A cross-border federated learning trusted data processing system and method based on zero-knowledge proof

Abstract

This invention provides a trusted data processing system and method for cross-border federated learning based on zero-knowledge proofs, comprising: a domestic task initiator initializing system parameters; overseas training sub-nodes committing to their local datasets and registering with the domestic aggregation master node; overseas training sub-nodes using local data to perform model training and generating trusted evidence of data commitment based on an improved zk-SNARK protocol; constructing a dynamic secure aggregation path among overseas training sub-nodes, recursively verifying and nesting the trusted evidence along the path, and simultaneously aggregating encrypted model gradients; the domestic aggregation master node receiving the final aggregated gradient ciphertext and a single nested evidence, performing a one-time verification; after successful verification, the domestic aggregation master node decrypts the aggregated gradient and updates the global model, then distributes the new global model to the overseas sub-nodes, repeating steps S2 to S4 until the model converges. This invention achieves a provable, efficient, and privacy-strength new model for "data processing from overseas."

Description

Technical Field

[0001] This invention relates to the fields of cross-border data flow, privacy computing, and artificial intelligence, specifically to a system and method that integrates federated learning and zero-knowledge proof technology to achieve trusted model training and cross-border data value flow under the condition that data does not leave the country. Background Technology

[0002] With the development of the digital economy, cross-border data flow has become a key requirement for enterprises' global operations. However, data sovereignty and privacy protection regulations in various countries (such as the EU's GDPR, China's Data Security Law, and Personal Information Protection Law) are becoming increasingly stringent, posing extremely high compliance risks and legal obstacles to the direct export of raw data. New data service models, exemplified by "data processing," require overseas data to be processed locally, with only the processing results (such as AI models and analysis reports) being transmitted back to China, thus achieving "data remaining stationary while value moves."

[0003] Currently, the mainstream technology for achieving this goal is federated learning. Federated learning allows participating parties to collaboratively train a shared global model by exchanging encrypted model parameters (gradients) without sharing the original data. However, existing federated learning solutions suffer from the following inherent security and efficiency bottlenecks in cross-border compliance scenarios: 1. Lack of reliable verification of the training process and data sources; Domestic aggregation servers cannot cryptographically verify whether overseas participants have genuinely and completely used the datasets they claim for training. Malicious participants may use fake or partial data for training to fraudulently obtain computing power rewards, or generate malicious gradients (poisoning attacks) designed to undermine the overall model performance. Existing solutions mostly rely on behavior auditing or Trusted Execution Environments (TEEs). The former lacks real-time performance and cryptographic strength, while the latter is limited by hardware heterogeneity and supply chain security, making it difficult to serve as a universal solution.

[0004] 2. The bottleneck of verification efficiency of zero-knowledge proofs in federated learning; To address the aforementioned trust issues, some studies have attempted to introduce zero-knowledge proofs. However, common zero-knowledge proof protocols (such as the standard zk-SNARK) generate proofs individually for each participant, resulting in a linear increase in the number of proofs that the domestic aggregation master node needs to verify, which in turn increases linearly with the number of overseas participants. In large-scale cross-border federated learning scenarios, this leads to unbearable communication and computational overhead. More importantly, existing solutions lack mechanisms for efficient "aggregation" or "nesting" of proofs. This means that when the number of overseas training child nodes participating in federated learning is N, the number of zero-knowledge proofs that the domestic aggregation master node needs to verify, as well as the resulting computational and communication overhead, all increase linearly with N, resulting in a significant increase in algorithm complexity. Level. In large-scale cross-border collaboration scenarios, this linear growth can quickly lead to system validation bottlenecks, becoming a key factor limiting the scalability of federated learning.

[0005] 3. Centralization dependence and single point of failure risk; Traditional federated learning heavily relies on a centralized aggregation server, which is not only vulnerable to attack but also lacks transparent proof of the correctness of its aggregation behavior to the participating parties. Furthermore, the initialization phase of zero-knowledge proofs typically requires a trusted third party, which is difficult to achieve in cross-border environments with multiple participants and conflicting interests.

[0006] Therefore, there is an urgent need for a technical solution that can both ensure the security and privacy of raw data and provide efficient, verifiable, and trustless supervision of the entire cross-border data processing process, so as to achieve a new "data processing" model that truly meets compliance requirements.

[0007] The term "data processing" as used in this application refers to a computational paradigm that involves local data processing and the cross-border flow of models or results. Summary of the Invention

[0008] This invention aims to solve the aforementioned technical problems and provides a trusted data processing system and method for cross-border federated learning based on zero-knowledge proofs. By constructing a distributed architecture of "domestic aggregation master node - overseas training sub-nodes" and intrinsically embedding an improved zero-knowledge proof protocol that supports nested verification into the local training and cross-border aggregation processes of federated learning, this invention achieves a provable, efficient, and privacy-strength new model for "data processing."

[0009] To achieve the above objectives, the present invention provides the following technical solution: On the one hand, a trusted data processing system for cross-border federated learning based on zero-knowledge proofs is proposed, which includes the following features: One task initiator and aggregation master node deployed domestically, and multiple training sub-nodes deployed overseas; The task initiator is used to initialize the system's common parameters and the common reference string required for zero-knowledge proofs; The overseas training sub-nodes are used to store local privacy data and perform local iterative training based on the global model issued by the domestic master node to generate model gradients; they are also used to generate credible evidence for the integrity of the local training process and the authenticity of the data used, based on an improved concise non-interactive zero-knowledge proof protocol. The overseas training sub-nodes are also used to construct dynamic aggregation paths, and recursively merge the credible evidence of each node on the aggregation path to generate a nested evidence. The domestic aggregation master node is used to receive the aggregated model gradient ciphertext and the nested evidence transmitted along the aggregation path, and to verify the integrity of all overseas child node operations on the aggregation path by performing a one-time verification on the nested evidence, and to update the global model after the verification is passed.

[0010] Specifically, the overseas training sub-nodes generate credible evidence for the local training process, including: Before local training is executed, the overseas training sub-node performs a matrix commitment on its local dataset and sends the commitment value to the domestic aggregation master node. The domestic aggregation master node calculates the hash digest of the commitment value and maps and stores the hash digest into a Bloom filter through multiple independent hash functions. During the training process, the overseas training sub-nodes construct arithmetic circuits based on quadratic matrix procedures. The constraints of these arithmetic circuits include both the computational process of model training and the matrix commitment of the dataset used. This allows the generated credible evidence to prove that the training process was correctly executed based on the committed specific dataset without disclosing the data and model.

[0011] Furthermore, the process by which the overseas training sub-nodes generate credible evidence also includes: The Chinese Remainder Theorem is used to preprocess batch training data, and the convolution operation is optimized into matrix multiplication. By introducing an uncertain parameter vector, the verification of batch matrix multiplication is compressed into the verification of a single equation. Furthermore, by utilizing the properties of the matrix trace, this equation is transformed into the verification of a single matrix trace equation, thereby reducing the number of multiplication gates in the arithmetic circuit during the generation of zero-knowledge proofs.

[0012] Furthermore, the construction of dynamic aggregation paths and the generation of nested evidence among the overseas training sub-nodes specifically includes: Each overseas training sub-node determines the current network topology by sharing an adjacency list, and discovers and removes malicious nodes by verifying credible evidence of neighboring nodes, thus forming a credible sparse communication graph. Run a depth-first traversal algorithm on the trusted sparse communication graph to generate an aggregation spanning tree as the path for data aggregation and evidence nesting; On the aggregated spanning tree, after receiving the credible evidence and gradient ciphertext from the child node, the parent node first verifies the validity of the child node's evidence, and then performs a cryptographic nesting operation on its own evidence and the child node's evidence to generate a new nested evidence. This nested evidence is equivalent to a proof of the integrity of all operations on the entire path from the source node to the current node.

[0013] Furthermore, the cryptographic nesting operation is implemented through random linear combinations of group elements, specifically: The parent node selects a random compression factor and performs exponential and multiplicative operations on the corresponding group elements in its own evidence and the child node's evidence to generate new group elements. This ensures that the generated nested evidence contains the same number of group elements as the single node evidence in terms of data structure, thus having a constant size. The total amount of proof data received by the domestic aggregation master node in cross-border communication is unrelated to the number of overseas training sub-nodes participating in the aggregation path, and the verification overhead of the domestic aggregation master node does not increase linearly with the increase of the number of overseas training sub-nodes.

