A Class-Level Parameter Aggregation Method and System Based on Homomorphic Encryption
By generating category public and private keys through homomorphic encryption and using a batch packaging strategy, the problem of insufficient category-level aggregation in existing schemes is solved. This achieves unbiased aggregation and fine-grained decryption authorization, reduces bandwidth consumption, enhances privacy protection, and improves the robustness and transferability of the model.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGZHOU UNIVERSITY
- Filing Date
- 2026-01-26
- Publication Date
- 2026-06-02
AI Technical Summary
Existing homomorphic encryption schemes are insufficient in terms of category-level aggregation and fine-grained decryption authorization, resulting in problems such as model overfitting, high bandwidth consumption, large protocol overhead, and insufficient privacy protection in multi-category, cross-domain, and non-IID data scenarios.
A class-level parameter aggregation method is adopted, and class public and private keys are generated through homomorphic encryption. The client decrypts locally and performs unbiased averaging based on the visible count to achieve selective decryption authorization. Historical classification header parameters are incorporated when the local model is updated, and a batch packaging strategy is adopted to reduce bandwidth and encryption times.
It achieves unbiased aggregation at the category level, reduces bandwidth consumption, enhances privacy protection, resists member inference and attribute inference attacks, and improves the robustness and transferability of the model.
Smart Images
Figure CN122138157A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of homomorphic encryption data aggregation technology, specifically to a class-level parameter aggregation method and system based on homomorphic encryption. Background Technology
[0002] When intelligent connected vehicles (including vehicle-mounted, roadside units, and cloud control platforms) are deployed across different automakers, cities, and even countries, they need robust recognition capabilities for diverse and dynamically evolving traffic signs, road facilities, and road condition events. Examples include regionally specific speed limit signs, temporary construction and detour signs, and road surface anomalies caused by extreme weather (water accumulation, icing, falling objects). Significant inter-domain differences exist in sign styles, frequency of occurrence, imaging equipment and parameters, weather / lighting / road surface materials, and traffic participant behavior patterns across different regions. This leads to insufficient generalization of single-domain trained models, while directly centralizing data raises privacy, compliance, and bandwidth cost issues. Federated learning, through a paradigm where data and models remain within their respective domains, allows for local training at each participant and aggregation and updates at the central server, which can alleviate the compliance and cost pressures of centralized data to some extent.
[0003] However, in real-world road scenarios, client data exhibits strong non-independent identical distribution and long-tailed category characteristics: within the same training round, some clients only observe a few or partially overlapping categories; the sample size, noise, and difficulty of the same category vary significantly across different regions, accompanied by temporal drift. Specifically, in cross-city traffic sign recognition scenarios, clients in cities with frequent rain and fog may frequently see the water accumulation warning category, while clients in sunny areas rarely see such samples; similarly, clients in mountainous cities have much higher sample coverage for the rockfall warning category than clients in plains areas. Under these conditions, if a unified aggregation of the entire model parameters or the entire layer parameters is adopted, it often implicitly assumes that each client contributes equally to each category, thus introducing meaningless updates to invisible classes (categories that have not seen samples in this round) and bias towards rare classes. If the aggregation results or participation information by category are directly disclosed, from a security threat perspective, parameters / gradients under plaintext or weak protection may be subject to member inference, attribute inference, and reconstruction attacks; even if only the category participation information and corresponding counts are disclosed, it is still possible to infer whether a certain domain covers certain sensitive scenarios through statistical side-channel analysis.
[0004] Homomorphic encryption allows direct algebraic operations on ciphertext. Existing federated learning schemes using homomorphic encryption often employ dense aggregation of the entire model or network layer, failing to distinguish between class visibility (whether a client has seen a certain class in this round) and its correction for the class average denominator. This easily leads to meaningless updates to invisible classes or biases towards rare classes, especially in cases of long-tailed classes and data drift. The model is prone to overfitting to some classes while performing poorly on others. Furthermore, existing methods lack fine-grained decryption authorization, typically configuring only public and private keys at the full model level. While this provides privacy protection, it fails to grant granular decryption authorization only to clients with the right to decrypt their assigned classes, lacking protection for class-level privacy and exposing the system to risks of member inference, attribute inference, and reconstruction attacks. At the engineering implementation level, visibility counts and class parameters are generally not batch-packaged with the ciphertext, resulting in high bandwidth consumption and protocol overhead. Therefore, there is an urgent need for a federated scheme that maintains dense aggregation and compliance boundaries while also achieving unbiased class-level averaging, fine-grained decryption, and bandwidth friendliness.
