Lightweight hybrid defense method and system for federated learning gradient leakage

Abstract

The invention discloses a lightweight hybrid defense method and system for federated learning gradient leakage, and the method comprises the steps: firstly calculating the importance of model parameters based on local data through employing Fisher information, and generating a local important parameter mask; a plurality of clients jointly determine a global encryption parameter set, important parameters are reserved locally as personalized knowledge, and other non-key parameters are classified into a noise area; the client performs homomorphic encryption on the global encryption parameter set by using the public key, adds differential privacy noise to the parameters in the noise area, and uploads the processed parameters; the system adopts a double-server architecture, an aggregation server aggregates encryption parameters and noise parameters respectively, a key server is responsible for decrypting the aggregated encryption parameters and merging the encrypted parameters with the noise parameters, and through selective encryption and personalized parameter reservation, the calculation and communication overhead is remarkably reduced, and the system has the advantages of being high in security and high in reliability. And meanwhile, relatively high model accuracy and strong privacy protection capability are still kept in a non-independent identically distributed data environment.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of cybersecurity and artificial intelligence, specifically involving privacy protection technology in federated learning, and in particular a lightweight hybrid defense method and system for gradient leakage in federated learning. Background Technology

[0002] Federated learning, as an emerging distributed machine learning paradigm, allows multiple participants to collaboratively train a shared machine learning model without sharing their local raw data, thus protecting data privacy by design. However, even though data remains local, the model gradients or parameter updates exchanged during training in federated learning can still leak important user information. Research shows that malicious attackers, especially "honest but curious" servers, can reconstruct part or even all of the original training data from the shared gradients through techniques such as gradient inversion attacks, posing a serious threat to the privacy and security of federated learning. To address such threats, existing technologies mainly employ differential privacy (DP), homomorphic encryption (HE), and secure multi-party computation (SMPC). Differential privacy provides mathematically provable privacy guarantees by injecting noise into the gradients, but this method often comes at the cost of model accuracy; the greater the noise, the higher the level of privacy protection, but the more severe the degradation in model performance. While secure multi-party computation can achieve secure gradient aggregation, its communication and computation protocols are extremely complex and costly, making it difficult to scale to large-scale federated learning scenarios or those with frequent client outages. Homomorphic encryption allows direct computation on ciphertext, enabling the aggregation of encrypted gradients from various clients without decryption, providing strong privacy protection without sacrificing model accuracy. However, fully homomorphically encrypting all model parameters incurs extremely high computational and communication overhead, making it impractical for resource-constrained clients (such as mobile devices). Furthermore, in real-world scenarios with heterogeneous data (non-IID), the vastly different data distributions across clients result in varying parameters that play a crucial role in performance across different models. This presents new challenges for the design of selective encryption schemes: how to dynamically and efficiently identify and protect truly important parameters while ensuring security, and how to balance privacy, performance, and overhead, remains a core challenge for current technologies. Summary of the Invention

[0003] The purpose of this invention is to provide a lightweight hybrid defense method and system for federated learning gradient leakage, so as to overcome the shortcomings of existing technologies such as excessive overhead of fully homomorphic encryption and compromise of the utility of differential privacy models.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A lightweight hybrid defense method for gradient leakage in federated learning includes the following steps: S1, the client evaluates the importance of parameters by calculating Fisher information for each model parameter based on its local data, and generates a local important parameter mask; S2, the multiple clients participating in the training negotiate and divide all model parameters into three parts: encryption area, personalized area and noise area according to the local important parameter mask; S3, the client uses a public key to perform homomorphic encryption on the model parameters in the encrypted area, adds differential privacy noise to the model parameters in the noise area, and retains the parameters in the personalized area locally without uploading them; S4, the client uploads the homomorphically encrypted parameters and the parameters with added differential privacy noise to the aggregation server; S5, the aggregation server performs ciphertext aggregation on the received encryption parameters and plaintext aggregation on the received noise parameters, and sends the aggregation result to the key server. S6, the key server uses its private key to decrypt the aggregated encrypted parameters, and then merges them with the aggregated noise parameters to update the global model; S7, the key server distributes the updated global model to the client; S8: The client receives the global model and merges it with the locally retained personalized parameters to form a new local model for training. S9, repeat S1 to S8, until the federated learning model converges.

