Byzantine robust federated learning method and system based on safe two-party calculation

Abstract

The invention relates to the technical field of federated learning, in particular to a Byzantine robust federated learning method and system based on safe two-party calculation. According to the method, a client adds a local mask in an updated local gradient to obtain an addition secret sharing share of the local gradient, and sends the addition secret sharing share to a server B; and after receiving the shared share of the local gradient, the server B informs the server A of the currently received Hash value of the client ID, and the server A uses the same local mask as the shared share. And the server A and the server B jointly perform local gradient aggregation to obtain two addition shared shares of the global model. And the server B receives the addition shared share of the server A and then combines the addition shared share to obtain a global model with a global mask. And the client performs global mask recovery through the global model issued by the server B to obtain a plaintext of the global model. According to the application, the privacy protection of federal learning can be effectively realized, and the Byzantine robust aggregation protocol is executed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning, in particular to a Byzantine robust federated learning method and system based on secure two-party computation. BACKGROUND

[0002] Federated learning is a distributed machine learning paradigm, in which several clients in a federated learning system train local models locally and upload the trained models to a server for aggregation, thereby protecting local training data. Malicious servers can reverse-engineer training data, including images and text snippets, by gradient, which is also known as gradient inversion attack, causing the leakage of private data of clients.

[0003] Byzantine failure refers to the uploading of incorrect model parameters (gradients) by malicious or faulty participants in a federated learning system to disrupt the training process of the global model and reduce the usability of the global model.

[0004] Existing federated learning systems cannot balance privacy data protection and Byzantine robustness, making it difficult to protect privacy data while preventing malicious clients from uploading incorrect data. The present application proposes a Byzantine robust federated learning method and system based on secure two-party computation, which can effectively implement privacy protection in federated learning and efficiently execute several main Byzantine robust aggregation protocols. SUMMARY

[0005] To overcome the problems in the related art, the first aspect of the present application provides a Byzantine robust federated learning method based on secure two-party computation, applied to a federated learning system under a double-server architecture, comprising: In response to a federated learning request, the client and server A generate a shared global mask and a local mask; The client adds the local mask to the updated local gradient to obtain the additive secret sharing of the local gradient and sends it to server B; After server B receives the shared part of the local gradient, it informs server A of the hash value of the current received client ID; Server A selects the global mask of the local gradient of the receiving client using the hash value and correctly corresponds with the shared part information of server B; Server A and server B jointly aggregate the local gradient to obtain two additive shared parts of the global model; Server A sends the additive shared parts of the global model to server B through the global mask, and server B receives and merges to obtain the global model with the global mask; Server B issues the global model with the mask to the client, and the client recovers the plaintext global model through the global mask.

[0006] In an embodiment, the client and the server A generate a shared global mask and a local mask, specifically including: The client needs to establish a connection with the server A and perform anonymous key negotiation first, and the two parties negotiate to generate a public seed key set for generating a random mask, and use the hash value of the client ID as an index; The client and the server A generate synchronized global masks and local masks through the public seed key set according to the input seed key and the training round.

[0007] In an embodiment, the client adds a local mask to the updated local gradient to obtain an additive secret sharing share of the local gradient and sends it to the server B, specifically including: The client adds a local mask and a shuffle mask to the updated local gradient to obtain an additive secret sharing share of the local gradient and sends it to the server B; The server B homomorphically encrypts the double-masked gradient share, and then sends it to the server A for shuffling operation.

[0008] In an embodiment, the server A performs shuffling operation, specifically including: Send the double-masked gradient share to the server B, and the server B uses additive semi-homomorphic encryption to encrypt the gradient share; the double-masked gradient share is an additive secret sharing share with a local mask and a shuffle mask; Send the double-masked gradient share ciphertext to the server A, and attach the hash value of the client ID to retrieve the mask corresponding to each gradient ciphertext; The server A eliminates the shuffle mask disorder and the order of all client gradient ciphertexts in the ciphertext state according to the homomorphic property; Send the single-masked gradient ciphertext after shuffling to the server B, and the server B decrypts the gradient ciphertext using its own decryption key to obtain the gradient share plaintext.

