Privacy-preserving robust federated learning aggregation method against backdoor attacks

Abstract

This invention discloses a privacy-preserving robust federated learning aggregation method to resist backdoor attacks. Based on a dual-server architecture, clustering algorithm, and threshold filtering algorithm, it filters out malicious clients while ensuring the privacy of local updates by federated learning clients. First, this invention uses a dual-server architecture and, through arithmetic sharing and quadratic association pairs, enables the two servers to calculate the cosine distance between local updates of each client without knowing the plaintext of the client's local updates, thus achieving privacy protection for client data. Furthermore, this invention combines clustering operations and threshold filtering, allowing the servers to filter out updates from malicious clients based on both the direction and magnitude of the client's local updates, thereby improving the robustness of federated learning.

Description

Technical Field

[0001] This invention belongs to the technical fields of information security, cryptography and privacy-preserving machine learning, and specifically relates to a privacy-preserving robust federated learning aggregation method that resists backdoor attacks. Background Technology

[0002] Against the backdrop of the rapid development of artificial intelligence and big data technologies, the value of data as a core production factor is becoming increasingly prominent. However, its decentralized nature, sensitivity, and stringent privacy compliance requirements have led to the widespread phenomenon of "data silos," severely restricting the performance improvement of machine learning models. To address this challenge, Federated Learning (FL) has emerged—a distributed machine learning paradigm that allows multiple participants (such as mobile devices, enterprises, or institutions) to collaboratively train a shared global model without sharing their original local data. Its core mechanism involves each participant training its model only on its local data and uploading encrypted or perturbed model updates (such as gradients or parameters) to a coordinating server. The server aggregates these updates, generates an optimized global model, and distributes it back to the participants, thus achieving privacy-preserving collaborative learning where "the model moves while the data remains stationary." This technology not only effectively avoids the privacy leaks and legal risks associated with the cross-domain flow of raw data but also provides a feasible path for highly sensitive fields such as healthcare, finance, and the Internet of Things, balancing data value release with compliance and security.

[0003] While federated learning effectively mitigates the risk of privacy breaches by avoiding the centralization of raw datasets, its distributed architecture still faces dual security challenges: privacy breaches and model poisoning (especially backdoor attacks). Regarding privacy protection, existing methods primarily rely on Differential Privacy (DP), which injects controlled noise into local updates to prevent servers or attackers from back-calculating individual data from gradients. Simultaneously, cryptographic techniques such as Homomorphic Encryption (HE) and Secure Multi-Party Computation (MPC) are used to encrypt model updates during transmission, ensuring that the aggregation process can be completed without decryption. On the other hand, when defending against backdoor attacks launched by malicious clients, mainstream strategies include robust aggregation (such as Krum and Median), anomaly detection (such as static threshold filtering based on gradient norm or cosine similarity), and cluster analysis, aiming to identify and eliminate anomalous updates.

[0004] Existing technologies exhibit a clear disconnect: privacy-focused solutions (such as aggregation protocols based on homomorphic encryption or secret sharing) can prevent semi-honest servers from obtaining raw gradients, but their aggregation logic is often static and blind, unable to identify and filter abnormal or toxic updates submitted by malicious clients. The use of homomorphic encryption and differential privacy often comes at the cost of sacrificing model utility or increasing communication overhead. On the other hand, existing robust defense mechanisms (such as methods based on clustering, norm pruning, or median estimation) can effectively improve the model's resistance to malicious attacks, but their core computations (such as calculating the Euclidean distance between gradients, cosine similarity, or performing dynamic threshold determination) usually require plaintext processing, which directly exposes the client's private data, contradicting the fundamental goal of privacy protection.

[0005] Therefore, the core technical challenge of current federated learning backdoor defense schemes lies in how to design an efficient and secure cryptographic protocol to support complex robustness analysis (such as secure distance calculation, dynamic clustering, and adaptive threshold filtering) without disclosing the client's original local updates to any party (including two non-colluding semi-honest servers). This would allow for the simultaneous achievement of the dual security goals of resisting malicious client attacks and resisting semi-honest server snooping within a unified framework. Summary of the Invention

[0006] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a privacy-protected robust federated learning aggregation method that resists backdoor attacks.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A privacy-preserving robust federated learning aggregation method to resist backdoor attacks, the federated learning aggregation method comprising the following steps:

[0009] S1, by the first server The main system initialization, the first server Before federated learning begins, a public key will be executed. and private key The generation of the public-private key pair, which is composed of public and private key pairs. Encryption and decryption for the Paillier cryptosystem, and the public key Distributed to the second server ;

[0010] S2, N clients Parallel execution of local training and arithmetic shared share generation, i=1,2,…,N, assuming a global model. The number of parameters is , No. Client Generate local update vector and pre-calculate by the client First related share and client Second related share The squared correlation pairs ,in express The local update value corresponding to the k-th parameter. It means The The associated values ​​corresponding to each parameter It means The associated value corresponding to the kth parameter, and For all Established, To precompute the bit width of the numerical values, all squared correlation pairs are operated on in the integer ring. In the process, then calculate. arithmetic sharing and ,calculate arithmetic sharing and ,calculate arithmetic sharing and Finally Send to the first server ,Will Send to the second server ;

[0011] S3, First Server Second server Cooperatively perform quadratic association pair verification without refactoring Given the original value, verify any client c i Submitted square association pairs Does it meet the requirements? right Once established, remove clients that fail verification and add the set of verified clients. Reserved for use in subsequent steps;

[0012] S4, First Server Second server Collaborative execution of safe distance and cosine similarity calculations without reconstructing the original global model. Secure computation for any client while updating vectors The square of the magnitude of the local update vector

[0013] First arithmetic shared share Second arithmetic share Any two clients and Between Square of norm distance First arithmetic shared share Second arithmetic share The cosine distance matrix between any two clients ,in, Indicates client The square norm of the gradient vector,

[0014] Indicates client and gradient vector and The square Euclidean distance and the cosine distance are

[0015] For any two different clients and cosine distance matrix No. Line number The elements of the column are represented as follows: ;

[0016] S5. Use clustering operations to analyze client sets. Using the cosine distance between clients as a metric, clients that fail to meet the minimum cluster size requirement are marked as outliers. A second filtering process based on thresholding is then performed to obtain a set of benign clients. ;

[0017] S6, First Server Aggregate all clients The first arithmetic shared share of the local update vector A new global model is obtained First arithmetic shared share Second server Aggregate all clients The second arithmetic shared share of the local update vector A new global model is obtained Second arithmetic shared share The first server and the second server exchange the first arithmetic shared share. Second arithmetic share A new global model is obtained .

