Federal learning parameter protection method and system based on reversible diffusion disturbance

Abstract

This invention discloses a method and system for protecting parameters in federated learning based on reversible diffusion perturbation, belonging to the fields of artificial intelligence and privacy computing technology. The method includes: a server distributing global model parameters to each client; each client training with local data to obtain updated local model parameters and converting them into a two-dimensional parameter image; performing a multi-step forward diffusion perturbation process to generate a noisy parameter image; each client filtering candidate intermediate diffusion states based on parameter space structure continuity constraints and recoverability constraints and uploading them to the server; weighted aggregation to obtain a global noisy parameter image; and performing a back-diffusion process on the global noisy parameter image to obtain global model parameters, which are then distributed to each client to complete the federated learning iterative update. This invention achieves efficient reversible recovery through reversible diffusion perturbation and can adaptively adjust the perturbation intensity according to the heterogeneity of client data, improving the model convergence stability.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and privacy computing technology, and particularly relates to a method and system for protecting federated learning parameters based on diffused noise perturbation. Background Technology

[0002] Federated learning, a distributed learning framework that enables collaborative model training without sharing raw data, has been widely applied in finance, healthcare, and smart devices. Existing federated learning methods typically employ privacy enhancement techniques such as Differential Privacy Stochastic Gradient Descent (DP-SGD), gradient pruning with one-off noise perturbation, Laplace noise injection, secure aggregation, or homomorphic encryption to prevent servers or malicious actors from inferring local data from uploaded parameters. However, these methods still have significant limitations. First, one-off irreversible noise can disrupt the spatial structure of model parameters, exacerbating directional shifts after aggregation, especially in cases of non-independent and identically distributed (Non-IID) data, easily leading to global model oscillations and convergence instability. Second, existing solutions often struggle to balance privacy perturbation with model usability; once the noise intensity is fixed, it cannot flexibly adapt to the heterogeneity of data from different clients, resulting in either weak privacy protection or excessive performance degradation. Third, most existing privacy perturbation methods only apply to single gradient or parameter updates, lacking reversible, gradual perturbation mechanisms, failing to maintain parameter continuity and recoverability while providing privacy protection. Based on the above-mentioned shortcomings, there is an urgent need for a federated learning parameter protection method that can maintain model structural features, support reversible recovery, and adaptively adjust the perturbation intensity according to client heterogeneity while protecting parameter privacy. Summary of the Invention

[0003] This invention aims to address the problems of irreversible noise disrupting parameter structure, inability to adapt to heterogeneous client data, and difficulty in improving global model convergence stability in Non-IID scenarios in existing federated learning privacy protection methods. It provides a parameter protection method and system that can maintain reversible parameter recovery under multi-step controllable perturbations, achieve heterogeneous adaptive privacy adjustment, and improve federated aggregation stability. Furthermore, in federated learning, model parameters are not independent scalar sets, but rather a parameter space structure constrained by network layers, channel associations, and convolutional kernel spatial adjacency relationships. Existing random noise or one-time perturbation methods easily disrupt this continuity, leading to aggregation direction shifts and global model oscillations. Therefore, the reversible diffusion perturbation described in this invention is not only used for privacy protection but also to maintain parameter structure continuity during the perturbation transmission phase, thereby improving aggregation stability and convergence controllability in Non-IID scenarios.

[0004] To achieve the above objectives, this invention proposes a federated learning parameter protection method based on reversible diffusion perturbation, comprising:

[0005] The server sends global model parameters to each client;

[0006] Each client uses local data to train the global model parameters to obtain updated local model parameters;

[0007] Each client converts the updated local model parameters into a two-dimensional parameter image that preserves the topological relationship of the convolution kernel through a predefined invertible linear mapping function, so as to form a parameter representation that satisfies the continuity constraint of the parameter space structure;

[0008] Each client performs a multi-step forward diffusion perturbation process on the two-dimensional parameter image, generating corresponding noisy parameter images in multiple diffusion time steps;

[0009] Each client filters candidate intermediate diffusion states in the multi-step forward diffusion perturbation process based on parameter space structural continuity constraints and reversible recovery constraints, and only selects the noisy parameter images corresponding to the candidate intermediate diffusion states that simultaneously satisfy structural continuity constraints and reversible recovery constraints to upload to the server.

