Engineering project data security sharing collaboration method and system based on federated learning

Abstract

The invention relates to the technical field of engineering data sharing, in particular to an engineering project data security sharing collaboration method and system based on federated learning. The method comprises the following steps: acquiring an initial model gradient update parameter of each participant, and constructing an initial global model parameter data set; according to a multi-dimensional model security enhancement strategy, performing multi-dimensional security enhancement processing on the initial global model parameter data set, and determining an enhanced gradient update data set; the multi-dimensional security enhancement processing comprises anti-poisoning processing and anti-sensitive role inference processing; and performing aggregation processing on the enhanced gradient update data set, embedding a feature trap verification mechanism in the aggregation processing process, and generating and distributing a security enhancement global model. According to the method, the security of federated learning in the engineering data security sharing process can be comprehensively improved while the efficiency of the model is ensured, and the balance and unification of the security and the efficiency of the federated learning model are realized.

Description

Technical Field

[0001] This application relates to the field of engineering data sharing technology, and in particular to a collaborative method and system for secure sharing of engineering project data based on federated learning. Background Technology

[0002] Large-scale engineering projects involve multiple stakeholders, each holding a portion of the project data. This data is scattered and sensitive. If the project data is shared or centrally stored, it will face significant risks of leakage and misuse. Applying federated learning models in the process of project data sharing can realize the core concept of "the model moves while the data remains stationary." Each stakeholder only exchanges model update parameters, rather than the original data itself, which significantly enhances the security of the project data sharing process.

[0003] However, existing collaborative technologies for secure sharing of engineering project data based on federated learning cannot effectively address attacks targeting the federated learning model itself while ensuring model performance. This leads to an imbalance between the security and performance of federated learning, making it difficult to meet the comprehensive requirements of engineering data sharing for high precision, strong robustness, and real-time response. Summary of the Invention

[0004] This application provides a collaborative method and system for secure data sharing in engineering projects based on federated learning to address the aforementioned problems.

[0005] Firstly, this application provides a collaborative method for secure data sharing in engineering projects based on federated learning, the method comprising:

[0006] Obtain the initial model gradient update parameters for each participant and construct an initial global model parameter dataset; perform multi-dimensional security enhancement processing on the initial global model parameter dataset according to the multi-dimensional model security enhancement strategy to determine the enhanced gradient update dataset; the multi-dimensional security enhancement processing includes anti-poisoning processing and anti-sensitive role inference processing; perform aggregation processing on the enhanced gradient update dataset and embed a feature trap verification mechanism during the aggregation process to generate and distribute a security-enhanced global model.

[0007] This scheme constructs a unified initial global model parameter dataset based on the initial model gradient update parameters of each participant, blocking unauthorized access and format attacks. Building upon this, a multi-dimensional model security enhancement strategy, incorporating anti-poisoning and anti-sensitive role inference processing, is implemented. This strategy performs credibility analysis and screening of gradient parameters while obfuscating sensitive roles, establishing a dual defense mechanism against poisoning and sensitive role inference. Furthermore, by generating a security-enhanced global model with a feature trap verification mechanism, the final security-enhanced global model distributed to each participant possesses anti-theft capabilities. This approach comprehensively improves the security of federated learning during the secure sharing of engineering data, achieving a balance and unity between the security and performance of federated learning models, while ensuring model performance.

[0008] Optionally, obtaining the initial model gradient update parameters of each participant and constructing an initial global model parameter dataset includes: the initial model gradient update parameters are provided by the participants through a gradient parameter upload interface; before uploading the initial model gradient update parameters, the participants verify their identity through a zero-knowledge proof mechanism and verify the legality of their registration certificates to ensure that the participants have legitimate identities; after obtaining the initial model gradient update parameters of each participant, a forced format conversion is performed to unify them into a preset dimension tensor structure, and a circuit breaker mechanism is automatically triggered to reject data with missing or overflowing dimensions.

[0009] This solution utilizes zero-knowledge proof mechanisms to protect the privacy of participants (such as hiding company size) while ensuring identity trustworthiness, blocking unauthorized access at the source, reducing the risk of engineering data leakage, and using forced format conversion and circuit breaker mechanisms to defend against malformed data attacks, ensuring continuous service availability. Even when malicious data exists, it can still maintain normal aggregation of other participants. The preset dimensional tensor structure eliminates the impact of framework differences, supports seamless participation of multiple types of engineering models in federated training, and the chain verification of registration certificates meets the regulatory requirements of the engineering industry, providing a traceable basis for data sharing behavior.

[0010] Optionally, the multi-dimensional model security enhancement strategy includes: performing dynamic credibility analysis on each initial model gradient update parameter based on the initial global model parameter dataset; determining the retained gradient parameter set and the potential poisoning parameter set based on the credibility analysis results; injecting a covert verification task perturbation factor into the retained gradient parameter set according to the covert verification task perturbation mechanism to identify hidden backdoor attacks; triggering a gradient discarding mechanism based on the hidden backdoor attacks to determine the filtered gradient parameter set; and performing obfuscation processing on the filtered gradient parameter set according to the hierarchical gradient obfuscation mechanism to determine the obfuscated gradient parameter set, and using the obfuscated gradient parameter set as the enhanced gradient update dataset. Through this scheme, dynamic credibility analysis combined with multi-dimensional anomaly detection can identify progressive poisoning that traditional methods cannot capture. The covert verification task perturbation mechanism improves the detection rate of backdoor covert attacks in engineering projects while maintaining the main task. Hierarchical gradient obfuscation significantly increases the cost of role inference attacks, making it difficult for attackers to reverse-engineer core parameters through sensitive roles.

[0011] Optionally, the step of performing dynamic credibility analysis on each initial model gradient update parameter based on the initial global model parameter dataset, and determining the set of retained gradient parameters and the set of potential poisoning parameters based on the credibility analysis results, includes: analyzing the statistical distribution characteristics of the initial global model parameter dataset based on historical model data to determine the gradient magnitude distribution dispersion and historical trend deviation angle; analyzing the temporal continuity of gradient parameters within the initial global model parameter dataset to determine the gradient parameter mutation degree; generating a comprehensive credibility corresponding to each gradient parameter based on the gradient magnitude distribution dispersion, the historical trend deviation angle, and the gradient parameter mutation degree; constructing the set of retained gradient parameters by using gradient parameters higher than the dynamic credibility threshold as retained gradient parameters, and constructing the set of potential poisoning parameters by using gradient parameters lower than the dynamic credibility threshold as potential poisoning gradient parameters; the dynamic credibility threshold is adaptively adjusted according to the distribution of the comprehensive credibility corresponding to the gradient parameters provided by all participants in the current analysis round.

[0012] This solution utilizes three dynamic indicators—gradient amplitude distribution dispersion, historical trend deviation angle, and gradient parameter mutation degree—to analyze the reliability of gradient parameters, forming a three-dimensional defense network against data poisoning. It simultaneously identifies explicit poisoning (amplitude anomalies), chronic poisoning (trend deviations), and pulse attacks (mutation anomalies). Combined with dynamic reliability thresholds, it ensures that data reliability assessment remains highly robust across different types of engineering project scenarios, accurately removing data with potential poisoning risks and improving the security of data sharing in engineering projects.

[0013] Optionally, the covert verification task perturbation mechanism includes: constructing several verification subtasks that are unrelated to the current main task but have known output patterns; mapping the feature space corresponding to the verification subtask to the feature extraction layer of the main task model, and generating a micro-amplitude parameter perturbation direction for the verification subtask; according to the micro-amplitude parameter perturbation direction, superimposing the corresponding perturbation on the gradient parameters in the retained gradient parameter set, and determining the deviation impact of each perturbation on the output of the verification subtask; analyzing the deviation impact, and if the output pattern corresponding to the verification subtask deviates from the known output pattern, then the corresponding gradient parameter is determined to be a hidden backdoor attack, triggering the gradient discarding mechanism, removing the corresponding gradient parameter from the retained gradient parameter set, and constructing the filtered gradient parameter set.

