Federated learning secure aggregation method and device based on linear auditing and on-chain accountability

Abstract

The scheme provides a federated learning secure aggregation method and device based on linear audit and on-chain accountability, which comprises: a client trains a to-be-updated model to obtain a model update vector, and generates a masked ciphertext based on the model update vector; a linear audit label is obtained, and the linear audit label is split into a first linear share and a second linear share; an aggregation server aggregates the masked update vector and the first linear share, and an auxiliary server aggregates the masked ciphertext and the second linear share; and the client updates the to-be-updated model based on the aggregation results of the aggregation server and the auxiliary server. The scheme adopts a dual-server separation architecture to aggregate the masked update vector and the masked ciphertext respectively, and a single server cannot obtain the plaintext model update of the client, thereby eliminating the malicious stealing of single-client private data by the server from the architecture.

Description

Technical Field

[0001] This application relates to the field of federated learning technology, and in particular to a method and apparatus for secure aggregation of federated learning based on linear auditing and on-chain accountability. Background Technology

[0002] Federated learning, as a distributed machine learning technology, centers on local data retention and cloud-based model updates. It enables collaborative modeling in scenarios where data cannot be directly shared, such as across hospitals, financial institutions, and government departments, effectively reducing the privacy risks associated with centralized uploading of raw datasets. However, this technology is not inherently secure. Model gradients and parameter updates uploaded by clients can still be reverse-engineered by attackers to reconstruct training data and labels. Simply relying on model sharing cannot completely eliminate privacy risks. Therefore, it is urgent to introduce mechanisms such as secure aggregation, encrypted computation, and auditing accountability to ensure the security of the entire training process.

[0003] Secure aggregation is a core technology for privacy protection in federated learning. Its goal is to ensure that the server only receives the aggregated results of model updates from multiple parties, without knowing the plaintext updates from any single client. A typical solution is the Practical Secure Aggregation Protocol proposed by Bonawitz et al., which achieves privacy-preserving aggregation of high-dimensional data vectors through methods such as random masking, becoming a mainstream solution for privacy protection in federated learning. However, traditional secure aggregation solutions are generally based on a strong trust assumption of server honesty / semi-honesty. In weak-trust cross-institutional collaboration scenarios such as healthcare and finance, this assumption is difficult to uphold, resulting in significant limitations in the applicability of these solutions.

[0004] Current secure aggregation technologies fail to form a complete and trustworthy secure closed loop: First, they lack global model version consistency verification, allowing servers to maliciously distribute different models, leading to aggregation distortion; second, they only protect the privacy of a single client update, failing to verify whether the aggregation results have been tampered with or omitted; third, the participant set is unilaterally confirmed by the server, and clients cannot verify the correspondence between the aggregation results and the participants; fourth, blockchain is mostly used only for evidence storage, failing to support model verification, aggregation auditing, and anomaly accountability, and lacks immutable evidence and state rollback mechanisms after anomalies occur, making it difficult to meet the privacy, trustworthiness, traceability, and collaborative requirements of federated learning in a weak trust environment. Summary of the Invention

[0005] This application provides a federated learning security aggregation method and apparatus based on linear auditing and on-chain accountability. This solution adopts a dual-server separation architecture to aggregate the mask update vector and the mask ciphertext separately. A single server cannot obtain the client's plaintext model update, thus preventing the server from maliciously stealing the privacy data of a single client from the architecture.

[0006] In a first aspect, embodiments of this application provide a federated learning security aggregation method based on linear auditing and on-chain accountability, the method comprising:

[0007] The client trains the model to be updated to obtain the model update vector, masks the model update vector with a random mask to obtain the mask update vector, and encrypts the random mask with the auxiliary server's public key to obtain the mask ciphertext; the model update vector is processed using a challenge matrix to obtain the linear audit label, and the linear audit label is split into a first linear share and a second linear share; the mask update vector and the first linear share are sent to the aggregation server, and the mask ciphertext and the second linear share are sent to the auxiliary server; The aggregation server aggregates the mask update vector of each client to obtain the mask update aggregation result, aggregates the first linear share of each client to obtain the first share aggregation result, and broadcasts the mask update aggregation result and the first share aggregation result to each client. The auxiliary server decrypts the ciphertext mask of each client using its own private key to obtain the random mask of each client, aggregates the random masks of each client to obtain the random mask aggregation result, aggregates the second linear share of each client to obtain the second share aggregation result, and broadcasts the random mask aggregation result and the second share aggregation result to each client. The client restores the aggregation update vector based on the mask update aggregation result and the random mask aggregation result, and restores the aggregation audit label based on the first share aggregation result and the second share aggregation result. When the product of the aggregation update vector and the challenge matrix equals the aggregation audit label, the client updates the model to be updated using the aggregation model update.