[0005] Therefore, although existing encryption schemes are important for protecting data privacy, their shortcomings in category-level aggregation and fine-grained decryption authorization limit their application in multi-category, cross-domain, and non-IID data. Summary of the Invention
[0006] To overcome the shortcomings and deficiencies of existing technologies, this invention provides a class-level parameter aggregation method and system based on homomorphic encryption. The invention enables the server to sum the parameters and visibility counts for each category in the ciphertext domain, and then distribute the summed ciphertext. The client decrypts locally and performs an unbiased average based on the visibility count. Selective decryption authorization is achieved through fine-grained public and private keys at the category level, and historical classification header parameters and the latest global classification header parameters are integrated during local model updates to mitigate knowledge forgetting. When uploading parameters, the client hides the existence of categories by using a fixed message format and zero-added ciphertext for invisible categories. The ciphertext upload process uses batch packaging to pack category parameters and visibility counts into the same ciphertext slot, significantly reducing bandwidth and encryption times.
[0007] To achieve the above objectives, the present invention adopts the following technical solution:
[0008] This invention provides a class-level parameter aggregation method based on homomorphic encryption, comprising the following steps:
[0009] Generate the category public and private keys required for homomorphic encryption, and distribute the private keys to clients who have the right to use the category data, where the category is a traffic sign or road condition event;
[0010] A classification model is trained based on data with category labels. For each category, the parameter vector of the corresponding category is calculated for the client, and the number of visible users for the corresponding category is calculated.
[0011] The parameter vectors and the number of visible counts of each category are concatenated into a slot vector to be encrypted. The slot vector is encoded into homomorphic encrypted plaintext and then encrypted using the public key of the corresponding category to obtain the ciphertext.
[0012] By performing homomorphic addition on each class and slot of the ciphertext, we obtain the sum of ciphertext parameters and the sum of ciphertext visibility counts.
[0013] The client decrypts the authorized category holding the private key, calculates the global class-level parameters based on unbiased average, and merges and updates them with the local historical classification headers;
[0014] Update the classification model and output the traffic sign or road condition event recognition results based on the updated classification model.
[0015] As a preferred technical solution, the parameter vector corresponding to the client category is calculated, which is the connection weight between the neuron of the corresponding category in the last fully connected layer of the classification model and all neurons in the previous layer.
[0016] As a preferred technical solution, the number of visible meters for the corresponding category is calculated, specifically including:
[0017] The client judges the data with category labels. If the corresponding category appears in the training samples in this round, the visibility count is 1; otherwise, the visibility count is 0.
[0018] As a preferred technical solution, the parameter vectors of each category and the number of visibility points are concatenated into a slot vector to be encrypted, and the method further includes:
[0019] When a category is not visible to the client, the parameter vector is set to the zero vector, the visibility count is set to zero, and they are concatenated into the slot vector to be encrypted. The slot vector is encoded into homomorphic encrypted plaintext, and then encrypted with the public key of the corresponding category to obtain the ciphertext.
[0020] As a preferred technical solution, the parameter vectors and visibility counts of each category are concatenated into a slot vector to be encrypted. The slot vector is encoded into homomorphic encrypted plaintext and encrypted with the public key of the corresponding category to obtain ciphertext. Specifically, a ciphertext fragmentation and packaging strategy is adopted. When the dimension of a single type of parameter vector exceeds the number of valid slots that a single ciphertext can carry, the parameter vector is divided into multiple fragments. At the end of each fragment, a slot is reserved to place the fragment visibility count or the total visibility count is carried by an independent ciphertext.
[0021] As a preferred technical solution, in the layout of fragmented visible counting, K ciphertexts are sent for each category, the 1st to Mth fragments contain the real parameter fragments and the tail slot contains the fragment count, and the remaining M+1 to Kth fragments are all sent as zero fragments;
[0022] In a layout where the total number of visible counts is carried by independent ciphertexts, each category sends a fixed number of K+1 ciphertexts. The first K ciphertexts are parameter fragments, and the last one contains the count ciphertext.
[0023] As a preferred technical solution, the client decrypts the authorization category holding the private key, using one or more of the following: grouping keys by category, threshold decryption, attribute-based encryption, or tag-based authorization.
[0024] As a preferred technical solution, global class-level parameters are obtained based on unbiased averaging and then merged and updated with local historical classification heads, specifically as follows:
[0025] ;
[0026] ;
[0027] in, Is client k in the th... The parameters of the s-th class corresponding to the local classifier in the federated learning training round. These are the parameters of the s-th class corresponding to the global classifier. It is the visible category owned by client k. It is a dynamic factor.
[0028] As a preferred technical solution, a local early stopping strategy and an anomaly detection strategy are also adopted in the classification model update step.
[0029] The present invention also provides a class-level parameter aggregation system based on homomorphic encryption, for implementing the above-mentioned class-level parameter aggregation method based on homomorphic encryption, including: multiple clients, a server, and a key management module;
[0030] The key management module generates category public and private keys required for homomorphic encryption, and distributes the private keys to clients that have the right to use category data, where the category is a traffic sign or a road condition event.
