parameters are received. The system administrator can decide to permanently or temporarily remove the marked node from the federated learning alliance, or manually resume the training process after confirming that it is a false alarm.

[0087] The model training method based on federated learning and security protection provided by the embodiments of the present application monitors the training nodes and aggregation nodes in real time, analyzes the data using machine learning algorithms, and timely detects and prevents tampering behavior.

[0088] In some embodiments, the method further comprises: Based on the computing performance parameters of each node in the federated learning architecture and / or the data volume of the local training data of each node, the nodes are divided into training nodes and aggregation nodes.

[0089] Specifically, the embodiments of the present application also design a hierarchical federated learning architecture, which can be divided into layers according to the significant differences in hardware configuration, network conditions and data size of each node in the federated learning architecture.

[0090] The computing performance parameters can be determined according to the hardware configuration indicators of each node (including but not limited to the number of cores and the main frequency of the central processing unit, the model and the size of the video memory of the graphics processing unit, the capacity of the memory, and the network bandwidth, etc.) and the software performance indicators (including but not limited to the computing throughput and the average computing time consumption, etc.).

[0091] According to the computing performance parameters of each node and the data volume of the local training data of each node, the comprehensive evaluation indicators of each node can be calculated by using the weighted average calculation method, which is expressed by the formula . represents the computing performance parameter of the node, represents the data volume of the local training data of the node. and are the respective weight coefficients.

[0092] According to the size of the comprehensive evaluation indicator, each node is divided into an aggregation node (high-level node) and a training node (bottom-level node). For example, the larger the comprehensive evaluation indicator, the stronger the node's ability to process data; the smaller the comprehensive evaluation indicator, the weaker the node's ability to process data. A preset indicator threshold can be set to determine the nodes with a comprehensive evaluation indicator greater than the threshold as aggregation nodes and the nodes with a comprehensive evaluation indicator less than the threshold as training nodes.

[0093] The aggregation node has strong computing power and large data size, and is responsible for handling complex computing tasks and model aggregation; the training node has relatively weak computing power and small data size, and mainly performs preliminary processing of local data and simple model training.

[0094] The training node first extracts features from the local data and performs preliminary model training to obtain the current model parameters (local model parameters), and then uploads them to the aggregation node. After receiving the model parameters of multiple training nodes, the aggregation node performs further aggregation and optimization to obtain the global model parameters.

[0095] The model training method based on federated learning and security protection provided in this application design a hierarchical federated learning architecture to optimize resource utilization and reduce communication and computing burden. This load balancing and specialized division of labor design enables the federated learning framework to be scaled more efficiently and stably to large-scale, heterogeneous node networks, significantly improving the overall performance and scalability of the system.

[0096] Figure 2 This is the second flowchart illustrating the model training method based on federated learning and security protection provided in this application. Figure 2 As shown, the method includes: Step 210: Data Acquisition and Encryption Stage.

[0097] Each participating party (training node) They used their respective acquisition devices to collect training data. .

[0098] Quantum encryption technology is used to generate quantum keys. Encrypt the original data. This ensures the security of data in the initial stages.

[0099] Encrypted data Stored locally, with the data source tagged as... and related metadata (such as collection time, data type, etc.).

[0100] Step 220: Model training and parameter interaction stage.

[0101] All participating parties Utilize encrypted data locally During model training, appropriate noise is added based on training requirements and privacy protection strategies. To model parameters In the middle, we get .

[0102] After training, homomorphic encryption technology is used to generate a homomorphic encryption key. For model parameters Encrypt The encrypted model parameters are processed using model compression and incremental update techniques to obtain the final parameters to be uploaded. .

[0103] The processed model parameters are transmitted via a secure communication channel. Uploaded to the aggregation node (central server or other participants). The interaction protocol is defined as follows: Message type: "ModelUpdate". Field information includes: "SenderID": the identity of the sender; "ReceiverID": the identity of the receiver; "UpdateParams": the processed model parameters; "Timestamp": the sending timestamp.

[0104] Step 230, data verification and model aggregation stage.

[0105] After receiving the model parameters , the receiver first verifies the integrity and authenticity of the model parameters using blockchain and hash chain, and checks for any abnormal conditions through real-time monitoring systems.

[0106] If the verification is passed and there is no abnormality, the model parameters are calculated and updated using homomorphic encryption technology, and the updated model parameters are fed back to other participants. The interaction protocol of the feedback message is defined as follows: Message type: "ModelFeedback". Field information includes: "SenderID": the identity of the sender; "ReceiverID": the identity of the receiver; "UpdatedParams": the updated model parameters; "VerificationResult": the verification result ("pass" or "fail"); "Timestamp": the sending timestamp.