[0008] Secondly, embodiments of this application provide a federated learning security aggregation device based on linear auditing and on-chain accountability, comprising: In the training module, the client trains the model to be updated to obtain the model update vector. The model update vector is then masked with a random mask to obtain a mask update vector. This random mask is then encrypted with the auxiliary server's public key to obtain the mask ciphertext. A challenge matrix is ​​used to process the model update vector to obtain a linear audit label, which is then split into a first linear share and a second linear share. The mask update vector and the first linear share are sent to the aggregation server, while the mask ciphertext and the second linear share are sent to the auxiliary server. The first aggregation module, the aggregation server aggregates the mask update vector of each client to obtain the mask update aggregation result, aggregates the first linear share of each client to obtain the first share aggregation result, and broadcasts the mask update aggregation result and the first share aggregation result to each client. The second aggregation module, which is an auxiliary server, decrypts the ciphertext of each client's mask with its own private key to obtain the random mask of each client, aggregates the random masks of each client to obtain the random mask aggregation result, aggregates the second linear share of each client to obtain the second share aggregation result, and broadcasts the random mask aggregation result and the second share aggregation result to each client. In the model update module, the client recovers the aggregation update vector based on the mask update aggregation result and the random mask aggregation result, and recovers the aggregation audit label based on the first share aggregation result and the second share aggregation result. When the product of the aggregation update vector and the challenge matrix equals the aggregation audit label, the model to be updated is updated using the aggregation model update.

[0009] Thirdly, embodiments of this application provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute a federated learning security aggregation method based on linear auditing and on-chain accountability.

[0010] Fourthly, embodiments of this application provide a readable storage medium storing a computer program, which, when executed by a processor, implements a federated learning security aggregation method based on linear auditing and on-chain accountability.

[0011] The main contributions and innovations of this invention are as follows: This application employs a dual-server architecture to aggregate the mask update vector and mask ciphertext separately. A single server cannot obtain the client's plaintext model update, thus preventing malicious theft of single-client privacy data by the server. This application uses a challenge matrix to generate linear audit tags, which are then split into a first linear share and a second linear share and sent to the aggregation server and auxiliary server respectively. This achieves lightweight and efficient verification of the aggregation result's correctness, with low linear computational complexity, adaptable to high-dimensional model updates. In this application, the client submits data using a private key signature. After the server verifies the signature, it determines the participant set. The client then verifies whether the participant sets of the two types of servers are consistent, preventing forged client-submitted data, ensuring the authenticity of participating entities, and preventing the server from unilaterally tampering with participants or omitting / miscalculating aggregation results. In this scheme, the client submits an on-chain evidence index, and the server submits aggregation / auxiliary commitments, all of which are stored on the chain, generating immutable training evidence. In the event of an anomaly, the responsible party can be quickly located, enabling on-chain accountability.

[0012] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0013] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart illustrating a federated learning security aggregation method based on linear auditing and on-chain accountability, according to an embodiment of this application. Figure 2 This is a structural block diagram of a federated learning security aggregation device based on linear auditing and on-chain accountability, according to an embodiment of this application. Figure 3 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0014] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0015] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0016] Example 1 This application provides a federated learning security aggregation method based on linear auditing and on-chain accountability. It employs a dual-server architecture to aggregate the mask update vector and mask ciphertext separately. A single server cannot obtain client plaintext model updates, thus architecturally preventing servers from maliciously stealing single-client privacy data. Specifically, refer to... Figure 1 The method includes: The client trains the model to be updated to obtain the model update vector, masks the model update vector with a random mask to obtain the mask update vector, and encrypts the random mask with the auxiliary server's public key to obtain the mask ciphertext; the model update vector is processed using a challenge matrix to obtain the linear audit label, and the linear audit label is split into a first linear share and a second linear share; the mask update vector and the first linear share are sent to the aggregation server, and the mask ciphertext and the second linear share are sent to the auxiliary server; The aggregation server aggregates the mask update vector of each client to obtain the mask update aggregation result, aggregates the first linear share of each client to obtain the first share aggregation result, and broadcasts the mask update aggregation result and the first share aggregation result to each client. The auxiliary server decrypts the ciphertext mask of each client using its own private key to obtain the random mask of each client, aggregates the random masks of each client to obtain the random mask aggregation result, aggregates the second linear share of each client to obtain the second share aggregation result, and broadcasts the random mask aggregation result and the second share aggregation result to each client. The client restores the aggregation update vector based on the mask update aggregation result and the random mask aggregation result, and restores the aggregation audit label based on the first share aggregation result and the second share aggregation result. When the product of the aggregation update vector and the challenge matrix is ​​equal to the aggregation audit label, the model to be updated is updated with the aggregation update vector.