[0014] On the other hand, a trusted data processing method for cross-border federated learning based on zero-knowledge proofs is also proposed, which includes the following steps: Step S1: The domestic task initiator initializes the system parameters, and the overseas training sub-nodes commit to their local datasets and register with the domestic aggregation master node; Step S2: The overseas training sub-nodes use local data to perform model training and generate credible evidence of the binding data commitment based on the improved zk-SNARK protocol; Step S3: Construct a dynamic secure aggregation path between overseas training sub-nodes, and recursively verify and nest the trusted evidence on the path, while aggregating the encrypted model gradients; Step S4: The domestic aggregation master node receives the final aggregated gradient ciphertext and the single nested evidence, and performs a one-time verification; Step S5: After successful verification, the domestic aggregation master node decrypts the aggregation gradient and updates the global model. Then, the new global model is distributed to the overseas child nodes. Steps S2 to S4 are repeated until the model converges.

[0015] Specifically, in step S1: The task initiator selects multiple participants, including itself, and uses verifiable secret sharing technology to collaboratively generate the public reference string required for zero-knowledge proof, thereby eliminating the dependence on a single trusted third party. The overseas training sub-nodes divide the local dataset into multiple subsets. For each subset, they generate a matrix commitment value by performing matrix multiplication between the preprocessed subset matrix and a singular square matrix, and then send the matrix commitment value to the domestic aggregation master node. The domestic aggregation master node constructs a Bloom filter, calculates the hash digest of each received matrix commitment value, and maps and stores each hash digest into the Bloom filter through multiple independent hash functions for subsequent verification of the legality of the data source.

[0016] Furthermore, step S2 further includes: After generating credible evidence, the overseas training sub-nodes use a pseudo-random mask to encrypt the local model gradient to generate gradient ciphertext and generate a range proof to prove that the norm of the encrypted gradient is within a preset range, thereby proving the correctness of the encryption operation and preventing malicious gradient submission. Before verifying the nested evidence, the domestic aggregation master node first verifies the range proof to filter out incorrect cryptographic gradients.

[0017] Furthermore, in step S4, the domestic aggregation master node performs a one-time verification, including: The nested evidence was verified by bilinear pairing to confirm the integrity of model training computation and the authenticity of data for all overseas training sub-nodes on the aggregation path. If the verification is successful, the domestic aggregation master node independently calculates the total mask using the mask seed that it shares with each overseas training sub-node in advance, and removes the total mask from the aggregated gradient ciphertext to obtain the global gradient plaintext. If the verification fails, the domestic aggregation master node will refuse to receive the aggregated gradient ciphertext for this round, terminate the global model update for this round, and issue a retraining instruction to each overseas training sub-node or trigger a malicious node tracing mechanism.

[0018] Furthermore, after step S5, the method further includes: After the global model converges, the domestic aggregation master node uses the homomorphic property of matrix commitments to verify the integrity of the data subset commitments submitted by the overseas training sub-nodes in all training rounds. By verifying a vector inner product equation or a hash chain-based equation, it ensures that the overseas training sub-nodes used all the data they claimed for training, thus achieving cryptographic auditing of data integrity.

[0019] Compared with existing technologies, the cross-border federated learning trusted data processing system and method based on zero-knowledge proof provided by this invention has the following beneficial effects: 1. Achieve compliant "data processing" without allowing raw data to leave the country; This invention constructs a distributed architecture of "domestic aggregation master node - overseas training sub-nodes." The raw data of the overseas sub-nodes is always stored locally, and only the model gradients, verified and encrypted with zero-knowledge proofs, are transmitted to the domestic master node. This fundamentally satisfies the legal requirement of "minimizing data leaving the country." The processed AI models or analysis results are securely transmitted back as high-value "data products," providing a feasible and regulated technical foundation for the "data remains stationary while its value moves" cross-border data flow paradigm.

[0020] 2. Provide a cryptographically self-verified, end-to-end trusted execution mechanism; This invention deeply integrates the improved zk-SNARK protocol with matrix commitments and Bloom filters, achieving cryptographic self-verification of the entire process of processing data from overseas: Data authenticity: Through matrix commitment and Bloom filter registration, it is ensured that the training data belongs to the pre-declared real dataset.

[0021] Training integrity: The computational process of model training is bound to the same arithmetic circuit with data commitments, and the generated credible evidence can prove that the training is strictly performed according to the agreed algorithm.

[0022] Data integrity: By leveraging the homomorphic property of matrix commitments, a unified audit of the data used in all training rounds is achieved after the model converges, preventing fraudulent behavior such as "partial data training".

[0023] Domestic master nodes do not need to trust any overseas participants; the credibility of the received gradients can be ensured solely through mathematical verification.

[0024] 3. Significantly reduce verification overhead and achieve constant-level cross-border collaboration efficiency; The core innovations of this invention are the nested proof generation algorithm and the dynamic secure aggregation path. This mechanism allows gradients and evidence to be recursively verified and nestedly merged among overseas child nodes along a dynamically constructed aggregation spanning tree before cross-border transmission. Ultimately, the domestic aggregation master node only needs to receive and verify a single nested piece of evidence of constant size to confirm the integrity and credibility of the operations of all child nodes along the entire aggregation path. This technique completely decouples the verification computation and communication overhead of the domestic master node from the number N of overseas training child nodes. Specifically, in traditional non-nested verification schemes, the verification complexity of the domestic aggregation master node is... Linear growth; however, this invention, through a nested evidence generation mechanism, transforms this growth relationship from linear growth to linear growth. Significantly reduced to Constant-level operation, meaning that the verification overhead does not increase with the number of participants, greatly enhances the scalability and practicality of large-scale cross-border federated learning.

[0025] 4. Provide decentralized, publicly auditable, cryptographically compliant credentials; Decentralized initialization: The system uses verifiable secret sharing technology to collaboratively generate a public reference string (CRS), eliminating the dependence on a single trusted third party and enhancing the system's security in a multi-party game environment.

[0026] Full-process auditability: All individual and nested evidence generated during the training process can be archived as immutable and publicly verifiable cryptographic credentials. When faced with audits by regulatory agencies, these credentials can mathematically rigorously prove the authenticity and compliance of each data processing operation, elevating compliance proof from the traditional "system and process" level to the "cryptographic algorithm" level, meeting high standards of in-process provability and post-process auditability regulatory requirements.

[0027] 5. Enhance the system's robustness and privacy protection capabilities; Elastic removal of malicious nodes: By verifying credible evidence among child nodes and dynamically constructing a sparse communication graph, the system can automatically detect and remove malicious or faulty nodes, possessing inherent resilience.

[0028] Gradient privacy and security: Pseudo-random masking is used to encrypt gradients and combined with range proofs. This not only prevents domestic master nodes from snooping on the gradient information of individual nodes, but also effectively filters out malicious gradient updates with abnormal norms, thus improving the convergence robustness of the global model. Attached Figure Description

[0029] Figure 1 A flowchart of a trusted data processing method for cross-border federated learning based on zero-knowledge proofs.

[0030] Figure 2 : Optimization diagram of matrix multiplication for convolution operations. Detailed Implementation

[0031] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] To further illustrate the technical means and effects adopted by the present invention in order to achieve the intended purpose, the specific embodiments according to the present invention are described in detail below.

[0033] First, the symbols used in this application are explained in Table 1 below: Table 1: Symbol Explanation ; ;

[0034] Example 1

[0035] Against the backdrop of stringent data sovereignty regulations in various countries (such as China's Data Security Law and the EU's GDPR) on cross-border data flows, domestic AI service providers and overseas data providers need to collaborate on training AI models. However, the original data cannot legally leave the country. While traditional federated learning can achieve "model movement without data movement," it suffers from inherent security problems in malicious environments, such as difficulty in verifying data authenticity and training integrity. Overseas participants may use forged or partially used data for training, while domestic aggregators lack effective cryptographic means for real-time compliance auditing. This embodiment provides a trusted data processing method for cross-border federated learning based on zero-knowledge proofs. This system and method enable trusted model training and cross-border data value flow under the condition that data does not leave the country. It provides regulatory agencies with efficient and publicly verifiable compliance credentials, truly realizing a closed-loop system for cross-border data processing that is "ruled beforehand, verifiable during the process, and auditable afterward."

