Trusted traceable privacy enhanced heterogeneous federal learning method and system

Abstract

The invention provides a credible traceable privacy enhanced heterogeneous federal learning method and system, and belongs to the technical field of artificial intelligence and information security, the method comprises the following steps: initializing a watermark parameter of a pseudo-random code at a server side, and generating a coding key and a decoding key; the client performs coding and tensor remodeling on the message bit sequence of the metadata through the coding key to generate a potential tensor with a watermark; performing reverse diffusion iteration on the potential tensor with the watermark through a pre-trained diffusion model to obtain a generation feature; and the server side performs multi-layer auditing on the client side according to the generation characteristics and the decoding key, and detects whether the client side has malicious behaviors or not. According to the method, the pseudo-random code watermark technology is applied to federated learning for the first time, an unforgeable watermark traceability mechanism is established, malicious behaviors of the client can be effectively monitored, and the method can be widely applied to heterogeneous federated learning scenes.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence and information security technology, and in particular to a trusted and traceable privacy-enhanced heterogeneous federated learning method and system. BACKGROUND

[0002] As a distributed machine learning paradigm, federated learning allows multiple participants to collaboratively train a model without sharing raw data, and is widely used in privacy-sensitive fields such as healthcare and finance. However, federated learning faces serious security threats. Malicious clients may upload tampered model updates, launch Byzantine attacks, data poisoning attacks, or implant backdoors, leading to a decline in global model performance or even complete failure.

[0003] Existing federated learning security solutions have the following obvious limitations: In the heterogeneous federated learning scenario, different participants have models with different architectures and different sizes, making traditional defense methods based on parameter comparison ineffective; defense methods based on aggregation (such as Krum, Trimmed-Mean) can resist attacks to some extent, but cannot trace the source of the attack, and the effect is not good in a heterogeneous environment; solutions based on trusted execution environment (TEE) have the problems of hardware attack risk and low computational efficiency.

[0004] In addition, the federated learning training process lacks transparency and auditability. When the global model performance is abnormal, the server has difficulty in quickly locating the problem client and cannot distinguish between malicious attacks and performance degradation caused by insufficient device capabilities. These problems seriously restrict the deployment and promotion of federated learning in key application fields. SUMMARY

[0005] The present application provides a trusted and traceable privacy-enhanced heterogeneous federated learning method and system to solve the problem of being unable to trace the source of the attack in the existing technology in the heterogeneous federated learning scenario, and to realize the traceability of the source of the attack and malicious behavior.

[0006] In a first aspect, the present application provides a trusted and traceable privacy-enhanced heterogeneous federated learning method, comprising: initializing watermark parameters of pseudo-random codes on the server side, and generating an encoding key and a decoding key; The client obtains the metadata in each round of training process and converts it into a message bit sequence, encodes the message bit sequence through the encoding key and tensor reshaping, and generates a watermarked latent tensor; The watermarked latent tensor is iteratively back-diffused through a pre-trained diffusion model to obtain generated features; The server receives the generated features uploaded by the client, and performs multi-layer auditing on the client according to the generated features and the decoding key. Extracting multi-dimensional features of the client, and combining the results of the multi-layer audit, detecting whether the client has malicious behavior.

[0007] On the basis of the above technical solutions, preferably, the related parameters of the pseudo-random code are initialized at the server end, and the encoding key and the decoding key are generated, comprising: Determining the latent vector dimension according to the structure of the pre-selected diffusion model at the server end; According to the metadata in each round of the training process of the client, the message length is determined; wherein the metadata at least includes the training round, the client ID, the timestamp and the homogeneity level; The latent vector dimension, the message length, the preset sparsity parameter and the target false positive rate are used as the watermark parameters of the pseudo-random code, and the encoding key and the decoding key are generated; wherein the encoding key includes a generation matrix, a one-time key pad, test bits and noise parameters, and the decoding key includes a parity check matrix, an iteration parameter and the content of the encoding key.

[0008] On the basis of the above technical solutions, preferably, the message bit sequence is encoded and tensor reshaped by the encoding key to generate a watermark latent tensor, comprising: The message bit sequence is linearly transformed by the generation matrix in the encoding key, the output result of the linear transformation is XORed with the one-time key pad, and noise is added to generate a codeword with the same length as the latent vector dimension; The elements in the codeword are sampled, and the sampling results are tensor reshaped and copied to generate a watermark latent tensor.

[0009] On the basis of the above technical solutions, preferably, the client is audited according to the generated features and the decoding key, comprising: Watermark verification of the generated features is performed by the decoding key; Extracting the fingerprint features of the generated features, and performing fingerprint verification according to the fingerprint features; Based on the results of the watermark verification and the fingerprint verification, updating the trust score of the client.

[0010] On the basis of the above technical solutions, preferably, the watermark verification of the generated features by the decoding key comprises: The generated features are decoded by the decoding key to obtain the recovered message bit sequence; Extracting the recovered metadata according to the recovered message bit sequence; Obtain the metadata of the current training round associated with the generated features from the dictionary on the server side; Determine whether the recovered metadata is consistent with the metadata of the current training round. If so, the watermark verification passes; otherwise, mark it as watermark verification failure and record it in the audit log.