[0005] Preferably, in step S1, the client generates a local important parameter mask in the following way: Client First, in its local dataset Perform local training to obtain model updates. Subsequently, the client... Its model parameters need to be evaluated. The importance of this parameter is measured using Fisher information in this example. Fisher Information Calculated using the following formula: , in It is a loss function; The client performs Min-Max normalization on the Fisher information scores within each model layer:

[0006] in, Indicates the first Among the layer's parameters, the largest Fisher information value is... Indicates the first The smallest Fisher information value among the layer's parameters; Client Set an importance threshold The normalized Fisher information score is higher than The parameter set is defined as the local important parameter mask. : .

[0007] Preferably, in step S2, multiple clients negotiate and divide the three parameter areas in the following way: Encrypted area : By the majority (more than a preset consensus ratio) These parameters are collectively considered important by the clients. These parameters are crucial to the model's performance, therefore strong privacy protection measures are employed. A consensus threshold hyperparameter is used. Decision. A parameter position. It is included in the encrypted area if and only if it exceeds the specified proportion. The client is marked as important:

[0008] Personalized Zone These are parameters that are important only to one or a small number of clients, but for which there is no global consensus. These parameters reflect the personalized characteristics of the client. For the client... In other words, its personalized area contains those in its local mask. It is in the middle, but not included in the global encryption zone. Parameters:

[0009] Noise area For the remaining non-critical parameters, which have a minor impact on performance, noise can be added for protection. .

[0010] Preferably, the aggregation server As a semi-trusted server, it only holds the public key and is responsible for performing ciphertext computation; the key server As a trusted server, it independently holds the private key and is responsible for key generation, distribution, and final ciphertext decryption.

[0011] Preferably, in step S3, the homomorphic encryption uses the CKKS method that supports floating-point arithmetic, the differential privacy noise uses a Gaussian mechanism, and the privacy budget is calculated and controlled through Rényi differential privacy.

[0012] Preferably, in step S8, the client merges the model in the following way: the personalized area parameters maintain the state of the previous round, and the global model received from the server is used to update the parameters of the encrypted area and the noise area.

[0013] A lightweight hybrid defense system for federated learning gradient leakage includes: The parameter importance assessment unit, deployed on the client, is used to calculate Fisher information for model parameters and generate a local mask of important parameters; The parameter partition negotiation unit is used to coordinate multiple clients to divide the encrypted area, personalized area and noise area according to the local important parameter mask; The hybrid protection application unit, deployed on the client side, is used to perform homomorphic encryption on the parameters in the encrypted area and add differential privacy noise to the parameters in the noisy area. The dual-server aggregated update unit includes: An aggregation server is used to aggregate encryption parameters and noise parameters; A key server is used to decrypt the aggregated ciphertext, merge all parameter updates, and generate a new global model; The local model merging unit, deployed on the client, is used to merge the received global model with locally retained personalized parameters.

[0014] Preferably, the client generates a local mask of important parameters in the following way: Client First, in its local dataset Perform local training to obtain model updates. Subsequently, the client... Its model parameters need to be evaluated. The importance of this parameter is measured using Fisher information in this example. Fisher Information Calculated using the following formula: , in It is a loss function; The client performs Min-Max normalization on the Fisher information scores within each model layer:

[0015] in, Indicates the first Among the layer's parameters, the largest Fisher information value is... Indicates the first The smallest Fisher information value among the layer's parameters; Client Set an importance threshold The normalized Fisher information score is higher than The parameter set is defined as the local important parameter mask. : .

[0016] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the aforementioned lightweight hybrid defense method for federated learning gradient leakage.