[0017] In the current embodiment, a training state tuple is published on the blockchain. The training state tuple includes the hash value of the model to be updated and a random seed. The hash value of the model to be updated is used to verify the version of the model to be updated in each client in the current training round. The random seed is used to generate the challenge matrix for the current training round and send it to each client.

[0018] Specifically, the model version used in this round of training is identified by the hash value of the model to be updated on the blockchain; that is, the client downloads the model to be updated from the server. Then, based on the training state tuple Consistency verification of the model to be updated ,like This indicates that the model in the client is a model that needs to be updated. If this occurs, it indicates that the model version in the client is different. The client will immediately terminate the current training round and submit an anomaly report to the blockchain.

[0019] Specifically, a challenge matrix is ​​generated for each training round using random seeds on the blockchain, thereby preventing either the client or the server from arbitrarily selecting audit parameters that are advantageous to themselves.

[0020] Furthermore, the training state tuple also includes the current training round identifier, the set of clients participating in this training, and the preset deadline for clients to upload training results in this round. Therefore, the training state tuple can be represented as:

[0021] in, Let be the training state tuple for the t-th round of training. This is the identifier for the current training round, used to identify the current training round. For the model to be updated in round t, Model to be updated hash value, This is a summary of the set of clients participating in the t-th training iteration, used to identify all clients participating in the current training round. To represent the preset deadline for the client to upload training results in round t, is the random seed for round t, used to generate the challenge matrix for round t.

[0022] Furthermore, the formula for generating the challenge matrix is ​​expressed as:

[0023] in, Let be the challenge matrix for the t-th round of training. Indicates matrix generation, Let be the random seed for round t. In this scheme, , This indicates that the model updates the vector dimension. Indicates audit dimensions, Modulus A finite field.

[0024] In the current embodiment, the client uses local data to train the model to be updated and obtain the model update vector. ,in, , Indicates client The model update vector generated in the t-th training round. This indicates that the model updates the vector dimension. Modulus A finite field.

[0025] In the current embodiment, the client obtains a random mask through random sampling and uses the random mask to update the model update vector mask to obtain the mask update vector, as expressed by the formula:

[0026] in, For the client The mask update vector obtained in the t-th round of training Indicates client The model update vector generated in the t-th training round. For the client The random mask generated in the t-th round of training. For relative to The modulo operation.

[0027] In the current embodiment, a public-private key pair is constructed in the auxiliary server, and the random mask is encrypted using the auxiliary server's public key to obtain the mask ciphertext, as expressed by the formula:

[0028] in, For the client The mask ciphertext generated in the t-th round of training, Indicates an encryption operation. For auxiliary servers public key, For the client A random mask generated during the t-th round of training.

[0029] Specifically, this scheme sends the mask update vector to the aggregation server, so that the aggregation server can only obtain the masked model update vector; and sends the mask ciphertext to the auxiliary server, so that although the auxiliary server can recover the random mask, it cannot obtain the corresponding mask update vector, nor can it recover the plaintext update model of the client independently.

[0030] In the current embodiment, the formula for obtaining linear audit labels by processing the model update vector using the challenge matrix is ​​expressed as follows:

[0031] in, For the client Linear audit labels in the t-th round of training, Let be the challenge matrix for the t-th round of training. For the client The model update vector generated in the t-th training round.

[0032] Furthermore, the client obtains the audit vector through random sampling. The first linear share is the audit vector, and the second linear share is the difference between the linear audit label and the audit vector, expressed by the formula:

[0033] in, For the first linear share, For the client The audit vector is randomly sampled during the t-th round of training. This is the second linear share.

[0034] Specifically, the client in the model The audit vector is obtained by random sampling within a finite field, as expressed by the formula:

[0035] in, For the client The audit vector is randomly sampled during the t-th round of training. For model A finite field.

