Federal learning hybrid encryption method and system based on RRAM
By combining the parallel computing capabilities and inherent noise characteristics of RRAM in federated learning, hybrid encryption of differential privacy and homomorphic encryption is achieved, solving the problem of coordinating the optimization of privacy protection and computational efficiency on resource-constrained devices, improving encryption speed and avoiding additional overhead.
Patent Information
- Application Number
- CN202511584802.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-31
- Publication Date
- 2026-02-10
AI Technical Summary
Existing federated learning techniques struggle to efficiently balance privacy protection and computational efficiency on resource-constrained edge devices. Traditional homomorphic encryption algorithms suffer from high computational complexity, differential privacy noise injection leads to decreased model accuracy, and existing technologies fail to effectively utilize the characteristics of RRAM.
A hybrid encryption method based on RRAM is adopted, which utilizes the parallel in-memory computing capability and inherent noise characteristics of RRAM, and combines differential privacy and homomorphic encryption. By mapping the weight matrix in the RRAM array and injecting differential privacy noise using its periodic read noise, the weight matrix is encrypted, and the encryption result is obtained through analog-to-digital conversion.
It significantly improves encryption speed, avoids additional computational overhead, is suitable for resource-constrained edge devices, and provides efficient privacy protection and computational acceleration.
Smart Images
Figure CN121508926A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of data security protection in federated learning, and particularly relates to a federated learning hybrid encryption method and system based on RRAM. BACKGROUND
[0002] With the wide application of machine learning technology in various fields, data privacy and data island problems are increasingly prominent. As an emerging machine learning technology, federated learning allows multiple clients to collaboratively train models while maintaining local data privacy, effectively solving the data island problem. However, federated learning still faces double privacy threats, the training data on the client side may be subject to inference attacks from other malicious clients or external attackers, in addition, the insecure aggregation on the server side may also lead to privacy leakage. To address these challenges, differential privacy (DP) and homomorphic encryption (HE) technologies are proposed and applied in federated learning. Differential privacy adds noise to data during training to resist privacy risks from malicious clients or external attackers, but may result in decreased model accuracy and high computational overhead. Homomorphic encryption protects model updates by performing calculations on encrypted data to prevent server compromise, but traditional homomorphic encryption algorithms have high computational complexity, making it difficult to meet real-time requirements. In addition, existing federated learning solutions mostly rely on general-purpose processors (such as CPUs), which are difficult to run efficiently on resource-constrained edge devices. Resistive random access memory (RRAM) as a new type of non-volatile memory has parallel in-memory computing capability based on cross-array structure, which can significantly improve encryption speed; the inherent random noise of RRAM conforms to Gaussian distribution, which can naturally meet the noise injection requirement of differential privacy, avoiding additional computational overhead. However, existing technologies have not effectively combined the above characteristics of RRAM to achieve the synergistic optimization of privacy protection and computational efficiency. SUMMARY
[0003] The technical problem to be solved by the present application is to provide a federated learning hybrid encryption method and system based on RRAM, which effectively combines the characteristics of RRAM to achieve the synergistic optimization of privacy protection and computational efficiency, and significantly improves the encryption speed and avoids additional computational overhead.
[0004] To solve the above technical problems, the technical scheme adopted by the present application is as follows: A federated learning hybrid encryption method based on RRAM, comprising the following steps: generating a random vector , adding noise to the random vector Deployed in the first row of the RRAM array; the weight matrices that need to be protected in federated learning are sequentially mapped to the subsequent row storage units of the RRAM array, and during the mapping process, the inherent periodic read noise of RRAM is used as differential privacy noise injection to generate weight matrices that meet differential privacy requirements; activate the random vector deployed in the first row of the RRAM array. Obtain its row voltage and according to Generate reference current In each round, the weight rows in the weight matrix that satisfy the differential privacy requirement are activated, and in each round... During activation, the voltage of the activated weight row is affected by the row voltage of the first row of the RRAM array. Modulation generates instantaneous current , The weight matrix that satisfies differential privacy requirements Each weighted row, The first in the weight matrix Each weighted row; the reference current Rounds instantaneous current Summing and then performing modular conversion yields the first... Each weight row The result of the encryption operation.
