Medical federated learning malicious node defense method and system based on reputation incentive and multi-dimensional audit

Abstract

This invention relates to a method and system for defending against malicious nodes in medical federated learning based on reputation incentives and multi-dimensional auditing. The method includes: constructing an architecture comprising computing nodes, verification nodes, supervisory nodes, and a consortium blockchain; computing nodes adjusting differential privacy budgets, generating ciphertext, parameter hashes, and proof of computing power authenticity, and sending them to verification nodes; verification nodes generating multi-dimensional audit summaries and storing them on the blockchain; a smart contract determining the malicious level of a node, updating its reputation score, and executing corresponding rewards and penalties; verification nodes calculating aggregate weights using a Softmax function with a temperature coefficient to update the global model and calculating a new baseline hash and storing it on the blockchain; and the smart contract calculating incentive rewards based on the node's quality score and reputation score, automatically returning funds confiscated from malicious nodes to the incentive fund pool, completing the circulation and closed-loop incentive of the fund pool. This can improve the accuracy of identifying malicious poisoning attacks and achieve a closed-loop synergy of privacy protection, secure aggregation, and long-term incentives.

Description

Technical Field

[0001] This invention relates to the field of federated learning security and privacy computing technology, and in particular to a method and system for defending against malicious nodes in medical federated learning based on reputation incentives and multi-dimensional auditing. Background Technology

[0002] With the rapid development of medical artificial intelligence technology, collaborative training of high-precision diagnostic models by multiple medical institutions has become an industry trend. However, the training of high-quality medical models typically relies on large-scale, multi-center data support, while medical data is highly sensitive and subject to privacy compliance requirements. Traditional centralized data sharing models are difficult to implement in actual medical collaborations. Federated learning, as a distributed learning paradigm where "data does not leave the institution," allows multiple medical institutions to collaboratively train a global model without exchanging raw data, effectively resolving the conflict between data sharing and privacy protection. However, existing medical federated learning systems still face core problems in actual deployment, such as single point of failure and insufficient trustworthiness of the central server, difficulty in auditing malicious node behavior, and lack of collaborative incentive mechanisms. Specifically, the traditional architecture relies on a single central node for parameter aggregation, which poses a risk of single point of failure, and if the central node is compromised, it will lead to global model pollution; medical institutions have varying levels of expertise, and some nodes may upload inferior parameters due to equipment failure or launch malicious poisoning attacks (such as falsifying training or tampering with gradients). Since the data does not leave the domain, the central node cannot effectively trace and audit the local training process; and the lack of objective and fair contribution evaluation standards leads to the marginalization of small medical institutions with weak computing power and little data, while large tertiary hospitals with high-quality data lack the motivation to participate, forming a "data silo" dilemma.

[0003] To address these issues, existing technologies have begun to incorporate blockchain into federated learning collaboration frameworks, utilizing distributed ledgers to construct decentralized and tamper-proof trusted collaboration architectures. However, existing blockchain + federated learning solutions still suffer from the following drawbacks: The contradiction between on-chain computation bottlenecks and privacy protection: Most solutions forcibly place complex operations such as encrypted computation and audit verification on-chain smart contracts, resulting in significant storage and computing power overhead, making them unsuitable for implementation in medical institutions with limited computing power. Weakening encryption can easily violate medical data compliance requirements; Single-dimensional defense against malicious nodes with a high false positive rate: Relying solely on single dimensions such as Euclidean distance for anomaly detection makes it difficult to distinguish between normal parameter shifts and malicious parameter contamination caused by Non-IID data (such as long-tail rare disease data) in medical scenarios, lacking multi-dimensional cross-validation mechanisms; Lack of reputation penalty and incentive circulation mechanisms: The lack of quantitative evaluation and dynamic reward / penalty mapping mechanisms based on model contribution results in low costs for malicious nodes, unclear benefits for compliant nodes, and a lack of long-term circulation design for incentive funds.

[0004] Therefore, in traditional medical collaboration scenarios, due to the lack of single-point trust in the central architecture, the single dimension of malicious node defense, the lack of auditability in the training process, and the absence of a reputation-driven long-term incentive and fund transfer mechanism, there are often problems such as the difficulty in accurately identifying malicious node poisoning attacks and the high rate of false positives in anomaly detection. Summary of the Invention

[0005] Based on this, in order to solve the above-mentioned technical problems, a medical federated learning malicious node defense method and system based on reputation incentives and multi-dimensional auditing is provided. This method can improve the accuracy of malicious poisoning attack identification and defense capabilities, and achieve closed-loop synergy of privacy protection, security aggregation and long-term incentives.

[0006] A method for defending against malicious nodes in a healthcare federated learning system based on reputation incentives and multi-dimensional auditing, the method comprising:

[0007] The regulatory node performs initialization operations to generate a system architecture that includes computing nodes, verification nodes, regulatory nodes, and a consortium blockchain, and completes key generation, node pseudonym allocation, initial reputation score setting, and incentive fund pool initialization.

[0008] The computing node obtains the global model parameters from the previous round, trains it using the local medical dataset, dynamically adjusts the differential privacy budget based on its own on-chain reputation score from the previous round, injects Laplacian noise into the sensitive layer parameters, and encapsulates the parameters using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hashes. The computing node uses a zero-knowledge proof key to generate a proof of computing power authenticity, sends the proof of authenticity and ciphertext to the verification node, and uploads the parameter hashes to the consortium blockchain.

[0009] The verification node performs threshold decryption on the received data, performs gradient direction auditing, update step size auditing, zero-knowledge proof verification, and medical logic compliance testing on the decrypted parameters, generates a multi-dimensional audit digest, and stores the digest on the blockchain through PBFT consensus.

[0010] After the multi-dimensional audit summary is uploaded to the blockchain, the smart contract determines the node's maliciousness level based on the audit results according to the preset tiered penalty rules, updates the node's reputation score, and executes the corresponding rewards and punishments.

[0011] The verification node calculates the aggregation weight using a Softmax function with a temperature coefficient based on the updated reputation score on the chain, performs a weighted average of the parameters of qualified nodes to update the global model, and calculates a new baseline hash on the chain.

[0012] The smart contract calculates incentive rewards based on the node's quality score and reputation score, and automatically returns the funds confiscated from malicious nodes to the incentive fund pool, thus completing the circulation of the fund pool and the closed-loop incentive.

[0013] In one embodiment, the supervisory node performs initialization operations, generating a system architecture including compute nodes, verification nodes, supervisory nodes, and a consortium blockchain, and completing key generation, node pseudonym allocation, initial reputation score setting, and incentive fund pool initialization, including:

[0014] Based on qualifications and computing power, regulatory nodes are divided into computing nodes, verification nodes, and regulatory nodes, and a consortium blockchain is deployed to build an on-chain and off-chain collaborative system architecture.

[0015] The monitoring node uses the Secp256k1 elliptic curve cryptography algorithm to generate local private and public keys for each computing node, and generates a global joint public and private key fragment based on Shamir threshold secret sharing. It performs a one-time trusted setting for the preset model training algorithm logic to generate a proof key and a verification key.

[0016] The smart contract creates an on-chain state vector for each computing node, which includes a node role identifier, an on-chain pseudonym, an initial reputation score, and a public key; the supervisory node injects initial tokens into the smart contract, establishes an incentive fund pool, and initializes it.

[0017] In one embodiment, the computing node obtains the global model parameters from the previous round, trains it using a local medical dataset, dynamically adjusts the differential privacy budget based on its own on-chain reputation score from the previous round, and injects Laplacian noise into the sensitive layer parameters, including:

[0018] The computing node obtains the global model parameters from the previous round, performs gradient descent training using the local medical dataset, and obtains the original local update parameters;

[0019] The original local update parameters are split into insensitive parameters and highly sensitive parameters according to the network layer depth;

[0020] The computing node reads its previous round reputation score from the chain and dynamically calculates the differential privacy budget. It then generates Laplace noise for the ultrasensitive parameter and injects it into the original local update parameter to obtain the noise-added parameter.