[0011] Based on the above technical solutions, preferably, the step of extracting the fingerprint features of the generated features and performing fingerprint verification based on the fingerprint features includes: Extract the mean vector and variance vector of the generated features and perform dimension filtering to determine the fingerprint features of each dimension; The proportion of fingerprint features greater than a predetermined fingerprint threshold is counted. If the proportion is greater than the preset threshold, the fingerprint verification is successful; otherwise, it is marked as an abnormal fingerprint and recorded in the audit log.

[0012] Based on the above technical solutions, preferably, the trust score of the client is updated based on the results of the watermark verification and the fingerprint verification, including: If both the watermark verification and the fingerprint verification pass, the client's trust score is updated using the exponential moving average method based on the client's current confidence level and historical trust score. If either the watermark verification or the fingerprint verification fails, the client's trust score is lowered, and the number of consecutive failures is recorded. If the number of consecutive failures exceeds a preset threshold and the trust score is less than a preset threshold, the client is marked as a suspicious client, triggering a deep audit.

[0013] Based on the above technical solutions, preferably, the step of extracting multi-dimensional features of the client and combining them with the results of the multi-layer audit to detect whether the client exhibits malicious behavior includes: Extract the historical performance records, failure modes, and gradient direction consistency of the suspicious client. Combine these with the results of the multi-layer audit to determine whether the suspicious client is engaging in malicious behavior and generate an audit report. The failure modes include single failures and consecutive failures. The gradient direction consistency is measured based on the cosine similarity between the current round gradient and the historical round gradients.

[0014] Secondly, the present invention also provides a trusted and traceable privacy-enhanced heterogeneous federated learning system, the system comprising: System initialization module: Deployed on the server side, it is used to initialize the watermark parameters of the pseudo-random code and generate the encoding key and decoding key; Watermark embedding module: Deployed on the client side, it is used to acquire metadata in each round of training and convert it into a message bit sequence. The message bit sequence is then encoded and reshaped into a tensor using the encoding key to generate a watermarked potential tensor. Feature generation module: Deployed on the client side, used to perform back-diffusion iteration on the watermarked latent tensor through a pre-trained diffusion model to obtain generated features; Multi-layer auditing module: Deployed on the server side, used to receive the generation features uploaded by the client, and perform multi-layer auditing on the client based on the generation features and the decoding key; Attack detection module: Deployed on the server side, it is used to extract multi-dimensional features of the client and, in combination with the results of the multi-layer audit, detect whether the client has malicious behavior.

[0015] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the trusted and traceable privacy-enhanced heterogeneous federated learning method as described above.

[0016] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the trusted and traceable privacy-enhanced heterogeneous federated learning method as described above.

[0017] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the trusted and traceable privacy-enhanced heterogeneous federated learning method as described above.

[0018] The beneficial effects of the technical solutions provided by some embodiments of the present invention include at least the following: 1) This invention provides a trusted and traceable privacy-enhanced heterogeneous federated learning method system, which for the first time applies pseudo-random code watermarking technology to federated learning. Watermarked encoding information is embedded in the latent space to generate a watermarked latent tensor, which is then mapped to the feature space through a diffusion model, thereby establishing an unforgeable watermark traceability mechanism. A multi-layer auditing mechanism is designed to comprehensively judge client behavior and effectively monitor malicious client behavior. The method of this invention can be applied to heterogeneous federated learning scenarios, and has a wider range of applications.

[0019] 2) This invention is based on pseudo-random code watermarking technology, embedding the watermark into the latent vector, and synthesizing high-quality generated features through a pre-trained diffusion model to assist local model training. These generated features retain the watermark information encoded in the latent vector, and have a distribution and semantics similar to real data, ensuring the concealment and ease of use of the watermark, while also ensuring the privacy and efficiency of the training process.

[0020] 3) This invention achieves watermark verification by embedding an undetectable watermark in the latent space and achieves fingerprint verification by statistically analyzing fingerprint features in the feature space, thereby establishing a dual-space traceability mechanism. This enables the federated learning training process to have fine-grained auditability and can be traced back to the specific training round, client, and generated features.

[0021] 4) This invention combines watermark verification, fingerprint verification, and trust score management to construct a three-layer defense system. Through the coordinated operation of the three defense mechanisms, it can achieve accurate identification and efficient defense against malicious clients.

[0022] 5) Based on the multi-dimensional features of the client and combined with the results of multi-layer auditing, this invention can detect whether the client has malicious behavior, and can accurately distinguish between malicious attacks and insufficient capabilities, effectively reducing the false alarm rate and achieving stronger security protection while ensuring model performance. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is one of the flowcharts illustrating a trusted and traceable privacy-enhanced heterogeneous federated learning method provided by the present invention; Figure 2 This is the second flowchart of a trusted and traceable privacy-enhanced heterogeneous federated learning method provided by the present invention; Figure 3 This is a schematic diagram of the structure of a trusted and traceable privacy-enhanced heterogeneous federated learning system provided by the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0026] In existing technologies, heterogeneous federated learning has many security flaws: heterogeneous model parameters make it impossible to directly compare model updates uploaded by different clients, rendering traditional aggregation defense methods ineffective; the training process lacks auditability, making it impossible to trace the source of attacks and malicious behavior; existing defense solutions either have high false positive rates or high computational costs, making them difficult to deploy in real-world scenarios; servers cannot distinguish between malicious attacks and insufficient capabilities, and are prone to misjudging honest but resource-constrained clients.