[0014] This scheme utilizes a verifiable perturbation mechanism for the verification subtask to identify hidden backdoor attacks against the model without affecting the main task. The corresponding gradient parameters are then removed from the reserved gradient parameter set to construct a filtered gradient parameter set, thereby further improving data security.

[0015] Optionally, the hierarchical gradient obfuscation mechanism includes: dividing the filtered gradient parameter set into a core parameter set and a non-core parameter set according to preset participant sensitivity level information; performing the following triple obfuscation strategy on the core parameter set to determine the obfuscated core parameter set: performing random permutation of the parameter topology for gradient parameters with the same participant sensitivity level; injecting a Gaussian-distributed noise mask into the core parameter set, wherein the variance of the noise mask is negatively correlated with the stability of the corresponding gradient parameter in historical training; applying a differential privacy-based directional offset to the gradient update direction of each gradient parameter in the core parameter set, wherein the offset amount is positively correlated with the amount of data of the corresponding participant; performing the noise mask on the non-core parameter set to determine the obfuscated non-core parameter set; and integrating the obfuscated core parameter set and the obfuscated non-core parameter set to construct the obfuscated gradient parameter set.

[0016] This solution divides the participants into core parameter sets and non-core parameter sets based on their sensitivity levels. A triple obfuscation strategy is used to obfuscate the core parameter sets to blur the roles of the participants corresponding to them. The non-core parameter sets are also obfuscated to further blur the differences in sensitive roles between the core and non-core parameter sets, thereby blocking attackers from trying to infer key data through sensitive roles.

[0017] Optionally, the step of aggregating the enhanced gradient update dataset and embedding a feature trap verification mechanism during the aggregation process to generate and distribute a security-enhanced global model includes: performing unsupervised clustering on the enhanced gradient update dataset to identify several outlier gradient data clusters; calculating the cosine similarity between the center of each outlier gradient data cluster and the historical global model based on the historical global model, removing outlier gradient data clusters whose cosine similarity is lower than the mean similarity, and determining the retained outlier clusters; performing variance compression on the gradient parameters within the retained outlier clusters, and allocating aggregation weights to the gradient parameters according to the compressed data size, and performing weighted aggregation on the gradient parameters within the retained outlier clusters based on the allocated aggregation weights to determine the security-enhanced global model; embedding a task verification mechanism into the retained outlier clusters during the weighted aggregation of the gradient parameters within the retained outlier clusters according to the feature trap verification mechanism; and distributing the constructed security-enhanced global model to each of the participating parties after performing the weighted aggregation and the task verification mechanism embedding on the gradient parameters within the retained outlier clusters.

[0018] This scheme utilizes unsupervised clustering and cosine similarity dynamic filtering. It establishes a reliable benchmark using historical models and adaptively adjusts the elimination threshold through the mean similarity to retain necessary outliers and avoid misjudgments caused by static thresholds. On this basis, a feature trap verification mechanism is embedded in the aggregation process to achieve time synchronization of safety and efficiency. The task verification mechanism synchronously checks the state of decoy neurons in the weighted aggregation to avoid response delays caused by post-verification.

[0019] Optionally, the feature trap verification mechanism includes: embedding a set of decoy feature neurons into a specific hidden layer during the current gradient parameter aggregation process; the activation of the decoy feature neurons requires the following conditions to be met simultaneously: the input is an artificially constructed invalid feature combination; the output mode is preset to a constant oscillation signal; during the next round of gradient parameter aggregation process, each participant is forced to feed back the local gradient parameters corresponding to the decoy feature neurons; the local gradient parameters are analyzed, and if an abnormal gradient amplitude or a destroyed oscillation mode is detected, it is determined that the participant has committed model reverse stealing behavior, the participant's model access permission is immediately terminated and a corresponding warning message is output.

[0020] This scheme embeds decoy feature neurons with special activation conditions during gradient parameter aggregation. It can detect and block potential model reverse attacks in real time, suppressing the risk of data leakage at the nascent stage. The decoy neurons are independent of the main task feature space, avoiding security mechanisms from interfering with normal model convergence.

[0021] Optionally, the method further includes: generating a unique participant key for each participant based on the identity information of each participant; embedding a corresponding digital watermark into the security-enhanced global model based on the unique participant key during the weighted aggregation of gradient parameters within the retained outlier cluster; locating and tracing the participant initiating the model reverse theft behavior based on the digital watermark when the model reverse theft behavior is detected; and re-embedding a new digital watermark into the security-enhanced global model based on the new key generated for each participant during each round of weighted aggregation.

[0022] This scheme utilizes a mechanism that generates dynamic watermarks by updating keys in each round to establish a timely defense barrier, preventing attackers from building effective denoising models. At the same time, it strongly binds the unique participant's key to the watermark, establishing an identity-model mapping relationship. Combined with the embedding of weighted aggregation timing, it ensures deep integration of watermarks and model parameters, enabling accurate tracing of abnormal participants.

[0023] Secondly, this application provides a collaborative system for secure data sharing in engineering projects based on federated learning, the system comprising:

[0024] The initial analysis module is used to obtain the initial model gradient update parameters for each participant and construct the initial global model parameter dataset.

[0025] The security enhancement module is used to perform multidimensional security enhancement processing on the initial global model parameter dataset according to the multidimensional model security enhancement strategy, and determine the enhanced gradient update dataset.

[0026] The aggregation and distribution module is used to aggregate the enhanced gradient update dataset and embed a feature trap verification mechanism during the aggregation process to generate and distribute a secure enhanced global model. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram of an application scenario provided in an embodiment of this application;

[0029] Figure 2 A flowchart illustrating a collaborative method for secure data sharing in engineering projects based on federated learning, provided as an embodiment of this application;

[0030] Figure 3 This is a schematic diagram of the structure of a collaborative system for secure data sharing in engineering projects based on federated learning, provided as an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0032] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0033] The embodiments of this application will now be described in further detail with reference to the accompanying drawings.

[0034] Existing technologies for secure sharing and collaboration of engineering project data based on federated learning cannot effectively address attacks targeting the federated learning model itself while ensuring model performance. This leads to an imbalance between the security and performance of federated learning, making it difficult to meet the comprehensive requirements of engineering data sharing for high precision, strong robustness, and real-time response.

[0035] Based on this, this application provides a collaborative method and system for secure sharing of engineering project data based on federated learning. It uniformly constructs an initial global model parameter dataset by updating the initial model gradient parameters of each participant, blocking unauthorized access and format attacks. On this basis, through a multi-dimensional model security enhancement strategy including anti-poisoning processing and anti-sensitive role inference processing, it performs credibility analysis and screening of gradient parameters while obfuscating sensitive roles, establishing a dual defense mechanism against poisoning and sensitive role inference. Furthermore, by generating a security-enhanced global model with a feature trap verification mechanism, the final security-enhanced global model distributed to each participant has anti-theft capabilities. While ensuring model performance, it comprehensively improves the security of federated learning in the process of secure sharing of engineering data, achieving a balance and unity between the security and performance of the federated learning model.

[0036] Figure 1This application provides an illustration of an application scenario. When various participants in an engineering project collaborate on data sharing, the method provided in this application is applied to comprehensively improve the security of federated learning in the process of secure data sharing, and to achieve a balance and unity between the security and performance of the federated learning model.

[0037] Specifically, the method provided in this application is applied to any server that interacts with the participating parties. The server obtains the initial model gradient update parameters provided by each participant. Based on these parameters, a unified initial global model parameter dataset is constructed to block unauthorized access and format attacks. Furthermore, a multi-dimensional model security enhancement strategy, incorporating anti-poisoning and anti-sensitive role inference processing, is implemented. This strategy performs credibility analysis and screening of gradient parameters while obfuscating sensitive roles, establishing a dual defense mechanism against poisoning and sensitive role inference. Finally, a security-enhanced global model with a feature trap verification mechanism is generated, ensuring that the final model distributed to each participant is resistant to theft. This comprehensively improves the security of federated learning during the secure sharing of engineering data, achieving a balance and unity between the security and performance of the federated learning model. Specific implementation details can be found in the following embodiments.

