Federal learning anti-poisoning safety aggregation method and system

Abstract

The invention belongs to the technical field of privacy protection, and discloses a federated learning anti-poisoning security aggregation method and system, and the scheme comprises the steps: system initialization, key material generation required by encryption communication, security distribution of model initial parameters, and pre-processing configuration of blind vectors; performing local training; carrying out robust aggregation; and decryption and model updating, wherein the two independent entities S1 and S2 of the server end jointly complete decryption and model updating work of the aggregation gradient. Relative performance advantages are always kept in all attack scenes, the superiority is mainly attributed to a flexible similarity-based comparison mechanism and proper selection of the first k trusted updates, and poisoning gradients are allowed to be filtered more accurately during aggregation.

Description

Technical Field

[0001] This invention belongs to, but is not limited to, the field of privacy protection technology, and particularly relates to a federated learning anti-poisoning security aggregation method and system, but is not limited to the aforementioned field. Background Technology

[0002] Federated learning (FL), a promising approach in distributed machine learning, has garnered significant attention. It protects data privacy by allowing clients to collaboratively train models without sharing the original data. In typical federated learning, a central server coordinates model training by aggregating updates from distributed clients. However, recent research has shown that even without access to the original data, attackers can launch inference attacks to reconstruct sensitive information from shared model updates. These attacks, including gradient inversion, data reconstruction, and membership inference, exploit gradients to recover private training samples, thus undermining the core privacy commitment of federated learning.

[0003] To address privacy breaches caused by inference attacks, various secure aggregation protocols have been proposed. These protocols encrypt individual model updates, allowing access only to the aggregation results, thus preventing any single party from obtaining the raw gradients of a single client. Techniques such as homomorphic encryption, differential privacy, and double masking are widely adopted to support this privacy-preserving design. However, while secure aggregation can defend against inference threats, it also introduces a new challenge: the inability to inspect individual updates, thus making it impossible to detect malicious contributions. In particular, malicious clients can launch poisoning attacks by uploading tampered model updates, thereby compromising the global model. These encrypted tampered updates are undetectable in their encrypted state, effectively bypassing server filtering capabilities.

[0004] A common method for detecting poisoned updates in federated learning is to measure the similarity between client gradients and a reference baseline. Recent research has shown that even when gradients are privatized using simple multiplicative masking methods, statistical correlations such as the Pearson correlation coefficient (PCC) are largely preserved. This observation opens a promising avenue for resisting both inference attacks and poisoning attacks. Specifically, for any two client gradients g1 and g2 masked by random scalars r1 and r2 respectively, the following equation holds:

[0005] Cov(g1,g2) / σ(g1)σ(g2)=Cov(r1g1,r2g2) / σ(r1g1)σ(r2g2)

[0006] Here, Cov(·,·) represents the covariance between two vectors, and σ(·) represents the standard deviation of a vector. However, correlation-based similarity assessment under the multiplication blinding mechanism still has some limitations in secure aggregation environments. On the one hand, if each client independently chooses an arbitrary blinding factor ri, the aggregation result Σrigi will be associated with inconsistent scaling, leading to unreliable model updates. On the other hand, attempting to remove the blinding factor after similarity calculation exposes the system to new inference risks and generates significant communication overhead. These challenges highlight a key question: how can gradient aggregation simultaneously resist poisoning and inference attacks while maintaining global model prediction performance? Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art, namely, to effectively identify and eliminate maliciously uploaded poisoned updates while protecting client gradient privacy, thereby improving the robustness of the global model.

[0008] This invention is implemented as follows: a federated learning anti-poisoning safe aggregation scheme, the scheme comprising:

[0009] S1: System initialization, which aims to generate the key materials required for encrypted communication, securely distribute the initial parameters of the model, and preprocess and configure the blind vectors.

[0010] S2: Local training;

[0011] S3: Robust aggregation;

[0012] S4: Decryption and Model Update. Two independent entities, S1 and S2, on the server side jointly complete the decryption of the aggregated gradient and the model update.

[0013] Furthermore, S1 specifically includes:

[0014] Blind vector generation: A pseudo-random vector generation algorithm is invoked by the key center. Generate a random blind vector of dimension l. Where k is a safety parameter, ensuring that the generated vector has sufficient entropy and unpredictability;

[0015] Key generation and distribution: KC generates and distributes key pairs for all participants in the federated system, including client Ci, edge node ENi, and the two servers S1 and S2; for each participating entity Where 𝑛 is the total number of clients, 𝑠 is the number of edge nodes corresponding to each group of clients, and the extra two represent two servers. The key generation function is called: KC will provide the corresponding public key. With private key The vectors are distributed to the client, edge nodes, and server respectively; KC generates a blind vector d and distributes it to ENi and S2.

