A privacy data security sharing method based on federated learning

Abstract

The application discloses a privacy data security sharing method based on federated learning, and particularly relates to the field of privacy data security protection and sharing, and is used for solving the problems of insufficient model credibility and lack of precision control in data exchange in the existing cross-institutional data collaboration process; the method performs homomorphic encryption processing on local data of each participant, constructs a ciphertext verifiable calculation task in combination with federated learning, outsources ciphertext forward propagation and back propagation calculation to a computing node for execution, and performs trusted verification on the calculation process by using zero-knowledge proof, and completes gradient aggregation and model updating in the ciphertext domain; after the model training is completed, the sharing value of the local data sample is intelligently judged based on the federated learning model output, ciphertext re-encryption and data exchange control are driven, and safe and controllable data circulation of multiple parties is realized, so that the cross-institutional data collaboration efficiency and decision precision are improved under the premise of guaranteeing privacy security and compliance requirements.

Description

Technical Field

[0001] This invention relates to the field of privacy data security protection and sharing technology, and more specifically, to a privacy data security sharing method based on federated learning. Background Technology

[0002] With the deepening application of artificial intelligence and big data technologies in fields such as healthcare, financial risk control, government collaboration, and industrial internet, cross-institutional data collaborative analysis and joint modeling have gradually become important means to improve prediction accuracy and decision-making level. However, in real business scenarios, the data held by different participants are generally highly sensitive, involving personal privacy, trade secrets, or core business information. Directly sharing raw data faces compliance risks and security risks, resulting in data remaining in silos for a long time, which seriously restricts the realization of cross-institutional intelligent collaboration capabilities.

[0003] Taking collaborative medical treatment as an example, patient treatment data accumulated by different hospitals has significant complementary value in disease risk assessment and postoperative complication prediction. However, due to privacy protection regulations, original medical records are difficult to exchange directly. How to accurately determine which patient samples have cross-hospital sharing value and which should be strictly restricted from circulation, while ensuring privacy and security, has become a key issue restricting the implementation of collaborative medical treatment. In the fields of government governance and industrial collaboration, there is also a large amount of complementary data between different departments or enterprises. However, there is a lack of technical mechanisms that can accurately determine the feasibility, scope, and objects of data sharing based on intelligent model output. As a result, the existing data exchange model relies heavily on manual rules or static strategy configuration, which is difficult to adapt to complex and ever-changing business needs.

[0004] Therefore, it is necessary to construct a privacy-preserving data sharing method based on the output of a federated learning model. This method should be developed by multi-party joint training of a high-precision model to achieve intelligent evaluation and accurate determination of the shared value of local data samples from each participant. This will promote the efficient circulation and collaborative application of cross-institutional data resources while ensuring data security and privacy compliance. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a privacy-preserving data sharing method based on federated learning to address the problems raised in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A privacy-preserving data sharing method based on federated learning includes the following steps:

[0008] S1. Encrypt the local privacy data of each participant using an additive homomorphic encryption algorithm to generate homomorphic ciphertext data, and extract the feature dimensions and sample number of the privacy data to generate a data descriptor.

[0009] S2. Based on data descriptors and predefined federated learning model structures, construct a verifiable computational task description file containing layer operation sequences and activation function types;

[0010] S3. Distribute the homomorphic ciphertext data and the verifiable computation task description file as computation task sub-packages to mutually isolated external computation nodes. Each computation node performs forward and backward propagation computations in the ciphertext domain according to the description file to generate encrypted gradient update fragments.

[0011] S4. After each external computing node completes its computation, it generates a zero-knowledge proof for the current ciphertext computation process.

[0012] S5. Verify all encrypted gradient update segments and their corresponding zero-knowledge proofs in parallel. Perform homomorphic aggregation operations on the verified gradient update segments to generate global encrypted gradients.

[0013] S6. Each participant uses its private key to decrypt the global encrypted gradient and updates the federated learning model copy based on the decrypted plaintext gradient.

[0014] S7. Based on the output of the federated learning model replica, re-encrypt the local homomorphic ciphertext data of each participant, generate a re-encrypted data packet for secure multi-party data exchange, and upload it to the shared data pool.

[0015] As a further aspect of the present invention, in step S1, extracting the feature dimensions and sample quantity of privacy data to generate a data descriptor specifically includes:

[0016] Field-level parsing is performed on the local privacy data of each participant, and the data is divided into a set of feature fields and a sequence of sample indexes according to a preset data structure template to form a plaintext feature matrix with a consistent structure.

[0017] The plaintext feature matrix is ​​processed element-wise by an additive homomorphic encryption operator to perform ciphertext mapping, generating homomorphic ciphertext data blocks that maintain the original addition operation relationship. Sample aggregation is then performed on the homomorphic ciphertext data blocks, and the feature dimensions and sample quantity distribution data containing batch identifiers corresponding to the aggregated samples are statistically analyzed. The statistical results are then encoded into standardized data descriptors.

[0018] As a further aspect of the present invention, in step S2, constructing a verifiable computational task description file containing layer operation sequences and activation function types based on data descriptors and predefined federated learning model structures specifically includes:

[0019] The number of input layer nodes and parallel computing paths of the federated learning model are predefined, and the hierarchical connection relationship between the input layer, hidden layer and output layer in the federated learning model structure is marked. The feature dimension and sample number distribution data obtained by parsing the data descriptor are mapped to the federated learning model structure.

