A supply chain-oriented privacy data protection method

Abstract

The application relates to the technical field of data privacy protection, and discloses a supply chain-oriented private data protection method, which comprises the following steps: dividing supply chain participants into three layers of core enterprises, first-level suppliers and second-level suppliers, and deploying a hierarchical network topology and a blockchain smart contract system. Each participant injects local sensitive data by using differential differential privacy; Fisher information matrix is used to grade gradients, and Paillier, BFV homomorphic encryption and a secure aggregation protocol are used to perform hybrid encryption and aggregation on key, important and secondary gradients respectively, and malicious gradient detection is performed; a quality-weighted scale self-adaptive cross-layer aggregation strategy is used to update a global model; and a blockchain is used to store and prove the output of the auditable collaborative training record. The application can realize supply chain multi-level collaborative privacy protection model training under the premise of protecting original data from being out of the domain, and can balance the privacy protection strength and the calculation efficiency, and provide full-process auditability.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, and more specifically, to a method for protecting privacy data in the supply chain. Background Technology

[0002] As the digital transformation of the supply chain deepens, the need for collaboration between core enterprises and multi-tiered suppliers is becoming increasingly urgent. In industries such as automobile manufacturing, electronics, and pharmaceutical distribution, core enterprises need to integrate sensitive business information such as order data, inventory information, and production capacity data from suppliers at all levels to achieve accurate demand forecasting and production plan optimization. However, this data is scattered across the independent systems of each participant, and due to business competition considerations, each party is unwilling to directly share raw data, leading to a data silo dilemma in supply chain collaboration.

[0003] Federated learning, as a distributed machine learning paradigm, allows multiple parties to collaboratively train models without sharing raw data, offering a new approach to supply chain privacy protection. Existing federated learning solutions mostly employ a parallel architecture, treating all participants equally, with model parameters from all nodes directly aggregated to a central server. This fails to reflect the hierarchical collaboration between core enterprises and multi-level suppliers in the supply chain, resulting in high communication complexity and low aggregation efficiency. Regarding privacy protection, differential privacy schemes use uniform noise intensity for all gradients, failing to implement differentiated protection for parameters of different sensitivity. While fully homomorphic encryption schemes can achieve ciphertext computation, the computational cost is thousands of times that of plaintext, making it difficult to meet the real-time collaboration needs of the supply chain. Furthermore, existing solutions lack effective defense mechanisms against gradient poisoning attacks by malicious nodes; malicious suppliers can corrupt the global model by sending incorrect gradients, and there is a lack of end-to-end auditing capabilities for the collaborative process.

[0004] To address the aforementioned issues, existing technologies suffer from the following technical problems: existing federated learning schemes are not adapted to multi-level hierarchical structures in the supply chain, making it difficult to balance privacy protection with computational efficiency. Furthermore, they lack dynamic node management, malicious gradient detection, and full-process auditing mechanisms, thus failing to meet the privacy protection needs of multi-party collaboration in the supply chain. Summary of the Invention

[0005] This invention provides a privacy data protection method for the supply chain, which solves the technical problems of existing federated learning schemes that are not adapted to the multi-level hierarchical structure of the supply chain, make it difficult to balance the strength of privacy protection and computational efficiency, and lack dynamic node management, malicious gradient detection and full-process auditability mechanisms.

[0006] This invention provides a privacy data protection method for the supply chain, comprising the following steps: S1 collects supply chain hierarchical relationships and participant identity information, deploys a layered network topology and blockchain smart contract system, and outputs an initialized supply chain privacy collaborative network; S2, obtain the privacy budget quota and local sensitive data issued by the initial cooperative network, and output the privacy-protected training dataset by adopting the differential privacy noise injection mechanism; S3 receives a privacy-preserving training dataset, uses the Fisher information matrix gradient sensitivity analysis method, and outputs hierarchical gradient update amount and local model quality score. S4, based on the hierarchical gradient update quantity and quality score, adopts a hybrid encrypted aggregation and malicious gradient detection mechanism to output hierarchical aggregation gradient and aggregation statistics; S5, based on the hierarchical aggregation gradient and the local training gradient, adopts a quality-weighted scale adaptive cross-layer aggregation strategy to output a new round of global model parameters; S6 receives a new round of global model parameters, adopts a blockchain-based notarization and zero-knowledge proof compliance verification mechanism, and outputs auditable collaborative training records and the final global model.