[0010] The server receives the noisy parameter images uploaded by each client, and performs weighted aggregation according to the local sample size of each client to obtain the global noisy parameter image;

[0011] The server uses a pre-trained backdiffusion network to perform a backdiffusion recovery process on the global noisy parameter image to obtain a global parameter image that satisfies the parameter space structure continuity constraint.

[0012] The server transforms the global parameter image back into global model parameters through the inverse function of the invertible linear mapping function, and distributes it to each client to complete the federated learning iterative update.

[0013] Further preferably, the parameter space structure continuity constraint is characterized by measuring the local smoothness between adjacent weight blocks in the two-dimensional parameter image and the degree of weight abrupt change at the hierarchical splicing point. When the measurement result is lower than the preset continuity threshold, the two-dimensional parameter image is considered to meet the parameter space structure continuity constraint required for aggregation.

[0014] Further preferably, the selection of the intermediate diffusion state includes:

[0015] The parameter space structure continuity index and recoverability index are respectively judged for the candidate intermediate diffusion state corresponding to the noisy parameter image. Only when both of them meet the preset threshold conditions is the noisy parameter image corresponding to the candidate intermediate diffusion state determined as the upload state.

[0016] Further optimization involves converting the local model parameters into a two-dimensional parameter image using an invertible linear mapping function. Specifically, this includes: unfolding the parameter tensors of each convolutional layer in the local model into two-dimensional weight blocks according to the channel dimension; mapping the original spatial dimensions of the two-dimensional weight blocks into matrix row and column indices; and splicing the two-dimensional weight blocks from different convolutional layers according to the network hierarchy to form a two-dimensional parameter image that maintains the network hierarchy and the topology of the convolutional kernel.

[0017] In a further preferred embodiment, the method further includes: the server dynamically adjusting the noise scheduling parameters based on the heterogeneity between the data distribution of each client and the global data distribution.

[0018] Further optimization involves the server performing aggregation consistency correction after receiving the global parameter image: detecting the continuity index of the parameter space structure of the global parameter image; if the parameter space structure continuity constraint is not met, then the weight of the intermediate diffusion state uploaded by each client or the threshold for selecting the intermediate diffusion state is adjusted retrospectively.

[0019] The present invention also provides a federated learning parameter protection system based on reversible diffusion perturbation, for implementing the federated learning parameter protection method, including a module deployed on the client and a module deployed on the server;

[0020] The client module includes:

[0021] The local training unit is used to train the received global model parameters using local data;

[0022] The parameter visualization unit is used to convert the updated local model parameters into a two-dimensional parameter image that maintains the continuity of the parameter space structure through an invertible linear mapping function;

[0023] A forward diffusion unit is used to perform a multi-step forward diffusion perturbation process on the two-dimensional parametric image and generate a noisy parametric image;

[0024] The state determination and uploading unit is used to filter the candidate intermediate diffusion states in the multi-step forward diffusion perturbation process based on the parameter space structural continuity constraint and the reversible recovery constraint, and only select the noisy parameter image corresponding to the intermediate diffusion state that simultaneously satisfies the structural continuity constraint and the reversible recovery constraint to upload to the server.

[0025] The server modules include:

[0026] The aggregation unit is used to perform weighted aggregation of the noisy parameter images uploaded by each client;

[0027] The backdiffusion unit, equipped with a pre-trained backdiffusion network, performs backdiffusion on the aggregated global noisy parameter image to recover the global parameter image;

[0028] The consistency correction unit is used to perform aggregate consistency correction: it detects the continuity index of the parameter space structure of the global parameter image. If the parameter space structure continuity constraint is not met, it backtracks and adjusts the weight of the intermediate diffusion state or the threshold of the intermediate diffusion state uploaded by each client.