[0005] Optionally, the generation of random vectors Includes generating random integers and prime numbers , random integer and prime numbers Multiplication yields a random vector .
[0006] Optionally, when using the inherent periodic read noise of RRAM as differential privacy noise injection to generate a weight matrix that satisfies the differential privacy requirement during the mapping process, the functional expression for generating the weight matrix that satisfies the differential privacy requirement is: , in, The weights in the weight matrix The corresponding generated results The added value has a mean of 0 and a variance of . Differential privacy noise, This represents the standard deviation of the periodic read noise of the RRAM array.
[0007] Optionally, the standard deviation of the periodic read noise of the RRAM array is calculated using the following function: , in, is a constant representing the noise disturbance, and are the maximum and minimum conductivities of the RRAM array, respectively.
[0008] Optionally, when the inherent periodic read noise of the RRAM is used as differential privacy noise injection to generate a weight matrix satisfying the differential privacy requirement in the mapping process, the weight rows in the weight matrix are regarded as data sets, the weight rows in the weight matrix satisfying the differential privacy requirement are regarded as outputs, and for all adjacent data sets and and all possible outputs , a mechanism satisfying the differential privacy requirement is generated The constraint condition satisfied is: , wherein, is the probability of generating an output satisfying the differential privacy requirement for the data set , is the privacy budget, is the probability of generating an output satisfying the differential privacy requirement for the data set , is the preset probability of privacy protection failure.
[0009] Optionally, the calculation function expression of the privacy budget is: , wherein, is a clipping threshold for controlling the sensitivity in differential privacy, limiting the influence of a single data point on the training result; is the preset probability of privacy protection failure; is the minimum client data set size, is a constant representing the noise disturbance, and are the maximum and minimum conductivities of the RRAM array, respectively.
[0010] In addition, the present application also provides a RRAM-based federated learning hybrid encryption system, comprising a processor and an RRAM array connected to each other, and the RRAM array is programmed or configured to execute the RRAM-based federated learning hybrid encryption method.
[0011] Optionally, the output end of the RRAM array is further connected with an analog-to-digital converter, and the RRAM array is connected with the processor through the analog-to-digital converter.
[0012] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the RRAM-based federated learning hybrid encryption method by a processor.
[0013] Furthermore, the present invention also provides a computer program product, including a computer program or instructions that are programmed or configured to execute the RRAM-based federated learning hybrid encryption method via a processor.
[0014] Compared with existing technologies, the present invention can achieve the following beneficial effects: The present invention combines differential privacy (DP) and homomorphic encryption (HE) into a hybrid encryption mechanism, and utilizes the parallel computing capabilities and inherent noise characteristics of resistive random access memory (RRAM) to achieve efficient and secure data processing. It can effectively combine the characteristics of RRAM to achieve synergistic optimization of privacy protection and computational efficiency, thereby significantly improving encryption speed and avoiding additional computational overhead. It is especially suitable for privacy protection and computational acceleration of federated learning in resource-constrained edge devices. Attached Figure Description
[0015] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.
[0016] Figure 2 This is a schematic diagram illustrating the basic principle of the method in an embodiment of the present invention.
[0017] Figure 3 This invention provides a comparison of the training time of federated learning with non-private and other encryption methods at different key lengths, based on the method of this embodiment. Detailed Implementation
[0018] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.