[0036] In the current embodiment, the client generates a client signature based on its private key, packages the mask update vector, the first linear share, and the client signature into an aggregation component, and sends it to the aggregation server. The aggregation server verifies the validity of the client signature in the aggregation component using the corresponding client public key. After successful verification, the aggregation server receives the corresponding mask update vector and the first linear share. The client then packages the mask ciphertext, the second linear share, and the client signature into an auxiliary component and sends it to the auxiliary server. The auxiliary server verifies the validity of the client signature in the auxiliary component using the corresponding client public key. After successful verification, the auxiliary server receives the corresponding mask ciphertext and the second linear share.

[0037] Specifically, each client generates an authentication key pair. ,in, This is the client's private key, used to generate the client's signature. This is the client's public key, used to authenticate the generated client signature.

[0038] Specifically, the client uses its own private key. Generate client signature Where t represents the current training round, Index the client, then sign the client. With mask update vector and the first linear share Packaged as an aggregate component Send to the aggregation server.

[0039] Similarly, client signature With masked ciphertext and the second linear share Packaged as an auxiliary component Send to the auxiliary server.

[0040] Furthermore, the aggregation server places the corresponding clients whose signatures have passed validity verification before the preset deadline into the aggregation participant set, and packages the corresponding mask update aggregation result, the first share aggregation result, and the aggregation participant set into an aggregation broadcast component, which is then broadcast to each client; the auxiliary server places the corresponding clients whose signatures have passed validity verification before the preset deadline into the auxiliary participant set, and packages the corresponding random mask aggregation result, the second share aggregation result, and the auxiliary participant set into an auxiliary broadcast component, which is then broadcast to each client.

[0041] Specifically, a preset deadline is defined in the training state tuple on the blockchain. This scheme only aggregates the model update vectors uploaded to the aggregation server and auxiliary server before the preset deadline.

[0042] In other words, in the step of the aggregation server aggregating the mask update vectors of each client to obtain the mask update aggregation result, the aggregation server aggregates the mask update vectors that were uploaded to the aggregation server before the preset deadline and whose signature validity verification passed. The formula is expressed as follows:

[0043] in, Update the aggregation result for the mask in round t. For the client in round t In the mask update vector, i is the client index. This is the set of clients whose signatures have passed the validity verification, i.e., the set of aggregated participants.

[0044] Similarly, in the step of aggregating the first linear share of each client to obtain the first share aggregation result, the aggregation server aggregates the first linear shares that were uploaded to the aggregation server before the preset deadline and whose signature validity verification passed, as expressed by the formula:

[0045] in, This represents the aggregation result of the first share in round t. For the client in round t The first linear share, where i is the client index. This is the set of clients whose signatures have passed the validity verification; in this case, it is the set of aggregate participants.

[0046] Then update the aggregation result with the corresponding mask. First share aggregation result and aggregated participant set Packaged as an aggregated broadcast component The broadcast is given to each client, where, Represents an aggregation server. This refers to the set of aggregation participants for the aggregation server.

[0047] Specifically, since the mask ciphertext is the result of encryption using the auxiliary server's public key, the auxiliary server decrypts the mask ciphertext uploaded to the aggregation server before the preset deadline and whose signature validity has been verified. Then, it aggregates the decrypted random masks. The formula for decrypting the mask ciphertext for each client is expressed as follows:

[0048] in, For the client in the t-th training round random mask, For the private key of the auxiliary server, For the client The mask ciphertext generated in the t-th round of training.

[0049] Then, the random masks of each client are aggregated, as shown in the formula:

[0050] in, This represents the result of random mask aggregation in training round t. For the client in the t-th training round The random mask, where i is the client index. This is the set of clients whose signatures have passed validity verification; in this case, it is the set of auxiliary participants.

[0051] Similarly, in the step of aggregating the second linear shares of each client to obtain the second share aggregation result, the aggregation server aggregates the second linear shares that were uploaded to the auxiliary server before the preset deadline and whose signature validity verification passed, as expressed by the formula:

[0052] in, This represents the aggregation result of the second share in training round t. For the client in round t The second linear share, where i is the client index. This is the set of clients whose signatures have passed validity verification; in this case, it is the set of auxiliary participants.

[0053] Then aggregate the corresponding random mask results Second share aggregation result and the set of auxiliary participants Packaged as an aggregated broadcast component The broadcast is given to each client, where, Represents auxiliary server, This is the set of auxiliary participants for the auxiliary server.

