Confidential distributed machine learning

Abstract

A general aspect of the present disclosure relates to a method comprising: a computer-implemented federated learning method for machine learning an owner of a model; a computer-implemented federated learning method for the coordinator; a computer-implemented federated learning method for training the client; and / or a computer-implemented federated learning method for an aggregator.

Description

Background Technology

[0001] Federated (machine) learning can be considered a subtype of distributed (machine) learning. In federated machine learning (see, for example, Priyanka Mary Mammen. 2021. Federated Learning: Opportunities and Challenges. In Proceedings of ACM Conference (Conference'17). ACM, New York, NY, USA, 5 pages; https: / / arxiv.org / pdf / 2101.05428.pdf), multiple devices, under the supervision of a central server, collaboratively learn machine learning models such as artificial neural networks without sharing their private training data. Therefore, federated (machine) learning is particularly suitable for domains where sharing private training data is not possible for data protection reasons (e.g., healthcare, finance, etc.).

[0002] In federated learning, local machine learning model updates are generated by participating in a local training process on the device. These local machine learning model updates are then aggregated (i.e., combined) into a trained global machine learning model. For example, a secure aggregation algorithm is known from Hossein Fereidooni et al., “SAFELearn: Secure Aggregation for private FEderatedLearning”, Cryptology ePrint Archive, Paper 2021 / 386; https: / / eprint.iacr.org / 2021 / 386.

[0003] A Trusted Execution Environment (TEE) provides a secure and trusted runtime environment for applications. A known example of a TEE is the Intel Software Guard Extension (Intel SGX), see, for example, https: / / de.wikipedia.org / w / index.php?title=Software_Guard_Extensions&oldid=232528710. The concept of Remote Attestation is well-known in the field of trusted computing. This allows authorized parties to, for example, identify changes made on a user's computer, see, for example, https: / / en.wikipedia.org / w / index.php?title=Trusted_Computing&oldid=1151565594#Remote_attestation.

[0004] In cryptography, zero-knowledge proof is a method that allows one party (the prover) to prove to another party (the verifier) ​​that a given statement is true, while the prover avoids transmitting any additional information other than that the statement is indeed true. See, for example, https: / / en.wikipedia.org / w / index.php?title=Zero-knowledge_proof&oldid=1152088705.

[0005] (Secure) multi-party computation (MPC) – roughly translated as (sichere)Mehrparteienberechnung in German – is a subfield of cryptography that aims to develop methods that allow parties to collaboratively compute functions about their input variables, which are kept secret. See, for example, https: / / en.wikipedia.org / w / index.php?title=Secure_multi-party_computation&oldid=1148234769. Cloud-native (secure) multi-party computation can be implemented, for example, through the Carbyne Stack, see, for example, https: / / carbynestack.io.

[0006] This disclosure proposes measures to enhance confidentiality in federated learning. Summary of the Invention

[0007] The first general aspect of this disclosure relates to a computer-implemented federated learning method for owners of machine learning models. The method includes: generating a first secret(s) and a first signature(sig(s)) based on Schnorr non-interactive zero-knowledge proofs (Schnorr NIZKP). The method further includes: sending the first signature(sig(s)) to a coordinator. The method also includes: uploading a fourth secret fragment of the first secret(s) to a cluster of aggregators, wherein a reference identifier (s_ref) of the first secret(s) is generated on the cluster of aggregators. The method further includes: providing a secure aggregation function (SecAgg(s_ref)) parameterized by the reference identifier (s_ref) on the aggregator. The method also includes: initiating a secret service designed to provide a network endpoint through which at least one training client, after successful authentication, can invoke the first secret(s). The method further includes uploading a first secret shard of the first multi-party computation (MPC) representation (CS(G_i)) of the machine learning model (G_i) to the cluster of the aggregator, wherein the first identifier (ID(CS(G_i)) of the first MPC representation (CS(G_i)) of the machine learning model (G_i) on the cluster of the aggregator is sent to the owner. The method also includes sending a first trigger signal containing the first identifier (ID(CS(G_i))) to the coordinator. In this context, the secret service can be a dedicated security service within the federated learning system, designed to provide a protected mechanism for transmitting sensitive information, specifically secrets (such as encryption keys or tokens), to authorized participants in the system. This can be done under strict security conditions, where the authenticity and authorization of the requesting participant (e.g., the training client) are checked using robust verification methods such as remote authentication or zero-knowledge proofs. The coordinator in the federated learning system can be a central control unit responsible for coordinating and managing the learning process regarding the distributed training client architecture. The coordinator initiates, oversees, and controls all phases of the federated learning cycle, including selecting training clients for learning iterations, distributing model updates, and collecting and securely aggregating local model updates. The coordinator ensures compliance with security and data protection guidelines by guaranteeing that only authenticated and authorized participants can engage in the learning process. The coordinator plays a crucial role in ensuring the efficiency and security of federated learning by coordinating communication between training clients and the aggregator without direct access to private training data or the specific content of model updates. The aggregator in a federated learning system can be a specialized component responsible for merging local machine learning model updates provided by training clients to generate an updated global machine learning model.Here, the aggregator uses secure and confidential methods, such as a secure aggregation function (SecAgg(s_ref)), which is parameterized by a reference identifier (s_ref) and points to a shared secret.

[0008] The second general aspect of this disclosure relates to a computer-implemented federated learning method for a coordinator. The method includes: generating a second secret (S) and a second signature (sig(S)) based on Schnorr non-interactive zero-knowledge proofs (Schnorr NIZKP). The method further includes: for each of a plurality of (C) training clients (c_j) used for training iterations, signing a random, client-specific token (t_j) using the second secret (S) based on Schnorr NIZKP, wherein a signed token (t_j_S) is generated. The method further includes: for each training client (c_j), sending the signed token (t_j_S) as a challenge to the corresponding training client (c_j). The method further includes: for each training client (c_j), receiving a proof (p_j) from the corresponding training client (c_j). The method further includes: for each training client (c_j), verifying the signature token (t_j_S) encoded in the proof (p_j) based on the second signature (sig(S)); and, if the verification is successful, verifying the proof (p_j) based on the first signature (sig(s)). The method also includes: allowing training clients (c_j) whose proof (p_j) has been successfully verified. The method further includes: if a first trigger signal is received, the first trigger signal containing the first identifier (ID(CS(G_i)) of the first MPC representation (CS(G_i)) of the machine learning model (G_i) on the cluster of aggregators, then sending a second trigger signal containing the first identifier (ID(CS(G_i))) to each of the plurality of (C) training clients (c_j) used for the training iteration. The method further includes: if at least one third trigger signal is received, the third trigger signal containing the second identifier (ID(s_j)) of the chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator, the chain expression containing the first secret (s) and the second MPC representation (CS(L_i_j)) of the local machine learning model update (L_i_j), then sending a fourth trigger signal to the aggregator, the fourth trigger signal containing the second identifier (ID(s_j)) of the chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator.