[0016] Model initialization parameter encryption and distribution: KC uses client public keys. For initial model parameters Encryption is performed to obtain ciphertext. Then the encrypted message is sent to the corresponding client Ci.

[0017] Furthermore, S2 specifically includes:

[0018] In the t-th round of training, each client Ci first uses its private key ski to decrypt the ciphertext of the global model broadcast by the server, obtaining the plaintext global model parameters. Subsequently, the client uses the stochastic gradient descent (SGD) algorithm to calculate the local model gradient based on the local dataset Di. ,in (⋅) represents the loss function; for malicious clients, instead of performing normal training, they inject fake adversarial gradients using their own attack strategies, denoted as: To protect the privacy of gradient information during the upload process, each client uses the Rand random number generation algorithm to introduce a random scalar masking factor into its gradient. Its generation method is as follows: Ultimately, the client will have a weighted gradient with occlusion, resulting in a benign outcome. Malignant Send to edge nodes for subsequent aggregation.

[0019] Furthermore, S3 specifically includes:

[0020] During each round of training, the edge node EN is responsible for decrypting, detecting anomalies, and aggregating the encrypted gradients from all clients;

[0021] Reference gradient calculation: To construct the reference gradient vector, the edge nodes average the aggregated gradient results from the previous t-1 rounds. This reference gradient is used for subsequent similarity assessment, serving as the direction guide for a benign gradient.

[0022] Encryption gradient reception and decryption: In round t, the edge node receives encryption gradients submitted by all clients. The edge nodes use their private keys to decrypt the ciphertext, obtaining the original set of gradients masked by a random factor: ;

[0023] Gradient similarity analysis and filtering: To eliminate potentially malicious gradients, the system uses PCC to evaluate each occlusion gradient against the reference gradient. Similarities between them: Edge nodes are sorted according to the value of each P[i], and some gradients with the lowest similarity are removed, while gradients with high similarity (i.e. high directional consistency) are retained as benign updates.

[0024] Aggregation and Blinding: Perform a weighted summation on the filtered set of benign gradients to obtain the global aggregated gradient for the current round. To ensure privacy protection, the edge nodes blind the aggregation results before sending them to the server, adding the blind vector d generated during the system initialization phase. ;

[0025] Encryption and Output: Aggregated Gradient After Blinding The encrypted text will be generated using the public key of server S1. This ciphertext will then be output and sent to server S1 to proceed to the next step.

[0026] Furthermore, S4 specifically includes:

[0027] Key and coefficient preparation: Both servers S1 and S2 need to obtain the occlusion coefficients ri corresponding to the gradients uploaded by all clients in advance; these coefficients can be transmitted encryptedly or distributed uniformly by KC;

[0028] Encrypted Aggregated Gradient Decryption: Server S1 first receives the blinded aggregated gradient ciphertext returned by the edge nodes. And use its private key to perform decryption to obtain the blinded plaintext. ;

[0029] Coefficient separation operation: To restore the original structure of each term in the gradient, S1 performs a modulus coefficient separation operation CS on the blinded plaintext gradient to generate an intermediate gradient expression. Its mathematical expression is:

[0030] ,

[0031] In this process, all modulo operations are performed element-wise independently along each dimension of the vector;

[0032] Dual-server collaborative unblinding: S1 will use the above The data is sent to S2; server S2 holds the original blind vector d and all {ri}, and uses this data to restore the blinded terms, and uses the deblinding operation DecCS to restore the true aggregate gradient: After completing blindness removal It was then returned to S1;

[0033] Global Model Update: Finally, S1 updates the global model parameters using the recovered aggregated gradients, as shown in the following formula:

[0034] ,

[0035] in:

[0036] The learning rate;

[0037] This represents the number of data samples held by the i-th client;

[0038] This represents the sum of all client samples.