[0027] This invention proposes a trustworthy and traceable privacy-enhanced heterogeneous federated learning method and system. Based on pseudo-random code (PRC) watermarking technology, an undetectable watermark is embedded in the generated features, and a dual-space traceability mechanism is established to achieve fine-grained auditing of the federated learning training process. A three-layer defense system is constructed based on watermark verification, fingerprint verification, and trust score management, and attack detection is performed, achieving strong security while ensuring model performance.

[0028] Example 1 Please see Figure 1 , Figure 1 One of the flowcharts for a trusted and traceable privacy-enhanced heterogeneous federated learning method provided as an embodiment of the present invention includes: S101. Initialize the watermark parameters of the pseudo-random code on the server side, and generate the encoding key and decoding key; S102. The client obtains the metadata in each round of training and converts it into a message bit sequence. The message bit sequence is then encoded and reshaped into a tensor using an encoding key to generate a watermarked potential tensor. S103. The watermarked latent tensor is back-diffused iteratively using a pre-trained diffusion model to obtain generated features; S104. The server receives the generated features uploaded by the client and performs multi-layer auditing on the client based on the generated features and the decoding key. S105. Extract multi-dimensional features of the client and combine them with the results of multi-level auditing to detect whether the client has malicious behavior.

[0029] This invention is the first to apply pseudo-random code watermarking technology to federated learning. It embeds watermarked encoding information into the latent space, generates a watermarked latent tensor, and maps it to the feature space through a diffusion model, thereby establishing an unforgeable watermark traceability mechanism. A multi-layer auditing mechanism is designed to comprehensively judge client behavior and effectively monitor malicious client behavior. The method of this invention can be applied to heterogeneous federated learning scenarios, thus having a wider range of applications.

[0030] In S101 of this embodiment, the PRC watermark parameters are initialized on the server side, and the encoding key and decoding key are generated based on the PRC watermark parameters.

[0031] For example, a high-level security parameter λ is first selected to define the required cryptographic security strength of the system. For instance, λ=128 represents a 128-bit security level. To meet the security objective set by λ, the server needs to configure specific watermark parameters for generating the encoding and decoding keys.

[0032] In some possible implementations, the relevant parameters of the pseudo-random code are initialized on the server side, and encoding and decoding keys are generated, including: On the server side, the potential vector dimensions are determined based on the structure of the pre-selected diffusion model. The message length is determined based on the metadata from each round of training on the client side; The encoding and decoding keys are generated using the potential vector dimension, message length, preset sparsity parameters, and watermark parameters of the pseudo-random code with a target false alarm rate.

[0033] Specifically, S101 above can be divided into the following three steps: S101-1. Initialize PRC watermark parameters. This invention pre-selects a diffusion model for subsequent feature generation; therefore, the potential vector dimension is first determined based on the structure of the pre-selected diffusion model. n (Right now n =number of channels × height × width), to ensure that the vector dimension of the subsequently generated watermark is consistent with the input dimension of the diffusion model; secondly, in order to embed the metadata of each round of training into the generated features, the present invention determines the message length according to the metadata to be embedded. l (like l= 512 bits are used to store metadata such as training round ID (16 bits), client ID (16 bits), timestamp (32 bits), and homogeneity level; finally, the sparsity parameter is set. t (like t =3) and target false alarm rate FPR (e.g., FPR=1e-5).

[0034] S101-2, Generate PRC key pairs. Based on latent vector dimension. n Message lengthl Sparsity parameters t The PRC encoded key is generated using a PRC key generation algorithm (such as a pseudo-random number generator) along with four parameters: target false alarm rate (FPR) and target false alarm rate (FPR). and decoding key The encoding key includes the generator matrix, one-time key pad, test bits, and noise parameters (g-parameter and noise rate), while the decoding key includes the parity check matrix, iteration parameters, and the contents of all encoded keys.

[0035] S101-3. Key Storage and Management. Save the key pair to a file and set strict access permissions to ensure that only the server can access it. The key pair remains unchanged throughout the entire federated learning training process, and the decryption key is not distributed to the client, ensuring the watermark's undetectability.

[0036] In addition, the client list, trust score dictionary, and audit log system can be initialized on the server side.

[0037] In S102 of this embodiment, the client converts the metadata of each training round into a message bit sequence and generates a watermarked potential vector for each training round using an encoding key.

[0038] In heterogeneous federated learning scenarios, different clients may use models with different architectures and scales. For example, client 1 uses a ResNet50 (residual network) model, client 2 uses a CNN (convolutional neural network) model, and client 3 uses a MobileNet (mobile network) model. For each client, this invention encodes its metadata and embeds a watermark to generate a watermarked potential vector for subsequent watermark verification, which helps to achieve malicious behavior defense in heterogeneous federated learning scenarios.

[0039] In some possible implementations, the message bit sequence is encoded and reshaped into a tensor using an encoding key to generate a watermarked potential tensor, including: The message bit sequence is linearly transformed by the generator matrix in the encoding key, the output of the linear transformation is XORed with the one-time key pad, and noise is added to generate a codeword with the same length as the potential vector dimension. Elements in the codeword are sampled, and the sampling results are reshaped and copied into a tensor to generate a watermarked potential tensor.