[0018] Further, step S1 is as follows:

[0019] S1a, First Server Receive security parameters Then randomly generate two large prime numbers. and The bit length of each prime number is ,and and The greatest common divisor is 1, the first server Next, calculate the encryption modulus of the Paillier cryptosystem. Carmichael function value for and The least common multiple of, and set the generator. Define auxiliary functions x is the input parameter of the auxiliary function, and the modular inverse is calculated. ,in Indicates in the model Multiplicative inverse;

[0020] S1b, First Server Generate public key and private key Then the public key is transmitted through a secure channel. Send to server ;

[0021] S1c, Second Server Receive and store public key .

[0022] Furthermore, step S2 is as follows:

[0023] S2a, Assuming a global model The number of parameters is N clients Using the global model in round t-1 In the client Local private dataset Training is performed on the local update vector to obtain the local update vector. ,in Represents the local update vector No. The local update value corresponding to each parameter, and then... By performing arithmetic sharing decomposition, we obtain... First arithmetic shared share Second arithmetic share

[0024] ,in This represents the local update vector. No. The first arithmetic shared share of the local update values ​​corresponding to each parameter. This represents the local update vector. No. The second arithmetic shared share of the corresponding local update values ​​for each parameter, for The process of splitting arithmetic sharing is as follows: First, randomly generate the first arithmetic sharing share. Each element in, through calculation Obtain the second arithmetic shared share

[0025] All elements in;

[0026] S2b, Client The first association share of generating square association pairs and the second related share ,in express The One associated value, express The One associated value, and Then Break it down into arithmetic sharing, and get

[0027] and Similarly Decomposed into arithmetic sharing and ,in , They represent No. The first and second arithmetic shared shares of the associated values , They represent No. The first and second arithmetic shared shares of each associated value;

[0028] S2c, Client Set the first arithmetic shared shares Send to the first server Second arithmetic shared share set Send to the second server ;

[0029] S2d, First Server Second server Receive and temporarily store N clients The first and second arithmetic shared share sets.

[0030] Furthermore, step S3 is as follows:

[0031] S3a, For N clients First server With the second server Together from the set Randomly select two distinct indices without replacement. and Until the set is empty, each time an index is selected... and After that, the first server Second server Together from model Randomly sample an odd number from the ring of integers First server Calculate intermediate variables ,in express No. The first arithmetic share of each associated value express No. The first arithmetic shared share of the associated values, the second server Locally computed intermediate variables ,in express No. The second arithmetic shared share of each associated value express No. The second arithmetic shared share of the associated values, the first server Second server exchange and And calculate First server calculate

[0032] ,in express No. The first arithmetic shared share of the associated values, the second server calculate ,in express No. The second arithmetic shared share of the associated values, the first server Second server exchange as well as And verify the conditions Whether it is true or false, if all subscripts are true or false. and If all combinations of these conditions satisfy the verification criteria, then the client will be... Marked as "valid"; if verification fails in any case, the client will be... Marked as "invalid";

[0033] S3b, Let the set of clients that have passed verification be... Preserve client set Data submitted in step S2 on both servers is discarded if the client's data in step S2 fails to pass verification.

[0034] Furthermore, step S4 is as follows:

[0035] S4a, First Server The first arithmetic share of the locally computed intermediate vector

[0036] ,in Represents the intermediate vector First arithmetic shared share and , Second server The second arithmetic share of the locally computed intermediate vector ,in Represents the intermediate vector The second arithmetic shared share and The two servers then exchange information with each other. and And calculate the intermediate vector

[0037] And among them yes , ;

[0038] S4b, compute any client The square of the magnitude of the local update vector Arithmetic Share and ,in The square of the magnitude of the vector is represented as follows:

[0039] For each client First server calculate The first arithmetic share of the square of the modulus

[0040] Second server Calculate the square of the modulus Second arithmetic shared share The arithmetic shared shares held by the two servers and satisfy: ;

[0041] S4c, First Server Locally computed intermediate value vector First arithmetic shared share and intermediate value vector First arithmetic shared share ,in Represents the intermediate value vector No. The middle value First arithmetic sharing, express No. The middle value The first arithmetic sharing, and has

[0042] Second server Locally computed intermediate value vector Second arithmetic shared share and intermediate value vector Second arithmetic shared share ,in Represents the intermediate value vector The The middle value The second arithmetic sharing, express No. The middle value The second arithmetic sharing, and has

[0043] ;

[0044] Server exchange , and , And calculate the intermediate value vector. With intermediate value vector and And among them

[0045] , ;

[0046] S4d, for any two different clients and , and Local update and Between Square of norm distance Arithmetic Share and The specific steps are as follows:

[0047] First Server calculate Square of norm distance First arithmetic share:

[0048] Second server calculate Square of norm distance Second arithmetic shared share

[0049] The arithmetic shared shares held by the two servers and satisfy: ;

[0050] S4e, for any two different clients and , and Local update and The cosine distance between them is ,in Represents the vector magnitude, first server First calculate the variable to be encrypted

[0051] Then use the public key of the Paillier cryptography mechanism. For 3 plaintexts , as well as Encryption yields ciphertext corresponding to the three plaintexts in a single encryption:

[0052] ,in Indicates the use of a public key A function to encrypt plaintext. For two local update vectors and Inner product First arithmetic sharing, Represents the local update vector The square of the modulus First arithmetic sharing, Represents the local update vector The square of the modulus The first arithmetic sharing will encrypt three ciphertexts in one step. Send to the second server ;

[0053] Second server Receive 3 encrypted ciphertexts at once From the ring of integers One blinding factor is randomly selected uniformly. Three single-encrypted ciphertexts are then encrypted a second time to obtain three double-encrypted ciphertexts:

[0054] , and satisfy , and ,in Indicates the use of private key A function to decrypt ciphertext. Modulus Seeking Exponentiation of powers;

[0055] Second server Use public key Generate 3 first-time blinded ciphertexts , , The expression is as follows:

[0056] ,

[0057] in , , ,symbol" "Right-to-left operation mapping relationship;"

[0058] Then, the blinded ciphertext is processed to obtain three secondary blinded ciphertexts. , , :

[0059] , , .

[0060] Furthermore, the Paillier cryptographic mechanism is a public-key encryption scheme that supports additive homomorphism, possessing the following additive homomorphic property: given two plaintexts... and ,satisfy and ,and and Corresponding ciphertext and Then there is 3 secondary blinded ciphertexts , , Send back to the first server First server Use private key Decrypt the received ciphertext: Then calculate the cosine distance of the plaintext: via plaintext cosine distance Constructed cosine distance matrix ,in The entire process achieved similarity measurement while protecting gradient privacy.

[0061] Furthermore, step S5 is as follows:

[0062] S5a, First Server Perform orientation-based clustering filtering, using the cosine distance matrix... Clustering is performed, and clients that fail to meet the minimum cluster size requirement are marked as outliers. All clients marked as outliers by the clustering operation are removed, resulting in a temporary benign set. ;

[0063] S5b, Assuming Subscript subscript ,in , Represents a benign set Mold taking operation, Represent real numbers The integer rounded down for each client , modulus square First arithmetic shared share By the first server Holding, second arithmetic shared share By the first server Holding, two servers cooperate, without recovery Under the premise of determining all The Middle Small elements and the first For smaller elements, the specific operations are as follows:

[0064] For benign sets Any two different clients and The corresponding square of the modulus and The two servers compared and The size relationship is obtained and The size relationship is used to determine the size of all clients. The corresponding square of the modulus Sort the data, and let the final sorted result be (from smallest to largest). ,in yes The Small vector magnitude squared, ,remember The Middle element for , The Middle element for The first server holds First arithmetic shared share for , First arithmetic shared share for Record the second server holding Second arithmetic shared share for , Second arithmetic shared share for ;

[0065] S5c, Based on the locally updated squared modulus, apply the temporary benign set. Filtering is performed on the client side, and two servers are used. and Calculate the anomaly threshold locally. Arithmetic Share and : For each client Remove all The client, to obtain a set of benign clients. ,in .

[0066] Furthermore, step S6 is as follows:

[0067] S6a, Assumption A collection of benign clients The number of clients in the first server For all clients Local update First arithmetic shared share Perform aggregation operations to obtain a new global model First arithmetic shared share

[0068] ,

[0069] in It is a new global model No. The first arithmetic shared share of each model parameter Indicates client Corresponding local update No. The first arithmetic shared share of the local update value corresponding to each parameter, and the second server. For all clients Local update Second arithmetic shared share Perform aggregation operations to obtain a new global model Second arithmetic shared share

[0070] ,

[0071] in It is a new global model No. The second arithmetic shared share of each model parameter Indicates client Corresponding local update No. The second arithmetic shared share of the local update values ​​corresponding to each parameter;

[0072] S6b, First Server Second server exchange and ,

[0073] Finally, the new global model is calculated. ,

[0074] in It is a new global model No. Dimensional model parameters.

[0075] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0076] (1) This invention achieves high robustness while ensuring strong privacy. Traditional solutions often compromise one thing for another: pure privacy solutions (such as SecAgg) cannot defend against malicious clients; while robust solutions (such as FoolsGold and Krum) require plaintext gradients, sacrificing privacy. This invention, through an arithmetic secret sharing mechanism under a dual-server model, ensures that the client's original updates always exist in the form of shards; and for the first time, it introduces a pre-shared squared association pair (SC) arithmetic sharing share, combined with a dedicated security protocol, so that nonlinear operations necessary for robust analysis, such as calculating gradient norms and pairwise distances, can be completed without reconstructing plaintext, thus unifying the two major goals of privacy and robustness at the cryptographic level.

[0077] (2) This invention offers higher computational efficiency and practicality. Existing schemes attempting to balance privacy and robustness often rely on fully homomorphic encryption (FHE), but its enormous computational overhead and ciphertext expansion make it impractical. This invention abandons the general FHE and instead adopts a lightweight hybrid cryptographic architecture: core aggregation and distance calculation are based on efficient arithmetic secret sharing, supplemented only when necessary (such as cosine similarity calculation) by a one-time Paillier cryptographic mechanism homomorphic operation. Simultaneously, a dynamic dual filtering mechanism (HDBSCAN clustering + adaptive threshold) is efficiently executed on the main server, avoiding complex ciphertext iterative clustering. This series of designs enables this invention to significantly reduce computational and communication costs while maintaining strong security, making it more suitable for deployment in real-world federated learning scenarios. Attached Figure Description

[0078] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0079] Figure 1 This is a flowchart of the privacy-preserving robust federated learning aggregation method for resisting backdoor attacks in federated learning disclosed in this invention;

[0080] Figure 2 This is a diagram showing the results of clustering using the HDBSCAN algorithm with cosine distance as the metric. Detailed Implementation

[0081] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0082] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0083] Example 1

[0084] While federated learning avoids centralized storage of raw datasets and reduces the risk of privacy breaches, it still faces two core challenges: privacy breaches and backdoor attacks. To protect privacy, existing methods often employ differential privacy, injecting noise into local client updates to prevent back-calculation of individual data from gradients. Simultaneously, cryptographic techniques such as homomorphic encryption and secure multi-party computation can encrypt model updates during transmission, achieving ciphertext aggregation and ensuring data confidentiality. Regarding robustness, mainstream solutions focus on resisting backdoor attacks from malicious clients, such as robust aggregation based on Krum and Median, or using gradient norms and cosine similarity to set static thresholds for anomaly detection, as well as cluster analysis, to identify and eliminate toxic updates.