[0009] In an embodiment, the server B receives a global model with a global mask after merging, specifically including: After receiving the additive sharing share sent by the server A, the server B performs global aggregation through the MPC operator.

[0010] The second aspect of the application provides a Byzantine robust federated learning system based on secure two-party computation, which performs federated learning based on the steps in the above Byzantine robust federated learning method, and includes a server A, a server B, and a plurality of clients; The server A is used for key negotiation with the client, and obtains the local gradient trained by the client through secret sharing; The server B is configured to obtain secret sharing shares of the global model by secret sharing with the server A, and perform global model aggregation. The client is configured to train the global model locally, and upload local gradients to the server A by secret sharing.

[0011] The technical scheme provided in the application can include the following beneficial effects. The Byzantine robust federated learning method provided in the application performs local mask encryption on the local gradients of the client by key seed multiplexing, performs global aggregation on the additive secret sharing shares sent by the client by the server A and the server B, performs second encryption between the server A and the server B by a global mask, prevents any server from obtaining the plaintext global model, and eliminates the mask by the client after aggregation to obtain the plaintext global model. In this learning paradigm, any participant cannot infer the input and output data of any other participant through the interaction data in the calculation process, ensures that the data is aggregated and Byzantine detected in an encrypted state, and avoids plaintext leakage.

[0012] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the application. BRIEF DESCRIPTION OF DRAWINGS

[0013] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which like reference characters refer to like parts throughout the several views, and in which preferred embodiments of the application are shown.

[0014] Figure 1 A flowchart of the Byzantine robust federated learning method shown in the embodiment of the application; Figure 2 A key negotiation process diagram of the client of the method shown in the embodiment of the application before training; Figure 1 A model parameter secret sharing process diagram of the method shown in the embodiment of the application during training; Figure 3 Figure 1 A model parameter security shuffling process diagram of the method shown in the embodiment of the application for the client. Figure 4 A model parameter security shuffling process diagram of the method shown in the embodiment of the application for the client. Figure 1 DETAILED DESCRIPTION

[0015] The preferred embodiments of the application will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the application are shown in the drawings, it should be understood that the application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to make the application more thorough and complete, and to fully convey the scope of the application to those skilled in the art.​​

[0016] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting. As used in this application and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or," as used herein, refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0017] It should be understood that although the terms "first," "second," "third," etc. can be used herein to describe various information, these terms are not intended to denote a particular order or hierarchy. These terms are used merely to distinguish one from another. For example, a first information can also be referred to as a second information, and similarly, a second information can also be referred to as a first information, without departing from the scope of the present application. Therefore, the features defined with "first," "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specifically defined.

[0018] If there is no encryption or fragmentation protection for local gradients when the client uploads the locally trained gradients, an untrusted aggregation server can deduce the client's original training data by analyzing the plaintext state of the local model gradient (such as neural network weight updates) after receiving the plaintext state of the local model gradient.

[0019] The present application provides a general federated learning framework that realizes gradient privacy protection through a double-server architecture secret sharing and combines multiple Byzantine detection mechanisms to ensure model robustness.

[0020] Figure 1 A flowchart of the Byzantine robust federated learning method shown in the embodiments of the present application.

[0021] The following will be described in conjunction with Figure 1 The federated learning method shown in the embodiments of the present application will be specifically described, as shown in Figure 1 which includes steps 101 to 107.

[0022] Step 101, in response to a federated learning request, the client and server A generate a shared global mask and a local mask.

[0023] As shown in Figure 2 and Figure 3 , in step 101, specifically includes: Step 201, the client needs to establish a connection with server A first and perform anonymous key negotiation. Both parties negotiate to generate a public seed key set for generating a random mask, and use the hash value of the client ID as an index.