[0031] The client trains a classification model based on data with category labels. For each category, the client calculates the parameter vector for the corresponding category and the number of visible data for the corresponding category.
[0032] The client concatenates the parameter vectors of each category and the number of visible units into a slot vector to be encrypted, encodes the slot vector into homomorphic encrypted plaintext, and encrypts it with the public key of the corresponding category to obtain ciphertext.
[0033] The server performs homomorphic addition on the ciphertext slot by slot to obtain the sum of ciphertext parameters and the sum of ciphertext visibility counts.
[0034] The client decrypts the authorized category holding the private key, calculates the global class-level parameters based on unbiased average, and merges and updates them with the local historical classification header;
[0035] The client updates the classification model and outputs traffic sign or road condition event recognition results based on the updated classification model.
[0036] Compared with the prior art, the present invention has the following advantages and beneficial effects:
[0037] (1) The present invention grants decryption permissions to legitimate clients by category public and private keys. Clients can only decrypt the aggregation results of the categories they own. Unauthorized clients cannot restore the ciphertext even if they receive it, thus achieving fine-grained decryption authorization.
[0038] (2) The present invention also uploads an equivalent ciphertext with zeros for invisible classes, and packages the parameters and visibility counts in a fixed layout to ensure that the number and size of each round of messages remain consistent, thereby reducing the risk of leakage of class distribution.
[0039] (3) The present invention loads parameters and visibility count in the same slot based on the fragmented batch packing strategy, and can be fragmented in parallel, reducing the number of ciphertexts and transmission volume, and saving bandwidth.
[0040] (4) The server of the present invention performs homomorphic summation and aggregation on the received ciphertext without decryption, corrects the denominator of the average of the categories, realizes unbiased aggregation at the category level, and effectively avoids the erroneous updating of invisible classes and the bias of rare classes. Attached Figure Description
[0041] Figure 1 This is a flowchart illustrating the class-level parameter aggregation method based on homomorphic encryption of the present invention.
[0042] Figure 2 This is a schematic diagram illustrating the implementation framework of the class-level parameter aggregation method based on homomorphic encryption of the present invention.
[0043] Figure 3 This is a schematic diagram of the slot layout and batch packaging fragmentation strategy for homomorphic encryption in this invention;
[0044] Figure 4 This is a schematic diagram illustrating the existence concealment and fixed message format of the present invention. Detailed Implementation
[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.
[0046] Example 1
[0047] like Figure 1 , Figure 2 As shown, this embodiment provides a class-level parameter aggregation method based on homomorphic encryption, applied to a federated learning architecture containing at least one client and one aggregation server. In a central server-multi-client architecture, the client trains / fine-tunes the model using only local private data and extracts class-level parameters such as classification headers or class prototypes, as well as the visible count. Class-level keys and access control are used to batch encode and homomorphically encrypt the parameters and counts, sending them uplink in a fixed message format. The server, without holding any private keys, performs pure homomorphic summation only on the ciphertext of the same class, obtaining ciphertexts of parameter sums and count sums, which are then sent down. The client only decrypts authorized classes and performs unbiased averaging based on the counts to obtain global class-level parameters, which can then be further processed. The system performs constraint fusion and updates with local historical classification heads in one step; optional overlay of differential privacy and anomaly detection is available, supporting the uploading of only classification heads or prototypes to adapt to heterogeneous model structures and misaligned category sets; bandwidth and encryption overhead are reduced through fragmented batch packaging and parameter and count slot loading; category existence is hidden through invisible class equivalence zeroing and upload rhythm perturbation; the above steps are repeated until the preset termination condition or convergence criterion is met, achieving class-level unbiased aggregation and fine-grained decryption authorization without decryption or leaving the domain, resisting member or attribute inference and side-channel analysis, reducing communication and computation costs, and significantly improving the portability and robustness of the federated model in cross-domain, long-tail, and non-IID scenarios. Specifically, the following steps are included:
[0048] S1: Class Key and Access Control Configuration:
[0049] For each category Independent class public and private keys required to configure homomorphic encryption The server does not hold any private keys. It only performs homomorphic summation and establishes a decryption authorization policy for each category, so that the client can only decrypt the results of the category it is authorized to decrypt;
[0050] Only have categories The client holding the data usage rights possesses the corresponding private key. Other clients do not have decryption permissions for this category. The key is issued, revoked and rotated by the key management module KMS / CA. If necessary, it can be expanded into a group key or a threshold (t / n) key to adapt to governance needs.
[0051] In this embodiment, the key management module generates independent homomorphic key pairs for each category. It also records version numbers for rotation, and public keys. Send to all participating clients for encrypted uploads, private key It is only sent to clients who possess this type of data, and is used to decrypt the distributed aggregate ciphertext. The distribution process uses mTLS / certificate authentication (CA issues client certificates). The key management module determines whether to allow access to the private key based on the client's identity or attributes. Or decrypt the share.