[0019] like Figure 1 As shown, the federated learning hybrid encryption method based on RRAM in this embodiment includes the following steps: 1. Hardware mapping: Generating random vectors , will random vector Deployed in the first row of the RRAM array; the weight matrices that need to be protected in federated learning are sequentially mapped to the subsequent row storage units of the RRAM array, and the inherent periodic read noise of RRAM is used as differential privacy noise injection during the mapping process to generate weight matrices that meet the differential privacy requirements. 2. Encrypted computation: Activate the random vector deployed in the first row of the RRAM array. Obtain its row voltage and according to Generate reference current In each round, the weight rows in the weight matrix that satisfy the differential privacy requirement are activated, and in each round... During activation, the voltage of the activated weight row is affected by the row voltage of the first row of the RRAM array. Modulation generates instantaneous current , The weight matrix that satisfies differential privacy requirements Each weighted row, The first in the weight matrix Each weighted row; the reference current Rounds instantaneous current Summing and then performing modular conversion yields the first... Each weight row The encryption operation result is then obtained. Subsequently, based on Kirchhoff's current law, the key encryption operation is achieved by simulating the sum of column currents. .
[0020] like Figure 2 As shown, the federated learning hybrid encryption method based on RRAM in this embodiment is a hybrid encryption mechanism of differential privacy (DP) and homomorphic encryption (HE), where BL1 to BL3 are the bit lines of the RRAM array, WL1 to WL3 are the word lines of the RRAM array, and the random vector... Deployed in the first row of the RRAM array; the federated learning weight matrix that needs protection is expanded into a weight matrix and then noise is added ( ~ and ~ The data is sequentially mapped to subsequent row storage units in the RRAM array, and then the encryption result can be obtained through modulo operations. The homomorphic encryption (HE) in this embodiment employs a symmetric homomorphic encryption method. Its principle is that after encrypting plaintext data, the ciphertext state can support addition and a finite number of multiplication operations, and the decrypted result is consistent with the result of directly calculating on the plaintext. The key generation algorithm for symmetric homomorphic encryption uses security parameters... Given two large prime numbers as input, output two large prime numbers. and and random numbers secret key The encryption algorithm uses a secret key. Plain text Large random integers and small integers The function expression for taking input and outputting ciphertext is: , wherein, is an encryption result, is a random number, and is a random integer, and is a prime number, is a plaintext, is a modulo operation, and when a weight matrix of federated learning to be protected is substituted, it can be expressed as: , wherein, is a ciphertext of , is an element in the i-th row and j-th column of the weight matrix of federated learning. is a result after injecting differential privacy noise. In the federated learning scenario, the weight parameters of the client need to be encrypted and uploaded to the server for aggregation. In this embodiment, the parallel computing capability of RRAM is utilized to accelerate homomorphic encryption. By distributing the elements of the weight matrix to different columns of the RRAM array and adopting a round-activated time-division multiplexing scheme, parallel encryption of multiple elements is realized, which significantly improves the computing efficiency.
[0021] In this embodiment, a random vector is generated. The random integer and the prime number are multiplied to obtain the random vector . .
[0022] In this embodiment, when the inherent periodic read noise of RRAM is utilized as differential privacy noise injection to generate a weight matrix satisfying the differential privacy requirement in the mapping process, the function expression for generating the weight matrix satisfying the differential privacy requirement is: , wherein, is a generated result corresponding to the weight in the weight matrix, is differential privacy noise with a mean of 0 and a variance of , is the standard deviation of the periodic read noise of the RRAM array.
[0023] In this embodiment, the function expression for calculating the standard deviation of the periodic read noise of the RRAM array is: , wherein, is a constant representing noise disturbance, and respectively, combined with the differential privacy requirement and the RRAM noise characteristics, the privacy budget provided by the periodic read noise can be obtained.
