Blockchain-based federated data trust verification method

Abstract

The application belongs to the technical field of blockchains, and discloses a federated data trusted verification method based on a blockchain, which comprises a probe implantation stage, a data tampering and malicious attack detection stage, and an on-chain aggregated record stage. Merkle The method prevents malicious clients from performing small-scale data poisoning through a poisoning detection method based on a gradient heat map and a Byzantine cluster, and finally ensures the trusted aggregation of the model by uploading the verification information and the aggregated model to the blockchain through a tree.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of blockchains, and in particular relates to a federated data trusted verification method based on a blockchain. BACKGROUND

[0002] As a typical privacy-preserving collaborative learning paradigm, federated learning supports multiple participants to jointly train a model without sharing original data, and has been widely applied in the fields of financial risk control, medical diagnosis, intelligent education and intelligent manufacturing. However, while ensuring data privacy, this paradigm also brings trust problems at the level of training data.

[0003] Existing federated learning lacks verification of the legality of training data, and the model can only prove ownership through watermarking but cannot verify the actual data that is trained.

[0004] Existing federated learning verification schemes often require clients to actively implant watermarks or submit verifiable proofs during the training phase, but these proofs rely on the honest behavior of clients, and the process is open and transparent, making it easy for malicious participants to bypass.

[0005] Considering that there are various types of attackers in federated learning, including external attackers tampering with client datasets and malicious clients conducting destructive poisoning. Existing federated learning training relies on a centralized aggregation server, and the aggregation results and verification behavior of the server lack external auditability, making internal collusion, hidden tampering and responsibility traceability important security risks.

[0006] Chinese patent application ZL2021104568860 discloses a federated learning data tamper-proofing monitoring method and related device, which verifies whether the training data is tampered with through a hash value. However, this method only solves the problem of data tamper-proofing verification during transmission and cannot resist data tampering or poisoning attacks by malicious clients locally.

[0007] Chinese patent application ZL2021111526947 discloses a defense method and device for federated learning data poisoning attacks, which sets a reference benchmark and conducts internal voting to identify poisoned gradients uploaded by malicious clients, thereby resisting data poisoning attacks. However, this defense method does not consider non-poisoning data tampering problems, such as using unauthorized datasets or non-compliant datasets in federated learning tasks. SUMMARY

[0008] To solve the above technical problems, the application provides a federated data trusted verification method based on a blockchain, which verifies whether the training data is tampered with by a large proportion through a data probe. This method prevents malicious clients from conducting small-scale data poisoning, and uses a blockchain and a smart contract to verify the legality of training data. The tree will verify the information and aggregate the model on the chain, ensuring the trusted aggregation of the model.

[0009] To achieve the above object, the application is realized by the following technical scheme:

[0010] The application is a federal data trusted verification method based on a blockchain. In the federal learning scene, the federal data trusted verification method includes three stages: probe implantation stage, data tampering and malicious attack detection stage, and on-chain aggregation record stage, specifically including the following steps:

[0011] In the probe implantation stage: the client declares the data set to the authority, and the authority sends the key after confirming the training data set method ; the client calculates the probe data through the key hash, trains the client model and implants the probe, and the authority calculates the loss difference of the client model on the probe sample and non-probe sample respectively to obtain the probe significance score , The client model below the threshold value is identified as not trained according to the requirements and is directly filtered, and the compliant client model is selected;

[0012] The data tampering and poisoning detection stage includes:

[0013] Step 2.1, based on the significance score , the compliant client model is selected for forward propagation, and the gradient of the prediction score of the prediction result is calculated, and the gradient is absolute valued and normalized to generate the final gradient heat map;

[0014] Step 2.2, perform in-depth detection on the generated gradient heat map by executing a double-channel detection mechanism, which inputs the gradient heat map into a pre-trained convolutional neural network for detection and inputs the gradient into a Byzantine clustering for detection; select a high-confidence benign set that passes the double-channel detection mechanism , also select a high-confidence malicious set that does not pass the double-channel detection mechanism , calculate the feature distance between the remaining client models and the high-confidence benign set and the high-confidence malicious set according to the cosine similarity, and finally obtain a trusted gradient set;

[0015] In the on-chain aggregation record stage: generate a structured verification record for all client models that enter the trusted gradient set, generate a new round of global model, and associate the hash digest of the global model with the root of the tree and store it in the blockchain, and the client model completes the verification through the record on the blockchain.

[0016] ​A further improvement of the present application is that the probe implantation stage comprises the following steps:

[0017] Step 1.1, the client declares a data set to the authority, which is the data set used by the client to participate in the current round of federated learning task;

[0018] Step 1.2, the authority checks the consistency of the data set declared by the client, and after passing the consistency check, the authority generates a key and distributes the key of the current round of training to all client models ;

[0019] Step 1.3, after the client receives the key , the key is used as a source of randomness to perform a hash mapping operation on the local data set, automatically selecting a fixed and reproducible probe sample subset from the local data set, and constructing the probe sample subset , the local data set includes the probe sample subset and the non-probe sample subset ;

[0020] Step 1.4, when the client trains the local model, the probe sample subset selected in step 1.3 is used, the probe sample is given a higher training weight, and the total loss of the sample during training is:

[0021]

[0022] where, is the standard cross-entropy loss, indicates whether the probe sample belongs to the probe sample subset , if it is a probe sample, the value is 1, otherwise 0, is the weight coefficient, is the additional loss on the probe sample, is the sample set containing the probe and non-probe, is the deep learning prediction result of the sample set ;