[0020] Based on the hierarchical connection relationship, a forward propagation linear transformation operation sequence and a nonlinear activation operation sequence are generated layer by layer, and a backward propagation gradient backpropagation path is constructed simultaneously to form a continuous and executable encrypted computation process.

[0021] The operation nodes and connections of each layer in the encrypted computation process are converted into a standardized arithmetic circuit structure, and the activation function operation is mapped to an equivalent polynomial computation sub-circuit, forming a verifiable computation circuit topology that covers the entire forward and backward propagation process.

[0022] Perform joint encapsulation of the arithmetic circuit topology and sample distribution data to generate a verifiable computation task description file.

[0023] As a further aspect of the present invention, in step S3, generating the encrypted gradient update fragment specifically includes:

[0024] The homomorphic ciphertext data corresponding to different batch identifiers and the verifiable computation task description file are encapsulated into independent computation task sub-packages and sent to different external computing nodes respectively.

[0025] The external computing node parses the arithmetic circuit topology in the computing task sub-package, and sequentially performs the forward propagation and backward propagation operations corresponding to the federated learning model in the homomorphic ciphertext domain to form the ciphertext intermediate results recursively layer by layer.

[0026] Based on the ciphertext intermediate results, the ciphertext derivation of parameter gradients is performed along the backpropagation path, generating encrypted gradient update fragments that correspond layer by layer to the federated learning model structure.

[0027] As a further aspect of the present invention, in step S4, after each external computing node completes its computation, generating a zero-knowledge proof for the current ciphertext computation process specifically includes:

[0028] After completing the forward and backward propagation calculations of the homomorphic ciphertext, each external computing node, based on the arithmetic circuit topology in the verifiable computing task description file, maps the intermediate ciphertext results of the layer-by-layer recursion with the encryption gradient update fragments to construct the corresponding arithmetic circuit instance calculation trajectory, and generates a proof generation input that satisfies the zero-knowledge constraint. The zero-knowledge proof in this ciphertext calculation process is consistent with the execution path of the arithmetic circuit.

[0029] As a further aspect of the present invention, in step S5, parallel verification of all encrypted gradient update segments and their corresponding zero-knowledge proofs, and performing homomorphic aggregation operations on the verified gradient update segments to generate a global encrypted gradient, specifically includes:

[0030] Receive encrypted gradient update fragments and corresponding zero-knowledge proofs from external computing nodes. For each zero-knowledge proof, call the matching verification algorithm and verification key to verify its validity concurrently.

[0031] Select all encrypted gradient update fragments with valid zero-knowledge proofs to form a valid fragment set, and rearrange them according to the hierarchical structure and model parameters of the federated learning model;

[0032] Based on the additive homomorphic encryption operator, a layer-by-layer additive aggregation operation is performed on all encryption gradient values ​​belonging to the same model parameter in the effective fragment set to obtain the global encryption gradient components of all model parameters, which are then summarized into a complete global encryption gradient.

[0033] As a further aspect of the present invention, in step S6, each participant uses its private key to decrypt the global encrypted gradient and updates the federated learning model replica based on the decrypted plaintext gradient, specifically including:

[0034] Each participant performs a homomorphic decryption operation on the global cryptographic gradient based on its locally stored private key to obtain a global gradient vector in plaintext form;

[0035] Based on the predefined federated learning model structure and hierarchical connection relationship, the plaintext global gradient vector mapping is constructed as the model parameter adjustment amount and updated to the local federated learning model copy of the participants.

[0036] As a further aspect of the present invention, in step S7, based on the output of the federated learning model replica, the local homomorphic ciphertext data of each participant is re-encrypted to generate a re-encrypted data packet for secure multi-party data exchange, and then uploaded to the shared data pool. Specifically, this includes:

[0037] Based on the local federated learning model copies of each participant, ciphertext inference operations are performed on the local homomorphic ciphertext data, outputting the prediction result label corresponding to each sample, and constructing a sample-level data sharing decision sequence based on the prediction result label;

[0038] Establish the same sharing policy rules for all participants, generate a corresponding key conversion parameter set by combining the data sharing judgment sequence, bind and encapsulate the key conversion parameters with the sample index identifier to form a structured re-encryption control instruction;

[0039] Based on the re-encryption control instructions, the re-encryption operator is invoked to perform key mapping transformation on the local homomorphic ciphertext data of each participant, generating a re-encrypted ciphertext data block that can only be decrypted by the target participant. The re-encrypted ciphertext data block is then encapsulated into a re-encrypted data packet and written to the shared data pool.

[0040] The technical effects and advantages of the privacy-preserving data sharing method based on federated learning proposed in this invention are as follows:

[0041] This invention combines additive homomorphic encryption, federated learning, and verifiable computation mechanisms to construct a privacy-preserving data sharing method for multi-party collaborative scenarios, enabling joint modeling and trusted computation across participating parties without exposing the original data content.