[0052] Specifically, the key management module issues category keys, which are then issued separately for traffic signs and area-specific signs or events. Only city or car manufacturer clients that hold authorization for this type of data can obtain the corresponding private key. ;
[0053] S2: Local Training and Class-Based Statistics: Each client trains the classification model's classification head or category prototype locally. Consistency of the backbone network across clients is not required. For each category... Calculate the various parameter vectors of this client. This is used to characterize the sum, mean, gradient, etc., of the model parameters or prototypes of this class, as well as the number of visible numbers. (Visible = 1, invisible = 0, or the number of samples in this class);
[0054] In this embodiment, the client trains or fine-tunes the model on labeled local data, and the model is derived from a heterogeneous feature extractor. and isomorphic classification heads Composition, that is , This indicates a concatenation process. Feature extractors can employ different grid structures depending on client hardware capabilities and data characteristics, while the classification head maintains structural consistency across all clients. For classification tasks, the classification head can be further subdivided into... ,in This represents the parameter vector for the k-th client corresponding to category s (in a neural network, this is represented by the connection weights between the neuron of category s in the last fully connected layer and all neurons in the previous layer). The visibility count for class s is defined. The client possesses labeled data, and the client can distinguish categories. If category s appears in the current training samples, then... ;otherwise .
[0055] In this embodiment, the visible quantity is counted. This is an indicator of whether data for category s appears in the client's data; when the client has data for category s... The denominator is 1 if it is not possessed, and 0 if it is not possessed. After aggregation, the denominator is... To improve numerical stability and avoid zero denominator, The sum of the visible counts of category s is obtained by the server's secret summation and the client's decryption. In this embodiment, the secret summation is the summation of the ciphertext sent by each client participating in the training. The ciphertext includes the encryption of each category parameter and the encryption of the category visible count.
[0056] In this embodiment, the client only uploads the classification header parameters or category prototypes, and the backbone network parameters are not sent out, in order to adapt to the heterogeneity of the model structure and the misalignment of the category set;
[0057] Federated learning refers to a process where the server first initializes a global model, then distributes the model parameters to each client. Each client trains the model on its local data, and each client then sends its trained model parameters back to the server. The server then aggregates these parameters to obtain a new global model, which is then distributed back to the clients, and the process is repeated. In this embodiment, the client encrypts the trained model parameters before uploading them to the server. Since homomorphic encryption allows the server to aggregate the model parameters without decryption, the server no longer receives the aggregated model parameters but instead receives the aggregated ciphertext. The client also receives ciphertext and needs to decrypt it to obtain the actual aggregated parameters. If the current client has data of the corresponding category, it will have the key for that category, allowing it to decrypt the ciphertext for that category and obtain the parameters.
[0058] The client decrypts only the data of the categories it owns locally, using any one of the following methods or a combination thereof: (a) grouping by class key: different categories use different decryption authorizations; (b) threshold decryption: the consortium entities to which the category belongs jointly generate decryption shares; (c) attribute-based encryption or tag-based authorization: only clients that meet the policy can decrypt the corresponding category.
[0059] Specifically, grouping by key class means that each class s has an independent key pair. The key management module KMS / CA only stores the private key. The private key is sent to clients that possess data of that category; clients that do not possess data of that category do not hold the private key. The client receives the ciphertext. (The ciphertext of class s), check if the private key exists in the local keystore. If applicable, then execute. If not found, discard / skip directly.
[0060] Threshold decryption specifically means that the private key for category s is not held entirely by a single client, but is split into n parts, requiring at least t parts to decrypt. The client receives the ciphertext. Then, a decryption share request (including class_id=s, client identity credentials, ciphertext hash, etc.) is sent to the decryption service providers (KMS nodes / multi-institutional custodians) within the alliance; each service provider uses its own key share to decrypt the data. Calculate a partial decryption share and return it, that is, obtain a portion of the decrypted data. Plaintext; After the client (or designated merging party) collects ≥t copies, it performs share merging (usually interpolation / combination operations) to obtain plaintext. This means that even if a single entity leaks the information, it cannot be decrypted independently.
[0061] Attribute-based encryption or tag-based authorization specifically refers to: when the client needs to decrypt ciphertext... At that time, it is not by default that the key is possessed. Instead, it first uses its own attribute credentials, such as tags like "City=X, Car Company=A, Business=Road Condition Events," to apply to KMS for key materials for that category s. Encryption packets, short-term decryption tokens, or The session encapsulation key is used to distribute usable materials only when the client attributes satisfy Policy(s); the client decapsulates the key to obtain the materials. Then, on Perform HE decryption. In this embodiment, Policy(s) refers to the decryption access policy / authorization rules for category s, that is, which clients with which attributes and credentials are allowed to decrypt the aggregate ciphertext of category s.