[0023] Step 1.5, after the client completes the local training model of the current round, the model update is submitted to the authority, and the authority first calculates the scores of the probe samples and the non-probe samples respectively, and the sample score is:

[0024]

[0025] where, is the score function, representing the cross-entropy loss value of the client model on the input sample , are model parameters, represents the prediction output of the client model with parameters on input , is the standard cross-entropy loss function, represents the probability that the client model predicts the input belongs to the true label ;

[0026] Step 1.6, define the probe data as the positive class and the non-probe data as the negative class, and use the curve to perform the binary classification task:

[0027] ,

[0028] wherein, is the probe sample subset, is the non-probe sample subset, is the probe score of the probe sample, is the probe score of the non-probe sample, is the probability;

[0029] Step 1.7, the authority calculates the loss difference of the client model on the probe data and the non-probe data respectively, and evaluates the distinguishability of the probe data and the non-probe data in combination with the curve to obtain the significance score based on the client model:

[0030] ,

[0031] wherein, is the probe score of the sample set, is the sample set;

[0032] Based on the significance score , the compliant client model is screened out.

[0033] Further improvement of the present application is that in step 1.3, a fixed and reproducible probe sample subset is automatically selected from the local data set, specifically: data probes are implanted in the form of pseudo-random function ( ) and hash binding:

[0034]

[0035] wherein, represents the data set information declared by the client, is the key assigned by the authority to the client; Index number of the data probe in the declared data set.

[0036] Further improvement of the present application is that in the data tampering and malicious attack detection phase, step 2.1 specifically includes the following steps:

[0037] Step 2.1.1, based on the saliency score Screening the compliant client model, the authority selects a validation set, and after the authority accepts the local model of the client , a sample of the validation set is used A forward propagation is performed on the client to obtain the prediction result The prediction score :

[0038]

[0039] Wherein, The local model uploaded by the client , represents the original score of the local model on the prediction result without passing through the activation function; Step 2.1.2, calculate the prediction score Gradient

[0040] :

[0041]

[0042] Wherein, The prediction score of the prediction result on the local model The gradient of the sample set ;

[0043] Step 2.1.3, absolute value and normalization processing is performed on the gradient to generate the final gradient heat map :

[0044]

[0045] Wherein, Indicates the pixel position and channel index, The absolute value of the gradient represents the sensitivity of the pixel to the prediction result, Indicates the global maximum gradient value, which is used to normalize to , That is, the final generated gradient heat map.

[0046] Further improvement of the present application is that the gradient heat map ​​The input pre-trained neural network model completes detection, specifically:

[0047] The finally generated gradient heat map is input into the pre-trained neural network model to obtain a prediction probability distribution of the client being benign or malicious:

[0048]

[0049] wherein, represents a neural network model, , represents a prediction local model of the probability of being a benign gradient, represents a prediction local model of the probability of being a malicious gradient.

[0050] In a round of federated learning tasks, if , it means that the local model uploaded by the client is considered malicious, and a malicious gradient group , a benign gradient group and a malicious number are obtained, the gradient heat map and the neural network model result; a threshold value is set, and when the malicious number is greater than the set threshold value, the prediction result of the neural network model is taken as the final prediction result.

[0051] Further improvements of the present application are that the gradient input Byzantine clustering completes detection, specifically:

[0052] Step 2.2.1, when the malicious number is less than the set threshold value, the gradient is input into the Byzantine robust clustering device, and the Euclidean distance between the client and the client other than the client is calculated:

[0053]

[0054] wherein, represents a client other than the client in a round of federated learning tasks, is the gradient of the client , is the gradient of the client .

[0055] Step 2.2.2, the output of the Byzantine robust clustering device in step 2.2.1 is another group of benign model gradient group and a group of malicious model gradient group benign gradient groups detected by gradient heatmap Benign model gradient sets detected by the Byzantine robust clusterer Taking the union of the sets yields a set of correct sets with high confidence. and a set of high-confidence error groups ,in, This represents a high confidence level; the remaining questionable groups... Defined as:

[0056] ;

[0057] Step 2.2.3: Calculate the questionable group Each gradient in the equation has an average similarity score with the gradients of the two high-confidence groups:

[0058]

[0059]

[0060] like If the local model uploaded by the client is correct, it will be guided to the final set of reliable gradients; otherwise, it will be classified into the malicious gradient group.

[0061] A further improvement in this application is that the on-chain aggregation recording stage includes:

[0062] Step 3.1: After data tampering and poisoning detection are completed, the verifier will assign the local models uploaded by all clients to the trusted gradient set. and its uploaded client identity information Agreed-upon dataset identifier Verification timestamp and the signature of the verifier Packaged and sent to the blockchain, a partial model of the client. Generate verification record format:

[0063]

[0064] in, It is a local model The hash;

[0065] Step 3.2: The verification body will compile all verification records for this round into a single format. Hash value And using the global client model location identifiers to be aggregated as leaf nodes, construct a tree Tree;

[0066] Step 3.3, the blockchain aggregates all verified trusted local models through a federated averaging aggregation algorithm to generate a final global model ,

[0067]

[0068] wherein, represents a set of all clients verified through the data tampering and poisoning detection stage, represents a weight coefficient of the client , and satisfies

[0069]

[0070] Step 3.4, after the global model is generated, the blockchain unifies the and the verification record of each trusted local model to build a tree, and the root of the tree is:

[0071] ;

[0072] Step 3.5, the task initiator obtains the global model parameters after the training ends, and queries the global model digest of the round from the blockchain. The initiator performs a hash operation on the local client model and compares it with the global model digest queried from the blockchain. If the global model digests are consistent, it indicates that the client model has not been tampered with in the entire process of generation, transmission and storage. If there is a difference, the initiator traces the verification information of the corresponding training round according to the record on the blockchain, and combines the tree structure to verify the integrity of all verification records in the round of training.