[0042] Compared to existing technologies, this invention introduces encrypted forward and backward propagation computations during federated learning training and uses zero-knowledge proofs to verify and constrain the computation process of external computing nodes, avoiding the risks of computational tampering and result forgery that may exist in outsourced computations, thereby improving the credibility and auditability of the entire model training process. Through a homomorphic aggregation mechanism, multi-party gradient summarization is completed within the encrypted domain, reducing the privacy leakage risks caused by the exposure of plaintext parameters and ensuring end-to-end security during model updates. After model training is completed, the shared value of local data samples from each participant is intelligently determined using the output of the federated learning model, driving the generation of encrypted re-encryption and data exchange strategies. This enables fine-grained control over the data sharing objects and scope, improving the efficiency of cross-institutional data collaboration and the accuracy of business decisions while meeting privacy protection and compliance requirements. It is suitable for high-security scenarios such as healthcare, finance, government affairs, and the industrial internet. Attached Figure Description

[0043] Figure 1 This is a schematic diagram of a privacy-preserving data sharing method based on federated learning according to the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0045] Example 1

[0046] Figure 1 This invention presents a privacy-preserving data sharing method based on federated learning, which includes the following steps:

[0047] S1. Encrypt the local privacy data of each participant using an additive homomorphic encryption algorithm to generate homomorphic ciphertext data, and extract the feature dimensions and sample number of the privacy data to generate a data descriptor.

[0048] S2. Based on data descriptors and predefined federated learning model structures, construct a verifiable computational task description file containing layer operation sequences and activation function types;

[0049] S3. Distribute the homomorphic ciphertext data and the verifiable computation task description file as computation task sub-packages to mutually isolated external computation nodes. Each computation node performs forward and backward propagation computations in the ciphertext domain according to the description file to generate encrypted gradient update fragments.

[0050] S4. After each external computing node completes its computation, it generates a zero-knowledge proof for the current ciphertext computation process.

[0051] S5. Verify all encrypted gradient update segments and their corresponding zero-knowledge proofs in parallel. Perform homomorphic aggregation operations on the verified gradient update segments to generate global encrypted gradients.

[0052] S6. Each participant uses its private key to decrypt the global encrypted gradient and updates the federated learning model copy based on the decrypted plaintext gradient.

[0053] S7. Based on the output of the federated learning model replica, re-encrypt the local homomorphic ciphertext data of each participant, generate a re-encrypted data packet for secure multi-party data exchange, and upload it to the shared data pool.

[0054] In step S1, the feature dimensions and sample number of the privacy data are extracted to generate a data descriptor.

[0055] Each participant performs unified data structure parsing on its locally stored privacy data sets. The privacy data sources may include structured data tables formed by business databases, log collection systems, or professional collection terminals. During parsing, each original data record is decomposed at the field level according to a predefined data structure template. Numerical, categorical, and time-series fields directly related to model training are extracted as feature field sets. Simultaneously, a unique corresponding sample index sequence is generated for each data record. The data structure template consists of field names, field types, field order, and missing value handling rules. When performing field-level parsing, participants map their local original data line by line according to the unified template, ensuring consistency in the number, order, and data type of the data structures formed by different participants. For fields with missing or outlier values, data completion and anomaly correction rules are predefined in the template to ensure comparability of the numerical distribution and representation of each feature field. After completing the field-level parsing, the feature field set corresponding to each sample is concatenated in a fixed order to construct a two-dimensional plaintext feature matrix. Each row corresponds to a sample index sequence, and each column corresponds to a feature field dimension. The overall matrix reflects the sample size in terms of the number of rows and the feature dimension size in terms of the number of columns.

[0056] After constructing the plaintext feature matrix, each participant performs element-wise ciphertext mapping operations on each element of the matrix based on a uniformly configured additive homomorphic encryption algorithm. Specifically, the homomorphic encryption public key parameters stored securely on the participant's local machine are first loaded. Each numerical element in the plaintext feature matrix is ​​then input into the additive homomorphic encryption operator to generate the corresponding ciphertext representation, maintaining the original data's structural relationship at the addition operation level. By performing element-wise encryption on the entire matrix, a homomorphic ciphertext data block with a structure completely identical to the plaintext matrix is ​​formed. This ciphertext data block strictly corresponds to the original sample index sequence and feature field arrangement order in the row and column dimensions, ensuring the correct mapping of arithmetic operation paths in subsequent ciphertext computation tasks. After the homomorphic ciphertext data block is constructed, sample aggregation processing is performed on the ciphertext samples according to pre-defined batch division rules. The ciphertext sample sets under the same batch identifier are managed uniformly, and statistical analysis is performed on the aggregated sample sets to extract the corresponding feature dimension scale and sample quantity distribution information. The sample size distribution is indexed by batch identifiers, recording the number of samples contained in each batch, thus forming a distribution description reflecting the sample size structure. Furthermore, the statistically obtained feature dimension size, sample size distribution, and batch identifier information are encapsulated into standardized data descriptors according to preset encoding rules. These data descriptors are expressed using a structured field format, including feature dimension fields, sample size fields, and batch index fields.

[0057] In step S2, a verifiable computation task description file containing layer operation sequences and activation function types is constructed based on data descriptors and predefined federated learning model structures.