[0021] The noise-adding parameters are reassembled with the non-sensitive parameters to obtain the final parameters to be uploaded.

[0022] In one embodiment, the parameters are encapsulated using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hash; the computing node generates a proof of computing power authenticity using a zero-knowledge proof key, sends the proof of authenticity and ciphertext to the verification node, and uploads the parameter hash to the consortium blockchain, including:

[0023] The computing node uses the ECIES asymmetric encryption algorithm to generate a symmetric encryption key using the joint public key of the verification node and a temporary random number. It then uses the AES-GCM algorithm to encrypt the parameters to be uploaded into ciphertext and calculates the parameter hash corresponding to the ciphertext.

[0024] The computing node uses a zero-knowledge proof key to generate a proof of the authenticity of computing power based on a preset arithmetic circuit.

[0025] The computing node sends the authenticity certificate and ciphertext to the verification node, and uploads the parameter hash to the consortium blockchain for evidence storage.

[0026] In one embodiment, the verification node performs threshold decryption on the received data, conducts gradient direction auditing, update step size auditing, zero-knowledge proof verification, and medical logic compliance testing on the decrypted parameters, generates a multi-dimensional audit digest, and stores the digest on the blockchain for evidence storage via PBFT consensus, including:

[0027] The verification node uses its own private key to partially decrypt the received ciphertext, and completes threshold decryption based on the Shamir threshold secret sharing mechanism to obtain the local plaintext parameters;

[0028] The verification node calculates the local update vector and the previous round global update vector based on the plaintext parameters, calculates the cosine similarity between the local update vector and the previous round global update vector, and compares the parameter update step size with the dynamic threshold generated based on historical statistical features.

[0029] The verification node uses the verification key to verify the matching between the authenticity proof and the parameter hash, and loads the plaintext parameters into the benchmark test set for inference, calculates the diagnostic accuracy, and performs medical logic compliance testing.

[0030] The audit results of gradient direction audit, update step size audit, zero-knowledge proof verification, and medical logic compliance testing are summarized to generate a multi-dimensional audit summary.

[0031] The verification node performs PBFT consensus on the multidimensional audit digest and completes BLS aggregate signature, then uploads the signed multidimensional audit digest to the blockchain for evidence storage.

[0032] In one embodiment, after the multi-dimensional audit summary is uploaded to the blockchain, the smart contract determines the node's maliciousness level based on the audit results according to a preset tiered penalty rule, updates the node's reputation score, and executes corresponding rewards and penalties, including:

[0033] The smart contract listens to and obtains the multi-dimensional audit summary uploaded to the chain, and obtains the audit results of zero-knowledge proof verification, update step size, gradient direction similarity and medical logic compliance based on the multi-dimensional audit summary;

[0034] Based on the audit results, each node is classified into three levels of malice: severe malice, moderate malice, and mild abnormality, according to a preset tiered penalty rule.

[0035] The smart contract updates the node's reputation score based on the level of malice and simultaneously executes corresponding rewards and penalties such as freezing permissions, confiscating deposits, or retaining eligibility.

[0036] In one embodiment, the verification node calculates the aggregate weight using a Softmax function with a temperature coefficient based on the updated reputation score on-chain, performs a weighted average of the parameters of qualified nodes to update the global model, and calculates a new baseline hash on-chain, including:

[0037] The verification node selects qualified nodes based on the updated reputation score on the consortium blockchain, and uses the Softmax function with a temperature coefficient to calculate the aggregate weight of each qualified node.

[0038] The verification node uses the aggregation weight to calculate a weighted average of the local parameters of the qualified node to obtain a new round of global model parameters;

[0039] The verification node performs a hash operation on the new round of global model parameters to generate a new baseline hash and stores it on the blockchain.

[0040] In one embodiment, the smart contract calculates incentive rewards based on the node's quality score and reputation score, and automatically returns the funds confiscated from malicious nodes to the incentive fund pool, completing the circulation and closed-loop incentive of the fund pool, including:

[0041] The smart contract extracts the cosine similarity and squared Euclidean distance of each computing node from the multidimensional audit summary, calculates the quality score and updated reputation score of the node, and calculates the comprehensive contribution score of each node through a weighted product model.

[0042] The smart contract calculates the incentive benefits for each node based on the comprehensive contribution score, deducts the fines and confiscations of malicious nodes and transfers them into the incentive fund pool, thereby realizing a closed-loop flow of funds between malicious punishment and compliant incentives.

[0043] A medical federated learning malicious node defense system based on reputation incentives and multi-dimensional auditing, the system comprising:

[0044] The regulatory node is used to perform initialization operations, generate a system architecture that includes computing nodes, verification nodes, regulatory nodes and consortium blockchain, and complete key generation, node pseudonym allocation, initial reputation score setting and incentive fund pool initialization.

[0045] The compute node is used to obtain the global model parameters from the previous round, train it using the local medical dataset, dynamically adjust the differential privacy budget based on its own on-chain reputation score from the previous round, inject Laplacian noise into the sensitive layer parameters, and encapsulate the parameters using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hashes. The compute node is also used to generate a computing power authenticity certificate using a zero-knowledge proof key, send the authenticity certificate and ciphertext to the verification node, and upload the parameter hashes to the consortium blockchain.

[0046] The verification node is used to perform threshold decryption on the received data, and sequentially perform gradient direction audit, update step size audit, zero-knowledge proof verification and medical logic compliance test on the decrypted parameters to generate a multi-dimensional audit digest. The digest is then stored on the blockchain through PBFT consensus.

[0047] The consortium blockchain is equipped with smart contracts. These smart contracts are used to determine the malicious level of a node based on the audit results and a preset tiered penalty rule after the multi-dimensional audit summary is uploaded to the blockchain. The smart contracts then update the node's reputation score and execute corresponding rewards and penalties.

[0048] The verification node is also used to calculate the aggregation weight using the Softmax function with a temperature coefficient based on the updated reputation score on the chain, to perform a weighted average of the parameters of qualified nodes to update the global model, and to calculate a new benchmark hash on the chain.

[0049] The smart contract is also used to calculate incentive revenue based on the node's quality score and reputation score, and automatically return the funds confiscated from malicious nodes to the incentive fund pool, thus completing the circulation and closed-loop incentive of the fund pool.

[0050] The aforementioned medical federated learning malicious node defense method and system based on reputation incentives and multi-dimensional auditing constructs a layered architecture of supervisory nodes, computing nodes, verification nodes, and consortium blockchain collaboration. It combines dynamic reputation control, differential privacy protection, encrypted transmission, and zero-knowledge proof verification with multi-dimensional cross-auditing, tiered malicious punishment, reputation-weighted model aggregation, and a closed-loop mechanism of reputation incentives and penalty feedback. This effectively identifies and intercepts various malicious node poisoning attacks while ensuring the privacy of local medical data remains within the domain, reducing the risk of model parameter tampering and training anomalies. Simultaneously, relying on on-chain immutable evidence storage and distributed consensus to enhance the traceability and credibility of the training process, it improves the accuracy of malicious poisoning attack identification and defense capabilities, achieving a closed-loop synergy of privacy protection, secure aggregation, and long-term incentives. Attached Figure Description

[0051] Figure 1This is an application environment diagram of a medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing, and a structural block diagram of a medical federated learning malicious node defense system based on reputation incentives and multi-dimensional auditing, as shown in one embodiment.

