A blockchain-based anti-byzantine privacy protection federated learning method and system

Abstract

The application discloses a kind of anti-bayesian privacy protection federated learning method and system based on block chain, and the anti-bayesian privacy protection federated learning method is realized by including key distribution center, multiple clients, two non-conspiracy servers and the federated learning system of block chain network;The method uses the security calculation process of double server cooperation to guarantee the data privacy of client, uses adaptive clustering and robust aggregation method to reduce the attack brought by malicious client as far as possible, and uses smart contract to manage the reputation value of client.By reputation value, the reward and punishment obtained after client participates in federated learning are set, and meanwhile, the blockchain increases the transparency and reliability of the system.The security calculation process based on non-conspiracy double server architecture updates global model, and finally obtains the global model safe and reliable after training.

Description

Technical Field

[0001] This invention belongs to the field of federated learning technology, specifically relating to a blockchain-based, Byzantine-resistant, privacy-preserving federated learning method and system. Background Technology

[0002] With the development of Internet of Things (IoT) technology, more and more IoT devices are entering our lives. These IoT devices are intelligent, provide computing capabilities, and generate massive amounts of data. How to utilize these devices and data has become a hot topic in industry and academia. As a result, data-driven machine learning (ML) technology has flourished. By leveraging ML, valuable knowledge can be extracted from large amounts of data to help users make informed decisions. However, while the traditional ML approach of aggregating data into a single data center solves the problem of insufficient data, it also introduces privacy issues.

[0003] As a novel distributed machine learning technology, federated learning offers an effective way to achieve privacy-preserving computation. Unlike traditional centralized machine learning models, federated learning allows multiple user devices to train models locally without exchanging data with a central server, sharing only model parameters to generate a global model. Therefore, this mechanism not only reduces the amount of user data uploaded but also fully utilizes the computing power of the clients, lowering the computational requirements of the central server. While federated learning has achieved positive results in both privacy protection and computational efficiency, it still faces two security threats: Byzantine attacks and user privacy leaks. First, the federated learning model training process still suffers from user privacy leaks. Although the participating parties do not directly share data during local model training, an honest but curious server may still deduce some user information through in-depth analysis of the local model. The second threat is that the federated learning mechanism is highly vulnerable to Byzantine attacks. Byzantine attacks in federated learning can be caused by attackers deliberately providing incorrect model parameters or training data by controlling a subset of user nodes to influence the final learning performance of the model. In some cases, user nodes may be unable to provide the correct data or perform the correct operations due to software errors, hardware failures, or network problems, which may also lead to problems similar to Byzantine attacks. Summary of the Invention

[0004] The purpose of this invention is to provide a blockchain-based, Byzantine-resistant, privacy-preserving federated learning method and system.

[0005] In a first aspect, the present invention provides a blockchain-based anti-Byzantine privacy-preserving federated learning method, the method comprising:

[0006] Initialize the reputation and global model of all clients; generate a pair of private and public keys through the key distribution center, distribute the public key to different clients, and distribute the private key to the second server;

[0007] Different clients train the received global model to obtain corresponding local gradients, encrypt them, and upload them to the first server. The first and second servers jointly obtain the similarity matrix between the local gradients. The second server uses an adaptive clustering algorithm to cluster the similarity matrix, and transmits the clustering results to the first server for aggregation before sending them back to the second server. The second server decrypts the aggregation results and updates the global model and the reputation of each client based on the decrypted aggregation results. Clients participating in the next training process are selected based on their reputation. The above process is repeated until the iteration termination condition is met, and the learning of the global model is completed.

[0008] Preferably, the specific process of updating the global model is as follows:

[0009] If the clustering algorithm divides the data into honest clients and malicious clients, the decrypted aggregation result is used as the final global model gradient to update the global model. If the clustering algorithm divides the data into multiple related clusters, the decrypted aggregation result is further aggregated, and the result of the further aggregation is used as the final global model gradient to update the global model.

[0010] Preferably, the client reputation update process is as follows:

[0011] If the clustering algorithm divides clients into honest clients and malicious clients, then the reputation of honest clients will be increased and the reputation of malicious clients will be decreased.

[0012] If the clustering algorithm results in multiple related clusters, then all clusters are divided into honest clusters and malicious clusters based on the distance between the decrypted clustering results and the gradient of the final global model. The reputation of clients in honest clusters is increased, while the reputation of clients in malicious clusters is decreased.

[0013] Preferably, the clustering algorithm is selected based on the total score of the similarity matrix; the total score is obtained by evaluating the similarity matrix.