[0038] Figure 2 This is a flowchart illustrating a method for secure data sharing and collaboration in engineering projects based on federated learning, as provided in one embodiment of this application. The method of this embodiment can be applied to servers in the above scenarios. Figure 2 As shown, the method includes:

[0039] S201. Obtain the initial model gradient update parameters for each participant and construct the initial global model parameter dataset.

[0040] The initial model gradient update parameters can refer to the gradient parameters (such as partial derivatives of weights) generated after training the local models of each participant. These parameters are used to update the global model and originate from the training results of the participants' local private data.

[0041] The initial global model parameter dataset can be a collection of gradient parameters uploaded by all participants, serving as the input source for federated learning, derived from the aggregated data from the gradient parameter upload interface.

[0042] Specifically, in engineering projects, different stakeholders (such as design institutes and construction companies) hold different sensitive data (such as BIM models and construction logs). Directly sharing raw data can lead to leakage risks. Federated learning achieves "data remains unchanged, model moves" by exchanging only gradient parameters. However, the following risks exist in the federated learning data construction process: identity forgery risk: attackers may impersonate legitimate stakeholders and upload malicious parameters; parameter format attacks: inconsistent gradient dimensions can cause model crashes (such as dimension overflow causing memory errors). Therefore, it is necessary to authenticate each parameter provider during the parameter construction phase and then perform a unified format conversion on the gradient parameters provided by different stakeholders to obtain an initial global model parameter dataset, thereby blocking unauthorized access and format attacks from the source.

[0043] S202. Based on the multidimensional model security enhancement strategy, perform multidimensional security enhancement processing on the initial global model parameter dataset to determine the enhanced gradient update dataset.

[0044] Multidimensional model security enhancement strategies can be a combination of anti-poisoning measures and anti-sensitive role inference measures.

[0045] Multidimensional security enhancement measures include anti-poisoning measures and anti-sensitive role inference measures.

[0046] Anti-poisoning measures can be a means of defending against malicious gradient parameter tampering attacks.

[0047] Sensitive role inference processing can be a means to prevent attackers from back-inferring the characteristics of participants' data through gradients.

[0048] The enhanced gradient update dataset can be a set of gradient parameters that has been securely processed, possessing multiple anti-attack characteristics.

[0049] Specifically, existing technologies cannot effectively defend against attacks targeting federated learning models while ensuring model performance. Key attacks against federated learning models include poisoning attacks and sensitive role inference. Poisoning attacks involve attackers injecting malicious gradients (e.g., intentionally shifting gradient directions) to disrupt model convergence, while sensitive role inference involves attackers inferring participant data attributes through gradient analysis (e.g., inferring sensitive accident information from construction gradients). To address these attacks, a multi-dimensional model security enhancement strategy incorporating anti-poisoning and anti-sensitive role inference measures is employed. This strategy performs credibility analysis and screening of gradient parameters while obfuscating sensitive roles, establishing a dual defense mechanism against both poisoning and sensitive role inference to achieve a balance between the security and performance of federated learning models.

[0050] S203. Aggregate the enhanced gradient update dataset and embed a feature trap verification mechanism during the aggregation process to generate and distribute a secure enhanced global model.

[0051] Aggregation processing can be the process of integrating the local model update gradients trained by multiple participants into a unified global model update.

[0052] Feature trap verification mechanisms can be mechanisms that embed decoy neurons during the aggregation process to detect reverse theft behavior in the model.

[0053] A security-enhanced global model can be a global model with attack resistance generated after aggregation and trap verification.

[0054] Specifically, traditional federated learning aggregation processes lack defenses against model theft. Attackers could potentially steal the global model through reverse engineering, reconstructing private data from participating parties. This model theft directly leads to the leakage of core project data (such as bridge stress parameters). This step addresses this by embedding decoy neurons during the gradient update data aggregation process to detect reverse model theft behavior. This generates a security-enhanced global model with a feature trap verification mechanism, making the final security-enhanced global model distributed to each participating party resistant to theft.

[0055] This scheme constructs a unified initial global model parameter dataset based on the initial model gradient update parameters of each participant, blocking unauthorized access and format attacks. Building upon this, a multi-dimensional model security enhancement strategy, incorporating anti-poisoning and anti-sensitive role inference processing, is implemented. This strategy performs credibility analysis and screening of gradient parameters while obfuscating sensitive roles, establishing a dual defense mechanism against poisoning and sensitive role inference. Furthermore, by generating a security-enhanced global model with a feature trap verification mechanism, the final security-enhanced global model distributed to each participant possesses anti-theft capabilities. This approach comprehensively improves the security of federated learning during the secure sharing of engineering data, achieving a balance and unity between the security and performance of federated learning models, while ensuring model performance.

[0056] In some embodiments, the initial model gradient update parameters are provided by the participants through the gradient parameter upload interface. Before uploading the initial model gradient update parameters, the participants are authenticated through a zero-knowledge proof mechanism, and the legality of the registration certificate held by the participants is verified to ensure that the participants have legitimate identities. After obtaining the initial model gradient update parameters of each participant, a forced format conversion is performed to unify them into a preset dimension tensor structure. Data with missing or overflowing dimensions is automatically rejected by the circuit breaker mechanism.

[0057] The gradient parameter upload interface can be a dedicated communication channel provided by the federated learning server, supporting encrypted transmission and protocol parsing. The source is the RESTful API interface designed by the system and follows the OAuth 2.0 security specification (such as the commonly used interface standard of industrial IoT platforms).

[0058] Zero-knowledge proof mechanisms can be cryptographic protocols that allow participants to verify the authenticity of an identity without revealing their identity information. The source adopts the zk-SNARKs scheme (derived from Zcash blockchain technology) and generates short proofs for the server to verify.

[0059] The registration certificate can be a digital certificate issued by a trusted Certificate Authority (CA), containing the participant's public key and identity metadata, originating from the X.509 standard (such as the PKI system in the engineering field), and generated during the participant's registration phase.

[0060] Forced format conversion can be a standardized operation that converts heterogeneous gradient data into fixed-dimensional tensors. This can be done using tensor processing libraries (such as PyTorch's reshape function), with the preset dimensions defined according to the global model structure.

[0061] The preset dimension tensor structure can be a uniform data shape (such as [batch_size, feature_dim]) with specified gradient parameters, which comes from the federated learning initialization configuration and is set according to the dimension of the model input layer.

[0062] Circuit breaking mechanisms can be a protective strategy that triggers immediate rejection of abnormal data. They originate from microservice architecture design patterns and automatically block illegal requests through threshold detection.

[0063] Specifically, in the process of data sharing in engineering projects, the reliable acquisition of initial model gradient update parameters is the first line of defense for federated learning security. Engineering projects involve multiple companies (such as design institutes and construction companies), and attackers may forge identities to inject malicious gradients. Zero-knowledge proof mechanisms ensure the authenticity of participants while preventing the leakage of identity information (such as company names and data scale), complying with engineering data confidentiality agreements. Without this mechanism, attackers can impersonate legitimate participants to launch poison attacks, compromising the reliability of the global model. Different participants using heterogeneous frameworks (such as TensorFlow / PyTorch) lead to differences in gradient structures. Forced format conversion solves aggregation compatibility issues and avoids model crashes caused by dimensional conflicts. For example, the gradient dimensions of structural design models and material testing models differ significantly; unifying them to preset tensors ensures the feasibility of subsequent aggregation. Engineering data is highly sensitive (such as BIM model parameters), and attackers may construct abnormal dimensional data (such as excessively long gradient vectors) to trigger buffer overflow vulnerabilities. Circuit breaking mechanisms intercept abnormal dimensional data in real time to prevent service paralysis. In large-scale projects (such as bridge monitoring), a single malicious attack can cause the global model to fail; circuit breaking mechanisms provide critical fault tolerance capabilities. Registration certificate verification ensures that participating parties meet the security requirements corresponding to their engineering data sharing qualifications. If the legality of the certificate is not verified, unqualified parties may obtain model parameters to derive sensitive data (such as geological exploration results), which could lead to legal disputes.