[0009] The third general aspect of this disclosure relates to a computer-implemented federated learning method for training a client (c_j). The method includes: if the training client's authentication is successful, invoking a first secret(s) from a network endpoint serving the secret of the owner of the machine learning model. The method includes: receiving a signature token (t_j_S) from a coordinator as a challenge. The method further includes: if the first secret(s) can be invoked, signing the signature token (t_j_S) using the first secret(s), wherein a proof (p_j = sign(s, t_j_S)) is generated. The method further includes: sending the proof (p_j) to the coordinator. The method further includes: if the training client (c_j) has been authorized by the coordinator, upon receiving a second trigger signal containing a first identifier (ID(CS(G_i))) and upon verification of the training client's identity and authorization on the aggregator's cluster, downloading a first MPC representation (CS(G_i)) of the machine learning model (G_i) from the aggregator's cluster based on the first identifier (ID(CS(G_i))). The method further includes: converting a first MPC representation (CS(G_i)) of the machine learning model into a local machine learning model according to a predetermined MPC protocol. The method further includes: training a local machine learning model based on local training data from a training client, wherein a local machine learning model update (L_i_j) is generated. The method further includes: converting the local machine learning model update (L_i_j) into a second MPC representation (CS(L_i_j)) according to the predetermined MPC protocol. The method further includes: generating a chained expression (s_j = (s, CS(L_i_j)) containing a first secret (s) and a second MPC representation (CS(L_i_j)). The method further includes: uploading a second secret shard of the chained expression (s_j) to the cluster of the aggregator, wherein a second identifier (ID(s_j)) of the chained expression (s_j) on the cluster of the aggregator is sent to the training client (c_j). The method further includes: sending a third trigger signal to the coordinator, the third trigger signal containing the second identifier (ID(s_j)).

[0010] The fourth general aspect of this disclosure relates to a computer-implemented federated learning method for an aggregator. The method includes: if a first secret fragment of a first MPC representation (CS(G_i)) of a machine learning model (G_i) is uploaded to the cluster of the aggregator, then sending to the owner of the machine learning model (G_i) a first identifier (ID(CS(G_i)) of the first MPC representation (CS(G_i)) on the cluster of the aggregator. The method also includes: if a second secret fragment of a chained expression (s_j = (s, CS(L_i_j))) containing the first secret (s) and a second MPC representation (CS(L_i_j)) of a local machine learning model update (L_i_j) is uploaded to the cluster of the aggregator, then sending to the training client (c_j) a second identifier (ID(s_j)) of the chained expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator. The method further includes: if a fourth trigger signal is received, the fourth trigger signal containing a second identifier (ID(s_j)) of a chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator, the chain expression containing a first secret (s) and a second MPC representation (CS(L_i_j)) of the local machine learning model update (L_i_j), then executing a secure aggregation function (SecAgg(s_ref)) provided by the owner of the machine learning model (G_i), the function being parameterized by a reference identifier (s_ref), wherein, during this execution, it is checked whether the chain expression (s_j = (s, CS(L_i_j))) contains a secret according to the reference identifier (s_ref). The method further includes: if the chained expression (s_j = (s, CS(L_i_j))) contains a secret according to a reference identifier (s_ref), then, based on a predetermined MPC circuit, securely aggregating the local machine learning model update (L_i_j) with at least one other local machine learning model update, wherein a third secret shard of the third MPC representation (CS(G_(i+1))) of the aggregated machine learning model (G_(i+1)) on the cluster that produces the aggregator, and a third identifier (ID(CS(G_(i+1)))) that produces the third MPC representation (CS(G_(i+1))). The method further includes: sending the third identifier (ID(CS(G_(i+1)))) to the coordinator.

[0011] A fifth general aspect of this disclosure relates to a method comprising the method according to the first general aspect, the method according to the second general aspect, the method according to the third general aspect, and / or the method according to the fourth general aspect.

[0012] The sixth general aspect of this disclosure relates to an apparatus designed to perform the method according to any one of the above general aspects.

[0013] The seventh general aspect of this disclosure relates to a computer program designed to perform the method according to any one of the above general aspects.

[0014] The eighth general aspect of this disclosure relates to a data carrier or signal that contains or encodes a computer program according to the seventh general aspect.

[0015] In federated (machine) learning, multiple (typically a large number) devices (hereinafter referred to as training clients) collaboratively train a (global) machine learning model, such as an (artificial) neural network. In this context, training clients do not necessarily share the same responsibilities. Instead, they can be located in different locations and / or have different responsibilities. An exemplary, but not unique, scenario involves each clinic having its own (local) training client, where each clinic possesses its own (local) training data (e.g., disease images, patient data, etc.), which it does not allow to share with other clinics or institutions. However, the clinic is still willing to contribute to the training of the (global) machine learning model based on its respective (local) training data. Typically, this can be achieved as follows: each (local) training client obtains the (global) machine learning model and generates a (local) machine learning model update based on its (local) training data, in which the (global) machine learning model is trained, for example, on the respective training client using the corresponding local training data. A central authority (which may be called an aggregator) then aggregates all (local) machine learning model updates, resulting in a (global) machine learning model update and, more specifically, a trained (global) machine learning model.

[0016] Federated learning is generally considered a secure and data-protection-focused approach for training machine learning models using sensitive data because the participating training clients keep their corresponding (local) training data confidential and do not transfer this training data to third parties.

[0017] Then, it has been repeatedly shown (see, for example, Priyanka Mary Mammen. 2021. Federated Learning: Opportunities and Challenges. In Proceedings of ACM Conference(Conference'17). ACM, New York, NY, USA, 5 pages; https: / / arxiv.org / pdf / 2101.05428.pdf and Benmalek et al. Security of Federated Learning: Attacks, Defensive Mechanisms, and Challenges. Revue des Sciences et Technologies del'Information – Série RIA : Revue d'Intelligence Artificielle, 2022, 36 (1),pp.49-59, 10.18280 / ria.360106, hal-0362040, https: / / hal.science / hal-03620400 / document): traditional federated learning falls far short of fully ensuring the confidentiality of local training data. In particular, training data can be derived from machine learning model updates by malicious aggregators. Furthermore, global machine learning models may be vulnerable to inference attacks designed to derive training data from the output data of (locally) trained machine learning models.