[0014] As a preferred method, the clustering algorithm is selected based on the total score as follows: if the total score is less than or equal to the threshold, spectral clustering is used to cluster the similarity matrix to obtain multiple related clusters; if the total score of the similarity matrix is ​​greater than the threshold, DBSCAN is used to cluster the similarity matrix to obtain a core cluster composed of honest clients and several malicious clients.

[0015] As a preferred method, the similarity matrix is ​​to obtain the uniformity score, variance score, skewness score, and normality score of the similarity matrix respectively, and obtain the total score of the similarity matrix by weighted summation of the uniformity score, variance score, skewness score, and normality score.

[0016] Preferably, the similarity matrix is ​​obtained using the following method:

[0017] In the first server, the inner product of each local encryption gradient with itself is calculated, and the inner product corresponding to each local encryption gradient is transmitted to the second server. In the second server, the inner product corresponding to each local encryption gradient is decrypted using the private key to obtain the squared modulus of the local gradient, and then transmitted back to the first server. In the first server, the local encryption gradient is normalized based on the squared modulus of the local gradient to obtain the normalized local encryption gradient. Based on the different normalized local encryption gradients, the encryption similarity matrix between the local gradients is calculated. The encryption similarity matrix in the first server is transmitted to the second server, and the encryption similarity matrix is ​​decrypted to obtain the decrypted similarity matrix.

[0018] Preferably, the normalization process is as follows: the normalized local encryption gradient is obtained by dividing the local encryption gradient by the modulus of the local gradient.

[0019] As a preferred approach, after updating the reputation of each client, a reputation decay mechanism is used to dynamically decay the reputation of each client.

[0020] Secondly, this invention provides a blockchain-based anti-Byzantine privacy-preserving federated learning system for executing the aforementioned anti-Byzantine privacy-preserving federated learning method. This anti-Byzantine privacy-preserving federated learning system includes multiple clients, dual servers, a key distribution center, and a blockchain smart contract. The clients are used to obtain gradient information for training a global model based on stored local datasets. The clients are categorized as honest clients and malicious clients. The dual servers include a non-colluding first server and a second server. The first server is used to receive encrypted gradients, calculate a similarity matrix, and perform secure aggregation. The second server is used for decryption, malicious client detection, and global model updates. The key distribution center generates a pair of private and public keys, distributing the public key to different clients and the private key to the second server. The blockchain smart contract records intermediate results and updates the client's reputation.

[0021] The beneficial effects of this invention are:

[0022] 1. This invention uses dual servers to achieve gradient normalization and similarity calculation, ensuring that the privacy information of participants is effectively protected during the Byzantine detection and model aggregation stages under the non-collusion assumption. Compared with traditional integer encryption schemes, it achieves a significant improvement in computational efficiency when processing floating-point gradients, while ensuring privacy and security.

[0023] 2. This invention proposes a similarity matrix state-aware adaptive Byzantine defense mechanism. By dynamically selecting DBSCAN or spectral clustering algorithm based on the evaluation results of the similarity matrix, it achieves effective Byzantine detection in both independent and non-independent i.i.d. environments. Compared with the traditional one-size-fits-all single defense method, the adaptive strategy can dynamically adjust the defense strategy according to the matrix characteristics, which greatly enhances the robustness and practicality of the entire federated learning system. Attached Figure Description

[0024] Figure 1 This is a system architecture diagram of Embodiment 1 of the present invention.

[0025] Figure 2 This is an overall flowchart of Embodiment 2 of the present invention. Detailed Implementation

[0026] The present invention will be further described below with reference to the accompanying drawings.

[0027] Example 1

[0028] like Figure 1 As shown, a blockchain-based Byzantine-resistant privacy-preserving federated learning system includes multiple clients, dual servers, a key distribution center, and a blockchain smart contract. Clients are used to obtain gradient information for training the global model based on stored local datasets. Clients can be categorized as honest or malicious; malicious clients submit incorrect gradients with the aim of disrupting the global model and thus the entire federated learning system. The dual servers include a non-colluding first server and a second server, which perform Byzantine detection and global model aggregation, upload intermediate results to the blockchain, and interact with each other via the blockchain. The key distribution center generates a pair of private and public keys, distributes the public key to different clients, and distributes the private key to the second server. The blockchain smart contract is responsible for executing and supervising the training process, recording intermediate results, and updating client reputations to punish or remove malicious clients.