[0029] The inverse parameter transformation unit is used to transform the recovered global parameter image back into global model parameters;

[0030] The scheduling unit is used to dynamically adjust noise scheduling parameters based on the heterogeneity between client data distribution and global data distribution.

[0031] The present invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the federated learning parameter protection method.

[0032] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the federated learning parameter protection method.

[0033] This invention achieves the following significant technical effects through the synergistic effect of key technologies such as reversible linear mapping functions, multi-step forward diffusion perturbation processes, intermediate diffusion state uploading, weighted aggregation, pre-trained backdiffusion networks to execute the backdiffusion process, and dynamic adjustment of noise scheduling parameters based on heterogeneity (KL divergence):

[0034] 1. By constructing a reversible diffusion perturbation consisting of a multi-step forward diffusion perturbation process and a reverse diffusion process based on a pre-trained reverse diffusion network, it is ensured that the global parameter image that satisfies the continuity constraint of the parameter space structure can be recovered after the parameter image is perturbed by noise. This achieves efficient and reversible recovery after parameter perturbation and effectively avoids irreversible damage to the model structure.

[0035] 2. The updated local model parameters are converted into a two-dimensional parameter image that preserves the topological relationships of the convolutional kernels through a reversible linear mapping function. This ensures that the channels and hierarchical relationships within the model parameters (especially the convolutional layer parameters) remain spatially continuous after conversion to a two-dimensional parameter image. This structured input lays the foundation for the subsequent diffusion and recovery processes, enabling the global parameter image recovered by the backdiffusion process to be accurately converted back into highly usable global model parameters through the inverse function of the reversible linear mapping function.

[0036] 3. The server dynamically adjusts the noise scheduling parameters based on the heterogeneity between the data distribution of each client and the global data distribution, achieving differentiated privacy protection strength. Clients with high data heterogeneity are subjected to stronger perturbations, which effectively suppresses the negative impact of abnormal gradients on global aggregation, thereby significantly improving the convergence stability of the global model in heterogeneous environments.

[0037] 4. Choosing to upload an intermediate diffusion state, rather than the final noisy state, means that the uploaded parameter image contains enough random noise to prevent privacy inference while retaining the necessary structural information to ensure the server can successfully perform the backdiffusion process for recovery. This design achieves a dynamic balance between privacy protection and model usability. The diffusion perturbation process only affects the transmission phase of model parameters and does not participate in the client's local gradient calculation process, thus avoiding the cumulative interference of perturbation noise on the local model's convergence path. Attached Figure Description

[0038] Figure 1 This is an overall flowchart of the federated learning parameter protection method based on reversible diffusion perturbation of the present invention.

[0039] Figure 2 This is a schematic diagram of the forward and reverse diffusion processes. Detailed Implementation

[0040] The embodiments of the present invention and their operation flow are described in detail below with reference to the accompanying drawings. Any structural adjustments, process modifications, or module substitutions made by those skilled in the art based on the technical concept of the present invention are within the scope of protection of the present invention.

[0041] A federated learning system consists of several clients and one server. Each client holds an independent local dataset, while the server is responsible for parameter aggregation and global model updates. (See also...) Figure 1 The specific steps of the federated learning parameter protection method based on reversible diffusion perturbation in this embodiment are as follows:

[0042] Step S1: The server initializes the global model;

[0043] Step S2: The server sends out global model parameters;

[0044] Step S3: The client trains the global model using local data;

[0045] Each client receives the global model parameters for the current round from the server and updates its model using its local data. Each client independently executes several rounds of training locally, iteratively optimizing the model using common optimization algorithms to obtain updated local model parameters. k is the client index.

[0046] Step S4: The client visualizes and maps the local model parameters;

[0047] The client will update the local model parameters. Through a predefined invertible linear mapping function Convert to 2D parametric image Invertible linear mapping function To maintain the topological relationship between convolutional kernels and channels, adjacent weights should have local spatial continuity. The mapping method includes: unfolding the parameter tensors of each convolutional layer in the local model into two-dimensional weight blocks according to the channel dimension; mapping the original spatial dimensions of the two-dimensional weight blocks into matrix row and column indices; and concatenating the two-dimensional weight blocks from different convolutional layers according to the network hierarchy to form a two-dimensional parameter image that maintains the network hierarchy and the topological structure of the convolutional kernels. The image-based mapping can be defined as:

[0048] (1);

[0049] in, It is a two-dimensional parametric image. Let n be a real vector space. It is a two-dimensional real matrix with H rows and W columns.

