Federal learning model-oriented anonymous traceable protection method
By combining group signature and model watermarking techniques in the federated learning model, anonymous signatures are generated and node fingerprints are embedded, solving the problem that the traceability of leakers depends on node identity in existing technologies, and realizing copyright protection of federated learning models with both anonymity and traceability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-03-13
AI Technical Summary
Existing mechanisms for tracing leakers of federated learning models require the public disclosure of federated node identities when tracking leakers, which infringes on the privacy of legitimate nodes and lacks non-repudiation and non-forgeability, thus affecting the credibility of the copyright protection system.
By combining group signature and model watermarking techniques, the system key is initialized before federated training to generate anonymous signatures and embed node fingerprints, ensuring the anonymity of legitimate nodes and tracing the leaker when the model is leaked.
It enables accurate tracking of model leakers without compromising the privacy of legitimate nodes, ensuring the credibility and security of the copyright protection system for federated learning models and guaranteeing the performance stability of the model in the original task.
Smart Images
Figure CN121664564A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of copyright protection technology, and in particular to an anonymous traceable protection method for federated learning models. Background Technology
[0002] Copyright protection for federated learning models falls into two main categories: ownership verification and traceability. Currently, mainstream methods for verifying ownership of federated learning models can be categorized into server-side watermark embedding and node-side watermark embedding. Server-side methods typically embed backdoor samples or specific behaviors during model aggregation, enabling ownership verification without accessing the original training data. Node-side methods allow each node to embed unique watermark information in its local model for subsequent ownership verification. These techniques have achieved some success in copyright declaration and ownership identification. Regarding traceability, existing mechanisms for tracing leakers of federated learning models embed unique and identifiable identifiers without relying on the original training data of nodes, effectively labeling the model propagation path and accurately tracking leaking nodes. However, these existing mechanisms still have significant shortcomings.
[0003] (1) Existing traceability mechanisms can only track down the model leaker if the identities of all federated nodes are disclosed, but this will compromise the privacy of legitimate federated nodes. Servers can associate node identities with model structure and gradient data, thereby potentially inferring private data, characterizing node profiles, and threatening their data security—which contradicts the core goal of federated learning to protect node data privacy.
[0004] (2) The existing source tracing mechanism for leakers of federated learning models lacks effective guarantees of non-repudiation and non-forgeability, which makes the identity identifiers and related evidence generated during the source tracing process easily forged by unauthorized malicious nodes. Furthermore, the leaking node may deny its responsibility for the model leak during the source tracing process of federated learning models, which weakens the probative value of the source tracing results and affects the credibility of the copyright protection system of federated learning models. Summary of the Invention
[0005] The purpose of this invention is to provide an anonymous and traceable protection method for federated learning models. By combining group signature with model watermarking technology, traceability is achieved while ensuring the anonymity of legitimate federated nodes.
[0006] To achieve the above objectives, this invention provides an anonymity and traceability protection method for federated learning models, comprising the following steps: Step S1, System Initialization and Multi-Key Distribution: Before the federated training begins, the group manager executes the group signature initialization algorithm, taking security parameters as input, to generate the system public key, the group tracking key, and the private key assigned to each federated client node; the group manager publishes the system public key and distributes the private keys of the federated client nodes to the corresponding federated client nodes. Step S2, Gradient Update and Signature: In each round of federated training, each federated client node generates a signature for the updated gradient and sends the updated gradient and its signature to the server through an anonymous network. Step S3, Federated Aggregation: After receiving the gradient and signature, the server calls the verification algorithm to confirm the legitimacy of the federated client nodes; if the verification passes, the gradient is valid; subsequently, the server uses the valid gradient to perform a global aggregation operation. Step S4, Signature Mapping and Federation Node Fingerprint Embedding: The server collects signatures from federated client nodes and maps the signatures to a specific vector space using a hash function to generate node fingerprints; the server records the mapping relationship between gradients, signatures, and fingerprints, and embeds the node fingerprint information into the gradients distributed to each federated client node. Step S5, Model Distribution: The server sends the global gradient embedded with the node fingerprint to the corresponding federated client node; the federated client node updates its local model based on the global gradient; then, the server and all federated client nodes continue the next round of training until the model converges.
