Federal learning privacy protection method and system facing inference attack

Abstract

The invention relates to the technical field of artificial intelligence, and particularly discloses an inference attack-oriented federated learning privacy protection method and system, and the method comprises the steps: all clients secretly negotiate a unified base permutation matrix before the starting of federated learning training; generating respective private permutation matrixes, and calculating correction factors based on the basic permutation matrixes and the private permutation matrixes; in the first round of training, the client uses a private permutation matrix to carry out structure disorder processing on a local gradient, and compresses the correction factor and embeds the correction factor into a frequency domain of the disorder gradient; extracting and recovering the correction factor based on the received protected gradient; and aligning the gradients with out-of-order structures sent by the clients to the unified sequence based on the recovered correction factors, and carrying out aggregation. According to the method, a double replacement mechanism is introduced, the gradient structure is disrupted on the premise that all original values and positions are reserved, and it is ensured that honest and curious servers and external eavesdroppers cannot interpret local updating.

Description

A privacy protection method and system for federated learning against inference attacks Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to a method and system for protecting privacy in federated learning against inference attacks. Background Technology

[0002] Federated learning is a distributed machine learning framework that allows multiple clients to collaboratively train a shared deep learning model. By aggregating model parameters from clients instead of the raw data, federated learning not only effectively improves training speed, model performance, and generalization, but also provides protection for local datasets and privacy. Therefore, it is widely used in various fields, such as smart manufacturing, autonomous driving, and digital health.

[0003] However, recent research has shown that while this gradient exchange maintains data locality, it contains a great deal of sensitive information. This creates a new attack surface. Specifically, a gradient is not just a set of numerical values, but a structured representation computed locally on the client dataset. This means that the value, location, and correspondence of each gradient component are associated with specific model parameters. This relationship reflects the contribution of the parameters to local updates and potentially explains the data flow within the model. Therefore, existing gradient-based privacy attacks fundamentally rely on the simultaneous correctness of these three elements. If any one of them is compromised or hidden, the connection between the gradient component and the model parameters is severed, making it difficult for attackers to recover meaningful information.

[0004] This dependency is manifested in deep gradient leakage attacks. In these attacks, attackers iteratively adjust "virtual" data by minimizing the distance between the "virtual" gradient and the stolen gradient. This process can reproduce the client's training data with high fidelity, leading to privacy breaches. Furthermore, member inference attacks aim to determine whether a specific set of data belongs to the client's training batch. These data breaches severely hinder the widespread adoption of federated learning, especially in fields like medicine and finance. In these privacy-critical domains, data protection is not merely a matter of preference, but also a legal and ethical imperative.

[0005] In federated learning, attackers from different locations can launch such inference attacks. An external eavesdropper can intercept gradients in the communication link between the client and the server. This allows them to infer private information from the raw gradient updates of a particular client. An honest but curious server, while adhering to the federated learning protocol, possesses the gradients of all clients and can obtain sensitive data through multiple rounds of analysis.

[0006] Existing strategies for defending against inference attacks can be broadly categorized into obfuscation and concealment. Obfuscation methods primarily modify gradient values ​​or remove parts of gradient positions to make the gradients difficult for attackers to understand, thereby reducing the fidelity of usable information. While this method has low computational complexity, it inherently relies on gradient modifications that are only reversible under extremely strict conditions, further complicating the trade-off between privacy protection and model capability. Excessive obfuscation provides strong privacy but severely reduces model accuracy by masking the true gradients and delaying the convergence process. Conversely, reducing the degree of obfuscation to maintain model performance weakens privacy guarantees. Unlike obfuscation methods, encryption methods only hide gradient values ​​while retaining all gradient positions and correspondences. Encryption preserves the complete model utility by avoiding irreversible modifications, but this advantage comes at the cost of consistently high complexity. Despite providing strong privacy guarantees, encryption is generally unsuitable for large-scale federated learning or resource-constrained federated learning. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for protecting privacy in federated learning against inference attacks, so as to solve the problems mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A privacy-preserving method for federated learning resistant to inference attacks, the method comprising:

[0010] Before the federated learning training begins, all clients secretly negotiate a unified basis permutation matrix;

[0011] Each client independently generates its own private permutation matrix and calculates a correction factor based on the base permutation matrix and the private permutation matrix;

[0012] In the first round of training, the client uses a private permutation matrix to structurally disorder the local gradients and then embeds the correction factor into the frequency domain of the disordered gradients after compression, forming a protected gradient.