[0036] See Figure 1 First, it is necessary to explain the system composition: Task initiator (within the country): Responsible for issuing federated learning tasks, defining model structure, generating and distributing system public parameters pp and public reference strings crs.

[0037] Aggregator Master Node (Domestic): A trusted aggregation server deployed domestically, responsible for maintaining Bloom filters to verify data authenticity, receiving and verifying model gradients and nested evidence from overseas, and performing global model aggregation and updates.

[0038] Training child nodes (overseas): Deployed overseas, each with its own privacy dataset. Each child node is responsible for performing model training locally using real data and generating trusted evidence based on the improved zk-SNARK protocol; at the same time, as part of the secure aggregation path, it participates in the generation and forwarding of nested evidence.

[0039] The Bloom filter, proposed by Burton Howard Bloom in 1970, is a highly space-efficient probabilistic data structure specifically designed for quickly determining whether an element belongs to a set. Its core idea is to sacrifice a small amount of accuracy (i.e., an acceptable false positive rate) in exchange for extremely low storage space usage and extremely fast query speed.

[0040] Secondly, the cross-border trusted data processing method of the present invention mainly includes the following five stages: Phase 1: System Initialization and Compliance Preparation; Domestic task initiators publish federated learning tasks, including model structure (such as ResNet-18), number of training rounds TT, and compliance audit strategies.

[0041] The task initiator collaborates with ρ selected domestic and foreign nodes to distribute and generate a public reference string crs using Verifiable Secret Sharing (VSS) technology, eliminating dependence on a single trusted third party and ensuring the decentralization of the system's security foundation.

[0042] Each overseas training sub-node preprocesses its local dataset Dj and performs a matrix commitment Comm(Dj), then sends the commitment value hash(Comm(Dj)) to the domestic aggregation master node. The master node stores these commitment values ​​in a space-efficient Bloom filter, which stores valid data commitment values ​​for subsequent queries to verify the legitimacy of the data source.

[0043] Phase Two: Local Trusted Training and Evidence Generation for Overseas Sub-Nodes; In each round of training, overseas sub-nodes Download the latest global model parameters.

[0044] child nodes Select a committed subset of data for local model training. During this process, execute an "improved zk-SNAR proof generation algorithm": Efficiency optimization: By utilizing the Chinese Remainder Theorem and batch matrix multiplication techniques, the computation graph of core operations such as convolution is transformed into an arithmetic circuit based on the Quadratic Matrix Program (QMP), significantly reducing proof generation time.

[0045] Content binding: Matrix commitment The process of calculating the model gradient is encoded into the constraint system. This ultimately generates a zero-knowledge proof. This proof can be obtained without disclosing data. Without any information about the model parameters, prove to the validator that the following statement is true: "There exists a local dataset." Its commitment value already exists in the master node's whitelist, and the model training algorithm for the r-th round was correctly executed using this dataset, generating the gradient for that round. ".

[0046] Child nodes use pseudo-random masks local gradient Encryption is performed to obtain ciphertext. And generate a non-interactive zero-knowledge proof (NIZK) to prove It is the result of correct encryption.

[0047] Phase 3: Construction of Dynamic Secure Aggregation Paths and Generation of Nested Proofs; Each overseas sub-node obtains the current network topology by sharing an adjacency list and mutually verifies the credible evidence generated in the first phase. By eliminating malicious nodes with abnormal behavior, a dynamic and robust sparse communication graph is constructed.

[0048] The system runs a depth-first search (DFS) algorithm on the communication graph to generate an aggregate spanning tree. Leaf nodes in the tree send data to their parent nodes, aggregating upwards layer by layer. This path is dynamic and robust.

[0049] On the aggregation path, the core "nested proof generation algorithm" is executed: When the parent node Received child node Encryption gradient and credible evidence Then, bilinear pairing was first used for verification. The correctness of the statement.

[0050] After verification, Use your own evidence Evidence with child nodes Perform cryptographic "nesting" operations This generates a new nested piece of evidence, either of constant or slowly growing size. This nested evidence can simultaneously prove... and Completeness of operations.

[0051] At the same time, use its own gradient mask gradient ciphertext with child nodes Perform homomorphic accumulation to obtain a new aggregated ciphertext. .

[0052] Phase Four: Cross-border Aggregation and Efficient Master Node Verification; The aggregation process proceeds recursively from bottom to top along the spanning tree path, ultimately receiving an aggregated global gradient ciphertext Yglobal and a single, final nested evidence at the aggregation master node located within the domain. .

[0053] The domestic master node performs a one-time verification: calling the verification algorithm Verify(crs, If the verification passes, it means that all operations (data authenticity, training integrity) on the link of all overseas sub-nodes participating in this round of aggregation are correct and reliable.

[0054] The master node, through the inverse process of the secure multi-party computation protocol, coordinates with all participants to securely remove the mask, decrypt to obtain the true global gradient gglobal, and update the global model.

[0055] Phase Five: Results Delivery and Compliance Audit; Repeat stages two through four until the global model converges.

[0056] The trained model is the data product of "data processing". This model is derived from the value of overseas data, but the original data used in its training process never left the overseas sub-nodes.

[0057] All zero-knowledge proofs generated during the process and nested proofs All of these can be archived as cryptographic audit logs. Domestic regulatory agencies or overseas partners can request these certificates at any time to verify that the entire cross-border data processing process strictly adheres to the agreement of "data not leaving the country, algorithm compliance, and data authenticity," achieving a high standard of compliance that is verifiable during the process and auditable afterward.

[0058] Through the above embodiments, the present invention successfully transforms the complex cross-border data compliance issue into an efficient and verifiable cryptographic problem, providing a solid technical foundation and reliable compliance guarantee for business models such as "data processing" and "data remaining unchanged while the model moves".

[0059] Example 2

[0060] Under the compliance requirement of "raw data not leaving the country" for cross-border data circulation, domestic task initiators and overseas training sub-nodes need to collaborate in training AI models. However, traditional federated learning cannot cryptographically verify the authenticity and training integrity of overseas data, posing inherent security risks. This embodiment provides a trusted data processing system for cross-border federated learning based on zero-knowledge proofs. The system generates public parameters through a domestic master node and collaborates with overseas nodes to distribute and generate zero-knowledge proof reference strings. Overseas sub-nodes bind local data matrix commitments to the training process based on improved zk-SNARK to generate trusted evidence. Each node constructs a dynamic aggregation path and recursively generates nested evidence of constant size. The domestic master node only needs to verify once to confirm compliance across the entire chain. Gradient encryption and range proofs protect privacy and filter malicious updates. The entire process proof is archived and auditable, realizing an efficient and compliant closed-loop model for cross-border data processing where "data remains stationary while the model moves, the process is provable, and supervision is traceable."

[0061] The system provided in this embodiment specifically includes: The system consists of a task initiator and aggregation master node deployed domestically, and multiple training sub-nodes deployed overseas. Participants include: Task initiator (within China): Responsible for issuing federated learning tasks, defining model structure, generating and distributing system public parameters pp and public reference strings crs.

[0062] Aggregator Master Node (Domestic): A trusted aggregation server deployed domestically, responsible for maintaining Bloom filters to verify data authenticity, receiving and verifying model gradients and nested evidence from overseas, and performing global model aggregation and updates.

[0063] Training sub-nodes (overseas): Deployed overseas, each with its own privacy dataset. Each sub-node is responsible for performing model training locally using real data and generating trusted evidence based on the improved zk-SNARK protocol; at the same time, as part of the secure aggregation path, it participates in the generation and forwarding of nested evidence.

[0064] An example of the internal structure of an overseas training sub-node; In this embodiment, the overseas training sub-node is specifically one or more computer devices equipped with a graphics processing unit (GPU), which internally includes: The data preprocessing module is configured to perform the Chinese Remainder Theorem transformation. This module reads the raw matrix data from memory and uses the parallel computing core of the GPU to convert the convolution sliding window operation into intermediate data in matrix multiplication format. Commitment calculation module: configured to perform matrix multiplication based on the singular matrix U and the preprocessed data to generate matrix commitment values ​​for the dataset; The evidence generation module is configured to load the Public Reference String (CRS) and generate zero-knowledge proofs by running QMP arithmetic circuits based on the intermediate data and matrix commitment values. This module introduces an uncertain parameter vector. This eliminates redundant polynomial calculations generated during verification batch matrix multiplication, thereby reducing GPU memory usage and proof generation time.