[0007] In a preferred embodiment, S1 includes: Deploying a layered network topology and blockchain smart contract system includes: dividing the participants into core enterprise nodes, a set of first-tier supplier nodes, and a set of second-tier supplier nodes according to the supply chain hierarchy; deploying trusted aggregation nodes at each level; and deploying aggregation nodes in a trusted execution environment. Initialize the consortium blockchain network and deploy a smart contract system on the blockchain. The smart contract system includes node management contracts, privacy budget management contracts, model evidence storage contracts, reputation scoring contracts, and malicious detection contracts. Each participant generates a two-layer key system, which includes identity key pairs generated using the elliptic curve digital signature algorithm and data key pairs generated using the Paillier homomorphic encryption algorithm.

[0008] In a preferred embodiment, S2 includes: The differentiated privacy noise injection mechanism includes: performing feature engineering on local sensitive data to extract multi-dimensional feature vectors; evaluating the sensitivity of the extracted features and classifying them into three levels: high sensitivity, medium sensitivity, and low sensitivity; querying the privacy budget management contract on the blockchain to obtain the total privacy budget quota for this node; and differentially allocating the privacy budget for this round among features of different sensitivity. Differential privacy protection is achieved by adding Laplace noise to the feature data based on the allocated privacy budget and feature sensitivity. The noise scale parameter is calculated based on the global sensitivity of the feature and the privacy budget. The privacy budget consumption record is submitted to the privacy budget management contract on the blockchain for verification and cumulative update.

[0009] In a preferred embodiment, S3 includes: The Fisher information matrix gradient sensitivity analysis method includes: after each participant receives the global model parameters, it trains the model on the local training dataset and records the gradient change history of each parameter; after the local training is completed, the gradient update amount of the local model parameters relative to the global model parameters is calculated. The importance of gradients is evaluated using a Fisher information matrix-based method. The approximate value of the diagonal elements of the Fisher information matrix is ​​calculated. Specifically, samples are drawn from the validation dataset, the loss value is calculated for each sample through forward propagation, the gradient is calculated through backpropagation, the square of the gradient is calculated, and the average is taken over all samples to obtain the approximate value of the Fisher information for each parameter.

[0010] In a preferred embodiment, S3 further includes: The output of hierarchical gradient update and local model quality score includes: sorting the gradient parameters by importance according to Fisher information values, selecting the parameters with the first preset proportion before sorting as key gradients, selecting the parameters with the second preset proportion in the middle as important gradients, and the remaining parameters as minor gradients. Calculate the performance metrics of the local model on the validation dataset, normalize the performance metrics, and then calculate the local data quality score. Package the gradient update amount, gradient sensitivity classification, local data quality score, and number of training samples, digitally sign them using the node's identity private key, and then prepare to upload them to the aggregation node.

[0011] In a preferred embodiment, S4 includes: The hybrid encryption aggregation method includes: encrypting key gradients using the Paillier homomorphic encryption algorithm, which supports addition and scalar multiplication operations in the ciphertext domain; and encrypting important gradients using the BFV homomorphic encryption scheme based on the learning and error problem on rings. For minor gradients, a secure aggregation protocol is used. Each participant adds the real gradient to the random mask and uploads it. The random mask is generated using a pairwise random mask method. The pairwise random masks are generated based on a shared key pre-negotiated through the Diffie-Hellman key exchange protocol. During aggregation, the pairwise random masks cancel each other out.

[0012] In a preferred embodiment, S4 further includes: The malicious gradient detection mechanism includes: calculating the mean and standard deviation of the mask gradients of all nodes at the same level for minor gradients; if the norm of the mask gradient of a node exceeds the mean plus a preset multiple of the standard deviation, it is marked as a suspected anomaly; calculating the norm of the ciphertext gradient for key gradients and important gradients using the properties of homomorphic encryption, comparing it with the historical statistical distribution of the gradient norm of the corresponding level, and if it exceeds the normal range, it is marked as a suspected malicious gradient. Suspected malicious gradients are excluded from this round of aggregation, and malicious behavior reports are submitted to the malicious detection smart contract on the blockchain; weighted aggregation is performed on normal gradients that pass the detection, and the aggregation weight is calculated by combining the data scale, data quality score and historical reputation score.