[0007] Preferably, the group signature scheme consists of five probabilistic multinomial-time algorithms, specifically including initialization, registration, signing, verification, and tracking; The initialization algorithm involves the group administrator executing an initialization algorithm to generate a system public key for verification. Private keys of the federated client nodes used for member registration and the group tracking key used to identify the signer To initialize the group signature system; among which, Indicates a federated client node; Registration Algorithm: Group administrators use the private keys of the federated client nodes. Generate a unique identifier based on the node's identity ID. and private signing key And distribute it to the corresponding federated client nodes; Signature algorithm: Group members use their private signing keys Generate a group signature for the message; Verification Algorithm: The verification algorithm receives the message, signature, and public key of the group verification system. The output is either valid or invalid, which is used in the attribution phase to determine whether the signature is valid. Tracking Algorithm: Group administrators use group tracking keys Signatures are used to identify the signer, which is used for model attribution and accountability tracking.
[0008] Preferably, the group administrator runs an initialization algorithm that takes security parameters as input to generate the required encryption keys, including the system public key gpk, the group tracing key gtk, and the key for each federated client node. Distributed private key Where I is the total number of federated client nodes; After initialization, the group administrator securely distributes the private key gsk[i] of the federated client node to the federated client node i, enabling it to independently sign its local model updates while maintaining anonymity; the system public key is shared with the server for verification, while the group tracing key is kept by the group administrator and used only during tracing.
[0009] Preferably, after the federated client nodes sign their local model updates using their respective private keys, the server receives these signed updates, specifically including: For the federated client node i in the t-th training round, the server first uses the system public key. Verify each signature; upon successful verification, the server processes each signature. A secure hash function is applied to generate a unique node fingerprint. As shown below: ; in, For hash functions; The node fingerprint uniquely identifies the contribution of each federated client node in a specific training round, serving as a watermark embedded in the model to ensure traceability without compromising anonymity; the correspondence between node fingerprints and signatures is recorded.
[0010] Preferably, given the weight matrix in the client model The local fingerprint is then represented as: ; in, For local fingerprint representation, , Fingerprint length; The weight matrix of the client-side model. , For the dimensions of the model weights; The symbol function is represented by K, which is a key matrix randomly generated by the server before node fingerprint embedding, i.e., the server generates a key matrix for each federated client node. Generate a key matrix To embed node fingerprints.
[0011] Preferably, the weight parameters in the batch normalized BN layer are selected for inserting local fingerprints, specifically including: First, in the BN layer, the output of the previous layer is... Normalization is performed as follows: ; in, and Output of the upper layer respectively The mean and variance; It is a small constant; and These are learnable parameters; The output tensor of the BN layer; Then, embed the local fingerprint parameters. In, and in multiple BN layers Concatenate into a vector .
[0012] Preferably, the fingerprint fitting loss function for the i-th federated client node is defined based on a Hinge-like loss function. As shown below: ; in, Hinge-like loss function; It is a key matrix randomly generated by the server for federated client node i before the node fingerprint is embedded; It is a node fingerprint; It is the BN layer concatenation vector of the federated client node i; It is a hyperparameter that controls the robustness of client fingerprints; Bit index; Fingerprints extracted from the node model The j-th bit; For node fingerprints The j-th bit, i.e. They represent and The j-th position in; Then, for the i-th federated client node, the fingerprint similarity score (FSS) method is used to calculate the difference between the extracted fingerprint and the original federated client node fingerprint, as shown below: ; in, This is the result of fingerprint similarity score calculation; It is the weight matrix of the client-side model; .