[0024] When a client joins the federated group, the client needs to establish a connection with server A and perform key agreement first. The two parties negotiate to generate a set of public seed keys for generating random masks, which contains two seed keys: . This enables both parties to generate the same random mask synchronously, reducing the doubled communication of secret sharing in the traditional two-server architecture.

[0025] In one implementation of the key agreement, an elliptic curve-based key agreement protocol is used to generate seed keys, which negotiates a shared key using a fixed key pair (i.e., a static key pair) on both sides. Due to the application scenario, the negotiated key is not used for communication, but is used locally for a long time, and does not need to have forward security. Selecting a negotiation protocol that is sufficiently secure and efficient is the most suitable, which can save certain system resources. To reduce information leakage, anonymous communication is required using the client ID hash value.

[0026] It can be understood that each training round of each client ID corresponds to a hash value, and in subsequent steps, the server looks up the mask by the hash value.

[0027] Step 202, the client and server A generate synchronized global masks and local masks according to the input seed key and training round.

[0028] Step 202 is the pre-training mask generation. Before being selected to participate in a certain round of training, the client and server 2 need to generate a random mask locally in advance and record the number of mask generations . According to the input seed key and the number of times , the pseudo-random number generator (PRG) will generate different random masks each time . respectively are the first times generated random masks for global model recovery and local gradient upload; for server 2, is the other half of the secret share of the local gradient used for robust aggregation, is the mask for the secure distribution of the global model used for aggregation.

[0029] Step 102, the client adds the local mask to the updated local gradient to obtain the additive secret sharing share of the local gradient and sends it to server B.

[0030] A semi-honest server will filter out the model gradient submitted by a Byzantine user when performing robust aggregation. After knowing the client to which the filtered gradient belongs, some private information can be inferred.

[0031] ​Further, in one implementation of step 102, the application shuffles the local gradient uploaded by the client before aggregation, to confuse the server's perspective of which client each gradient specifically belongs to.

[0032] As shown in Figure 4 , when the client completes the local training of this round, the updated local gradient is added to the mask: . Get the additive secret sharing share of the local gradient, and send it to server B, while determining that the other party has accepted the gradient share, and generating the mask set used in the next round in advance .

[0033] Further, step 102 specifically includes: 301. The client adds a local mask and a shuffle mask to the updated local gradient to obtain an additive secret sharing share of the local gradient and sends it to server B; 302. Server B homomorphically encrypts the double-masked gradient share, and then sends it to server A for shuffling.

[0034] The application safely shuffles the source of each local model gradient before aggregation, which can directly eliminate privacy threats in this regard and improve the effect of privacy protection.

[0035] In step 302, the shuffling operation specifically includes: 400. When the client joins the federation group and performs key negotiation, an additional seed key is generated to generate a mask . When performing secret sharing on the local gradient, an additional mask is added: .

[0036] 401. Send the double-masked gradient share to server B, and server B uses additive semi-homomorphic encryption to encrypt the gradient share to get ; the double-masked gradient share is an additive secret sharing share with a local mask and a shuffle mask.

[0037] 402. Send the double-masked gradient share ciphertext to server A, and attach the hash value of the client ID to retrieve the mask corresponding to each gradient ciphertext.

[0038] 403. Server A removes the shuffle mask and scrambles the order of all client gradient ciphertexts according to the homomorphic property in the ciphertext state; that is, .

[0039] 404. Send the shuffled single-masked gradient ciphertext to server B, and server B decrypts the gradient ciphertext with its own decryption key to get the gradient share plaintext.

[0040] The shuffling method of the embodiment of the application starts from the client submitting the local gradient, an additional mask is added in it, then the homomorphic encryption is performed on the gradient share of the double mask, and then it is sent to server A for shuffling operation. Since the plaintext information at this time is completely different from the information sent by the client, it cannot be inferred that these gradient shares originally belong to which client.

