A privacy-enhanced federated learning system based on policy scheduling
By introducing policy scheduling and dynamic key management into the federated learning system, and combining differential privacy, homomorphic encryption, and zero-knowledge proofs, the problem of balancing privacy protection and model utility in existing systems is solved, achieving end-to-end privacy protection and efficient model training.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANGHAI XINHAO INFORMATION TECH CO LTD
- Filing Date
- 2026-03-23
- Publication Date
- 2026-06-23
AI Technical Summary
Existing federated learning systems face multiple threats to privacy protection, including the theft of model parameters, malicious node tampering, the inability to dynamically adjust static policies, the lack of forward security in key management, and the introduction of new privacy leakage risks through auditing mechanisms, making it difficult to balance privacy protection with model utility.
A privacy-enhanced federated learning system based on policy scheduling is adopted, including a central coordination node, local training nodes, and third-party audit nodes. Differential privacy, homomorphic encryption, zero-knowledge proof, and key management units are deployed. Through a dynamic key system and policy scheduling center, end-to-end privacy protection and intelligent scheduling are achieved. Combined with a trusted execution environment and hardware encryption modules, dual protection is provided.
It significantly improves the system's resistance to attacks, achieves a balance between privacy protection and model utility, enhances the system's credibility and forward security of keys, and reduces the risk of key leakage.
Smart Images
Figure CN122263162A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of privacy protection technology, specifically relating to a privacy-enhancing federated learning system based on policy scheduling. Background Technology
[0002] With the rapid development of big data and artificial intelligence technologies, federated learning, as a distributed machine learning paradigm, allows participating parties to collaboratively train models without sharing original data, effectively avoiding the privacy risks associated with data centralization. However, federated learning systems still face multiple privacy threats: attackers can back-infer original training data through model parameters or gradients (such as membership inference attacks and attribute inference attacks); intermediate computation results may be stolen during transmission or aggregation; and malicious nodes may submit tampered parameters to destroy the global model. To address these challenges, existing research has proposed various privacy enhancement techniques, such as differential privacy, which protects data privacy by adding noise perturbations, but often at the cost of decreased model accuracy; homomorphic encryption, which allows computation in ciphertext, but incurs huge computational overhead and is difficult to apply to large-scale models; secure multi-party computation, which enables privacy-preserving collaborative computation, but has high communication costs and complex protocols; and trusted execution environments, which provide a secure execution environment through hardware isolation, but still face the threat of side-channel attacks. Furthermore, existing systems mostly adopt static privacy protection strategies, which cannot dynamically adjust the protection strength according to data characteristics, training progress, and node contributions, making it difficult to balance privacy protection and model utility. In terms of key management, most systems still rely on fixed keys or simple rotation mechanisms, lacking forward security and resistance to data leakage. Auditing mechanisms often require plaintext data or parameters, introducing new risks of privacy breaches. Summary of the Invention
[0003] To address the aforementioned problems in the prior art, this invention provides a privacy-enhanced federated learning system based on policy scheduling.
[0004] The objective of this invention can be achieved through the following technical solutions: A policy-based privacy-enhancing federated learning system, comprising: The system comprises a central coordination node, local training nodes, and third-party audit nodes. Each node is equipped with a privacy enhancement module, which includes a differential privacy unit, a homomorphic encryption unit, a zero-knowledge proof unit, and a key management unit. The central coordination node is deployed in a trusted cloud environment and configured with a hardware encryption module. The local training nodes are deployed by the participating institutions, and the third-party audit nodes are deployed by an authoritative institution. The central coordination node generates initial global model parameters and a dynamic key system, and distributes them to each of the local training nodes and the third-party auditing nodes; The local training node is used to perform privacy enhancement processing on the initial global model parameters to obtain privacy data, and to train the local model on the privacy data. The encrypted local model parameters are then sent to the central coordination node, which performs homomorphic aggregation operation on the local model parameters through the homomorphic encryption unit to generate a draft of the global model parameters. The initial draft of the global model parameters is sent to the third-party audit node. The third-party audit node generates a compliance certificate for the aggregation process through the zero-knowledge proof unit, and synchronizes the compliance certificate for the aggregation process and the initial draft of the global model parameters to each of the local training nodes. Each local training node verifies the validity of the compliance proof of the aggregation process and the completeness of the initial draft of the global model parameters. If the verification is successful, the final draft of the global model parameters is confirmed. If the verification fails, the parameter re-aggregation process is triggered. The central coordination node triggers a dynamic key update mechanism to generate a new key system and distribute it to each node through an encrypted channel. At the same time, each node uses secure erasure technology to destroy the old key. The central coordination node is synchronously configured with a policy scheduling center, which dynamically schedules the privacy enhancement process and dynamic key update process through a data dependency privacy protocol, a node contribution dynamic key protocol, and a time evolution privacy decay protocol.