[0054] Specifically, this scheme recovers the mask update vectors of different clients in the aggregation server and recovers the random masks of different clients in the auxiliary server, thereby aggregating the update results of all clients for the model to be updated. Therefore, it is impossible to obtain data from different clients on a single server, client or blockchain, making federated learning more secure.

[0055] In the current embodiment, after the client generates a client signature and sends the aggregation component and auxiliary component to the corresponding aggregation server and auxiliary server, an on-chain evidence index is generated based on the client signature and submitted to the blockchain. The on-chain evidence index is represented as follows:

[0056] Among them, for the client The on-chain evidence index in the current training round t is used to prove the client. In the current training round t, the aggregation component and auxiliary component have been sent to the corresponding aggregation server and auxiliary server.

[0057] In the current embodiment, after the aggregation server broadcasts the aggregation broadcast component to each client, it generates an aggregation commitment based on the aggregation broadcast component and submits the aggregation commitment to the blockchain. The aggregation commitment is represented as follows:

[0058] in, Update the aggregation result for the mask in round t. This represents the aggregation result of the first share in round t. H represents the set of aggregation participants for the aggregation server, and H represents the hash operation.

[0059] In the current embodiment, after the auxiliary server broadcasts the auxiliary broadcast component to each client, it generates an auxiliary commitment based on the auxiliary broadcast component and submits the auxiliary commitment to the blockchain. The auxiliary commitment is represented as follows:

[0060] in, This represents the result of random mask aggregation in training round t. This represents the aggregation result of the second share in round t. H represents the set of auxiliary participants for the auxiliary server, where H represents hash operation.

[0061] Specifically, the aggregation commitment and the auxiliary commitment are used to indicate that the aggregation server and the auxiliary server will disclose the corresponding aggregation results and participant set information after a preset deadline. At the same time, by utilizing the one-way nature of hash operation, it is ensured that the information disclosed on the chain cannot be reversed to derive the original model update data. This achieves both traceable and public auditing of the training process and prevents the leakage of the client's original privacy data.

[0062] In the current embodiment, after receiving the aggregation broadcast component and the auxiliary broadcast component, the client verifies whether the set of aggregation participants in the aggregation broadcast component is consistent with the set of auxiliary participants in the auxiliary broadcast component. When the set of aggregation participants is consistent with the set of auxiliary participants, the client restores the aggregation update vector and aggregation audit tag based on the aggregation broadcast component and the auxiliary broadcast component.

[0063] Furthermore, when the set of aggregate participants is inconsistent with the set of auxiliary participants, the client refuses to receive both the aggregate broadcast component and the auxiliary broadcast component, and submits evidence of the discrepancy to the blockchain.

[0064] Specifically, when the set of aggregation participants matches the set of auxiliary participants, it indicates that all clients participating in the aggregation process have completed compliance verification and information upload on both the aggregation server and the auxiliary server sides, and there is no situation of unilateral omission or tampering with participant information. At this time, the client can continue to calculate the global update based on the publicly available aggregation results. Consistency verification can be represented as:

[0065] in, For the set of aggregation participants of the aggregation server, For the set of auxiliary participants of the auxiliary server, This indicates whether both sides of the equation are the same; if they are the same... =, if different It is not equal to ≠.

[0066] When the set of aggregation participants matches the set of auxiliary participants, the client restores the aggregation update vector based on the masked aggregation result and the random masked aggregation result, as expressed by the formula:

[0067]

[0068] in, This is the aggregated update vector for the t-th training round. Update the aggregation result for the mask in round t. This represents the result of random mask aggregation in training round t. Indicates to Modulo operation This is the set of clients whose signatures have passed validity verification. For the client The model update vector generated in the t-th training round. For the client A random mask generated during the t-th round of training.

[0069] Subsequently, the formula for the client to restore the aggregation audit label based on the aggregation results of the first share and the aggregation results of the second share is expressed as follows:

[0070] in, To aggregate audit tags, This is the aggregation result for the first share. The result of the second share calculation, because , , ,therefore Therefore, when the product of the aggregate update vector and the challenge matrix equals the aggregate audit label... If the result is consistent, it means that the aggregated update vector returned by the server is consistent with the linear audit tags submitted by each client, and the client receives the aggregated update vector.