[0085] However, current privacy protection and robustness enhancement mechanisms are clearly disconnected. On the one hand, while privacy schemes based on homomorphic encryption and secure multi-party computation can prevent semi-honest servers from snooping on the original gradients, their aggregation logic is static and "blind," unable to semantically discern malicious updates; moreover, homomorphic encryption and secure multi-party computation often come at the cost of sacrificing model utility or significantly increasing communication or computational overhead. On the other hand, while robust methods (such as clustering and norm pruning) effectively defend against backdoor attacks, they require calculating gradient distances or similarities in plaintext, exposing client-side private information and violating the original intention of federated learning.

[0086] This embodiment is a privacy-protected robust federated learning aggregation method that defends against backdoor attacks by preventing semi-trusted servers and malicious clients from compromising the privacy and security of local client data, while effectively identifying and filtering out local updates from malicious clients.

[0087] Before introducing the technical solution, the mathematical foundation and definitions involved in this invention will be explained as follows:

[0088] Regarding the Paillier cryptography mechanism

[0089] set up Two large prime numbers and The product of for and The least common multiple of, and set the generator. Auxiliary functions x is the input parameter of the auxiliary function, and the modular inverse is... ,in Indicates in the model The multiplicative inverse of the following is the public key of the Paillier cryptosystem. and private key .

[0090] The Paillier cryptosystem is a public-key encryption scheme that supports additive homomorphism. This scheme possesses the following additive homomorphic property: given two plaintexts... and ,satisfy and ,and and Corresponding ciphertext and Then there is ,in Indicates the use of a public key A function to encrypt plaintext. Indicates the use of private key A function that decrypts plaintext. That is, the result of multiplying ciphertext corresponds to the encrypted result of adding plaintext. Therefore, Paillier encryption supports direct addition operations on the ciphertext field without decryption.

[0091] To support operations such as secure distance calculation, dynamic clustering, and adaptive threshold filtering without disclosing local client updates, and to simultaneously achieve the dual goals of resisting eavesdropping and backdoor attacks, this embodiment discloses a privacy-preserving robust federated learning aggregation method to resist federated learning backdoor attacks, comprising the following steps:

[0092] S1, by the first server The main system initialization, the first server Before federated learning begins, a public key will be executed. and private key The generation of the public-private key pair, which is composed of public and private key pairs. Encryption and decryption for the Paillier cryptosystem, and the public key Distributed to the second server .

[0093] First Server Second server The two servers collaborate to complete the task of global model aggregation in federated learning. At most one of them is a semi-honest server, and the first server... Responsible for generating the public key in the Paillier cryptosystem. and private key ,in and Both are binary codes of a certain length, and then the public key is... Send to the second server .

[0094] The specific process for this step is as follows:

[0095] S1a, First Server Receive security parameters Then randomly generate two large prime numbers. and The bit length of each prime number is ,and and The greatest common divisor is 1, the first server Next, calculate the encryption modulus of the Paillier cryptosystem. Carmichael function value for and The least common multiple of, and set the generator. Define auxiliary functions x is the input parameter of the auxiliary function, and the modular inverse is calculated. ,in Indicates in the model Multiplicative inverse;

[0096] S1b, First Server Generate public key and private key Then the public key is transmitted through a secure channel. Send to server ;

[0097] S1c, Second Server Receive and store public key .

[0098] S2, N clients Parallel execution of local training and arithmetic shared share generation, i=1,2,…,N, assuming a global model. The number of parameters is , No. Client Generate local update vector and pre-calculate by the client First related share and client Second related share The squared correlation pairs ,in express The local update value corresponding to the k-th parameter. It means The The associated values ​​corresponding to each parameter It means The associated value corresponding to the kth parameter, and For all Established, To precompute the bit width of the numerical values, all squared correlation pairs are operated on in the integer ring. In the process, then calculate. arithmetic sharing and ,calculate arithmetic sharing and ,calculate arithmetic sharing and Finally Send to the first server ,Will Send to the second server .

[0099] The specific process for this step is as follows:

[0100] S2a, Assuming a global model The number of parameters is N clients Using the global model in round t-1 In the client Local private dataset Training is performed on the local update vector to obtain the local update vector. ,in Represents the local update vector No. The local update value corresponding to each parameter, and then... By performing arithmetic sharing decomposition, we obtain... First arithmetic shared share Second arithmetic share

[0101] ,in This represents the local update vector. No. The first arithmetic shared share of the local update values ​​corresponding to each parameter. This represents the local update vector. No. The second arithmetic shared share of the corresponding local update values ​​for each parameter, for The process of splitting arithmetic sharing is as follows: First, randomly generate the first arithmetic sharing share. Each element in, through calculation Obtain the second arithmetic shared share

[0102] All elements in;

[0103] S2b, Client The first association share of generating square association pairs and the second related share ,in express The One associated value, express The One associated value, and Then Break it down into arithmetic sharing, and get

[0104] and Similarly Decomposed into arithmetic sharing and ,in , They represent No. The first and second arithmetic shared shares of the associated values , They represent No. The first and second arithmetic shared shares of each associated value;

[0105] S2c, Client Set the first arithmetic shared shares Send to the first server Second arithmetic shared share set Send to the second server ;

[0106] S2d, First Server Second server Receive and temporarily store N clients The first and second arithmetic shared share sets.

