A federated large model privacy protection method based on CRT-BFV homomorphic encryption

Abstract

The present application relates to a kind of federal big model privacy protection methods based on CRT-BFV homomorphic encryption, belong to federal learning, big model privacy protection technical field.The method includes: according to model initialization parameter, training client, obtain client model weight, compress client model weight based on Chinese remainder theorem, obtain client one-dimensional weight;Using homomorphic encryption algorithm, client one-dimensional weight is encrypted, and ciphertext weight is obtained;Server is aggregated to the ciphertext weight uploaded, and aggregation result is obtained;Client decrypts the received aggregation result, obtains plaintext information and reconstructs, and obtains reconstructed plaintext information;After adjusting and updating reconstructed plaintext information, as the input of next round training, iteration training is carried out.The present application is aimed at solving the technical problem that "privacy-efficiency-accuracy" is difficult to balance in the related art in federal big model training.

Description

Technical Field

[0001] This invention relates to a federated large model privacy protection method based on CRT-BFV fully homomorphic encryption, belonging to the fields of federated learning and large model privacy protection technology. Background Technology

[0002] Against the backdrop of rapid development in artificial intelligence technology, large-scale models have demonstrated outstanding performance in key areas such as natural language understanding, multimodal reasoning, and complex decision-making. Performance improvements in large-scale models heavily rely on large-scale, diverse, and high-quality data resources. However, as model size grows exponentially, the marginal supply capacity of public data resources gradually weakens, and globally available public data resources face depletion. To overcome the performance bottlenecks of general-purpose large-scale models in vertical domains, the industry has begun exploring collaborative training using sensitive data from private domains such as healthcare and finance to expand the knowledge boundaries and application scenarios of models. However, this cross-domain collaborative training model faces severe privacy and security challenges.

[0003] Federated learning, as a distributed machine learning framework, provides a feasible solution for collaborative training of private data through the technical concept of "data remaining within its domain and models being aggregated remotely." Its core idea is that, without directly transmitting the original data, each participant only uploads the model parameters or weights trained locally, and a central server aggregates them to generate a global model, thus utilizing private data while avoiding the risk of data leakage. However, federated learning still faces two major problems in practical applications: first, malicious participants may contaminate the global model through poisoning attacks or backdoor attacks, or reverse engineer other participants' original data through inference attacks; second, honest but curious servers may use the received weight information, combined with techniques such as generative adversarial networks (GANs), to reconstruct the original data, leading to the leakage of sensitive information.

[0004] To address the aforementioned privacy threats, existing technologies primarily employ privacy protection techniques such as Secure Multi-Party Computation (SMC), Differential Privacy (DP), Trusted Execution Environment (TEE), and Homomorphic Encryption (HE). Secure Multi-Party Computation (SMC) achieves data privacy by constructing secure interaction protocols, but its complex protocol design leads to significantly increased computational overhead and low communication efficiency, making it difficult to adapt to large-scale distributed training scenarios. Differential Privacy (DP) protects privacy by adding noise to the weights; however, the introduction of noise slows down model convergence and reduces training accuracy, especially in complex large-scale model scenarios where the cumulative effect of noise further exacerbates performance losses. Trusted Execution Environment (TEE) relies on hardware isolation technology to provide a secure computing environment, but it is limited by the security guarantees of hardware manufacturers and suffers from insufficient scalability in large-scale distributed systems, with high memory interaction costs. Homomorphic Encryption (HE)... As an important direction for privacy-preserving federated learning, it supports direct computation in encrypted state, enabling model aggregation without revealing the original data. However, traditional HE schemes (such as CKKS based on approximate homomorphic encryption and BFV based on precise integer encryption) still face significant challenges when handling large model weights: Although CKKS supports floating-point operations, floating-point encoding leads to data bloat and high computational complexity; BFV only supports integer operations, requiring quantization conversion to process floating-point weights, which also exacerbates computational and communication overhead. In addition, the large number of parameters and multiple layers of large models further amplify the computational and communication overhead of homomorphic encryption, making it difficult to meet the efficiency requirements of practical applications.