[0107] The central server or designated aggregation node aggregates the model parameters uploaded by each party to generate global model parameters. Let the received model parameter set be , , where is the number of training nodes, and the global model parameters are obtained through an aggregation algorithm.

[0108] Step 240, global model distribution and update stage.

[0109] The central server distributes the aggregated global model parameters to each participant. The interaction protocol of the distribution message is defined as follows: Message type: "GlobalModelDistribution".

[0110] Field information includes: "SenderID": the identity of the central server; "ReceiverID": the identity of the receiver; "GlobalModelParams": the global model parameters; "Timestamp": the sending timestamp.

[0111] ​After receiving the global model, the participant verifies the integrity and authenticity of the model, and if the verification is passed, the global model is used to update the local model, and the next round of training begins.

[0112] The model training method based on federated learning and security protection provided by the embodiments of the application fuses quantum encryption, homomorphic encryption, differential privacy, blockchain, hash chain, machine learning monitoring, hierarchical architecture, and model compression and incremental updating, and constructs a safe and efficient federated learning environment. The method uses a mathematical model to quantitatively analyze and optimize the data privacy protection and model training process, and defines an explicit interaction protocol to specify the data transmission and collaboration process between the participants. Innovations are made in data encryption, model parameter protection, data integrity verification, and collaboration process optimization to ensure that data privacy is strictly protected and data is not tampered with, while improving the efficiency of multi-party collaborative training.

[0113] The device provided by the embodiments of the application is described below, and the device described below can be correspondingly referred to the method described above.

[0114] Figure 3 is a structural schematic diagram of the model training device based on federated learning and security protection provided by the application, as Figure 3 indicated, the model training device based on federated learning and security protection 300 comprises: The local training module 310 is configured to perform current training on the target model based on the local training data to obtain current model parameters, wherein the local training data is obtained by quantum encrypting the original training data; The parameter encryption module 320 is configured to perform homomorphic encryption on the current model parameters to obtain current encrypted model parameters; The parameter uploading module 330 is configured to upload the current encrypted model parameters to the aggregation node, so that the aggregation node aggregates the current encrypted model parameters sent by each training node to obtain global model parameters; The parameter receiving module 340 is configured to receive the global model parameters distributed by the aggregation node, and perform next training on the target model based on the global model parameters.

[0115] The model training device based on federated learning and security protection provided by the embodiments of the application, because quantum encryption is used in the data collection stage, it provides high-level future-oriented security protection for the static storage of the original training data. Because homomorphic encryption is used in the model parameter interaction stage, the privacy of the aggregation process is ensured, and the aggregation node or potential attackers cannot obtain any single node model update details. The combination of the two encryption technologies applied in the federated learning process ensures that the data privacy is strictly protected and the data is not attacked or tampered with during the collaborative training of the model, and the efficiency of multi-party collaborative training is improved.

[0116] Figure 4 is a structural schematic diagram of a model training system based on federated learning and security protection provided by the present application, as shown in Figure 4 The model training system based on federated learning and security protection 400 includes a plurality of nodes 410; the plurality of nodes constitute a federated learning architecture, which is used to execute the model training method based on federated learning and security protection in the above embodiments to train the target model.

[0117] The model training system based on federated learning and security protection provided by the embodiments of the present application ensures that data privacy is strictly protected and data is not attacked or tampered with during the process of cooperatively training the model, and the efficiency of multi-party cooperative training is improved, because the nodes execute the method in the above embodiments.

[0118] Figure 5 is a structural schematic diagram of an electronic device provided by the present application, as shown in Figure 5 The electronic device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor, the communications interface, and the memory complete mutual communication through the communications bus. The processor can invoke a logical command in the memory to execute the method described in the above embodiments, for example: performing current training on the target model based on local training data to obtain current model parameters; the local training data is obtained by quantum encryption on the original training data; homomorphically encrypting the current model parameters to obtain current encrypted model parameters; uploading the current encrypted model parameters to the aggregation node, so that the aggregation node aggregates the current encrypted model parameters sent by each training node to obtain global model parameters; receiving the global model parameters distributed by the aggregation node, and performing next training on the target model based on the global model parameters.