[0064] This solution utilizes zero-knowledge proof mechanisms to protect the privacy of participants (such as hiding company size) while ensuring identity trustworthiness, blocking unauthorized access at the source, reducing the risk of engineering data leakage, and using forced format conversion and circuit breaker mechanisms to defend against malformed data attacks, ensuring continuous service availability. Even when malicious data exists, it can still maintain normal aggregation of other participants. The preset dimensional tensor structure eliminates the impact of framework differences, supports seamless participation of multiple types of engineering models in federated training, and the chain verification of registration certificates meets the regulatory requirements of the engineering industry, providing a traceable basis for data sharing behavior.

[0065] In some embodiments, based on the initial global model parameter dataset, dynamic credibility analysis is performed on each initial model gradient update parameter. Based on the credibility analysis results, a set of retained gradient parameters and a set of potential poisoning parameters are determined. According to the covert verification task perturbation mechanism, a covert verification task perturbation factor is injected into the retained gradient parameter set to identify hidden backdoor attacks. Based on the hidden backdoor attacks, a gradient discarding mechanism is triggered to determine the filtered gradient parameter set. According to the hierarchical gradient obfuscation mechanism, the filtered gradient parameter set is obfuscated to determine the obfuscated gradient parameter set, and the obfuscated gradient parameter set is used as the enhanced gradient update dataset.

[0066] Dynamic credibility analysis can be a process of evaluating credibility in real time based on the statistical characteristics of gradient parameters. It originates from a federated learning security framework (such as the credibility assessment module of the FATE platform) and trains a credibility discrimination model through historical model data.

[0067] The set of gradient parameters to be retained can be a set of highly reliable gradient parameters selected through confidence analysis.

[0068] The potential poisoning parameter set can be a set of low-confidence gradient parameters identified by confidence analysis, which may be potentially malicious poisoning data.

[0069] The covert verification task perturbation mechanism can be a defense mechanism that detects hidden backdoors by injecting verification task perturbation factors.

[0070] Gradient discarding mechanism can be a security policy that executes immediate discarding of detected malicious gradient parameters.

[0071] The filtered gradient parameter set can be a safe gradient set cleaned by the hidden verification task perturbation mechanism.

[0072] A hierarchical gradient obfuscation mechanism is a technique that differentiates gradient obfuscation based on the sensitivity level of the participating parties' roles.

[0073] The obfuscated gradient parameter set can be a set of gradient parameters that has undergone hierarchical obfuscation, thus blurring the sensitivity of roles.

[0074] Specifically, if a malicious gradient is injected into an engineering project model (such as a bridge stress prediction model), it can lead to the failure of structural safety assessment. Dynamic credibility analysis can effectively capture poisoning behavior by monitoring the gradient amplitude distribution dispersion (reflecting abnormal parameter amplitudes), historical trend deviation angle (detecting abrupt changes in gradient direction), and gradient parameter abruptness (identifying temporal anomalies) in real time. Backdoors in engineering models (such as disabling the detection of specific material defects) are often hidden in normal gradients. The hidden verification task perturbation mechanism injects micro-perturbations (<0.1% parameter change) into the gradient by constructing verification sub-tasks unrelated to the main task (such as randomly rotating BIM model components to generate verification images), and observes whether the output deviates from the known pattern (such as the component should be identified as "abnormal" after rotation). When the hidden backdoor implanted by the attacker (such as ignoring cracks at a specific angle) is activated by the perturbation, the abnormal output will trigger the gradient discard mechanism. The gradients of project participants (such as general contractors) may leak trade secrets (such as bidding strategies). The hierarchical gradient obfuscation mechanism implements multiple protections for the core parameter set based on the preset sensitivity level information of the participants (such as marking design institutes as highly sensitive). It changes the gradient parameter structure (such as rearranging the gradients of convolutional layers into fully connected layer structures) to prevent inference of data features through parameter positions; it injects high-variance Gaussian noise into parameters with low stability (such as frequently changing optimizer momentum) to increase the difficulty of inference; and it adjusts the offset according to the amount of data of the participants (such as the gradient offset of construction parties with large amounts of data is larger) to balance privacy and model accuracy.

[0075] This solution combines dynamic credibility analysis with multi-dimensional anomaly detection to identify progressive poisoning that traditional methods cannot capture. The covert verification task perturbation mechanism improves the detection rate of covert backdoor attacks in engineering projects while maintaining the main task. The hierarchical gradient obfuscation significantly increases the cost of role inference attacks, making it difficult for attackers to reverse-engineer core parameters through sensitive roles.

[0076] In some embodiments, based on historical model data, the statistical distribution characteristics of the initial global model parameter dataset are analyzed to determine the gradient magnitude distribution dispersion and historical trend deviation angle; the temporal continuity of gradient parameters within the initial global model parameter dataset is analyzed to determine the gradient parameter mutation degree; based on the gradient magnitude distribution dispersion, historical trend deviation angle, and gradient parameter mutation degree, a comprehensive credibility corresponding to each gradient parameter is generated; gradient parameters higher than the dynamic credibility threshold are used as reserved gradient parameters to construct a reserved gradient parameter set, and gradient parameters lower than the dynamic credibility threshold are used as potential poisoning gradient parameters to construct a potential poisoning parameter set; the dynamic credibility threshold is adaptively adjusted according to the distribution of comprehensive credibility corresponding to the gradient parameters provided by all participants in the current analysis round.

[0077] Historical model data can refer to the global model parameter dataset accumulated in the historical training rounds of federated learning, which comes from past training records stored in the system database (such as model version snapshots in MongoDB).

[0078] Statistical distribution characteristics can be the regularity of the gradient parameters in their numerical distribution.

[0079] The gradient magnitude distribution dispersion can be an indicator (such as standard deviation) that reflects the degree of dispersion of the absolute value of the gradient parameter. The larger the value, the more gradient outliers there are.

[0080] The historical trend deviation angle can be the angle between the current gradient direction and the historical average gradient direction (unit: degrees).

[0081] The gradient parameter mutation rate can be a quantitative indicator of the gradient change rate between adjacent training rounds.

[0082] Overall credibility can be a gradient reliability score (0-10 points) generated by integrating multiple dimensions of indicators.

[0083] A dynamic credibility threshold can be an adaptively changing credibility boundary.

[0084] Specifically, historical model data is loaded, and gradient parameters from the most recent N rounds (e.g., N=50) are extracted. The ratio of the overall standard deviation to the mean is calculated as the gradient magnitude distribution dispersion. The historical gradient mean vector is calculated, and the cosine similarity between the current gradient vector and the historical vector is obtained. The cosine similarity is then converted into an angle value using the inverse cosine function to quantify the historical trend deviation angle. Based on the gradient data from the most recent K rounds (e.g., K=5), the rate of change of Euclidean distance between adjacent rounds is calculated. The second derivative of the rate of change sequence is performed to quantify the gradient parameter mutation degree. On this basis, a three-dimensional scoring matrix is ​​constructed: dispersion > 0.4 → confidence deduction of 4 points, deviation angle > 20° → confidence deduction of 3 points, mutation degree > 150% → confidence deduction of 5 points. Simultaneously, a scoring matrix is ​​overlaid. The system assigns weights to different scenarios, increasing the weight of abrupt changes for high-risk scenarios (such as nuclear power plant monitoring) and decreasing the weight of dispersion for highly heterogeneous scenarios (such as multinational projects). It calculates the overall credibility scores for the current round, generates a distribution histogram, and calculates statistics (such as median and quartiles). The threshold positions are adjusted according to the project stage: for the scheme design stage, the upper quartile is used; for the construction change stage, the median is used. The dynamic credibility corresponding to each gradient parameter is compared with the adjusted dynamic threshold. Gradient parameters higher than the dynamic credibility threshold are retained as retained gradient parameters, forming a retained gradient parameter set. Gradient parameters lower than the dynamic credibility threshold are considered potential poisoning gradient parameters, forming a potential poisoning parameter set, thus eliminating data with potential poisoning risks.