[0005] In summary, existing privacy protection technologies face the challenge of balancing privacy, efficiency, and accuracy in training federated large-scale models. How to ensure weight privacy while reducing the computational and communication overhead of homomorphic encryption has become a key technical bottleneck hindering the practical implementation of federated large-scale models. Summary of the Invention

[0006] The purpose of this invention is to provide a privacy protection method for federated large models based on CRT-BFV fully homomorphic encryption, aiming to solve the technical problem of difficulty in balancing "privacy-efficiency-accuracy" in the training of federated large models.

[0007] To achieve the above objectives, the technical solution of this invention is: a privacy protection method for federated large models based on CRT-BFV fully homomorphic encryption, the specific steps of which are as follows:

[0008] Step 1: Send the model initialization parameters to the client and server;

[0009] Step 2: Train the client according to the model initialization parameters to obtain the client model weights. Compress the client model weights based on the Chinese Remainder Theorem to obtain the client one-dimensional weights.

[0010] Step 3: Encrypt the client's one-dimensional weight using a fully homomorphic encryption algorithm to obtain the ciphertext weight;

[0011] Step 4: The server aggregates the weights of the uploaded ciphertext to obtain the aggregation result;

[0012] Step 5: The client decrypts the received aggregation result to obtain plaintext information, and reconstructs the plaintext information to obtain reconstructed plaintext information;

[0013] Step 6: After adjusting and updating the reconstructed plaintext information, use it as input for the next round of training and perform iterative training.

[0014] Optionally, step 2 includes:

[0015] Step 2.1: Client P i (i=1,2,...,k) Initialize parameters according to the model. The client model weights are obtained through forward and backward propagation training. ;

[0016] Step 2.2: Apply the Chinese Remainder Theorem to the weights of the client model. Compression includes:

[0017] right Weight within Solve the system of congruence equations:

[0018]

[0019] Calculate the unique solution using the Chinese Remainder Theorem ,in To compress the modulus for the Chinese Remainder Theorem, the original k-dimensional weights are reduced. Compressed into one-dimensional values, we get ;

[0020] Client model weights All weights within the weights are compressed to obtain the compressed client-side one-dimensional weights. .

[0021] Optionally, step 3 includes:

[0022] Step 3.1: The key generation center generates the public key for the fully homomorphic encryption algorithm. private key And distribute the private key to each client;

[0023] Step 3.2: Encrypt the client's one-dimensional weights using the BFV.Enc() algorithm. Obtain the ciphertext weight :

[0024]

[0025] Among them, BFV.Enc() is the encryption algorithm in the fully homomorphic encryption algorithm.

[0026] Optionally, step 4 includes:

[0027] The server receives the ciphertext weights encrypted by all clients. Then, aggregation is performed, and the aggregation expression is:

[0028]

[0029] in, This is the aggregated result of the ciphertext weights. Indicates the encryption modulus.

[0030] Optionally, step 5 includes:

[0031] Step 5.1: The server aggregates the ciphertext weights. It is sent to each client, and the client receives it. Then, the plaintext information is obtained by using the BFV.Dec() decryption operation. :

[0032]

[0033] Among them, BFV.Dec() is the decryption algorithm in the fully homomorphic encryption algorithm. For private key;

[0034] Step 5.2: Process plaintext information To refactor, the expression is:

[0035]

[0036] in, This is the reconstructed plaintext information.

[0037] Optionally, step 6 includes:

[0038] Step 6.1: Freeze the weights of the original high-dimensional client model based on the LoRA algorithm. Only the compressed one-dimensional weights are trained. The reconstructed plaintext information is adjusted by minimizing the local loss function. The expression is:

[0039]

[0040] in, For batch size, Let be the conditional probability distribution function. For the first Private training datasets for each client;

[0041] Step 6.2: Update the reconstructed plaintext information using the AdamW optimizer to obtain:

[0042]

[0043] in, For learning rate, This is the weight decay factor. This refers to the updated and reconstructed plaintext information; These are the corrected momentum vector and the squared momentum vector. It is a constant;

[0044] Step 6.3: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] The model is used as input for the next round of training, and iterative training is performed until the model converges.