[0005] Preferably, the dynamic key system includes a data encryption key, a signature key, and a verification key; the central coordination node and each of the local training nodes and the third-party auditing nodes adopt a two-way identity authentication mechanism.
[0006] Preferably, the privacy enhancement process specifically involves: the differential privacy unit adding noise perturbation to the initial global model parameters, while simultaneously desensitizing sensitive fields in the initial global model parameters; The noise intensity in the noise disturbance is determined using an adaptive noise adjustment strategy. Initially, the noise intensity is dynamically adjusted based on the sensitivity of the local training data and the preset privacy budget. Later, the privacy budget is dynamically adjusted based on the data dependency privacy protocol and the time evolution privacy decay protocol. At the same time, a privacy budget allocation algorithm is used to distribute the total privacy budget across multiple training rounds.
[0007] Preferably, the local model training specifically involves the homomorphic encryption unit encrypting the intermediate calculation results of the model using partial homomorphic encryption or fully homomorphic encryption techniques. Meanwhile, the key management unit, based on the dynamic key distributed by the central coordination node, encrypts and stores the privacy data and controls access, allowing only authorized processes to access parameters. The key management unit, based on a role-based access control model, restricts access permissions for local model parameters, allowing only the training process to access parameters in a trusted execution environment and prohibiting unauthorized processes from reading or modifying parameters. It also monitors abnormal behavior during local training in real time. If an anomaly is detected, training is immediately paused and the current parameters are encrypted and backed up, while a warning message is sent to the central coordination node.
[0008] Preferably, the homomorphic aggregation operation specifically involves: performing a consistency check on the hash values of the node parameters sent by each of the local training nodes; if a node parameter is found to have been tampered with, the node parameter is rejected from participating in the aggregation, and an abnormal notification is sent to the third-party audit node. The central coordination node dynamically adjusts the aggregation weights of the node parameters and aggregates them based on the data quality and training contribution of each local training node to obtain the initial draft of the global model parameters. The central coordination node stores the initial draft of the global model parameters using a hybrid encryption method of symmetric and asymmetric encryption. The parameter aggregation process is stored on-chain via the consortium blockchain.
[0009] Preferably, the generation of the compliance proof of the aggregation process specifically involves the third-party audit node generating the compliance proof of the aggregation process based on a zero-knowledge proof algorithm, using the aggregation process log and parameter hash value.
[0010] Preferably, the zero-trust verification specifically involves: after each local training node receives the compliance proof of the aggregation process, it verifies the validity through a zero-knowledge proof unit. The verification content includes the validity of the proof document signature, the compliance of the aggregation calculation logic, and the consistency of the parameter hash values. If more than a preset threshold of local training nodes raises objections to the initial draft of the global model parameters, the third-party audit node re-examines the aggregation process. If an aggregation error is confirmed, the central coordination node removes the abnormal parameters and re-initiates the aggregation. If the objection is not valid, a verification report is sent to the objecting node, explaining the verification basis.
[0011] Preferably, the dynamic key update mechanism is as follows: The dynamic key update mechanism is triggered by periodic triggering, risk triggering, and compliance triggering; the new key is distributed in a sharded manner, and the key strength depends on the dynamic key protocol contributed by the node; after receiving the new key, each node uses a secure erasure technique to remove the old key and delete the temporary data encrypted by the old key.