[0013] The correction factor is extracted and recovered based on the received protected gradient;

[0014] The gradients sent by each client in a structurally disordered manner are aligned to the unified order based on the recovery correction factor and then aggregated.

[0015] As a further embodiment of the present invention, before negotiating the basis permutation matrix and performing the disordered operation on the gradient, a gradient preprocessing step is also included: the server flattens the gradient of the model parameters and divides it into multiple non-overlapping gradient blocks, and the subsequent permutation operation is performed on a unit of gradient blocks.

[0016] As a further aspect of the present invention, all clients secretly negotiate a unified basis permutation matrix, specifically including:

[0017] All clients obtain a shared key through the GroupDiff-Hellman key exchange protocol;

[0018] Each client generates a unique random seed by using the shared key and the index of the gradient block to obtain the equation;

[0019] Each client uses the random seed to generate a basis permutation matrix corresponding to each gradient block using a pseudo-random permutation algorithm.

[0020] As a further aspect of the present invention, for each client and each gradient block, the product of the inverse of the private permutation matrix and the corresponding basis permutation matrix is ​​the correction factor.

[0021] As a further aspect of the present invention, the step of compressing and embedding the correction factor into the frequency domain of the disordered gradient specifically includes:

[0022] Using a measurement matrix constructed based on an asymmetric extended graph, the vectorized correction factor is compressed to obtain a compressed vector;

[0023] Transform the disordered gradients to the frequency domain to obtain the frequency domain coefficients;

[0024] After the compressed vector is segmented, it is embedded into the corresponding frequency domain coefficients by numerical offset.

[0025] The embedded frequency domain coefficients are inversely transformed to obtain the final protected gradient of the transmission.

[0026] As a further embodiment of the present invention, the server extracts and recovers the correction factor from the received protected gradient, specifically including:

[0027] The protected gradient is transformed to the frequency domain, and the estimated value of the compressed vector is extracted from the frequency domain coefficients.

[0028] The problem of restoring the correction factor is constructed as a constrained optimization problem. The objective of the optimization problem is to minimize the difference between the product of the measurement matrix and the vectorized result of the correction factor and the extracted compressed vector estimate. The constraint condition is that the solution lies within a continuous relaxation set of the permutation matrix.

[0029] As a further embodiment of the present invention, the correction factor is embedded and transmitted only in the first round of training. In all subsequent training rounds, the client and server reuse the permutation relationship established in the first round to perform gradient scrambling, alignment and aggregation.

[0030] This invention also provides a federated learning privacy protection system for inference attacks, the system comprising:

[0031] The negotiation module is used to secretly negotiate a unified basis permutation matrix among all clients before the federated learning training begins.

[0032] The correction factor calculation module is used for each client to independently generate its own private permutation matrix and calculate the correction factor based on the base permutation matrix and the private permutation matrix;

[0033] The compression embedding module is used in the first round of training to perform structural disorder processing on the local gradient using a private permutation matrix, and to embed the correction factor into the frequency domain of the disordered gradient after compression to form a protected gradient.

[0034] A recovery module is used to extract and recover the correction factor based on the received protected gradient;

[0035] An aggregation module is used to align the structurally disordered gradients sent by each client to the unified order based on the recovery correction factor, and then aggregate them.