[0039] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0040] This invention evaluates the accuracy of its model against two attacks (label flipping attacks and backdoor attacks) on four datasets (Fashion-MNIST, Synthetic, CIFAR-10, FEMNIST) with different proportions of malicious clients (0 to 50%). Comparisons are made with six state-of-the-art benchmark schemes: FedAvg, Multi-Krum, PBFL, PEFL, RFed, and ShieldFL. Generally, models trained on honest clients tend to achieve higher accuracy due to access to high-quality training data. The accuracy of all aggregation schemes decreases with increasing proportions of malicious clients, with FedAvg showing the most significant drop. This is because it cannot identify or suppress poisoned updates, making it highly vulnerable to adversarial attacks. Even for the Byzantine resilience method, accuracy gradually decreases when the malicious ratio exceeds 30% due to the reduced amount of trusted data involved in aggregation. Nevertheless, this invention maintains a relative performance advantage across all attack scenarios. This superiority is primarily attributed to its flexible similarity-based comparison mechanism and appropriate selection of the top k trusted updates, which allows for more precise filtering of poisoned gradients during aggregation.

[0041] This invention successfully solves a key technical problem in federated learning that has long been considered "difficult to achieve simultaneously": effectively detecting poisoning behavior under a secure aggregation mechanism (where the server cannot access any plaintext gradient information). The reason this goal has remained unachieved in long-term research is twofold: firstly, encryption and masking mechanisms prevent the server from obtaining the true direction, magnitude, and interrelationships of gradients, directly causing traditional robust aggregation and anomaly detection methods based on gradient similarity or consistency to fail; secondly, the exposure of intermediate data introduced to recover or approximate gradient information undermines the privacy protection assumption of secure aggregation, creating a fundamental technical contradiction. This invention solves this problem for the first time without compromising privacy constraints through three highly synergistic core technological breakthroughs. First, by designing a multiplication masking mechanism, the Pearson correlation between gradients is strictly maintained, enabling the determination of gradient direction consistency in a completely dense state; second, by constructing a random factor set {r1,…,r...} with a deterministic sorting structure... n This approach allows for the layer-by-layer stripping of occluded gradients within the modular arithmetic framework, fundamentally solving the problem of incorrect aggregation under occlusion conditions. Thirdly, a dual-server coefficient decomposition and collaborative recovery protocol is proposed, placing the "separation" and "anti-separation" processes in different entities. This ensures the correctness of the aggregation results while preventing any single server from acquiring individual gradient information. The synergistic effect of these technologies makes poison detection under secure aggregation possible for the first time. Attached Figure Description

[0042] Figure 1 This is a performance comparison chart of the label flipping attack provided in this embodiment of the invention on the Fashion-MNIST dataset;

[0043] Figure 2 This is a performance comparison chart of the backdoor attack provided in this embodiment of the invention on the Fashion-MNIST dataset;

[0044] Figure 3 This is a performance comparison chart of the label flipping attack provided in this embodiment of the invention on the Synthetic dataset;

[0045] Figure 4 This is a performance comparison chart of the backdoor attack provided in this embodiment of the invention on the Synthetic dataset;

[0046] Figure 5 This is a performance comparison chart of the label flipping attack provided in this embodiment of the invention on the CIFAR-10 dataset;

[0047] Figure 6 This is a performance comparison chart of the backdoor attack provided in this embodiment of the invention on the CIFAR-10 dataset;

[0048] Figure 7 This is a performance comparison chart of the label flipping attack provided in this embodiment of the invention on the FEMNIST dataset;

[0049] Figure 8 This is a performance comparison chart of the backdoor attack provided in this embodiment of the invention on the FEMNIST dataset;

[0050] Figure 9 This is a system model diagram provided in an embodiment of the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0052] In the industrial environment where large-scale distributed intelligent systems are continuously being deployed, such as online model iteration in mobile financial risk control, medical imaging cloud platforms, and vehicle-road cooperative driving systems, data silos and privacy compliance restrictions have made federated learning the mainstream architecture. However, actual industrial operation shows that traditional federated averaging (FedAvg) is extremely prone to instability when encountering model poisoning, backdoor injection, and gradient bias attacks. After multiple iterations, it can lead to accuracy collapse, decision shifts, and even controllable backdoor behavior. The underlying reason is that the gradient aggregation stage lacks the ability to identify the behavior of the uploader. The server assumes the responsibility of single-point decryption and aggregation. Once a node is attacked, the aggregation result will be contaminated as a whole. At the same time, robust aggregation methods such as Krum and Trimmed-Mean are difficult to implement efficiently in multi-level edge architectures and cannot balance privacy protection and poisoning detection. Therefore, the industry urgently needs a secure aggregation mechanism that is compatible with heterogeneous edge deployment structures, avoids centralized leakage of private keys, can eliminate forged gradients in the encrypted domain, and ensures stable performance.