[0065] Communication and Aggregation Module: Configured to establish encrypted channels with other overseas sub-nodes and send gradient ciphertext and nested evidence.

[0066] Step S1: System initialization and common parameter generation; The service initiator is used to initialize common system parameters.

[0067] First, during the system startup phase, the task initiator (i.e., the trusted coordinator within the country) is responsible for generating and publishing a set of public parameters (pp). This parameter set serves as the global configuration baseline for the entire federated learning task and its accompanying cryptographic protocols. The generation process specifically includes the following sub-steps: The task initiator announces a federated learning task and the expected number of training rounds T, and selects a multiplicative group of order p that is a prime number. ,in λ is a safety parameter; construct a bilinear mapping e: ,in It is a p-order multiplicative cyclic group. These are the generators of the two groups; a collision-resistant hash function is generated. This hash function is used to compress data commitment values ​​into a fixed-length digest. Describes a finite field of order p. Describe the multiplication group of the finite field (i.e. ({0}). In this scheme... With the aforementioned bilinear mapping group Sharing the same prime order p ensures that cryptographic operations are performed on a unified algebraic structure.

[0068] The task initiator still needs to specify that the sample matrix has dimensions of m×m, the convolution kernel has dimensions of n×n, and construct a singular matrix U with dimensions of m×m. Randomly select pairwise coprime prime numbers. Construct the modulus sequence { ,..., Furthermore, the task initiator presets an upper limit B for the gradient L2 norm based on the model size and expected gradient range (e.g., B = 10). 3 ), used for range proof in subsequent gradient encryption. Finally, the task initiator generates the public parameter pp: (1) The upper limit B ensures that the gradients submitted by overseas child nodes are within a reasonable range, preventing malicious nodes from submitting excessively large gradients for poisoning attacks.

[0069] The system's public parameters are uniformly generated and published by the domestic task initiator, ensuring the consistency and global credibility of the basic cryptographic components (bilinear mapping group, generator, hash function) and task structure parameters (matrix dimension, modulus sequence, commitment matrix), providing a unified public benchmark for subsequent cryptographic operations by all participating parties.

[0070] The singular matrix U is in a finite field The m randomly selected above 2 A ×d-dimensional matrix, where The dimension of a preprocessed single data sample expanded into a column vector. The matrix commitment is defined as: for a subset of the preprocessed data matrix... (N is the number of samples), multiply each column by U, then sum or concatenate the results to obtain the commitment value. (Matrix multiplication).

[0071] Step S2: Distributed generation of common reference strings; The task initiator is used to initialize the system's public parameters and the public reference string required for zero-knowledge proofs.

[0072] To eliminate reliance on a single trusted third party, the task initiator selects ρ participants (including itself, domestic master nodes, and several overseas sub-nodes) to collaboratively generate the common reference string CRS required for zero-knowledge proof.

[0073] Each participant needs to share parameters using a verifiable secret sharing mechanism, which ensures that each participant shares the same parameters with everyone else. Let's first assume that ρ participants are selected. Generate the CRS and consider the relation generator R that returns the relations.

[0074] (2) After that, the selected Randomly select 6 numbers And calculate; (3) here, , group Encryption operations in the middle, group In the encryption operation, ρ participants share all the parameters in the above formula.

[0075] This embodiment uses For example, it demonstrates how to share the same things with others. Without leaking First, the participants Generate a polynomial of order ,in, and Each participant will receive [something]. Where F(x) is a polynomial with coefficients taken from the finite field Zq. q is a large prime number and q divides it. They also need to distribute the commitments for the coefficients of F(x) to other... Participants, the method is as follows (all calculations below are performed modulo p): (4) The any of the participants The correctness of the received secret share F(j) can be verified by checking the following congruence equation (all operations are performed modulo p): (5) In addition, it is also necessary to ensure Shared , , The form is shown in equation (6), because a malicious It is possible to transmit arbitrary random vectors to others. Therefore, Need to go to other Transmission by each participant and This is to verify the correctness of the parameters, where r is the pseudo-random number generator. Generated random numbers. Anyone who owns a shared... People are capable of verifying equations The correctness of the information. Security depends on... The computational indistinguishability, the q-SDH assumption, and the discrete logarithm problem assumption.

[0076] In this way, participants You can share parameters from other participants. , , , , , , , , Without revealing any information about the trapdoor, any selected participant can then summarize the collected parameters of the ρ participants as follows.

[0077] (6) final, , where α,β,γ, x and z are trapdoor parameters. It is a polynomial, s is the length of the statement, and N is the number of data samples. This prevents the leakage of trapdoor parameters during CRS generation. If some selected participants are malicious, this embodiment uses verifiable secret sharing and masking techniques to verify the correctness of the participants sharing fragments. , As shown in Equation (7), it contains all the encrypted polynomial parameters required for the quadratic matrix program constraint.

[0078] ; (7) This embodiment employs a distributed CRS generation mechanism, ensuring that the trapdoor parameters of the CRS will not be leaked as long as at least one honest participant exists, thus eliminating the strong dependence of traditional zk-SNARK schemes on a single trusted third party. This CRS can support the generation and verification of proofs in all subsequent rounds without requiring repeated initialization.

[0079] Step S3: Overseas child node data commitment and Bloom filter registration; Before local training execution, the overseas training sub-node performs a matrix commitment on its local dataset and sends the commitment value to the domestic aggregation master node, which then stores it in a Bloom filter. Specifically, this includes: Assuming participants Download the public parameter pp and split the local dataset. For T subsets Each data subset Contains N samples > . And according to the preprocessing algorithm (1), The sample matrix is ​​preprocessed using the Chinese Remainder Theorem and the im2col operation. , As shown below: ;

[0080] After data preprocessing, the data subset Transformed and data set Identify in the corresponding data format .

[0081] Then, For local data Make a commitment. Specifically, for the i-th preprocessed data subset... It is a matrix of dimension d×N, where d represents the dimension of a single sample expanded into a column vector, and N represents the number of samples contained in the subset. All matrix elements belong to a finite field. The singular matrix U is defined in the finite field. The randomly selected dimension is The matrix. The overseas training sub-nodes generate the matrix commitment value of the subset through the following matrix multiplication: ; in," "" represents matrix multiplication over a finite field. For a complete dataset The commitment value Comm( It can be done in the same way. The calculation is performed as a whole, or it is obtained by combining the homomorphic properties of the commitment values ​​of each subset. Subsequently, The commitment value Comm( ) and Comm( The data is sent to the domestic aggregation master node.

[0082] subset Represented as and They are then sent to the aggregation server AS. The aggregation server calculates the hash digest of the commitments for the complete dataset. = and hash digests of commitments for each subset of data. All the hash digests mentioned above are mapped and stored in the Bloom filter through multiple independent hash functions.

[0083] Meanwhile, in order to efficiently verify whether the data subset used by the overseas sub-nodes belongs to their pre-registered real data in each subsequent training round, the domestic aggregation master node commits a value for each received data subset. Similarly, calculate its hash digest. The digest is mapped and stored in the same Bloom filter using the ξ independent hash functions. Therefore, the Bloom filter not only contains the complete dataset commitment information of each overseas child node, but also the commitment information of all its declared data subsets, providing an efficient basis for member querying for fine-grained data authenticity verification in each round of training.

[0084] The domestic aggregation master node constructs a Bloom filter of length L, with a preset false positive rate of ε. This false positive rate ε satisfies the classic mathematical relationship between the Bloom filter's bit array length L, the expected number of elements n, and the number of independent hash functions ξ: ;

[0085] In actual deployment, the system can determine the false positive rate ε based on a preset security target (e.g., taking...). From the expected total number of data subsets n, we can deduce the minimum bit array length L and the optimal number of hash functions ξ, thereby achieving a balance between query speed, storage overhead, and risk of misjudgment.