[0036] Compared with existing technologies, the advantages of this invention are as follows: This invention focuses on the correspondence between gradient values ​​and positions, and proposes a structural gradient privacy protection method. By introducing a double permutation mechanism, the gradient structure is shuffled while preserving all original values ​​and positions, ensuring that honest and curious servers and external eavesdroppers cannot interpret local updates. More importantly, this structural scrambling is reversible with the help of a correction factor, ensuring that the server can still perform effective aggregation without seeing the original gradient structure, thus guaranteeing that model utility is almost unaffected. To further improve efficiency, the correction factor is compressed and embedded in the frequency domain of the scrambled gradient for transmission. This invention not only copes with various inference attacks, but also achieves almost lossless model accuracy and negligible additional computational complexity. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.

[0038] Figure 1 is a flowchart of a federated learning privacy protection method for inference attacks provided by an embodiment of the present invention.

[0039] Figure 2 is a model transfer flow diagram provided in an embodiment of the present invention.

[0040] Figure 3 shows the defensive effects of the present invention and other defense methods against deep gradient leakage attacks. Detailed Implementation

[0041] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0042] Figure 1 is a flowchart of a privacy protection method for federated learning against inference attacks. As shown in Figure 1, in this embodiment of the invention, a privacy protection method for federated learning against inference attacks includes:

[0043] Before the federated learning training begins, all clients secretly negotiate a unified basis permutation matrix;

[0044] Each client independently generates its own private permutation matrix and calculates a correction factor based on the base permutation matrix and the private permutation matrix;

[0045] In the first round of training, the client uses a private permutation matrix to structurally disorder the local gradients and then embeds the correction factor into the frequency domain of the disordered gradients after compression, forming a protected gradient.

[0046] The correction factor is extracted and recovered based on the received protected gradient;

[0047] The gradients sent by each client in a structurally disordered manner are aligned to the unified order based on the recovery correction factor and then aggregated.

[0048] In this embodiment, before training begins, the server initializes the model parameters and gradient preprocessing method, and all clients secretly negotiate the basis permutation matrix; all clients secretly generate private permutations and calculate correction factors; in the first round, the clients compress the correction factors and embed them into the shuffled gradient frequency domain for transmission; the server extracts and restores the correction factors; the server re-aligns and aggregates local gradients.

[0049] As a preferred embodiment of the present invention, before negotiating the basis permutation matrix and performing the disordered operation on the gradient, a gradient preprocessing step is also included: the server flattens the gradient of the model parameters and divides it into multiple non-overlapping gradient blocks, and the subsequent permutation operation is performed on a unit of gradient blocks.

[0050] As shown in Figure 2, in this embodiment, the server initializes the global model parameters as follows: The global gradient is To defend against inference attacks, gradients are out of order during transmission. Since gradients naturally appear in different forms (e.g., matrices for convolution operations or vectors for bias operations), a uniform out-of-order rule cannot be established. To facilitate processing, the gradients are first flattened and concatenated into a one-dimensional vector. , where N is the total number of model parameters. Subsequently, Divided into B non-overlapping blocks Each gradient block This naturally corresponds to a model layer. Where N b This refers to the number of model parameters for the b-th block. Therefore, the following condition is met:

[0051] ;

[0052] After the gradient is divided into blocks, out-of-order operations can be performed on a block-by-block basis.

[0053] In a preferred embodiment of the present invention, all clients secretly negotiate a unified basis permutation matrix, specifically including:

[0054] All clients obtain a shared key through the GroupDiff-Hellman key exchange protocol;

[0055] Each client generates a unique random seed by using the shared key and the index of the gradient block to obtain the equation;

[0056] Each client uses the random seed to generate a basis permutation matrix corresponding to each gradient block using a pseudo-random permutation algorithm.