[0052] Figure 2 This is a flowchart illustrating a medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing in one embodiment. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] The medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown. For example... Figure 1 As shown, this application environment includes compute nodes ( 100. Verification Node ( 200, Regulatory Nodes 300, Consortium Blockchain 400. Among them, computing nodes ( )100 is composed of participating medical institutions, responsible for performing model training locally, adding differential privacy noise to sensitive parameters, encapsulating parameters using an asymmetric encryption system, and submitting parameter hashes and zero-knowledge training proofs to the consortium blockchain; verification nodes ( 200 high-computing-power audit nodes deployed on the consortium blockchain network are operated by absolutely authoritative institutions such as the National Health Commission or top-tier public data centers. These nodes are considered fully trusted entities with both physical and logical security, responsible for decrypting parameters and performing multi-dimensional audits in an off-chain secure environment. To prevent single points of failure or localized network hijacking, multiple verification nodes must cross-verify the audit results and confirm them with PBFT consensus; regulatory nodes ( The 300 is comprised of authoritative institutions such as the National Health Commission. It is responsible for issuing access certificates, injecting initial incentive funds, releasing public small-scale benchmark datasets, and, in the event of a severe security incident, using the master control private key to trace the real identity of malicious nodes using aliases; consortium blockchains ( )400 provides the underlying ledger, runs PBFT consensus and smart contracts, and is responsible for lightweight notarization, reputation-based state machine maintenance and automated token clearing and settlement.

[0055] In one embodiment, such as Figure 2 As shown, a method for defending against malicious nodes in medical federated learning based on reputation incentives and multi-dimensional auditing is provided, including the following steps:

[0056] Step 202: The regulatory node performs initialization operations to generate a system architecture that includes computing nodes, verification nodes, regulatory nodes and consortium blockchain, and completes key generation, node pseudonym allocation, initial reputation score setting and incentive fund pool initialization.

[0057] As the sole executor, the regulatory node can perform initialization operations, mainly including system architecture setup, role assignment, cryptographic key generation, node identity pseudonym allocation, initial reputation score configuration, and incentive fund pool creation.

[0058] In one embodiment, a method for defending against malicious nodes in a medical federated learning system based on reputation incentives and multi-dimensional auditing may include an initialization process. Specifically, the process includes: a supervisory node classifying nodes into compute nodes, verification nodes, and supervisory nodes based on qualifications and computing power; deploying a consortium blockchain and constructing an on-chain / off-chain collaborative system architecture; the supervisory node using the Secp256k1 elliptic curve cryptography algorithm to generate local private and public keys for each compute node, and generating a global federated public and private key shard based on Shamir threshold secret sharing; performing a one-time trust setting on the preset model training algorithm logic to generate a proof key and a verification key; a smart contract creating an on-chain state vector for each compute node containing a node role identifier, on-chain pseudonym, initial reputation score, and public key; and the supervisory node injecting initial tokens into the smart contract, establishing and initializing an incentive fund pool.

[0059] The regulatory node is an authoritative institution with administrative-level trust endorsement, responsible for the top-level initialization and global parameter preset of the entire federated learning system. The regulatory node first deploys a system-defined smart contract on the consortium blockchain. Based on the computing power, data volume, and historical trustworthiness of each participating medical institution, it assigns roles, designating authoritative institutions with administrative trust endorsement and high computing power as verification nodes, with a number meeting Byzantine fault tolerance requirements, to undertake off-chain trust auditing. Ordinary medical institutions participating in training are designated as computing nodes for local model training and parameter uploading. The regulatory node itself retains regulatory, access, credit, funding injection, and extreme event tracing permissions. It then deploys the underlying consortium blockchain system, enabling the PBFT consensus mechanism and smart contracts for lightweight evidence storage, reputation status management, and automated token settlement, forming a complete system architecture where computing nodes, verification nodes, regulatory nodes, and the consortium blockchain operate collaboratively.

[0060] Specifically, in this embodiment, the system sets the total number of network nodes to be [number missing]. The regulatory nodes are categorized based on the computing power and qualifications of each institution: nodes with top-tier computing power and administrative-level trust endorsement are grouped into a set of verification nodes. ,serial number Total number of systems satisfied in To determine the maximum number of fault verification nodes that the system can tolerate, thus satisfying the safety lower bound of Byzantine fault tolerance; the medical institutions participating in the joint training are divided into sets of computing nodes. ,serial number In this embodiment, computing nodes are referred to as nodes. .

[0061] To ensure communication security and privacy protection, the custodian node can perform cryptographic initialization. Specifically, it generates a unique local private key and public key for each compute node using the Secp256k1 elliptic curve algorithm, used for on-chain signatures and authentication. The verifier node group, based on the Shamir threshold secret sharing protocol, collaboratively generates a global federated private key and splits it into multiple private key fragments, each stored separately by the verifier node. Simultaneously, it generates a public federated public key for ECIES encryption and threshold decryption. A one-time trusted setup using zk-SNARKs is performed to generate a global proof key and a verification key. The proof key is distributed to each compute node, while the verification key is publicly stored on both the verifier nodes and the blockchain.

[0062] Specifically, certificate issuing authorities ( )use Elliptic curve cryptography, for each computing node Generate local private key With public key The pseudonym for interaction on the compute node chain is defined as follows: in, To ensure the authenticity and uniformity of social credit codes for institutions, The result is a random number. Next, the verification node group is checked. The distributed key generation protocol, based on Shamir threshold secret sharing technology, enables a group to collaboratively generate a global private key. The global private key is split into Private key sharding The data is securely stored by each verification node. Subsequently, the system generates elements based on elliptic curves. By publicly disclosing the joint public key through scalar multiplication

[0063] exist In the audit key preset, the supervisory node defines the arithmetic circuit based on the preset model training algorithm logic and performs a one-time trust setting to generate a pair of globally public parameters: the proof key. Distributed to each computing node for constructing proof of computing power authenticity after local training; verification key. It is publicly disclosed and stored in each verification node and blockchain smart contract, and is used to verify the mathematical validity of the proofs submitted by the computing nodes during the audit phase.

[0064] In this embodiment, the regulatory node or CA (Certificate Authority) can generate a unique on-chain pseudonym for each computing node. Specifically, this pseudonym can be obtained by concatenating the institution's real unified social credit code, the node's public key, and a random number (nonce), and then performing a SHA256 hash calculation. This pseudonym serves as the interaction identifier for the computing node on the consortium blockchain, achieving desensitization and isolation between the real identity and the on-chain identity, thus protecting the institution's privacy. Initial reputation score settings: The consortium blockchain smart contract creates an on-chain state vector for each computing node, uniformly assigning an initial reputation score of 100 (maximum). It simultaneously records information such as the node's role, on-chain pseudonym, and public key, forming an initial reputation state machine. The reputation score will be used for subsequent dynamic differential privacy, model aggregation weights, and incentive allocation. Incentive fund pool initialization: The regulatory node injects initial tokens into the consortium blockchain smart contract to establish a basic incentive fund pool, serving as the sole funding carrier for rewards for computing power contributions, compliance incentives, and malicious penalties within the system. Simultaneously, it initializes global model parameters, completing all system configurations before training, enabling the system to enter an iterative training state.

[0065] Specifically, smart contracts can be implemented on-chain for each computing node. Create an initial state vector: in, This serves as the node role identifier, with a fixed value. ; This is the unique interactive pseudonym for this node on the chain; This is the initial credit score, which is set to a maximum of 100 by default. For the reason Institutions through The algorithm uniformly generates the public digital certificate key for this node, which is used for signature verification of subsequent on-chain transactions. The regulated node injects initial... Establish a basic incentive fund pool The token serves as the sole unit of record-keeping and settlement within the system, used to quantify computing power contributions and enforce economic rewards and penalties. The initialization parameters for the global model are as follows: .

[0066] Step 204: The compute node obtains the global model parameters from the previous round, trains it using the local medical dataset, dynamically adjusts the differential privacy budget based on its own on-chain reputation score from the previous round, injects Laplacian noise into the sensitive layer parameters, and encapsulates the parameters using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hash. The compute node uses the zero-knowledge proof key to generate a computing power authenticity proof, sends the authenticity proof and ciphertext to the verification node, and uploads the parameter hash to the consortium blockchain.