[0013] In a preferred embodiment, S5 includes: The quality-weighted scale-adaptive cross-layer aggregation strategy includes: after the second-level supplier layer aggregation node completes the internal aggregation within the layer, it transmits the aggregation gradient and layer statistics to the first-level supplier layer aggregation node; The first-level supplier layer aggregation node calculates the quality weighted scale of each level. The quality weighted scale is equal to the total data scale of the level multiplied by the average data quality score of the level. The cross-level aggregation weight is calculated based on the quality weighted scale of each level. A weight upper limit mechanism is set. The aggregation weight of any level shall not exceed the preset weight upper limit value. If it exceeds the preset weight upper limit value, it shall be truncated to the preset weight upper limit value, and the weight of the other level shall be adjusted accordingly to ensure that the weight sum is 1.

[0014] In a preferred embodiment, S5 further includes: The output of the new round of global model parameters includes: the core enterprise node receives the cross-layer aggregated gradient, and finally aggregates the supplier aggregated gradient with its own local training gradient. The quality weighted scale of the core enterprise is multiplied by a preset boosting factor during calculation. The core enterprise uses global gradients to update global model parameters through the Adam optimizer; it uses a secure multi-party computation protocol to calculate global verification performance, where each participant adds its local verification metrics to a random mask and uploads them, and the core enterprise aggregates them and cancels out the random masks to obtain the global verification metrics; the updated global model parameters are then distributed to participants at each level through aggregation nodes.

[0015] In a preferred embodiment, S6 includes: The compliance verification mechanism using blockchain notarization and zero-knowledge proof includes: the core enterprise performs hash calculation on the global model parameters to generate a unique model identifier, constructs a notarization transaction containing model hash, training rounds, participating node list, hierarchical aggregation weight, node contribution, malicious node mark and global model performance, and broadcasts it to the blockchain network after signing; Each participant generates a zero-knowledge proof, which adopts a concise non-interactive knowledge proof scheme based on the Groth16 protocol. The proof content includes the correctness of differential privacy noise injection, the compliance of training data, and the authenticity of uploaded gradients. The core enterprise judges whether the global model has converged. If the rate of change of the global verification loss and the global verification accuracy are both less than the preset convergence threshold for multiple consecutive rounds, the training ends. Otherwise, S3 to S6 are repeated.

[0016] The beneficial effects of this invention are as follows: A hierarchical federated learning framework adapted to the supply chain structure was constructed, dividing participants into three layers: core enterprises, Tier 1 suppliers, and Tier 2 suppliers. Gradient aggregation is completed within each layer before being passed upwards, which aligns with the natural collaborative model of the supply chain. Combined with gradient sensitivity analysis based on the Fisher information matrix, a hybrid encryption strategy of Paillier homomorphic encryption, BFV homomorphic encryption, and secure aggregation protocol is adopted for key gradients, important gradients, and minor gradients, respectively. This concentrates computational resources on high-impact parameters, reducing overall computational overhead while ensuring strong privacy protection, thus solving the problem of balancing privacy protection and efficiency. By introducing a blockchain smart contract system and deploying node management contracts, privacy budget management contracts, reputation scoring contracts, and malicious detection contracts, dynamic access and exit management of supplier nodes, fine-grained allocation and tracking of differential privacy budgets, and real-time detection and isolation of malicious gradients are achieved. Combined with a zero-knowledge proof mechanism based on the Groth16 protocol, all participants can prove the compliance of the training process to the auditor without exposing the original data, providing end-to-end trusted auditing capabilities for supply chain collaboration and meeting regulatory compliance requirements. Attached Figure Description

[0017] Figure 1 This is a flowchart of a privacy data protection method for the supply chain according to the present invention; Figure 2 This is a flowchart of a privacy data protection method for the supply chain according to the present invention. Detailed Implementation