[0086] Specifically, the aggregation master node randomly selects ξ mutually independent hash functions, denoted as ξ. Each hash function The input to (k = 1, …, ξ) is any binary string, and the output is an integer index value in the range [0, L-1]. For each data item to be stored in the Bloom filter, its digest value is first calculated using the cryptographic hash function, and then this digest value is used as input and passed through the ξ hash functions respectively. Map the corresponding bits to the Bloom filter and set those bits to 1.

[0087] As described above, the overseas child node sends the commitment value to the domestic aggregation master node, which calculates the hash of the commitment value and uses multiple independent hash functions to map and store the hash value into a Bloom filter.

[0088] In addition, it should be noted that the core process of the preprocessing algorithm (1) includes: Input: An n×n sample matrix X, and a sequence of moduli that are pairwise coprime. (where m is the kernel size).

[0089] Column-by-column processing: For the k-th column of the matrix (k=1 to n), extract the column vector of that column. .

[0090] Sliding window CRT compression: For t=1 to m, using the Chinese Remainder Theorem (CRT), a modular sequence is used. calculate Obtain column vectors .

[0091] Generate a compression matrix: The obtained Arrange them according to their positions to form a new m×n parameter matrix. .

[0092] im2col conversion: for The im2col operation is applied to convert it into a column vector format suitable for convolution operations, resulting in the final output matrix. .

[0093] Returns: The processed sample matrix .

[0094] This embodiment employs matrix commitment technology, enabling overseas child nodes to provide data "cryptographic fingerprints" without leaking the original data. The Bloom filter achieves efficient data commitment storage and member query with extremely low time and space overhead, laying the foundation for real-time data authenticity verification in each subsequent training round.

[0095] Step S4: Local training and credible evidence generation for overseas child nodes; The overseas training sub-nodes are also used to generate credible evidence for the integrity of the local training process and the authenticity of the data used, based on an improved concise non-interactive zero-knowledge proof protocol. Specifically, this includes: In each round of federated learning training, the overseas training sub-nodes receive global model parameters from the domestic master node, use the locally committed subset of data to train the model, and generate model gradients.

[0096] For example, in the r-th training round, the participants Analyze the global model To obtain the convolution kernel W and bias b, select a committed subset of data. Train the local model. After local training is complete, update the convolutional kernel W and label it as... Subsequently, Extract and record the feature matrix It is used to generate zk-SNARK evidence.

[0097] For convolutional layers, this embodiment optimizes the convolution operation to matrix multiplication, assuming the participants... The preprocessing algorithm has been executed in batches to process the sample matrix. Converted into a processed matrix Furthermore, assuming that a training round contains MM kernels of m×m dimension, the convolution kernels are first transformed from m×m dimension to m×m dimension using the im2col algorithm. Then, M cores are stacked to obtain... The matrix is ​​used to convert the convolution operation into matrix multiplication. Detailed steps are as follows: Figure 2 As shown.

[0098] The output matrix of the convolution operation is defined as a feature map with dimension (n). m+1)×(n m+1). The Chinese Remainder Theorem was applied to each column of the feature map, resulting in M ​​1×(n) values. The vectors (m+1) are stacked to form the feature matrix. Because of the participants If the assumptions in the model are unreliable, then it is necessary to verify whether... The convolution operation was actually performed, which can be verified by checking the matrix multiplication equation. Whether it holds true or not is the test.

[0099] because The matrices have different dimensions, so they are uniformly expanded to n×n matrices by padding with zeros. Based on this, the equation... The equation still holds true. If a subset of data contains N samples, then there are N equations to verify. All equations are summed as follows: (8) To reduce the computational overhead of matrix multiplication, this embodiment employs batch verification technology, which compresses the verification of multiple matrix multiplications into the verification of a single equation by introducing an uncertain parameter vector.

[0100] The "uncertain parameter vector" is the parameter vector that the prover uses from a finite field when constructing a zero-knowledge proof. A set of column vectors randomly selected from the data. Its purpose is to act as a cryptographic "compression factor," using random linear combinations to batch and randomize the N matrix equations that the verifier needs to check one by one into a single equation, thereby reducing the proof size and verification overhead by a constant factor without substantially reducing security.

[0101] Specifically, let the N matrix multiplication equations that need to be verified be: (i=1...N), where All are preprocessed n×n square matrices. The prover randomly selects N n-dimensional column vectors from the finite field F_p. Define the following linear combination: ; ; ;

[0102] in, Representation matrix With column vectors The matrix-vector multiplication results in a column vector. If for all i... (Matrix multiplication) then the following equation holds with a high probability: (9) Here, "×" represents matrix multiplication. By verifying a single equation (9) instead of verifying N independent matrix multiplication equations, the number of multiplication gates in a zero-knowledge proof circuit can be significantly reduced.

[0103] To further reduce the verification overhead of the compressed equation (9) in the zero-knowledge proof circuit, this embodiment further utilizes the properties of the matrix trace to perform a secondary optimization of equation (9). Specifically, the matrix multiplication verification in equation (9) is equivalently transformed into the verification of its matrix trace. Since the matrix multiplication equation... It holds true if and only if the traces of the matrices on both sides are equal (i.e., tr( )=tr( Since the operations on the trace of a matrix are linear and commutative, the verification of batch matrix multiplication can ultimately be transformed into the verification of the equality of a single trace of a matrix: (10) in This refers to the aforementioned column vector of uncertain parameters. Through the two-step transformation described above (first introducing the uncertain parameter vector to compress batch verification into a single equality, and then using the matrix trace to transform matrix multiplication verification into scalar equality verification), this embodiment reduces the number of steps required in the zero-knowledge proof circuit that would otherwise be necessary. The computational cost of the multiplication gates is reduced to a constant number of multiplication gates, thus significantly reducing the proof generation overhead.

[0104] According to the definition of the quadratic matrix program QMP, a QMP contains three sets of polynomials. and a target polynomial When matrix multiplication computations are represented as matrix-based arithmetic circuits, the QMP representation of these matrix multiplications in the circuit is defined as follows: Regarding the statement and witness There exists a column vector μ of length n such that for any n, ... , enabling Divisible ,in ; Therefore, the QMP multiplication gate is subject to the following constraints: (11) Here, tr(·) represents the trace of the matrix. Since the result of the matrix multiplication in this constraint is a 1×1 matrix, its trace is the scalar value itself. By verifying the trace equality of matrix multiplication, the computational complexity of batch verification can be significantly reduced.

[0105] In this case, the left input line of the multiplication gate is marked as The right input line is marked as The output line is .here, Representing the trace of a matrix, verifying only the diagonal of the matrix is ​​more efficient than verifying the entire matrix multiplication.

[0106] Furthermore, the matrix commitment equation Convolution equation These are combined to generate credible evidence to ensure consistency between the committed data subset and the training data subset.

[0107] Evidence generation algorithm based on improved zk-SNARK (Algorithm (2)) Will and They are respectively analyzed as and Evidence for constructing convolutional layers is obtained by uniformly and randomly selecting ψ, s on a group of multiplicative integers of order p, and calculating A, B, C, D, Comm(Ejr). This makes equation (8) true.

[0108] (12) For pooling and activation layers, an arithmetic transformation scheme is applied to convert nonlinear layer operations into matrix operations. For activation layers, the ReLU function is constructed as a (0,1) matrix RM, where 1 represents the position of an element in the feature matrix Z with a value greater than 0, and the remaining positions are set to 0. Matrix multiplication is performed on matrix RM and feature matrix Z instead of the activation function, which transforms the convolutional layer operation into; (13) Similarly, for max pooling layers, based on the position of the maximum element in each pooling region, the corresponding element of the max pooling operation matrix PM is set to 1, and the remaining elements are set to 0. This allows the max pooling operation to be transformed into a matrix PM and a matrix... .

[0109] (14) After that, the evidence generation scheme for the nonlinear layer is similar to the evidence generation scheme for the convolutional layer in algorithm (2).