[0119] In addition, the logic commands in the memory described above can be implemented in the form of a software function unit and sold or used as a separate product, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of commands to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0120] The processor in the electronic device provided by the embodiments of the present application can call the logic instructions in the memory to implement the above-mentioned method, and the specific implementation manners are consistent with the above-mentioned method implementation manners, and the same beneficial effects can be achieved, which will not be described here.

[0121] The embodiments of the present application also provide a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method provided by the above-mentioned embodiments.

[0122] The specific implementation manners are consistent with the above-mentioned method implementation manners, and the same beneficial effects can be achieved, which will not be described here.

[0123] The embodiments of the present application provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the above-mentioned method.

[0124] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0125] Those skilled in the art can clearly understand the implementation of the various embodiments by means of software and the necessary general hardware platform from the above description of the embodiments, and of course, the embodiments can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that contributes to the technical solutions can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the methods.

[0126] Finally, it should be noted that: the above examples are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A model training method based on federated learning and security protection, characterized in that, include: The target model is trained using local training data to obtain the current model parameters. The local training data is obtained by quantum encryption of the original training data. The current model parameters are homomorphically encrypted to obtain the current encrypted model parameters; The current encrypted model parameters are uploaded to the aggregation node, so that the aggregation node can aggregate the current encrypted model parameters sent by each training node to obtain the global model parameters; Receive the global model parameters distributed by the aggregation node, and perform the next training on the target model based on the global model parameters.

2. The model training method based on federated learning and security protection according to claim 1, characterized in that, The process of homomorphically encrypting the current model parameters includes: Determine the sensitivity of the current model parameters relative to the local training data; Based on the sensitivity and the preset privacy budget, Laplace noise is generated for the current model parameters; Add the Laplace noise to the current model parameters; Homomorphic encryption is applied to the parameters of the current model with added Laplace noise.

3. The model training method based on federated learning and security protection according to claim 1, characterized in that, Uploading the current encryption model parameters to the aggregation node includes: The current encryption model parameters are pruned and quantized sequentially to obtain the compression result corresponding to the current encryption model parameters; The parameter difference between the compression processing result corresponding to the current encryption model parameters and the compression processing result corresponding to the previous encryption model parameters is used as the incremental update result corresponding to the current encryption model parameters. The incremental update results are uploaded to the aggregation node.

4. The model training method based on federated learning and security protection according to claim 1, characterized in that, After receiving the global model parameters distributed by the aggregation node, the method further includes: The update records of the global model parameters are verified based on a preset blockchain to obtain a first verification result; the preset blockchain is jointly maintained by each training node and is used to store the operation history of the local training data and / or the update records of the model parameters of the target model. The hash values ​​of the global model parameters are verified based on a preset hash chain to obtain a second verification result; the preset hash chain is used by each training node to store the hash values ​​of each data block in the local training data and / or the hash values ​​of each parameter block in the model parameters of the target model; If both the first and second verification results are passed, it is determined that the global model parameters have not been tampered with.

5. The model training method based on federated learning and security protection according to claim 1, characterized in that, The method further includes: The training nodes and the aggregation nodes are monitored in real time to obtain the data transmission traffic of each node and / or the model parameter update frequency of the target model; If the data transmission traffic exceeds a preset traffic threshold and / or the model parameter update frequency exceeds a preset update frequency, an alarm message for training anomalies in the target model is generated.

6. The model training method based on federated learning and security protection according to claim 1, characterized in that, The method further includes: Based on the computational performance parameters of each node in the federated learning architecture and / or the amount of local training data of each node, each node is divided into training nodes and aggregation nodes.

7. A model training device based on federated learning and security protection, characterized in that, include: The local training module is used to perform the current training on the target model based on local training data to obtain the current model parameters. The local training data is obtained by quantum encryption of the original training data. The parameter encryption module is used to perform homomorphic encryption on the current model parameters to obtain the current encrypted model parameters; The parameter upload module is used to upload the current encrypted model parameters to the aggregation node, so that the aggregation node can aggregate the current encrypted model parameters sent by each training node to obtain global model parameters. The parameter receiving module is used to receive the global model parameters distributed by the aggregation node, and to perform the next training of the target model based on the global model parameters.

8. A model training system based on federated learning and security protection, characterized in that, Includes multiple nodes; The plurality of nodes constitute a federated learning architecture for executing the model training method based on federated learning and security protection as described in any one of claims 1 to 6, and for training the target model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the model training method based on federated learning and security protection as described in any one of claims 1 to 6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the model training method based on federated learning and security protection as described in any one of claims 1 to 6.

Images