[0018] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0019] At least one embodiment of the present invention discloses a privacy data protection method for the supply chain, such as... Figures 1 to 2 As shown, it includes the following steps: S1 collects supply chain hierarchical relationships and participant identity information, deploys a layered network topology and blockchain smart contract system, and outputs an initialized supply chain privacy collaborative network; Based on the hierarchical structure of the automotive manufacturing supply chain, participants are divided into three tiers. The first tier comprises core enterprise nodes, namely automotive manufacturers, possessing vehicle production data and market demand data. The second tier consists of a set of Tier 1 supplier nodes, including 15 companies such as engine suppliers, transmission suppliers, and chassis suppliers, possessing component production and inventory data. The third tier comprises a set of Tier 2 supplier nodes, including 80 companies such as steel suppliers, rubber suppliers, and electronic component suppliers, possessing raw material supply and production capacity data. This hierarchical division aligns with the natural collaborative model of the supply chain: upper-tier companies place orders with lower-tier companies, and lower-tier companies supply goods to upper-tier companies; data collaboration should also proceed layer by layer along the hierarchical relationship.

[0020] In the network topology design, trusted aggregation nodes are deployed at each level. Four aggregation nodes are deployed at the second-tier vendor level, each responsible for gradient aggregation tasks from approximately 20 second-tier vendors. Two aggregation nodes are deployed at the first-tier vendor level, each responsible for aggregation tasks from different categories of vendors. The aggregation nodes are operated by independent third-party trusted computing service providers and deployed in a trusted execution environment. This invention leverages the isolated execution characteristics of this environment to ensure the confidentiality of the hybrid encrypted aggregation computation process, preventing the aggregation node operators from obtaining intermediate computation results during gradient aggregation. High availability is achieved among the aggregation nodes through a redundancy backup mechanism; when an aggregation node fails, a backup node automatically takes over its tasks. Each participating party connects to the corresponding level's aggregation node via a dedicated network, and network communication is encrypted using transport layer security protocols.

[0021] This invention initializes a consortium blockchain network, leveraging the permissioned access mechanism and immutable ledger characteristics of consortium blockchains to provide a trusted environment for evidence storage and smart contract execution for multi-party collaborative training. The core enterprise and five major Tier 1 suppliers act as consensus nodes, responsible for transaction verification and block generation. Other suppliers act as light nodes, capable of querying blockchain data but not participating in the consensus process. The blockchain employs a practical Byzantine fault-tolerant algorithm as its consensus mechanism, which can tolerate no more than one-third of malicious nodes, making it suitable for consortium blockchain scenarios. The block generation time is set to 5 seconds to ensure fast transaction confirmation while avoiding frequent consensus overhead.

[0022] The smart contract system deployed on the blockchain includes five core contract types. The node management contract handles the onboarding and offboarding registration of supplier nodes. When a new supplier applies to join the collaborative network, it needs to submit materials such as enterprise identity authentication information, data quality assessment reports, and historical supply chain collaboration records. The smart contract automatically verifies the authenticity of these materials and calculates an initial reputation score. Only suppliers whose initial reputation score reaches the onboarding threshold can gain participation rights. The privacy budget management contract allocates differential privacy budget quotas to each participant. The total budget quota is set according to the privacy protection requirements of the collaborative task. Each participant's initial quota is proportional to its data size and initial reputation score, and the quota allocation is dynamically adjusted based on actual consumption during subsequent training. The model evidence storage contract records key information such as the global model hash value, training round, participating node list, and aggregation weights for each round of federated learning, ensuring the traceability of the training process. The reputation score contract maintains the dynamic reputation score of each participant, updating the score based on factors such as contribution, data quality, and whether it is marked as malicious in each training round. The reputation score affects the node's aggregation weight and privacy budget quota in subsequent rounds. The malicious detection contract receives reports of suspected malicious behavior submitted by aggregated nodes, records the behavioral characteristics of the marked nodes, and triggers a penalty mechanism when a node's cumulative number of markings exceeds a threshold, lowering its reputation score or removing it from the collaborative network.