[0110] Finally, the consistency of evidence across different layers is proven using CP-SNARK with commitment and proof, generating the final credible evidence. After evidence generation during the r-th round of local model training, participants Local updates are encrypted to protect privacy, thereby generating an NIZK proof to demonstrate the correctness of the encryption operation and that the norm of the gradient is within a preset range. Specifically, the following range proof is generated: (15) in Participant The masking key, B, is the range boundary generated by the aggregation server based on RoFL; Where, r j Participant P j A randomly selected masking key, Y jr = g jr + r j (or an equivalent encryption form) is gradient ciphertext. Let B represent the L2 norm, and B be the preset upper limit of the gradient norm in the common parameter pp. Before verifying nested evidence, the domestic aggregation master node first verifies the range proof. If the gradient is greater than or equal to B, it proves that the gradient cannot pass and will be discarded.

[0111] Then, The message Package and sign the package, and send it along with the signature to the aggregation server.

[0112] The core process of the algorithm (2) includes: Input: Processing matrix E; Feature matrix Z; Common reference string crs; Singular matrix U; Global model parameters θ; Analyze the global model parameters θ to obtain the convolution kernel parameters W; The analytical convolution kernel matrix W is The processing matrix E is The characteristic matrix Z is ; Computational subset commitment ; set up ;(in, , , , , The basis polynomials, pre-constructed using Lagrange interpolation and encoded in the common reference string `crs`, are based on the circuit topology of the Quadratic Matrix Program (QMP). Their specific construction method is consistent with the standard QMP protocol and will not be elaborated further in this embodiment. Execute the algorithm Prove(crs, ,ω); Analytical Statement for ; Analysis of evidence ω is ; CRS analysis yields ; Random selection , ; And calculate ; Obtain evidence ; Return: Output evidence .

[0113] In this local training proof scenario of cross-border federated learning, the statement The specific meaning of evidence ω is as follows: (1) Statement For public input, it includes: global model parameters (such as the structural information of the convolution kernel), and the matrix commitment value Comm of the data subset. ), and the system common parameter pp; (2) Evidence ω is a private input, provided by the prover. Secret holding, including: a subset of local data Actual convolution kernel weights used and intermediate calculation feature matrix .

[0114] This zero-knowledge proof protocol enables the verifier to be confident, without revealing any information about ω, that the prover has indeed used the data they have committed to. It correctly executed the forward computation process for model training.

[0115] This embodiment also includes the overseas training sub-node encrypting the local model gradient using a pseudo-random mask after generating credible evidence, and generating a range proof to demonstrate the correctness of the encryption operation. After the overseas training sub-node completes local model training and generates credible evidence π, the calculated local model gradient g needs to be encrypted to prevent the domestic aggregation master node or other participants from inferring the privacy information of the original data from the gradient. Simultaneously, to prevent malicious participants from submitting abnormal gradients (such as excessively large gradients generated by poisoning attacks), a range proof also needs to be generated for the encrypted gradient to prove that the gradient is within a preset reasonable range.

[0116] This embodiment binds the data matrix commitment to the QMP arithmetic circuit, generating credible evidence that can simultaneously prove "the training process was fully executed" and "the data used is authentic and reliable" without revealing any data or model information. CRT preprocessing, uncertain parameters, and matrix trace optimization reduce proof overhead. Gradient encryption and range proof protect the privacy of model updates and can filter out abnormal gradients in advance, improving the robustness and security of the system.

[0117] This embodiment also includes the verification of credible evidence, as detailed below: For overseas training sub-nodes Credible evidence generated in round r Domestic aggregation master nodes or other verification parties can verify its correctness through the following steps: (1) Data authenticity verification; The verifier analyzes the evidence. To obtain a subset of the data, promise Comm( First, calculate the hash digest of the commitment: (16) Subsequently, ξ independent hash functions using a Bloom filter were applied. Calculate the index position separately: (17) If for all k=1 to ξ, the Bloom filter has the th... If all bits are 1, it indicates that the commitment for this subset of data has been pre-registered, meaning the data authenticity verification has been passed, and the verification flag is set. =1; otherwise let =0.

[0118] (2) Verification of training integrity; The verifier analyzes credible evidence. To obtain the evidence components of each layer. Taking a convolutional layer as an example, its evidence components include (A, B, C, D, Comm( The verification method verifies the integrity of the training process using the following bilinear pairwise equation: (18) in, It is a bilinear mapping. Let α, β, γ be the generators. For the trapdoor parameter in the public reference string, This is a public statement. If the above equation holds true, it indicates that the child node has correctly executed the agreed local training process, i.e., passed the training integrity verification, and the verification flag is set. Otherwise, .

[0119] like and Then the credible evidence is determined. If valid, the domestic aggregation master node accepts the model update ciphertext of the child node and participates in subsequent aggregations; otherwise, it rejects the model update.

[0120] (3) Data integrity verification (executed after global model convergence); Once the global model converges, the domestic aggregation master node will train the overseas sub-nodes. The submitted data subset commitments are verified for completeness to ensure that the sub-node uses all the data it has pre-committed in all training rounds and does not reuse the same data subset. The core basis of this verification method is the additive homomorphic property of the matrix commitment scheme adopted in this scheme.

[0121] set up Data subsets were used in T rounds of training. Its corresponding commitment value is Based on the homomorphic property of matrix commitments, for commitment schemes... Equation (19): The matrix commitment scheme adopted in this solution The "additive homomorphism property" specifically refers to the fact that for any two-dimensional compatible data matrix... and The result of the operation on the corresponding additive group is equal to the commitment value of the sum of these two matrices. This property is rigorously described in standard cryptographic notation as follows: ;

[0122] The "+" sign between commitment values ​​represents an operation in the addition group of the corresponding matrices, while between matrices it represents a finite field. Matrix addition. It is based on this property that the verifier can associate commitments from multiple subsets of data into a whole through algebraic operations, thereby achieving cryptographic auditing of the integrity of the use of all training data.

[0123] (19) If child node The claimed complete dataset is = (Assuming that the subsets are mutually exclusive), and that a complete dataset commitment Comm has been submitted during the initialization phase. If ), then it should be: (20) Therefore, the domestic aggregation master node only needs to verify whether the above homomorphic aggregation equation holds to complete the data integrity verification. To reduce the computational overhead of verification, a random linear combination method can be used to transform the verification of the summation of T commitments into the verification of the inner product equation of a single vector.

[0124] The "vector inner product equation" mentioned here refers to the equation to be verified. Each commitment value It is considered as a column vector c, and a weight vector v is randomly selected by the verifier. Batch verification is efficiently completed by verifying the equality between the inner product of the two and the expected value. The mathematical principles of its construction and verification are as follows.

[0125] Specifically, the aggregation master node randomly selects a random number r. Construct a weight vector ( ), and verify: (twenty one) If the above equation holds true, then the child nodes are indicated with high probability. The training was conducted using the full subset of data it claims to have used, and no subset was reused or omitted; otherwise, the child node is deemed to have incomplete data usage and may be penalized or have its reputation adjusted according to a preset strategy.

[0126] In another implementation, a hash chain-based verification method can also be used: aggregating master nodes to construct vectors. ,in The cryptographic core of this method lies in utilizing the one-wayness and chain structure of the collision-resistant hash function H to commit the complete dataset during the initialization phase. The hash chain is unforgeable and bound to the data subset commitments of each round. The construction of the hash chain and the verification logic of the "hash chain-based equation" are represented by standard cryptographic notation, such as the verification equation (22). This equation essentially also utilizes the homomorphic property of matrix commitments, and achieves cryptographic auditing of data integrity by associating the T-round subset commitments with the complete dataset commitments.

[0127] (twenty two) in child node A complete dataset commitment submitted during the initialization phase. If the equation holds true, it indicates that the child node used the entire dataset it claimed for training, thus passing the data integrity verification; otherwise, it is determined that the child node did not use the data completely, and rewards may be refused or its reputation value may be reduced according to preset policies.

[0128] Through the aforementioned verification mechanism for credible evidence, the present invention further achieves the following technical effects: Data authenticity can be verified efficiently: The domestic aggregation master node only needs to perform hash operations and Bloom filter queries on the data subset commitment to confirm whether the training data claimed by the overseas sub-node belongs to the pre-registered real dataset in constant time. The verification overhead is minimal and does not increase with the amount of data.

[0129] Training integrity can be cryptographically self-verified: a single bilinear pairing equation can be used to verify whether the foreign child node has fully executed the agreed local model training process, without having to trust the behavior claims of the foreign node, thus achieving proactive detection and filtering of malicious training behavior.