[0073] The beneficial effects of the present application are:

[0074] The present application proposes a data probe verification mechanism based on key binding, which enables all clients to complete multi-user concurrent data set compliance verification without exposing the original data. Compared with the way of manual review of each client or model watermark relying on the honest behavior of the client, the present application significantly reduces the repeated operations in the verification process, improves the throughput of data compliance verification, and enhances the data trust flow capacity of the federated learning system.

[0075] ​​​The application depicts the attention change of the sensitive area of the model input through the gradient heat map, and combines the Byzantine robust clustering and the two-dimensional saliency feature recognition mechanism of deep learning, so that the abnormal distribution of the gradient caused by data poisoning can be effectively captured. The dual-channel detection method can still ensure high recognition rate in the case of a large number of clients and a high proportion of malicious participants, effectively detect small-scale data tampering and hidden poisoning behavior, greatly improve the robustness of federated learning training and the ability to cope with complex attack scenarios, and comprehensively improve the security of model training.

[0076] The application uses the non-tamperable and traceable characteristics of the blockchain to chain the verification record, legitimacy proof and global model digest of each round on the tree structure, realizes the public verification of the whole training process, and eliminates the space for human intervention. The aggregation operation is executed by the smart contract to ensure that any historical record can be traced back, establish a trusted computing root for federated model training, and enhance the credibility of the federated training process, avoiding the tampering and unclear responsibility problems caused by centralized aggregation.

[0077] The application integrates probe verification, heat map poisoning detection, robust aggregation and blockchain storage into a unified framework to form a secure closed loop of data source provable-model update verifiable-aggregation process auditable. This design makes it difficult for malicious clients to evade detection by modifying a small number of samples or replacing data sets, and also avoids the situation that honest clients are misjudged due to a small amount of noise. In actual deployment, this mechanism improves the trust level of participants in the system and ensures that the federated learning task can still maintain fairness and order in an open and hostile environment. BRIEF DESCRIPTION OF DRAWINGS

[0078] Figure 1 is a flowchart of the application.

[0079] Figure 2 is a schematic diagram of the probe implantation stage of the application.

[0080] Figure 3 is a comparison chart of the influence of the probe ratio on the accuracy of the aggregated model.

[0081] Figure 4 is a schematic diagram of the poisoning detection method based on the gradient heat map and the Byzantine clustering method of the application.

[0082] Figure 5 is a schematic diagram of the malicious client detection accuracy of the application.

[0083] Figure 6 is a schematic diagram of the trusted model aggregation based on the blockchain of the application. DETAILED DESCRIPTION

[0084] Embodiments of the present application will be described below with reference to drawings. Numerous specific details will be set forth in the following description in order to provide a thorough understanding. However, it will be appreciated that these specific details are not intended to limit the present application. In other words, in some embodiments of the present application, one or more of these specific details can not be used. Also, for simplicity of explanation, the fully-illustrated embodiments can be shown in block diagram form and some conventional structures and components can not be shown.

[0085] The present application is a blockchain-based federated data trust verification method, which includes three stages: probe implantation stage, data tampering and malicious attack detection stage, and on-chain aggregation record stage.

[0086] In the probe implantation stage: the client declares the data set to the authority, and the authority sends the key after confirming the trained data set method ; the client selects the probe data by key hashing, trains the client model and implants the probe, and the authority calculates the loss difference of the client model on the probe sample and the non-probe sample respectively to generate the probe significance score , The client model below the threshold value is identified as not trained as required and is directly filtered, and the compliant client model is screened out.

[0087] As shown in Figure 2 , the probe implantation stage includes the following steps:

[0088] Step 1.1, the client declares the data set to the authority, which is the data set used by the client to participate in the current round of federated learning tasks, including data set identification, version information and license proof;

[0089] Step 1.2, the authority checks the consistency of the data set declared by the client, and after passing the consistency check, the authority generates a key and distributes the key for this round of training to all client models . The consistency check includes: whether it belongs to the list of available data sets, whether the license terms meet the training scenario requirements, whether the data source is auditable, and whether there is an unauthorized derivative version.

[0090] Step 1.3, after the client receives the key , the key is used as a source of randomness to perform a hash mapping operation on the local data set, automatically selecting a fixed and reproducible probe sample subset from the local data set, and constructing the probe sample subset , the local data set includes the probe sample subset and the non-probe sample subset .

[0091] In the training process, the probe samples are given higher training weights. After the model is submitted, the verifier first calculates the scores of the probe samples and non-probe samples respectively. Assuming that the verification model is , the probe sample set is , and the remaining non-probe sample subset is .

[0092] In the implementation of the present application, cross-entropy loss is used as the score function. After obtaining the loss of the model on the probe samples and non-probe samples, the probe samples are defined as positive classes, and the non-probe samples are defined as negative classes. The curve is used for the binary classification task. If the model is indeed trained on the complete data set, it is expected to satisfy , that is, the probe samples have lower loss compared to the non-probe samples.