[0107] S3, First Server Second server Cooperatively perform quadratic association pair verification without refactoring Given the original value, verify any client c i Submitted square association pairs Does it meet the requirements? right Once established, remove clients that fail verification and add the set of verified clients. Reserved for use in subsequent steps.

[0108] The specific process for this step is as follows:

[0109] S3a, For N clients First server With the second server Together from the set Randomly select two distinct indices without replacement. and Until the set is empty, each time an index is selected... and After that, the first server Second server Together from model Randomly sample an odd number from the ring of integers First server Calculate intermediate variables ,in express No. The first arithmetic share of each associated value express No. The first arithmetic shared share of the associated values, the second server Locally computed intermediate variables ,in express No. The second arithmetic shared share of each associated value express No. The second arithmetic shared share of the associated values, the first server Second server exchange and And calculate First server calculate

[0110] ,in express No. The first arithmetic shared share of the associated values, the second server calculate ,in express No. The second arithmetic shared share of the associated values, the first server Second server exchange as well as And verify the conditions Whether it is true or false, if all subscripts are true or false. and If all combinations of these conditions satisfy the verification criteria, then the client will be... Marked as "valid"; if verification fails in any case, the client will be... Marked as "invalid";

[0111] S3b, Let the set of clients that have passed verification be... Preserve client set Data submitted in step S2 on both servers is discarded if the client's data in step S2 fails to pass verification.

[0112] S4, First Server Second server Collaborative execution of safe distance and cosine similarity calculations without reconstructing the original global model. Secure computation for any client while updating vectors The square of the magnitude of the local update vector First arithmetic shared share Second arithmetic share Any two clients and Between Square of norm distance First arithmetic shared share Second arithmetic share The cosine distance matrix between any two clients ,in, Indicates client The square norm of the gradient vector,

[0113] Indicates client and gradient vector and The square Euclidean distance and the cosine distance are For any two different clients and cosine distance matrix No. Line number The elements of the column are represented as follows: ;

[0114] The specific process for this step is as follows:

[0115] S4a, First Server The first arithmetic share of the locally computed intermediate vector ,in Represents the intermediate vector First arithmetic shared share and , Second server The second arithmetic share of the locally computed intermediate vector ,in Represents the intermediate vector The second arithmetic shared share and The two servers then exchange information with each other. and And calculate the intermediate vector And among them yes , ;

[0116] S4b, compute any client The square of the magnitude of the local update vector Arithmetic Share and ,in The square of the magnitude of the vector is represented as follows:

[0117] For each client ,

[0118] First Server calculate The first arithmetic share of the square of the modulus Second server Calculate the square of the modulus Second arithmetic shared share The arithmetic shared shares held by the two servers and satisfy: No information about the original gradient was leaked throughout the process. Plaintext information;

[0119] S4c, First Server Locally computed intermediate value vector First arithmetic shared share and intermediate value vector First arithmetic shared share ,in Represents the intermediate value vector No. The middle value First arithmetic sharing, express No. The middle value First arithmetic sharing,

[0120] And there are Second server Locally computed intermediate value vector Second arithmetic shared share and intermediate value vector Second arithmetic shared share ,in Represents the intermediate value vector The The middle value The second arithmetic sharing, express No. The middle value The second arithmetic sharing,

[0121] And there are ;

[0122] Server exchange , and , And calculate the intermediate value vector.

[0123] With intermediate value vector and And among them

[0124] , ;

[0125] S4d, for any two different clients and , and Local update and Between Square of norm distance Arithmetic Share and The specific steps are as follows:

[0126] First Server calculate Square of norm distance First arithmetic share:

[0127] Second server calculate Square of norm distance Second arithmetic shared share

[0128] The arithmetic shared shares held by the two servers and satisfy: No information about the original gradient was leaked throughout the entire calculation process. or Plaintext information;

[0129] S4e, for any two different clients and , and Local update and The cosine distance between them is ,in Represents the vector magnitude, first server First calculate the variable to be encrypted

[0130] Then use the public key of the Paillier cryptography mechanism. For 3 plaintexts , as well as Encryption yields ciphertext corresponding to the three plaintexts in a single encryption:

[0131] ,in Indicates the use of a public key A function to encrypt plaintext. For two local update vectors and Inner product First arithmetic sharing, Represents the local update vector The square of the modulus First arithmetic sharing, Represents the local update vector The square of the modulus The first arithmetic sharing will encrypt three ciphertexts in one step. Send to the second server ;

[0132] Second server Receive 3 encrypted ciphertexts at once From the ring of integers One blinding factor is randomly selected uniformly. Three single-encrypted ciphertexts are then encrypted a second time to obtain three double-encrypted ciphertexts:

[0133] ,

[0134] and satisfy , and ,in Indicates the use of private key A function to decrypt ciphertext. Modulus Seeking Exponentiation of powers;

[0135] Second server Use public key Generate 3 first-time blinded ciphertexts , , The expression is as follows:

[0136] ,

[0137] in , , ,symbol" "Right-to-left operation mapping relationship;"

[0138] Then, the blinded ciphertext is processed to obtain three secondary blinded ciphertexts. , , :

[0139] , , .

[0140] Three secondary blinded ciphertexts , , Send back to the first server ;

[0141] First Server Use private key Decrypt the received ciphertext:

[0142] Then calculate the cosine distance of the plaintext: via plaintext cosine distance Constructed cosine distance matrix ,in The entire process achieved similarity measurement while protecting gradient privacy.

[0143] S5. Use clustering operations to analyze client sets. Using the cosine distance between clients as a metric, clients that fail to meet the minimum cluster size requirement are marked as outliers. A second filtering process based on thresholding is then performed to obtain a set of benign clients. .