[0058] Based on the pre-selected federated learning model type, the overall model structure is standardized and configured. In this embodiment, a multi-layer feedforward neural network is used as the basic structure of the federated learning model. It includes an input layer, several hidden layers, and an output layer. The number of nodes in the input layer is dynamically set according to the feature dimension recorded in the parsed data descriptor. For example, when the feature dimension is 128, the number of input layer nodes is set to 128. Parallel computing paths are divided according to the sample distribution data, allowing different batches of samples to perform encrypted computation tasks in parallel across multiple external computing nodes. The hidden layer structure is configured hierarchically according to the business complexity, for example, constructing a two- or three-layer hidden layer structure. Each hidden layer has a fixed number of neurons, and a mapping relationship with the preceding and following layers is established through fully connected connections. The number of nodes in the output layer is determined according to the federated learning task objective; for example, it is set to the number of categories in a classification scenario and a single-node output in a regression scenario. After configuring the number of nodes at each level, the hierarchical connections between the input layer, hidden layers, and output layer are uniformly labeled, clarifying the weight connection method, data flow, and computational dependencies between nodes in each layer, forming a standardized model topology description. Subsequently, the parsed data descriptors are introduced into the model structure mapping process. Based on the feature dimension scale, the column dimensions of the plaintext feature matrix are mapped one by one to the input layer nodes to ensure that each feature field has a unique mapping channel in the model. At the same time, the batch scheduling method is determined based on the sample quantity distribution data, and the sample index sequence is bound to the parallel computing path so that each batch of samples can execute a consistent model operation process in different computing nodes.

[0059] Based on the labeled hierarchical connections, the computational process of each layer of the model is expanded layer by layer to generate standardized forward and backward propagation computational flows. For the connection between the input layer and the first hidden layer, corresponding linear transformation operation units are constructed according to the node mapping order. The input feature vector and weight parameters are weighted and summed to generate intermediate computation results. A preset nonlinear activation function is introduced to perform activation mapping on the intermediate computation results, forming the output representation of the first hidden layer. Similarly, the connection between the first hidden layer and the second hidden layer, and between subsequent hidden layers and the output layer, is expanded layer by layer to construct a complete forward propagation operation sequence, enabling the input features to undergo feature extraction and semantic mapping sequentially within the multi-layer neural network structure. Simultaneously, after the forward propagation operation sequence is constructed, a gradient backpropagation path is generated synchronously according to the model structure. Error signal propagation links are established layer by layer along the direction from the output layer to the input layer, allowing the output error to be propagated back to each hidden layer and input layer node according to the weight connection relationship, thus forming a complete parameter gradient derivation path. The aforementioned forward and backward propagation operation sequences strictly adhere to homomorphic encryption operation constraints during construction, uniformly encapsulating all addition and multiplication operations to enable the entire computation process to be executed continuously within the homomorphic ciphertext domain, forming a well-structured, complete, and directly schedulable ciphertext computation process.

[0060] After constructing the encrypted computation process, a unified arithmetic circuit transformation is performed on the computation nodes and their connections involved. Specifically, each linear transformation unit in the forward and backward propagation is mapped to an arithmetic circuit node composed of addition and multiplication gates. These nodes are then connected according to the data flow order based on the model hierarchy, forming an arithmetic computation network with a strict topological structure. For nonlinear activation operations involved in the encrypted computation process, corresponding computational sub-circuits are constructed using equivalent polynomial approximation. This transforms the original activation function operations into a polynomial operation structure composed of multi-level addition and multiplication gates, allowing activation operations to be executed within the arithmetic circuit framework. Through this method, the entire forward and backward propagation process is uniformly represented as a standardized arithmetic circuit topology, enabling the entire encrypted training process to be abstracted as a deterministic arithmetic computation path. Subsequently, the arithmetic circuit topology and sample distribution data are jointly encapsulated, and the batch sample indices, feature dimension scales, parallel computation path identifiers, and arithmetic circuit node connections are structurally bound to generate a complete and verifiable computation task description file. The task description file is expressed in the form of structured fields, including an arithmetic circuit node table, a connection relationship table, a sample batch index table, and a scheduling control field.

[0061] In step S3, an encrypted gradient update fragment is generated.

[0062] Based on the generated sample batch identifiers, homomorphic encrypted data blocks are grouped and managed according to batches, with each group corresponding to a complete subset of samples. Subsequently, each group of homomorphic encrypted data is jointly encapsulated with the generated verifiable computation task description file to form an independent computation task sub-package. The computation task sub-package contains three core types of information: first, the homomorphic encrypted sample data block and its sample index sequence, used to identify the sample set participating in the computation; second, the verifiable computation task description file, used to describe the federated learning model structure, arithmetic circuit topology, and computation path; and third, a batch scheduling identifier, used to indicate the execution priority and node allocation rules of the task sub-package in the parallel computing scheduling system. During the encapsulation process, the above three types of information are arranged in a structured manner according to a preset data encapsulation format, and the encapsulation result is verified for integrity to ensure that the data structure and task description remain consistent during transmission and parsing. After encapsulation, the generated multiple computation task sub-packages are distributed to external computing nodes that are independent and logically isolated from each other. During the distribution process, a mapping relationship between tasks and computing nodes is established based on the batch scheduling identifier, so that different computing nodes can receive and execute independent encrypted computation tasks in parallel, thereby forming an overall computing architecture for multi-node concurrent processing.