[0093] As shown in Figure 3 , from the experimental data, the influence of probe implantation on the precision of the final aggregation model of federated learning in various models fluctuates within ±5%, indicating that the probe in the present application has little influence on the precision of the federated learning task and does not damage the aggregation model.

[0094] Table 1 Anti-pruning attack efficiency

[0095]

[0096] As shown in Table 1, the probe method used in the present application can maintain a high verification success rate under normal pruning attack, indicating that the method proposed in the present application has high robustness.

[0097] In step 1.3, a fixed and reproducible probe sample subset is automatically selected from the local data set. Specifically, data probes are implanted using a pseudo-random function ( ) and a hash binding method:

[0098]

[0099] wherein represents the data set information declared by the client, is the key assigned to the client by the authority; is the index number of the data probe in the declared data set.

[0100] In step 1.4, the client trains the local model according to the probe sample subset selected in step 1.3 . The probe samples are given higher training weights, and the total loss of the samples during the training process is :

[0101]

[0102] where, is the standard cross-entropy loss, represents the probe sample whether it belongs to the probe sample subset , if it is a probe sample, the value is 1, otherwise 0, is the weight coefficient, if it is a probe sample, this value is not zero will add a part of the loss, if it is a non-probe sample, the value is zero, then the loss is , is the additional loss on the probe sample, is the sample set containing probes and non-probes, is the sample set , the deep learning prediction result of the sample set , so that the loss weight has a more significant impact on the gradient update in the back propagation process, thereby forming a detectable statistical feature driven by the probe in the final model parameters; Step 1.5, the verification authority can accurately reproduce the probe sample set that the client should use because it holds the same key. After the client completes the local training model in this round, the model update is submitted to the authority, which first calculates the score of the probe sample and the non-probe sample respectively. In the implementation of the present application, cross-entropy loss is used as the score function, and the probe sample score is:

[0103]

[0104] where, is the score function, which represents the cross-entropy loss value of the client model on the input sample , is the model parameter, represents the prediction output of the client model with the parameter on the input , is the standard cross-entropy loss function, represents the probability that the client model predicts that the input belongs to the real label ;

[0105] Step 1.6, after getting the loss of the probe data and the non-probe data, define the probe data as positive class and the non-probe data as negative class, and use curve to perform binary classification task:

[0106] ,

[0107] where, is the probe sample subset, is the non-probe sample subset, probe score of a probe sample, probe score of a non-probe sample, probability;

[0108] Step 1.7, the authority calculates the loss difference of the client model on probe data and non-probe data respectively, and combines Curve to evaluate the distinguishability of probe data and non-probe data, and get the significance score based on the client model

[0109]

[0110] wherein, probe score of a sample set, sample set;

[0111] If the client model is actually trained on the declared data set, then due to the additional fitting of the probe sample, it is expected to satisfy , that is, the probe data has lower loss compared with the non-probe data. Based on the significance score Screen out the compliant client model.

[0112] The score reflects whether the client actually uses the declared data set for training, whether the probe is implanted as required, whether the probe is replaced or tampered during training, etc. The client model below the threshold will be identified as not trained as required and directly filtered.

[0113] In order to prevent data tampering of non-poisonous nature, the present application carries out the second round of data trust verification: the watermark verification of the data probe used by the present application mainly relies on that the model implanted with loss probe has lower loss on probe data compared with non-probe data. Assuming that the training party agrees to train the data set , but uses the poor data set to add the probe sample set of the data set to generate a tampered model . This tampered model has never touched the non-probe sample subset of the data set , so compared with the model normally implanted with the probe, the tampered model has greater loss on the non-probe sample subset , and in order to make the tampered model pass the first round of detection, the malicious client will add the original data set during training according to the data set ​​probe data and increase the learning rate on this part of data. This leads to tampered model on the non-probe sample subset with more obvious loss difference, and thus higher PSA score.

[0114] Therefore, the present application performs a second round of verification by score. It is found that the probe score of the tampered dataset and the probe score of the normal model are separable, and the threshold score of the tampered model of the dataset score of the honest client If the client score score , the model is considered to be tampered, and the user may not be able to get normal rewards in this round of task.

[0115] After the client completes local training according to the pre-distributed key and successfully implants the data probe, the present application performs a multi-stage systematic analysis on the uploaded model update to ensure the effectiveness and reliability of data legitimacy verification and poisoning detection. The starting point of the process is the responsiveness evaluation of the probe signal. Since the probe is determined by the key and has unforgeability, the loss difference of the client model on the probe sample and the non-probe sample contains information about the use of the data set. The system evaluates the sensitivity of the model to the probe sample by calculating the score, from which it is inferred whether the client has truly used the declared data set and whether the probe has been broken, weakened or hidden. The model update must show sufficient probe discrimination in this stage to enter the subsequent integrity detection process. This mechanism ensures that subsequent analysis is only carried out on model updates with verifiable training trajectories, thereby ensuring that the logical premise of the subsequent detection stage is consistent and credible.

[0116] After the probe consistency verification, the present application performs in-depth detection on the model update in two parallel paths. These two paths depict the internal structure of the model update from different information perspectives, aiming to reveal statistical anomalies caused by attacks such as violation of data declaration, local data tampering, label flipping, fuzzy feature manipulation or backdoor behavior.