[0050] To characterize the continuity of the parameter space structure of a two-dimensional parametric image, this invention defines a parameter space structure continuity index function. It is used to measure the local smoothness between adjacent weight blocks in a two-dimensional parametric image and the degree of abrupt changes at the layer stitching; when Below the preset parameter spatial structure continuity threshold At that time, it was assumed that the two-dimensional parametric image satisfied the continuity of the parametric space structure required for aggregation.

[0051] Step S5: Process the two-dimensional parametric image A multi-step forward diffusion perturbation process is performed to generate a noisy parameter image by gradually adding controllable noise. ,like Figure 2 The upper part (forward diffusion process) is shown. The recursive relationship of the multi-step forward diffusion perturbation is as follows:

[0052] ,t=1,2,…,T (2;

[0053] in, This is the image with added noise parameters after diffusion at step t. It is random noise. A matrix with a mean of 0 and a covariance of identity. Standard Gaussian noise, where t is the time step index and T is the final time step. This is the cumulative attenuation coefficient. , The noise scheduling parameter is for time step s.

[0054] use This represents the conditional probability distribution of a multi-step forward diffusion perturbation process, used to describe the diffusion state of a two-dimensional parametric image in the diffusion chain from the (t-1)th step. Transition to the diffusion state at step t The probability relationship. The conditional probability distribution reflects the Markov property of multi-step forward diffusion perturbation, and the Markov chain property of multi-step forward diffusion perturbation ensures that:

[0055] (3);

[0056] in, (·) represents the conditional probability distribution of the forward diffusion process. Let t be the diffusion state at step t. This represents the diffusion state at step t-1. This is the initial state; that is, in the multi-step forward diffusion perturbation stage, the diffusion result at step t depends only on the state at step t-1, and not on earlier historical states.

[0057] Step S6: Select the intermediate diffusion state to upload to the server;

[0058] Each client selects the image with noise-adding parameters for an intermediate diffusion state in the diffusion chain. The data is uploaded to the server after compression and quantization, rather than as the final dissemination result. The intermediate diffusion state It is not a fixed value, but rather selected within the range of diffusion steps. Within a preset safe zone. The selection of the intermediate diffusion state includes a state determination process: the client or server pre-sets a parameter space structure continuity threshold. With recoverability threshold , It is an index for the continuity of the parameter space structure. This is a recoverability index used to characterize the upper bound of the backdiffusion reconstruction error; it is only valid if the candidate diffusion states simultaneously satisfy... and Only when the candidate diffusion state is reached will the image with the added noise parameters corresponding to that state be uploaded.

[0059] This design has two key technical advantages:

[0060] (1) Feasibility of aggregation: The selected intermediate diffusion state satisfies the continuity constraint of the parameter space structure, avoiding directional drift after aggregation;

[0061] (2) Recoverability: The selected intermediate diffusion state satisfies the recoverability constraint, and the server can stably complete the reverse diffusion reconstruction;

[0062] (3) Enhanced privacy: Random noise has been injected to reduce the risk of inferring local data from uploaded parameters.

[0063] Step S7: The server performs weighted aggregation on all uploaded noisy parameter images according to the local sample size of each client, to obtain the global noisy parameter image. :

[0064] (4);

[0065] in, For the image with global noise parameters, The aggregate weight for client k. The image showing the noise-adding parameters of the intermediate diffusion state of client k. Let k be the local sample size of the client. Let j be the number of local samples on client j, and K be the number of clients.

[0066] Furthermore, after obtaining the global noisy parameter image, the server performs aggregate consistency correction: a continuity index of the parameter space structure of the global noisy parameter image. If the parameter space structure continuity constraint is not met during the detection, the weight of the intermediate diffusion state uploaded by each client or the threshold for selecting the intermediate diffusion state is adjusted retrospectively to suppress local structural mutations caused by heterogeneous clients, thereby improving the stability of the aggregation direction.