[0071] In this embodiment, the client updates the model to be updated based on a preset learning rate, as expressed by the formula:

[0072] in, The updated model to be updated. This is an outdated model awaiting update. To preset the learning rate, This is the aggregated update vector for the t-th training round.

[0073] After the model is updated, the client submits a summary of the results received in this round to the blockchain: This is used to prove that the current aggregation result and the updated model state have been accepted by the client. If the equation does not hold, the client rejects the current aggregation result and enters the on-chain challenge process.

[0074] In the current embodiment, a RoundManager contract, an Evidence contract, and a ChallengeManager contract are deployed on the blockchain. The RoundManager contract is used to publish and update the training state for each round of federated learning, the Evidence contract is used to anchor the client-uploaded summary, server commitment, and challenge evidence, and the ChallengeManager contract is used to handle abnormal challenges, verify evidence, and trigger dispute resolution or state rollback.

[0075] Specifically, if a client discovers an anomaly at any stage of model distribution, valid participant set, or linear audit, it submits signed evidence to the on-chain ChallengeManager contract. This evidence may include the client's signature information, upload digest, server broadcast result, participant set root, and aggregation result hash. The ChallengeManager contract calls the Evidence contract to query the corresponding evidence digest and verifies whether the signature and hash commitment submitted by the client are consistent with the on-chain record. If the verification result indicates that there is indeed a model inconsistency, participant set inconsistency, or audit failure, the contract marks the current round as a failure state and triggers a state rollback if necessary, restoring the global model to the trusted state of the previous round.

[0076] Example 2 Based on the same concept, referencing Figure 2 This application also proposes a federated learning security aggregation device based on linear auditing and on-chain accountability, comprising: In the training module, the client trains the model to be updated to obtain the model update vector. The model update vector is then masked with a random mask to obtain a mask update vector. This random mask is then encrypted with the auxiliary server's public key to obtain the mask ciphertext. A challenge matrix is ​​used to process the model update vector to obtain a linear audit label, which is then split into a first linear share and a second linear share. The mask update vector and the first linear share are sent to the aggregation server, while the mask ciphertext and the second linear share are sent to the auxiliary server. The first aggregation module, the aggregation server aggregates the mask update vector of each client to obtain the mask update aggregation result, aggregates the first linear share of each client to obtain the first share aggregation result, and broadcasts the mask update aggregation result and the first share aggregation result to each client. The second aggregation module, which is an auxiliary server, decrypts the ciphertext of each client's mask with its own private key to obtain the random mask of each client, aggregates the random masks of each client to obtain the random mask aggregation result, aggregates the second linear share of each client to obtain the second share aggregation result, and broadcasts the random mask aggregation result and the second share aggregation result to each client. In the model update module, the client recovers the aggregation update vector based on the mask update aggregation result and the random mask aggregation result, and recovers the aggregation audit label based on the first share aggregation result and the second share aggregation result. When the product of the aggregation update vector and the challenge matrix equals the aggregation audit label, the model to be updated is updated using the aggregation model update.

[0077] Example 3 This embodiment also provides an electronic device, see reference. Figure 3It includes a memory 404 and a processor 402, wherein the memory 404 stores a computer program and the processor 402 is configured to run the computer program to perform the steps in any of the above method embodiments.

[0078] Specifically, the processor 402 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0079] Memory 404 may include a mass storage device for data or instructions. For example, and not limitingly, memory 404 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk drive, a magneto-optical disk drive, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 404 may include removable or non-removable (or fixed) media. Where appropriate, memory 404 may be internal or external to a data processing device. In a particular embodiment, memory 404 is non-volatile memory. In a particular embodiment, memory 404 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable read-only memory (PROM), an erasable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), an electrically alterable read-only memory (EAROM), or flash memory, or a combination of two or more of these. Where appropriate, the RAM can be Static Random-Access Memory (SRAM) or Dynamic Random-Access Memory (DRAM). DRAM can be Fast Page Mode Dynamic Random-Access Memory (FPMDRAM), Extended Data Out Dynamic Random-Access Memory (EDODRAM), Synchronous Dynamic Random-Access Memory (SDRAM), etc.

[0080] The memory 404 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 402.

[0081] The processor 402 reads and executes computer program instructions stored in the memory 404 to implement any of the federated learning security aggregation methods based on linear auditing and on-chain accountability in the above embodiments.

[0082] Optionally, the electronic device may further include a transmission device 406 and an input / output device 408, wherein the transmission device 406 is connected to the processor 402, and the input / output device 408 is connected to the processor 402.