[0018] Confidentiality attacks can include membership inference attacks, which aim to determine whether certain training data has been used by the training client during training. Alternatively or additionally, confidentiality attacks can include attribute inference attacks, which aim to derive meta-features from training data from other training clients. Alternatively or additionally, confidentiality attacks can include reconstruction attacks, which aim to reconstruct training data and / or related labels that have been used during training.

[0019] Because of the methods disclosed herein, the difficulty of such confidentiality attacks on machine learning model updates can be increased, or even prevented altogether. Furthermore, in addition to confidentiality, the methods disclosed herein also enhance security. In particular, these methods protect training clients from confidentiality attacks originating from malicious aggregators and / or malicious coordinators, where the coordinator is designed to coordinate federated learning.

[0020] Furthermore, the methods disclosed herein protect the confidentiality of the (trained) machine learning model relative to training clients that wish to contribute to updates to the local machine learning model. Therefore, the methods disclosed herein are particularly suitable when a machine learning model needs to be protected due to its high value or for other reasons.

[0021] In principle, to improve the security of machine learning models, the entire training process might be implemented by the training client through multi-party computation (MPC). However, this has significant drawbacks: First, the training client loses the advantage of localized training data, as the training data originally stored locally must be sent to the MPC system. Second, MPC training incurs excessive computational workload and high costs.

[0022] Conversely, the method disclosed herein implements an alternative approach that avoids these drawbacks while still protecting the machine learning model from attacks by the training client. In this case, the training client must be authenticated using a combination of zero-knowledge proofs and remote authentication to be allowed to contribute to federated learning. This, in turn, allows for the exclusion of unauthenticated training clients from federated learning. Aggregator verification: Only machine learning model updates whose training clients can prove they know the (first) secret of the owner of the machine learning model will be accepted during secure aggregation. By using zero-knowledge proofs to protect the (first) secret against malicious coordinators, it is prevented that malicious coordinators impose machine learning model updates from unauthenticated training clients onto secure aggregation. Furthermore, the training client can run in a confidential computing enclave (e.g., via Gramine). This protects the machine learning model from unauthorized access by the operator of the training client. Attached Figure Description

[0023] Figure 1a This illustration demonstrates a computer-implemented federated learning approach for the owners of machine learning models.

[0024] Figure 1b This illustration demonstrates a computer-implemented federated learning approach for the coordinator.

[0025] Figure 1c The illustration illustrates a computer-implemented federated learning approach used to train clients.

[0026] Figure 1d This illustration demonstrates a computer-implemented federated learning approach for an aggregator.

[0027] Figure 2This schematically illustrates a method that includes Figures 1a-1d At least one method shown in the figure.

[0028] Figure 3 The illustration depicts the owner, coordinator, training client, aggregator, and optionally, tester of a machine learning model. Detailed Implementation

[0029] The computer-implemented method presented in this disclosure is executed in the interaction of the following entities, see [link to relevant documentation]. Figure 3 The machine learning model consists of its owner, multiple (usually a large number) training clients, a coordinator, and an aggregator. Additionally, a tester can be used.

[0030] The owner of the (global) machine learning model has rights to the (global) machine learning model, both in its initial state and in a trained state. Specifically, the owner can choose the machine learning model, i.e., its architecture (e.g., number of neurons, number of layers, number of neurons per layer, etc.). The owner is also the purchaser of the federated machine learning model. In the methods disclosed herein, the owner can be the only entity with plaintext access to the (trained) machine learning model.

[0031] Training clients c_j among multiple / numerous C (i.e., j = 1 to m) training clients possess (local) training data, which should at least not be shared with third parties or may not be shared with third parties. Training clients can be devices (e.g., computers) within an organizational unit (e.g., a clinic) that possesses the (local) training data.

[0032] Coordinator 20 coordinates federated learning by triggering actions on the training client c_j. This coordination includes, for example, selecting the training client to be used in the next training iteration; providing references to the initial and updated (i.e., trained) machine learning models; and / or evaluating training progress during training iterations. Furthermore, the coordinator delegates the aggregation 40 of machine learning model updates from the training clients to the aggregator. Because communication is conducted via identifiers, the coordinator never sees the machine learning model updates or the machine learning models themselves.

[0033] The aggregator 40 includes a (secure) multi-party computation (MPC) cluster, specifically multiple devices (e.g., computers) designed to operate in an MPC environment. This means that each member of the MPC cluster participates in the cluster's collective computation. Each cluster member's input contains a secret share of a secret slice of the entire input, such that no single member knows the contents of the entire input, the contents of their own secret share, or the shares of other cluster members. The aggregator (i.e., the MPC cluster) obtains machine learning model updates from the training client, computes the aggregated model updates, and updates the global machine learning model accordingly. Advantageously, by using (secure) multi-party computation (MPC), the aggregator does not need to know the model updates or the global machine learning model.

[0034] The following conventions will be used in the following text: G_i represents a machine learning model, more specifically, the i-th version of that machine learning model (e.g., i = 0 to n-1). G_0 could, for example, be the initial machine learning model used to perform the disclosed methods. G_0 could, for example, be an untrained machine learning model. Alternatively, G_0 could be a machine learning model that has been previously trained using the disclosed methods or otherwise. G_i could, for example, be a data structure that defines the model parameters of that machine learning model.

[0035] CS(x), for example for x = G_i or L_i_j, represents the multi-party computation (MPC) representation of x. This representation is reversible, that is, x can be converted to the MPC representation CS(x) according to a predetermined MPC protocol, and the MPC representation CS(x) can also be converted to x according to the same predetermined MPC protocol. CS(x) can be, for example, an MP-SPDZ / Carbyne Stack representation.

[0036] ID(y) is the identifier of the secret shard y, which is stored on the aggregator's MPC cluster. Therefore, in the case of CarbyneStack, this could be, for example, the Amphora service of a cluster member.

[0037] L_i_j represents the machine learning model update generated (locally) by the training client c_j in the i-th training iteration (e.g., i = 0 to n-1). The machine learning model update can be, for example, a machine learning model that is updated through training.

[0038] First, a federated learning method 100 implemented by a computer for the owner 10 of a machine learning model is disclosed. Figure 1a As shown schematically in the diagram.