[0040] Specifically, S102 above may include the following sub-steps: S102-1, Metadata Encoding. When the client receives the training task, it obtains metadata such as the current round ID, its own client ID, and timestamp. The server calculates and distributes metadata such as the homogeneity level. Let the message length be... l=512, convert the round ID to 16-bit binary, the client ID to 16-bit binary, the timestamp to 32-bit binary, normalize the homogeneity level to [0,255] and convert it to 8-bit binary. Concatenate all the above message bits and fill with bits from zero to 512 to form a message bit sequence.

[0041] S102-2, PRC Encoding. The message bit sequence is encoded using the encoding key generated on the server side, and sparse noise is added to meet the t parameter requirements to generate a codeword of length n, where codeword = message × generator matrix ⊕ one-time key pad.

[0042] S102-3, Pseudo-Gaussian Sampling. Initialize a floating-point vector of length n. For each element i in the codeword, if codeword[i] = 1, then from the mean... Sampling is performed using a positive Gaussian distribution with a standard deviation of σ; if codeword[i] = 0, the sample is taken from the distribution with a mean of σ. Sampling is performed using a negative Gaussian distribution with a standard deviation of σ, and the sampling results are converted into a floating-point vector. .in , These are the means of the positive Gaussian distribution and the negative Gaussian distribution, respectively.

[0043] S102-4, Tensor Reshaping and Copying. Transforming floating-point vectors... Reshape into a 4-dimensional tensor of (1, channels, height, width), where channels is the number of channels, height is the height, and width is the width, and channels × height × width = n. Copy along the batch dimension. Next, the generated shape is ( This generates a watermarked latent tensor (with parameters in range, channels, height, and width). Metadata such as the generation ID, training epoch ID, client ID, timestamp, number of samples, and MD5 hash of the codewords are recorded in a dictionary on the server side. This watermark embedding method is logically transparent to the client; the client only needs to call the `generate_watermarked_latent` interface without needing to understand the details of the watermarking mechanism, ensuring the watermark's concealment and ease of use.

[0044] In S103 of this embodiment, the diffusion model can adopt the Denoising Diffusion Probabilistic Model (DDPM), which is used to perform n_T steps of reverse diffusion process under the guidance of conditional information. In each step, the denoising network is called to predict noise and update the latent vector, and output high-quality generated features to assist the local model training.

[0045] Specifically, S103 above may include the following sub-steps: S103-1, Diffusion Model Initialization. Load the pre-trained DDPM model and set the time steps. =1000. Define the noise scheduling method (linear or cosine scheduling), and calculate the single-step signal preservation coefficient α and the cumulative signal preservation coefficient. Isodiffusion parameters. Preparation conditions. Such as one-hot encoding of sample labels or category indexes.

[0046] S103-2, Backdiffusion Iteration. From the watermarked latent vector... Starting from the initial state of the vector, for time step t... Decrease to 1, then perform the following steps: (a) The watermarked potential vector at the current time step t and conditions Input the neural network model to predict noise ; (b) Iterative calculation based on reparameterization techniques:

[0047] Where z is standard Gaussian noise; The potential vector with watermark at time step t-1; (c) When t=1, z=0, and the final output features are obtained. .

[0048] S103-3, Feature Output and Quality Control. For features... Perform cropping and normalization to obtain generated features. Check the statistical properties of the generated features (such as mean, variance, and range) to ensure they are similar to the distribution of the real data. If the quality is not up to standard, regenerate until it meets the standard, then output the generated features.

[0049] S103-4. Metadata Association. Associate the generated features with the metadata recorded in the dictionary, including the generated feature ID, training epoch ID, client ID, etc. This metadata can be used for subsequent watermark verification and traceability.

[0050] Understandably, the feature generation process can be accelerated using GPUs, controlling computational overhead while maintaining quality. These generated features retain the watermark information encoded in the latent vectors, while also having a distribution and semantics similar to real data, thus ensuring the privacy and efficiency of the training process.

[0051] In S104 of this embodiment, a multi-layered defense mechanism is established on the server side to audit the client.

[0052] For example, the reverse operations of S103, S102, and S101 can be performed sequentially on the generated features submitted by the client to recover the metadata hidden in the generated features. Then, the metadata is compared with the metadata stored in the dictionary on the server side to verify the legality of metadata such as the client's identity and the round in which it participated, and to check whether the update format and size meet expectations.

[0053] For example, the cosine similarity between the current update vector and the historical average update vector can be calculated, and updates that deviate significantly (negative correlation or extremely low similarity) can be flagged.

[0054] For example, a trust score can be maintained for each client. The trust scores of clients contributing high-quality and stable services are increased, while the trust scores of clients detected as anomalous are decreased. During aggregation, clients are weighted according to their trust scores, and those with excessively low trust scores are temporarily or permanently banned from participating.

[0055] In addition, auditing the client can be performed by checking whether the L2 norm of client updates (such as gradients and parameter differences) is within a reasonable threshold and by performing median statistics.

[0056] In S105 of this embodiment, attack detection is performed on the client based on the client's multi-dimensional characteristics and multi-layer audit results to identify malicious clients.

[0057] For example, multi-dimensional features such as client behavior characteristics (e.g., participation frequency, continuous / intermittent patterns, response latency), data distribution characteristics (e.g., mean, variance, label distribution), and performance characteristics (contribution to the global model) can be extracted. These multi-dimensional features are then combined with multi-layer audit results, and attack detection is performed on the client using methods such as rule engines and machine learning models to identify malicious clients.