[0057] As shown in Figure 2, in this embodiment, all C clients first execute a standard group Diffie-Hellman key exchange protocol and obtain a key K that is shared only by all clients. Using this key K, each client can use the key acquisition equation (KDF) to deterministically convert gradient blocks. Get a random seed:

[0058] ;

[0059] Subsequently, this seed is used to initialize a pseudo-random permutation algorithm to generate a deterministic basis permutation matrix, which is: Each row and column of this matrix contains a non-zero 1, and satisfies... Using block index b for AND separation in the formula ensures the uniqueness of the seed, thereby guaranteeing the basis permutation matrix M for each block b. b Cryptographically independent of all other blocks. The basis permutation matrix provides a uniform gradient order for all clients. .

[0060] In a preferred embodiment of the present invention, for each client and each gradient block, the product of the inverse of the private permutation matrix and the corresponding basis permutation matrix is ​​the correction factor.

[0061] As shown in Figure 2, in this embodiment, further, in step three, the specific operation of the client secretly generating a private permutation and calculating the correction factor is as follows:

[0062] To hide the true gradient structure, each client c independently determines its own private permutation matrix. Private permutation matrix: Where C is the total number of clients, and the private permutation satisfies This private permutation matrix can shuffle the local gradient, i.e. .

[0063] Establishing the basis permutation matrix and private permutation matrix Then, each client calculates the correction factor. , Since the correction factor is the product of two permutation matrices, therefore It is also a permutation matrix, satisfying that each row and each column contains only one 1. This correction factor can correct the shuffled local gradient. Mapped to a uniform order.

[0064] ;

[0065] The client provides the correction factor to the server, which can then align all local gradients with different structures to a uniform order for effective aggregation.

[0066] In a preferred embodiment of the present invention, the step of compressing and embedding the correction factor into the frequency domain of the disordered gradient specifically includes:

[0067] Using a measurement matrix constructed based on an asymmetric extended graph, the vectorized correction factor is compressed to obtain a compressed vector;

[0068] Transform the disordered gradients to the frequency domain to obtain the frequency domain coefficients;

[0069] After the compressed vector is segmented, it is embedded into the corresponding frequency domain coefficients by numerical offset.

[0070] The embedded frequency domain coefficients are inversely transformed to obtain the final protected gradient of the transmission.

[0071] As shown in Figure 2, in this embodiment, the specific operation of the client to compress the correction factor and embed it into the shuffled gradient frequency domain is as follows:

[0072] In the first round at t=1, each client first starts from the local dataset. Extract a small batch of data , and using the initialized model parameters Calculate the stochastic local gradient of the loss function L. , As mentioned above, to protect the local gradient structure, each client utilizes a private permutation matrix. Disrupt the gradient Each gradient block after shuffling is: .

[0073] The client needs to provide the correction factor. The server enables the client to access all local gradients with different structures. Align to a uniform order for efficient aggregation. However, the full transfer size N b ×N b of It consumes a lot of communication resources. Therefore, Compress and embed out-of-order gradients It is transmitted in the frequency domain.

[0074] First, due to the permutation matrix Its unique sparsity allows for compression using compressed sensing:

[0075] ;

[0076] in, It has a sparsity of N b The vectorized correction factor It is a measurement matrix. , This is a compressed vector. The validity of the measurement depends on the construction of a high-quality measurement matrix, therefore... Construct as an asymmetric extended graph The adjacency matrix is ​​given by d, where d is a constant left margin and ε is the expansion factor. This construction method has two key advantages. First, it is efficient. The compressed vector... The size m and the size N of the gradient block b A linear relationship exists: Second, the measurement matrix. satisfy Restricted isometric properties under norm:

[0077] ;

[0078] This property is preserved during compression. The geometric structure ensures that it can be perfectly restored.