[0063] After receiving the computation task sub-package, the external computing node parses the verifiable computation task description file contained within, extracts the arithmetic circuit topology, the order of operation nodes, and the connection relationships between nodes, and loads the circuit topology into the local ciphertext computation execution environment. After parsing, the computing node performs forward propagation computation layer by layer on the homomorphic ciphertext sample data according to the operation order described by the arithmetic circuit topology. Specifically, the computing node sequentially schedules the addition and multiplication gates in the circuit, performs linear combination operations on the ciphertext feature values ​​corresponding to the input layer nodes, and propagates layer by layer to each hidden layer node according to the circuit topology order. At each layer, it completes the corresponding activation operation mapping, ultimately forming the ciphertext prediction result of the output layer. Simultaneously, the computing node performs layer-by-layer backpropagation computation on the error signal generated by the output layer according to the preset backpropagation path in the arithmetic circuit, sequentially generating intermediate error signals in ciphertext form at each hidden layer node, and completing layer-by-layer recursion along the weight connection path, thereby constructing a complete backpropagation ciphertext computation process. Through the continuous execution of forward and backward propagation operations, a layer-by-layer recursive ciphertext intermediate result covering each layer of the model structure is formed in the homomorphic ciphertext domain. The ciphertext intermediate result corresponds structurally to the federated learning model hierarchy, and fully characterizes the feature mapping state and error signal distribution state of the sample in each layer of the model.

[0064] After obtaining the intermediate encrypted results obtained through layer-by-layer recursion, the external computing nodes perform encrypted derivation operations on the gradient values ​​corresponding to the model parameters of each layer according to the parameter associations defined in the backpropagation path. Specifically, at the output layer, the computing nodes first perform element-wise multiplication operations on the encrypted error signal and the encrypted activation values ​​output by the previous layer node, generating encrypted gradient components corresponding to the output layer weight parameters. Then, the error signal is propagated back layer by layer according to the preset connection relationships in the model structure. At each hidden layer node, the same gradient derivation operation is performed in conjunction with the encrypted intermediate results output by that layer node, sequentially generating encrypted gradient components corresponding to the weight and bias parameters of each hidden layer. Throughout the derivation process, all operations are completed within the homomorphic encrypted domain; the computing nodes only process encrypted data and do not access any plaintext parameters or sample content. After completing the gradient derivation for each layer, the computing nodes structurally encapsulate the generated encrypted gradient components according to the federated learning model's hierarchical structure and parameter index identifiers, combining gradient components belonging to the same level or the same parameter index position to form encrypted gradient update fragments. The encrypted gradient update fragments are structurally strictly aligned with the order and connection relationships of parameters in each layer of the federated learning model, with each encrypted gradient update fragment corresponding to a model parameter.

[0065] In S4, after each external computing node completes its calculation, it generates a zero-knowledge proof for the current ciphertext calculation process.

[0066] After the external computing nodes complete the forward and backward propagation calculations of the homomorphic ciphertext, the intermediate results of the layer-by-layer recursive ciphertext and the encryption gradient update fragments generated during this round of ciphertext calculation are uniformly mapped according to the arithmetic circuit topology recorded in the verifiable computation task description file. Specifically, the computing nodes align the ciphertext data generated at each stage of forward and backward propagation with the corresponding arithmetic operation nodes according to the order and connection relationships of the operation nodes defined in the arithmetic circuit topology, constructing an arithmetic circuit instance computation trajectory covering all computation steps. This computation trajectory uses node indices as the main line, recording the input ciphertext identifier, output ciphertext identifier, and execution order identifier for each addition and multiplication gate in this ciphertext calculation, thus forming a traceable circuit execution path for the entire computation process.

[0067] After constructing the computation trajectory of the arithmetic circuit instance, the computing node extracts proof generation inputs that meet the zero-knowledge constraints based on this trajectory. These inputs include a description of the circuit topology, a mapping of node connections, ciphertext identifiers for inputs and outputs, and intermediate computation consistency constraints. Subsequently, the computing node invokes a zero-knowledge proof generation algorithm to perform proof construction operations on the aforementioned proof generation inputs, generating a zero-knowledge proof corresponding to this ciphertext computation process. This zero-knowledge proof, without revealing any plaintext data, model parameters, or intermediate computation results, fully characterizes the fact that the ciphertext forward and backward propagation operations strictly follow the arithmetic circuit topology. This allows subsequent verifiers to independently verify the correctness of this ciphertext computation process solely based on the zero-knowledge proof and publicly available verification parameters, thereby constructing a trustworthy and auditable outsourced computation execution mechanism.

[0068] In step S5, all encrypted gradient update segments and their corresponding zero-knowledge proofs are verified in parallel. Homomorphic aggregation operations are performed on the verified gradient update segments to generate a global encrypted gradient.