[0058] This invention is based on pseudo-random code watermarking technology. It embeds the watermark into the latent vector and synthesizes high-quality generated features through a pre-trained diffusion model to assist local model training. These generated features retain the watermark information encoded in the latent vector and have a distribution and semantics similar to real data, ensuring the concealment and ease of use of the watermark, while also ensuring the privacy and efficiency of the training process.

[0059] Example 2 Please see Figure 2 , Figure 2 A second flowchart illustrating a trusted and traceable privacy-enhanced heterogeneous federated learning method provided as an embodiment of the present invention, the method comprising: S201. Initialize the watermark parameters of the pseudo-random code on the server side, and generate the encoding key and decoding key; S202. The client obtains the metadata in each round of training and converts it into a bit sequence. The bit sequence is then encoded and reshaped into a tensor using an encoding key to generate a watermarked potential tensor. S203. The watermarked latent tensor is back-diffused iteratively using a pre-trained diffusion model to obtain generated features; S204. The server receives the generated feature uploaded by the client and verifies the watermark of the generated feature using the decoding key. S205. Extract the fingerprint features generated from the fingerprint features, and perform fingerprint verification based on the fingerprint features; S206. Update the client's trust score based on the results of watermark verification and fingerprint verification; S207. Extract multi-dimensional features of the client and combine them with the results of multi-level auditing to detect whether the client has malicious behavior.

[0060] This invention establishes a three-layer defense mechanism on the server side to audit clients. The first layer performs PRC watermark verification to trace the source of features; the second layer performs feature fingerprint verification to detect feature tampering; and the third layer manages trust scores. Through the collaborative work of these three defense mechanisms, accurate identification and efficient defense against malicious clients are achieved. Furthermore, based on the client's multi-dimensional features and the results of multi-layer auditing, this invention detects whether the client is engaging in malicious behavior and can accurately distinguish between malicious attacks and insufficient capabilities, effectively reducing the false positive rate and achieving stronger security while ensuring model performance.

[0061] S210~S203 of this embodiment can be referred to S101~S103, and will not be repeated here.

[0062] In S204 of this embodiment, the server verifies the watermark of the generated feature uploaded by the client using the decoding key to trace the source of the feature.

[0063] In some possible implementations, the generated feature is watermarked using a decoding key, including: Retrieve metadata related to the current training round and associated with the generated features from the server-side dictionary; The generated features are decoded using the decoding key to obtain the recovered bit sequence; Extract the recovered metadata from the recovered bit sequence; Determine whether the recovered metadata is consistent with the metadata trained in the current round. If so, the watermark verification passes; otherwise, mark it as watermark verification failure and record it in the audit log.

[0064] Specifically, after receiving the generated features uploaded by the client, the server first retrieves the training round ID and the client ID from the dictionary recording the current federated learning task on the server. Then, the server reconstructs the message bit sequence from the received generated features according to the reverse operation of S202.

[0065] Taking the specific implementation of S102 as an example, the process of recovering the message bit sequence is as follows: Through the inverse operation of pseudo-Gaussian sampling, the sign (±1) of the flattened generated feature at all n positions is calculated. If the value is positive, it is recorded as "1", and if the value is negative, it is recorded as "0", thus constructing a bit sequence of length n; then, the server uses the decoding key... The bit sequence is decoded using the belief propagation algorithm to obtain the recovered message bit sequence.

[0066] Finally, the server parses the recovered metadata (such as the recovered training round ID and the recovered client ID) from the recovered message bit sequence and compares it with the training round ID, client ID, and other information stored in the server's dictionary. If the two match and the decoding confidence is higher than the preset confidence threshold (such as 0.9), the watermark verification passes; otherwise, it is marked as watermark verification failure and recorded in the audit log.

[0067] In step S205 of this embodiment, a statistical fingerprint of the generated features is extracted, including the distribution of values ​​of mean, variance and specific dimensions, to obtain fingerprint features for fingerprint verification.

[0068] In some possible implementations, fingerprint features are extracted from the generated features, and fingerprint verification is performed based on these fingerprint features, including: Extract the mean vector and variance vector of the generated features and perform dimension filtering to determine the fingerprint features of each dimension; The proportion of fingerprint features greater than a predetermined fingerprint threshold is counted. If the proportion is greater than the preset threshold, the fingerprint verification is successful; otherwise, it is marked as an abnormal fingerprint and recorded in the audit log.

[0069] Specifically, for a client uploading generated features for the first time, a statistical fingerprint of the features is calculated to determine the fingerprint threshold for that client. Specifically, the mean and variance vectors of the generated features are extracted, and the elements in the vectors are sorted in descending order. The top-k most discriminative dimensions (e.g., the 30 dimensions with the highest mean in the mean vector) are selected as fingerprint features. Then, the threshold for these fingerprint features is determined as threshold = top_mean + 0.25 × top_std, where top_mean and top_std are the mean and variance of a certain dimension, respectively. These thresholds corresponding to these dimensions are saved as the fingerprint threshold for that client.

[0070] For subsequently uploaded generated features, extract the mean value `new_means` of the same dimension, and calculate the proportion `exceed_ratio` of these mean values ​​that is greater than or equal to the corresponding fingerprint threshold. That is, `exceed_ratio = (new_means>= threshold).mean()`. If the proportion `exceed_ratio>= 0.6`, the fingerprint verification passes; otherwise, it is marked as an anomaly and recorded in the audit log.