[0039] The method 100 includes: generating a first secret s and a first signature sig(s) based on Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP).

[0040] The method 100 further includes sending a first signature sig(s) to the coordinator 20.

[0041] The method 100 further includes: uploading a fourth secret fragment of the first secret s to the cluster of the aggregator 40, wherein a reference identifier s_ref of the first secret s is generated on the cluster of the aggregator 40. The first secret s stored on the cluster of the aggregator 40 can be accessed through this reference identifier, particularly by the secure aggregation function provided 123.

[0042] The method 100 further includes providing a secure aggregation function SecAgg(s_ref) parameterized by the reference identifier s_ref on the aggregator 40. This secure aggregation function SecAgg(s_ref) may, for example, be based on an algorithm from SAFELearn, as described above. By parameterizing the secure aggregation function SecAgg(s_ref) by the reference identifier, the aggregator can then check whether the training client c_j is allowed to upload its local machine learning model updates to the cluster of aggregator 40 after successfully completing local training. That is, upload is only allowed if the training client c_j successfully proves that it knows the first secret s, which therefore corresponds to the secret that can be invoked under the reference identifier s_ref (according to the secret of the reference identifier s_ref). The secure aggregation function SecAgg(s_ref) may be a specially developed algorithm within the federated learning system, the computation of which is designed to combine machine learning model updates generated by different participants (training clients) in a manner that maintains the confidentiality of each contribution. Secure aggregation functions use a reference identifier s_ref pointing to a shared secret to ensure that only authorized updates are included in the aggregation.

[0043] The method 100 further includes: initiating a secret service (e.g., Gramine) designed to provide a network endpoint through which at least one training client c_j, after successful authentication, can invoke the first secret s. Successful invocation of the first secret s by the training client c_j enables the training client c_j to prove knowledge of the first secret s when uploading its local machine learning model updates.

[0044] The method 100 further includes: uploading 130 a first secret shard of the first multi-party computation (MPC) representation CS(G_i) of a (e.g., an initial) machine learning model G_i (i.e., G_0) to the cluster of the aggregator 40, wherein the first identifier ID (CS(G_i)) of the first MPC representation CS(G_i) of the machine learning model G_i on the cluster of the aggregator 40 is sent to the owner 10. The machine learning model uploaded 130 may be an initial, i.e., untrained machine learning model (e.g., G_0). Alternatively, the machine learning model uploaded 130 may be a machine learning model G_i that has been at least partially trained.

[0045] The method 100 further includes sending a first trigger signal 131 containing a first identifier ID (CS(G_i)) to the coordinator 20. The first trigger signal may, for example, consist solely of the first identifier ID (CS(G_i)). The first trigger signal can prompt the coordinator 20 to perform federated learning on the training client. The advantage of providing the machine learning model G_i as a secret shard and, in other cases, only its identifier, is that the coordinator 20 itself does not obtain the machine learning model. This better ensures the confidentiality of the machine learning model.

[0046] The method 100 may further include: transforming (e.g., initial) machine learning model G_i into a first MPC representation CS(G_i) according to a predetermined MPC protocol.

[0047] The method 100 may further include: if a third identifier ID (CS(G_(i+1))) of the third MPC representation CS(G_(i+1)) of the aggregated machine learning model G_(i+1) on the cluster of aggregator 40 is received, then based on the third identifier ID (CS(G_(i+1))), downloading 140 of the third MPC representation CS(G_(i+1)) of the aggregated machine learning model G_(i+1) from the cluster of aggregator 40. Then, the method 100 may further include: converting 141 of the third MPC representation CS(G_(i+1)) of the aggregated machine learning model G_(i+1) into a global machine learning model according to the predetermined MPC protocol. Through steps 140 and 141, the owner of the machine learning model can invoke the machine learning model in its trained state. In the case of, for example, n training iterations, CS(G_(n-1)) may also be downloaded first as the third MPC representation.

[0048] A computer-implemented federated learning method 200 for coordinator 20 is also disclosed. Figure 1b The illustration is shown in the middle.

[0049] Method 200 includes: generating a second secret S and a second signature sig(S) based on Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP).

[0050] The method 200 further includes: then, for each of the plurality of C training clients c_j (j = 1 to m) used for training iterations, signing a random, training client-specific token t_j using a second secret S based on Schnorr NIZKP 221, wherein a signed token t_j_S is generated (respectively).

[0051] The method 200 further includes: then, for each training client c_j, sending the signature token t_j_S as a challenge to the corresponding training client c_j.

[0052] The method 200 further includes: then, for each training client c_j, receiving 223 proof p_j from the corresponding training client c_j.

[0053] The method 200 further includes: then, for each training client c_j, verifying the signature token t_j_S encoded in the proof p_j based on the second signature sig(S) 224a; and, if the verification is successful, verifying the proof p_j based on the first signature sig(s) 224b.

[0054] The method 200 also includes: then, allowing 225 training clients c_j to prove that p_j has been successfully verified.

[0055] Therefore, steps 221 to 225 represent authenticating these training clients before allowing them to contribute to the federated learning. This prevents unauthorized training clients like c_j from being blocked. Consequently, potentially harmful effects on the trained machine learning model (e.g., due to deliberately falsified training data imposed on training clients by a malicious coordinator in the federated learning) can be prevented.

[0056] The method 200 further includes: if a first trigger signal is received, the first trigger signal containing the first identifier ID (CS(G_i)) of the first MPC representation CS(G_i) of the machine learning model G_i on the cluster of aggregator 40, then a second trigger signal 230 is sent to each of the 225 allowed training clients c_j among the multiple (typically even a large number) C training clients c_j used for the training iteration, the second trigger signal containing the first identifier (ID(CS(G_i))). The second trigger signal can individually prompt the 225 allowed training clients c_j to perform the training iteration. The second trigger signal may, for example, consist only of the first identifier ID (CS(G_i)). Typically, not only the coordinator but also each training client c_j only knows the first identifier ID (CS(G_i)), but not the machine learning model G_i (or the MPC representation CS(G_i) of the machine learning model). The latter is reliably stored on the cluster of aggregator 40 as a secret shard.

[0057] The method 200 may include: selecting 210 multiple / large numbers of C training clients c_j for the training iteration according to a predetermined selection strategy.