[0024] In this embodiment, the inherent noise of the RRAM array is utilized to realize differential privacy: differential privacy (DP) is a method of protecting individual privacy by adding noise to data, the core idea of which is to ensure that the existence or nonexistence of a single data point has little effect on the result in the process of data publishing or analysis. Specifically, the framework of differential privacy (DP) requires that for all adjacent data sets and and all possible outputs , a mechanism is generated to satisfy the differential privacy requirement The constraint condition satisfied is: , wherein, is the probability of generating an output satisfying the differential privacy requirement for the data set , is the privacy budget, is the probability of generating an output satisfying the differential privacy requirement for the data set , is the preset probability of failure of privacy protection. Therefore, in this embodiment, when the inherent periodic read noise of the RRAM is utilized as the differential privacy noise injection to generate a weight matrix satisfying the differential privacy requirement in the mapping process, the weight row in the weight matrix is regarded as a data set, the weight row in the generated weight matrix satisfying the differential privacy requirement is regarded as an output, for all adjacent data sets and and all possible outputs , a mechanism is generated to satisfy the differential privacy requirement The constraint condition satisfied is: , wherein, is the probability of generating an output satisfying the differential privacy requirement for the data set , is the privacy budget (the smaller it is, the stronger the privacy protection is), is the probability of generating an output satisfying the differential privacy requirement for the data set , is the preset probability of failure of privacy protection (usually a very small positive number). To ensure this differential privacy property, noise is usually added to the data, and in this embodiment, a Gaussian mechanism is adopted: , wherein, is the sensitivity of the function , denotes a sample from a Gaussian distribution with mean 0 and variance . The periodic read noise inherent to RRAM devices is utilized as a differential privacy noise injection mechanism.
[0025] In this embodiment, the calculation function expression of the privacy budget is: , wherein, is a clipping threshold used to control the sensitivity in differential privacy, limiting the influence of a single data point on the training result; is a preset probability of privacy protection failure (usually a very small positive number); is the minimum client data set size, is a constant representing noise disturbance, and are the maximum and minimum conductivities of the RRAM array, respectively. The privacy budget can be used to guide the hardware design.
[0026] In order to verify the RRAM-based federated learning hybrid encryption method of the present embodiment, the performance of the RRAM-based federated learning hybrid encryption method of the present embodiment is verified using MNIST and CIFAR data sets in this embodiment. By simulating different RRAM configurations, the privacy protection capability and the computing efficiency of the system are evaluated, and the results are shown in Table 1.
[0027] Table 1 Comparison of privacy protection capability and computing efficiency under different RRAM configurations
[0028] In Table 1, GST PCM, TaOx / HfOx, and AIOx / HfO are three existing RRAM array devices, is the minimum conductivity of the RRAM array, is the on-off ratio, is a constant representing noise disturbance. Combined with and the on-off ratio , the maximum conductivity of the RRAM array can be calculated, and then the privacy budget can be calculated. The experimental results shown in Table 1 show that the method of the present embodiment significantly improves the training efficiency of federated learning while maintaining a high level of privacy protection, providing an effective hardware implementation path for resource-constrained edge devices.
[0029] Furthermore, the method of this embodiment is compared with the unencrypted method and other encryption methods (paillier) at different key lengths (prime numbers). The comparison of federated learning training time under different digits yields the following results: Figure 3 As shown. See also Figure 3 As can be seen, compared with the unencrypted method and other encryption methods (paillier), the method in this embodiment achieves significantly better results in terms of federated learning training time, almost approaching the performance of the unencrypted method. It is evident that the method in this embodiment utilizes the simulation characteristics of the RRAM cross-array to achieve… The parallel multiplier execution, with its time complexity, avoids the bit-level serialization bottleneck of the von Neumann architecture. After summing the column currents, the signals are converted into digital signals by a high-speed analog-to-digital converter (ADC) and input into a lightweight digital coprocessor. To optimize modular arithmetic, the Barrett reduction method is used, transforming modular arithmetic into subtraction and shift operations, thereby improving computational speed and efficiency.
[0030] Furthermore, this embodiment also provides a federated learning hybrid encryption system based on RRAM, including interconnected processors and an RRAM array, wherein the RRAM array is programmed or configured to execute the RRAM-based federated learning hybrid encryption method. For processors without an analog-to-digital converter (ADC), an ADC may be connected to the output of the RRAM array, and the RRAM array is connected to the processor via the ADC.