[0029] Example 2

[0030] like Figure 2 As shown, a blockchain-based, Byzantine-resistant, privacy-preserving federated learning method includes the following steps:

[0031] Step S1: Initialization

[0032] Initialize the reputation and global model for all clients, and randomly set the model parameters in the global model. Distribute the public key to different clients through a key distribution center, and distribute the private key to a second server.

[0033] Step S2: Obtain the encryption gradient

[0034] In each round of training, each client Use their respective local datasets Train the received global model and obtain the local gradient that reflects the optimal direction of global model parameter updates. Its expression is:

[0035]

[0036] in, For empirical loss function; These are the parameters of the global model; ; For the number of clients; It is a differentiation operation.

[0037] Use homomorphic encryption algorithms to encrypt local gradients. That is, each client Use public key local gradient Encryption is performed to obtain the local encryption gradient. and encrypt the gradient locally. Uploaded to the first server.

[0038] In this embodiment, CKKS (Cheon-Kim-Kim-Song) is used to encrypt the local gradient.

[0039] Step S3: Construct the encrypted similarity matrix

[0040] Each local encryption gradient is calculated separately in the first server. With its own inner product And the inner product corresponding to each local encryption gradient Transmitted to the second server. The inner product corresponding to the local encryption gradient. The expression is:

[0041]

[0042] in, This is the inner product symbol.

[0043] In the second server, the private key is used to encrypt each local gradient. Corresponding inner product Decryption is performed to obtain the local gradient. The corresponding inner product, i.e., the local gradient Modulus square Local gradient The square of the modulus is sent back to the first server, where the local encryption gradient is normalized to obtain the normalized local encryption gradient. Its expression is:

[0044]

[0045] The local encryption gradient is normalized to facilitate subsequent cosine similarity calculation. Based on the local encryption gradient after different normalization... Calculate the encrypted similarity matrix between local gradients Encryption similarity matrix elements in The expression is:

[0046]

[0047] Step S4: Similarity Matrix Evaluation

[0048] The encrypted similarity matrix in the first server The data is transmitted to a second server, where the encrypted similarity matrix is ​​processed. Decryption is performed to obtain the decrypted similarity matrix CS. Four evaluation metrics for the similarity matrix CS are calculated to determine its current state. These four metrics include uniformity score, variance score, skewness score, and normality score. A comprehensive evaluation of the similarity matrix is ​​conducted using these four different metrics, each revealing an aspect of the similarity matrix CS. The calculation methods are as follows:

[0049] (1) Evenness score The expression is:

[0050]

[0051] in, The coefficient of variation is 1. ; Standard deviation; This is the mean.

[0052] (2) Variance score The expression is:

[0053]

[0054] in, is the variance of the variances; mean is the mean of the variances.

[0055] (3) Skewness score The expression is:

[0056]

[0057] in, This is the absolute value of the skewness.

[0058] In this embodiment, the skewness of the similarity matrix can be directly calculated using the SKEW function.

[0059] (4) Normality score The expression is:

[0060]

[0061] in, This is a normality test value, obtained through the Shapiro-Wilk test, which can test whether the data conforms to a normal distribution.

[0062] The uniformity score, variance score, skewness score, and normality score are weighted and summed to obtain the total score of the similarity matrix. Its expression is:

[0063]

[0064] in, This represents the score weight.

[0065] If the number of clients If the number of nodes is less than or equal to a preset threshold, consistency and variance are prioritized because they are more stable with a limited sample size. Therefore, the threshold is set to ( ) = (0.4, 0.3, 0.2, 0.1); if the number of clients If the number of nodes exceeds a preset threshold, all metrics need to be balanced, therefore, the following settings are made: = (0.3, 0.3, 0.3, 0.3).

[0066] In this embodiment, the preset threshold for the number of nodes is 20.

[0067] Step S5: Cluster the similarity matrix

[0068] If the total score of the similarity matrix Less than or equal to the preset threshold A more sophisticated defense strategy is then employed. First, spectral clustering is used for distribution-aware grouping, dividing the data distribution space to ensure approximate stability within each cluster and improve local consistency. In this stage, the similarity matrix is ​​clustered to group the indices corresponding to each client. Cluster The clustered results are then returned to the first server as a nested list, where the length of the nested list is [length missing]. .