[0058] The method 200 further includes: if at least one third trigger signal is received, the third trigger signal containing the second identifier ID(s_j) of the chained expression s_j = (s, CS(L_i_j)) on the cluster of the aggregator 40, the chained expression containing the first secret s and the second MPC representation CS(L_i_j) of the local machine learning model update Li_i_j, then a fourth trigger signal is sent to the aggregator 40, the fourth trigger signal containing the second identifier ID(s_j) of the chained expression on the cluster of the aggregator 40. The third trigger signal may, for example, consist only of the second identifier ID(s_j). The fourth trigger signal may also, for example, consist only of the second identifier ID(s_j). The advantage is that only the training clients that are allowed 225 can form the chained expression s_j containing the (correct) first secret s. Then, through the chained expression s_j, it can be subsequently checked whether the machine learning model update generated by the training client is allowed to contribute to the secure aggregation 431.

[0059] If a third trigger signal is received from at least one of the multiple / large number of C training clients c_j used for the training iteration (for another j), the third trigger signal containing another second identifier ID(s_j) of another chain expression s_j = (s, CS(L_i_j)) on the cluster of aggregator 40, the other chain expression containing another first secret s (which is the same as the first secret s) and another second MPC representation CS(L_i_j) of another local machine learning model update of Li_i_j, then a fourth trigger signal 231 can be sent, wherein the fourth trigger signal contains the other second identifier ID(s_j).

[0060] In particular, when each of the multiple / large number of C training clients c_j used for this training iteration receives a corresponding third trigger signal, which contains the corresponding second identifier ID(s_j) of the corresponding other chain expression s_j = (s, CS(L_i_j)) on the cluster of aggregator 40, which contains the corresponding first secret s and the corresponding second MPC representation CS(L_i_j) of the corresponding local machine learning model update of Li_i_j, a fourth trigger signal can be sent, wherein the fourth trigger signal contains each second identifier ID(s_j) (j = 1 to m).

[0061] The method 200 may further include: if the third identifier ID (CS(G_(i+1))) of the third MPC representation CS(G_(i+1)) of the aggregated machine learning model G_(i+1) on the cluster of aggregator 40 is received, then check 240 whether to perform the next training iteration for the aggregated machine learning model G_(i+1).

[0062] The method 200 may further include: then, if no next training iteration is required, sending a third identifier ID(CS(G_(i+1))) to the owner 10 of the machine learning model. Otherwise, these methods may be repeated for each next training iteration (e.g., n training iterations), where, for example, ID(CS(G_(n-1))) is returned as a third identifier to the owner 10 of the machine learning model.

[0063] Methods 100, 200, 300, 400, and 500 have protected the machine learning model from attacks by malicious training clients. These methods also protect the machine learning model from being exposed to the coordinator 20. However, a potential risk remains because the coordinator 20 might negatively impact the quality of the (trained) machine learning model by maliciously and distortingly selecting training clients. This can be prevented as follows: This method 200 can be executed within a Trusted Execution Environment (TEE). This improves security, especially by preventing the coordinator 20 from maliciously deviating from this method 200 and / or its intended course. Here, the owner 10 of the machine learning model can, for example, trust the coordinator 20 to adhere to a predetermined selection strategy through remote attestation. Therefore, maliciously distorted selections by the training client can be prevented.

[0064] Furthermore, in method 200, log entries can be reliably recorded on external storage, or optionally, on a distributed ledger. This further enhances security, as the process can also be traced back afterward. Reliable recording can be achieved, for example, by using the public key of the machine learning model's owner 10 to asymmetricly encrypt log entries. Alternatively, log entries can be encrypted using a symmetric private key pre-agreed between the coordinator 20 and the machine learning model's owner 10.

[0065] Furthermore, in method 200, coordinator 20 may prompt at least one training client c_j of 250 to download the aggregate machine learning model G_(i+1) and evaluate the quality of the aggregate machine learning model G_(i+1) based on the local test data of the training client (according to a predetermined local test standard), wherein at least a second test result is generated and the second test result is sent to coordinator 20.

[0066] Then, the method 200 may include: receiving 251 the at least second test result.

[0067] Then, the method 200 may include: evaluating 252 the at least second test result and the first test result, the first test result being generated by a tester 50, the tester being designed to: evaluate the quality of the aggregate machine learning model G_(i+1) based on local test data of the tester 50 (also according to predetermined test criteria), wherein the evaluation is based on MPC or homomorphic encryption, wherein the evaluation result is generated.

[0068] Then, the method 200 may include performing one or more predetermined actions based on the evaluation result. The predetermined actions may, for example, be to omit subsequent training iterations because the evaluation result is satisfactory. Alternatively, the predetermined actions may also include switching to another predetermined selection strategy for the training client.

[0069] A computer-implemented federated learning method 300 for training client c_j is also disclosed. Figure 1c As shown schematically in the diagram.

[0070] The method 300 includes: if the training client's authentication is successful, invoking 310 the first secret from the network endpoint providing the service (e.g., Gramine) from the secret of the machine learning model's owner 10. If, for example, remote authentication fails, the first secret cannot be invoked. In this case, for example, starting the training client is pointless, as the resulting machine learning model update will not be accepted during the secure aggregation 431 process. If an unprotected training client is still started, it may be able to connect to the coordinator 20, but it will never be selected by the honest coordinator 20 for training iterations.

[0071] The method 300 also includes: receiving 311 signature tokens t_j_S from the coordinator 20 as a challenge.

[0072] The method 300 further includes: if the first secret s can be invoked, then the first secret s is used to sign the signature token t_j_S 312, wherein a proof p_j = sign(s, t_j_S) is generated.

[0073] The method 300 also includes: sending proof p_j 313 to the coordinator 20.

[0074] The method 300 further includes: if the training client c_j has been allowed by the coordinator 20 225, then upon receiving a second trigger signal containing a first identifier ID (CS(G_i)) and having already verified the identity and authorization of the training client c_j on the cluster of the aggregator 40, downloading the first MPC representation CS(G_i) of the machine learning model G_i from the cluster of the aggregator 40 based on the first identifier ID (CS(G_i)). Verification of the training client's identity and authorization may be based, for example, on a predetermined authentication and / or authorization protocol.

[0075] The method 300 includes: then, transforming 321 the first MPC representation CS(G_i) of the machine learning model into a local machine learning model according to a predetermined MPC protocol (the same MPC protocol as in method 100). The local machine learning model may be, for example, the machine learning model G_i, and in particular, the initial machine learning model G_0. Alternatively, the local machine learning model may be another representation of the machine learning model G_i (especially G_0), which is designed for training on the training client c_j.

[0076] The method 300 further includes: training a local machine learning model 330 based on local training data from the training client, wherein the local machine learning model update L_i_j is generated. The local machine learning model L_i_j can be, for example, a trained local machine learning model.