[0012] Preferably, the data-dependent privacy protocol specifically involves: real-time monitoring of the activity level of key features in the current iteration, updating the privacy budget, mathematically described as follows: ,in, For the updated privacy budget, Based on privacy budget, As a dependency index, The activity level of key features at time t. This represents the highest level of activity in history. The time-evolutionary privacy decay protocol specifically involves monitoring the current training progress and updating the privacy budget accordingly, mathematically described as follows: ,in, For the updated privacy budget, The attenuation coefficient is... This represents the current iteration number. The total number of iterations; the data dependency privacy protocol has a higher priority than the time evolution privacy decay protocol; The node contribution dynamic key protocol specifically involves: calculating the gradient contribution ratio of each client in real time, and dynamically updating the key strength based on the gradient contribution ratio. Mathematically, this can be described as follows: ,in, For the updated key strength, Based on the basic key strength, As a contribution index, Let t be the percentage of gradient contribution by the client. Contribute the total to all clients.
[0013] The beneficial effects of this invention are as follows: (1) By integrating differential privacy, homomorphic encryption, zero-knowledge proof and trusted execution environment, a full-link privacy protection system from data preprocessing, computation process to result verification is constructed, which significantly improves the system’s anti-attack capability.
[0014] (2) By introducing a policy scheduling center, the privacy protection strength and key policy are dynamically adjusted according to data dependency, time evolution and node contribution, thus realizing an intelligent balance between privacy protection and model utility and overcoming the rigidity problem of traditional static policies.
[0015] (3) By using third-party audit nodes and zero-knowledge proof technology, the verifiability and fairness of the aggregation process are achieved without disclosing any original information, thus enhancing the credibility of the system.
[0016] (4) By adopting a dynamic key system and a fragmented distribution mechanism, combined with quantum encryption and national cryptographic algorithms, the forward security and resistance to quantum attacks of the key are ensured, and the risk of key leakage is greatly reduced.
[0017] (5) With the help of a trusted execution environment and hardware encryption module, dual protection of "software encryption + hardware isolation" is achieved, so that even if the host system is compromised, the core data can still be securely protected. Attached Figure Description
[0018] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.
[0019] Figure 1 This is a flowchart of the steps of a privacy-enhancing federated learning system based on policy scheduling according to the present invention. Detailed Implementation
[0020] To better understand the invention, various aspects of the invention will be described in more detail with reference to the accompanying drawings. It should be understood that these detailed descriptions are merely illustrative of exemplary embodiments of the invention and are not intended to limit the scope of the invention in any way. Throughout the specification, the expression "and / or" includes any and all combinations of one or more of the associated listed items. As used herein, the terms "approximately," "about," and similar terms are used as expressions of approximation, not as expressions of degree, and are intended to describe inherent deviations in measured or calculated values that will be recognized by those skilled in the art. Furthermore, the order in which the steps are described in this invention does not necessarily indicate the order in which these steps occur in actual operation, unless otherwise expressly defined or deduced from the context.
[0021] It should also be understood that expressions such as "comprising," "including," "having," "containing," and / or "comprising" are open-ended rather than closed-ended expressions in this specification, indicating the presence of the stated features, elements, and / or components, but not excluding the presence of one or more other features, elements, components, and / or combinations thereof. Furthermore, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features, not just individual elements in the list. Additionally, when describing embodiments of the invention, the word "may" is used to mean "one or more embodiments of the invention." And the term "exemplary" is intended to refer to examples or illustrations.
[0022] Unless otherwise specified, all terms used herein (including engineering and technical terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that, unless expressly stated herein, terms defined in common dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the relevant art, and not in an idealized or overly formalized sense.
[0023] It should be noted that, unless otherwise specified, the embodiments and features described in this invention can be combined with each other. The invention will now be described in detail with reference to the accompanying drawings and embodiments.