[0071] This invention defines a fingerprint threshold when the client first uploads and generates features. Subsequent uploads compare the newly uploaded features with the fingerprint thresholds of the client's historical features, calculating the proportion of dimensions exceeding the threshold to verify fingerprint consistency. If the proportion is higher than 60%, the fingerprint verification passes, confirming that the features have not been tampered with.

[0072] This invention achieves watermark verification by embedding an undetectable watermark in the latent space and achieves fingerprint verification by statistically analyzing fingerprint features in the feature space. This establishes a dual-space traceability mechanism of feature space and latent space, enabling the federated learning training process to have fine-grained auditability and trace back to specific training rounds, clients, and generated features.

[0073] In S206 of this embodiment, the trust score and number of consecutive failures for each client are maintained, and the trust score of the client is dynamically updated using the exponential moving average method.

[0074] Based on the results of watermark verification and fingerprint verification, the client's trust score is updated using the exponential moving average (EMA) method. If verification passes, the trust score increases; if verification fails, the trust score decreases and the number of consecutive failures is recorded. When the number of failures accumulates to a certain level and the trust score falls below a minimum threshold, the client is marked as suspicious.

[0075] In some possible implementations, the client's trust score is updated based on the results of watermark verification and fingerprint verification, including: If both watermark verification and fingerprint verification pass, the client's trust score is updated using the exponential moving average method based on the client's current confidence level and historical trust score. If either watermark verification or fingerprint verification fails, the client's trust score is lowered, and the number of consecutive failures is recorded. If the number of consecutive failures exceeds a preset threshold and the trust score is less than a preset threshold, the client is marked as a suspicious client, triggering a deep audit.

[0076] Specifically, all clients are initialized with a trust score of 1.0 and a consecutive failure count of 0. After each audit round, if both watermark verification and fingerprint verification pass, the consecutive failure count is reset to 0, and the trust score is updated using an exponential moving average method based on the client's current confidence level and historical trust score. conf_ema_t = α ×client_conf_t+ (1-α) × conf_ema_t-1 Where conf_ema_t is the client's current trust score, conf_ema_t-1 is the historical trust score, conf_ema_t is the updated trust score, and α is the weight, which can be α=0.1.

[0077] If either watermark verification or fingerprint verification fails, the client's trust score is lowered (e.g., the current trust score is reduced by 0.1), and the consecutive failure count is increased by one. If the consecutive failure count is greater than or equal to 3 and the trust score is less than or equal to 0.2, the client is marked as "suspicious," triggering a deep audit.

[0078] This invention conducts a comprehensive audit of the generated features and model updates uploaded by the client. Through the collaborative work of three layers of defense, it verifies the client's credibility from different angles, forming multiple safeguards.

[0079] In S207 of this embodiment, a multi-dimensional analysis is performed on suspicious clients to detect whether the clients exhibit malicious behavior.

[0080] In some possible implementations, multi-dimensional features of the client are extracted and combined with the results of multi-layer auditing to detect whether the client is engaging in malicious behavior, including: Extract the client's historical performance records, failure modes, and gradient direction consistency. Combine the results of multi-layer auditing to determine whether the client has engaged in malicious behavior and generate an audit report. Among them, failure modes include single failures and consecutive failures. Gradient direction consistency is measured based on the cosine similarity between the current round gradient and the gradients of historical rounds.

[0081] Specifically, malicious behavior of the client is detected based on the client's historical performance records, failure modes, feature integrity, and gradient consistency.

[0082] (a) Historical performance records: if conf_ema_t was originally greater than 0.8 but suddenly drops, it is judged as "temporary failure or intrusion"; if it is always less than 0.5, it is judged as "insufficient capability or continuous malicious intent".

[0083] (b) Failure mode: Single failure is occasional failure, and continuous failure is persistent failure.

[0084] (c) Feature Integrity: If watermark verification or fingerprint verification fails, the watermark or fingerprint has been tampered with. Feature integrity is not satisfied.

[0085] (d) Gradient consistency: Calculate the cosine similarity between the gradient of the current round and the gradient of the historical round. If the similarity is less than -0.5, it is judged as gradient direction reversal, which may be a label flipping attack. If the similarity is in [0.3, 0.7], it is judged as gradient drift, which may be a change in data distribution.

[0086] Based on the above four dimensions, the output judgment result is: "Insufficient capability", "Malicious attack", or "Uncertain and requires further investigation". An audit report is generated, which includes a description of suspicious behavior, the chain of evidence, and recommended actions (such as isolation, equipment upgrade, or re-examination).

[0087] Understandably, in addition to the dimensions mentioned above, the prediction accuracy of the currently generated features can be tested using a test set. The quality of the features can be judged based on the test results, and malicious attacks can be comprehensively judged based on changes in feature quality.

[0088] This invention can detect various threats, including Byzantine attacks, data poisoning attacks, label flipping attacks, and backdoor attacks, by analyzing client historical performance records, failure modes, feature integrity, and gradient consistency. Combined with audit logs and trust scores, it generates visualized audit reports and attack detection results, providing decision support for system administrators.