[0017] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned lightweight hybrid defense method for federated learning gradient leakage.

[0018] Compared with the prior art, the present invention has the following beneficial technical effects: This invention provides a lightweight hybrid defense method for gradient leakage in federated learning. It assesses parameter importance by calculating Fisher information for each model parameter and generates a local important parameter mask. Based on this local important parameter mask, all model parameters are divided into three parts: an encrypted region, a personalized region, and a noise region. Model parameters in the encrypted region are homomorphically encrypted, while those in the noise region are amplified with differential privacy noise. Parameters in the personalized region are kept locally and not uploaded. The homomorphically encrypted parameters and the parameters with added differential privacy noise are uploaded to an aggregation server. By using homomorphic encryption only on a small subset of the most critical parameters and applying computationally less expensive differential privacy noise to a large number of non-critical parameters, the overall computational and communication costs are significantly reduced. Because the highly privacy-protected homomorphic encryption is used on the parameters most affecting model performance, and the differential privacy noise is added to parameters with less impact on the model, this method can provide a high level of privacy protection while maximizing model accuracy.

[0019] This invention introduces the concept of a "personalized region," allowing clients to retain their unique and important parameters, effectively addressing the performance degradation problem caused by heterogeneous data and realizing the advantages of personalized federated learning.

[0020] The dual-server architecture adopted in this invention separates key management from model aggregation, ensuring that the private key does not leave the key server. This fundamentally prevents the risk of key leakage caused by malicious behavior of the client or aggregation server, and provides end-to-end privacy protection. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of a lightweight hybrid defense method for federated learning gradient leakage in an embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram illustrating the workflow of a lightweight hybrid defense method for federated learning gradient leakage in an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] like Figure 1 , Figure 2 As shown, this invention provides a lightweight hybrid defense method for federated learning gradient leakage, specifically including the following steps: System initialization: The system includes a trusted key distribution and decryption server. ) and a semi-trusted aggregation server ( ), and multiple clients. Before training begins, Generate a homomorphic public-private key pair ( ). Securely store your private key and the public key Distributed to all clients and aggregation servers .

[0026] Importance assessment of client-side local parameters: At the start of each round of federated learning training, the clients participating in that round of training... First, in its local dataset Perform local training to obtain model updates. Subsequently, the client... Its model parameters need to be evaluated. The importance of this parameter is measured using Fisher information in this example. Fisher Information Calculated using the following formula: , in It is the loss function.

[0027] To eliminate the impact of differences in parameter numerical ranges between different layers, the client performs Min-Max normalization on the Fisher information scores within each model layer:

[0028] in, Indicates the first Among the layer's parameters, the largest Fisher information value is... Indicates the first The smallest Fisher information value among the layer's parameters.

[0029] Finally, the client Set an importance threshold The normalized Fisher information score is higher than The parameter set is defined as the local important parameter mask. :

[0030] Client-side parameter negotiation mask: All clients participating in this round of training Exchange each other's local important parameter masks They negotiated to determine globally unified parameter partitions.

[0031] Encrypted area : By the majority (more than a preset consensus ratio) These parameters are collectively considered important by the clients. These parameters are crucial to the model's performance, therefore strong privacy protection measures are employed. A consensus threshold hyperparameter is used. Decision. A parameter position. In the A wheel is included in the encrypted zone if and only if it exceeds the specified proportion. The client is marked as important:

[0032] Personalized Zone These are parameters that are important only to one or a small number of clients, but for which there is no global consensus. These parameters reflect the personalized characteristics of the client. For the client... In other words, its personalized area contains those in its local mask. It is in the middle, but not included in the global encryption zone. Parameters:

[0033] Noise area In the encrypted area And personalized areas Other non-critical parameters have little impact on performance and can be protected by adding noise.