[0062] S3: Batch Encoding and Encrypted Uplink: This enables batch encoding and encryption of various categories of data. and After being encoded using a homomorphic encryption algorithm, the ciphertext is batch-packaged into several ciphertext slots to obtain the ciphertext. , If a certain type is not visible on the client, then the encrypted zero vector and zero flag ciphertext are written to the corresponding slot; the ciphertext is then sent to the aggregation server.
[0063] like Figure 3 As shown, the encoding process consists of two steps: plaintext encoding and ciphertext encryption in CKKS. First, the class parameter vector is encoded... and visible quantity Concatenate them into a real number vector to be encrypted. Then, use CKKS' SIMD batching to pack the vector into the same plaintext slot vector, and finally encrypt it into ciphertext using the public key.
[0064] Specifically, for each category s, the client locally has the parameter vector for that category. and visible quantity The client first constructs the vector of the slot to be encrypted. d is the dimension of the parameter vector.
[0065] That is, place the parameters in the first slot, put the counting quantity in a reserved slot (usually the last slot), and then use CKKS Encoder to encode the data according to the selected parameters (polynomial modulus N, scale Δ, module chain Q). Encode it into CKKS plaintext (essentially a scaled polynomial representation), and then use the public key of that class. Encryption yields ciphertext .
[0066] When a certain category s is not visible to the client, then Set it to the zero vector. The same plaintext encoding and ciphertext encryption process is performed on [0|| 0] to generate ciphertext with zeros added, so as to ensure that the size / number of messages in each round is fixed and the existence of hidden categories is hidden. In this embodiment, the batch encoding and encryption uplink forces the invisible classes to also upload a ciphertext with zeros added, and packages the parameters and visibility counts in a fixed layout, so as not to leak the client category distribution.
[0067] If a certain parameter dimension d exceeds the number of valid slots L that a single ciphertext can carry, then... Divided into multiple sections according to the number of slots. Each chip is encoded and encrypted separately; a counting slot can still be placed at the end of each chip, such as... .
[0068] In homomorphic encryption methods, the CKKS scheme supports approximately homomorphic computation on complex / real numbers, provides SIMD vector batching capabilities, and can efficiently implement linear operations such as vectorized addition and scalar normalization, adapting to category-level parameter summation / averaging. Therefore, in this embodiment, the CKKS homomorphic encryption scheme is adopted.
[0069] Example of homomorphic encryption CKKS parameters: Ring dimension ,Proportion A module chain of 2-3 layers is sufficient to satisfy the additive noise budget (the module chain is defined by a series of modules Q; for example, the initial module Q of a 2-layer module chain may be approximately...). The magnitude of this value can be adjusted according to actual safety and performance requirements; if rotation / relinearization (such as SIMD rearrangement) is enabled, then configure gks and rlk as needed. The default configuration does not force the distribution of gks / rlk.
[0070] In this embodiment, the vector to be encrypted is constructed. Where d is the dimension of the parameter vector, the model parameters and the number of visible numbers are placed in the same slot vector, and the client public key is used based on the selected parameter configuration that supports approximate arithmetic homomorphic encryption (polynomial modulus degree N, scale Δ, modulus Q). For vectors Encrypt and generate ciphertext. .like Figure 4 As shown, for invisible classes, a ciphertext is also uploaded ( The parameters are either zeroed out (equivalent to keeping the difference from the previous round to 0) to ensure that the message size and number remain fixed in each round, thereby hiding the existence of categories and differences in sample size. For high-dimensional parameters, a encrypted fragmentation and packaging strategy is used. When the number of effective slots L that a single ciphertext can carry is exceeded, the parameter vector is divided into... / L fragments, each fragment is in the form of L fragments. , Where || represents vector concatenation, and each fragment has a slot at the end to store the fragment visibility count, or a single independent ciphertext can be used to carry the total visibility count. Either layout can be chosen.
[0071] In segmented counting mode, the end-side segment normalization and splicing are more robust; in independent counting mode, the end-side normalizes the total count and uniformly scales the segments. can The chips are loaded in 8 pieces, with each chip having a tail slot containing one counter bit, or an independent small encrypted message carrying the counter.
[0072] Fixed message format: Define a fixed number of K ciphertexts for each type to be uploaded in each round (K = number of fragments or upper bound), and fill the gaps with equivalent zeros; at the same time, use upload rhythm perturbation (e.g., randomly jitter batch transmission time within ±50ms) and batch alignment to reduce time side channeling.
[0073] A fixed message format using a fragmented counting layout (with the count placed in the last slot of each parameter fragment) is as follows: K ciphertexts are sent for each category. The 1st to Mth fragments contain the actual parameter fragments, and the last slot contains the count / flag for that fragment. The remaining M+1 to Kth fragments are all sent as zero fragments (parameters are 0, and the last slot count is also 0). In this way, the count is already included in these K fragments, and no additional ciphertext is needed.