[0083] The transmission device 406 can be used to receive or send data via a network. Specific examples of the network described above may include wired or wireless networks provided by the communication provider of the electronic device. In one example, the transmission device includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 406 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0084] Input / output device 408 is used to input or output information. In this embodiment, the input information may be a model update vector, linear audit labels, etc., and the output information may be a recovered aggregate update vector, etc.

[0085] Optionally, in this embodiment, the processor 402 can be configured to perform the following steps via a computer program: The client trains the model to be updated to obtain the model update vector, masks the model update vector with a random mask to obtain the mask update vector, and encrypts the random mask with the auxiliary server's public key to obtain the mask ciphertext; the model update vector is processed using a challenge matrix to obtain the linear audit label, and the linear audit label is split into a first linear share and a second linear share; the mask update vector and the first linear share are sent to the aggregation server, and the mask ciphertext and the second linear share are sent to the auxiliary server; The aggregation server aggregates the mask update vector of each client to obtain the mask update aggregation result, aggregates the first linear share of each client to obtain the first share aggregation result, and broadcasts the mask update aggregation result and the first share aggregation result to each client. The auxiliary server decrypts the ciphertext mask of each client using its own private key to obtain the random mask of each client, aggregates the random masks of each client to obtain the random mask aggregation result, aggregates the second linear share of each client to obtain the second share aggregation result, and broadcasts the random mask aggregation result and the second share aggregation result to each client. The client restores the aggregation update vector based on the mask update aggregation result and the random mask aggregation result, and restores the aggregation audit label based on the first share aggregation result and the second share aggregation result. When the product of the aggregation update vector and the challenge matrix equals the aggregation audit label, the client updates the model to be updated using the aggregation model update.

[0086] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0087] Generally, various embodiments can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects of the invention can be implemented in hardware, while others can be implemented by firmware or software executed by a controller, microprocessor, or other computing device, but the invention is not limited thereto. Although various aspects of the invention may be shown and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that, by way of non-limiting example, these blocks, apparatuses, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0088] Embodiments of the present invention can be implemented by computer software, which may be executable by a data processor of a mobile device, such as a processor entity, or by hardware, or by a combination of software and hardware. Computer software or programs (also referred to as program products) including software routines, applets, and / or macros can be stored in any device-readable data storage medium, and they include program instructions for performing specific tasks. The computer program product may include one or more computer-executable components configured to perform the embodiments when the program is run. The one or more computer-executable components may be at least one piece of software code or a portion thereof. Additionally, it should be noted in this respect that, as Figure 3 Any box in the logical flow can represent a program step, or interconnected logic circuits, boxes and functions, or a combination of program steps and logic circuits, boxes and functions. Software can be stored on physical media such as memory chips or blocks of storage implemented within a processor, magnetic media such as hard disks or floppy disks, and optical media such as DVDs and their data variants, CDs, etc. The physical medium is a non-transient medium.

[0089] Those skilled in the art should understand that the technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0090] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A federated learning security aggregation method based on linear auditing and on-chain accountability, characterized in that, Includes the following steps: The client trains the model to be updated to obtain the model update vector, masks the model update vector with a random mask to obtain the mask update vector, and encrypts the random mask with the auxiliary server's public key to obtain the mask ciphertext; the model update vector is processed using a challenge matrix to obtain the linear audit label, and the linear audit label is split into a first linear share and a second linear share; Send the mask update vector and the first linear share to the aggregation server, and send the mask ciphertext and the second linear share to the auxiliary server. The aggregation server aggregates the mask update vector of each client to obtain the mask update aggregation result, aggregates the first linear share of each client to obtain the first share aggregation result, and broadcasts the mask update aggregation result and the first share aggregation result to each client. The auxiliary server decrypts the ciphertext mask of each client using its own private key to obtain the random mask of each client, aggregates the random masks of each client to obtain the random mask aggregation result, aggregates the second linear share of each client to obtain the second share aggregation result, and broadcasts the random mask aggregation result and the second share aggregation result to each client. The client restores the aggregation update vector based on the mask update aggregation result and the random mask aggregation result, and restores the aggregation audit label based on the first share aggregation result and the second share aggregation result. When the product of the aggregation update vector and the challenge matrix equals the aggregation audit label, the client updates the model to be updated using the aggregation model update.