[0045] The beneficial effects of this invention are:

[0046] (1) This invention significantly reduces the computational and communication overhead of federated large model training through the synergistic optimization of the Chinese Remainder Theorem (CRT) and BFV fully homomorphic encryption. The CRT weight compression technology compresses high-dimensional weights into smaller data volumes by using the unique solution property of the congruence equation system after dividing them into blocks, reducing the weight size before encryption to about 1 / k of the original (k is the number of modulo), directly reducing the amount of encryption computation and the volume of ciphertext transmission; combined with the efficient aggregation property of BFV fully homomorphic encryption, the computational complexity of homomorphic aggregation on the server side decreases linearly with the reduction of weight data volume, effectively alleviating the resource bottleneck in large-scale distributed training.

[0047] (2) This invention ensures the accuracy of model training through the CRT lossless compression mechanism and precise quantization strategy. The unique solution characteristic of the CRT congruence equation system guarantees that there is no information loss in the weight compression-decompression process. Combined with the upper bound control of quantization error (error ≤ quantization interval Δ), it avoids the problem of model performance degradation caused by noise superposition in traditional differential privacy and other techniques.

[0048] (3) Based on the quantum security of BFV fully homomorphic encryption, this invention effectively defends against the risk of weight privacy leakage. The BFV encryption algorithm relies on the computational difficulty of the Ring-Tolerant Learning (RLWE) problem, so attackers cannot recover the private key or the original weight from the ciphertext. Combined with the characteristic of CRT compression that only reduces the amount of data without exposing the weight content, the aggregation server cannot infer the original data of the participants from the ciphertext even under quantum attack. At the same time, it resists the poisoning attack of malicious participants and the reasoning attack of honest but curious servers, providing strong privacy protection for private data collaborative training. It is suitable for large-scale federated large model training in sensitive fields such as medicine and finance. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the process of this invention. Detailed Implementation

[0050] To make the uses, technical solutions, and advantages of this invention clearer and easier to understand, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0051] The illustrations and specific parameter values ​​provided in the following examples are mainly for illustrating the basic concept of the present invention and for simulation verification of the present invention. In specific application environments, appropriate adjustments can be made according to the actual scenario and requirements.

[0052] Example 1: As Figure 1 As shown, a privacy protection method for a federated large model based on CRT-BFV fully homomorphic encryption includes the following steps:

[0053] Step 1: Send the model initialization parameters to the client and server.

[0054] Step 2: Train the client according to the model initialization parameters to obtain the client model weights. Compress the client model weights based on the Chinese Remainder Theorem to obtain the client one-dimensional weights.

[0055] Step 2.1: Client P i (i=1,2,...,k) Initialize parameters according to the model. The client model weights are obtained through forward and backward propagation training. ;

[0056] Step 2.2: Apply the Chinese Remainder Theorem to the weights of the client model. Compression includes:

[0057] right Weight within Solve the system of congruence equations:

[0058]

[0059] Calculate the unique solution using the Chinese Remainder Theorem ,in To compress the modulus for the Chinese Remainder Theorem, the original k-dimensional weights are reduced. Compressed into one-dimensional values, we get , where y is , It is a finite field middle The inverse element;

[0060] Client model weights All weights within the weights are compressed to obtain the compressed client-side one-dimensional weights. .

[0061] Specifically, in this embodiment, initialization parameters are set. for:

[0062] [[0.05,0.11,0.40,0.21,0.23],[0.20,0.45,0.21,0.27,0.37]];

[0063] [[0.51,0.16,0.32,0.18,0.62],[0.23,0.24,0.31,0.43,0.26]];

[0064] The modulus is: [101, 107, 307];

[0065] Obtain the compressed client one-dimensional weights for:

[0066] [237668,1325656,140950,755527];

[0067] [474357,3108101,1727235,1708148];

[0068] Step 3: Encrypt the client's one-dimensional weight using a fully homomorphic encryption algorithm to obtain the ciphertext weight.