[0074] The fixed message format using an independent counting layout (the total number of visible counts is carried by a single small ciphertext) is as follows: K+1 ciphertexts are sent for each category. The first K ciphertexts are parameter fragments (if insufficient, they are padded with zero fragments), and the last ciphertext is dedicated to the count ciphertext. For invisible categories, a ciphertext with a count of 0 plus zero is sent. In this way, regardless of whether the category is visible or not, or whether there are insufficient fragments, the server can obtain both the parameter and count ciphertexts at a fixed location, and the external world cannot see the category participation status.
[0075] In this embodiment, the client performs encryption on {{} before encryption. Implement pruning / norm constraints and optional differential privacy noise injection to defend against malicious update and inference attacks;
[0076] In this embodiment, the batch packaging adopts a fixed layout of the category parameter fragment-slot mapping table. The parameter fragments of the same category and their visible count components are placed in the same ciphertext at a fixed offset, so as to aggregate parameters and indicators in a single homomorphic addition, thereby reducing the number of ciphertexts and bandwidth.
[0077] In this embodiment, the aggregation server only performs homomorphic addition and optional homomorphic constant scaling, without using multiplication depth, thereby avoiding noise accumulation and scale management issues;
[0078] S4: Pure Homomorphic Summation and Aggregation: The server performs homomorphic addition on the received ciphertext, slot by slot, without decryption, to obtain... and ;
[0079] In this embodiment, the server performs slot-by-slot homomorphic addition on ciphertext of the same type from different clients. To obtain the ciphertext parameters and vector With ciphertext visible count and (Located in the designated slot), the server does not hold the private key, does not decrypt, and does not perform non-linear operations; it is only responsible for addition and routing.
[0080] S5: Distribution and Class-Based Decryption Average: The server will... Return to the client; each client performs decryption and computation only for the authorized category:
[0081] ;
[0082] The parameter for the aggregated category s (g is global). This refers to the class 's' parameter in the client's local model classifier parameters. The quantity is the visible quantity.
[0083] Update the local category header parameters or category prototype accordingly;
[0084] After the client decrypts the authorized category, it updates the classifier category parameters of the current local model with the global classifier category parameters. After all updates are completed, the updated local model is used to train the model on the local data to obtain the local model parameters for the next round of federated learning. The parameters are then encrypted and uploaded to the server for aggregation again.
[0085] In this embodiment, the server sums the ciphertext. The client decrypts only the category 's' of the private key it holds. ,get The global classifier class parameters are obtained using the unbiased average formula. For high-dimensional parameter classes that are packaged in chunks, the calculation is performed in chunk-aligned order. And splice the pieces together Obtain the global classifier category parameters;
[0086] S6: Model Update and Next Iteration: The data is dynamically fused with the corresponding local historical category header parameters. This fusion process only applies to categories visible to the client. For invisible categories, historical parameters remain unchanged.
[0087] The fusion expression is as follows:
[0088] ;
[0089] In the above formula, Is client k in the th... The parameters of the s-th class corresponding to the local classifier in the round of federated learning training; These are the parameters of the s-th class corresponding to the global classifier; It is the visible category owned by client k; It is a dynamic factor, expressed as follows:
[0090] ;
[0091] When the client enters the next round of federation, strategies such as local early stop and anomaly detection can be superimposed to improve robustness and resistance to inference.
[0092] The local early stopping strategy is as follows: During each round of local training on the client side, a small portion of the local validation set is allocated, and validation metrics (loss / acc / F1) are calculated after each epoch. If the metrics do not improve for P consecutive epochs (or the improvement is less than the threshold), the local training for that round is stopped early, and the process directly proceeds to extracting and encrypting the class parameters for uploading. This avoids the minority classes being biased by local overfitting under non-independent and identically distributed / long-tailed conditions, while also saving computing power on the client side.
[0093] The anomaly detection strategy specifically involves performing the following checks before parameter encryption: numerical checks: whether parameters / gradients contain NaN / Inf values, whether the loss value explodes, whether the learning rate is abnormal, and magnitude / direction checks. Whether it exceeds the threshold, and updated with the historical average. Is the cosine similarity abnormal (e.g., less than a certain threshold)?
[0094] Iterative convergence: Repeat steps S2-S5 until the stopping condition is met;
[0095] After iteration, the final output of the client is a model parameter: the local feature extractor and the updated classifier, which infer the newly acquired image or perceived input, and output the recognition result of which traffic sign or road condition event belongs to which category (such as speed limit, construction, water accumulation, ice, falling objects, etc.), and improve robustness and generalization ability under strong non-independent identically distributed and long-tailed distribution.