[0117] The first path constructs two-dimensional heat map representations based on gradient visualization analysis. The system extracts the spatial sensitivity structure from the gradient distribution of the model on the validation samples and maps the gradient field to the density map in the image domain to reflect the model's attention concentration area in the input space and its change pattern. These heat maps are then input into a pre-trained convolutional neural network, which automatically extracts high-level semantic features to identify whether there are abnormal shifts in the model's internal representation. For example, local label flipping or low-proportion sample poisoning often causes unexpected reinforcement or diffusion of gradients in specific areas, and such shifts are difficult to capture through overall statistics but can be represented as significant structural abnormalities in the gradient image space. This path enables the system to detect fine-grained structural abnormalities caused by training data perturbations from the local sensitivity behavior of the model.

[0118] The second path focuses on analyzing the relative distribution structure of client updates in high-dimensional space from the overall relationship between gradient updates. The system treats all client gradient vectors as observation samples of the same round of federated update distribution and uses robust clustering and robust statistical methods to identify abnormal points. Unlike detection based on probes or local features, this path directly describes the overall geometric relationship of updates, identifies updates that are significantly offset from the group distribution through distance comparison, aggregated deviation metrics, and multi-round filtering mechanisms. Such methods can effectively identify high-proportion malicious clients, manipulated overall distribution, or attacks with consistent cross-sample tampering, and are a supplement to local structural analysis based on gradient space.

[0119] When the two detection paths complete the preliminary evaluation, the system will build a consistency judgment mechanism based on the two sets of detection results. Updates are divided into "highly trusted", "highly suspicious", and "to be further determined". For samples that are consistent in the judgment of the two paths, the system directly classifies them into the corresponding set; for samples with inconsistent judgments between the two paths, the system further calculates their similarity in gradient direction, feature representation, and statistical distribution, evaluates their closer behavior categories through cosine similarity, average directional offset, and other indicators, and assigns them to the set that best fits their statistical characteristics. When some updates still cannot be reliably classified through the above methods, they will be marked as boundary samples, and their dynamic behavior will be continuously tracked in subsequent training rounds to ensure the stability and long-term consistency of the classification

[0120] Specifically, the process of double-rule poisoning detection is as shown in Figure 4

[0121] Data tampering and poisoning detection phase: includes:

[0122] Step 2.1, based on the significance score ​Screening the compliant client model, the authority selects a validation set, and the authority accepts the local model of the client Afterwards, a sample of the validation set is used The client model is forward propagated once to obtain the prediction result The prediction score :

[0123]

[0124] Wherein, The local model uploaded by the client The original score of the local model on the prediction result without passing through the activation function; this value represents the unnormalized prediction value of the model on each category. Subsequently, the gradient is backpropagated with respect to the pixels belonging to the image; Step 2. 2, calculate the prediction score Gradient

[0125] :

[0126]

[0127] Wherein, The prediction score of the prediction result on the local model The gradient of the sample set ;

[0128] Step 2.3, absolute value and normalization processing is performed on the gradient to generate the final gradient heat map :

[0129]

[0130] Wherein, Indicates the pixel position and channel index, The absolute value of the gradient indicates the sensitivity of the pixel to the prediction result. If the absolute value of the gradient of a certain position is large, it indicates that the pixel has higher importance in predicting the label, Indicates the global maximum gradient value, which is used for normalization to ,The final generated gradient heat map is .

[0131] ​Step 2.4, in-depth detection is performed on the generated gradient heat map by a double-channel detection mechanism, which refers to detecting the gradient heat map and the gradient at the same time; the gradient of the uploaded model is independently analyzed without participating in the client training and without touching the original data of the client to identify poisoning signs; the double-channel detection mechanism refers to inputting the gradient heat map into a pre-trained convolutional neural network for detection and inputting the gradient into a Byzantine clustering for detection; the gradient behavior of the uploaded client model is independently analyzed to identify poisoning signs, and a high-confidence benign set passing the double-channel detection mechanism is screened out , and a high-confidence malicious set failing to pass the double-channel detection mechanism is also screened out , the feature distance of the remaining client model and the high-confidence benign set and the high-confidence malicious set is calculated according to the cosine similarity, and the remaining client model is classified into the most similar category to ensure that all client updates can obtain a determined classification result, and finally a trusted gradient set is obtained.

[0132] The gradient heat map is input into a pre-trained neural network model for detection, specifically: the finally generated gradient heat map is input into a pre-trained neural network model to obtain the prediction probability distribution of the client being benign or malicious:

[0133]

[0134] wherein, represents the neural network model, , represents the probability of predicting that the local model is a benign gradient, represents the probability of predicting that the local model is a malicious gradient.

[0135] In a round of federated learning tasks, if , it means that the local model uploaded by the client is considered to be malicious, and a malicious gradient group , a benign gradient group and a malicious number are obtained, represents the gradient heat map and the neural network model result; a threshold is set, when the malicious number is greater than the set threshold, take as an example, is the Byzantine proportion, the Byzantine poisoning detection method is affected by the number of poisoned clients and is difficult to work normally, at this time the prediction result of the neural network model is taken as the final prediction result.