[0034] Client parameter processing and uploading: Client Based on the partitioning results from the previous step, update the model. Differentiated processing will be applied to updates to the encrypted area. The client uses the public key. Homomorphic encryption is performed to obtain the ciphertext. Regarding the updates to the personalization area... The client keeps it locally and does not upload it. (Regarding updates to the noise region...) The client first performs L2 norm clipping: . Then add Gaussian noise. The parameters after adding noise are obtained:

[0035] For any RDP order This mechanism guarantees -RDP, where: . After processing is complete, the client ciphertext The updated version with added noise is sent to the aggregation server. .

[0036] The aggregation server performs parameter aggregation: Aggregator server After collecting updates from all clients, the additive homomorphism of homomorphic encryption is used to aggregate all ciphertexts, and the aggregated ciphertext along with the updated noise region parameters is sent to the key server. .

[0037] The decryption server decrypts the parameters and distributes them to the client: After receiving the aggregation result, use the private key. Decrypt the aggregated ciphertext to obtain the update of the encrypted region, and merge it with the update of the noisy region to obtain the complete global parameter update. Further calculation of the global model:

[0038] in It is the server's global model learning rate. This is the number of clients participating in this round. Finally, The global model obtained in this round of training Send to all clients.

[0039] Client updates local parameters: Client n receives the global model Then, local model merging is performed. It retains the personalized region parameters that it just updated during local training. The parameters of the encrypted and noisy regions are then updated using the corresponding parameters from the global model. The merged new model... This will be used for the next round of local training:

[0040] Where ⊙ represents element-wise product.

[0041] Specifically, such as Figure 2 As shown, the process begins with the key server distributing public keys to all parties. After performing local training, the client identifies important parameters using Fisher information and, through negotiation, divides them into encrypted, personalized, and noisy regions. The client then performs homomorphic encryption and differential privacy processing on the corresponding parameter partitions before uploading them to the aggregation server. After completing the aggregation operation, the aggregation server sends the results to the key server for decryption and model updates. Finally, the updated global model is distributed back to the client, which merges it with the local personalized parameters and proceeds to the next round of training.

[0042] This invention also provides a lightweight hybrid defense system for federated learning gradient leakage, specifically including: The parameter importance assessment unit, deployed on the client, is used to calculate Fisher information for model parameters and generate a local mask of important parameters; The parameter partition negotiation unit is used to coordinate multiple clients to divide the encrypted area, personalized area and noise area according to the local important parameter mask; The hybrid protection application unit, deployed on the client side, is used to perform homomorphic encryption on the parameters in the encrypted area and add differential privacy noise to the parameters in the noisy area. The dual-server aggregated update unit includes: An aggregation server is used to aggregate encryption parameters and noise parameters; A key server is used to decrypt the aggregated ciphertext, merge all parameter updates, and generate a new global model; The local model merging unit, deployed on the client, is used to merge the received global model with locally retained personalized parameters.

[0043] In one embodiment of the present invention, a terminal device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve a corresponding method flow or corresponding function. The processor described in this embodiment can be used in the operation of a lightweight hybrid defense method for federated learning gradient leakage.

[0044] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0045] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0046] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a specific manner, such that the instructions stored in the computer-readable storage medium produce an apparatus including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0047] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A lightweight hybrid defense method for gradient leakage in federated learning, characterized in that, Includes the following steps: S1, the client evaluates the importance of parameters by calculating Fisher information for each model parameter based on its local data, and generates a local important parameter mask; S2, the multiple clients participating in the training negotiate and divide all model parameters into three parts: encryption area, personalized area and noise area according to the local important parameter mask; S3, the client uses a public key to perform homomorphic encryption on the model parameters in the encrypted area, adds differential privacy noise to the model parameters in the noise area, and retains the parameters in the personalized area locally without uploading them; S4, the client uploads the homomorphically encrypted parameters and the parameters with added differential privacy noise to the aggregation server; S5, the aggregation server performs ciphertext aggregation on the received encryption parameters and plaintext aggregation on the received noise parameters, and sends the aggregation result to the key server. S6, the key server uses its private key to decrypt the aggregated encrypted parameters, and then merges them with the aggregated noise parameters to update the global model; S7, the key server distributes the updated global model to the client; S8: The client receives the global model and merges it with the locally retained personalized parameters to form a new local model for training. S9, repeat S1 to S8, until the federated learning model converges.