[0053] This invention introduces a four-layer architecture: "client—edge node—dual servers S1 / S2—key center KC," which subdivides the critical path for secure model updates, ensuring clear responsibility boundaries for gradient flow in encryption, blinding, filtering, separation, and deblinding stages. During system initialization, KC generates blind vectors and various key materials, and sends the encrypted initial model parameters to the client, ensuring all subsequent communication is encrypted and masked. The client only needs to decrypt the model parameters locally, perform training, and upload the gradient scaled by a random factor. Due to the addition of random coefficients, even if the server obtains intermediate values, it is difficult to deduce the true gradient structure. The core logic of the entire architecture is not simple distributed computing, but rather, through key decoupling and decomposition of computational responsibilities, it establishes a steady-state communication mechanism where "untrusted communication links are controllable and untrusted entities are verifiable."

[0054] To identify malicious gradients under confidentiality, this invention moves gradient similarity detection forward to edge nodes: edge nodes generate reference gradients through multiple rounds of global aggregation history to construct a "temporally consistent vector" for the model's orientation. Subsequently, the Pearson correlation coefficient (PCC) is used to evaluate the directional consistency of the masked gradients uploaded by each client. Although the gradients are scaled by a random factor, the directional information remains unchanged, thus allowing for accurate identification of the bias characteristics of malicious attacks through statistical correlation. This process does not require obtaining the true gradient values ​​or rely on client behavior models, thereby avoiding the adversarial dilemma common in the industry where "the detection model is evaded by attackers." The retained benign gradients are then superimposed with the system's blind vector, providing traceable structural information for subsequent server-side deblinding processing. This results in a robust aggregation process with strong directional consistency, strong resistance to adversarial disturbances, and high interpretability.

[0055] On the server side, S1 is responsible for decrypting the blinded aggregated gradient ciphertext returned by the edge nodes, but what it obtains is only a composite structure after mixing random coefficients and blind vectors. S1 uses modulus-coefficient separation to split the multi-layered nested random factors by dimension, generating an intermediate expression so that the superimposed trajectory of the blind vectors can be fully expanded algebraically, but it still cannot recover the true gradient independently. At this point, a second server, S2, is introduced, which holds the original blind vector d and all ri. It uses the deblinding mapping function DecCS(·) to eliminate the blind terms and recover the unbiased aggregated gradient. The dual-server design employs a permission-splitting mechanism, ensuring that neither server can independently derive the true gradient, thus guaranteeing verifiable computation, irreversible information, and non-merging permissions. The final aggregated gradient is used by S1 to update the global model, ensuring that the update path meets the optimization requirements of federated learning.

[0056] The secure aggregation mechanism of this invention exhibits inherent stability during operation: random occlusion factors on the client disrupt reversibility, similarity detection of edge nodes ensures directional consistency, blind vectors provide structured, separable identifiers for the server, and the dual servers ensure the correctness and security of the deblinding process through the division of ownership of keys and blind vectors. Although poisoning attacks may change the direction of some uploaded gradients in a single round, the time averaging mechanism of the reference gradient can capture the global convergence trend, making it difficult for malicious gradients to affect the model update direction in the long term. Overall, the system utilizes mechanisms such as randomness, weighting, directional statistics, and algebraic separability to construct a complete and reliable link from the client to the model update, without relying on attacker behavior assumptions, nor on expensive homomorphic computation or heavyweight multi-party security protocols, thus possessing industrial feasibility.

[0057] From the perspective of industrial applications, this invention addresses three key pain points of federated learning: (1) In multi-layer edge collaborative networks, due to frequent communication and heterogeneous nodes, traditional secure aggregation methods cannot resist poisoning while maintaining performance. This invention provides a robust aggregation path that can be deployed in real edge architectures; (2) In highly sensitive scenarios such as medical, vehicle networking, and finance, attackers can construct backdoors through tail distribution attacks. This solution significantly reduces the success rate of backdoor injection through directional consistency detection, ensuring the safety of clinical and vehicle decision-making in the model; (3) Traditional solutions have high encryption computation overhead and large latency. This invention achieves a compromise between low communication overhead, low computation cost, and strong privacy protection through blind vector + dual-server weighted reconstruction, enabling the system to operate stably in industrial environments with high real-time requirements. In summary, this invention enables federated learning to have a feasible, traceable, and verifiable anti-poisoning capability when facing complex adversarial environments, laying the foundation for the industry to truly realize "secure and controllable distributed intelligence".