[0079] In correction factor Compressed into a compact vector Then, embed it into a shuffled gradient. In the frequency domain, this avoids additional communication overhead and increases noise immunity. Specifically, each client c first utilizes the Normalized Discrete Cosine Transform (DCT-II) to... Transform to the frequency domain, frequency domain , The k-th frequency domain coefficient is:

[0080] ;

[0081] in, These are time-domain and frequency-domain indices, It is a standard normalization term:

[0082] ;

[0083] Subsequently, vector Divided into N b A continuous block, For the k-th block The value after (d+1) base expansion Embedded with corresponding frequency domain coefficients middle:

[0084] ;

[0085] Where α is the embedding strength. This formula will The center point of the dynamic range is moved to 0 to generate a symmetrical perturbation that can be controlled by α. Finally, client c uses inverse normalized discrete cosine transform to obtain the final protection gradient and passes it to the server. The final protection gradient is: .

[0086] In a preferred embodiment of the present invention, the server extracts and recovers the correction factor from the received protected gradient, specifically including:

[0087] The protected gradient is transformed to the frequency domain, and the estimated value of the compressed vector is extracted from the frequency domain coefficients.

[0088] The problem of restoring the correction factor is constructed as a constrained optimization problem. The objective of the optimization problem is to minimize the difference between the product of the measurement matrix and the vectorized result of the correction factor and the extracted compressed vector estimate. The constraint condition is that the solution lies within a continuous relaxation set of the permutation matrix.

[0089] In this embodiment, the specific operation of the server extracting and restoring the correction factor in step five is as follows:

[0090] Upon receiving Then, the server first calculates the frequency domain coefficients: Because the client cannot obtain Therefore, 0 is used as a reference to extract the embedded value:

[0091] ;

[0092] Subsequently, It is converted back to a compressed vector.

[0093] exist After successful extraction, the server's final task is to restore the correction factor. This process can be represented as a constrained optimization problem:

[0094] ;

[0095] Here, the Burkhoff polyhedron is a continuous relaxation set of the discrete permutation matrix:

[0096] ;

[0097] in, represent The element in the i-th row and j-th column, , This optimization problem can be solved using the traditional interior-point method.

[0098] As a preferred embodiment of the present invention, the correction factor is embedded and transmitted only in the first round of training. In all subsequent training rounds, the client and server reuse the permutation relationship established in the first round to perform gradient scrambling, alignment and aggregation.

[0099] In this embodiment, the server extracts and recovers the correction factor. Then, all structurally disordered gradients are mapped to a unified order: Finally, the global gradient is obtained using federated average aggregation and then redistributed to the client for model updates.

[0100] ;

[0101] This concludes one round of training. In subsequent rounds (t>0), the client does not need to transmit the correction factor again. Simply use private substitution before transmission. gradient Disrupt the structure, that is The server directly utilizes... Realign and aggregate the disordered gradients of the structure, i.e. After multiple rounds of communication, the model converged.

[0102] As shown in Figure 3, the applicability of the proposed federated learning privacy protection method for inference attacks to image classification tasks is analyzed through simulation experimental data. The simulation experiment uses the PyTorch framework of Python software, and the specific content is as follows:

[0103] The simulation uses Python multithreading to simulate a real environment, creating a parameter aggregation thread and... There is one client scheduling thread, which is currently suspended.

[0104] The ResNet56 model was built using the PyTorch framework in Python. The model consists of one initial 3×3 convolutional layer and 27 residual blocks. Each residual block contains two 3×3 convolutional layers, followed by global average pooling and a fully connected layer.

[0105] Start the client scheduling thread: obtain initialization model parameters and communication rounds. The values ​​are assigned to the ResNet56 model, and the image and labels are used as input. Stochastic gradient descent is then used to calculate the client-side local gradient. And upload the random permutation matrix Gradient after disordering Send to the server. The server starts a parameter aggregation thread, using a correction factor. Received gradient Align to uniform order The data is then aggregated and sent back to the client for model parameter updates. This completes the image classification training task under multi-user collaboration.

[0106] The simulation data used was the CIFAR-100 database to evaluate federated learning privacy protection methods against inference attacks. The CIFAR-100 database contains 60,000 color images of size 32×32, covering 100 categories, including a wide variety of objects and scenes.