[0041] In step 103, after server B receives the shared share of the local gradient, it informs server A of the hash value of the current received client ID; In step 104, server A selects the global mask of the local gradient of the received client by using the hash value, and correctly corresponds with the shared share information of server B.

[0042] In step 104, after server B receives the shared share of the local gradient, it informs server A of the hash value and order of the client ID of the received gradient, so that server A selects the corresponding mask of the local gradient of the received client , and correctly corresponds with the shared share information of server B, so that both sides can confirm the two additive shared secret shares of the local gradient participating in the model aggregation.

[0043] Step 105, server A and server B jointly perform local gradient aggregation to obtain two additive shared shares of the global model.

[0044] Two servers jointly execute the robust aggregation algorithm to obtain two additive shared shares of the aggregated global model: , and are respectively held by server A and server B, is the global training round.

[0045] Step 106, server A sends the additive shared share of the global model to server B through the global mask, and server B receives and merges to obtain the global model with the global mask.

[0046] Server A adds the global mask to its own share and sends it to server B, and server B receives and merges to obtain the global model with the global mask, obtaining the additive secret sharing of the global model corresponding to the client . .

[0047] The existing security two-party calculation based on secret sharing can only support basic multiplication and addition linear operations, and thus the common method for processing nonlinear operations (such as division, square root, logarithm, etc.) is to use Newton iteration method (combination of linear operations) to perform multiple operations to obtain an approximate value of the calculated value. However, this method has obvious disadvantages, that is, multiple operations will bring high communication and calculation overhead, and since the obtained value is an approximate value, the performance of the aggregated model is inevitably affected.

[0048] The embodiments of the present application also provide a nonlinear security two-party operator, which can effectively improve the efficiency of the Byzantine robust aggregation algorithm executed by two servers, reduce the communication and calculation amount, and make the performance of the aggregated model comparable to that of the plaintext aggregation model. The nonlinear security two-party operator includes "division", "square root", "logarithm", "exponent", and "comparison".

[0049] The embodiments of the present application combine the above operators, and can implement the existing various mainstream robust aggregation algorithms, and are also compatible with other robust algorithms, thereby achieving a universal effect.

[0050] Further, the step 106 specifically includes that after receiving the addition sharing share sent by the server A, the server B performs global aggregation through the MPC operator.

[0051] In the division operator, the implementation of the division operator is to fully utilize the local calculation capacity of the device and combine the multiplication method of the addition secret sharing, and the principle includes the following steps: Suppose that the server A and the server B hold the secret sharing of the number a and the number b.

[0052] 1.1, the two parties respectively take random values r1 and r2 as the addition shares of r, perform a secure multiplication protocol, calculate , and send the obtained two addition shares to each other.

[0053] Wherein, r is a fictitious non-zero value, which is unknown to both parties, so even if b*r becomes a public value, the value of b cannot be inferred.

[0054] 1.2, locally calculate 1 / (r*b), and then respectively let x1=r1 / (r*b) and x2=r2 / (r*b).

[0055] Wherein, r1 / r and r2 / r can be regarded as two proportional numbers, and the sum of the two is 1, so x1 and x2 are two addition secret shares of 1 / b.

[0056] 1.3, the multiplication protocol of the secret sharing is called again, and the secret shares of and are input, and the addition secret share of can be obtained.

[0057] In the square root operator, the whole logic of the square root operator is to convert the additive secret sharing into the multiplicative secret sharing, that is, to convert into .

[0058] Server A and server B perform square root calculation locally to get , and then use the additive secret sharing multiplication protocol to get Additive secret sharing:

[0059] The conversion protocol of the multiplicative secret sharing in it is as follows: Let server A and server B hold the additive secret shares x and y respectively.

[0060] (1) Server A locally generates a non-zero random number a and 1 / a, and server B locally generates a non-zero random value v and 1 / v.