[0067] Step S8: Backdiffusion to recover the global parameter image;

[0068] like Figure 2 The lower half (backdiffusion process) shows that the server uses a pre-trained backdiffusion network UNet to process the globally noisy parameter image. Perform backdiffusion to recover the global parameter image:

[0069] (5);

[0070] in, This represents the recovered global parameter image. (·) represents a pre-trained backdiffusion network. Let be the noise scheduling parameter for time step t. By using a small number of reverse steps, the server can smooth the parameter space distribution while maintaining privacy.

[0071] use Represents a pre-trained back diffusion network The conditional probability distribution modeled by (·) is used in the back diffusion phase based on the diffusion state at step t+1. Inferring the diffusion state at step t The reverse diffusion process also satisfies the Markov property:

[0072] (6);

[0073] in, (·) represents the conditional probability distribution estimate of the pre-trained backdiffusion network. These represent the parameters of the backdiffusion network (a lightweight UNet network). This represents the diffusion state at step T. In other words, the backdiffusion network predicts the parameter state of the previous time step based on the current diffusion state and the time step, thus achieving reversible recovery of the diffusion chain.

[0074] The back diffusion network includes multiple denoising modules (such as...) Figure 2 The denoising modules T, (T-1), ..., 1 (shown) are designed to progressively predict and remove noise added during forward diffusion according to noise scheduling parameters from a noisy image. Each denoising module is a lightweight neural network subunit. Its core function is to predict the estimated noise injected during forward diffusion based on the current input image and the corresponding time step information. By subtracting the predicted noise from the current input, partial removal of noise at that step can be achieved, allowing the image to revert to a clear state by one step. All denoising modules work sequentially, jointly completing the progressive reconstruction from the "noisy parameter image in the intermediate diffusion state" to the clear "output image" (i.e., the restored global parameter image).

[0075] This reverse diffusion network achieves stepwise reversible recovery of the diffusion chain by estimating the amount of noise injected during the diffusion process. This allows the two-dimensional parametric image to still reconstruct its key structural information after privacy perturbations, thereby improving the directional stability and model usability of federated aggregation.

[0076] The goal of the backdiffusion recovery process is not to reconstruct the original perturbation input, but to recover the global parameter image that satisfies the continuity constraint of the parameter space structure, so as to ensure the structural consistency of the aggregated model parameters and the stability of the update direction.

[0077] Step S9: Based on the recovered global parameter image, use the inverse function of the invertible linear mapping function. Get the updated global model parameters And broadcast it to each client.

[0078] Step S10: Determine whether the maximum number of iterations has been reached. If yes, end the iteration; otherwise, proceed to steps S2-S9.

[0079] Furthermore, to address the aggregation offset caused by Non-IID (non-independent and identically distributed) data, this invention calculates noise scheduling parameters in step S5 through heterogeneity adaptive scheduling. The server dynamically adjusts the noise step count and intensity based on the KL divergence between the client data distribution and the global distribution, applying stronger noise to clients with greater data distribution differences, thereby improving global convergence performance while protecting privacy. The noise scheduling parameters are adjusted based on the KL divergence:

[0080] (7);

[0081] in For the noise scheduling parameters of client k at time step t, The noise scheduling parameters are for time step t. For adjustment coefficients, Calculate the data distribution of client k for the server With global distribution The KL divergence between the parameters is used. KL divergence represents heterogeneity. The higher the heterogeneity, the stronger the perturbation. Therefore, under the premise of satisfying the continuity threshold and recoverability threshold of the parameter space structure, the perturbation intensity is adaptively adjusted to suppress the aggregation direction shift caused by heterogeneous clients, thereby improving the stability and controllable convergence of the global update.

[0082] The lightweight UNet network described in this invention is an improvement on the standard UNet encoder-decoder structure, and its specific implementation includes:

[0083] In the convolutional layers of the encoder and decoder, standard two-dimensional convolutions are replaced with depthwise separable convolutions to reduce the number of convolution kernel parameters and computational complexity.