[0013] Preferably, the server returns the gradient containing the node fingerprint to the corresponding node, specifically including: The gradient contains embedded node fingerprints, which allows each federated client node's updates to still be tracked while it continues local training, thus enabling the identification of the specific source node in the event of a model leak.
[0014] The preferred model leakage tracking process based on cosine similarity is as follows: (1) Given the weight matrix of the suspected model The extracted fingerprint is represented as: ; in, The fingerprint representation extracted from the suspicious model. ; This is a key matrix randomly generated by the server during the node fingerprint embedding stage; The weight matrix for the suspected model; It is a symbolic function; (2) From the suspicious model The extracted fingerprints are compared with the client fingerprints generated by each node in each round of training, specifically including: By calculating the similarity between the extracted fingerprint and the fingerprints of each client, the system identifies the most similar client fingerprint; once a matching client fingerprint is found, the system can trace back to the specific round of leakage and the corresponding client identity; (3) After obtaining the matching client fingerprint index, the signature is found through the established client fingerprint-signature correspondence, thereby further tracing the identity of the leaker.
[0015] Preferably, based on cosine similarity, the index of the best-matching client fingerprint and its corresponding leakage round are output, as shown below: ; in, Indicates the current training round. Tn represents the total number of training rounds; , Indicates the index of the federated client node. This indicates the total number of federated client nodes; This indicates the output matching result; This represents the node fingerprint of the federated client node i in the t-th training round. ; This represents the index of the federated client node that best matches the cosine similarity among all i; The cosine similarity function is shown below: ; in, This represents the cosine similarity value between input vectors x and y; This represents the L2 norm, i.e., the vector length.
[0016] Therefore, the above-mentioned anonymous traceability protection method for federated learning models adopted in this invention has the following beneficial effects: (1) Combining group signatures with model watermarks to ensure the effectiveness of traceability: This invention proposes an anonymously traceable copyright protection mechanism for federated learning models. In federated learning, a unique signature is introduced for each node and training round, and a cosine similarity-based metric is designed to detect model leakers. By combining group signatures with model watermarks, model leakers can be accurately tracked while ensuring the anonymity of legitimate nodes, thus achieving traceability.
[0017] (2) Protecting the anonymity of legitimate node identities: This invention ensures the anonymity of node identities and can identify the leakers of federated learning models without infringing on the privacy of legitimate nodes; both nodes and servers are deployed in an anonymous network, further ensuring anonymity and providing security analysis, proving that this invention can track model leakers without compromising the privacy of legitimate nodes.
[0018] (3) Ensuring Model Utility and Achieving High Fidelity: This invention operates stably, has minimal impact on the accuracy of the model's original task, and maintains stable performance on the original task, highlighting its strong adaptability and stability. While ensuring traceability and anonymity, it effectively maintains the model's utility in the original task, demonstrating excellent fidelity and ensuring feasibility and practicality in actual federated learning applications. Without sacrificing model performance, it achieves anonymous tracking and accountability of potential leakers, thereby improving the overall security and credibility of the system.
[0019] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0020] Figure 1 This is the overall architecture diagram of the anonymous traceability protection method for federated learning models of this invention; Figure 2 This is a flowchart of the anonymity and traceability protection method for federated learning models according to the present invention. Detailed Implementation
[0021] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.
[0022] Example 1 Existing traceability mechanisms can only track down the model leaker when their identity is publicly known, posing a threat to user privacy. To address this challenge, this invention combines group signature with model watermarking technology to achieve traceability while ensuring the anonymity of legitimate federated nodes. The overall architecture is as follows: Figure 1 As shown.