[0067] Local computation on computing nodes and reputation-driven dynamic privacy protection can occur during the training phase of each round of federated learning, executed locally and securely by the participating medical institutions (i.e., computing nodes). This primarily involves computing nodes downloading the globally aggregated model parameters from the consortium blockchain or validator nodes; then, using local private medical datasets (such as CT images and electronic medical records), they perform multiple rounds of local training using optimization algorithms such as stochastic gradient descent (SGD); after training, they calculate the model update (gradient) or new model parameters for the current round.

[0068] In one embodiment, a malicious node defense method for medical federated learning based on reputation incentives and multidimensional auditing may further include a process of local computation and reputation-driven dynamic privacy protection. Specifically, the process includes: the computing node obtains the global model parameters from the previous round, performs gradient descent training using a local medical dataset, and obtains the original local update parameters; the original local update parameters are split into non-sensitive parameters and ultra-sensitive parameters according to network layer depth; the computing node reads its own reputation score from the chain and dynamically calculates the differential privacy budget, and generates Laplacian noise for the ultra-sensitive parameters and injects it into the original local update parameters to obtain noisy parameters; the noisy parameters are then reassembled with the non-sensitive parameters to obtain the final parameters to be uploaded.

[0069] Compute nodes can obtain the global model parameters from the previous iteration from the consortium blockchain or validator nodes, using these global model parameters as the starting point for the current training iteration. They then perform mini-batch stochastic gradient descent training for a specified number of rounds using a local medical dataset to obtain the original local update parameters for this round. Next, the compute nodes divide the locally trained model parameters into insensitive and highly sensitive parameters. General features such as shallow convolutional layers are classified as insensitive layers, while pathological features such as deep fully connected layers are mapped as sensitive layers. Privacy protection processing is only performed on the sensitive layers. The compute nodes read their on-chain reputation score from the consortium blockchain smart contract for the previous iteration. Based on the system's preset basic privacy budget, they calculate the dedicated privacy budget for this round according to the reputation score percentage. Higher reputation scores result in larger privacy budgets and lower noise; lower reputation scores result in smaller privacy budgets and force the injection of more noise, diluting the malicious poisoning capability from the source. Based on the dynamic privacy budget and the gradient sensitivity upper limit, the compute nodes add Laplacian noise to the sensitive layer parameters to obtain the noisy sensitive parameters. The insensitive layers remain unchanged. The noisy sensitive layers and the insensitive layers are then reassembled to form the final local model parameters to be uploaded.

[0070] Specifically, computing nodes Get global parameters from the previous round Utilizing local medical datasets Model training is performed, where For medical images or electronic medical records, This is for diagnostic labeling. Next, the computation node can set its learning rate. The loss function is ,node implement Mini-batch stochastic gradient descent for each local epoch yields the original local update parameters for this round: In this embodiment, considering that shallow convolutional layers in deep learning models extract general edge and texture features with low privacy, while deep fully connected layers extract highly abstract pathological mapping features with extremely high privacy, the nodes will... Split into non-sensitive parameters With hypersensitive parameters Next, compute the nodes. You can set a global basic privacy budget. node Retrieve your own on-chain reputation score from the previous round Calculate the dedicated privacy budget for this round: Only for sensitive parameters Generate and inject Laplacian noise, where Upper limit of sensitivity for gradient clipping: Among them, the higher the credit rating The larger the value, the lower the noise, allowing for the preservation of high-precision pathological features; the lower the reputation... The smaller the value, the more noise is forcibly injected, diluting the destructive power of the poisoning attack directly at the parameter source. Finally, the computing node can reassemble the noisy sensitive layer with the unnoisy non-sensitive layer to obtain the final parameters to be uploaded.

[0071] In one embodiment, a malicious node defense method for medical federated learning based on reputation incentives and multi-dimensional auditing may further include a process of encrypted encapsulation and zero-knowledge proof generation based on ECIES. The specific process includes: the computing node uses the ECIES asymmetric encryption algorithm to generate a symmetric encryption key using the joint public key of the verification node and a temporary random number; it uses the AES-GCM algorithm to encrypt the parameters to be uploaded to form ciphertext and calculates the parameter hash corresponding to the ciphertext; the computing node uses the zero-knowledge proof key to generate a computing power authenticity proof based on a preset arithmetic circuit; the computing node sends the authenticity proof and ciphertext to the verification node and uploads the parameter hash to the consortium blockchain for storage.

[0072] The compute node can generate temporary random numbers, calculate a temporary public key, and use the joint public key of the verification node group to calculate a shared key. It then obtains a symmetric encryption key through a key derivation function. Next, it uses the AES-GCM algorithm to encrypt the final parameters to be uploaded, outputting a complete ciphertext composed of the temporary public key and encrypted data. The compute node then performs a hash operation on the ciphertext to obtain a unique parameter hash value, which is uploaded to the consortium blockchain in advance for evidence storage, used for subsequent auditing and tamper-proof verification. The compute node can use the zero-knowledge proof key distributed by the supervisory node to construct a proof according to a pre-defined arithmetic circuit, proving that the local training process is legal, the gradient norm does not exceed system limits, no malicious parameter scaling attacks were performed, and no original medical data or true gradient information is leaked, ultimately generating a zero-knowledge proof of the current round's computing power authenticity. Finally, the compute node sends the aforementioned ciphertext and the zero-knowledge proof of computing power authenticity to the verification node network, where the verification nodes receive and prepare for the off-chain multi-dimensional audit process.

[0073] Specifically, computing nodes In the interval Internally generated temporary random numbers ,in, To expose fixed system constants, for The order of the elliptic curve base point G is determined, and then the temporary public key is calculated. The base points of the elliptic curve are then calculated; the shared key points are then calculated. Use key derivation functions to Hash the x-coordinate to generate a symmetric encryption key. Next, the compute nodes can use The algorithm encrypts the parameters to be uploaded: Output ciphertext .

[0074] Next, the computing nodes can generate feature-constrained... Zero-knowledge proof begins with defining the circuit and constructing the arithmetic circuit. The core decision logic built into the circuit is as follows: Next, parameter mapping is performed, with common input. Defined as This refers to the system's publicly disclosed sensitivity truncation limit; Witness is defined as the true sensitivity parameters extracted locally by the node without added noise. Finally, the proof is generated, and the computation nodes are computed. Using the proof key Run the circuit and output proof. Prove the relationship The validity of this finding proves that the local update parameters of the node were not subjected to malicious numerical scaling attacks and that the actual medical gradient data was not leaked throughout the process.

[0075] The computing node can transmit the ciphertext With proof Transmitted to the verification node network, parameter hash Upload to the consortium blockchain for evidence storage.

[0076] Step 206: The verification node performs threshold decryption on the received data, performs gradient direction audit, update step size audit, zero-knowledge proof verification, and medical logic compliance test on the decrypted parameters, generates a multi-dimensional audit digest, and stores the digest on the blockchain through PBFT consensus.

[0077] Verification nodes can perform off-chain multi-dimensional cross-auditing in the audit phase of each round of federated learning, with verification nodes operated by authoritative institutions performing the audits in a secure off-chain environment.

[0078] In one embodiment, a malicious node defense method for medical federated learning based on reputation incentives and multi-dimensional auditing may further include an off-chain fully trusted multi-dimensional cross-auditing process. The specific process includes: the verification node using its own private key to partially decrypt the received ciphertext, completing threshold decryption based on the Shamir threshold secret sharing mechanism to obtain local plaintext parameters; the verification node calculating the local update vector and the previous round's global update vector based on the plaintext parameters, calculating the cosine similarity between the local update vector and the previous round's global update vector, and comparing the parameter update step size with a dynamic threshold generated based on historical statistical features; the verification node using the verification key to verify the matching of the authenticity proof and the parameter hash, loading the plaintext parameters into a benchmark test set for inference, calculating the diagnostic accuracy to perform medical logic compliance testing; summarizing the audit results of gradient direction auditing, update step size auditing, zero-knowledge proof verification, and medical logic compliance testing to generate a multi-dimensional audit digest; the verification node executing PBFT consensus on the multi-dimensional audit digest, completing BLS aggregation signing, and storing the signed multi-dimensional audit digest on the blockchain.