[0069] The federated coordination server receives encrypted gradient update fragments and their corresponding zero-knowledge proof files uploaded from multiple external computing nodes via a secure communication link. It then uniformly registers and categorizes all received data based on task identifiers and batch indexes. For each zero-knowledge proof, a zero-knowledge verification algorithm matching the proof system used in the verifiable computation task description file is invoked. This algorithm is configured to verify whether the computation process strictly follows the established arithmetic circuit topology. During verification, the verification key corresponding to the current computation task is loaded, and the circuit execution commitments and computation node mapping information contained in the zero-knowledge proof are compared item by item with the publicly available arithmetic circuit topology to verify the consistency of the connection relationships between each layer of computation nodes. Subsequently, according to the pre-set constraint checking rules in the verification algorithm, the consistency of the computation path described in the proof is checked to confirm that no node omissions, order shifts, or computation substitutions have occurred during the ciphertext forward and backward propagation operations. Finally, the integrity of the ciphertext input-output commitment relationship given in the proof is verified to confirm that all intermediate ciphertext results are strictly derived from the circuit execution path. The entire verification process employs a parallel scheduling approach to execute multiple zero-knowledge proofs simultaneously, thereby improving overall processing efficiency while ensuring verification accuracy. After verification, a corresponding validity tag is generated for each cryptographic gradient update segment, and verified segments are stored separately from those that failed verification.

[0070] After zero-knowledge proof verification, segments with validity tags are selected from all encrypted gradient update segments to form a unified set of valid segments. Then, based on the hierarchical structure description file of the federated learning model, the gradient components corresponding to each valid segment set are structurally aligned and rearranged according to their model level and parameter index position. Specifically, the encrypted gradient update segments uploaded by each external computing node are decomposed into ciphertext gradient components corresponding to the weight and bias parameters of each layer of the model. According to the predefined parameter arrangement order in the model topology, all gradient components are indexed and rearranged, so that encrypted gradient values ​​belonging to the same model parameter position form continuously arranged aggregation units in the data structure. After aligning the gradient components, the additive homomorphic encryption operator is called to perform a term-by-term addition operation on the encrypted gradient values ​​in each aggregation unit, generating the global encrypted gradient component corresponding to the model parameter. This homomorphic addition operation is performed directly in the ciphertext domain without any plaintext decryption operation, ensuring the gradient information is encrypted throughout the aggregation stage. After completing the aggregation of encrypted gradients corresponding to all model parameters, the generated global encrypted gradient components of each layer are recombined according to the federated learning model structure to construct a complete global encrypted gradient data structure, and the training identifier and model version mark are attached.

[0071] In step S6, each participant uses its private key to decrypt the global encrypted gradient and updates the federated learning model copy based on the decrypted plaintext gradient.

[0072] Upon receiving the global encrypted gradient, each participant loads the corresponding homomorphic decryption private key parameters from its local secure storage unit and performs a consistency check on the current training task identifier and model version marker to confirm that the decryption object matches the current model update round. Subsequently, the global encrypted gradient data structure is decomposed into multiple global ciphertext gradient components according to the corresponding model parameter index order, and these components are sequentially input into the homomorphic decryption operator for item-by-item decryption. During decryption, key mapping transformation and modulus domain restoration operations are performed on each global ciphertext gradient component to restore it to its corresponding plaintext gradient expression. The decrypted plaintext gradient components are then recombined according to a predefined parameter arrangement order to construct a complete plaintext global gradient vector. To ensure the structural integrity of the decryption result, after decrypting all global gradient components, each participant performs a consistency check on the plaintext global gradient vector. By verifying the continuity of parameter indices and the matching relationship of gradient dimensions, it is confirmed that the decrypted plaintext gradient vector structurally corresponds strictly to the federated learning model parameter configuration.

[0073] After obtaining the plaintext global gradient vector, each participant performs model parameter-level mapping processing on the gradient vector according to the predefined federated learning model structure description file. Specifically, firstly, based on the model's hierarchical connection relationships, the plaintext gradient vector is split according to the parameter arrangement order of the input layer, hidden layers, and output layer, generating gradient adjustment components for the weight and bias parameters of each layer. Subsequently, each gradient adjustment component is mapped item by item to construct the model parameter adjustment amount, and a synchronous iterative update operation is performed on the weight matrix and bias vector stored in the current model replica. During the parameter update process, updates are strictly performed layer by layer according to the hierarchical connection relationships, ensuring that the model parameters of each layer structurally match their corresponding gradient adjustment components, avoiding parameter misalignment or hierarchical confusion.

[0074] In step S7, based on the output of the federated learning model replica, the local homomorphic ciphertext data of each participant is re-encrypted to generate a re-encrypted data packet for secure multi-party data exchange, and then uploaded to the shared data pool.

[0075] After updating the federated learning model copy, each participant inputs its local homomorphic ciphertext data into the locally deployed ciphertext inference arithmetic circuit according to the sample index order to perform forward propagation inference operations. The structure of the ciphertext inference arithmetic circuit is consistent with the topology of the federated learning model arithmetic circuit used in the training phase, including the hierarchical connection relationship between input layer nodes, several hidden layer nodes, and output layer nodes, so that the homomorphic ciphertext data is passed layer by layer between each layer of operation nodes to complete feature mapping and semantic expression transformation. During inference, all linear transformation operations and nonlinear activation operations are completed in the ciphertext domain, forming a ciphertext prediction result corresponding to each sample. Subsequently, each participant performs decryption operations on the ciphertext prediction result based on the locally stored inference decryption key to obtain a prediction result label in plaintext form. The prediction result label can be a classification label, risk level identifier, or business score label, used to characterize the value attribute or risk attribute of the sample in the current business scenario. Based on a predefined sample sharing determination method, the prediction results are mapped to sample-level data sharing determination results, and a sample-level data sharing determination sequence is generated according to the sample index order, so that each local sample corresponds to a unique sharing determination state. A common specific example: In cross-hospital joint modeling applications, the postoperative complication risk prediction results output by the federated learning model are used as the basis for sharing determination. If the prediction result is marked as high-risk, the corresponding patient sample is determined to be a shareable sample and is allowed to enter the multi-hospital shared data pool after being re-encrypted; if the prediction result is marked as low-risk, the corresponding sample is determined to be non-shareable and is only retained in local storage.