[0023] To achieve anonymity, this invention establishes a group administrator responsible for key generation and distribution, as well as the registration and management of group members. Under this mechanism, only the group administrator can trace the true identity of the signer through the signature. During federated training, federated client nodes send updated gradients and their signatures to the server via an anonymous network. With the help of anonymous communication, federated client nodes can upload gradients while concealing their identities. Furthermore, to enable tracing in model leakage incidents, this invention uses the digital signatures uploaded by federated client nodes as the "fingerprints" of the federated client nodes, and embeds the node fingerprints into the corresponding models using white-box watermarking technology before model distribution. When a model is leaked, the leaker can be identified by extracting the node fingerprints.
[0024] This invention provides an anonymity and traceability protection method for federated learning models, such as... Figure 2 The overall process of federated training can be divided into the following five stages, as shown below: Step S1, System Initialization and Multiple Key Distribution: Before federated training begins, the group administrator executes the group signature initialization algorithm to generate the system public key, the group tracking key, and the private key assigned to each federated client node. The group administrator publishes the system public key and distributes the private keys of the federated client nodes to the corresponding federated client nodes.
[0025] Step S2, Gradient Update and Signature: In each round of federated training, each federated client node generates a signature for the updated gradient and sends the updated gradient and its signature to the server through an anonymous network.
[0026] Step S3, Federated Aggregation: After receiving the gradients and signatures, the server calls a verification algorithm to confirm whether they come from legitimate federated client nodes. If the verification passes, the gradients are considered valid. Subsequently, the server uses the valid gradients to perform a global aggregation operation.
[0027] Step S4, Signature Mapping and Federation Node Fingerprint Embedding: The server collects signatures from federated client nodes and maps them to a specific vector space using a hash function to generate node fingerprints. The server records the mapping relationship between gradients, signatures, and fingerprints, and then embeds the node fingerprint information into the gradients that will be distributed to each federated client node.
[0028] Step S5, Model Distribution: The server sends the global gradients embedded with node fingerprints to the corresponding federated client nodes. To obtain a higher-performance federated model, the federated client nodes update their local models based on these gradients. Afterward, the server and all federated client nodes continue training for the next round until the model converges.
[0029] Example 2 This embodiment details the fingerprint embedding process based on group signatures. Group signatures are a key cryptographic primitive used in this invention to ensure that federated client nodes can participate anonymously, while also providing accountability in the event of security issues.
[0030] Group signatures possess four main properties: unforgeability, anonymity, traceability, and non-repudiation. A group signature scheme consists of five probabilistic multinomial-time (PPT) algorithms, specifically including setup, enroll, sign, verify, and trace.
[0031] The setup algorithm is as follows: the group administrator executes the setup algorithm to generate a system public key for verification. Private keys of the federated client nodes used for member registration and the group tracking key used to identify the signer To initialize the group signature system; among which, This indicates a federal client node.
[0032] Enroll registration algorithm: The group administrator uses the private keys of the federated client nodes. Generate a unique identifier based on the node's identity ID. and private signing key It is then distributed to the corresponding federated client nodes.
[0033] Signature Algorithm: Group members use their private signing keys. Generate a group signature for the message.
[0034] Verify algorithm: The verification algorithm receives the message, signature, and public key of the group verification system. The output is either valid or invalid, which is used in the attribution phase to determine whether the signature is valid.
[0035] Trace algorithm: The group administrator uses the group trace key when needed. Signatures are used to identify the signer, which is used for model attribution and accountability tracking.
[0036] The entire process begins with the initialization of the group signature system, and the specific steps are as follows: Step 1: The group administrator runs an initialization algorithm that takes security parameters as input and generates the required encryption keys, including the system public key gpk, the group tracing key gtk, and the key for each federated client node. Distributed private key Where I is the total number of federated client nodes.
[0037] After initialization, the group administrator securely distributes the federated client node gsk[i] to the federated client node i, enabling it to independently sign its local model updates while maintaining anonymity. The system public key is shared with the server for verification, while the group tracing key is kept by the group administrator and used only when tracing is required.
[0038] Step 2: After the federated client nodes sign their local model updates using their respective private keys, the server receives these signed updates.