[0096] To verify the privacy protection of the proposed homomorphic encryption-based heterogeneous federated learning parameter aggregation method, the following evaluation is conducted based on theoretical security models and side-channel analysis:
[0097] (1) Formal security analysis and threat modeling.
[0098] In the security model of this invention, it is assumed that the federated learning server is honest but curious; that is, it will correctly execute the aggregation and routing operations specified by the protocol, but will attempt to infer the client's private data information by analyzing the received intermediate information (such as ciphertext and message patterns). Simultaneously, the possibility of malicious external attackers or colluding clients attempting to obtain unauthorized category information is considered.
[0099] Semantic security of homomorphic encryption: This invention employs a homomorphic encryption algorithm to fundamentally satisfy the semantic security standard of IND-CPA (Indistinguishability under chosen-plaintext attack). This means that for any two plaintext vectors of the same length... and Any attacker with limited computing power only possesses the public key. In this case, it distinguishes the encryption results and The probabilistic advantage is negligible. For example, the semantic security of the CKKS scheme is based on the assumption of the difficulty of learning the RLWE problem with error loops. In terms of parameters... And under the corresponding module chain configuration, such as its module... Under this configuration, the current optimal attack requires This operation achieves a 128-bit security level. This cryptographic primitive guarantees the category parameter uploaded by a single client. and visible indicators Once encrypted, the plaintext information is completely confidential to any entity that does not possess the private key.
[0100] Server-side privacy protection: The server only performs homomorphic addition operations throughout the entire process. Because the server does not hold any type of private key. Furthermore, the homomorphic encryption property ensures that operations on the ciphertext domain do not reveal the plaintext content, so the server cannot obtain any of the client's original parameters, gradient information, or category visibility.
[0101] Security for fine-grained decryption authorization: Private keys are distributed independently for each category via a key management device. This implements category-based access control. Client k can only decrypt its authorized category. aggregated ciphertext For its unauthorized categories. Since the client does not hold According to IND-CPA security, the decryption attempt failed, and no useful information could be obtained from the ciphertext. This effectively prevents malicious clients from stealing model knowledge from other participants across categories through decryption operations.
[0102] (2) Analysis of the side-channel mitigation effect.
[0103] Time-side channel: This invention uses upload rhythm perturbation (such as randomly jittering batch transmission time within ±50ms) combined with a batch alignment strategy to prevent attackers from inferring the class training time or participation order by analyzing the time sequence of client upload messages, thereby cutting off the time-side channel.
[0104] Traffic pattern side channel: By using a fixed packet format and a batch packaging strategy, it ensures that the number and size of packets uploaded by different clients and in different rounds remain consistent. This makes it impossible for network traffic analysis to distinguish the differences in the distribution of different client categories, effectively mitigating traffic pattern-based side channel attacks.
[0105] In summary, through formal security analysis, simulated attack verification, and side-channel analysis, this invention fully demonstrates its ability to provide comprehensive and effective protection for client-side data privacy. While ensuring the effectiveness of model aggregation, it resists various privacy attacks such as member inference, attribute inference, and data reconstruction, and effectively eliminates the risk of category existence leakage that may be introduced by class-based aggregation. This meets the stringent requirements for data privacy and compliance in cross-domain collaborative scenarios such as intelligent connected vehicles.
[0106] Example 2
[0107] This embodiment provides a class-level parameter aggregation system based on homomorphic encryption, used to implement the class-level parameter aggregation method based on homomorphic encryption in Embodiment 1, including: multiple clients, a server, and a key management module;
[0108] In this embodiment, the key management module generates category public and private keys required for homomorphic encryption, and distributes the private keys to clients that have the right to use category data, wherein the category is a traffic sign or a road condition event;
[0109] In this embodiment, the client trains a classification model based on data with category labels. For each category, the client calculates the parameter vector of the corresponding category and the number of visible counts for the corresponding category.
[0110] In this embodiment, the client concatenates the parameter vectors of each category and the number of visible units into a slot vector to be encrypted, encodes the slot vector into homomorphic encrypted plaintext, and encrypts it with the public key of the corresponding category to obtain ciphertext;
[0111] In this embodiment, the server performs homomorphic addition on the ciphertext slot by slot to obtain the sum of ciphertext parameters and the sum of ciphertext visibility counts;
[0112] In this embodiment, the client decrypts the authorized category holding the private key, calculates the global class-level parameters based on unbiased average, and merges and updates them with the local historical classification header;
[0113] In this embodiment, the client updates the classification model and outputs the traffic sign or road condition event recognition results based on the updated classification model.
[0114] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.