[0079] In this embodiment, the verification node group can receive ciphertext and zero-knowledge proof of computing power authenticity from the computing nodes, obtain the corresponding parameter hash from the consortium blockchain for consistency verification, and confirm that the data has not been tampered with. Next, the verification nodes extract the temporary public key from the ciphertext, and each verification node uses its own private key to shard and calculate the decryption share; after the system collects no less than 2f+1 valid decryption shares, it restores the shared key point and symmetric key, and uses AES-GCM to decrypt to obtain the plaintext ground model parameters, completing the threshold decryption.

[0080] Next, the verification node calculates the local model update vector of the current round and the global model update vector of the previous round. It uses cosine similarity to determine whether the parameter update direction is consistent with the global convergence direction and records the similarity result. Then, it calculates the squared Euclidean distance between the local parameters and the global parameters of the previous round, determines the dynamic threshold based on the historical moving average and standard deviation, judges whether the parameter update amplitude is abnormal, and records the distance value and whether it exceeds the standard.

[0081] Verification nodes can use public verification keys to perform Groth16 algorithm verification based on BN254 bilinear pairing, check whether the bilinear pairing equation holds, determine whether the computing node has malicious scaling or fake training behavior, and output the verification result; load the decrypted local parameters into the test framework, use the public benchmark test set released by the regulatory node for inference, calculate the model accuracy; compare with the dynamic compliance threshold, determine whether the parameters conform to the validity of medical business logic, and output the compliance result.

[0082] Next, the verification nodes package the iteration rounds, calculated node pseudonyms, gradient direction similarity, update step distance, medical logic compliance results, and zero-knowledge proof verification results into a standardized multi-dimensional audit digest. Then, PBFT consensus is executed, and each verification node generates a BLS signature shard for the audit digest. The master node aggregates no less than 2f+1 signature shards to obtain an aggregate signature, packages the signed audit digest into a transaction, and broadcasts it on the chain to complete the tamper-proof evidence storage.

[0083] Specifically, in this embodiment, the verification node Decipher the received ciphertext Extract the temporary public key Using its own private key for sharding Calculate decryption share Collect more than the threshold After recovery of the shared key point and Decryption yields plaintext .

[0084] For gradient direction auditing, the verification node first calculates the local model update vector for that node in this round. and the update vector of the previous global model Then, the cosine similarity between the two updated vectors is calculated: in, It represents the L2 norm of a vector.

[0085] For update step size auditing, verify the square of the Euclidean distance at each node: The dynamic threshold is calculated using historical moving averages. in, For the front The mean of the global distance. The standard deviation is denoted as .

[0086] For bilinear pairing The proof verification employs the zk-SNARKs protocol (Groth16) based on asymmetric bilinear pairing (BN254 curve) for construction and verification. The verification node parses the zero-knowledge proof parameters from the network requests submitted by the compute nodes. in (Points on elliptic curve group 1). (Points on elliptic curve group 2); Extract the common input defined above. Map it to a finite field Scalar on, and simultaneously retrieve public verification key. in For the generation of the evolution point, The corresponding verification mapping points are provided for the public inputs; the verification nodes utilize a bilinear pairing function. Calculate and verify that the following core validation equations are strictly equal: in, The constant term represents the mapping of the common input; if the bilinear pairing equation holds, it indicates that the ciphertext parameters of this node do not exceed the legal gradient norm constraint boundary, and there is no malicious model scaling poisoning behavior. Output the verification result. If the equation does not hold true, it indicates that the node has engaged in highly malicious behavior by fabricating abnormal gradients out of thin air, and the verification result is output. .

[0087] For medical logic compliance testing, the verification node will decrypt the local parameters. Loaded into the testing framework, the model is used for inference using a small set of public benchmarks published by regulatory agencies. The verification node can set dynamic compliance thresholds. in, This represents the accuracy of the previous global model on the same test set. The baseline accuracy for system initialization is a priori threshold set by the regulatory node; For the first The dynamic tolerance deviation threshold of the wheel is calculated based on the global model in front. The standard deviation of the accuracy of the round test, i.e. in The system's preset historical audit window size, This is the system's preset sensitivity adjustment coefficient. If the inference accuracy of this node model falls below 50%, it is considered a failure. Otherwise .

[0088] Finally, verify the node. Generate a formatted summary: Verify the execution of the node group. Consensus, each verification node Using the private key fragments allocated during the initialization phase Digital signature fragments are generated from digest information based on the BLS signature algorithm. Because the system is set to have a total number of nodes. The master node needs to collect at least Nodes Signature fragments The master node will this Individual signatures are aggregated into a single signature. The master node will be attached The summary is packaged into the block transaction and broadcast on the chain.

[0089] Step 208: After the multi-dimensional audit summary is uploaded to the blockchain, the smart contract determines the node's maliciousness level based on the audit results according to the preset tiered penalty rules, updates the node's reputation score, and executes the corresponding rewards and punishments.

[0090] In one embodiment, a method for defending against malicious nodes in a medical federated learning system based on reputation incentives and multi-dimensional auditing may further include a process of smart contract malicious judgment and reputation state machine update. The specific process includes: the smart contract listens to and obtains the multi-dimensional audit summary uploaded to the chain, and obtains audit results of zero-knowledge proof verification, update step size, gradient direction similarity, and medical logic compliance based on the multi-dimensional audit summary; according to the audit results, each node is divided into a malicious level of severe maliciousness, moderate maliciousness, and mild abnormality according to a preset tiered penalty rule; the smart contract performs an update operation on the node's reputation score according to the maliciousness level, and simultaneously executes corresponding rewards and penalties such as permission freezing, deposit forfeiture, or qualification retention.

[0091] The smart contract can first verify the validity of the PBFT-BLS aggregated signature of the multi-dimensional audit digest uploaded to the chain, confirming that the digest comes from a trusted verification node and has not been tampered with. After the signature verification passes, it automatically triggers the tiered maliciousness determination and reputation state machine update logic. Next, the smart contract extracts key determination parameters from the audit digest, which can mainly include the zero-knowledge proof verification result, the update step size audit result and dynamic threshold, the gradient direction cosine similarity, the medical logic compliance test result, and the maliciousness level is determined sequentially according to the tiered rules.

[0092] Specifically, if the zero-knowledge proof verification fails, it is directly judged as severely malicious, permanently stripping the node of its eligibility to participate in training and aggregation, setting its reputation score to 0, and confiscating all of the node's pledged funds; if the update step size exceeds the dynamic threshold (Dist>τ_dist) and the medical logic compliance test fails (Rule=0), it is judged as moderately malicious, deducting 30 points from the previous round's reputation score and freezing the node's participation privileges in the next round; if only the gradient direction cosine similarity is low, but the medical logic compliance test is normal (Rule=1), it is judged as mildly abnormal (compatible with Non-IID medical data), deducting 10 points from the previous round's reputation score, and retaining the node's participation eligibility; if all audit items are qualified, no points are deducted, the current reputation score is maintained, and it is marked as a normal compliant node.

[0093] The smart contract writes the latest reputation score, after assessment, into the node's on-chain state vector, overwriting the previous reputation value, and simultaneously records the level of malice and reward / punishment records to ensure that the reputation status is traceable and tamper-proof. Then, it can deduct points, freeze permissions, and confiscate / withhold staked funds for severely and moderately malicious nodes; compliant nodes retain their incentive eligibility and are not subject to penalties. Nodes that pass three consecutive audits receive a 2-point increase in reputation score per round, up to a maximum of 100 points, forming a security constraint of "strict punishment and slow recovery."