[0039] For federated client node i in the t-th training round, the server first verifies each signature using the system public key gpk. After successful verification, the server processes each signature... A secure hash function is applied to generate a unique node fingerprint. As shown below: ; in, This is a hash function.
[0040] This node fingerprint uniquely identifies the contribution of each federated client node in a specific training epoch. It serves as a watermark embedded in the model, ensuring traceability without compromising anonymity. The correspondence between node fingerprints and signatures will be recorded.
[0041] Step 3: Given the weight matrix in the client model The local fingerprint is then represented as: ; in, For local fingerprint representation, , Fingerprint length; The weight matrix of the client-side model. , For the dimensions of the model weights; The symbol function is represented by K, which is a key matrix randomly generated by the server before node fingerprint embedding, i.e., the server generates a key matrix for each federated client node. Generate a key matrix To embed node fingerprints.
[0042] Step 4: Select the weight parameters in the batch normalization (BN) layer for inserting local fingerprints.
[0043] First, in the BN layer, the output of the previous layer is... Normalization is performed as follows: ; in, and Output of the upper layer respectively The mean and variance; It is a small constant; and These are learnable parameters; This is the output tensor of the BN layer.
[0044] Then, embed the local fingerprint parameters. In, and in multiple BN layers Concatenate into a vector .
[0045] Step 5: Define the fingerprint fitting loss function for the i-th federated client node based on the Hinge-like loss function. As shown below: ; in, Hinge-like loss function; It is a key matrix randomly generated by the server for federated client node i before the node fingerprint is embedded; It is a node fingerprint; It is the BN layer concatenation vector of the federated client node i; It is a hyperparameter that controls the robustness of client fingerprints; Bit index; Fingerprints extracted from the node model The j-th bit; For node fingerprints The j-th bit, i.e. They represent and The j-th position in the sequence.
[0046] Then, for the i-th federated client node, the fingerprint similarity score (FSS) method is used to calculate the difference between the extracted fingerprint and the original federated client node fingerprint, as shown below: ; in, This is the result of fingerprint similarity score calculation; It is the weight matrix of the client-side model; .
[0047] Step 6: The server returns the gradient containing the node fingerprint to the corresponding node.
[0048] The gradient contains embedded node fingerprints, allowing each federated client node's updates to still be tracked while it continues local training, thus enabling the identification of the specific source node in the event of a model leak.
[0049] Example 3 This embodiment details the model leakage tracking process based on cosine similarity. In the context of model leakage, a cosine similarity-based method is used for model leakage attribution analysis.
[0050] (1) Given the weight matrix of the suspected model The extracted fingerprint is represented as: ; in, The fingerprint representation extracted from the suspicious model. ; This is a key matrix randomly generated by the server during the node fingerprint embedding stage; The weight matrix for the suspected model; It is a symbolic function.
[0051] (2) From the suspicious model The extracted fingerprints are compared with the fingerprints generated by each node in each round of training.
[0052] By calculating the similarity between the extracted fingerprint and the fingerprints of each client (node), the system identifies the most similar client fingerprint. Once a matching client fingerprint is found, the system can trace back to the specific round of leakage and the corresponding client identity. Cosine similarity is used to measure the similarity between fingerprints, which is an efficient method to quantify the degree of similarity between two vector representations.
[0053] Therefore, based on cosine similarity, the index of the best-matching client fingerprint and its corresponding leakage round are output as follows: ; in, Indicates the current training round. Tn represents the total number of training rounds; , Indicates the index of the federated client node. This indicates the total number of federated client nodes; This indicates the output matching result; This represents the node fingerprint of the federated client node i in the t-th training round. ; This represents the index of the federated client node that best matches the cosine similarity among all i; The cosine similarity function is shown below: ; in, This represents the cosine similarity value between input vectors x and y; This represents the L2 norm, i.e., the vector length.
[0054] (3) After obtaining the matching client fingerprint index, the signature is found through the established "client fingerprint-signature" correspondence, thereby further tracing the identity of the leaker.