[0136] The gradient is input into the Byzantine clustering to complete detection, specifically:

[0137] Step 2.2.1, when the malicious number is less than the set threshold, in order to supplement more dimensional features, the gradient is input into the Byzantine robust clustering, and the Euclidean distance of each client with other clients is calculated:

[0138]

[0139] wherein, represents the client other than the client in a round of federated learning task, the candidate with the minimum distance and other clients is selected, the gradient of the client , the gradient of the client ;

[0140] Step 2.2.2, further iteration is carried out on the basis of , the output of the Byzantine robust clustering in step 2.2.1 is another group of benign model gradient groups and a group of model gradient groups with high probability of being malicious , the benign model gradient groups detected by the gradient heat map and the benign model gradient groups detected by the Byzantine robust clustering are taken and set, obtaining a group of correct groups with high confidence and a group of error groups with high confidence , wherein, represents high confidence , and the remaining suspicious group is defined as:

[0141] ;

[0142] Step 2.2.3, for the suspicious group , the application further calculates the similarity with the high execution all set, and adopts the traction mechanism to classify, and calculates the average similarity score of each gradient in the suspicious group with the average of the two high confidence group gradients:

[0143]

[0144]

[0145] If If the local model uploaded by the client is found to be true, it will be directed to the final set of trusted gradients; otherwise, it will be classified into the malicious gradient group. These two results constitute the final complete outcome of the entire malicious attack detection phase.

[0146] This application is in , , Dataset, , and The harmful effects of data poisoning on federated learning were tested on three models. The experimental results are shown in Tables 2 and 3.

[0147] Table 2 Impact of Tag Flipping Attack

[0148]

[0149] Table 3 Backdoor Attack Effects

[0150]

[0151] Tables 2 and 3 above demonstrate that this application achieves good detection accuracy across different proportions of malicious clients, and can... In scenarios where malicious clients are used to infect malware, maintaining a level of over [number] is possible. The detection accuracy, the detection accuracy for example Figure 5 As shown.

[0152] The on-chain aggregation record phase generates structured verification records for all client models entering the trusted gradient set, generates a new round of global models, and combines the hash digest of the global model with... The root of the tree is linked and stored in the blockchain, and the client model completes the verification through the records on the blockchain.

[0153] During the aggregation phase of federated learning, the system needs to ensure that model updates from different clients, after completing data probe verification and poisoning detection, participate in global model aggregation in a traceable and tamper-proof manner. To this end, this application utilizes the native features of the blockchain system. The tree structure organizes all verification records and aggregated summaries from each training round into blocks for the same round, and aggregate scheduling and state registration are completed through smart contracts on the blockchain. The on-chain structure is as follows: Figure 6 As shown, this process is completed collaboratively by the verification authority, smart contracts, and off-chain aggregation modules, ensuring that all verification states generated during the training process are recorded in the blockchain. Strict identity binding and consistency guarantees are achieved in the tree structure.

[0154] After each round of training, each client submits the local model update to the authority. The authority first performs probe verification and poisoning detection to confirm whether the client model meets the data probe embedding requirements and whether there are abnormal gradient characteristics caused by label flipping or backdoor samples.

[0155] The off-chain aggregation module loads each validated client model update from the off-chain storage system according to the input set recorded by the smart contract, and performs gradient aggregation according to the indicated strategy. The aggregation algorithm can be weighted average, robust aggregation, or other strategies preset by the task party. After aggregation, the off-chain module serializes the global model obtained by aggregation, calculates its parameter hash digest, and returns the digest to the smart contract.

[0156] For the model that passes all detection processes, the authority constructs a structured verification record for it and serializes the record into a chain-compliant leaf data. Each verification record contains five basic fields: model verification result, model parameter hash digest, training party identity, data set certificate number, and verification authority signature. The verification result describes whether the model passes the probe and poisoning detection; the model parameter hash is used to represent the model parameters uploaded by the client; the identity corresponds to the specific client; the data set certificate number is used to confirm the legal source of the training data set submitted by the client; and the verification party signature guarantees the authenticity and traceability of the verification record. The verification authority encodes each record as an independent leaf node, which is used as a basic element to build the block of this round.

[0157] The verification authority arranges all leaf nodes in the order of the training clients and constructs a blockchain-native tree based on them. The blockchain system calculates the parent nodes layer by layer based on the node order and fixed hash combination rules until the root value of the block of this round is obtained. This root value is used to uniquely represent the overall structure and content of all verification records of this round of federated training. Subsequently, the verification authority submits the root of this training round, the round number, the verification authority signature, and the list of validated clients to the smart contract. The smart contract verifies the validity of the signature of the submitted content and writes this information into the blockchain state storage, so that the root enters the chain as the formal verification result summary of this round of training.

[0158] The specific on-chain aggregation record phase includes the following steps:

[0159] Step 3.1, after data tampering and poisoning detection, the verification party uploads all local models and their uploaded client identity information , and the agreed data set identifier​​ Verification timestamp and the signature of the verifier Packaged and sent to the blockchain, a partial model of the client. Format for generating verification records:

[0160]

[0161] in, It is a local model of ;

[0162] After receiving the global model summary, the smart contract compares it with the data from the current training round. The root, verification authority signature, aggregation timestamp, and round number are written together into the blockchain's state record. This is because each block in the blockchain contains its own... In this tree-structured approach, the verification record's data hash and global model summary are managed as leaf nodes of the current round's block, ensuring that training records and aggregation results are integrated within the block. A tree structure maintains consistency and immutability. Any node in the chain can be accessed via... The path verification determines whether a verification record belongs to the training block, while the task initiator only needs to read the global model summary stored on the chain to perform consistency verification by comparing it with the locally obtained model.