[0069] Step 3.1: The key generation center generates the public key for the fully homomorphic encryption algorithm. private key And distribute the private key to each client;

[0070] Step 3.2: Encrypt the client's one-dimensional weights using the BFV.Enc() algorithm. Obtain the ciphertext weight :

[0071]

[0072] Among them, BFV.Enc() is the encryption algorithm in the fully homomorphic encryption algorithm.

[0073] Specifically, in this embodiment, The encrypted message is sent to the server via a wired or wireless channel and the received message is:

[0074] The encrypted value:

[0075] b'\n\x01\x04\x12\xd8\xb3\x05^\xa1\x10\x04\x01\x02\x00\x00\xd8Y\x01\x00\x00\x00\x00\x00 (\xb5 / \xfd\xa0a\x00\x02\x004\xcb\n\xdc\x98\r\xd2=k\x90\x06\x90\xec9P1\xa3\xad\x0e\xf2\ xcc%\x0e\x0by\x05\xf5\xbf\x0f\x90\xee\xa4\xf6\x7f*\x13\xcc\x00\x02\x00\x10\x00\xf0?\x0 1\x00^\xa1\x10\x04\x18@P\xde\xae\x93\x0b\x00\x00\x00Lv\x17\x08\x05\x00\x00\x00\xb0H\...

[0076] The encrypted value:

[0077] b'\n\xf9\xf9yE\xcb\x16\x87\x1cEu;\x1f\xe7@_j\xc8o )\xd5\xd4\'\x00+"\x1bY<\xc5s\x0b\xef\x81\xc94\xeb\xbe\x8a\xb0\xadjO7\xfe\xc 2\xbb\xd6a\xe7m;\xc8\xd2\x04A\xc6:z\xc1\x03C\xdb\xa3\x97\xd6Y\xc9\x98\xcfJ\x dd\x16x\x1a\x8fy\x02\x0c\xedA\xe1\x0c\x92\xe3q-o\x10I\x81\x10)\x12\xb1\xd3~\ x16NK\x1d\xff\x9b / \xc0~\x18\xea\xeb\x08\n\xa4\xcf\xfcx\x10k\x13`\x92\x00\...

[0078] Step 4: The server aggregates the weights of the uploaded ciphertext to obtain the aggregated result.

[0079] Optionally, the server receives the ciphertext weights encrypted by all clients. Then, aggregation is performed, and the aggregation expression is:

[0080]

[0081] in, This is the aggregated result of the ciphertext weights. Indicates the encryption modulus.

[0082] Specifically, in this embodiment,

[0083] Step 5: The client decrypts the received aggregation result to obtain plaintext information, and reconstructs the plaintext information to obtain reconstructed plaintext information.

[0084] Step 5.1: The server aggregates the ciphertext weights. It is sent to each client, and the client receives it. Then, the plaintext information is obtained by using the BFV.Dec() decryption operation. :

[0085]

[0086] Among them, BFV.Dec() is the decryption algorithm in the fully homomorphic encryption algorithm. For private key;

[0087] Step 5.2: Process plaintext information To refactor, the expression is:

[0088]

[0089] in, This is the reconstructed plaintext information.

[0090] Specifically, in this embodiment, the reconstructed plaintext information for:

[0091] [[0.56,0.27,0.72,0.39,0.85],[0.43,0.69,0.52,0.7,0.63]];

[0092] Step 6: After adjusting and updating the reconstructed plaintext information, use it as input for the next round of training and perform iterative training.