[0061] (2) Perform the additive secret sharing of the multiplication protocol to calculate y / a, and server A gets y1 / a and server 2 gets y2 / a, where y1+y2=y.

[0062] (3) Server A and server B locally calculate (x+y1) / a and y2 / av respectively.

[0063] (4) Perform the multiplication protocol to calculate the secret sharing of (x+y1) / av by inputting (x+y1) / a and 1 / v respectively, and server A and server B get s1=value1 / av and s2=value2 / av respectively, where value1+value2=x+y1.

[0064] (5) Server B sends y2 / av to server A, and server A restores (x+y) / av, and then multiplies a to get (x+y) / v, denoted as u.

[0065] At this point, u*v=x+y. The conversion of the multiplicative secret sharing is completed.

[0066] The remaining other nonlinear operators can be implemented on the basis of the above operators: For example, the logarithm operator includes the following steps: 2.1, for , calculate : 2.2, use the multiplication conversion protocol to get .

[0067] 2.3, locally calculate , that is, satisfy .

[0068] 2.4, for , compute .

[0069] The logarithm operator is calculated first by the above steps , according to the change of base formula, , and then the division operator is called, so that the additive secret sharing of is obtained.

[0070] In the exponential operator, the following steps are included: 3.1, for , compute : 3.2, calculate by the logarithm method.

[0071] 3.3, perform the multiplication protocol on to obtain .

[0072] 3.4, both parties locally calculate .

[0073] Perform the multiplication protocol on the result of 3.3 to obtain: , that is, the additive secret sharing is obtained.

[0074] In the comparison operator, the following steps are included: 4.1, for , compare the size relationship of the two: 4.2, locally calculate the additive secret sharing of the two , that is .

[0075] 4.3, perform the multiplication secret sharing conversion on to obtain , if there is zero among them, then the size relationship of can be directly obtained , otherwise, perform 4.4.

[0076] 4.4, for , the server respectively converts them into binary number complements in local, and extracts the most significant bit (sign bit) MSB( ), MSB( ).

[0077] 4.5, send their own most significant bits to each other, and then perform XOR operation on the two most significant bits: , according to the result, the positive and negative signs of can be judged, and then the size relationship of is obtained.

[0078] Step 107, server B sends the global model with the mask to the client, and the client restores the plaintext global model through the global mask.

[0079] Server B sends to the client participating in the next round of training, and server A can generate the mask of the next round of clients in advance .

[0080] Further, considering that if the masks for restoring the global model are the same, the client that exits in the middle of the way may intercept the global model share and restore the complete model, the masks used for each client are not the same, and the distributed global model shares are also different, so even if intercepted, the global model cannot be restored.

[0081] Based on the Byzantine robust federated learning method disclosed in the embodiments of the present application, the embodiments of the present application also provide a Byzantine robust federated learning system based on secure two-party computation, which comprises a server A, a server B and a plurality of clients.

[0082] The server A is configured to perform key negotiation with the client, and obtain the local gradient trained by the client through secret sharing; the server B is configured to obtain the secret sharing share of the global model through secret sharing with the server A, and perform global model aggregation; and the client is configured to train the global model locally, and upload the local gradient to the server A through secret sharing.

[0083] The scheme of the present application has been described in detail above with reference to the drawings. In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments. Those skilled in the art should also know that the actions and modules involved in the specification are not necessarily required by the present application. In addition, it can be understood that the steps in the method embodiments of the present application can be adjusted, combined and reduced in sequence according to actual needs, and the modules in the device embodiments of the present application can be combined, divided and reduced according to actual needs.

[0084] In addition, the method according to the present application can also be implemented as a computer program or computer program product, which includes computer program code instructions for executing part or all of the steps in the above method of the present application.