[0130] Data integrity can be audited afterward: After the global model converges, the aggregation master node uses the homomorphic property of matrix commitment to verify whether the overseas child nodes have fully used all the data subsets they promised in all training rounds with just one vector inner product equation, effectively preventing free-rider attacks of "training with partial data and cheating to obtain the full reward".

[0131] The verification overhead is constant and independent of the model size: the computational complexity of the above three verifications is independent of the number of neural network layers and the number of samples, and only involves constant hashing, pairing and vector operations, providing a feasible technical foundation for real-time compliance auditing of large-scale cross-border federated learning.

[0132] Step S5: Dynamic aggregation path construction and nested evidence generation; The overseas training sub-nodes are also used to construct dynamic aggregation paths, and recursively merge credible evidence from each node along these paths to generate nested evidence. Specifically, this includes: In the decentralized aggregation phase of federated learning, each overseas training sub-node obtains its network connections with each other through a pre-shared adjacency list and constructs an initial communication topology. Subsequently, each sub-node sends the credible evidence generated during its local training phase to all its neighboring nodes. Upon receiving the evidence, the neighboring nodes immediately invoke a zero-knowledge proof verification procedure to check its correctness. If the credible evidence provided by a sub-node fails verification, it indicates that the node may not have correctly executed the training task or used uncommitted data. In this case, all neighboring nodes mark it as a malicious node and remove it and its associated communication links from the communication topology. After all nodes have completed evidence exchange and malicious node removal, the system obtains a sparse communication graph consisting only of honest and credible nodes. Based on this, a node is randomly selected as the root node, and a depth-first traversal algorithm is run to generate an aggregation spanning tree covering all honest nodes. The hierarchical structure of this spanning tree determines the secure transmission path for gradient ciphertext uploading and evidence merging in this round.

[0133] It also includes the process of passing the evidence from the leaf node to the root node along this aggregated spanning tree. Each parent node, after receiving the nested evidence from its child node, first independently verifies the completeness and correctness of the child node's evidence. After confirming that it is correct, it performs a cryptographic merging operation on its own credible evidence and the nested evidence of the child node to generate a new nested evidence that is equivalent to simultaneously proving the compliance of its own and all child node operations.

[0134] The specific example of cryptographic nesting operations is as follows: Parent node Get child nodes Evidence =( , , , ) and their own evidence =( , , , ),in , , For the group The elements in For the group The element in the parent node Self-evidence =( , , , The corresponding elements belong to the same group.

[0135] Parent node After receiving the child node evidence, the first step is to verify it using a bilinear mapping. The validity of the evidence (verification equation as shown in the aforementioned formula (18)) is verified. After successful verification, the parent node performs the following cryptographic nesting operation based on random linear combination of group elements to merge its own evidence with the child node evidence into a single nested evidence. : First, the parent node From finite fields Uniformly and randomly selected compression factor ,in Denotes the group of multiplicative integers modulo P, denoted by . Indicates uniform random selection; The aggregated commitment value is calculated by exponentially operating on the elements of the child node's evidence and multiplying them by the corresponding elements of the parent node's evidence: ; in, group or Multiplication operations on Represents group elements The r-th power operation; The intermediate value after aggregation is calculated by multiplying the group elements (or equivalently, by performing addition in the additive group representation): ; The final output is nested evidence. =(A',B',C',D').

[0136] The fundamental reason why the above nested operations can ensure a constant evidence size is that, in the improved zk-SNARK protocol used in this embodiment, the main constituent element of a single credible piece of evidence π is a group. and The number of elements in the group (such as A, B, C, etc.) is independent of the size of the arithmetic circuit. When a parent node nests its evidence with that of its child nodes, the aggregate computation performed is only exponentiation and multiplication operations on the group elements, for example... = ,as a result Still a group It refers to a single element, not an extension of a vector or matrix. Therefore, regardless of the number of child nodes involved in the nesting on the aggregation path, the final nested evidence generated after layers of random linear combinations... The data structure maintains the exact same number and type of elements as the evidence for a single node (e.g., containing only a fixed number of elements). Elements and The element (in bytes) has a constant size. This property stems from the cryptographic assumptions of the discrete logarithm problem on bilinear groups and the homomorphic properties of random linear combinations, which makes the proof size not increase linearly with the number of aggregate nodes.

[0137] The nested evidence Π generated through the aforementioned random linear combination method has a data size that is essentially the same as the evidence generated by a single node, and does not grow linearly with the depth of the aggregation path, thus achieving a constant-size verification load. This nested operation is executed recursively, with each parent node merging the evidence from all its child nodes with its own evidence, until it reaches the aggregation master node located within the country. Ultimately, the aggregation master node receives a single, constant-size final nested evidence, which encapsulates the training integrity and data authenticity proofs of all overseas child nodes along the entire aggregation path. The domestic master node only needs to perform verification on this evidence once to be certain that the entire chain operation from each leaf node to the root node complies with the preset compliance requirements, without needing to verify the independent evidence of each child node individually, thereby reducing the verification overhead, which originally grew linearly with the number of participants, to a constant level.

[0138] Step S6: Domestic master node verification and global model update; The domestic aggregation master node is used to receive the aggregated model gradient ciphertext and the nested evidence transmitted along the aggregation path, and to verify the integrity of all overseas child node operations on the aggregation path by performing a one-time verification on the nested evidence, and to update the global model after the verification is passed.

[0139] The domestic aggregation master node is also used to verify the integrity of the data subset commitments submitted by the overseas training sub-nodes after the global model converges, to ensure that the overseas sub-nodes used all the data they claimed to have for training.

[0140] Specifically, in each round of federated learning training, the domestic aggregation master node, as the central hub of the entire cross-border collaborative architecture, is responsible for receiving two key results that converge from the bottom up along the aggregation spanning tree: first, the aggregated gradient ciphertext obtained through multi-level accumulation; and second, the final nested evidence formed after recursive nesting and merging. The aggregation master node first performs a one-time verification operation on the final nested evidence, verifying whether the cryptographic constraints contained in the evidence are fully valid by calling a zero-knowledge proof verification algorithm. Since the nested evidence is formed by merging the trusted evidence of all overseas child nodes layer by layer along the secure path, it has completely preserved the proof information of all computational operations and data commitments from each leaf node to the root node. Therefore, this single nested evidence is equivalent to a unified proof of the behavior of all overseas child nodes in the entire aggregation chain. Once the verification is successful, the aggregation master node can be certain that all overseas training child nodes participating in this round of aggregation have honestly used their pre-committed real data, fully executed the agreed local model training task, and have not generated any invalid model updates or malicious gradients, without accessing any overseas original data or verifying the independent evidence of each child node separately.

[0141] If the one-time verification fails, it indicates that at least one overseas training sub-node on the aggregation path has not correctly executed the local training task or used uncommitted data, meaning the integrity of the entire chain operation is questionable. In this case, the domestic aggregation master node performs the following exception handling steps: First, reject the aggregated gradient ciphertext for this round and terminate the global model update for this round to avoid polluting the global model; Secondly, broadcast the verification failure notification to each overseas training sub-node and issue instructions to re-execute the current round of local training and evidence generation; Simultaneously, a malicious node tracing mechanism is triggered. The domestic aggregation master node can request each parent node on the aggregation spanning tree to provide verification failure records of its child nodes in order to locate and mark child nodes with abnormal behavior, and exclude them from the set of trusted participants in subsequent training rounds.

[0142] After confirming the integrity of the entire operation, the aggregation master node immediately initiates the model update process. First, the aggregation master node, in collaboration with each overseas sub-node, executes the inverse process of the secure multi-party computation protocol to securely remove the random mask attached before gradient uploading, thereby obtaining the true global gradient plaintext. The specific implementation of the "inverse process" of securely removing the gradient mask is as follows: Before the start of each round of training, each overseas training sub-node participating in that round of training... Through a pre-defined pseudo-random number generator seed negotiation mechanism, a random mask seed bound to the round is secretly shared with the domestic aggregation master node. Each child node generates a pseudo-random mask vector for this round based on the seed. Its dimension and model gradient The same applies. During the local gradient encryption phase, child nodes compute the gradient ciphertext. And upload it.