[0163] Step 3.2: The verification body will compile all verification records for this round into a single format. Hash value And using the global client model location identifiers to be aggregated as leaf nodes, construct a tree Tree;

[0164] Step 3.3: The blockchain aggregates all verified and trusted local models through smart contracts using a federated average aggregation algorithm (FedAvg) to generate the final global model. ,

[0165]

[0166] in, This represents the set of all clients that have passed the data tampering and poisoning detection stages. Indicates client The weight coefficients, and satisfying

[0167]

[0168] Step 3.4: Verify information and store it on the blockchain in the global model. In the global model... After generation, the blockchain uses smart contracts to transmit the global model. hash of the global model and the verification record of each trusted local model unified into a tree, the root of the tree is:

[0169] ;

[0170] Step 3.5, global model delivery and on-chain trusted verification. After the training ends, the task initiator obtains the global model parameters from the off-chain server, and queries the global model digest of this round from the blockchain. The initiator performs a hash operation on the local client model and compares it with the global model digest queried from the blockchain. If the global model digests are consistent, it means that the client model has not been tampered with in the entire process of generation, transmission and storage. If there is a difference, the initiator can trace back to the verification information of the corresponding training round according to the record on the blockchain, and combine the tree structure to verify the integrity of all verification records in this round of training.

[0171] The present application constructs an extensible data probe verification mechanism. This mechanism can realize multi-client parallel data set legality confirmation without uploading original data, reduce the repeated workload of traditional client-by-client verification method, and improve the efficiency of data trusted circulation in the process of federated learning training.

[0172] The present application proposes a data probe and statistical verification method based on key binding, so that the verification process does not need to expose the probe sample or key details, and can judge whether the client has truly used the agreed data set, thereby improving the security of the verification process, avoiding the inference of the probe, and reducing the attack risk brought by the information side channel.

[0173] The present application designs a double-channel detection mechanism based on gradient heat map and Byzantine robust aggregation. This mechanism can independently analyze the gradient behavior of the uploaded model without participating in client training and contacting client original data, identify poisoning signs, enhance the coverage ability of the system to multiple threat scenarios, and improve the overall credibility of federated learning training.

[0174] The present application constructs a trusted record and aggregation system based on blockchain, which solidifies each round of verification record, client trusted contribution and final global model digest in the on-chain structure, avoids internal manipulation and subsequent denial, realizes the verifiability, non-repudiation and cross-round consistency guarantee of the whole training process.

[0175] The above merely illustrates the embodiments of the present application but should not be taken as limitations. For those skilled in the art, the present application can have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. within the spirit and principles of the present application shall be included in the scope of the claims of the present application.

Claims

1. A blockchain-based method for trusted verification of federated data, characterized in that: In the context of federated learning, the federated data trust verification method comprises three stages: probe implantation, data tampering and malicious attack detection, and on-chain aggregated record stage, specifically including the following steps: During the probe implantation phase: The client declares the dataset to the authoritative institution, and the authoritative institution sends the key after confirming the legitimacy of the training dataset. ; The client selects probe data using key hashing, trains the client model, and implants the probe. An authoritative institution calculates the loss difference between the client model on probe samples and non-probe samples, generating a probe significance score. , Client models that fall below the threshold are identified as not trained as required and are directly filtered out, while compliant client models are selected. Data tampering and poisoning detection stage: including: Step 2.1: Based on significance score Select compliant client models for forward propagation and calculate the prediction results. The gradient of the predicted score is obtained, and the gradient is processed by absolute value conversion and normalization to generate the final gradient heatmap. Step 2.2: Perform in-depth detection using a dual-path detection mechanism on the generated gradient heatmap. This mechanism involves inputting the gradient heatmap into a pre-trained convolutional neural network for detection, and inputting the gradient into Byzantine clustering for detection. High-confidence benign sets that pass the dual-path detection mechanism are then selected. Similarly, high-confidence malicious aggregates that fail the dual-path detection mechanism are filtered out. The remaining client models and the high-confidence benign set are calculated based on cosine similarity. and high-confidence malicious aggregation The feature distance is used to obtain the set of reliable gradients. During the on-chain aggregation record phase: Structured verification records are generated for all client models entering the trusted gradient set, a new round of global models is generated, and the hash digest of the global model is compared with... The root of the tree is linked and stored in the blockchain, and the client model completes the verification through the records on the blockchain.

2. The blockchain-based federated data trusted verification method according to claim 1, characterized in that: The probe implantation stage includes the following steps: Step 1.1: The client declares the dataset to the authoritative institution. This dataset is the dataset that the client intends to use in this round of federated learning tasks. Step 1.2: The authoritative organization performs a consistency check on the dataset declared by the client. After passing the consistency check, the authoritative organization generates a key and distributes the key for this round of training to all client models. ; Step 1.3: The client receives the key. Then, the key As a source of randomness, a hash mapping operation is performed on the local dataset to automatically select a fixed and reproducible subset of probe samples from the local dataset, thus constructing the probe sample subset. The local dataset includes a subset of probe samples. Non-probe sample subset ; Step 1.4: When the client trains the local model locally, it selects a subset of probe samples according to step 1.