[0085] This solution utilizes three dynamic indicators—gradient amplitude distribution dispersion, historical trend deviation angle, and gradient parameter mutation degree—to analyze the reliability of gradient parameters, forming a three-dimensional defense network against data poisoning. It simultaneously identifies explicit poisoning (amplitude anomalies), chronic poisoning (trend deviations), and pulse attacks (mutation anomalies). Combined with dynamic reliability thresholds, it ensures that data reliability assessment remains highly robust across different types of engineering project scenarios, accurately removing data with potential poisoning risks and improving the security of data sharing in engineering projects.

[0086] In some embodiments, several verification subtasks that are unrelated to the current main task but have known output patterns are constructed; the feature space corresponding to the verification subtask is mapped to the feature extraction layer of the main task model, and a small-amplitude parameter perturbation direction is generated for the verification subtask; according to the small-amplitude parameter perturbation direction, the corresponding perturbation is superimposed on the gradient parameters in the reserved gradient parameter set, and the deviation impact of each perturbation on the output of the verification subtask is determined; the deviation impact is analyzed, and if the output pattern corresponding to the verification subtask deviates from the known output pattern, the corresponding gradient parameter is determined to be a hidden backdoor attack, triggering the gradient discarding mechanism, removing the corresponding gradient parameter from the reserved gradient parameter set, and constructing a filtered gradient parameter set.

[0087] The main task can be the main learning task of each participant's local model.

[0088] The verification subtask can be an auxiliary detection task that is artificially constructed and is unrelated to the main learning task, and has a preset output mode.

[0089] The known output pattern can be the preset correct output pattern corresponding to the verification subtask.

[0090] Feature space mapping can be the process of associating the input features of the validation subtask with the feature extraction layer of the main model.

[0091] The direction of the micro-amplitude parameter perturbation can be a small adjustment vector (amplitude < 0.1%) applied to the gradient parameters, derived from the gradient descent optimization principle, and generated by calculating and verifying the negative gradient direction of the task loss function.

[0092] Deviation effect can be the degree of difference between the output of the verification task and the preset mode after the perturbation injection.

[0093] Specifically, firstly, several sets of invalid feature combinations (such as random noise + engineering labels) are generated, and the output mode of the invalid feature combinations is defined as a constant oscillating signal (such as a sine wave), thus constructing a validation subtask. Next, the feature extraction layer of the main model (such as the third convolutional block of ResNet50) is located, and a mapping channel is established from the validation task input to the feature layer. Through this mapping channel, the input features of the validation subtask are associated with the feature extraction layer of the main model. The gradient direction of the validation task loss function is quantized, and the gradient magnitude is compressed to 0.05-0.1% of the original parameters, generating a micro-amplitude parameter perturbation direction. Then, the perturbation vector is superimposed on the retained gradient parameter set, while keeping the gradient direction of the main task unchanged. The validation subtask is run to obtain the actual output, and the difference between the actual output and the oscillating signal is calculated (through the inverse of cosine similarity). When the difference exceeds a threshold (such as KL divergence > 0.25), the corresponding gradient parameter is removed from the retained gradient parameter set, thus constructing a filtered gradient parameter set.

[0094] This scheme utilizes a verifiable perturbation mechanism for the verification subtask to identify hidden backdoor attacks against the model without affecting the main task. The corresponding gradient parameters are then removed from the reserved gradient parameter set to construct a filtered gradient parameter set, thereby further improving data security.

[0095] In some embodiments, based on preset participant sensitivity level information, the filtered gradient parameter set is divided into a core parameter set and a non-core parameter set. The following triple obfuscation strategy is applied to the core parameter set to determine the obfuscated core parameter set: for gradient parameters with the same participant sensitivity level, a random permutation of the parameter topology is performed; a Gaussian-distributed noise mask is injected into the core parameter set, where the variance of the noise mask is negatively correlated with the stability of the corresponding gradient parameter in historical training; a differential privacy-based directional offset is applied to the gradient update direction of each gradient parameter within the core parameter set, where the offset amount is positively correlated with the amount of data from the corresponding participant; noise masking is applied to the non-core parameter set to determine the obfuscated non-core parameter set; and the obfuscated core parameter set and the obfuscated non-core parameter set are integrated to construct the obfuscated gradient parameter set.

[0096] The preset sensitivity level information of the participants can be a pre-set data sensitivity classification identifier for each participant (e.g., design institute = level 1, material supplier = level 3), which is derived from the project confidentiality agreement (e.g., the annex to the FIDIC contract conditions) and is initialized by the project data security officer.

[0097] The core parameter set can be a subset of gradient parameters provided by highly sensitive participants.

[0098] The non-core parameter set can be a subset of gradient parameters provided by low-sensitivity participants.

[0099] The obfuscated core parameter set can be the obfuscated core parameter set.

[0100] Random permutation of parameter topology can be a data scrambling process that changes the arrangement of gradient parameter space. It originates from scrambling algorithms in cryptography (such as the AES permutation box principle) and is achieved by changing the order of tensor dimensions.

[0101] A noise mask that follows a Gaussian distribution can be a privacy protection method for random noise that follows a normal distribution, originating from a differential privacy framework (such as the Google RAPPOR scheme), where the noise variance is adaptively adjusted based on parameter stability.

[0102] Differential privacy directional offset can be a data obfuscation process that adjusts the gradient direction according to the proportion of data volume of the participants. It originates from differential privacy theory (Dwork 2006) and achieves offset quantization through the Laplace mechanism.

[0103] The obfuscated non-core parameter set can be an obfuscated non-core parameter set.

[0104] Specifically, the process loads preset sensitivity level information and splits the filtered gradient parameter set into a core parameter set (sensitivity levels 1-2 participants) and a non-core parameter set (sensitivity levels 3-5 participants). For the core parameter set, the gradient parameter space structure (e.g., [height × width × channel]) is identified, and the dimensional order is randomly rearranged (e.g., replacing [height × width × channel] with [width × channel × height]). Historical training stability (e.g., parameter volatility in the last 50 rounds) is analyzed. High-variance noise (e.g., variance = 0.3) is injected into high-variance parameters, and low-variance noise (e.g., variance = 0.05) is injected into stable parameters. The data volume of each participant is extracted (e.g., construction party = 10TB, supervision party = 1GB), and the offset angle is calculated proportionally to the data volume (0.8° offset per TB of data). The gradient update direction is then rotated based on the offset angle. For the non-core parameter set, only adaptive noise injection is performed, using a uniform variance threshold (e.g., variance = 0.1). The processed core and non-core sets are merged to generate a confused gradient parameter set.

[0105] This solution divides the participants into core parameter sets and non-core parameter sets based on their sensitivity levels. A triple obfuscation strategy is used to obfuscate the core parameter sets to blur the roles of the participants corresponding to them. The non-core parameter sets are also obfuscated to further blur the differences in sensitive roles between the core and non-core parameter sets, thereby blocking attackers from trying to infer key data through sensitive roles.

[0106] In some embodiments, unsupervised clustering is performed on the enhanced gradient update dataset to identify several outlier gradient data clusters; based on the historical global model, the cosine similarity between the center of each outlier gradient data cluster and the historical global model is calculated, and outlier gradient data clusters with cosine similarity lower than the mean similarity are removed to determine the retained outlier clusters; the gradient parameters within the retained outlier clusters are subjected to variance compression, and the gradient parameters are aggregated and weighted according to the compressed data size, and the gradient parameters within the retained outlier clusters are weighted and aggregated according to the allocated aggregation weights to determine the security-enhanced global model; during the weighted aggregation of the gradient parameters within the retained outlier clusters, a task verification mechanism is embedded in the retained outlier clusters according to the feature trap verification mechanism; after the weighted aggregation and task verification mechanism embedding of the gradient parameters within the retained outlier clusters, the constructed security-enhanced global model is distributed to each of the participating parties.

[0107] Unsupervised clustering can be a gradient parameter grouping process that does not rely on predefined labels. It originates from machine learning clustering algorithms (such as DBSCAN) and automatically identifies similar parameter groups through the spatial density of gradient parameters.

[0108] Outlier gradient data clusters can be subsets of gradient parameters that significantly deviate from the main population in cluster analysis. They originate from the output of clustering algorithms and have a data point density lower than a preset threshold (e.g., <5 points / unit space).