[0077] The method 300 further includes: transforming the local machine learning model update Li_i_j to a second MPC representation CS(L_i_j) according to the predetermined MPC protocol.

[0078] The method 300 further includes: generating a chain expression s_j = (s, CS(L_i_j)), which contains a first secret s and a second MPC representation CS(L_i_j).

[0079] The method 300 further includes: then, uploading 342 a second secret fragment of the chained expression s_j to the cluster of the aggregator 40, wherein the second identifier ID (s_j) of the chained expression s_j on the cluster of the aggregator 40 is sent to the training client c_j. By providing the first secret s in the chained expression s_j, it can be verified by the secure aggregation function SecAgg(s_ref) provided to the aggregator 40 that the corresponding training client c_j does indeed know the first secret s. This achieves that only the training client c_j that is allowed 225 is allowed to contribute to the machine learning model update Li_j during aggregation.

[0080] The method further includes sending a third trigger signal 343 to the coordinator 20, the third trigger signal containing the second identifier ID(s_j).

[0081] Method 300 can be executed within a Trusted Execution Environment (TEE) (either on at least one training client c_j or on each training client c_j in the plurality of Cs). This ensures that one or more training clients c_j—preferably all training clients—cannot (maliciously) deviate from method 300. This, for example, can prevent the machine learning model, and in particular, the abuse of that machine learning model.

[0082] A computer-implemented federated learning method 400 for aggregator 40 is also disclosed. Figure 1d The illustration is shown in the middle.

[0083] The method 400 includes: if the first secret shard of the first MPC representation CS(G_i) of the machine learning model G_i is uploaded to the cluster of the aggregator 40, then send 410 the first identifier ID (CS(G_i)) of the first MPC representation CS(G_i) on the cluster of the aggregator 40 to the owner 10 of the machine learning model G_i.

[0084] The method 400 further includes: if a second secret fragment of the chain expression s_j = (s, CS(L_i_j)) is uploaded to the cluster of aggregator 40, the chain expression containing the first secret s and the second MPC representation CS(L_i_j) of the local machine learning model update of L_i_j, then the second identifier ID (s_j) of the chain expression s_j = (s, CS(L_i_j)) on the cluster of aggregator 40 is sent to the training client c_j.

[0085] The method 400 further includes: if a fourth trigger signal is received, the fourth trigger signal containing a second identifier ID(s_j) of the chained expression s_j = (s, CS(L_i_j)) on the cluster of the aggregator 40, the chained expression containing a first secret s and a second MPC representation CS(L_i_j) of the local machine learning model updating L_i_j, then 430 executes a secure aggregation function SecAgg(s_ref) provided by the owner 10 of the machine learning model G_i, the function being parameterized by the reference identifier s_ref, wherein, during this execution, it is checked whether the chained expression s_j = (s, CS(L_i_j)) contains the secret according to the reference identifier s_ref.

[0086] The method 400 further includes: if the chained expression s_j = (s, CS(L_i_j)) contains a secret according to the reference identifier s_ref, then, based on a predetermined MPC circuit, securely aggregating the local machine learning model update L_i_j with at least one other local machine learning model update 431, wherein a third secret shard of the third MPC representation CS(G_(i+1)) of the aggregated machine learning model G_(i+1) on the cluster that produces the aggregator 40, and a third identifier ID (CS(G_(i+1))) of the third MPC representation CS(G_(i+1)). This secure aggregation 431 can be implemented, for example, by an algorithm from SAFELearn, or based on that algorithm, as described above. The aggregated machine learning model G_(i+1) can, for example, be based on a weighted average of the local machine learning model updates L_i_j (for different j). By checking whether the chained expression s_j = (s, CS(L_i_j)) contains a secret according to the reference identifier s_ref, it is possible to prevent machine learning model updates from unauthorized training clients from being considered during secure aggregation 431.

[0087] The method 400 includes: then sending a third identifier ID (CS(G_(i+1))) to the coordinator 20.

[0088] Alternatively, after n training iterations, an aggregated machine learning model CS(G_(n-1)) can be generated, and the corresponding identifier ID(CS(G_(n-1))) can be sent to the coordinator 20.

[0089] The method 400 may further include: sending a third identifier ID (CS(G_(i+1))) of a third MPC representation CS(G_(i+1)) to a tester 50, the tester being designed to: download an aggregated machine learning model G_(i+1) and evaluate the quality of the aggregated machine learning model G_(i+1) based on local test data of the tester 50 (e.g., according to predetermined test criteria), wherein the evaluation is based on MPC or homomorphic encryption, wherein a first test result is generated and the first test result is sent to the aggregator 40.

[0090] The method 400 may include: then, receiving 441 the first test result.

[0091] Method 400 may include: then sending a first test result 442 to coordinator 20. In method 200, based on the first test result, coordinator 20 may perform one or more predetermined actions, as described above.

[0092] Alternatively, a machine learning model CS(G_(n-1)) aggregated after n training iterations can be used as the basis for this evaluation.

[0093] It also discloses one or more combination methods 500, in Figure 2 The illustration is shown in the middle.

[0094] Method 500 may include a computer-implemented federated learning method 100 for the owner 10 of the machine learning model. Alternatively or additionally, method 500 may include a computer-implemented federated learning method 200 for the coordinator 20. Alternatively or additionally, method 500 may include a computer-implemented federated learning method 300 for training the client c_j. Alternatively or additionally, method 500 may include a computer-implemented federated learning method 400 for the aggregator 40.

[0095] In these methods 100, 200, 300, 400, and 500, the predefined MPC protocol can be based on fixed-point, floating-point, and / or integers (e.g., int8 quantization). This choice can be made based on the desired trade-off between the performance and accuracy of the machine learning model. Fixed-point-based variants are faster but may introduce quantization errors, while floating-point-based variants require more computational power and also use more bandwidth (in the network), but for this purpose, they enable a more accurate mapping between the raw representation of the machine learning model and the MPC-compatible representation.

[0096] Alternatively, these methods 100, 200, 300, 400, and 500 can be adapted to enable the coordinator 20 to access the global machine learning model. In this variant, the aggregator 40 securely aggregates local machine learning model updates only via MPC. Here, the exchange of the global machine learning model with the training client occurs in-band, i.e., via a regular communication channel.