[0024] Example 1: Please see Figure 1 A privacy-enhanced federated learning system based on policy scheduling includes a central coordination node, multiple local training nodes, and a third-party audit node. Each node deploys a privacy enhancement module, which includes a differential privacy unit, a homomorphic encryption unit, a zero-knowledge proof unit, and a key management unit. The central coordination node is deployed in a trusted cloud environment (such as a government cloud or a financial private cloud) and configured with hardware encryption modules (such as encryption cards or TPM 2.0). The local training nodes are deployed by participating institutions (such as banks, hospitals, and government departments). The third-party audit node is deployed by an independent authoritative institution (such as an industry regulatory department or a third-party security company) to ensure the system's impartiality. The central coordination node generates initial global model parameters and a dynamic key system, and distributes them to each of the local training nodes and the third-party auditing nodes through a quantum key distribution channel (for ultra-high security scenarios) or an SM4 national cryptographic encryption channel (for general scenarios). The local training node is used to perform privacy enhancement processing on the initial global model parameters to obtain privacy data, and to train the local model on the privacy data. The encrypted local model parameters (including parameter hash values and node signatures) are sent to the central coordination node. The central coordination node performs homomorphic aggregation operation on the local model parameters through the homomorphic encryption unit (parameter summation and weighted average can be completed without decryption) to generate a draft of the global model parameters. The initial draft of the global model parameters is sent to the third-party audit node. The third-party audit node generates a compliance certificate for the aggregation process through the zero-knowledge proof unit (proving that the aggregation operation did not tamper with the parameters or leak privacy), and synchronizes the compliance certificate for the aggregation process and the initial draft of the global model parameters to each of the local training nodes. Each local training node verifies the validity of the compliance proof of the aggregation process and the completeness of the initial draft of the global model parameters. If the verification is successful, the final draft of the global model parameters is confirmed. If the verification fails, the parameter re-aggregation process is triggered. The central coordination node triggers a dynamic key update mechanism periodically (e.g., after each training round) or when it detects a risk of key leakage (e.g., abnormal node access, network attack), generates a new key system, and distributes it to each node through an encrypted channel. At the same time, each node uses secure erasure technology to destroy the old key to ensure long-term key security. The central coordination node is synchronously configured with a policy scheduling center, which dynamically schedules the privacy enhancement process and dynamic key update process through a data dependency privacy protocol, a node contribution dynamic key protocol, and a time evolution privacy decay protocol.
[0025] In this embodiment, the dynamic key system includes a data encryption key (used for encrypting local data and intermediate computation results, employing SM4 or AES-256 algorithms), a signature key (used for node authentication and parameter signing, employing SM2 or ECDSA algorithms to prevent parameter tampering and identity forgery), and a verification key (used for zero-knowledge proof verification, employing a lattice-based quantum-resistant algorithm to ensure privacy during the verification process and resist quantum attack threats). A two-way authentication mechanism (based on digital certificates and device fingerprint binding) is used between the central coordination node and each of the local training nodes and the third-party audit nodes to prevent key distribution from being hijacked. Key distribution uses a quantum encryption channel; quantum key distribution (QKD) technology is used in extremely high-security scenarios (such as interbank financial risk control and medical record training), while SM4 encryption channels are used in ordinary scenarios.
[0026] In this embodiment, the privacy enhancement process specifically involves: the differential privacy unit adding noise perturbations conforming to a Laplace distribution or a Gaussian distribution to the initial global model parameters, and simultaneously desensitizing sensitive fields (such as financial account information, medical record identifiers, and government identity information) in the initial global model parameters using format-preserving encryption (FPE) technology, ensuring that the preprocessed data retains training value without leaking original privacy; The determination of noise intensity in the noise disturbance adopts an adaptive noise adjustment strategy. In the initial stage, the noise intensity is dynamically adjusted based on the sensitivity of the local training data (calculated through local or global sensitivity) and a preset privacy budget (e.g., less than or equal to 0.1 in financial scenarios and less than or equal to 0.05 in medical scenarios): for high-sensitivity data (e.g., medical diagnosis results), the noise intensity is increased; for low-sensitivity data (e.g., user behavior statistics), the noise intensity is decreased. In the later stage, the privacy budget is dynamically adjusted based on the data dependency privacy protocol and the time evolution privacy decay protocol. At the same time, a privacy budget allocation algorithm (e.g., a greedy algorithm) is used to distribute the total privacy budget across multiple rounds of training to avoid excessive consumption of the privacy budget in a single round of training. The specific format preservation encryption technology involves: using FPE (Factory-Based Encryption) technology to de-identify sensitive fields in the data (such as financial account numbers, medical ID numbers, and government citizen IDs). For example, FPE encryption is applied to bank account numbers “622202XXXXXXXX1234”, retaining the prefix “622202” and the suffix “1234”, while encrypting the middle field as “AB3D5E”. The de-identified account number is “622202AB3D5E1234”, which hides core privacy while retaining the account format characteristics. FPE encryption is applied to patient ID numbers “110101XXXXXXXX1234”, retaining the first 6 administrative region codes and the last 4, while encrypting the middle date of birth field to ensure that the patient's true identity cannot be deduced. FPE encryption is applied to citizen government ID numbers “CZ2025XXXXXXXX001”, retaining the prefix “CZ2025” and the serial number “001”, while encrypting the middle field, which complies with the government data de-identification specifications.