[0094] Specifically, smart contract verification digest After the signature is verified, a tiered penalty logic is triggered: Severe malice: If Permanently strip the node of its network access and parameter aggregation eligibility, and score. Forfeiture of deposit; Moderate malice: If Deduction of points Freeze permissions for the next round; minor anomaly: if only Low but It was determined to be normal. Features, deductions Eligibility will be retained; Reputation recovery mechanism: After three consecutive rounds of compliance, the reputation score incremental recovery mechanism will be activated. The step size is set to 2 to build a defense strategy that is "easy to punish and difficult to recover". Each violation deducts 10 to 30 points, but each time compliance is restored, only 2 points can be compensated. This is intended to significantly increase the cost of malicious nodes attempting to regain high privileges through brief periods of normal behavior.

[0095] Step 210: The verification node calculates the aggregation weight using the Softmax function with temperature coefficient based on the updated reputation score on the chain, performs a weighted average of the parameters of qualified nodes to update the global model, and calculates the new benchmark hash on the chain.

[0096] In one embodiment, a medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing may further include a process of reputation weighted aggregation and global model update. The specific process includes: the verification node selects qualified nodes based on the updated reputation score on the consortium blockchain, and calculates the aggregation weight of each qualified node using a Softmax function with a temperature coefficient; the verification node uses the aggregation weight to perform a weighted average calculation on the local parameters of the qualified nodes to obtain a new round of global model parameters; the verification node performs a hash operation on the new round of global model parameters to generate a new baseline hash and stores it on the blockchain.

[0097] Verifying nodes can read the latest updated node reputation scores and malicious intent assessment results from the consortium blockchain smart contract, filtering out severely malicious, frozen, and unqualified nodes to form a set of legitimate and valid nodes participating in the aggregation for this round. Then, a Softmax function with a temperature coefficient is used to normalize the reputation scores of each qualified node and convert them into model aggregation weights. Specifically, for each qualified node, its reputation score is used as input, and after performing an exponential operation, it is divided by the sum of the exponents of all qualified nodes to obtain the normalized weight. The temperature coefficient is used to smooth out differences in reputation scores, preventing high-scoring nodes from excessively monopolizing weights, while retaining the effective contribution of rare disease data from small institutions. The sum of the weights of all nodes is 1, ensuring that the weighted aggregation is legitimate and valid.

[0098] The verification nodes use the calculated reputation weights to perform a weighted summation of the local model parameters decrypted by each qualified node, resulting in the new global model parameters for this iteration, thus completing secure aggregation. They then perform a SHA256 hash operation on the global model parameters generated in this round to obtain a unique hash value for the global model, serving as a reliable benchmark for the training results. Finally, the verification nodes package the global model hash into an on-chain transaction, and after consensus, write it into the consortium blockchain's distributed ledger, ensuring the training results are immutable, traceable, and verifiable, thus completing the global model update and notarization process for this round.

[0099] Specifically, in this embodiment, the verification node filters out the set of qualified nodes based on the latest reputation score on the chain. Specifically, the verification nodes use temperature coefficients. of Function transformation aggregate weights: If not introduced Even small differences in reputation scores can be amplified exponentially, leading to a few top-scoring hospitals completely monopolizing the overall model; [This is followed by a seemingly unrelated sentence about setting up a reputation score system.] This approach preserves the marginal case characteristics contribution of low-reputation institutions while ensuring the dominant position of high-reputation nodes. Next, the validation nodes perform a weighted average calculation: Then calculate the new baseline hash: On-chain evidence storage.

[0100] Step 212: The smart contract calculates incentive revenue based on the node's quality score and reputation score, and automatically returns the funds confiscated from malicious nodes to the incentive fund pool, completing the circulation of the fund pool and the closed-loop incentive.

[0101] In one embodiment, a medical federated learning malicious node defense method based on reputation incentives and multidimensional auditing may further include a closed-loop reputation incentive and fund transfer settlement process. The specific process includes: the smart contract extracts the cosine similarity and squared Euclidean distance of each computing node from the multidimensional audit summary, calculates the quality score and updated reputation score of the node, and calculates the comprehensive contribution score of each node through a weighted product model; the smart contract calculates the incentive income of each node according to the comprehensive contribution score, deducts the penalty funds of malicious nodes and transfers them to the incentive fund pool, thereby realizing the closed-loop fund transfer of malicious punishment and compliance incentives.

[0102] The smart contract extracts gradient direction similarity and update step size stability metrics from the on-chain audit summary, and calculates the node quality score using a preset weighted formula: the similarity ratio reflects the accuracy of parameter update direction; the step size ratio reflects training convergence stability; the weighted sum of the two metrics yields the current round's quality score, used to measure the node's contribution to training. Quality Score The calculation formula can be expressed as: in, and ; Measuring the accuracy of the update direction. Measure convergence stability.

[0103] The smart contract can calculate and distribute incentive tokens and rewards to each compliant node according to the rule of base incentive pool × relative quality score × reputation score multiplier. Specifically, the proportion of a single node's quality to the total quality of all nodes can be calculated first; then multiplied by the ratio of that node's reputation score to the maximum score; finally multiplied by the total amount of the base incentive pool to obtain the actual incentive reward for that node in this round. The reward is automatically settled by the smart contract and directly distributed to the node's on-chain account. The calculation formula is expressed as follows: That is, the staked funds deducted by moderately and severely malicious nodes will be automatically injected by the smart contract in proportion. This allows for the construction of a dynamic replenishment mechanism for the capital pool, achieving a sustainable closed-loop circulation of technical defense against malicious nodes and positive economic incentives for compliant nodes.

[0104] Specifically, the smart contract executes penalties on nodes deemed moderately or severely malicious, primarily including confiscating all staked funds of severely malicious nodes and deducting corresponding staked funds from moderately malicious nodes. All penalties are uniformly collected into a designated escrow account of the smart contract, ensuring no funds flow into any private accounts. The smart contract automatically injects the collected penalties into the basic incentive pool in full according to a preset ratio, achieving dynamic replenishment and self-circulation of the pool. This includes penalties directly becoming the incentive source for compliant nodes in the next round, forming a sustainable closed loop, eliminating the need for continuous funding from regulatory nodes, and ensuring the long-term stable operation of the system. The smart contract updates the pool balance, records incentive distribution and penalty return logs, and stores them on the blockchain for evidence, marking the completion of incentives and fund flows for this round of training, and the system enters the preparation state for the next iteration.

[0105] In one embodiment, a malicious node defense method for medical federated learning based on reputation incentives and multi-dimensional auditing is provided. This method proposes a blockchain-based off-chain and on-chain collaborative architecture. Only lightweight hashes and audit digests are stored on-chain, while complex model decryption, multi-dimensional auditing, and aggregation are all completed off-chain by fully trusted verification nodes deployed by authoritative institutions. This overcomes the computational bottleneck of on-chain computing and avoids single points of failure through multi-node consensus. A multi-dimensional cross-auditing system is constructed, abandoning single threshold judgments and integrating parameter direction (cosine similarity), update step size (Euclidean distance dynamic threshold), and medical logic rules. It trains zero-knowledge proofs (zk-SNARKs) to detect and defend against parameter poisoning, model scaling, and fake training. The audit summary is uploaded to the blockchain and cannot be tampered with. It constructs a reputation-driven dynamic incentive and long-term fund circulation mechanism, which converts node audit results into reputation scores. These reputation scores not only directly determine the aggregation weight of the global model and token incentive revenue, but also automatically return the staked funds of medium and severe malicious nodes to the basic incentive pool. Through this mechanism, combined with adaptive differential privacy dynamic noise addition, a closed-loop linkage between technical defense optimization and long-term economic incentives is finally achieved.