[0084] The number of feature channels in each layer is compressed so that the number of output channels in each layer is reduced by a preset ratio compared to the standard UNet encoder-decoder structure.

[0085] Residual connections are introduced in the corresponding layers of the encoder and decoder to add the input features and output features of the convolutional layer, thereby alleviating network degradation and enhancing feature representation capabilities.

[0086] Meanwhile, the time step encoding Emb(t) is linearly mapped and then added element-wise or concatenated with the feature maps of each layer, so that the network can perceive the current diffusion time step information during the back diffusion process.

[0087] Through the above structural improvements, while reducing the number of model parameters, it is still possible to accurately model the distribution of diffusion noise, thereby supporting the reversible diffusion recovery of global parameter images.

[0088] Another embodiment of the present invention provides a federated learning parameter protection system based on reversible diffusion perturbation, for implementing the federated learning parameter protection method, including a module deployed on the client and a module deployed on the server;

[0089] The client module includes:

[0090] The local training unit is used to train the received global model parameters using local data;

[0091] The parameter visualization unit is used to convert the updated local model parameters into a two-dimensional parameter image that maintains the continuity of the parameter space structure through an invertible linear mapping function;

[0092] A forward diffusion unit is used to perform a multi-step forward diffusion perturbation process on the two-dimensional parametric image and generate a noisy parametric image;

[0093] The state determination and uploading unit is used to filter the candidate intermediate diffusion states in the multi-step forward diffusion perturbation process based on the parameter space structural continuity constraint and the reversible recovery constraint, and only select the noisy parameter image corresponding to the intermediate diffusion state that simultaneously satisfies the structural continuity constraint and the reversible recovery constraint to upload to the server.

[0094] The server modules include:

[0095] The aggregation unit is used to perform weighted aggregation of the noisy parameter images uploaded by each client;

[0096] The backdiffusion unit, equipped with a pre-trained backdiffusion network, performs backdiffusion on the aggregated global noisy parameter image to recover the global parameter image;

[0097] The consistency correction unit is used to perform aggregate consistency correction: it detects the continuity index of the parameter space structure of the global parameter image. If the continuity constraint of the parameter space structure is not met, it backtracks and adjusts the weight of the uploaded state of each client or the intermediate diffusion state by selecting a threshold.

[0098] The inverse parameter transformation unit is used to transform the recovered global parameter image back into global model parameters;

[0099] The scheduling unit is used to dynamically adjust noise scheduling parameters based on the heterogeneity between client data distribution and global data distribution.

[0100] Another embodiment of the present invention provides an electronic device including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the federated learning parameter protection method.

[0101] Another embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the federated learning parameter protection method.

[0102] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0103] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A federated learning parameter protection method based on reversible diffusion perturbation, characterized in that, The method comprises the following steps: The server sends global model parameters to each client; Each client trains the global model parameters using local data to obtain updated local model parameters; Each client converts the updated local model parameters into a two-dimensional parameter image that maintains the convolution kernel topology through a predefined reversible linear mapping function, to form a parameter representation that satisfies the parameter space structure continuity constraint; Each client performs a multi-step forward diffusion perturbation process on the two-dimensional parameter image to generate a corresponding noisy parameter image in multiple diffusion time steps; Each client filters candidate intermediate diffusion states in the multi-step forward diffusion perturbation process based on the parameter space structure continuity constraint and the reversible recovery constraint, and only selects noisy parameter images corresponding to candidate intermediate diffusion states that simultaneously satisfy the structure continuity constraint and the reversible recovery constraint to upload to the server; The server receives the noisy parameter images uploaded by each client, and performs weighted aggregation according to the local sample size of each client to obtain a global noisy parameter image; The server performs a reverse diffusion recovery process on the global noisy parameter image using a pre-trained reverse diffusion network to obtain a global parameter image that satisfies the parameter space structure continuity constraint; The server converts the global parameter image back into global model parameters through the inverse function of the reversible linear mapping function, and sends the global model parameters to each client to complete federated learning iteration update.