[0089] This invention allows clients that pass multi-layered auditing and attack detection to participate in local training and model aggregation. For example, in local training, generated features can be mixed with the real latent vectors corresponding to the local dataset to enhance the local dataset, train the local model, and output updated parameters after local training is completed, which are then uploaded to the server for model aggregation. The server receives the updated parameters uploaded by each client, aggregates the model parameters, and performs a new round of global model distribution.

[0090] The technical solution of the present invention will be described below with specific examples in specific application scenarios.

[0091] I. Malicious attack detection scenario.

[0092] In the 10th round of training, the model (client ID=8) was compromised by an external attacker who tampered with the local dataset, flipping 20% ​​of the labels (changing category 0 to category 1).

[0093] The server generates the watermarked potential vector and generated features according to the normal process. Because the watermark embedding process is transparent to the client, even if compromised, attackers cannot detect or remove the watermark.

[0094] An anomaly was found during server-side auditing: The first layer of watermark verification successfully decoded round ID=10 and client ID=8, and the watermark verification passed; the second layer of fingerprint verification showed that the client was using a MobileNetV2 model, and the historical fingerprints showed relatively small feature variance (characteristic of small models); the statistical characteristics of the current feature were consistent with the historical ones, and the fingerprint verification passed; the third layer of trust score management used the exponential moving average method to dynamically update the trust score.

[0095] Finally, attack detection was performed: the server used the golden validation set to test the generated features uploaded by the client. It was found that the prediction accuracy for category 0 plummeted from 88% to 45%, while the accuracy for category 1 rose from 87% to 98% (abnormally high), thus determining that the feature quality was abnormal. Further analysis of its gradient direction revealed a cosine similarity of -0.62 with historical rounds, indicating that the gradient direction was close to being reversed. The audit log recorded a complete chain of evidence: watermark integrity passed, fingerprint consistency passed, feature quality was abnormal, and the gradient direction was reversed, confirming a label flipping attack.

[0096] II. Scenarios where clients with insufficient capabilities are handling the situation.

[0097] Client ID=9 is using the MobileNetV2 model. The device is outdated and has limited network bandwidth. During the 12th training round, it failed to upload the model update on time due to a network timeout.

[0098] During server-side auditing, client 9 was found to be absent. Historical records showed a 100% pass rate for watermark and fingerprint verification in rounds 1-11, with a stable trust score around 0.88. The gradient direction was consistent with other clients, indicating no malicious behavior. Round 12 absence analysis revealed a single failure pattern (1 consecutive failure), with good historical performance, good feature integrity, and good gradient consistency. Overall, the client's absence was likely due to a temporary malfunction caused by insufficient capability, rather than malicious intent. The server slightly lowered this client's trust score to 0.85, not marking it as suspicious, and giving it another chance to participate. If the client recovers in round 13, its trust score will rise; only after a certain number of consecutive failures will it be marked as suspicious.

[0099] Example 3 Please see Figure 3 ,Figure 3 This is a schematic diagram of a trusted and traceable privacy-enhanced heterogeneous federated learning system provided as an embodiment of the present invention. Each client employs a heterogeneous local model; for example, client 1 uses a ResNet50 model, client 2 uses a CNN model, and client 3 uses a MobileNet model. The system includes: System initialization module: Deployed on the server side, it is used to initialize the watermark parameters of the pseudo-random code and generate the encoding key and decoding key; Watermark embedding module: Deployed on the client side, it is used to acquire metadata in each round of training and convert it into a message bit sequence. The message bit sequence is encoded and reshaped into a tensor using an encoding key to generate a watermarked potential tensor. Feature generation module: Deployed on the client side, it is used to perform back-diffusion iteration on the watermarked latent tensor through a pre-trained diffusion model to obtain generated features; Multi-layer auditing module: Deployed on the server side, it is used to receive the generated features uploaded by the client and perform multi-layer auditing on the client based on the generated features and the decoding key; Attack detection module: Deployed on the server side, it is used to extract multi-dimensional features of the client and combine them with the results of multi-layer auditing to detect whether the client has malicious behavior.

[0100] Understandably, a complete heterogeneous federated learning system can also include a local training module and a model aggregation and distribution module: Local training module: Deployed on the client, it is used to perform local training based on the local dataset and the synthetic data (generated features) obtained by the feature generation module. After local training is completed, it updates the parameters and outputs them, and uploads the local model parameters to the server. Model aggregation and distribution module: Deployed on the server side, it is used to receive local model parameters uploaded by various clients, aggregate model parameters, and distribute a new round of global models.

[0101] The trusted and traceable privacy-enhanced heterogeneous federated learning system described above can be referred to in correspondence with the trusted and traceable privacy-enhanced heterogeneous federated learning method described in the aforementioned method embodiments.

[0102] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440. The processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions stored in the memory 430 to execute a trusted, traceable, privacy-enhanced heterogeneous federated learning method provided in the above-described method embodiments.

[0103] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0104] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute a trusted and traceable privacy-enhanced heterogeneous federated learning method provided by the above-described method embodiments.

[0105] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform a trusted and traceable privacy-enhanced heterogeneous federated learning method provided in the above-described method embodiments.