[0143] At the aggregation master node, once the nested evidence verification is successful, the aggregation master node has obtained the aggregate gradient ciphertext of all participating nodes from the root node of the aggregation spanning tree. At this point, the domestic aggregation master node utilizes the mask seed that it has pre-shared with each child node. The mask vector of each child node is calculated independently. And sum them to get the total mask. Finally, the aggregator master node performs a subtraction operation: (twenty three) This allows for the secure acquisition of the true global gradient plaintext without the need for additional communication between child nodes. The process leverages the additive homomorphic property of pseudo-random masks, eliminating the need for complex multi-party computation protocols. This protects the gradient privacy of each child node (the master node within the local area cannot know individual gradient values) while ensuring the correctness of the aggregation result.

[0144] Subsequently, the aggregation master node uses this global gradient to update the current global model parameters, obtaining a new global model, which is then broadcast to all overseas training sub-nodes for the next round of iterative training. In this way, the domestic aggregation master node transforms the complex multi-party compliance verification problem into an efficient verification of a single cryptographic piece of evidence. This significantly reduces verification computational overhead and ensures that the gradient sources upon which the global model update relies have undergone rigorous cryptographic auditing. Thus, while protecting data privacy and model quality, it achieves a secure and trustworthy closed loop in cross-border federated learning: "data remains still, model moves; process is provable, and supervision is traceable."

[0145] It should be noted that the above examples are merely some specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments and many variations are possible. All variations that can be directly derived or conceived by those skilled in the art from the content disclosed in this invention should be considered within the scope of protection of this invention.

Claims

1. A trusted data processing system for cross-border federated learning based on zero-knowledge proofs, characterized in that, include: One task initiator and aggregation master node deployed domestically, and multiple training sub-nodes deployed overseas; The task initiator is used to initialize the system's common parameters and the common reference string required for zero-knowledge proofs; The overseas training sub-nodes are used to store local privacy data and perform local iterative training based on the global model issued by the domestic master node to generate model gradients; they are also used to generate credible evidence for the integrity of the local training process and the authenticity of the data used, based on an improved concise non-interactive zero-knowledge proof protocol. The overseas training sub-nodes are also used to construct dynamic aggregation paths, and recursively merge the credible evidence of each node on the aggregation path to generate a nested evidence. The domestic aggregation master node is used to receive the aggregated model gradient ciphertext and the nested evidence transmitted along the aggregation path, and to verify the integrity of all overseas child node operations on the aggregation path by performing a one-time verification on the nested evidence, and to update the global model after the verification is passed.

2. The system according to claim 1, characterized in that, The overseas training sub-nodes generate credible evidence for the local training process, specifically including: Before local training is executed, the overseas training sub-node performs a matrix commitment on its local dataset and sends the commitment value to the domestic aggregation master node. The domestic aggregation master node calculates the hash digest of the commitment value and maps and stores the hash digest into a Bloom filter through multiple independent hash functions. During the training process, the overseas training sub-nodes construct arithmetic circuits based on quadratic matrix procedures. The constraints of these arithmetic circuits include both the computational process of model training and the matrix commitment of the dataset used. This allows the generated credible evidence to prove that the training process was correctly executed based on the committed specific dataset without disclosing the data and model.

3. The system according to claim 2, characterized in that, The process by which the overseas training sub-nodes generate credible evidence also includes: The Chinese Remainder Theorem is used to preprocess batch training data, and the convolution operation is optimized into matrix multiplication. By introducing an uncertain parameter vector, the verification of batch matrix multiplication is compressed into the verification of a single equation. Furthermore, by utilizing the properties of the matrix trace, this equation is transformed into the verification of a single matrix trace equation, thereby reducing the number of multiplication gates in the arithmetic circuit during the generation of zero-knowledge proofs.

4. The system according to claim 1, characterized in that, The construction of dynamic aggregation paths and generation of nested evidence among the overseas training sub-nodes specifically includes: Each overseas training sub-node determines the current network topology by sharing an adjacency list, and discovers and removes malicious nodes by verifying credible evidence of neighboring nodes, thus forming a credible sparse communication graph. Run a depth-first traversal algorithm on the trusted sparse communication graph to generate an aggregation spanning tree as the path for data aggregation and evidence nesting; On the aggregated spanning tree, after receiving the credible evidence and gradient ciphertext from the child node, the parent node first verifies the validity of the child node's evidence, and then performs a cryptographic nesting operation on its own evidence and the child node's evidence to generate a new nested evidence. This nested evidence is equivalent to a proof of the integrity of all operations on the entire path from the source node to the current node.

5. The system according to claim 4, characterized in that, The cryptographic nesting operation is implemented through random linear combinations of group elements, specifically: The parent node selects a random compression factor and performs exponential and multiplicative operations on the corresponding group elements in its own evidence and the child node's evidence to generate new group elements. This ensures that the generated nested evidence contains the same number of group elements as the single node evidence in terms of data structure, thus having a constant size. The total amount of proof data received by the domestic aggregation master node in cross-border communication is unrelated to the number of overseas training sub-nodes participating in the aggregation path, and the verification overhead of the domestic aggregation master node does not increase linearly with the increase of the number of overseas training sub-nodes.

6. A trusted data processing method for cross-border federated learning based on zero-knowledge proofs, applied to the system as described in any one of claims 1 to 5, characterized in that, Includes the following steps: Step S1: The domestic task initiator initializes the system parameters, and the overseas training sub-nodes commit to their local datasets and register with the domestic aggregation master node; Step S2: The overseas training sub-nodes use local data to perform model training and generate credible evidence of the binding data commitment based on the improved zk-SNARK protocol; Step S3: Construct a dynamic secure aggregation path between overseas training sub-nodes, and recursively verify and nest the trusted evidence on the path, while aggregating the encrypted model gradients; Step S4: The domestic aggregation master node receives the final aggregated gradient ciphertext and the single nested evidence, and performs a one-time verification; Step S5: After successful verification, the domestic aggregation master node decrypts the aggregation gradient and updates the global model. Then, the new global model is distributed to the overseas child nodes. Steps S2 to S4 are repeated until the model converges.

7. The method according to claim 6, characterized in that, In step S1: The task initiator selects multiple participants, including itself, and uses verifiable secret sharing technology to collaboratively generate the public reference string required for zero-knowledge proof, thereby eliminating the dependence on a single trusted third party. The overseas training sub-nodes divide the local dataset into multiple subsets. For each subset, they generate a matrix commitment value by performing matrix multiplication between the preprocessed subset matrix and a singular square matrix, and then send the matrix commitment value to the domestic aggregation master node. The domestic aggregation master node constructs a Bloom filter, calculates the hash digest of each received matrix commitment value, and maps and stores each hash digest into the Bloom filter through multiple independent hash functions for subsequent verification of the legality of the data source.

8. The method according to claim 6, characterized in that, Step S2 further includes: After generating credible evidence, the overseas training sub-nodes use a pseudo-random mask to encrypt the local model gradient to generate gradient ciphertext and generate a range proof to prove that the norm of the encrypted gradient is within a preset range, thereby proving the correctness of the encryption operation and preventing malicious gradient submission. Before verifying the nested evidence, the domestic aggregation master node first verifies the range proof to filter out incorrect cryptographic gradients.

9. The method according to claim 6, characterized in that, In step S4, the domestic aggregation master node performs a one-time verification, which includes: The nested evidence was verified by bilinear pairing to confirm the integrity of model training computation and the authenticity of data for all overseas training sub-nodes on the aggregation path. If the verification is successful, the domestic aggregation master node independently calculates the total mask using the mask seed that it shares with each overseas training sub-node in advance, and removes the total mask from the aggregated gradient ciphertext to obtain the global gradient plaintext. If the verification fails, the domestic aggregation master node will refuse to receive the aggregated gradient ciphertext for this round, terminate the global model update for this round, and issue a retraining instruction to each overseas training sub-node or trigger a malicious node tracing mechanism.

10. The method according to claim 6, characterized in that, Following step S5, the following is also included: After the global model converges, the domestic aggregation master node uses the homomorphic property of matrix commitments to verify the integrity of the data subset commitments submitted by the overseas training sub-nodes in all training rounds. By verifying a vector inner product equation or a hash chain-based equation, it ensures that the overseas training sub-nodes used all the data they claimed for training, thus achieving cryptographic auditing of data integrity.

Images