[0144] The specific process for this step is as follows:

[0145] S5a, First Server Perform orientation-based clustering filtering, using the cosine distance matrix... Clustering is performed, and clients that fail to meet the minimum cluster size requirement are marked as outliers. All clients marked as outliers by the clustering operation are removed, resulting in a temporary benign set. ;

[0146] S5b, Assuming Subscript subscript ,in , Represents a benign set Mold taking operation, Represent real numbers The integer rounded down for each client , modulus square First arithmetic shared share By the first server Holding, second arithmetic shared share By the first server Holding, two servers cooperate, without recovery Under the premise of determining all The Middle Small elements and the first For smaller elements, the specific operations are as follows:

[0147] For benign sets Any two different clients and The corresponding square of the modulus and The two servers compared and The size relationship is obtained and The size relationship is used to determine the size of all clients. The corresponding square of the modulus Sort the data, and let the final sorted result be (from smallest to largest).

[0148] ,in yes The Small vector magnitude squared, ,remember The Middle element for , The Middle element for The first server holds First arithmetic shared share for , First arithmetic shared share for Record the second server holding Second arithmetic shared share for , Second arithmetic shared share for ;

[0149] S5c, Based on the locally updated squared modulus, apply the temporary benign set. Filtering is performed on the client side, and two servers are used. and Calculate the anomaly threshold locally. Arithmetic Share and :

[0150] For each client Remove all The client, to obtain a set of benign clients. ,in .

[0151] S6, First Server Aggregate all clients The first arithmetic shared share of the local update vector A new global model is obtained First arithmetic shared share Second server Aggregate all clients The second arithmetic shared share of the local update vector A new global model is obtained Second arithmetic shared share The first server and the second server exchange the first arithmetic shared share. Second arithmetic share A new global model is obtained .

[0152] The specific process for this step is as follows:

[0153] S6a, Assumption A collection of benign clients The number of clients in the first server For all clients Local update First arithmetic shared share Perform aggregation operations to obtain a new global model First arithmetic shared share ,

[0154] in It is a new global model No. The first arithmetic shared share of each model parameter Indicates client Corresponding local update No. The first arithmetic shared share of the local update value corresponding to each parameter, and the second server. For all clients Local update Second arithmetic shared share Perform aggregation operations to obtain a new global model Second arithmetic shared share ,

[0155] in It is a new global model No. The second arithmetic shared share of each model parameter Indicates client Corresponding local update No. The second arithmetic shared share of the local update values ​​corresponding to each parameter;

[0156] S6b, First Server Second server exchange and ,

[0157] Finally, the new global model is calculated. ,

[0158] in It is a new global model No. Dimensional model parameters.

[0159] Example 2

[0160] In this embodiment, the number of clients is 6, and the parameter size of the client model is 7. The specific process in this example is as follows: T1, referring to step S1 of example 1, the first server... The main system initialization, the first server Before federated learning begins, a public key will be executed. and private key The generation of the public-private key pair, and the public key Distributed to the second server .

[0161] T2. Referring to step S2 in Example 1, the six clients execute local training and arithmetic share generation in parallel, and then send the data to the corresponding clients respectively. Assume that the data generated by each client is as follows:

[0162] Client Locally updated first arithmetic sharing Locally updated second arithmetic sharing Square correlation pairs The first arithmetic sharing are respectively as well as Square correlation pairs The second arithmetic sharing are respectively as well as .

[0163] Client Locally updated first arithmetic sharing Locally updated second arithmetic sharing Square correlation pairs The first arithmetic sharing are respectively as well as Square correlation pairs The second arithmetic sharing are respectively as well as .

[0164] Client Locally updated first arithmetic sharing Locally updated second arithmetic sharing Square correlation pairs The first arithmetic sharing are respectively as well as Square correlation pairs The second arithmetic sharing are respectively as well as .

[0165] Client Locally updated first arithmetic sharing Locally updated second arithmetic sharing Square correlation pairs The first arithmetic sharing are respectively as well as Square correlation pairs The second arithmetic sharing are respectively as well as .

[0166] Client Locally updated first arithmetic sharing Locally updated second arithmetic sharing Square correlation pairs The first arithmetic sharing are respectively as well as Square correlation pairs The second arithmetic sharing are respectively as well as .

[0167] Client Locally updated first arithmetic sharing Locally updated second arithmetic sharing Square correlation pairs The first arithmetic sharing are respectively as well as Square correlation pairs The second arithmetic sharing are respectively as well as .

[0168] T3. Referring to step S3 in Example 1, the two servers collaboratively verify the correctness of the square association pairs sent by the client. (The verification process is repeated on the client side.) When checking the correctness of the square association pairs, assume that the two servers choose the following indices. and Odd number of random samples First server Calculate intermediate variables ,in express The first element in express The first in One element, second server Locally computed intermediate variables ,in express The first element in express The first in One element, two servers and exchange and And calculate First server calculate ,in express The One element, second server calculate ,in express The first element, the first and second servers and exchange as well as Obviously, the conditions cannot be met. Therefore, the client cannot pass the verification. It was marked as "invalid". Since the other clients all met the verification conditions, the set of clients that passed verification is... .

[0169] T4. Referring to step S4 in Example 1, the first server... Second server Collaborative execution of safe distance and cosine similarity calculation. The resulting cosine distance matrix. as follows: ,

[0170] in Indicates client and client The cosine distance between local updates, and the normal cosine distance. cosine distance matrix The data in the 5th row and 5th column is both -1, indicating that the client... It was not involved in the calculation of the cosine distance.

[0171] T5. Referring to step S5 in Example 1, the server... The cosine distance matrix As input to the HDBSCAN algorithm, clients that fail to meet the minimum cluster size requirement are marked as outliers, and all clients marked as outliers by the clustering operation are removed. Figure 2 You can see the client Local update The direction of the update is significantly offset from the direction of the local updates on other clients, therefore the client... They will be excluded, resulting in a temporary benign set. Then calculate the anomaly threshold. Since there is only a client Local update The square of the modulus The client is above the abnormal threshold. They will be excluded, resulting in a benign client set. .