[0069] If the total score of the similarity matrix Greater than the preset threshold If the similarity matrix is ​​relatively consistent and not chaotic (indicating similar independent and identically distributed conditions and slight Byzantine activity), then DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is used to cluster the similarity matrix. The core idea of ​​DBSCAN is that a cluster is the largest set of points connected by density, and regions with different densities are considered noise. In an independent and identically distributed environment, the data gradient distribution should be that the gradients of all normal nodes are tightly clustered in a cluster, while the gradients of malicious nodes become outliers that deviate from this cloud. DBSCAN's characteristics perfectly match this. DBSCAN has the following advantages: (1) DBSCAN automatically discovers the number of clusters without specifying m. Under normal circumstances, it will almost always find a large core cluster (normal nodes) and several noise points (malicious nodes). (2) Ordinary clustering methods assume that the clusters are convex (usually spherical). If the gradient distribution of normal nodes is slightly more complex, its performance will deteriorate. DBSCAN relies on density, thus overcoming the disadvantage that distance-based algorithms can only discover "spherical" clusters. DBSCAN can discover clusters of any shape. As long as the density of a region is high enough, it can be identified, regardless of whether its shape is spherical, strip-shaped, or other complex. (3) Conventional clustering methods (such as k-means) are very sensitive to the choice of initial cluster centers. Different initializations may lead to completely different clustering results, making the defense strategy unstable. The result of DBSCAN is determined only by the density distribution of data points and is independent of the choice of initial points. As long as the parameters are fixed, the result of each run is deterministic, which greatly increases the stability of the defense system.

[0070] By using DBSCAN to cluster the similarity matrix, a core cluster consisting of non-noise points (honest clients) and several noise points (malicious clients) is obtained. The indexes of all non-noise points in the core cluster are aggregated to obtain an index list containing the indexes of all non-noise points, and this index list is transmitted to the first server.

[0071] Step S6: Global Model Update

[0072] If the first server receives the nested list, it performs average aggregation on the local gradients corresponding to the indexes in each cluster in the nested list to obtain multiple gradient aggregation results, and sends the multiple gradient aggregation results to the second server. After decrypting the multiple gradient aggregation results, the second server obtains the cluster center gradient corresponding to each cluster, performs median aggregation on the cluster center gradients corresponding to all clusters to obtain the final global model gradient, and updates the global model based on the final global model gradient.

[0073] If the first server receives the index list, it selects the corresponding local gradient according to the index in the index list and performs average aggregation to obtain a gradient aggregation result; the second server directly decrypts the gradient aggregation result to obtain the final global model gradient, and updates the global model based on the final global model gradient.

[0074] Step S7: Reputation Update

[0075] Reputation assessment is performed based on the clustering results obtained from different clustering methods, and the reputation of each client is updated based on the reputation assessment results. The specific process is as follows:

[0076] 7-1. For the multiple clusters obtained by spectral clustering, calculate the distance between the gradient of the center of each cluster and the gradient of the final global model. Its expression is:

[0077]

[0078] in, The gradient at the cluster center; This represents the final global model gradient.

[0079] Constructing an adaptive threshold ;in, The sign of the standard deviation is indicated by the distance between the gradient at the cluster center and the gradient of the final global model. Less than the adaptive threshold If the cluster is classified as an honest cluster, it indicates that the cluster's "proposal" has been adopted by the global consensus, making it a high-quality and trustworthy cluster. This enhances the reputation of all clients corresponding to the indices within the cluster. The distance between the cluster center gradient and the final global model gradient... Greater than or equal to the adaptive threshold If the cluster is classified as malicious, it indicates that the cluster contains outliers that have been filtered out or have little or no effect on global updates. Its overall direction is wrong, making it a low-quality or malicious cluster. This will reduce the reputation of all clients corresponding to the indexes within the cluster.

[0080] 7-2. Regarding the core clusters and several noise points obtained by DBSCAN: treat the core clusters as normal and increase the reputation of the clients corresponding to the non-noise points; treat the noise points as malicious and decrease the reputation of the clients corresponding to them.

[0081] 7-3. If the client's reputation decreases, the updated reputation... The expression is:

[0082]

[0083] in, For the reputation before the update; For penalty weights.

[0084] If the client's reputation increases, the updated reputation The expression is:

[0085]

[0086] in, For reward weighting.

[0087] Step S8: Reputation Decline

[0088] The client's reputation is dynamically updated using a reputation decay mechanism, and the decayed reputation... It is expressed as follows:

[0089]

[0090] in, This is the attenuation factor.

[0091] If a client's reputation falls below 0 after decay, that client is removed from the federated learning system and prohibited from participating in the next training cycle.

[0092] Step S9: Repeat steps S2 to S8 until the global model converges or the preset number of training rounds is reached.