[0106] It should be understood that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart above may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0107] In one embodiment, such as Figure 1As shown, a medical federated learning malicious node defense system based on reputation incentives and multi-dimensional auditing is provided, including:

[0108] Supervisory node 300 is used to perform initialization operations, generate a system architecture that includes computing nodes, verification nodes, supervisory node 300 and consortium blockchain, and complete key generation, node pseudonym allocation, initial reputation score setting and incentive fund pool initialization.

[0109] Compute node 100 is used to obtain the global model parameters from the previous round, train it using the local medical dataset, dynamically adjust the differential privacy budget based on its own on-chain reputation score from the previous round, inject Laplacian noise into the sensitive layer parameters, and encapsulate the parameters using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hashes. Compute node 100 is also used to generate a proof of computing power authenticity using a zero-knowledge proof key, send the proof of authenticity and ciphertext to verification node 200, and upload the parameter hashes to consortium blockchain 400.

[0110] Verification node 200 is used to perform threshold decryption on the received data, and sequentially perform gradient direction audit, update step size audit, zero-knowledge proof verification and medical logic compliance test on the decrypted parameters to generate a multi-dimensional audit digest, and then put the digest on the chain for evidence storage through PBFT consensus.

[0111] Consortium Chain 400 is equipped with smart contracts. After the multi-dimensional audit summary is uploaded to the chain, the smart contracts determine the malicious level of the node based on the audit results and according to the preset tiered penalty rules, update the node's reputation score, and execute the corresponding rewards and punishments.

[0112] Validator Node 200 is also used to calculate aggregate weights using a Softmax function with a temperature coefficient based on the updated reputation score on the chain, to perform a weighted average of the parameters of qualified nodes to update the global model, and to calculate a new baseline hash on the chain.

[0113] Smart contracts are also used to calculate incentive rewards based on the node's quality score and reputation score, and automatically return the funds confiscated from malicious nodes to the incentive fund pool, thus completing the circulation and closed-loop incentive of the fund pool.

[0114] In one embodiment, the supervisory node 300 is further configured to divide nodes into computing nodes 100, verification nodes 200, and supervisory nodes based on qualifications and computing power, deploy the consortium blockchain 400, and construct an on-chain and off-chain collaborative system architecture; generate local private and public keys for each computing node 100 using the Secp256k1 elliptic curve cryptography algorithm, and generate a global joint public and private key shard based on Shamir threshold secret sharing; perform a one-time trusted setting for the preset model training algorithm logic to generate a proof key and a verification key; the smart contract creates an on-chain state vector for each computing node 100, containing a node role identifier, on-chain pseudonym, initial reputation score, and public key; and the supervisory node 300 injects initial tokens into the smart contract, establishes an incentive fund pool, and initializes it.

[0115] In one embodiment, the computing node 100 is further configured to obtain the global model parameters from the previous round, perform gradient descent training using the local medical dataset to obtain the original local update parameters; split the original local update parameters into insensitive parameters and ultrasensitive parameters according to the network layer depth; read its own reputation score from the chain and dynamically calculate the differential privacy budget, and generate Laplacian noise for the ultrasensitive parameters and inject it into the original local update parameters to obtain noisy parameters; and reassemble the noisy parameters with the insensitive parameters to obtain the final parameters to be uploaded.

[0116] In one embodiment, the computing node 100 is further configured to use the ECIES asymmetric encryption algorithm to generate a symmetric encryption key using the joint public key of the verification node 200 and a temporary random number, encrypt the parameters to be uploaded using the AES-GCM algorithm to form ciphertext, and calculate the parameter hash corresponding to the ciphertext; generate a computing power authenticity certificate based on a preset arithmetic circuit using a zero-knowledge proof key; send the authenticity certificate and ciphertext to the verification node 200, and upload the parameter hash to the consortium blockchain 400 for storage.

[0117] In one embodiment, the verification node 200 is further configured to partially decrypt the received ciphertext using its own private key fragments, complete threshold decryption based on the Shamir threshold secret sharing mechanism to obtain local plaintext parameters; calculate the local update vector and the previous round global update vector based on the plaintext parameters, calculate the cosine similarity between the local update vector and the previous round global update vector, and compare the parameter update step size with the dynamic threshold generated based on historical statistical features; verify the matching of the authenticity proof and parameter hash using the verification key, and load the plaintext parameters into the benchmark test set for inference, calculate the diagnostic accuracy to perform medical logic compliance testing; summarize the audit results of gradient direction audit, update step size audit, zero-knowledge proof verification, and medical logic compliance testing to generate a multi-dimensional audit digest; execute PBFT consensus on the multi-dimensional audit digest, complete BLS aggregate signature, and store the signed multi-dimensional audit digest on the blockchain.

[0118] In one embodiment, the smart contract listens to and obtains the multi-dimensional audit digest uploaded to the blockchain, and obtains audit results for zero-knowledge proof verification, update step size, gradient direction similarity, and medical logic compliance based on the multi-dimensional audit digest. According to the audit results, each node is divided into three levels of malice: severe malice, moderate malice, and mild abnormality according to the preset tiered penalty rules. The smart contract updates the node's reputation score according to the malice level and simultaneously executes corresponding rewards and penalties such as freezing permissions, confiscating deposits, or retaining qualifications.

[0119] In one embodiment, the verification node 200 is also used to screen qualified nodes based on the updated reputation score on the consortium blockchain 400, calculate the aggregate weight of each qualified node using the Softmax function with a temperature coefficient, use the aggregate weight to perform a weighted average calculation on the local parameters of the qualified nodes to obtain the new round of global model parameters, perform a hash operation on the new round of global model parameters to generate a new baseline hash and store it on the blockchain.

[0120] In one embodiment, the smart contract extracts the cosine similarity and squared Euclidean distance of each computing node from the multidimensional audit summary, calculates the quality score and updated reputation score of the node, and calculates the comprehensive contribution score of each node through a weighted product model. The smart contract calculates the incentive income of each node based on the comprehensive contribution score, deducts the fines and confiscations of malicious nodes and transfers them to the incentive fund pool, thereby realizing a closed-loop flow of funds for malicious punishment and compliance incentives.

[0121] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0122] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A medical federal learning malicious node defense method based on reputation incentive and multi-dimensional audit, characterized in that, The method includes: The regulatory node performs initialization operations to generate a system architecture that includes computing nodes, verification nodes, regulatory nodes, and a consortium blockchain, and completes key generation, node pseudonym allocation, initial reputation score setting, and incentive fund pool initialization. The computing node obtains the global model parameters from the previous round, trains it using the local medical dataset, dynamically adjusts the differential privacy budget based on its own on-chain reputation score from the previous round, injects Laplacian noise into the sensitive layer parameters, and encapsulates the parameters using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hashes. The computing node uses a zero-knowledge proof key to generate a proof of computing power authenticity, sends the proof of authenticity and ciphertext to the verification node, and uploads the parameter hashes to the consortium blockchain. The verification node performs threshold decryption on the received data, performs gradient direction auditing, update step size auditing, zero-knowledge proof verification, and medical logic compliance testing on the decrypted parameters, generates a multi-dimensional audit digest, and stores the digest on the blockchain through PBFT consensus. After the multi-dimensional audit summary is uploaded to the blockchain, the smart contract determines the node's maliciousness level based on the audit results according to the preset tiered penalty rules, updates the node's reputation score, and executes the corresponding rewards and punishments. The verification node calculates the aggregation weight using a Softmax function with a temperature coefficient based on the updated reputation score on the chain, performs a weighted average of the parameters of qualified nodes to update the global model, and calculates a new baseline hash on the chain. The smart contract calculates incentive rewards based on the node's quality score and reputation score, and automatically returns the funds confiscated from malicious nodes to the incentive fund pool, thus completing the circulation of the fund pool and the closed-loop incentive.