[0093] Step 6.1: Freeze the weights of the original high-dimensional client model based on the LoRA algorithm. Only the compressed one-dimensional weights are trained. The reconstructed plaintext information is adjusted by minimizing the local loss function. The expression is:

[0094]

[0095] in, For batch size, Let be the conditional probability distribution function. For the first Private training datasets for each client;

[0096] Step 6.2: Update the reconstructed plaintext information using the AdamW optimizer to obtain:

[0097]

[0098] in, For learning rate, This is the weight decay factor. This refers to the updated and reconstructed plaintext information; These are the corrected momentum vector and the squared momentum vector. As a constant, in some specific implementations, Take a very small amount ;

[0099] Step 6.3: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] The model is used as input for the next round of training, and iterative training is performed until the model converges.

[0100] Specifically, in this embodiment, The values ​​[[0.35,0.15,0.45,0.12,0.76],[0.22,0.45,0.78,0.4,0.32] are used as inputs for the next round of training.

[0101] The specific embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A privacy protection method for a federated large model based on CRT-BFV fully homomorphic encryption, characterized in that, The method includes the following steps: Step 1: Send the model initialization parameters to the client and server; Step 2: Train the client model according to the model initialization parameters to obtain the client model weights. Compress the client model weights based on the Chinese Remainder Theorem to obtain the client one-dimensional weights, including: Step 2.1: Client P i (i=1,2,...,k) Initialize parameters according to the model. The client model weights are obtained through forward and backward propagation training. ; Step 2.2: Apply the Chinese Remainder Theorem to the weights of the client model. Compression includes: right Weight within Solve the system of congruence equations: ； Calculate the unique solution using the Chinese Remainder Theorem ,in To compress the modulus for the Chinese Remainder Theorem, the original k-dimensional weights are reduced. Compressed into one-dimensional values, we get ; Client model weights All weights within the weights are compressed to obtain the compressed client-side one-dimensional weights. ; Step 3: Encrypt the client's one-dimensional weight using a fully homomorphic encryption algorithm to obtain the ciphertext weight, including: Step 3.1: The key generation center generates the public key for the fully homomorphic encryption algorithm. Private key And distribute the private key to each client; Step 3.2: Encrypt the client's one-dimensional weights using the BFV.Enc() algorithm. Obtain the ciphertext weight : ； Among them, BFV.Enc() is the encryption algorithm in the fully homomorphic encryption algorithm; Step 4: The server aggregates the weights of the uploaded ciphertext to obtain the aggregation result; Step 5: The client decrypts the received aggregation result to obtain plaintext information, and reconstructs the plaintext information to obtain reconstructed plaintext information, including: Step 5.1: The server aggregates the ciphertext weights. It is sent to each client, and the client receives it. Then, the plaintext information is obtained by using the BFV.Dec() decryption operation. : ； Among them, BFV.Dec() is the decryption algorithm in the fully homomorphic encryption algorithm. For private key; Step 5.2: Process plaintext information To refactor, the expression is: ； in, This is the reconstructed plaintext information; Step 6: After adjusting and updating the reconstructed plaintext information, use it as input for the next round of training and perform iterative training, including: Step 6.1: Freeze the weights of the original high-dimensional client model based on the LoRA algorithm. Only the compressed client-side one-dimensional weights are trained. The reconstructed plaintext information is adjusted by minimizing the local loss function. The expression is: ； in, For batch size, Let be the conditional probability distribution function. For the first Private training datasets for each client; Step 6.2: Update the reconstructed plaintext information using the AdamW optimizer to obtain: ； in, For learning rate, This is the weight decay factor. This refers to the updated and reconstructed plaintext information; These are the corrected momentum vector and the squared momentum vector. It is a constant; Step 6.3: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] The model is used as input for the next round of training, and iterative training is performed until the model converges.

2. The privacy protection method for federated large models based on CRT-BFV fully homomorphic encryption according to claim 1, characterized in that, Step 4 includes: The server receives the ciphertext weights encrypted by all clients. Then, aggregation is performed, and the aggregation expression is: ； in, This is the aggregated result of the ciphertext weights. This represents the encryption modulus.

Images