[0109] The historical global model can be a global model version generated from the historical training rounds of federated learning, sourced from a model version database (such as 50 historical model snapshots stored in MongoDB).

[0110] The mean similarity can be the arithmetic mean of the cosine similarities of all outlier clusters in the current round.

[0111] Outlier clusters can be the effective outlier gradient groups filtered by cosine similarity.

[0112] Variance compression can be a standardization technique to reduce the fluctuation of gradient parameters. It originates from data preprocessing methods (such as Z-score standardization) and compresses the parameter variance to the target range.

[0113] Aggregate weight allocation can be a strategy that determines gradient contribution weights based on the data size.

[0114] Weighted aggregation can be a fusion process that integrates gradient parameters according to their weights.

[0115] Embedding a task verification mechanism can be an operation that inserts verification logic into the aggregation process.

[0116] Specifically, the high sensitivity of engineering data necessitates strict filtering of malicious parameters. However, excessive removal of outliers can lead to the loss of innovative features in the data. For example, when a participant provides new construction process parameters, although its gradient deviates from the mainstream, its similarity is still higher than the mean, allowing it to be retained to enhance the model's innovativeness. Engineering projects have extremely high real-time requirements, but traditional security mechanisms require additional verification latency. Outliers may contain high-value but high-variance parameters (such as data from sudden geological disasters), and direct aggregation can compromise model stability. To address these issues, density-based clustering analysis (such as DBSCAN) is performed on the enhanced gradient update dataset to automatically identify outlier gradient data clusters whose statistical characteristics deviate from the mainstream. Feature vectors from the historical global model are extracted as a benchmark, and the cosine similarity of the center vector of each outlier cluster is calculated. The arithmetic mean of the similarities of all outliers in the current round is dynamically calculated, and clusters below this value are removed (e.g., similarity 0.35 < mean 0.6 is discarded). Scaling transformations are applied to the gradient parameters within the retained outliers to compress the variance to a preset range (e.g., limiting fluctuations to ±50%). The effective data volume from each gradient parameter source is counted, and aggregation weights are allocated proportionally to the data volume (e.g., a weight of 0.3 is assigned if the data volume accounts for 30%). During the weighted average aggregation of the gradient parameter directions based on the aggregation weights, a task verification mechanism is embedded to construct a security-enhanced global model, which is then distributed to all participants via an encrypted channel.

[0117] This scheme utilizes unsupervised clustering and cosine similarity dynamic filtering. It establishes a reliable benchmark using historical models and adaptively adjusts the elimination threshold through the mean similarity to retain necessary outliers and avoid misjudgments caused by static thresholds. On this basis, a feature trap verification mechanism is embedded in the aggregation process to achieve time synchronization of safety and efficiency. The task verification mechanism synchronously checks the state of decoy neurons in the weighted aggregation to avoid response delays caused by post-verification.

[0118] In some embodiments, during the current gradient parameter aggregation process, a set of decoy feature neurons are embedded into a specific hidden layer. The activation of the decoy feature neurons requires the following conditions to be met simultaneously: the input is an artificially constructed invalid feature combination; the output mode is preset to a constant oscillation signal; in the next round of gradient parameter aggregation, each participant is forced to feed back the local gradient parameters of the corresponding decoy feature neurons; the local gradient parameters are analyzed, and if an abnormal gradient amplitude or a destroyed oscillation mode is detected, it is determined that a participant has committed model reverse stealing behavior, the participant's model access permission is immediately terminated, and a corresponding warning message is output.

[0119] A specific hidden layer can be a hidden layer in the global model.

[0120] Decoy feature neurons can be virtual neuron nodes that are artificially implanted into the hidden layer of the model. Their function is unrelated to the main task and is dedicated to security monitoring.

[0121] Artificially constructed invalid feature combinations can be artificially synthesized feature vectors whose value combinations are impossible to appear in actual data, and are used to trigger decoy neurons.

[0122] The constant oscillation signal can be a preset periodic output waveform (such as a sine wave) as a normal response benchmark for the decoy neuron.

[0123] The local gradient parameter can be the gradient update value of the decoy neuron generated after the participant's local training.

[0124] Gradient magnitude anomalies can be an abnormal situation where the local gradient value exceeds the historical reasonable fluctuation range (such as a sudden increase of 300%).

[0125] Disruption of the oscillation mode can occur when the output signal loses its periodic characteristics (such as waveform disorder or constant amplitude).

[0126] Model reverse engineering can be a malicious act by an attacker who reverse-engineers the features of the original data by analyzing gradient parameters.

[0127] Model access permissions can be the permissions for participants to access the global model and participate in subsequent training.

[0128] Warning messages can be used to remind system maintenance personnel.

[0129] Specifically, traditional solutions rely on static parameter auditing, but reverse engineering attacks can mask the theft behavior through small gradient perturbations. This solution constructs a secure verification channel independent of the main task using decoy neurons, making it difficult for attackers to identify and circumvent. When an attacker attempts to reverse engineer the model, its gradient update will inevitably perturb the oscillation mode of the decoy neurons (there is a strong causal relationship between the theft behavior and the disruption of the oscillation signal). Decoy neurons are inserted into specific hidden layers of the global model (such as fully connected layers), and their weights are initialized to random non-zero values. Input vectors with all zero feature values ​​or exceeding the sensor's range (such as a temperature value of -100°C) are generated to construct invalid feature combinations. The output is set as a sine wave with an amplitude of ±1 and a frequency of 5Hz as the baseline mode. At the beginning of each round of aggregation, a global model containing decoy neurons is distributed to the participants. After local training, the participants are forced to upload the gradient parameters of the decoy neurons. The gradient data is analyzed. If the absolute value of the gradient is greater than 3 times the standard deviation of the historical mean, it is considered that there is an amplitude anomaly. At the same time, a Fourier transform is performed on the output sequence. If the 5Hz fundamental frequency component is missing, it is determined that the oscillation mode of the output is destroyed. When any of the above conditions are met, the API access key of the participant is automatically frozen, and alarm information is recorded and output through the system log, including the attack time, participant ID and abnormal index value.

[0130] This scheme embeds decoy feature neurons with special activation conditions during gradient parameter aggregation, enabling real-time detection and blocking of potential model reverse attacks, thus suppressing data leakage risks at the nascent stage. The decoy neurons are independent of the main task feature space, preventing security mechanisms from interfering with normal model convergence.

[0131] In some embodiments, a unique participant key is generated for each participant based on the participant's identity information; during the weighted aggregation of gradient parameters within the retained outlier cluster, a corresponding digital watermark is embedded in the security-enhanced global model based on the unique participant key; when model reverse engineering is detected, the participant initiating the model reverse engineering is located and traced based on the digital watermark; during each round of weighted aggregation, a new digital watermark is re-embedded in the security-enhanced global model based on the new key generated for each participant.

[0132] Identity information can be brief information used to identify the participants.

[0133] The unique participant key can be an encrypted string generated based on the participant's registered identity (such as the enterprise's unified credit code), and it has uniqueness and cannot be forged.

[0134] Digital watermarks can be hidden identifiers embedded in model parameters that do not affect model functionality but allow for traceability of the source.

[0135] Specifically, existing technologies typically embed fixed watermarks (such as constant noise injection) into the model. Attackers can strip the watermark through multiple rounds of model comparison, resulting in static vulnerabilities in existing fixed watermarks. This solution generates a dynamic watermark by updating the key in each round, establishing a timely defense barrier that prevents attackers from building an effective denoising model. For example, in a subway construction monitoring scenario, when a malicious subcontractor attempts to steal ground-penetrating radar data, the dynamic watermark changes its frequency domain characteristics after each model update, making it impossible for attackers to crack the watermark through historical model differential analysis. In a federated learning environment, traditional digital fingerprinting technology cannot associate model copies with specific participants. This solution strongly binds the unique participant's key to the watermark, establishing an identity-model mapping relationship. Combined with the embedding of weighted aggregation timing, it ensures deep fusion of the watermark and model parameters, achieving accurate traceability. Taking a cross-regional power grid project as an example, when a substation parameter leak is discovered, the leaking party can be identified through the regional coding features in the watermark.