2. The federated learning security aggregation method based on linear auditing and on-chain accountability as described in claim 1, characterized in that, A training state tuple is published on the blockchain. The training state tuple includes the hash value of the model to be updated and a random seed. The hash value of the model to be updated is used to verify the version of the model to be updated in each client in the current training round. The random seed is used to generate the challenge matrix for the current training round and send it to each client.

3. The federated learning security aggregation method based on linear auditing and on-chain accountability as described in claim 1, characterized in that, The client obtains the audit vector through random sampling. The first linear share is the audit vector, and the second linear share is the difference between the linear audit label and the audit vector.

4. The federated learning security aggregation method based on linear auditing and on-chain accountability as described in claim 1, characterized in that, The client generates a client signature based on its private key, packages the mask update vector, the first linear share, and the client signature into an aggregation component, and sends it to the aggregation server. The aggregation server verifies the validity of the client signature in the aggregation component using the corresponding client public key. After successful verification, the aggregation server receives the corresponding mask update vector and the first linear share. The client then packages the mask ciphertext, the second linear share, and the client signature into an auxiliary component and sends it to the auxiliary server. The auxiliary server verifies the validity of the client signature in the auxiliary component using the corresponding client public key. After successful verification, the auxiliary server receives the corresponding mask ciphertext and the second linear share.

5. The federated learning security aggregation method based on linear auditing and on-chain accountability as described in claim 4, characterized in that, The aggregation server places the corresponding clients whose signatures have passed the validity verification before the preset deadline into the aggregation participant set, and packages the corresponding mask update aggregation result, the first share aggregation result, and the aggregation participant set into an aggregation broadcast component, which is then broadcast to each client. The auxiliary server places the corresponding clients whose signatures have passed the validity verification before the preset deadline into the auxiliary participant set, and packages the corresponding random mask aggregation result, second share aggregation result, and auxiliary participant set into an auxiliary broadcast component, which is then broadcast to each client.

6. The federated learning security aggregation method based on linear auditing and on-chain accountability as described in claim 5, characterized in that, After receiving the aggregation broadcast component and the auxiliary broadcast component, the client verifies whether the set of aggregation participants in the aggregation broadcast component is consistent with the set of auxiliary participants in the auxiliary broadcast component. When the set of aggregation participants is consistent with the set of auxiliary participants, the client restores the aggregation update vector and aggregation audit tag based on the aggregation broadcast component and the auxiliary broadcast component.

7. The federated learning security aggregation method based on linear auditing and on-chain accountability as described in claim 1, characterized in that, After the client generates a client signature and sends the aggregation component and auxiliary component to the corresponding aggregation server and auxiliary server, an on-chain evidence index is generated based on the client signature and submitted to the blockchain. The on-chain evidence index is used to prove that the client has sent the aggregation component and auxiliary component to the corresponding aggregation server and auxiliary server in the current training round.

8. A federated learning security aggregation device based on linear auditing and on-chain accountability, characterized in that, include: In the training module, the client trains the model to be updated to obtain the model update vector. The model update vector is then masked with a random mask to obtain a mask update vector. This random mask is then encrypted with the auxiliary server's public key to obtain the mask ciphertext. A challenge matrix is ​​used to process the model update vector to obtain a linear audit label, which is then split into a first linear share and a second linear share. The mask update vector and the first linear share are sent to the aggregation server, while the mask ciphertext and the second linear share are sent to the auxiliary server. The first aggregation module, the aggregation server aggregates the mask update vector of each client to obtain the mask update aggregation result, aggregates the first linear share of each client to obtain the first share aggregation result, and broadcasts the mask update aggregation result and the first share aggregation result to each client. The second aggregation module, which is an auxiliary server, decrypts the ciphertext of each client's mask with its own private key to obtain the random mask of each client, aggregates the random masks of each client to obtain the random mask aggregation result, aggregates the second linear share of each client to obtain the second share aggregation result, and broadcasts the random mask aggregation result and the second share aggregation result to each client. In the model update module, the client recovers the aggregation update vector based on the mask update aggregation result and the random mask aggregation result, and recovers the aggregation audit label based on the first share aggregation result and the second share aggregation result. When the product of the aggregation update vector and the challenge matrix equals the aggregation audit label, the model to be updated is updated using the aggregation model update.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to execute a federated learning security aggregation method based on linear auditing and on-chain accountability as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, The readable storage medium stores a computer program that, when executed by a processor, implements a federated learning security aggregation method based on linear auditing and on-chain accountability as described in any one of claims 1-7.

Images