2. The lightweight hybrid defense method for federated learning gradient leakage according to claim 1, characterized in that, In step S1, the client generates a local important parameter mask in the following way: Client First, in its local dataset Perform local training to obtain model updates. Subsequently, the client Its model parameters need to be evaluated. The importance of Fisher information is used as a measure in this example; parameter Fisher Information Calculated using the following formula: ， in It is a loss function; The client performs Min-Max normalization on the Fisher information scores within each model layer: in, Indicates the first Among the layer's parameters, the largest Fisher information value is... Indicates the first The smallest Fisher information value among the layer's parameters; Client Set an importance threshold The normalized Fisher information score is higher than The parameter set is defined as the local important parameter mask. : 。 3. The lightweight hybrid defense method for federated learning gradient leakage according to claim 1, characterized in that, In step S2, multiple clients negotiate the division of the three parameter areas in the following way: Encrypted area Employing strong privacy protection measures, it uses a consensus threshold hyperparameter. Determine; the position of a parameter It is included in the encrypted area if and only if it exceeds the specified proportion. The client is marked as important: Personalized Zone For the client In other words, its personalized area contains those in its local mask. It is in the middle, but not included in the global encryption zone. Parameters: Noise area For the remaining non-critical parameters, which have a minor impact on performance, noise can be added for protection. 。 4. The lightweight hybrid defense method for federated learning gradient leakage according to claim 1, characterized in that, The aggregation server As a semi-trusted server, it only holds the public key and is responsible for performing ciphertext computation; the key server As a trusted server, it independently holds the private key and is responsible for key generation, distribution, and final ciphertext decryption.

5. The lightweight hybrid defense method for federated learning gradient leakage according to claim 1, characterized in that, In step S3, the homomorphic encryption uses the CKKS method that supports floating-point arithmetic, the differential privacy noise uses a Gaussian mechanism, and the privacy budget is calculated and controlled through Rényi differential privacy.

6. The lightweight hybrid defense method for federated learning gradient leakage according to claim 1, characterized in that, In step S8, the client merges the models in the following way: the parameters of the personalized area remain in the state of the previous round, and the parameters of the encrypted area and the noise area are updated using the global model received from the server.

7. A lightweight hybrid defense system for federated learning gradient leakage, characterized in that, include: The parameter importance assessment unit, deployed on the client, is used to calculate Fisher information for model parameters and generate a local mask of important parameters; The parameter partition negotiation unit is used to coordinate multiple clients to divide the encrypted area, personalized area and noise area according to the local important parameter mask; The hybrid protection application unit, deployed on the client side, is used to perform homomorphic encryption on the parameters in the encrypted area and add differential privacy noise to the parameters in the noisy area. The dual-server aggregated update unit includes: An aggregation server is used to aggregate encryption parameters and noise parameters; A key server is used to decrypt the aggregated ciphertext, merge all parameter updates, and generate a new global model; The local model merging unit, deployed on the client, is used to merge the received global model with locally retained personalized parameters.

8. A lightweight hybrid defense system for federated learning gradient leakage according to claim 7, characterized in that, The client generates a mask of important local parameters in the following way: Client First, in its local dataset Perform local training to obtain model updates. Subsequently, the client Its model parameters need to be evaluated. The importance of Fisher information is used as a measure in this example; parameter Fisher Information Calculated using the following formula: ， in It is a loss function; The client performs Min-Max normalization on the Fisher information scores within each model layer: in, Indicates the first Among the layer's parameters, the largest Fisher information value is... Indicates the first The smallest Fisher information value among the layer's parameters; Client Set an importance threshold The normalized Fisher information score is higher than The parameter set is defined as the local important parameter mask. : 。 9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-7.

Images