[0027] In this embodiment, the local model training specifically involves the homomorphic encryption unit encrypting intermediate computation results (such as gradients and loss values) using partial homomorphic encryption (PHE) or full homomorphic encryption (FHE) techniques to prevent intermediate data leakage. Lightweight partial homomorphic encryption (PHE) is used for low-sensitivity intermediate results (such as batch normalized statistics), while full homomorphic encryption (FHE) or secure multi-party computation (MPC) is used for high-sensitivity intermediate results (such as model gradients) to balance privacy protection strength and training efficiency. Meanwhile, the key management unit, based on the dynamic key distributed by the central coordination node, encrypts and stores the privacy data and controls access, allowing only authorized processes to access parameters. The key management unit, based on a role-based access control (RBAC) model, restricts access permissions for local model parameters, allowing only training processes to access parameters within a Trusted Execution Environment (TEE, such as Intel SGX), prohibiting unauthorized processes from reading or modifying parameters. It also monitors for abnormal behavior during local training (such as sudden gradient changes or abnormally shortened training time). If an anomaly is detected, training is immediately paused, and the current parameters are encrypted and backed up, while a warning message is sent to the central coordination node. An independent encryption key is generated within the Trusted Execution Environment to perform secondary encryption on parameters and intermediate data during training. Even if the node's operating system is compromised, it cannot steal the privacy data within the TEE. Furthermore, the TEE and key management unit work together, allowing only training processes with legitimate keys to enter the TEE and prohibiting unauthorized processes from accessing it, forming a dual protection of "software encryption + hardware isolation."
[0028] In this embodiment, the homomorphic aggregation operation specifically involves: performing a consistency check on the hash values of the node parameters sent by each local training node; if a node parameter is found to have been tampered with (hash value mismatch), then the node parameter is rejected from participating in the aggregation, and an abnormal notification is sent to the third-party audit node. The central coordination node dynamically adjusts the aggregation weights of the node parameters (nodes with high data quality and large contribution have a weight ≥0.2, and vice versa) based on the data quality (such as data integrity and label accuracy) and training contribution (such as the improvement in model accuracy) of each local training node, and aggregates them to improve the global model accuracy and obtain the initial draft of the global model parameters. The central coordination node stores the initial draft of the global model parameters using a hybrid encryption method of symmetric and asymmetric encryption. The symmetric key is used for daily access, while the asymmetric key is jointly kept by the central coordination node and the third-party audit node. Both parties need to work together to decrypt the key to prevent a single node from tampering with the global parameters. The parameter aggregation process (list of participating nodes, aggregation weights, calculation results, and verification records) is stored on the blockchain (such as Fabric or government blockchain) to ensure that the aggregation process is traceable and tamper-proof, facilitating subsequent auditing.
[0029] In this embodiment, the generation of the compliance proof of the aggregation process is specifically as follows: the third-party audit node generates the compliance proof of the aggregation process based on the zero-knowledge proof (ZKP) algorithm (such as zk-SNARKs, Bulletproofs) and the aggregation process log and parameter hash value. The compliance proof of the aggregation process does not contain any original parameters or intermediate data.
[0030] In this embodiment, the zero-trust verification specifically involves: after each local training node receives the compliance proof of the aggregation process, it verifies the validity through a zero-knowledge proof unit. The verification content includes the validity of the proof document signature, the compliance of the aggregation calculation logic, and the consistency of the parameter hash values. If more than a preset threshold (e.g., 30%) of the local training nodes raise objections to the initial draft of the global model parameters (verification failure), the third-party audit node re-examines the aggregation process. If the aggregation is confirmed to be incorrect, the central coordination node removes the abnormal parameters and re-initiates the aggregation. If the objection is not valid, a verification report is sent to the objecting node, explaining the verification basis.