[0107] The hyperparameters used in the simulation were: communication rounds T=100, local time E=100, and learning rate 0.001. In gradient preprocessing, for ease of calculation, the gradients were uniformly divided into groups of size N. b =16 gradient blocks. This size corresponds to the minimum parameter tensor size in the ResNet56 network. Each correction factor is compressed using an asymmetric expansion graph, with the minimum constant left-hand dimension d. min =4, The compressed information is embedded in the frequency domain of the gradient with an embedding strength of α=0.05.

[0108] External eavesdroppers and honest but curious servers exploit the received gradients for inference attacks. Using a table from the CIFAR-100 dataset as an example, Table 1 visually compares the defense capabilities of gradient structure disordered methods against deep gradient leakage attacks compared to three other competitors. In an undefended scenario, the attack can reconstruct the image almost perfectly. While other methods offer limited protection, introducing some noise and perturbations, the core shape of the image remains clearly visible. In contrast, gradient structure disorder fundamentally disrupts the relationship between gradient values ​​and positions. Now, the deep gradient leakage attack attempts to match a completely uninformative target, hindering the convergence of the optimization process and producing random, meaningless outputs.

[0109] Table 1 compares the defense capabilities of the gradient structure disorder defense method against member inference attacks with three other competitors. Two standard metrics are used here: the true positive rate (TPR) at a false positive rate of 0.1% (TPR@FPR=0.1%). This represents a realistic and high-precision scenario, demonstrating the accuracy when the false positive rate is very low; the area under the curve (AUC) measures the overall ability of the inference attack to distinguish between the target and non-target. 1.00 represents perfect, and 0.50 represents random guessing. The results in the table show that other methods reduce the success rate of the attack, but the AUC is still much higher than 0.50. This is because the statistical distribution is blurred, weakening the anomalous signal. However, there is still a slight difference between the gradients of the target and non-target, so the attack can succeed. In contrast, gradient structure disorder disrupts the cosine similarity of the attack calculation. This randomness makes the shuffled gradient belonging to the target no longer statistically anomalous. Therefore, the attack result is not significantly different from random guessing.

[0110] Table 1 Success rate of member inference attacks under different defense methods

[0111]

[0112] Besides the effectiveness of attack defense, the impact of defense mechanisms on the model task should also be evaluated, focusing on additional time overhead and final model accuracy. Table 2 shows the additional time added per round per client and the test accuracy of the model for different defense methods. The efficiency of gradient structure scrambling is due to two reasons: structure scrambling relies solely on lightweight matrix computation, which is far simpler than other defense methods. Fast processing allows the scrambling of different gradient blocks to be performed independently, and this large-scale parallelization significantly reduces the additional overhead. In terms of model accuracy, obfuscation methods cause a continuous decline in model accuracy during training because they essentially disrupt or interfere with gradient processing, further impairing model convergence. In comparison, gradient structure scrambling achieves the same results as without defense. This is because the design of this method is compatible with aggregation. Although the gradient is scrambled from the attacker's perspective, the correction factor still allows the server to correctly aggregate all corresponding elements, thus protecting the integrity of the global model update.

[0113] Table 2. Additional time added per client per round by different methods

[0114]

[0115] This invention also provides a federated learning privacy protection system for inference attacks, the system comprising:

[0116] The negotiation module is used to secretly negotiate a unified basis permutation matrix among all clients before the federated learning training begins.

[0117] The correction factor calculation module is used for each client to independently generate its own private permutation matrix and calculate the correction factor based on the base permutation matrix and the private permutation matrix;

[0118] The compression embedding module is used in the first round of training to perform structural disorder processing on the local gradient using a private permutation matrix, and to embed the correction factor into the frequency domain of the disordered gradient after compression to form a protected gradient.

[0119] A recovery module is used to extract and recover the correction factor based on the received protected gradient;

[0120] An aggregation module is used to align the structurally disordered gradients sent by each client to the unified order based on the recovery correction factor, and then aggregate them.