[0172] T6. Referring to step S6 in Example 1, the first server... Aggregate all clients The first arithmetic shared share of the local update vector A new global model is obtained First arithmetic shared share Second server Aggregate all clients The second arithmetic shared share of the local update vector A new global model is obtained Second arithmetic shared share The first server and the second server exchange the first arithmetic shared share. Second arithmetic share A new global model is obtained .

[0173] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0174] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A privacy-preserving robust federated learning aggregation method to resist backdoor attacks, characterized in that, The federated learning aggregation method includes the following steps: S1, by the first server The main system initialization, the first server Before federated learning begins, a public key will be executed. and private key The generation of the public-private key pair, which is composed of public and private key pairs. Encryption and decryption for the Paillier cryptosystem, and the public key Distributed to the second server ; S2, N clients Parallel execution of local training and arithmetic shared share generation, i=1,2,…,N, assuming a global model. The number of parameters is , No. Client Generate local update vector and pre-calculate by the client First related share and client Second related share The squared correlation pairs ,in express The local update value corresponding to the k-th parameter. It means The The associated values ​​corresponding to each parameter It means The associated value corresponding to the kth parameter, and For all Established, To precompute the bit width of the numerical values, all squared correlation pairs are operated on in the integer ring. In the process, then calculate. arithmetic sharing and ,calculate arithmetic sharing and ,calculate arithmetic sharing and Finally Send to the first server ,Will Send to the second server ; S3, First Server Second server Cooperatively perform quadratic association pair verification without refactoring Given the original value, verify any client c i Submitted square association pairs Does it meet the requirements? right Once established, remove clients that fail verification and add the set of verified clients. Reserved for use in subsequent steps; S4, First Server Second server Collaborative execution of safe distance and cosine similarity calculations without reconstructing the original global model. Secure computation for any client while updating vectors The square of the magnitude of the local update vector First arithmetic shared share Second arithmetic share Any two clients and Between Square of norm distance First arithmetic shared share Second arithmetic share The cosine distance matrix between any two clients ,in, Indicates client The square norm of the gradient vector, Indicates client and gradient vector and The square Euclidean distance and the cosine distance are For any two different clients and cosine distance matrix No. Line number The elements of the column are represented as follows: ; S5. Use clustering operations to analyze client sets. Using the cosine distance between clients as a metric, clients that fail to meet the minimum cluster size requirement are marked as outliers. A second filtering process based on thresholding is then performed to obtain a set of benign clients. ; S6, First Server Aggregate all clients The first arithmetic shared share of the local update vector A new global model is obtained First arithmetic shared share Second server Aggregate all clients The second arithmetic shared share of the local update vector A new global model is obtained Second arithmetic shared share The first server and the second server exchange the first arithmetic shared share. Second arithmetic share A new global model is obtained .

2. The privacy-preserving robust federated learning aggregation method for resisting backdoor attacks according to claim 1, characterized in that, The process of step S1 is as follows: S1a, First Server Receive security parameters Then randomly generate two large prime numbers. and The bit length of each prime number is ,and and The greatest common divisor is 1, the first server Next, calculate the encryption modulus of the Paillier cryptosystem. Carmichael function value for and The least common multiple of, and set the generator. Define auxiliary functions x is the input parameter of the auxiliary function, and the modular inverse is calculated. ,in Indicates in the model Multiplicative inverse; S1b, First Server Generate public key and private key Then the public key is transmitted through a secure channel. Send to server ; S1c, Second Server Receive and store public key .

3. The privacy-preserving robust federated learning aggregation method for resisting backdoor attacks according to claim 1, characterized in that, The process of step S2 is as follows: S2a, Assuming a global model The number of parameters is N clients Using the global model in round t-1 In the client Local private dataset Training is performed on the local update vector to obtain the local update vector. ,in Represents the local update vector No. The local update value corresponding to each parameter, and then... By performing arithmetic sharing decomposition, we obtain... First arithmetic shared share Second arithmetic share ,in This represents the local update vector. No. The first arithmetic shared share of the local update values ​​corresponding to each parameter. This represents the local update vector. No. The second arithmetic shared share of the corresponding local update values ​​for each parameter, for The process of splitting arithmetic sharing is as follows: First, randomly generate the first arithmetic sharing share. Each element in, through calculation Obtain the second arithmetic shared share All elements in; S2b, Client The first association share of generating square association pairs and the second related share ,in express The One associated value, express The One associated value, and Then Split into arithmetic sharing, get and Similarly Decomposed into arithmetic sharing and ,in , They represent No. The first and second arithmetic shared shares of the associated values , They represent No. The first and second arithmetic shared shares of each associated value; S2c, Client Set the first arithmetic shared shares Send to the first server Second arithmetic shared share set Send to the second server ; S2d, First Server Second server Receive and temporarily store N clients The first and second arithmetic shared share sets.

4. The privacy-preserving robust federated learning aggregation method for resisting backdoor attacks according to claim 1, characterized in that, The process of step S3 is as follows: S3a, For N clients First server With the second server Together from the set Randomly select two distinct indices without replacement. and Until the set is empty, each time an index is selected... and After that, the first server Second server Together from model Randomly sample an odd number from the ring of integers First server Calculate intermediate variables ,in express No. The first arithmetic share of each associated value express No. The first arithmetic shared share of the associated values, the second server Locally computed intermediate variables ,in express No. The second arithmetic shared share of each associated value express No. The second arithmetic shared share of the associated values, the first server Second server exchange and And calculate First server calculate ,in express No. The first arithmetic shared share of the associated values, the second server calculate ,in express No. The second arithmetic shared share of the associated values, the first server Second server exchange as well as And verify the conditions Whether it is true or false, if all subscripts are true or false. and If all combinations of these conditions satisfy the verification criteria, then the client will be... Marked as "valid"; if verification fails in any case, the client will be... Marked as "invalid"; S3b, Let the set of clients that have passed verification be... Preserve client set Data submitted in step S2 on both servers is discarded if the client's data in step S2 fails to pass verification.