[0093] The above description is merely a preferred implementation of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A blockchain-based, Byzantine-resistant, privacy-preserving federated learning method, characterized in that: The method includes: Initialize the reputation and global model of all clients; generate a pair of private and public keys through the key distribution center, distribute the public key to different clients, and distribute the private key to the second server; Different clients train the received global model to obtain corresponding local gradients, encrypt them, and upload them to the first server. The first and second servers jointly obtain the similarity matrix between the local gradients. In the second server, an adaptive clustering algorithm is used to cluster the similarity matrix, and the clustering results are transmitted to the first server for aggregation before being sent back to the second server. The second server decrypts the aggregation results and updates the global model and the reputation of each client based on the decrypted aggregation results. Clients participating in the next training process are selected based on their reputation. The above process is repeated until the iteration termination condition is met, and the learning of the global model is completed. The clustering algorithm is selected based on the total score of the similarity matrix. The total score is obtained by evaluating the similarity matrix. The method for selecting the clustering algorithm based on the total score is as follows: if the total score is less than or equal to the threshold, spectral clustering is used to cluster the similarity matrix to obtain multiple related clusters; if the total score of the similarity matrix is ​​greater than the threshold, DBSCAN is used to cluster the similarity matrix to obtain a core cluster composed of honest clients and several malicious clients. The method for evaluating the similarity matrix is ​​as follows: obtain the uniformity score, variance score, skewness score, and normality score of the similarity matrix respectively, and obtain the total score of the similarity matrix by weighted summation of the uniformity score, variance score, skewness score, and normality score; The specific process for updating the global model is as follows: If the clustering algorithm divides the data into honest clients and malicious clients, the decrypted aggregation result is used as the final global model gradient to update the global model. If the clustering algorithm divides the data into multiple related clusters, the decrypted aggregation result is further aggregated, and the result of the further aggregation is used as the final global model gradient to update the global model.

2. The blockchain-based anti-Byzantine privacy-preserving federated learning method according to claim 1, characterized in that: The process for updating the client's reputation is as follows: If the clustering algorithm divides clients into honest clients and malicious clients, then the reputation of honest clients will be increased and the reputation of malicious clients will be decreased. If the clustering algorithm results in multiple related clusters, then all clusters are divided into honest clusters and malicious clusters based on the distance between the decrypted clustering results and the gradient of the final global model. The reputation of clients in honest clusters is increased, while the reputation of clients in malicious clusters is decreased.

3. The blockchain-based Byzantine-resistant privacy-preserving federated learning method according to claim 1, characterized in that: The similarity matrix is ​​obtained as follows: In the first server, the inner product of each local encryption gradient and itself is calculated, and the inner product corresponding to each local encryption gradient is transmitted to the second server. In the second server, the inner product corresponding to each local encryption gradient is decrypted using the private key to obtain the modulus square of the local gradient, and then transmitted back to the first server. In the first server, the local encrypted gradient is normalized based on the square of the local gradient to obtain the normalized local encrypted gradient. Based on the local encryption gradients after different normalizations, calculate the encryption similarity matrix between the local gradients; The encrypted similarity matrix in the first server is transmitted to the second server, and the encrypted similarity matrix is ​​decrypted to obtain the decrypted similarity matrix.

4. The blockchain-based anti-Byzantine privacy-preserving federated learning method according to claim 3, characterized in that: The normalization process is as follows: the local encryption gradient is divided by the modulus of the local gradient to obtain the normalized local encryption gradient.

5. A blockchain-based, Byzantine-resistant, privacy-preserving federated learning method according to claim 1, characterized in that: After updating the reputation of each client, a reputation decay mechanism is used to dynamically decay the reputation of each client.

6. A blockchain-based, Byzantine-resistant, privacy-preserving federated learning system, characterized in that: This system is used to execute a blockchain-based anti-Byzantine privacy-preserving federated learning method as described in claim 1. The anti-Byzantine privacy-preserving federated learning system includes multiple clients, dual servers, a key distribution center, and a blockchain smart contract. The clients are used to obtain gradient information for training a global model based on a stored local dataset. The clients are divided into honest clients and malicious clients. The dual servers include a non-colluding first server and a second server. The first server is used to receive encrypted gradients, calculate a similarity matrix, and perform secure aggregation. The second server is used for decryption, malicious client detection, and global model updates; the key distribution center is used to generate a pair of private and public keys, distribute the public key to different clients, and distribute the private key to the second server; the blockchain smart contract is used to record intermediate results and update the client's reputation.

Images