3. Probe samples are added to the loss weights during training. loss : ， in, For standard cross-entropy loss, Indicates probe sample Does it belong to a subset of probe samples? If it is a probe sample, The value is 1 if it is 1, otherwise it is 0. These are the weighting coefficients. To add additional loss to the probe sample, For a sample set that includes both probes and non-probes, For sample set The prediction results of deep learning; Step 1.5: After the client completes the local training of the model for this round, it submits the updated client model to the authoritative institution. The authoritative institution first calculates the scores for probe samples and non-probe samples separately. The score is: ， in, It is a scoring function, representing the client model's performance on the input samples. The cross-entropy loss value on, For model parameters, The parameter is The client-side model for input The predicted output, It is the standard crossover loss function. Indicates the client model predicts the input. Belongs to real labels The probability of; Step 1.6: Define probe data as positive and non-probe data as negative. Curves for binary classification tasks: ， in, For a subset of probe samples, This is a subset of non-probe samples. The probe score is given to the probe sample. The probe score for non-probe samples. For probability; Step 1.7: Authoritative institutions calculate the loss difference of the client-side model on probe data and non-probe data respectively, and combine it with... The curve is used to evaluate the distinguishability between probe data and non-probe data, and a significance score based on the client model is obtained. : ， in, The probe score is assigned to the sample set. For the sample set; Based on significance score Select compliant client models.

3. The blockchain-based federated data trusted verification method according to claim 2, characterized in that: In step 1.3, a fixed and reproducible subset of probe samples is automatically selected from the local dataset. Specifically, data probes are implanted using a pseudo-random function and hash binding. ， in, This indicates the dataset information declared by the client. The key assigned to the client by the authoritative authority; This is the index number of the data probe within the declared dataset.

4. The blockchain-based federated data trusted verification method according to claim 1, characterized in that: In the data tampering and malicious attack detection phase, step 2.1 specifically includes the following steps: Step 2.1.1: Based on significance score After selecting compliant client models, an authoritative organization chooses a validation set and receives partial client models from the authoritative organization. Then, using a sample from the validation set Perform a forward propagation on the client to obtain the prediction result. Predicted score : ， in, It is a client Uploaded partial model, This indicates that the local model affects the prediction results. No passage The raw score of the activation function; Step 2.1.2: Calculate the predicted score gradient : ， in, Indicates the prediction result Prediction scores on the local model For sample set The gradient; Step 2.1.3, Gradient After performing absolute value conversion and normalization, the final gradient heatmap is generated. : ， in, Indicates pixel position and channel index. The absolute value of the gradient represents the sensitivity of that pixel to the prediction result. This represents the global maximum gradient value, used for normalization to... , This is the final gradient heatmap generated.

5. The blockchain-based federated data trusted verification method according to claim 4, characterized in that: gradient heatmap The detection is performed by inputting a pre-trained neural network model as follows: The final generated gradient heatmap The input is fed into a pre-trained neural network model to obtain the predicted probability distribution of whether the client is benign or malicious: ， in, Represents a neural network model. , Indicates the predictive local model The probability of a benign gradient. Indicates the predictive local model The probability of a malicious gradient; In a round of federated learning tasks, if This indicates that the local model uploaded by the client is considered malicious, resulting in a malicious gradient set. benign gradient group and malicious quantity , This represents the gradient heatmap and neural network model results; a threshold is set for the number of malicious attacks. When the value exceeds the set threshold, the prediction result of the neural network model will be used as the final prediction result.

6. The blockchain-based federated data trusted verification method according to claim 5, characterized in that: The gradient is input into Byzantine clustering to complete the detection, specifically: Step 2.2.1, when the number of malicious attacks... When the gradient is less than the set threshold, Input into the Byzantine robust clusterer, compute client With the client Any client other than Euclidean distance: ， in, Including the client in a round of federated learning tasks Any client other than For the client gradient, For any client The gradient; In steps 2.2.2 and 2.2.1, the output of the Byzantine robust clusterer is another set of benign model gradients. and a malicious set of model gradients benign gradient groups detected by gradient heatmap Benign model gradient sets detected by the Byzantine robust clusterer Taking the union of the sets yields a set of correct sets with high confidence. and a set of high-confidence error groups ,in, This represents a high confidence level; the remaining groups are of questionable confidence. Defined as: ； Step 2.2.3: Calculate the questionable group Each gradient in the equation has an average similarity score with the gradients of the two high-confidence groups: ， ， like If the local model uploaded by the client is correct, it will be guided to the final set of reliable gradients; otherwise, it will be classified into the malicious gradient group.

7. The blockchain-based federated data trusted verification method according to claim 1, characterized in that: The on-chain aggregation record phase includes: Step 3.1: After data tampering and poisoning detection are completed, the verifier will assign the local models uploaded by all clients to the trusted gradient set. and its uploaded client identity information Agreed-upon dataset identifier Verification timestamp and the signature of the verifier Packaged and sent to the blockchain, a partial model of the client. Generate verification record format: ， in, It is a local model The hash; Step 3.2: The verification body will compile all verification records for this round into a single format. Hash value And using the global client model location identifiers to be aggregated as leaf nodes, construct a tree Tree; Step 3.3: The blockchain aggregates all verified and trusted local models using a federated average aggregation algorithm to generate the final global model. , ， in, This represents the set of all clients that have passed the data tampering and poisoning detection stages. Indicates the client The weight coefficients, and satisfying ； Step 3.4, in the global model After generation, the blockchain will use the global model. of And the verification records of each trusted local model Unified construction On the tree, The roots of the tree are: ; Step 3.5: After training, the task initiator obtains the global model parameters and queries the global model summary for that round from the blockchain. The initiator performs a hash operation on the local client model and compares it with the global model summary queried from the blockchain. If the global model summaries match, it means that the client model has not been tampered with during the entire process of generation, transmission, and storage. If discrepancies occur, the initiator traces the verification information of the corresponding training round based on the records on the blockchain, and combines it with... The tree structure verifies the completeness of all validation records in this round of training.

Images