[0121] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A privacy protection method for federated learning against inference attacks, characterized in that, The method includes: before federated learning training begins, all clients secretly negotiate a unified basis permutation matrix; each client independently generates its own private permutation matrix and calculates a correction factor based on the basis permutation matrix and the private permutation matrix; in the first round of training, the client uses the private permutation matrix to perform structural disorder processing on the local gradients, and embeds the correction factor into the frequency domain of the disordered gradients after compression to form protected gradients; extracts and recovers the correction factor based on the received protected gradients; and aligns the structurally disordered gradients sent by each client to the unified order based on the recovered correction factor and aggregates them.

2. The method for protecting privacy in federated learning against inference attacks according to claim 1, characterized in that, Before negotiating the basis permutation matrix and performing the scrambling operation on the gradients, a gradient preprocessing step is also included: the server flattens the gradients of the model parameters and divides them into multiple non-overlapping gradient blocks, and subsequent permutation operations are performed on a unit of gradient blocks.

3. The method for protecting privacy in federated learning against inference attacks according to claim 1, characterized in that, The process of all clients secretly negotiating a unified basis permutation matrix includes: all clients obtaining a shared key through a group Diffie-Hellman key exchange protocol; each client generating a unique random seed based on the shared key and the index of the gradient block using a key acquisition equation; and each client using the random seed to generate a basis permutation matrix corresponding to each gradient block using a pseudo-random permutation algorithm.

4. The method for protecting privacy in federated learning against inference attacks according to claim 1, characterized in that, For each client and each gradient block, the product of the inverse of the private permutation matrix and the corresponding basis permutation matrix is ​​the correction factor.

5. A method for protecting privacy in federated learning against inference attacks according to claim 1, characterized in that, The step of compressing and embedding the correction factor into the frequency domain of the out-of-order gradient specifically includes: compressing the vectorized correction factor using a measurement matrix constructed based on an asymmetric extended graph to obtain a compressed vector; transforming the out-of-order gradient to the frequency domain to obtain frequency domain coefficients; dividing the compressed vector and embedding it into the corresponding frequency domain coefficients by numerical offset; and performing an inverse transformation on the embedded frequency domain coefficients to obtain the final transmitted protected gradient.

6. The method for protecting privacy in federated learning against inference attacks according to claim 1, characterized in that, The server extracts and recovers the correction factor from the received protected gradient, specifically including: transforming the protected gradient to the frequency domain, extracting the estimated value of the compressed vector from the frequency domain coefficients; and constructing the problem of recovering the correction factor as a constrained optimization problem, wherein the objective of the optimization problem is to minimize the difference between the product of the measurement matrix and the vectorized result of the correction factor and the estimated value of the extracted compressed vector, and the constraint condition is that the solution lies within the continuous relaxation set of the permutation matrix.

7. A privacy protection method for federated learning against inference attacks according to claim 1, characterized in that, The correction factor is embedded and transmitted only in the first round of training. In all subsequent training rounds, the client and server reuse the permutation relationship established in the first round to perform gradient scrambling, alignment, and aggregation.

8. A federated learning privacy protection system for inference attacks, used to implement the federated learning privacy protection method for inference attacks as described in any one of claims 1-7, characterized in that, The system includes: a negotiation module for all clients to secretly negotiate a unified basis permutation matrix before federated learning training begins; a correction factor calculation module for each client to independently generate its own private permutation matrix and calculate a correction factor based on the basis permutation matrix and the private permutation matrix; a compression embedding module for clients to use their private permutation matrix to perform structural disorder processing on their local gradients in the first round of training, and to embed the compressed correction factor into the frequency domain of the disordered gradients to form protected gradients; a recovery module for extracting and recovering the correction factor based on the received protected gradients; and an aggregation module for aligning the structurally disordered gradients sent by each client to the unified order based on the recovered correction factor and aggregating them.

Images