[0058] This invention provides a federated learning anti-poisoning safety aggregation scheme, which includes:

[0059] S1: System initialization, which aims to generate the key materials required for encrypted communication, securely distribute the initial parameters of the model, and preprocess and configure the blind vectors.

[0060] S2: Local training;

[0061] S3: Robust aggregation;

[0062] S4: Decryption and Model Update. Two independent entities, S1 and S2, on the server side jointly complete the decryption of the aggregated gradient and the model update.

[0063] The core can be divided into two main parts: malicious gradient detection and coefficient separation.

[0064] (1) Malicious gradient detection

[0065] In federated learning systems, the local model gradients uploaded by clients should maintain a consistent direction, exhibiting a cooperative descent trend towards the optimal model parameters—a phenomenon known as directional consistency. These "benign" gradients are often tightly distributed around the global gradient direction, reflecting the consistency between the training data. However, in real-world scenarios, some malicious clients may intentionally upload forged "malicious gradients" to interfere with the global model's updates. Such malicious gradients mainly manifest in two forms:

[0066] Directional deviation type: The uploaded gradient deviates significantly from the normal gradient aggregation direction and has a significant angle with the update direction uploaded by most clients, thus disrupting the global descent path.

[0067] Amplitude imbalance type: The uploaded gradients are roughly consistent in direction, but the numerical amplitude is abnormally amplified. This is often used to implement amplification backdoor attacks or flip attacks, so that their impact is significantly amplified in the aggregation.

[0068] To effectively identify the two types of abnormal behavior mentioned above, this invention designs a two-stage anomaly detection mechanism:

[0069] In the first stage, to identify directional deviation anomalies, the system evaluates directional consistency by calculating the PCC between the gradient uploaded by each client and the reference aggregated gradient. If the PCC value of a gradient is significantly lower than that of the reference gradient, it is considered an "angle anomaly" inconsistent with the mainstream direction and is removed.

[0070] In the second stage, to suppress amplitude imbalance attacks, the system performs L2 norm normalization on all gradients under test to eliminate malicious clients' attempts to gain additional influence by simply amplifying the gradient magnitude. Similarity evaluation is performed after normalization to ensure the detection mechanism is robust to numerical scales. These two mechanisms complement each other: the former ensures directional consistency, and the latter guarantees the reasonableness of the numerical scale, jointly constructing a reliable gradient filtering strategy. Even if an attacker attempts to manipulate only a single feature of the gradient (direction or magnitude) to evade detection, it is difficult to bypass this combined detection, thus improving the system's ability to identify poisoning behavior in encrypted states.

[0071] (2) Coefficient separation

[0072] In this invention, to protect privacy during gradient similarity calculation, a random factor *r* is introduced specific to each client. However, this mechanism also introduces new challenges: since the gradients uploaded by all clients are weighted by different factors, the final gradient aggregation result obtained by the server is:

[0073] gagg1 = r1g1 + r2g2 + ... + rngn.

[0074] It is difficult to directly recover the original gradient sum g = g1 + g2 + ... + gn from the aggregation result. To solve this problem, this invention designs a "coefficient separation" algorithm, the key of which lies in the selection of the random factor ri, which must satisfy the following condition: This allows us to extract the contribution of each term individually using modular arithmetic. For example, first perform a modular arithmetic on the sum: Therefore, we can conclude that: Similarly, each of the remaining gradients gi can be solved sequentially in the same way. To prevent a single server from reconstructing all individual gradient values ​​during the separation process, this invention designs a dual-server security protocol: before performing coefficient separation, a random blind vector d is first added to the sum vector gagg, resulting in: The results after blinding. It is sent to server S1, which only has the set of coefficients. However, the specific value of the blind vector d is unknown. Server S1, without knowing the blind vector, performs a coefficient separation operation (denoted as CS(⋅)) and obtains: ,in This represents the intermediate result after the modular arithmetic has been stripped away, specifically:

[0075] ,

[0076] Subsequently, S1 will The data is sent to server S2. Server S2 possesses the blind vector d and the coefficient set. However, the original gradient is not accessed, therefore individual information is not leaked. Server S2 is responsible for performing the unblinding operation (denoted as DecCS(⋅)), specifically: The central error term e can be calculated using the following formula:

[0077] ,

[0078] Finally, through The original global gradient can then be recovered. Throughout the process, neither server can obtain all the information needed to reconstruct the original gradient of any client independently. Server S1 performs modular stripping without knowing d, while server S2 knows d but has not seen the original gradient. Only through their collaboration can blind vector elimination and final reconstruction be completed, ensuring the system's security and gradient privacy protection under the premise of "no collusion between the two servers".