[0097] One or more devices are also disclosed, designed to perform one or more methods 100, 200, 300, 400, 500, respectively. Each of these devices includes at least one computing unit (at least one processor) and working memory (e.g., RAM), and may also have non-volatile memory. One device may, for example, include a computing unit for an owner 10 of a machine learning model. Another device may, for example, include a computing unit for a coordinator 20. One or more other devices may, for example, each include at least one computing unit for training client c_j. Another device may, for example, include at least one computing unit for an aggregator 40 (typically multiple computing units for the cluster). An device may also include a computing unit for the owner 10 of the machine learning model, a computing unit for the coordinator 20, a computing unit for each training client c_j, and / or a computing unit for the aggregator 40. Such devices may, for example, allow these computing units to be networked together.

[0098] One or more computer programs are also disclosed, each designed to perform one or more methods 100, 200, 300, 400, 500. Each of these computer programs may exist, for example, in an interpretable form or in a compiled form. The computer program may (or may partially) be loaded into the working memory (e.g., RAM) of the device, for example, as a sequence of bits or bytes, for execution.

[0099] One or more data carriers or signals are also disclosed, each containing or encoding the disclosed computer program. The data carrier may, for example, include one of RAM, ROM, EPROM, HDD, SDD, ..., on which / therein the signal is stored. The data carrier storing the computer program using methods 100, 200, 300, 400, 500 may be a non-volatile memory of the device.

Claims

1. A computer-implemented federated learning method (100) for the owner (10) of a machine learning model, the method comprising: Based on Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP), generate (120) first secret(s) and first signature(sig(s)); Send (121) the first signature (sig(s)) to the coordinator (20); The fourth secret fragment of the first secret(s) is uploaded (122) to the cluster of the aggregator (40), wherein a reference identifier (s_ref) of the first secret(s) is generated on the cluster of the aggregator (40). On the aggregator (40), a secure aggregation function (SecAgg(s_ref)) parameterized by the reference identifier (s_ref) is provided (123). Initiate (124) a secret service, which is designed to provide a network endpoint, at least one training client (c_j), which, after successful authentication, is able to invoke the first secret(s) through the network endpoint. The first secret shard of the first multi-party computation (MPC) representation (CS(G_i)) of the machine learning model (G_i) is uploaded (130) to the cluster of the aggregator (40), wherein the first identifier (ID(CS(G_i)) of the first MPC representation (CS(G_i)) of the machine learning model (G_i) on the cluster of the aggregator (40) is sent to the owner (10). Send (131) a first trigger signal containing the first identifier (ID(CS(G_i))) to the coordinator (20).

2. The method (100) according to claim 1, wherein the method comprises: According to the predetermined MPC protocol, the machine learning model (G_i) is transformed (110) into the first MPC representation (CS(G_i)).

3. The method (100) according to claim 1 or 2, wherein the method comprises: If the third identifier (ID(CS(G_(i+1))) of the third MPC representation (CS(G_(i+1))) of the aggregated machine learning model (G_(i+1)) on the cluster of the aggregator (40) is received, then based on the third identifier ID(CS(G_(i+1))), the third MPC representation (CS(G_(i+1))) of the aggregated machine learning model (G_(i+1)) is downloaded (140) from the cluster of the aggregator (40). According to the predetermined MPC protocol, the third MPC representation (CS(G_(i+1)) of the aggregated machine learning model (G_(i+1)) is transformed (141) into a global machine learning model.

4. A computer-implemented federated learning method (200) for a coordinator (20), the method comprising: Based on Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP), generate (220) second secret (S) and second signature (sig(S)); For each of the multiple (C) training clients (c_j) used for training iterations, based on Schnorr NIZKP, the second secret (S) is used to sign a random, training client-specific token (t_j) (221), wherein a signed token (t_j_S) is generated. For each training client (c_j), the signature token (t_j_S) is sent as a challenge (222) to the corresponding training client (c_j); For each training client (c_j), receive (223) proof (p_j) from the corresponding training client (c_j); For each training client (c_j), the signature token (t_j_S) encoded in the proof (p_j) is verified based on the second signature (sig(S)) (224a), and if the verification is successful, the proof (p_j) is verified based on the first signature (sig(s)) (224b). Allow (225) the training client (c_j) whose proof (p_j) has been successfully verified; If a first trigger signal is received, the first trigger signal containing the first identifier (ID(CS(G_i)) of the first MPC representation (CS(G_i)) of the machine learning model (G_i) on the cluster of the aggregator (40), then a second trigger signal (230) containing the first identifier (ID(CS(G_i))) is sent to each of the multiple (C) training clients (c_j) used for the training iteration. If at least one third trigger signal is received, the third trigger signal containing the second identifier (ID(s_j)) of the chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator (40), the chain expression containing the first secret (s) and the second MPC representation (CS(L_i_j)) of the local machine learning model update (L_i_j), then a fourth trigger signal (231) is sent to the aggregator (40), the fourth trigger signal containing the second identifier (ID(s_j)) of the chain expression on the cluster of the aggregator (40).

5. The method (200) according to claim 4, wherein the method comprises: According to a predetermined selection strategy, (210) the plurality of (C) training clients (c_j) for the training iteration are selected.

6. The method (200) according to claim 4 or 5, wherein, If a third trigger signal is received from at least one of the plurality of (C) training clients (c_j) used for the training iteration, the third trigger signal containing another second identifier (ID(s_j)) of another chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator (40), the other chain expression containing another first secret (s) and another second MPC representation (CS(L_i_j)) of another local machine learning model update (L_i_j), then the fourth trigger signal (231) is sent. The fourth trigger signal includes the other second identifier (ID(s_j)).

7. The method (200) according to any one of claims 4 to 6, wherein, If a corresponding third trigger signal is received from each of the plurality of (C) training clients (c_j) used for the training iteration, the third trigger signal containing a corresponding second identifier (ID(s_j)) of a corresponding other chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator (40), the other chain expression containing a corresponding first secret (s) and a corresponding second MPC representation (CS(L_i_j)) of a corresponding local machine learning model update (L_i_j), then the fourth trigger signal (231) is sent. The fourth trigger signal contains each second identifier (ID(s_j)).

8. The method (200) according to any one of claims 4 to 7, the method comprising: If the third identifier (ID(CS(G_(i+1))) of the third MPC representation (CS(G_(i+1))) of the aggregated machine learning model (G_(i+1)) on the cluster of the aggregator (40) is received, then check (240) whether to perform the next training iteration for the aggregated machine learning model (G_(i+1)); If no next training iteration is required, send (241) the third identifier (ID(CS(G_(i+1)))) to the owner (10) of the machine learning model.