5. The privacy-preserving robust federated learning aggregation method for resisting backdoor attacks according to claim 1, characterized in that, The process of step S4 is as follows: S4a, First Server The first arithmetic share of the locally computed intermediate vector ,in Represents the intermediate vector First arithmetic shared share and , Second server The second arithmetic share of the locally computed intermediate vector ,in Represents the intermediate vector The second arithmetic shared share and The two servers then exchange information with each other. and And calculate the intermediate vector And among them yes , ; S4b, compute any client The square of the magnitude of the local update vector Arithmetic Share and ,in The square of the magnitude of the vector is represented as follows: For each client , First Server calculate The first arithmetic share of the square of the modulus Second server Calculate the square of the modulus Second arithmetic shared share The arithmetic shared shares held by the two servers and satisfy: ; S4c, First Server Locally computed intermediate value vector First arithmetic shared share and intermediate value vector First arithmetic shared share ,in Represents the intermediate value vector No. The middle value First arithmetic sharing, express No. The middle value First arithmetic sharing, And there are Second server Locally computed intermediate value vector Second arithmetic shared share and intermediate value vector Second arithmetic shared share ,in Represents the intermediate value vector The The middle value The second arithmetic sharing, express No. The middle value The second arithmetic sharing, And there are ; Server exchange , and , , And calculate the intermediate value vector. With intermediate value vector and And among them , ; S4d, for any two different clients and , and Local update and Between Square of norm distance Arithmetic Share and The specific steps are as follows: First Server calculate Square of norm distance First arithmetic share: Second server calculate Square of norm distance Second arithmetic shared share The arithmetic shared shares held by the two servers and satisfy: ； S4e, for any two different clients and , and Local update and The cosine distance between them is ,in Represents the magnitude of the vector. First Server First calculate the variable to be encrypted Then use the public key of the Paillier cryptography mechanism. For 3 plaintexts , as well as Encryption yields ciphertext corresponding to the three plaintexts in a single encryption: ,in Indicates the use of a public key A function to encrypt plaintext. For two local update vectors and Inner product First arithmetic sharing, Represents the local update vector The square of the modulus First arithmetic sharing, Represents the local update vector The square of the modulus The first arithmetic sharing will encrypt three ciphertexts in one step. Send to the second server ; Second server Receive 3 encrypted ciphertexts at once From the ring of integers One blinding factor is randomly selected uniformly. Three single-encrypted ciphertexts are then encrypted a second time to obtain three double-encrypted ciphertexts: , and satisfy , and ,in Indicates the use of private key A function to decrypt ciphertext. Modulus Seeking Exponentiation of powers; Second server Use public key Generate 3 first-time blinded ciphertexts , , The expression is as follows: ， in , , ,symbol" "Right-to-left operation mapping relationship;" Then, the blinded ciphertext is processed to obtain three secondary blinded ciphertexts. , , : ， ， 。 6. The privacy-preserving robust federated learning aggregation method for resisting backdoor attacks according to claim 5, characterized in that, The Paillier cryptosystem is a public-key encryption scheme that supports additive homomorphism, possessing the following additive homomorphic property: given two plaintexts... and ,satisfy and ,and and Corresponding ciphertext and Then there is Three secondary blinded ciphertexts , , Send back to the first server First server Use private key Decrypt the received ciphertext: Then calculate the cosine distance of the plaintext: via plaintext cosine distance Constructed cosine distance matrix ,in .

7. The privacy-preserving robust federated learning aggregation method for resisting backdoor attacks according to claim 1, characterized in that, The process of step S5 is as follows: S5a, First Server Perform orientation-based clustering filtering, using the cosine distance matrix... Clustering is performed, and clients that fail to meet the minimum cluster size requirement are marked as outliers. All clients marked as outliers by the clustering operation are removed, resulting in a temporary benign set. ; S5b, Assuming Subscript subscript ,in , Represents a benign set Mold taking operation, Represent real numbers The integer rounded down for each client , modulus square First arithmetic shared share By the first server Holding, second arithmetic shared share By the first server Holding, two servers cooperate, without recovery Under the premise of determining all The Middle Small elements and the first For smaller elements, the specific operations are as follows: For benign sets Any two different clients and The corresponding square of the modulus and The two servers compared and The size relationship is obtained and The size relationship is used to determine the size of all clients. The corresponding square of the modulus Sort the data, and let the final sorted result be (from smallest to largest). ,in yes The Small vector magnitude squared, ,remember The Middle element for , The Middle element for The first server holds First arithmetic shared share for , First arithmetic shared share for Record the second server holding Second arithmetic shared share for , Second arithmetic shared share for ; S5c, Based on the locally updated squared modulus, apply the temporary benign set. Filtering is performed on the client side, and two servers are used. and Calculate the anomaly threshold locally. Arithmetic Share and : For each client Remove all The client, to obtain a set of benign clients. ,in .

8. The privacy-preserving robust federated learning aggregation method for resisting backdoor attacks according to claim 1, characterized in that, The process of step S6 is as follows: S6a, Assumption A collection of benign clients The number of clients in the first server For all clients Local update First arithmetic shared share Perform aggregation operations to obtain a new global model First arithmetic shared share , in It is a new global model No. The first arithmetic shared share of each model parameter Indicates client Corresponding local update No. The first arithmetic shared share of the local update value corresponding to each parameter, and the second server. For all clients Local update Second arithmetic shared share Perform aggregation operations to obtain a new global model Second arithmetic shared share , in It is a new global model No. The second arithmetic shared share of each model parameter Indicates client Corresponding local update No. The second arithmetic shared share of the local update values ​​corresponding to each parameter; S6b, First Server Second server exchange and , Finally, the new global model is calculated. , in It is a new global model No. Dimensional model parameters.

Images