[0079] Furthermore, S1 specifically includes:

[0080] Blind vector generation: A pseudo-random vector generation algorithm is invoked by the key center. Generate a random blind vector of dimension l. Where k is a safety parameter, ensuring that the generated vector has sufficient entropy and unpredictability;

[0081] Key generation and distribution: KC generates and distributes key pairs for all participants in the federated system, including client Ci, edge node ENi, and the two servers S1 and S2; for each participating entity Where 𝑛 is the total number of clients, 𝑠 is the number of edge nodes corresponding to each group of clients, and the extra two represent two servers. The key generation function is called: KC will provide the corresponding public key. With private key The vectors are distributed to the client, edge nodes, and server respectively; KC generates a blind vector d and distributes it to Eni and S2.

[0082] Model initialization parameter encryption and distribution: KC uses client public keys. For initial model parameters Encryption is performed to obtain ciphertext. Then the encrypted message is sent to the corresponding client Ci.

[0083] Furthermore, S2 specifically includes:

[0084] In the t-th round of training, each client Ci first uses its private key ski to decrypt the ciphertext of the global model broadcast by the server, obtaining the plaintext global model parameters. Subsequently, the client uses the stochastic gradient descent (SGD) algorithm to calculate the local model gradient based on the local dataset Di. ,in (⋅) represents the loss function; for malicious clients, instead of performing normal training, they inject fake adversarial gradients using their own attack strategies, denoted as: To protect the privacy of gradient information during the upload process, each client uses the Rand random number generation algorithm to introduce a random scalar masking factor into its gradient. Its generation method is as follows: Ultimately, the client will have a weighted gradient with occlusion, resulting in a benign outcome. Malignant Send to edge nodes for subsequent aggregation.

[0085] Furthermore, S3 specifically includes:

[0086] During each round of training, the edge node EN is responsible for decrypting, detecting anomalies, and aggregating the encrypted gradients from all clients;

[0087] Reference gradient calculation: To construct the reference gradient vector, the edge nodes average the aggregated gradient results from the previous t-1 rounds. This reference gradient is used for subsequent similarity assessment, serving as the direction guide for a benign gradient.

[0088] Encryption gradient reception and decryption: In round t, the edge node receives encryption gradients submitted by all clients. The edge nodes use their private keys to decrypt the ciphertext, obtaining the original set of gradients masked by a random factor: ;

[0089] Gradient similarity analysis and filtering: To eliminate potentially malicious gradients, the system uses PCC to evaluate each occlusion gradient against the reference gradient. Similarities between them: Edge nodes are sorted according to the value of each P[i], and some gradients with the lowest similarity are removed, while gradients with high similarity (i.e. high directional consistency) are retained as benign updates.

[0090] Aggregation and Blinding: Perform a weighted summation on the filtered set of benign gradients to obtain the global aggregated gradient for the current round. To ensure privacy protection, the edge nodes blind the aggregation results before sending them to the server, adding the blind vector d generated during the system initialization phase. ;

[0091] Encryption and Output: Aggregated Gradient After Blinding Encryption is performed using the public key of server S1 to generate ciphertext, which is then output and sent to server S1 to proceed to the next step.

[0092] Furthermore, S4 specifically includes:

[0093] Key and coefficient preparation: Both servers S1 and S2 need to obtain the occlusion coefficients ri corresponding to the gradients uploaded by all clients in advance; these coefficients can be transmitted encryptedly or distributed uniformly by KC;

[0094] Encrypted Aggregated Gradient Decryption: Server S1 first receives the blinded aggregated gradient ciphertext returned by the edge nodes. And use its private key to perform decryption to obtain the blinded plaintext. ;

[0095] Coefficient separation operation: To restore the original structure of each term in the gradient, S1 performs a modulus coefficient separation operation CS on the blinded plaintext gradient to generate an intermediate gradient expression. Its mathematical expression is:

[0096] ,

[0097] In this process, all modulo operations are performed element-wise independently along each dimension of the vector;

[0098] Dual-server collaborative unblinding: S1 will use the above The data is sent to S2; server S2 holds the original blind vector d and all {ri}, and uses this data to restore the blinded terms, and uses the deblinding operation DecCS to restore the true aggregate gradient: After completing blindness removal It was then returned to S1;

[0099] Global Model Update: Finally, S1 updates the global model parameters using the recovered aggregated gradients, as shown in the following formula:

[0100]

[0101] in:

[0102] The learning rate;

[0103] This represents the number of data samples held by the i-th client;

[0104] This represents the sum of all client samples.