[0106] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0107] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A trustworthy and traceable privacy-enhanced heterogeneous federated learning method, characterized in that, include: Initialize the watermark parameters of the pseudo-random code on the server side, and generate the encoding key and decoding key; The client obtains metadata from each round of training and converts it into a message bit sequence. The message bit sequence is then encoded and reshaped into a tensor using the encoding key to generate a watermarked potential tensor. The watermarked latent tensor is back-diffusion iterated using a pre-trained diffusion model to obtain generated features; The server receives the generated features uploaded by the client and performs multi-layer auditing on the client based on the generated features and the decoding key; Extract multi-dimensional features of the client and combine them with the results of the multi-layer audit to detect whether the client engages in malicious behavior.

2. The trusted and traceable privacy-enhanced heterogeneous federated learning method according to claim 1, characterized in that, The process of initializing the relevant parameters of the pseudo-random code on the server side and generating the encoding key and decoding key includes: On the server side, the potential vector dimension is determined based on the structure of the pre-selected diffusion model; The message length is determined based on the metadata collected during each training round by the client; wherein the metadata includes at least the training round, client ID, timestamp, and homogeneity level. Using the potential vector dimension, the message length, the preset sparsity parameter, and the watermark parameter of the pseudo-random code with the target false alarm rate, an encoding key and a decoding key are generated; wherein, the encoding key includes a generation matrix, a one-time key pad, test bits, and noise parameters, and the decoding key includes a parity check matrix, iteration parameters, and the content of the encoding key.

3. The trusted and traceable privacy-enhanced heterogeneous federated learning method according to claim 2, characterized in that, The step of encoding and tensor reshaping the message bit sequence using the encoding key to generate a watermarked potential tensor includes: The message bit sequence is linearly transformed using the generator matrix in the encoding key. The output of the linear transformation is XORed with the one-time key pad, and noise is added to generate a codeword with the same length as the dimension of the potential vector. Elements in the codeword are sampled, and the sampling results are reshaped and copied to generate a watermarked potential tensor.

4. The trusted and traceable privacy-enhanced heterogeneous federated learning method according to claim 1, characterized in that, The step of performing multi-layer auditing of the client based on the generated features and the decoding key includes: The generated feature is verified using the decoding key; Extract the fingerprint features from the generated features, and perform fingerprint verification based on the fingerprint features; Based on the results of the watermark verification and the fingerprint verification, the client's trust score is updated.

5. The trusted and traceable privacy-enhanced heterogeneous federated learning method according to claim 4, characterized in that, The step of watermarking the generated feature using the decoding key includes: Obtain the metadata of the current training round associated with the generated features from the dictionary on the server side; The generated feature is decoded using the decoding key to obtain the recovered message bit sequence; Extract the recovered metadata based on the recovered message bit sequence; Determine whether the recovered metadata is consistent with the metadata of the current training round. If so, the watermark verification passes; otherwise, mark it as watermark verification failure and record it in the audit log.

6. The trusted and traceable privacy-enhanced heterogeneous federated learning method according to claim 4, characterized in that, The step of extracting the fingerprint features from the generated features and performing fingerprint verification based on the fingerprint features includes: Extract the mean vector and variance vector of the generated features and perform dimension filtering to determine the fingerprint features of each dimension; The proportion of fingerprint features greater than a predetermined fingerprint threshold is counted. If the proportion is greater than the preset threshold, the fingerprint verification is successful; otherwise, it is marked as an abnormal fingerprint and recorded in the audit log.

7. The trusted and traceable privacy-enhanced heterogeneous federated learning method according to claim 4, characterized in that, Based on the results of the watermark verification and the fingerprint verification, the client's trust score is updated, including: If both the watermark verification and the fingerprint verification pass, the client's trust score is updated using the exponential moving average method based on the client's current confidence level and historical trust score. If either the watermark verification or the fingerprint verification fails, the client's trust score is lowered, and the number of consecutive failures is recorded. If the number of consecutive failures exceeds a preset threshold and the trust score is less than a preset threshold, the client is marked as a suspicious client, triggering a deep audit.

8. The trusted and traceable privacy-enhanced heterogeneous federated learning method according to claim 7, characterized in that, The step of extracting multi-dimensional features of the client and combining them with the results of the multi-layer audit to detect whether the client engages in malicious behavior includes: Extract the historical performance records, failure modes, and gradient direction consistency of the suspicious client. Combine these with the results of the multi-layer audit to determine whether the suspicious client is engaging in malicious behavior and generate an audit report. The failure modes include single failures and consecutive failures. The gradient direction consistency is measured based on the cosine similarity between the current round gradient and the historical round gradients.

9. A trustworthy and traceable privacy-enhanced heterogeneous federated learning system, characterized in that, The system includes: System initialization module: Deployed on the server side, it is used to initialize the watermark parameters of the pseudo-random code and generate the encoding key and decoding key; Watermark embedding module: Deployed on the client side, it is used to acquire metadata in each round of training and convert it into a message bit sequence. The message bit sequence is then encoded and reshaped into a tensor using the encoding key to generate a watermarked potential tensor. Feature generation module: Deployed on the client side, used to perform back-diffusion iteration on the watermarked latent tensor through a pre-trained diffusion model to obtain generated features; Multi-layer auditing module: Deployed on the server side, used to receive the generation features uploaded by the client, and perform multi-layer auditing on the client based on the generation features and the decoding key; Attack detection module: Deployed on the server side, it is used to extract multi-dimensional features of the client and, in combination with the results of the multi-layer audit, detect whether the client has malicious behavior.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the trusted and traceable privacy-enhanced heterogeneous federated learning method as described in any one of claims 1 to 8.

Images