[0023] Each participant generates a two-layer key system. The identity key pair is generated using the elliptic curve digital signature algorithm. The public key serves as a unique identifier for each node on the blockchain and is registered with the node management contract. The private key is securely stored locally by the node and used to sign transactions and data to prove identity. The data key pair is generated using the Paillier homomorphic encryption algorithm. The aggregation node generates a Paillier public-private key pair. The public key is distributed to each participant for encrypting gradient data, and the private key is kept by the aggregation node for decrypting the aggregation result. The Paillier key length is set to 2048 bits, striking a balance between security and computational efficiency. Each participant also generates a random seed for the secure aggregation protocol. The seed is generated by a cryptographically secure random number generator and used to subsequently generate the mask vector.

[0024] After initialization, each participant's initial reputation score is set to a standard value, with suppliers having extensive historical collaboration experience receiving a slightly higher initial score. The node management contract publishes the current collaborative network topology on the blockchain, including the number of nodes at each level, aggregate node addresses, and the list of blockchain consensus nodes, allowing all participants to query the network status.

[0025] S2, obtain the privacy budget quota and local sensitive data issued by the initial cooperative network, and output the privacy-protected training dataset by adopting the differential privacy noise injection mechanism; Each participating party extracts raw data for demand forecasting from its local business systems. The core enterprise extracts historical vehicle sales data, including monthly sales volume, model distribution, regional distribution, and seasonal fluctuations, while also extracting external characteristics such as macroeconomic indicators like GDP growth rate and disposable income. Tier 1 suppliers extract historical component order data, including order volume, order delivery cycle, inventory turnover rate, and production qualification rate. Tier 2 suppliers extract raw material supply data, including supply volume, supply price fluctuations, inventory levels, and capacity utilization. The raw data from all parties spans the past 36 months and is organized by monthly granularity.

[0026] The raw data undergoes cleaning and preprocessing. Missing values ​​are identified and handled; for missing values ​​in time series data, linear interpolation is used to fill them, taking into account the seasonality of the data. Outliers are detected using a local outlier-based anomaly detection algorithm, calculating the degree of outlier for each data point relative to its neighborhood; data points with an outlier degree exceeding a set threshold are marked as outliers. Outliers are corrected or deleted; if the proportion of outliers is less than 5% of the total data, outlier samples are deleted; if the proportion is high, a smoothing method is used to correct the outliers.

[0027] Feature engineering was performed to extract multi-dimensional feature vectors from the raw data. Time-series features were extracted, including moving averages, exponentially weighted moving averages, and decompositions of trend and seasonal components for historical order volumes. Statistical features were extracted, including descriptive statistics such as mean, variance, skewness, and kurtosis of order volumes, as well as rate-of-change features such as year-on-year and month-on-month growth rates. Correlation features were extracted by analyzing the relationships between upstream and downstream suppliers to construct supply chain network topology features, such as graph features like degree centrality and betweenness centrality. For core enterprises, correlation features between external macroeconomic characteristics and sales data were also extracted. After feature extraction, a feature vector containing approximately 50 feature dimensions was constructed for each participant.

[0028] The extracted features are assessed for sensitivity, categorized into three levels: high sensitivity, medium sensitivity, and low sensitivity. High-sensitivity features include those directly reflecting trade secrets, such as order prices, profit margins, inventory costs, and raw material procurement prices; leakage of these features would cause significant business losses. Medium-sensitivity features include those reflecting the company's operational status, such as order volume, inventory levels, and capacity utilization rates; these features have some commercial value but are less sensitive than high-sensitivity features. Low-sensitivity features include descriptive features such as delivery cycles, geographical location, and industry category; leakage of these features will not cause significant business losses. Based on the feature sensitivity level, differentiated privacy protection levels are assigned to features of different sensitivity.

[0029] Query the privacy budget management contract on the blockchain to obtain the total privacy budget allocation and consumed budget for this node in the current training task. The privacy budget is represented by the epsilon parameter in the differential privacy framework. A smaller epsilon value indicates higher privacy protection but lower data availability. Assuming a certain level of provider node has a total privacy budget allocation of epsilon equal to 10, the budget needs to be allocated reasonably across multiple training rounds. In the first round of training, the budget allocated to this node is one-tenth of the total budget, i.e., epsilon equals 1. This node needs to allocate the budget in this round among different sensitivity features: high-sensitivity features are allocated epsilon equal to 0.5, medium-sensitivity features are allocated epsilon equal to 0.3, and low-sensitivity features are allocated epsilon equal to 0.2, satisfying the combinatorial property of the privacy budget.