[0055] Therefore, this invention employs the aforementioned anonymous and traceable protection method for federated learning models. For the first time within the federated learning framework, it deeply integrates a group signature system with white-box model watermarking technology. Through a process of multi-key distribution → gradient signature → fingerprint embedding, it constructs a traceable copyright protection system while ensuring node anonymity. Based on a cosine similarity-based model leaker identification algorithm, even under complete anonymity, the server can locate the source of model leakage by comparing the fingerprint extracted from a suspicious model with the fingerprint of a node. This method overcomes the reliance of existing tracing schemes on public identity and safeguards node privacy.
[0056] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.
Claims
1. A method for anonymity and traceability protection for federated learning models, characterized in that, Includes the following steps: Step S1, System Initialization and Multi-Key Distribution: Before the federated training begins, the group administrator executes the group signature initialization algorithm, taking security parameters as input, to generate the system public key, the group tracking key, and the private key assigned to each federated client node; The group administrator publishes the system public key and distributes the private keys of the federated client nodes to the corresponding federated client nodes; Step S2, Gradient Update and Signature: In each round of federated training, each federated client node generates a signature for the updated gradient and sends the updated gradient and its signature to the server through an anonymous network. Step S3, Federated Aggregation: After receiving the gradient and signature, the server calls the verification algorithm to confirm the legitimacy of the federated client nodes; if the verification passes, the gradient is valid. Subsequently, the server performs a global aggregation operation using the effective gradients; Step S4, Signature Mapping and Federation Node Fingerprint Embedding: The server collects signatures from federated client nodes and maps the signatures to a specific vector space using a hash function to generate node fingerprints; the server records the mapping relationship between gradients, signatures, and fingerprints, and embeds the node fingerprint information into the gradients distributed to each federated client node. Step S5, Model Distribution: The server sends the global gradient embedded with the node fingerprint to the corresponding federated client node; The federated client nodes update their local models based on the global gradients; then, the server and all federated client nodes continue the next round of training until the model converges.
2. The anonymity and traceability protection method for federated learning models according to claim 1, characterized in that, The group signature scheme consists of five probabilistic multinomial-time algorithms, specifically including initialization, registration, signing, verification, and tracking; The initialization algorithm involves the group administrator executing an initialization algorithm to generate a system public key for verification. Private keys of the federated client nodes used for member registration and the group tracking key used to identify the signer To initialize the group signature system; among which, Indicates a federated client node; Registration Algorithm: Group administrators use the private keys of the federated client nodes. Generate a unique identifier based on the node's identity ID. and private signing key And distribute it to the corresponding federated client nodes; Signature algorithm: Group members use their private signing keys Generate a group signature for the message; Verification Algorithm: The verification algorithm receives the message, signature, and public key of the group verification system. The output is either valid or invalid, which is used in the attribution phase to determine whether the signature is valid. Tracking Algorithm: Group administrators use group tracking keys Signatures are used to identify the signer, which is used for model attribution and accountability tracking.
3. The anonymity and traceability protection method for federated learning models according to claim 1, characterized in that, The group administrator runs an initialization algorithm that takes security parameters as input to generate the necessary encryption keys, including the system public key gpk, the group tracing key gtk, and the key for each federated client node. Distributed private key Where I is the total number of federated client nodes; After initialization, the group administrator securely distributes the private key gsk[i] of the federated client node to the federated client node i, enabling it to independently sign its local model updates while maintaining anonymity; the system public key is shared with the server for verification, while the group tracing key is kept by the group administrator and used only during tracing.
4. The anonymity and traceability protection method for federated learning models according to claim 3, characterized in that, After the federated client nodes sign their local model updates using their respective private keys, the server receives these signed updates, which specifically include: For the federated client node i in the t-th training round, the server first uses the system public key. Verify each signature; upon successful verification, the server processes each signature. A secure hash function is applied to generate a unique node fingerprint. As shown below: ； in, For hash functions; The node fingerprint uniquely identifies the contribution of each federated client node in a specific training round, serving as a watermark embedded in the model to ensure traceability without compromising anonymity; the correspondence between node fingerprints and signatures is recorded.