2. The method of claim 1, wherein, The regulatory node performs initialization operations, generating a system architecture that includes compute nodes, verification nodes, regulatory nodes, and the consortium blockchain. It also completes key generation, node pseudonym allocation, initial reputation score setting, and incentive fund pool initialization, including: Based on qualifications and computing power, regulatory nodes are divided into computing nodes, verification nodes, and regulatory nodes, and a consortium blockchain is deployed to build an on-chain and off-chain collaborative system architecture. The monitoring node uses the Secp256k1 elliptic curve cryptography algorithm to generate local private and public keys for each computing node, and generates a global joint public and private key fragment based on Shamir threshold secret sharing. It performs a one-time trusted setting for the preset model training algorithm logic to generate a proof key and a verification key. The smart contract creates an on-chain state vector for each computing node, which includes a node role identifier, an on-chain pseudonym, an initial reputation score, and a public key; the supervisory node injects initial tokens into the smart contract, establishes an incentive fund pool, and initializes it.

3. The method of claim 1, wherein, The compute node obtains the global model parameters from the previous round, trains it using the local medical dataset, and dynamically adjusts the differential privacy budget based on its own on-chain reputation score from the previous round. It also injects Laplacian noise into the sensitive layer parameters, including: The computing node obtains the global model parameters from the previous round, performs gradient descent training using the local medical dataset, and obtains the original local update parameters; The original local update parameters are split into insensitive parameters and highly sensitive parameters according to the network layer depth; The computing node reads its previous round reputation score from the chain and dynamically calculates the differential privacy budget. It then generates Laplace noise for the ultrasensitive parameter and injects it into the original local update parameter to obtain the noise-added parameter. The noise-adding parameters are reassembled with the non-sensitive parameters to obtain the final parameters to be uploaded.

4. The medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing according to claim 3, characterized in that, The parameters are encapsulated using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hashes; The computing node generates a proof of computing power authenticity using a zero-knowledge proof key, sends the proof of authenticity and ciphertext to the verification node, and uploads the parameter hash to the consortium blockchain, including: The computing node uses the ECIES asymmetric encryption algorithm to generate a symmetric encryption key using the joint public key of the verification node and a temporary random number. It then uses the AES-GCM algorithm to encrypt the parameters to be uploaded into ciphertext and calculates the parameter hash corresponding to the ciphertext. The computing node uses a zero-knowledge proof key to generate a proof of the authenticity of computing power based on a preset arithmetic circuit. The computing node sends the authenticity certificate and ciphertext to the verification node, and uploads the parameter hash to the consortium blockchain for evidence storage.

5. The medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing according to claim 1, characterized in that, The verification node performs threshold decryption on the received data, conducts gradient direction auditing, update step size auditing, zero-knowledge proof verification, and medical logic compliance testing on the decrypted parameters, generates a multi-dimensional audit digest, and stores the digest on the blockchain for evidence through PBFT consensus, including: The verification node uses its own private key to partially decrypt the received ciphertext, and completes threshold decryption based on the Shamir threshold secret sharing mechanism to obtain the local plaintext parameters; The verification node calculates the local update vector and the previous round global update vector based on the plaintext parameters, calculates the cosine similarity between the local update vector and the previous round global update vector, and compares the parameter update step size with the dynamic threshold generated based on historical statistical features. The verification node uses the verification key to verify the matching between the authenticity proof and the parameter hash, and loads the plaintext parameters into the benchmark test set for inference, calculates the diagnostic accuracy, and performs medical logic compliance testing. The audit results of gradient direction audit, update step size audit, zero-knowledge proof verification, and medical logic compliance testing are summarized to generate a multi-dimensional audit summary. The verification node performs PBFT consensus on the multidimensional audit digest and completes BLS aggregate signature, then uploads the signed multidimensional audit digest to the blockchain for evidence storage.

6. The medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing according to claim 1, characterized in that, After the multi-dimensional audit summary is uploaded to the blockchain, the smart contract determines the node's maliciousness level based on the audit results according to a preset tiered penalty rule, updates the node's reputation score, and executes corresponding rewards and penalties, including: The smart contract listens to and obtains the multi-dimensional audit summary uploaded to the chain, and obtains the audit results of zero-knowledge proof verification, update step size, gradient direction similarity and medical logic compliance based on the multi-dimensional audit summary; Based on the audit results, each node is classified into three levels of malice: severe malice, moderate malice, and mild abnormality, according to a preset tiered penalty rule. The smart contract updates the node's reputation score based on the level of malice and simultaneously executes corresponding rewards and penalties such as freezing permissions, confiscating deposits, or retaining eligibility.

7. The medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing according to claim 1, characterized in that, The verification node calculates the aggregation weight using a Softmax function with a temperature coefficient based on the updated reputation score on-chain, performs a weighted average of the parameters of qualified nodes to update the global model, and calculates a new baseline hash on-chain, including: The verification node selects qualified nodes based on the updated reputation score on the consortium blockchain, and uses the Softmax function with a temperature coefficient to calculate the aggregate weight of each qualified node. The verification node uses the aggregation weight to calculate a weighted average of the local parameters of the qualified node to obtain a new round of global model parameters; The verification node performs a hash operation on the new round of global model parameters to generate a new baseline hash and stores it on the blockchain.

8. The medical federated learning malicious node defense method based on reputation incentives and multi-dimensional auditing according to claim 1, characterized in that, The smart contract calculates incentive rewards based on the node's quality score and reputation score, and automatically returns the funds confiscated from malicious nodes to the incentive fund pool, completing the circulation and closed-loop incentive of the fund pool, including: The smart contract extracts the cosine similarity and squared Euclidean distance of each computing node from the multidimensional audit summary, calculates the quality score and updated reputation score of the node, and calculates the comprehensive contribution score of each node through a weighted product model. The smart contract calculates the incentive benefits for each node based on the comprehensive contribution score, deducts the fines and confiscations of malicious nodes and transfers them into the incentive fund pool, thereby realizing a closed-loop flow of funds between malicious punishment and compliant incentives.

9. A medical federated learning malicious node defense system based on reputation incentives and multi-dimensional auditing, characterized in that, The system includes: The regulatory node is used to perform initialization operations, generate a system architecture that includes computing nodes, verification nodes, regulatory nodes and consortium blockchain, and complete key generation, node pseudonym allocation, initial reputation score setting and incentive fund pool initialization. The compute node is used to obtain the global model parameters from the previous round, train it using the local medical dataset, dynamically adjust the differential privacy budget based on its own on-chain reputation score from the previous round, inject Laplacian noise into the sensitive layer parameters, and encapsulate the parameters using the ECIES asymmetric encryption algorithm to generate ciphertext and parameter hashes. The compute node is also used to generate a computing power authenticity certificate using a zero-knowledge proof key, send the authenticity certificate and ciphertext to the verification node, and upload the parameter hashes to the consortium blockchain. The verification node is used to perform threshold decryption on the received data, and sequentially perform gradient direction audit, update step size audit, zero-knowledge proof verification and medical logic compliance test on the decrypted parameters to generate a multi-dimensional audit digest. The digest is then stored on the blockchain through PBFT consensus. The consortium blockchain is equipped with smart contracts. These smart contracts are used to determine the malicious level of a node based on the audit results and a preset tiered penalty rule after the multi-dimensional audit summary is uploaded to the blockchain. The smart contracts then update the node's reputation score and execute corresponding rewards and penalties. The verification node is also used to calculate the aggregation weight using the Softmax function with a temperature coefficient based on the updated reputation score on the chain, to perform a weighted average of the parameters of qualified nodes to update the global model, and to calculate a new benchmark hash on the chain. The smart contract is also used to calculate incentive revenue based on the node's quality score and reputation score, and automatically return the funds confiscated from malicious nodes to the incentive fund pool, thus completing the circulation and closed-loop incentive of the fund pool.

Images