2. The federated learning parameter protection method of claim 1, wherein, The parameter space structure continuity constraint is characterized by measuring the local smoothness between adjacent weight blocks and the weight mutation degree at the hierarchical splicing position in the two-dimensional parameter image. When the measurement result is lower than a preset continuity threshold, it is considered that the two-dimensional parameter image satisfies the parameter space structure continuity constraint required for aggregation.

3. The federated learning parameter protection method of claim 1, wherein, The selection of the intermediate diffusion state includes: performing parameter space structure continuity index determination and recoverability index determination on the noisy parameter image corresponding to the candidate intermediate diffusion state respectively, and only when both satisfy the preset threshold condition, the noisy parameter image corresponding to the candidate intermediate diffusion state is determined as the upload state.

4. The federated learning parameter protection method of claim 1, wherein, Converting the local model parameters into a two-dimensional parameter image through a reversible linear mapping function specifically includes: unfolding the parameter tensors of each convolution layer in the local model into two-dimensional weight blocks in the channel dimension; mapping the original spatial dimension in the two-dimensional weight blocks into matrix row and column indexes; and splicing the two-dimensional weight blocks from different convolution layers according to the network level order to form a two-dimensional parameter image that maintains the network level relationship and the convolution kernel topology structure.

5. The federated learning parameter protection method of claim 1, wherein, The method further comprises: the server dynamically adjusts the noise scheduling parameter according to the heterogeneity between the data distribution of each client and the global data distribution.

6. The federated learning parameter protection method of claim 5, wherein, The heterogeneity is measured by KL divergence, and the adjustment formula is: ； where is the noise schedule parameter for client k at time step t, is the noise schedule parameter at time step t, is the adjustment coefficient, is the KL divergence between the server's computation of the data distribution for client k and the global distribution .

7. The federated learning parameter protection method of claim 5, wherein, After receiving the global parameter image, the server performs aggregation consistency correction: detecting the parameter space structure continuity index of the global parameter image, and if it does not satisfy the parameter space structure continuity constraint, adjusting the weight of the intermediate diffusion state uploaded by each client or the intermediate diffusion state selection threshold.

8. A federated learning parameter protection system based on reversible diffusion perturbation, used to implement the federated learning parameter protection method in any one of claims 1 to 7, characterized in that, The method comprises the following steps: The module deployed on the client comprises: a local training unit configured to train the received global model parameters using local data; a parameter imaging unit configured to convert the updated local model parameters into a two-dimensional parameter image via an invertible linear mapping function; a forward diffusion unit configured to perform a multi-step forward diffusion perturbation process on the two-dimensional parameter image and generate a noisy parameter image; a state determination and uploading unit configured to screen candidate intermediate diffusion states in the multi-step forward diffusion perturbation process based on a parameter space structure continuity constraint and an invertible recovery constraint, and only select noisy parameter images corresponding to intermediate diffusion states that simultaneously satisfy the structure continuity constraint and the invertible recovery constraint to upload to the server; the modules of the server include: an aggregation unit configured to perform weighted aggregation on the noisy parameter images uploaded by each client; a reverse diffusion unit equipped with a pre-trained reverse diffusion network, configured to perform reverse diffusion on the aggregated global noisy parameter image to recover a global parameter image; a consistency correction unit configured to perform aggregation consistency correction: detecting a parameter space structure continuity index of the global parameter image, and if the parameter space structure continuity constraint is not satisfied, adjusting the weights of the intermediate diffusion states uploaded by each client or the intermediate diffusion state selection threshold backtracking; a parameter inverse transformation unit configured to convert the recovered global parameter image back into global model parameters; a scheduling unit configured to dynamically adjust noise scheduling parameters according to the heterogeneity between client data distribution and global data distribution.

9. An electronic device comprising a processor and a memory, the memory storing a computer program, characterized in that, The computer program is executed by the processor to implement the federated learning parameter protection method of any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the federated learning parameter protection method of any one of claims 1-7.

Images