5. The anonymity and traceability protection method for federated learning models according to claim 4, characterized in that, Given the weight matrix in the client model Then the local fingerprint is represented as: ； in, For local fingerprint representation, , Fingerprint length; The weight matrix of the client-side model. , For the dimensions of the model weights; The symbol function is represented by K, which is a key matrix randomly generated by the server before node fingerprint embedding, i.e., the server generates a key matrix for each federated client node. Generate a key matrix To embed node fingerprints.
6. The anonymity and traceability protection method for federated learning models according to claim 5, characterized in that, Select the weight parameters in the batch normalized BN layer for inserting local fingerprints, specifically including: First, in the BN layer, the output of the previous layer is... Normalization is performed as follows: ； in, and Output of the upper layer respectively The mean and variance; It is a small constant; and These are learnable parameters; The output tensor of the BN layer; Then, embed the local fingerprint parameters. In, and in multiple BN layers Concatenate into a vector .
7. The anonymity and traceability protection method for federated learning models according to claim 6, characterized in that, Based on the Hinge-like loss function, the fingerprint fitting loss function of the i-th federated client node is defined. As shown below: ； in, Hinge-like loss function; It is a key matrix randomly generated by the server for federated client node i before the node fingerprint is embedded; It is a node fingerprint; It is the BN layer concatenation vector of the federated client node i; It is a hyperparameter that controls the robustness of client fingerprints; Bit index; Fingerprints extracted from the node model The j-th bit; For node fingerprints The j-th bit, i.e. They represent and The j-th position in; Then, for the i-th federated client node, the fingerprint similarity score (FSS) method is used to calculate the difference between the extracted fingerprint and the original federated client node fingerprint, as shown below: ； in, This is the result of fingerprint similarity score calculation; It is the weight matrix of the client-side model; .
8. The anonymity and traceability protection method for federated learning models according to claim 7, characterized in that, The server returns the gradient containing the node fingerprint to the corresponding node, specifically including: The gradient contains embedded node fingerprints, which allows each federated client node's updates to still be tracked while it continues local training, thus enabling the identification of the specific source node in the event of a model leak.
9. The anonymity and traceability protection method for federated learning models according to claim 1, characterized in that, The leakage tracking process based on cosine similarity is as follows: (1) Given the weight matrix of the suspected model The extracted fingerprint is represented as: ； in, The fingerprint representation extracted from the suspicious model. ; This is a key matrix randomly generated by the server during the node fingerprint embedding stage; This is the weight matrix for the suspected model; It is a symbolic function; (2) From the suspicious model The extracted fingerprints are compared with the client fingerprints generated by each node in each round of training, specifically including: By calculating the similarity between the extracted fingerprint and the fingerprints of each client, the system identifies the most similar client fingerprint; once a matching client fingerprint is found, the system can trace back to the specific round of leakage and the corresponding client identity; (3) After obtaining the matching client fingerprint index, the signature is found through the established client fingerprint-signature correspondence, thereby further tracing the identity of the leaker.
10. The anonymity and traceability protection method for federated learning models according to claim 9, characterized in that, Based on cosine similarity, the index of the best-matching client fingerprint and its corresponding leakage round are output as follows: ； in, Indicates the current training round. Tn represents the total number of training rounds; , Indicates the index of the federated client node. This indicates the total number of federated client nodes; This indicates the output matching result; This represents the node fingerprint of the federated client node i in the t-th training round. ; This represents the index of the federated client node that best matches the cosine similarity among all i; The cosine similarity function is shown below: ； in, This represents the cosine similarity value between input vectors x and y; This represents the L2 norm, i.e., the vector length.