[0076] After obtaining the sample-level data sharing decision sequence, each participant performs policy mapping processing on the decision results according to the uniformly configured sharing policy rules. The sharing policy rules are pre-stored locally on each participant's machine in the form of a structured policy table. The policy table defines the target participant set, data access permission level, and key conversion method corresponding to different sharing decision markers. During implementation, each decision marker in the sample-level data sharing decision sequence is read sequentially, and the policy entry matching that marker is retrieved from the sharing policy rule table to generate the corresponding key conversion parameters. The key conversion parameters include a target participant identifier, a re-encryption key index identifier, and an access permission control field, used to indicate the key mapping direction and conversion method of subsequent re-encryption operators. Subsequently, the generated key conversion parameters are bound and encapsulated with the corresponding sample index identifier to form a structured set of re-encryption control instructions. The re-encryption control instructions are organized in a unified data format, including a sample index field, a key conversion parameter field, and a policy verification field, enabling the re-encryption execution process to be executed sequentially according to the clearly defined sample-level control logic. A common use case is as follows: When the prediction result is marked as high-risk or high-value, the target participants are set to all high-risk participants, the access level is set to joint analysis level, and the key conversion method is set to multi-target re-encryption; when the prediction result is marked as medium-risk, the target participants are limited to designated collaborators exchanging keys, and the access level is set to controlled analysis; when the prediction result is marked as low-risk, the target participants are set to empty, the access level is set to local private level, and no re-encryption is performed. Through the above processing, the prediction result markings output by the federated learning model are unified and integrated with the multi-party data sharing strategy, making the re-encryption operation controllable, traceable, and consistent with the strategy, ensuring that different participants follow a unified access control standard during data sharing.

[0077] After the re-encryption control command is constructed, each participating party, based on the sample index identifier and key conversion parameters recorded in the control command, sequentially calls the re-encryption operator to perform key mapping transformation on the corresponding local homomorphic ciphertext data. In specific implementation, for each sample ciphertext data, the re-encryption operator, based on the target participating party identifier specified in the key conversion parameters, loads the corresponding re-encryption key from the local security key management unit and performs a key space mapping operation on the original homomorphic ciphertext data, ensuring that the transformed ciphertext can only be decrypted by the private key corresponding to the target participating party. This re-encryption process is completed without exposing any plaintext data content, achieving fine-grained transfer control of ciphertext access permissions. After re-encrypting a single sample ciphertext, the generated re-encrypted ciphertext data block, along with the corresponding sample index identifier, target participating party identifier, and sharing policy tag, is structurally encapsulated to form a standardized re-encrypted data packet. The above re-encryption and encapsulation processes are sequentially performed on all samples that meet the sharing conditions, constructing a complete set of re-encrypted data packets, which are then written into the shared data pool according to a unified data interface protocol. The shared data pool provides controlled access interfaces to each participant. Participants can only download and decrypt the corresponding re-encrypted ciphertext data blocks according to their own permissions, thereby enabling secure data exchange and collaborative applications among multiple parties while ensuring privacy and access compliance.