[0105] Specific application areas or related products of this invention:

[0106] Example: Privacy Protection and Anti-Poisoning Applications in a Federated Learning-Based Medical Diagnostic System

[0107] Taking the joint training of a pneumonia identification model by medical institutions as an example, multiple medical institutions, including Hospital A, Hospital B, and Hospital C, hope to jointly train a high-precision medical image diagnosis model without sharing local patient privacy data. However, traditional federated learning has prominent problems in the following two aspects: (1) After the server adopts secure aggregation, it is impossible to observe individual gradients, which makes it impossible to identify maliciously uploaded poison gradients; (2) Existing anti-poisoning algorithms all rely on plaintext gradient similarity and cannot be used under privacy protection conditions.

[0108] The technology proposed in this invention can effectively solve the above problems, and its workflow in medical scenarios is as follows.

[0109] 1. Local Training and Masked Gradient Generation at Client Hospitals: Each hospital trains a local model using its own lung CT data and calculates its local gradient gi. To protect gradient privacy and prevent the server from deducing patient data, this invention uses a structured multiplicative masking vector ri to mask the local gradient, ensuring that the uploaded gradient is in the form: gi′=ri⋅gi. This masking is multiplicative, and its core characteristics are: masking does not destroy the Pearson correlation between gradient directions; the server cannot derive the original gradient from gi′.

[0110] 2. Dual-server collaboration for dense-state similarity calculation and poisoning detection: To ensure the model is not compromised by malicious hospitals or attackers, this invention employs a dual-server architecture (Server A (S1) + Server B (S2)) to accomplish the following tasks:

[0111] (1) Server A: Performs dense-state similarity calculation: Server A obtains all occlusion gradients gi′ and calculates the Pearson correlation matrix between each pair of gradients. Assume that for gradients g1 and g2, the following equation holds:

[0112]

[0113] Therefore, even under encryption, Server A can still accurately determine the directional consistency between the gradients of each client.

[0114] (2) Detecting poisoned gradients submitted by malicious hospitals: Server A identifies highly anomalous gradients (such as gradients with directions completely opposite to those of other hospitals) based on the correlation matrix. These gradients are usually injected by malicious hospitals to cause the model to converge incorrectly or to maliciously tamper with the output. This invention utilizes dense-state anomaly detection, which can eliminate attackers without exposing the true gradients of any hospital, thus significantly improving the robustness of the model.

[0115] 3. Secure Aggregation: Collaborative Unmasking and Summation between Server A and Server B

[0116] After filtering out malicious gradients, all valid gradients need to be summed to complete the federated average. However, due to gradient occlusion caused by multiplication, direct summation will yield incorrect values. This invention proposes a coefficient decomposition protocol to solve this problem:

[0117] 1. Server A reassembles the retained occlusion gradients according to a preset structure and sends them to Server B;

[0118] 2. Server B utilizes the separability of the structured random factor set {r1,…,rn} to achieve “partial anti-masking”;

[0119] 3. Server A and Server B work together to complete the final anti-masking and obtain the correct ∑gi.

[0120] Throughout the process, neither server was able to independently recover the true gradient of any hospital.

[0121] 4. Global Model Update: The server updates the medical image diagnosis model using the summed gradient, and then sends the model parameters back to each hospital for the next iteration.

[0122] 5. Technical effects of the present invention in this embodiment

[0123] According to the experimental results:

[0124] (1) Effective identification and filtering of poisoning clients: Even with an attack rate as high as 30%, the present invention can still correctly identify malicious gradients, which significantly improves the accuracy of the model (experiments show that the improvement can reach 3%–5%).

[0125] (2) Complete protection of patient privacy: All gradients uploaded by hospitals are multiplicatively masked, and neither Server A nor Server B can recover any local gradients individually, thus meeting the requirements of medical data privacy regulations.

[0126] (3) Extremely low computation and communication overhead: The Pearson correlation calculation of the present invention remains unchanged under shading, so no additional complex homomorphic encryption is required, which greatly reduces the deployment cost.

[0127] (4) The model converges stably and has strong anti-attack capabilities: Compared with traditional secure aggregation, which cannot defend against poisoning, this invention combines privacy protection and robust aggregation to achieve a higher quality and more robust medical model.