[0031] In this embodiment, the dynamic key update mechanism is specifically as follows: The dynamic key update mechanism is triggered by periodic events (after each training round), risk events (detection of node key leakage, network attacks, or node exiting the system), and compliance events (updates to industry privacy policies, such as changes in encryption standards due to revisions to the Personal Information Protection Law). The new key is distributed in shards, divided into N shards and distributed to N local training nodes. The central coordinating node must collect shard confirmation information from at least K (K≤N) nodes before allowing nodes to use the new key, preventing single-point key leakage. Key strength depends on the node's contribution to the dynamic key protocol. After receiving the new key, each node uses a secure erasure technique compliant with national confidentiality standards (GJB 5233-2004) to thoroughly erase the old key by overwriting random data at least three times, while also deleting temporary data encrypted with the old key to prevent reuse.
[0032] In this embodiment, the data-dependent privacy protocol specifically involves: real-time monitoring of the activity of key features in the current iteration (i.e., features that contribute to key decisions in the model, such as the "BRCA1 gene mutation" feature contributing to key decisions in a cancer prediction model), and updating the privacy budget, mathematically described as follows: ,in, For the updated privacy budget, Based on the basic privacy budget (i.e., the privacy budget mentioned above based on the preset privacy budget). As a dependency index, The activity level of key features at time t. The higher the historical activity level, the more important the feature, and the more sensitive the system perceives the data, requiring a larger privacy budget; when the feature is inactive, the privacy budget is automatically released. The time-evolutionary privacy decay protocol specifically involves monitoring the current training progress (e.g., 500 iterations completed, total target 2000 iterations), and updating the privacy budget based on this progress. Mathematically, this can be described as follows: ,in, For the updated privacy budget, The attenuation coefficient is... This represents the current iteration number. The total number of iterations; the data dependency privacy protocol has a higher priority than the time evolution privacy decay protocol; The node contribution dynamic key protocol specifically involves: calculating the gradient contribution ratio of each client in real time (e.g., the gradient influence of a hospital on the global model in this iteration), and dynamically updating the key strength based on the gradient contribution ratio. Mathematically, this can be described as follows: ,in, For the updated key strength, Based on the basic key strength, As a contribution index, Let t be the percentage of gradient contribution by the client. Contribute the total to all clients.
[0033] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.
Claims
1. A privacy-enhanced federated learning system based on policy scheduling, characterized in that, The system includes a central coordination node, local training nodes, and third-party audit nodes. Each node is deployed with a privacy enhancement module, which includes a differential privacy unit, a homomorphic encryption unit, a zero-knowledge proof unit, and a key management unit. The central coordination node is deployed in a trusted cloud environment and is configured with a hardware encryption module. The local training nodes are deployed by the participating institutions. The third-party audit nodes are deployed by an authoritative organization; The central coordination node generates initial global model parameters and a dynamic key system, and distributes them to each of the local training nodes and the third-party auditing nodes; The local training node is used to perform privacy enhancement processing on the initial global model parameters to obtain privacy data, and to train the local model on the privacy data. The encrypted local model parameters are then sent to the central coordination node, which performs homomorphic aggregation operation on the local model parameters through the homomorphic encryption unit to generate a draft of the global model parameters. The initial draft of the global model parameters is sent to the third-party audit node. The third-party audit node generates a compliance certificate for the aggregation process through the zero-knowledge proof unit, and synchronizes the compliance certificate for the aggregation process and the initial draft of the global model parameters to each of the local training nodes. Each local training node verifies the validity of the compliance proof of the aggregation process and the completeness of the initial draft of the global model parameters. If the verification is successful, the final draft of the global model parameters is confirmed. If the verification fails, the parameter re-aggregation process is triggered. The central coordination node triggers a dynamic key update mechanism to generate a new key system and distribute it to each node through an encrypted channel. At the same time, each node uses secure erasure technology to destroy the old key. The central coordination node is synchronously configured with a policy scheduling center, which dynamically schedules the privacy enhancement process and dynamic key update process through a data dependency privacy protocol, a node contribution dynamic key protocol, and a time evolution privacy decay protocol.
2. The privacy-enhanced federated learning system based on policy scheduling according to claim 1, characterized in that, The dynamic key system includes a data encryption key, a signature key, and a verification key; the central coordination node and each of the local training nodes and the third-party audit nodes adopt a two-way identity authentication mechanism.