[0078] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0079] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0080] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0081] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0082] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0083] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0084] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0086] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A privacy-preserving data sharing method based on federated learning, characterized in that, Includes the following steps: S1. Encrypt the local privacy data of each participant using an additive homomorphic encryption algorithm to generate homomorphic ciphertext data, and extract the feature dimensions and sample number of the privacy data to generate a data descriptor. S2. Based on data descriptors and predefined federated learning model structures, construct a verifiable computational task description file containing layer operation sequences and activation function types; S3. Distribute the homomorphic ciphertext data and the verifiable computation task description file as computation task sub-packages to mutually isolated external computation nodes. Each computation node performs forward and backward propagation computations in the ciphertext domain according to the description file to generate encrypted gradient update fragments. S4. After each external computing node completes its computation, it generates a zero-knowledge proof for the current ciphertext computation process. S5. Verify all encrypted gradient update segments and their corresponding zero-knowledge proofs in parallel. Perform homomorphic aggregation operations on the verified gradient update segments to generate global encrypted gradients. S6. Each participant uses its private key to decrypt the global encrypted gradient and updates the federated learning model copy based on the decrypted plaintext gradient. S7. Based on the output of the federated learning model replica, re-encrypt the local homomorphic ciphertext data of each participant, generate a re-encrypted data packet for secure multi-party data exchange, and upload it to the shared data pool. In step S2, constructing a verifiable computational task description file containing layer operation sequences and activation function types based on data descriptors and predefined federated learning model structures specifically includes: The number of input layer nodes and parallel computing paths of the federated learning model are predefined, and the hierarchical connection relationship between the input layer, hidden layer and output layer in the federated learning model structure is marked. The feature dimension and sample number distribution data obtained by parsing the data descriptor are mapped to the federated learning model structure. Based on the hierarchical connection relationship, a forward propagation linear transformation operation sequence and a nonlinear activation operation sequence are generated layer by layer, and a backward propagation gradient backpropagation path is constructed simultaneously to form a continuous and executable encrypted computation process. The operation nodes and connections of each layer in the encrypted computation process are converted into a standardized arithmetic circuit structure, and the activation function operation is mapped to an equivalent polynomial computation sub-circuit, forming a verifiable computation circuit topology that covers the entire forward and backward propagation process. Perform joint encapsulation of arithmetic circuit topology and sample distribution data to generate a verifiable computation task description file; In step S3, generating the encrypted gradient update fragment specifically includes: The homomorphic ciphertext data corresponding to different batch identifiers and the verifiable computation task description file are encapsulated into independent computation task sub-packages and sent to different external computing nodes respectively. The external computing node parses the arithmetic circuit topology in the computing task sub-package, and sequentially performs the forward propagation and backward propagation operations corresponding to the federated learning model in the homomorphic ciphertext domain to form the ciphertext intermediate results recursively layer by layer. Based on the ciphertext intermediate results, the ciphertext derivation of parameter gradients is performed along the backpropagation path to generate encrypted gradient update fragments that correspond to the structure of the federated learning model layer by layer. In step S4, after each external computing node completes its computation, it generates a zero-knowledge proof for the current ciphertext computation process, specifically including: After completing the forward and backward propagation calculations of the homomorphic ciphertext, each external computing node, based on the arithmetic circuit topology in the verifiable computing task description file, maps the intermediate ciphertext results of the layer-by-layer recursion with the encryption gradient update fragments to construct the corresponding arithmetic circuit instance calculation trajectory, and generates a proof generation input that satisfies the zero-knowledge constraint. The zero-knowledge proof in this ciphertext calculation process is consistent with the execution path of the arithmetic circuit.

2. The method for secure sharing of privacy-preserving data based on federated learning according to claim 1, characterized in that, In step S1, extracting the feature dimensions and sample quantity of privacy data to generate data descriptors specifically includes: Field-level parsing is performed on the local privacy data of each participant, and the data is divided into a set of feature fields and a sequence of sample indexes according to a preset data structure template to form a plaintext feature matrix with a consistent structure. The plaintext feature matrix is ​​processed element-wise by an additive homomorphic encryption operator to perform ciphertext mapping, generating homomorphic ciphertext data blocks that maintain the original addition operation relationship. Sample aggregation is then performed on the homomorphic ciphertext data blocks, and the feature dimensions and sample quantity distribution data containing batch identifiers corresponding to the aggregated samples are statistically analyzed. The statistical results are then encoded into standardized data descriptors.

3. The method for secure sharing of privacy-preserving data based on federated learning according to claim 1, characterized in that, In step S5, all encrypted gradient update segments and their corresponding zero-knowledge proofs are verified in parallel. Homomorphic aggregation is then performed on the verified gradient update segments to generate a global encrypted gradient. Specifically, this includes: Receive encrypted gradient update fragments and corresponding zero-knowledge proofs from external computing nodes. For each zero-knowledge proof, call the matching verification algorithm and verification key to verify its validity concurrently. Select all encrypted gradient update fragments with valid zero-knowledge proofs to form a valid fragment set, and rearrange them according to the hierarchical structure and model parameters of the federated learning model; Based on the additive homomorphic encryption operator, a layer-by-layer additive aggregation operation is performed on all encryption gradient values ​​belonging to the same model parameter in the effective fragment set to obtain the global encryption gradient components of all model parameters, which are then summarized into a complete global encryption gradient.

4. The method for secure sharing of privacy-preserving data based on federated learning according to claim 1, characterized in that, In step S6, each participant uses its private key to decrypt the global encrypted gradient and updates the federated learning model replica based on the decrypted plaintext gradient, specifically including: Each participant performs a homomorphic decryption operation on the global cryptographic gradient based on its locally stored private key to obtain a global gradient vector in plaintext form; Based on the predefined federated learning model structure and hierarchical connection relationship, the plaintext global gradient vector mapping is constructed as the model parameter adjustment amount and updated to the local federated learning model copy of the participants.

5. The method for secure sharing of privacy-preserving data based on federated learning according to claim 1, characterized in that, In step S7, based on the output of the federated learning model replica, the local homomorphic ciphertext data of each participant is re-encrypted to generate a re-encrypted data packet for secure multi-party data exchange, and then uploaded to the shared data pool. Specifically, this includes: Based on the local federated learning model copies of each participant, ciphertext inference operations are performed on the local homomorphic ciphertext data, outputting the prediction result label corresponding to each sample, and constructing a sample-level data sharing decision sequence based on the prediction result label; Establish the same sharing policy rules for all participants, generate a corresponding key conversion parameter set by combining the data sharing judgment sequence, bind and encapsulate the key conversion parameters with the sample index identifier to form a structured re-encryption control instruction; Based on the re-encryption control instructions, the re-encryption operator is invoked to perform key mapping transformation on the local homomorphic ciphertext data of each participant, generating a re-encrypted ciphertext data block that can only be decrypted by the target participant. The re-encrypted ciphertext data block is then encapsulated into a re-encrypted data packet and written to the shared data pool.

Images