[0128] To verify the robustness of the security aggregation scheme of this invention under different attack intensities, this embodiment evaluates the trend of model accuracy with attack intensity under different malicious client ratios (0%–50%). The experimental results are shown in Figures 1-8. The experiments cover four datasets: Fashion-MNIST, Synthetic, CIFAR-10, and FEMNIST, and simultaneously consider two typical poisoning scenarios: label flipping attacks and backdoor attacks. The results show that as the proportion of malicious clients increases, all aggregation methods experience varying degrees of accuracy decline. The traditional FedAvg exhibits the most significant degradation; when the malicious client ratio reaches above 30%, the model accuracy drops drastically, making it almost unusable for effective training. Even for robust aggregation methods with Byzantine tolerance, the accuracy gradually decays as the malicious client ratio increases, mainly due to the reduction in the amount of effective, non-toxic data participating in the aggregation.

[0129] In comparison, the SA-FL secure aggregation scheme proposed in this invention demonstrates significant robustness across all datasets and attack types. Even when the proportion of malicious clients reaches 40%–50%, the model accuracy of this invention remains at the highest level among similar algorithms, significantly outperforming existing methods such as FedAvg, Multi-Krum, PBFL, PEFL, RFed, and ShieldFL. This advantage is mainly attributed to the feature similarity-based trusted client screening mechanism and top-k model update selection strategy employed in this invention, which can accurately filter contaminated gradients during the aggregation process, thereby effectively suppressing model shifts caused by poisoning attacks.

[0130] In summary, the experimental results show that the secure aggregation scheme of the present invention can maintain stable training performance even under extreme conditions with a high proportion of malicious clients participating, significantly improving the reliability and practical value of federated learning in complex environments, and fully demonstrating the outstanding technical effect and inventiveness of the present invention.

Claims

1. A federated learning anti-poisoning security aggregation system, characterized in that, The system includes a key center, multiple clients, multiple edge nodes, and servers S1 and S2, and executes according to a preset training round: System initialization; Client-side decryption and local training; Robust aggregation of edge nodes; Server-side unblinding and global model update; The servers S1 and S2 work together to decrypt and unblind the blinded aggregated gradients, and finally output the updated global model parameters.

2. The system according to claim 1, characterized in that, The system initialization includes: generating blind vectors by the key center, generating key pairs for each participant, encrypting the initial model parameters, and sending the encrypted model parameters to the corresponding clients.

3. The system according to claim 1, characterized in that, In each round of training, each client decrypts the global model ciphertext sent by the server, calculates the local gradient using the local dataset, introduces random occlusion coefficients into the gradient, and then sends it to the corresponding edge node.

4. A method for blind vector generation and initial model encryption in a federated learning system, characterized in that, The key center obtains a blind vector of dimension l using a pseudo-random vector generation algorithm; generates public and private keys for each participant using a key generation algorithm; and encrypts the initial model parameters using the client's public key and transmits them to the target client.

5. The method according to claim 4, characterized in that, The blind vector is synchronously distributed to the edge nodes and server S2 for subsequent gradient blinding and deblinding processes.

6. A client-side training and gradient occlusion method in federated learning, characterized in that, Each client decrypts the global model parameters during the training rounds, obtains the local gradient based on the local dataset, generates random coefficients for the gradient to obtain the occlusion gradient, and finally sends the occlusion gradient to the corresponding edge node.

7. The method according to claim 6, characterized in that, The occlusion gradient uploaded by a benign client is the product of random coefficients and the true gradient, while the occlusion gradient uploaded by a malicious client is the product of random coefficients and adversarial gradient.

8. A robust gradient aggregation method performed at edge nodes, characterized in that, include: Receive multiple masking gradients; construct a reference gradient based on the aggregated gradients from previous rounds; use similarity calculation to remove low-similarity gradients; perform weighted aggregation on the retained gradients; add the blind vector to the aggregated gradient and output the blinded aggregated gradient ciphertext.

9. The method according to claim 8, characterized in that, The similarity calculation uses the statistical correlation between the gradient and the reference gradient to determine the degree of similarity, in order to filter out malicious gradients whose direction deviates from the reference gradient.

10. A method for aggregated gradient unblinding and model updating in federated learning, characterized in that, Server S1 decrypts the blinded aggregated gradient ciphertext and performs modulus coefficient separation to obtain the intermediate gradient structure. Server S2 calculates the deblinding result based on the blind vector and random coefficients. Server S1 updates the model parameters θ(t+1)=θt−ηΣi ni gagg,t using the global aggregated gradient.

Images