[0031] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the RRAM-based federated learning hybrid encryption method via a processor.
[0032] Furthermore, this embodiment also provides a computer program product, including a computer program or instructions that are programmed or configured to execute the RRAM-based federated learning hybrid encryption method via a processor.
[0033] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.
Claims
1. A federated learning hybrid encryption method based on RRAM, characterized in that, The process includes the following steps: generating random vectors , random vector Deployed in the first row of the RRAM array; the weight matrices that need to be protected in federated learning are sequentially mapped to the subsequent row storage units of the RRAM array, and during the mapping process, the inherent periodic read noise of RRAM is used as differential privacy noise injection to generate weight matrices that meet differential privacy requirements; activate the random vector deployed in the first row of the RRAM array. Obtain its row voltage and according to Generate reference current ; In each round, the weight rows in the weight matrix that satisfy the differential privacy requirement are activated, and in each round... During activation, the voltage of the activated weight row is affected by the row voltage of the first row of the RRAM array. Modulation generates instantaneous current , The weight matrix that satisfies differential privacy requirements Each weighted row, The first in the weight matrix Each weighted row; the reference current Rounds instantaneous current Summing and then performing modular conversion yields the first... Each weight row The result of the encryption operation.
2. The RRAM-based federated learning hybrid encryption method according to claim 1, characterized in that, The generation of random vectors Includes generating random integers and prime numbers , random integer and prime numbers Multiplication yields a random vector .
3. The RRAM-based federated learning hybrid encryption method according to claim 1, characterized in that, When using the inherent periodic read noise of RRAM as differential privacy noise injection to generate a weight matrix that satisfies differential privacy requirements during the mapping process, the function expression for generating the weight matrix that satisfies differential privacy requirements is as follows: ， in, The weights in the weight matrix The corresponding generated results The added value has a mean of 0 and a variance of . Differential privacy noise, This represents the standard deviation of the periodic read noise of the RRAM array.
4. The RRAM-based federated learning hybrid encryption method according to claim 3, characterized in that, The standard deviation of the periodic read noise of the RRAM array is calculated using the following function: ， in, A constant characterizing noise disturbance, and These are the maximum and minimum conductivity of the RRAM array, respectively.
5. The federated learning hybrid encryption method based on RRAM according to claim 1, characterized in that, When using the inherent periodic read noise of RRAM as differential privacy noise injection to generate a weight matrix that meets differential privacy requirements during the mapping process, the weight rows in the weight matrix are considered as the dataset, and the weight rows in the weight matrix that meets differential privacy requirements are considered as the output. For all adjacent datasets... and and all possible outputs A mechanism that generates differential privacy requirements. The constraints to be satisfied are: ， in, For the dataset Generate output that meets differential privacy requirements The probability, For privacy budget, For the dataset Generate output that meets differential privacy requirements The probability, This represents the preset probability of privacy protection failure.
6. The RRAM-based federated learning hybrid encryption method according to claim 5, characterized in that, The expression for the calculation function of the privacy budget is: ， in, The pruning threshold is used to control the sensitivity in differential privacy and limit the impact of a single data point on the training results. The preset probability of privacy protection failure; To minimize the client dataset size, A constant characterizing noise disturbance, and These are the maximum and minimum conductivity of the RRAM array, respectively.
7. A federated learning hybrid encryption system based on RRAM, comprising interconnected processors and an RRAM array, characterized in that, The RRAM array is programmed or configured to perform the RRAM-based federated learning hybrid encryption method as described in any one of claims 1 to 6.
8. The RRAM-based federated learning hybrid encryption system according to claim 7, characterized in that, The output of the RRAM array is also connected to an analog-to-digital converter, and the RRAM array is connected to the processor through the analog-to-digital converter.
9. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the RRAM-based federated learning hybrid encryption method of any one of claims 1 to 6 via a processor.
10. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the RRAM-based federated learning hybrid encryption method of any one of claims 1 to 6 via a processor.