[0136] The implementation steps of this scheme are as follows: Extract identification information that can characterize the participants, such as their business registration number / unified credit code; encrypt the identification information using the national cryptographic SM4 algorithm to generate a 256-bit encryption key; in the gradient weighted fusion stage, convert the key into a low-frequency perturbation signal and superimpose the perturbation signal onto the weight parameters of the fully connected layer of the model; when the feature trap mechanism detects a reverse attack, extract the watermark signal from the leaked model and decrypt it to obtain the plaintext key, locate and trace the corresponding participant; after each round of aggregation, the old key is automatically discarded, and a new key is generated based on the latest audit status of the participants.

[0137] This scheme utilizes a mechanism that generates dynamic watermarks by updating keys in each round to establish a timely defense barrier, preventing attackers from building effective denoising models. At the same time, it strongly binds the unique participant's key to the watermark, establishing an identity-model mapping relationship. Combined with the embedding of weighted aggregation timing, it ensures deep integration of watermarks and model parameters, enabling accurate tracing of abnormal participants.

[0138] Figure 3 A schematic diagram of the structure of a collaborative system for secure data sharing in engineering projects based on federated learning, as provided in one embodiment of this application, is shown below. Figure 3 As shown, the engineering project data security sharing and collaboration system 300 based on federated learning in this embodiment includes: an initial analysis module 301, a security enhancement module 302, and an aggregation and distribution module 303.

[0139] The initial analysis module 301 is used to obtain the initial model gradient update parameters of each participant and construct the initial global model parameter dataset;

[0140] Security enhancement module 302 is used to perform multidimensional security enhancement processing on the initial global model parameter dataset according to the multidimensional model security enhancement strategy, and determine the enhanced gradient update dataset;

[0141] The aggregation and distribution module 303 is used to aggregate the enhanced gradient update dataset and embed a feature trap verification mechanism during the aggregation process to generate and distribute a security-enhanced global model.

[0142] Optionally, the initial analysis module 301 is specifically used for:

[0143] The initial model gradient update parameters are provided by the participants through the gradient parameter upload interface. Before uploading the initial model gradient update parameters, the participants are authenticated through a zero-knowledge proof mechanism, and the legality of the registration certificate held by the participants is verified to ensure that the participants have a legitimate identity. After obtaining the initial model gradient update parameters of each participant, a forced format conversion is performed to unify them into a preset dimension tensor structure. Data with missing or overflowing dimensions is automatically rejected by a circuit breaker mechanism.

[0144] Optionally, in the security enhancement module 302, the multi-dimensional model security enhancement strategy is specifically used for:

[0145] Based on the initial global model parameter dataset, dynamic credibility analysis is performed on each initial model gradient update parameter. Based on the credibility analysis results, a set of retained gradient parameters and a set of potential poisoning parameters are determined. According to the covert verification task perturbation mechanism, a covert verification task perturbation factor is injected into the retained gradient parameter set to identify hidden backdoor attacks. Based on the hidden backdoor attacks, a gradient discarding mechanism is triggered to determine the filtered gradient parameter set. According to the hierarchical gradient obfuscation mechanism, the filtered gradient parameter set is obfuscated to determine the obfuscated gradient parameter set, and the obfuscated gradient parameter set is used as the enhanced gradient update dataset.

[0146] Optionally, when the security enhancement module 302 performs dynamic credibility analysis on each initial model gradient update parameter based on the initial global model parameter dataset, and determines the set of gradient parameters to be retained and the set of potential poisoning parameters based on the credibility analysis results, it is specifically used for:

[0147] Based on historical model data, the statistical distribution characteristics of the initial global model parameter dataset are analyzed to determine the gradient magnitude distribution dispersion and historical trend deviation angle. The temporal continuity of gradient parameters within the initial global model parameter dataset is analyzed to determine the gradient parameter mutation degree. Based on the gradient magnitude distribution dispersion, the historical trend deviation angle, and the gradient parameter mutation degree, a comprehensive credibility score is generated for each gradient parameter. Gradient parameters higher than the dynamic credibility threshold are selected as reserved gradient parameters to construct the reserved gradient parameter set, and gradient parameters lower than the dynamic credibility threshold are selected as potential poisoning gradient parameters to construct the potential poisoning parameter set. The dynamic credibility threshold is adaptively adjusted based on the distribution of the comprehensive credibility scores corresponding to the gradient parameters provided by all participants in the current analysis round.

[0148] Optionally, in the security enhancement module 302, the covert verification task perturbation mechanism is specifically used for:

[0149] Construct several verification subtasks that are unrelated to the current main task but have known output patterns; map the feature space corresponding to the verification subtasks to the feature extraction layer of the main task model, and generate a small-amplitude parameter perturbation direction for the verification subtasks; according to the small-amplitude parameter perturbation direction, superimpose the corresponding perturbation on the gradient parameters in the retained gradient parameter set, and determine the deviation impact of each perturbation on the output of the verification subtasks; analyze the deviation impact, and if the output pattern corresponding to the verification subtasks deviates from the known output pattern, then determine the corresponding gradient parameter as a hidden backdoor attack, trigger the gradient discarding mechanism, remove the corresponding gradient parameter from the retained gradient parameter set, and construct the filtered gradient parameter set.

[0150] Optionally, in the security enhancement module 302, the hierarchical gradient obfuscation mechanism is specifically used for:

[0151] Based on the preset sensitivity level information of the participants, the filtered gradient parameter set is divided into a core parameter set and a non-core parameter set. The following triple obfuscation strategy is applied to the core parameter set to determine the obfuscated core parameter set: for gradient parameters with the same sensitivity level among participants, a random permutation of the parameter topology is performed; a Gaussian-distributed noise mask is injected into the core parameter set, where the variance of the noise mask is negatively correlated with the stability of the corresponding gradient parameter in historical training; a differential privacy-based directional offset is applied to the gradient update direction of each gradient parameter within the core parameter set, where the offset amount is positively correlated with the amount of data from the corresponding participant; the noise mask is applied to the non-core parameter set to determine the obfuscated non-core parameter set; and the obfuscated core parameter set and the obfuscated non-core parameter set are integrated to construct the obfuscated gradient parameter set.

[0152] Optionally, the aggregation and distribution module 303 is specifically used for:

[0153] Unsupervised clustering is performed on the enhanced gradient update dataset to identify several outlier gradient data clusters. Based on the historical global model, the cosine similarity between the center of each outlier gradient data cluster and the historical global model is calculated. Outlier gradient data clusters with cosine similarity lower than the mean similarity are removed, and the remaining outlier clusters are determined. Variance compression is performed on the gradient parameters within the remaining outlier clusters, and aggregation weights are assigned to the gradient parameters according to the compressed data size. Based on the assigned aggregation weights, weighted aggregation is performed on the gradient parameters within the remaining outlier clusters to determine the security-enhanced global model. During the weighted aggregation of the gradient parameters within the remaining outlier clusters, a task verification mechanism is embedded into the remaining outlier clusters according to the feature trap verification mechanism. After the weighted aggregation and task verification mechanism embedding of the gradient parameters within the remaining outlier clusters, the constructed security-enhanced global model is distributed to each of the participating parties.

[0154] Optionally, in the aggregation and distribution module 303, the feature trap verification mechanism is specifically used for:

[0155] During the current gradient parameter aggregation process, a set of decoy feature neurons are embedded into a specific hidden layer. The activation of the decoy feature neurons requires the following conditions to be met simultaneously: the input is an artificially constructed invalid feature combination; the output mode is preset to a constant oscillation signal. In the next round of gradient parameter aggregation, each participant is forced to feed back the local gradient parameters corresponding to the decoy feature neurons. The local gradient parameters are analyzed. If an abnormal gradient amplitude or a destroyed oscillation mode is detected, it is determined that the participant has committed model reverse stealing behavior. The participant's model access permission is immediately terminated and a corresponding warning message is output.