Claims
1. A class-level parameter aggregation method based on homomorphic encryption, characterized in that, Includes the following steps: Generate the category public and private keys required for homomorphic encryption, and distribute the private keys to clients who have the right to use the category data, where the category is a traffic sign or road condition event; A classification model is trained based on data with category labels. For each category, the parameter vector of the corresponding category is calculated for the client, and the number of visible users for the corresponding category is calculated. The parameter vectors and the number of visible counts of each category are concatenated into a slot vector to be encrypted. The slot vector is encoded into homomorphic encrypted plaintext and then encrypted using the public key of the corresponding category to obtain the ciphertext. By performing homomorphic addition on each class and slot of the ciphertext, we obtain the sum of ciphertext parameters and the sum of ciphertext visibility counts. The client decrypts the authorized category holding the private key, calculates the global class-level parameters based on unbiased average, and merges and updates them with the local historical classification headers; Update the classification model and output the traffic sign or road condition event recognition results based on the updated classification model.
2. The class-level parameter aggregation method based on homomorphic encryption according to claim 1, characterized in that, Calculate the parameter vector corresponding to the client's category, which represents the connection weights between the neuron of the corresponding category in the last fully connected layer of the classification model and all neurons in the previous layer.
3. The class-level parameter aggregation method based on homomorphic encryption according to claim 1, characterized in that, Calculate the visible count for the corresponding category, specifically including: The client judges the data with category labels. If the corresponding category appears in the training samples in this round, the visibility count is 1; otherwise, the visibility count is 0.
4. The class-level parameter aggregation method based on homomorphic encryption according to claim 1, characterized in that, The parameter vectors and visibility counts of each category are concatenated to form the slot vector to be encrypted, and the process also includes: When a category is not visible to the client, the parameter vector is set to the zero vector, the visibility count is set to zero, and they are concatenated into the slot vector to be encrypted. The slot vector is encoded into homomorphic encrypted plaintext, and then encrypted with the public key of the corresponding category to obtain the ciphertext.
5. The class-level parameter aggregation method based on homomorphic encryption according to claim 1, characterized in that, The parameter vectors and visibility counts of each category are concatenated into a slot vector to be encrypted. The slot vector is then encoded into homomorphic encrypted plaintext and encrypted using the public key of the corresponding category to obtain ciphertext. Specifically, a ciphertext fragmentation and packaging strategy is adopted. When the dimension of a single-category parameter vector exceeds the number of valid slots that a single ciphertext can carry, the parameter vector is divided into multiple fragments. At the end of each fragment, a slot is reserved to store the fragment visibility count or the total visibility count is carried by an independent ciphertext.
6. The class-level parameter aggregation method based on homomorphic encryption according to claim 5, characterized in that, In the layout of fragmented visible counting, K ciphertexts are sent for each category. The 1st to Mth fragments contain the actual parameter fragments and the tail slot contains the fragment count. The remaining M+1 to Kth fragments are all sent as zero fragments. In a layout where the total number of visible counts is carried by independent ciphertexts, each category sends a fixed number of K+1 ciphertexts. The first K ciphertexts are parameter fragments, and the last one contains the count ciphertext.
7. The class-level parameter aggregation method based on homomorphic encryption according to claim 1, characterized in that, The client decrypts the authorization categories holding the private key using one or more of the following methods: grouping by class key, threshold decryption, attribute-based encryption, or tag-based authorization.
8. The class-level parameter aggregation method based on homomorphic encryption according to claim 1, characterized in that, Global class-level parameters are obtained based on unbiased averaging and then merged and updated with local historical classification heads, specifically as follows: ； ； in, Is client k in the th... The parameters of the s-th class corresponding to the local classifier in the federated learning training round. These are the parameters of the s-th class corresponding to the global classifier. It is the visible category owned by client k. It is a dynamic factor.
9. The class-level parameter aggregation method based on homomorphic encryption according to claim 1, characterized in that, In the classification model update step, a local early stopping strategy and an anomaly detection strategy are also adopted.
10. A class-level parameter aggregation system based on homomorphic encryption, characterized in that, The method for implementing class-level parameter aggregation based on homomorphic encryption as described in any one of claims 1-9 includes: multiple clients, a server, and a key management module; The key management module generates category public and private keys required for homomorphic encryption, and distributes the private keys to clients that have the right to use category data, where the category is a traffic sign or a road condition event. The client trains a classification model based on data with category labels. For each category, the client calculates the parameter vector for the corresponding category and the number of visible data for the corresponding category. The client concatenates the parameter vectors of each category and the number of visible units into a slot vector to be encrypted, encodes the slot vector into homomorphic encrypted plaintext, and encrypts it with the public key of the corresponding category to obtain ciphertext. The server performs homomorphic addition on the ciphertext slot by slot to obtain the sum of ciphertext parameters and the sum of ciphertext visibility counts. The client decrypts the authorized category holding the private key, calculates the global class-level parameters based on unbiased average, and merges and updates them with the local historical classification header; The client updates the classification model and outputs traffic sign or road condition event recognition results based on the updated classification model.