[0085] Alternatively, the application can also be implemented as a non-transitory machine readable storage medium (or computer readable storage medium, or machine readable storage medium) on which an executable code (or computer program, or computer instruction code) is stored, and when the executable code (or computer program, or computer instruction code) is executed by a processor of an electronic device (or electronic device, server, etc.), the processor is caused to perform part or all of the steps of the above method according to the application.

[0086] Those skilled in the art will further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the present disclosure can be implemented as electronic hardware, computer software, or combinations of both.

[0087] The flow diagrams and block diagrams in the drawings are presented to illustrate the architecture, functionality, and operations of possible implementations of systems and methods according to various embodiments of the present application. In this regard, each block in the flow diagrams and block diagrams can represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may be executed in the reverse order, depending on the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0088] The embodiments of the present application have been described above, the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes are obvious to those skilled in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles, practical applications, or improvements to the technology in the market of the embodiments, or to enable other ordinary skilled in the art to understand the embodiments disclosed herein.

Claims

1. A Byzantine robust federated learning method based on secure two-party computation, characterized in that, Federated learning systems applied in a dual-server architecture include: In response to the federated learning request, the client and server A generate a shared global mask and a local mask; The client adds a local mask to the updated local gradient, obtains the additive secret shared share of the local gradient, and sends it to server B; After receiving the shared share of the local gradient, server B informs server A of the hash value of the currently received client ID; Server A uses hash values ​​to select the global mask of the local gradient received by the client and correctly matches it with the shared share information of server B. Server A and Server B jointly perform local gradient aggregation to obtain two additive shared shares of the global model; Server A sends the addition-shared portion of the global model to server B through a global mask. After receiving the data, server B merges the data to obtain a global model with the global mask. Server B sends a global model with a mask to the client, and the client recovers the plaintext global model by using the global mask.

2. The Byzantine robust federated learning method according to claim 1, characterized in that, The client and server A generate shared global and local masks, specifically including: The client needs to first establish a connection with server A and perform anonymous key negotiation. The two parties negotiate to generate a public seed key set for generating random masks, and use the hash value of the client ID as an index. Based on the input seed key and training round, the client and server A generate synchronized global and local masks using a common seed key set.

3. The Byzantine robust federated learning method according to claim 1, characterized in that, The client adds a local mask to the updated local gradient, obtains the additive secret shared share of the local gradient, and sends it to server B, specifically including: The client adds a local mask and a shuffle mask to the updated local gradient, obtains the additive secret shared share of the local gradient, and sends it to server B; Server B performs homomorphic encryption on the gradient shares of the double mask before sending them to server A for shuffling.

4. The Byzantine robust federated learning method according to claim 3, characterized in that, The shuffling operation performed by server A specifically includes: A double-mask gradient share is sent to server B, and server B encrypts the gradient share using additive semi-homomorphic encryption; the double-mask gradient share is an additive secret shared share that incorporates a local mask and a shuffle mask. Send the double-mask gradient share ciphertext to server A, along with the hash value of the client ID, to retrieve the mask corresponding to each gradient ciphertext; Server A, based on the homomorphic property, removes the shuffle mask in the ciphertext state and shuffles the order of all client gradient ciphertexts; The shuffled single-mask gradient ciphertext is sent to server B. Server B decrypts the gradient ciphertext using its own decryption key to obtain the gradient share plaintext.

5. The Byzantine robust federated learning method according to claim 1, characterized in that, After receiving and merging the data, server B obtains a global model with a global mask, specifically including: After receiving the addition shared shares sent by server A, server B performs global aggregation using the MPC operator.

6. A Byzantine robust federated learning system based on secure two-party computation, characterized in that, Federated learning is performed based on the steps of the Byzantine robust federated learning method according to any one of claims 1 to 5, including server A, server B and several clients; Server A is used to negotiate keys with the client and obtain the local gradients trained by the client through secret sharing; Server B is used to obtain the secret sharing share of the global model with Server A through secret sharing, and to perform global model aggregation; The client is used to train a global model locally and upload local gradients to server A via secret sharing.

Images