[0156] Optionally, the system 300 further includes a digital watermark embedding module 304, specifically used for:

[0157] Based on the identity information of each participant, a unique participant key is generated for each participant; during the weighted aggregation of gradient parameters within the retained outlier cluster, a corresponding digital watermark is embedded in the security-enhanced global model based on the unique participant key; when reverse engineering of the model is detected, the participant initiating the reverse engineering of the model is located and traced based on the digital watermark; during each round of weighted aggregation, a new digital watermark is re-embedded in the security-enhanced global model based on the new key generated for each participant.

[0158] The system in this embodiment can be used to execute the methods of any of the above embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

Claims

1. A collaborative method for secure data sharing in engineering projects based on federated learning, characterized in that, include: Obtain the initial model gradient update parameters for each participant and construct the initial global model parameter dataset; Based on the multidimensional model security enhancement strategy, the initial global model parameter dataset is subjected to multidimensional security enhancement processing to determine the enhanced gradient update dataset. The multi-dimensional security enhancement process includes anti-poisoning processing and anti-sensitive role inference processing; The enhanced gradient update dataset is aggregated, and a feature trap verification mechanism is embedded in the aggregation process to generate and distribute a secure enhanced global model.

2. The method according to claim 1, characterized in that, The process of obtaining the initial model gradient update parameters for each participant and constructing the initial global model parameter dataset includes: The initial model gradient update parameters are provided by the participating parties through the gradient parameter upload interface; Before uploading the initial model gradient update parameters, the participants verify their identity through a zero-knowledge proof mechanism and verify the legality of the registration certificate held by the participants to ensure that the participants have a legitimate identity. After obtaining the initial model gradient update parameters of each participant, a forced format conversion is performed to unify them into a preset dimension tensor structure. Data with missing or overflowing dimensions is automatically rejected by the circuit breaker mechanism.

3. The method according to claim 1, characterized in that, The multidimensional model security enhancement strategy includes: Based on the initial global model parameter dataset, a dynamic credibility analysis is performed on each initial model gradient update parameter. Based on the credibility analysis results, the set of retained gradient parameters and the set of potential poisoning parameters are determined. According to the covert verification task perturbation mechanism, the covert verification task perturbation factor is injected into the retained gradient parameter set to identify hidden backdoor attacks, and according to the hidden backdoor attacks, the gradient discarding mechanism is triggered to determine the filtered gradient parameter set. According to the hierarchical gradient obfuscation mechanism, the filtered gradient parameter set is obfuscated to determine the obfuscated gradient parameter set, and the obfuscated gradient parameter set is used as the enhanced gradient update dataset.

4. The method according to claim 3, characterized in that, The step of performing dynamic credibility analysis on each initial model gradient update parameter based on the initial global model parameter dataset, and determining the set of retained gradient parameters and the set of potential poisoning parameters based on the credibility analysis results, includes: Based on historical model data, analyze the statistical distribution characteristics of the initial global model parameter dataset to determine the gradient magnitude distribution dispersion and historical trend deviation angle; Analyze the temporal continuity of gradient parameters within the initial global model parameter dataset to determine the gradient parameter abruptness. Based on the gradient magnitude distribution dispersion, the historical trend deviation angle, and the gradient parameter abruptness, a comprehensive confidence level is generated for each gradient parameter. Gradient parameters above the dynamic confidence threshold are used as reserved gradient parameters to construct the reserved gradient parameter set, and gradient parameters below the dynamic confidence threshold are used as potential poisoning gradient parameters to construct the potential poisoning parameter set. The dynamic credibility threshold is adaptively adjusted based on the distribution of the overall credibility corresponding to the gradient parameters provided by all participants in the current analysis round.

5. The method according to claim 3, characterized in that, The covert verification task perturbation mechanism includes: Construct several verification subtasks that are unrelated to the current main task but have known output patterns; The feature space corresponding to the verification subtask is mapped to the feature extraction layer of the main task model, and a micro-amplitude parameter perturbation direction for the verification subtask is generated. Based on the direction of the micro-amplitude parameter perturbation, the corresponding perturbation is superimposed on the gradient parameters in the reserved gradient parameter set to determine the deviation effect of each perturbation on the output of the verification subtask. Analyzing the deviation impact, if the output mode corresponding to the verification subtask deviates from the known output mode, the corresponding gradient parameter is determined to be a hidden backdoor attack, triggering the gradient discarding mechanism, removing the corresponding gradient parameter from the set of retained gradient parameters, and constructing the filtered gradient parameter set.

6. The method according to claim 5, characterized in that, The hierarchical gradient obfuscation mechanism includes: Based on the preset sensitivity level information of the participants, the filtered gradient parameter set is divided into a core parameter set and a non-core parameter set; The following triple obfuscation strategy is applied to the core parameter set to determine the obfuscated core parameter set: For gradient parameters with the same sensitivity level among participants, random permutation of the parameter topology is performed. A noise mask following a Gaussian distribution is injected into the core parameter set, and the variance of the noise mask is negatively correlated with the stability of the corresponding gradient parameter in historical training. A differential privacy-based directional offset is applied to the gradient update direction of each gradient parameter in the core parameter set, and the offset amount is positively correlated with the amount of data of the corresponding participant. The noise mask is applied to the non-core parameter set to determine the obfuscated non-core parameter set; The obfuscated core parameter set and the obfuscated non-core parameter set are integrated to construct the obfuscated gradient parameter set.

7. The method according to claim 6, characterized in that, The process of aggregating the enhanced gradient update dataset and embedding a feature trap verification mechanism during the aggregation process to generate and distribute a secure enhanced global model includes: Unsupervised clustering is performed on the enhanced gradient update dataset to identify several outlier gradient data clusters; Based on the historical global model, calculate the cosine similarity between the center of each outlier gradient data cluster and the historical global model, remove outlier gradient data clusters whose cosine similarity is lower than the mean similarity, and determine the outlier clusters to be retained. The gradient parameters within the retained outlier clusters are subjected to variance compression, and the gradient parameters are aggregated and weighted according to the compressed data size. Based on the allocated aggregated weights, the gradient parameters within the retained outlier clusters are weighted and aggregated to determine the security enhancement global model. During the weighted aggregation of gradient parameters within the retained outlier clusters, a task verification mechanism is embedded into the retained outlier clusters according to the feature trap verification mechanism. After performing the weighted aggregation of gradient parameters within the retained outlier clusters and embedding the task verification mechanism, the constructed security-enhanced global model is distributed to each of the participating parties.

8. The method according to claim 7, characterized in that, The feature trap verification mechanism includes: During the current gradient parameter aggregation process, a set of decoy feature neurons are embedded into a specific hidden layer; The activation of the decoy feature neurons requires the simultaneous fulfillment of the following conditions: The input is an invalid combination of artificially constructed features; The output mode is preset to a constant oscillation signal; In the next round of gradient parameter aggregation processing, each participant is required to feed back the local gradient parameters corresponding to the decoy feature neuron. If the local gradient parameters are analyzed and an abnormal gradient magnitude or a disrupted oscillation mode is detected, it is determined that the participant has committed model reverse engineering and theft. The participant's model access rights are immediately terminated and a corresponding warning message is output.

9. The method according to claim 8, characterized in that, The method further includes: Based on the identity information of each participant, a unique participant key is generated for each participant. During the weighted aggregation of gradient parameters within the retained outlier clusters, a corresponding digital watermark is embedded in the security enhancement global model based on the unique participant key. When the reverse engineering of the model is detected, the participants who initiated the reverse engineering of the model are located and traced based on the digital watermark. During each round of weighted aggregation, a new digital watermark is re-embedded in the security enhancement global model based on the new key generated for each of the aforementioned participants.

10. A collaborative system for secure data sharing in engineering projects based on federated learning, characterized in that, The method applied to any one of claims 1-9 includes: The initial analysis module is used to obtain the initial model gradient update parameters for each participant and construct the initial global model parameter dataset. The security enhancement module is used to perform multidimensional security enhancement processing on the initial global model parameter dataset according to the multidimensional model security enhancement strategy, and determine the enhanced gradient update dataset. The aggregation and distribution module is used to aggregate the enhanced gradient update dataset and embed a feature trap verification mechanism during the aggregation process to generate and distribute a secure enhanced global model.

Images