3. The privacy-enhancing federated learning system based on policy scheduling according to claim 1, characterized in that, The privacy enhancement process specifically involves: the differential privacy unit adding noise perturbation to the initial global model parameters, and simultaneously desensitizing sensitive fields in the initial global model parameters; The noise intensity in the noise disturbance is determined using an adaptive noise adjustment strategy. Initially, the noise intensity is dynamically adjusted based on the sensitivity of the local training data and the preset privacy budget. Later, the privacy budget is dynamically adjusted based on the data dependency privacy protocol and the time evolution privacy decay protocol. At the same time, a privacy budget allocation algorithm is used to distribute the total privacy budget across multiple training rounds.
4. The privacy-enhanced federated learning system based on policy scheduling according to claim 3, characterized in that, The local model training specifically involves the homomorphic encryption unit encrypting the intermediate calculation results of the model using partial or full homomorphic encryption techniques. Meanwhile, the key management unit, based on the dynamic key distributed by the central coordination node, encrypts and stores the privacy data and controls access, allowing only authorized processes to access parameters. The key management unit, based on a role-based access control model, restricts access permissions for local model parameters, allowing only the training process to access parameters in a trusted execution environment and prohibiting unauthorized processes from reading or modifying parameters. It also monitors abnormal behavior during local training in real time. If an anomaly is detected, training is immediately paused and the current parameters are encrypted and backed up, while a warning message is sent to the central coordination node.
5. The privacy-enhanced federated learning system based on policy scheduling according to claim 4, characterized in that, The homomorphic aggregation operation specifically involves: performing consistency verification on the hash values of node parameters sent by each local training node; if node parameter tampering is detected, the node parameter is rejected from participating in the aggregation, and an abnormal notification is sent to the third-party audit node. The central coordination node dynamically adjusts the aggregation weights of the node parameters and aggregates them based on the data quality and training contribution of each local training node to obtain the initial draft of the global model parameters. The central coordination node stores the initial draft of the global model parameters using a hybrid encryption method of symmetric and asymmetric encryption. The parameter aggregation process is stored on-chain via the consortium blockchain.
6. The privacy-enhanced federated learning system based on policy scheduling according to claim 1, characterized in that, The generation of the compliance proof for the aggregation process is specifically as follows: the third-party audit node generates the compliance proof for the aggregation process based on the zero-knowledge proof algorithm, using the aggregation process log and parameter hash value.
7. The privacy-enhanced federated learning system based on policy scheduling according to claim 1, characterized in that, The zero-trust verification specifically involves each local training node receiving the compliance proof of the aggregation process and verifying its validity through a zero-knowledge proof unit. The verification content includes the validity of the proof file signature, the compliance of the aggregation calculation logic, and the consistency of the parameter hash values. If more than a preset threshold of local training nodes raise objections to the initial draft of the global model parameters, the third-party audit node will re-examine the aggregation process. If the aggregation is confirmed to be incorrect, the central coordination node will remove the abnormal parameters and re-initiate the aggregation. If the objection is not valid, a verification report is sent to the objecting node, explaining the basis for the verification.
8. The privacy-enhancing federated learning system based on policy scheduling according to claim 1, characterized in that, The dynamic key update mechanism is specifically as follows: The dynamic key update mechanism is triggered by periodic triggering, risk triggering, and compliance triggering; the new key is distributed in a sharded manner, and the key strength depends on the dynamic key protocol contributed by the node; after receiving the new key, each node uses a secure erasure technique to remove the old key and delete the temporary data encrypted by the old key.
9. The privacy-enhancing federated learning system based on policy scheduling according to claim 1, characterized in that, The data-dependent privacy protocol specifically involves: real-time monitoring of the activity level of key features in the current iteration, updating the privacy budget, mathematically described as follows: ,in, For the updated privacy budget, Based on privacy budget, As a dependency index, The activity level of key features at time t. This represents the highest level of activity in history. The time-evolutionary privacy decay protocol specifically involves monitoring the current training progress and updating the privacy budget accordingly, mathematically described as follows: ,in, For the updated privacy budget, The attenuation coefficient is... This represents the current iteration number. The total number of iterations; the data dependency privacy protocol has a higher priority than the time evolution privacy decay protocol; The node contribution dynamic key protocol specifically involves: calculating the gradient contribution ratio of each client in real time, and dynamically updating the key strength based on the gradient contribution ratio. Mathematically, this can be described as follows: ,in, For the updated key strength, Based on the basic key strength, As a contribution index, Let t be the percentage of gradient contribution by the client. Contribute the total to all clients.