9. The method (200) according to any one of claims 4 to 8, wherein the method is executed within a Trusted Execution Environment (TEE).

10. The method (200) according to any one of claims 4 to 9, wherein, Records can be reliably stored on external storage, or optionally, on a distributed ledger.

11. The method (200) according to any one of claims 4 to 10, wherein, The coordinator (20) prompts (250) at least one training client (c_j) to: download the aggregate machine learning model (G_(i+1)) and evaluate the quality of the aggregate machine learning model (G_(i+1)) based on the local test data of the training client, wherein at least a second test result is generated and the at least second test result is sent to the coordinator (20). Receive (251) the at least second test result; Evaluation (252) of at least the second test result and the first test result, the first test result being generated by the tester (50), the tester being designed to: evaluate the quality of the aggregated machine learning model (G_(i+1)) based on local test data of the tester (50), wherein the evaluation is based on MPC or homomorphic encryption, wherein the evaluation result is generated; Perform the (253) predetermined action based on the evaluation results.

12. A computer-implemented federated learning method (300) for training a client (c_j), the method comprising: If the authentication of the training client is successful, the first secret(s) is invoked from the network endpoint that provides the service from the secret of the owner (10) of the machine learning model. Receive (311) signature token (t_j_S) from the coordinator (20) as a challenge; If the first secret(s) can be invoked, then the first secret(s) is used to sign the signature token (t_j_S) (312), wherein a proof is generated (p_j = sign(s, t_j_S)). Send the proof (p_j) (313) to the coordinator (20); If the training client (c_j) has been allowed (225) by the coordinator (20), then when a second trigger signal containing a first identifier (ID(CS(G_i))) is received and the identity and authorization of the training client (c_j) have been verified on the cluster of the aggregator (40), the first MPC representation (CS(G_i)) of the machine learning model (G_i) is downloaded (320) from the cluster of the aggregator (40) based on the first identifier (ID(CS(G_i))). According to the predetermined MPC protocol, the first MPC representation (CS(G_i)) of the machine learning model is converted (321) into a local machine learning model; The local machine learning model is trained (330) based on the local training data of the training client, wherein a local machine learning model update (L_i_j) is generated. According to the predetermined MPC protocol, the local machine learning model update (L_i_j) is transformed (340) into a second MPC representation (CS(L_i_j)). Generate a chain expression (s_j = (s, CS(L_i_j))) containing the first secret (s) and the second MPC representation (CS(L_i_j)); The second secret fragment of the chain expression (s_j) is uploaded (342) to the cluster of the aggregator (40), wherein the second identifier (ID(s_j)) of the chain expression (s_j) on the cluster of the aggregator (40) is sent to the training client (c_j). Send a third trigger signal (343) to the coordinator (20), the third trigger signal containing the second identifier (ID(s_j)).

13. The method (300) according to claim 12, wherein the method is executed within a Trusted Execution Environment (TEE).

14. A computer-implemented federated learning method (400) for an aggregator (40), the method comprising: If the first secret shard of the first MPC representation (CS(G_i)) of the machine learning model (G_i) is uploaded to the cluster of the aggregator (40), then the first identifier (ID(CS(G_i)) of the first MPC representation (CS(G_i)) on the cluster of the aggregator (40) is sent (410) to the owner (10) of the machine learning model (G_i). If the second secret fragment of the chain expression (s_j = (s, CS(L_i_j))) is uploaded to the cluster of the aggregator (40), the chain expression containing the first secret (s) and the second MPC representation (CS(L_i_j)) of the local machine learning model update (L_i_j) is sent (420) to the training client (c_j) the second identifier (ID(s_j)) of the chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator (40). If a fourth trigger signal is received, the fourth trigger signal containing a second identifier (ID(s_j)) of a chain expression (s_j = (s, CS(L_i_j))) on the cluster of the aggregator (40), the chain expression containing a first secret (s) and a second MPC representation (CS(L_i_j)) of a local machine learning model update (L_i_j), then (430) a secure aggregation function (SecAgg(s_ref)) provided (123) by the owner (10) of the machine learning model (G_i) is executed, the function being parameterized by a reference identifier (s_ref), wherein, during the execution, it is checked whether the chain expression (s_j = (s, CS(L_i_j))) contains a secret according to the reference identifier (s_ref); If the chain expression (s_j = (s, CS(L_i_j))) contains a secret according to the reference identifier (s_ref), then based on the predetermined MPC circuit, the local machine learning model update (L_i_j) is securely aggregated with at least one other local machine learning model update (431), wherein the third secret shard of the third MPC representation (CS(G_(i+1))) of the aggregated machine learning model (G_(i+1)) on the cluster of the aggregator (40) and the third identifier (ID(CS(G_(i+1)))) of the third MPC representation (CS(G_(i+1)))) are generated. Send the third identifier (ID(CS(G_(i+1)))) to the coordinator (20).

15. The method (400) according to claim 14, wherein, The aggregated machine learning model (G_(i+1)) is a weighted sum of the local machine learning model updates (L_i_j).

16. The method (400) according to claim 14 or 15, the method comprising: Send (440) the third identifier (ID(CS(G_(i+1))) of the third MPC representation (CS(G_(i+1))) to the tester (50), the tester being designed to: download the aggregated machine learning model (G_(i+1)) and evaluate the quality of the aggregated machine learning model (G_(i+1)) based on the local test data of the tester (50), wherein the evaluation is based on MPC or homomorphic encryption, wherein a first test result is generated and the first test result is sent to the aggregator (40). Receive (441) the first test result; The first test result is sent (442) to the coordinator (20).

17. A method (500) comprising: The computer-implemented federated learning method (100) for the owner (10) of a machine learning model according to any one of claims 1 to 3. The computer-implemented federated learning method (200) for the coordinator (20) according to any one of claims 4 to 11. The computer-implemented federated learning method (300) for training the client (c_j) according to any one of claims 12 to 13; and / or The computer-implemented federated learning method (400) for an aggregator (40) according to any one of claims 14 to 16.

18. The method according to any one of the preceding claims (100, 200, 300, 400, 500), wherein, The predetermined MPC protocol is based on fixed-point numbers, floating-point numbers, and / or integers.

19. An apparatus designed to perform the method (100, 200, 300, 400, 500) according to any one of the preceding claims.

20. A computer program designed to perform the method (100, 200, 300, 400, 500) according to any one of claims 1 to 18.

21. A data carrier or signal, said data carrier / signal comprising / encoding a computer program according to claim 20.

Images