[0030] Differential privacy protection is achieved by adding Laplace noise to feature data based on the allocated privacy budget and feature sensitivity. For highly sensitive features, the noise scale parameter is calculated based on the feature's global sensitivity and privacy budget. Global sensitivity is defined as the maximum impact of a change in a single record on the feature value, estimated by analyzing the feature's value range and magnitude of change. Random noise following a Laplace distribution is generated, with the probability density function centered at 0, and the scale parameter is the global sensitivity divided by the privacy budget. The generated noise is added to the feature values ​​to obtain noisy feature values. For moderately and low-sensitivity features, the same noise addition process is used, but due to the larger allocated privacy budget, the noise scale is relatively small, resulting in a lower impact on data usability. For low-sensitivity features, if the allocated privacy budget is very sufficient, it is possible to choose not to add noise or add minimal noise, maximizing data utility while ensuring privacy protection.

[0031] The noisy feature data is normalized to map all feature values ​​to the range of 0 to 1. The normalization method uses min-maximum normalization: for each feature, the minimum and maximum values ​​of that feature across all samples are calculated, and then the feature value for each sample is subtracted from the minimum value and divided by the difference between the maximum and minimum values. Normalized data eliminates differences in the units and ranges of different features, facilitating subsequent model training.

[0032] The processed data is divided into training and validation sets in an 8:2 ratio. The training set is used for local model training, and the validation set is used to evaluate the local model's performance. Random sampling is used during the partitioning to ensure that the data distribution of the training and validation sets is consistent. For time series data, a time segmentation method can also be used, using the first 80% of the time period as the training set and the last 20% as the validation set, which better reflects the actual scenario of time series prediction.

[0033] The privacy budget consumption for this training round is calculated. Based on the combinatorial properties of differential privacy, the total consumption equals the sum of the consumptions of each feature. The privacy budget consumption record is submitted to the blockchain's privacy budget management contract. The contract verifies the accuracy of the consumption calculation and updates the node's cumulative consumption. The contract checks if the cumulative consumption exceeds the total quota. If it does not exceed the quota, the training round can proceed normally; if it approaches or exceeds the quota, a warning is issued to the node or its participation in subsequent training is suspended. The privacy budget management contract's records are visible to all participants, achieving transparency and auditability in the use of the privacy budget.

[0034] S3 receives a privacy-preserving training dataset, uses the Fisher information matrix gradient sensitivity analysis method, and outputs hierarchical gradient update amount and local model quality score. The core enterprise initializes a global demand forecasting model using a Long Short-Term Memory (LSTM) neural network architecture, suitable for time series forecasting tasks. The model consists of an input layer, two LSM layers, a fully connected layer, and an output layer. The input layer receives a 50-dimensional feature vector, with each feature corresponding to an input node. The first LSM layer contains 128 hidden units, capable of learning long-term dependencies in the time series. The second LSM layer contains 64 hidden units, further extracting high-level time series features. The fully connected layer contains 32 neurons, performing a non-linear transformation on the output of the LSM layers. The output layer contains one neuron, outputting the demand forecast for the next three months. The activation functions used in the LSM layers are sigmoid and tanh, the fully connected layer uses ReLU, and the output layer uses a linear activation function. The model parameters are initialized using the Xavier method to ensure stable gradient propagation during the initial training phase.

[0035] The core enterprise packages the initialized global model parameters and distributes them to all participants through aggregation nodes. The model parameters include the weight matrices and bias vectors for each layer, with a total of approximately 200,000 parameters. Parameters are compressed during transmission, and model quantization technology is used to convert floating-point parameters into a lower-precision representation. The compressed parameter size is approximately one-quarter of the original size, reducing network transmission overhead.

[0036] After receiving the global model parameters, each participant trains the model on its local training dataset. Training employs a mini-batch stochastic gradient descent algorithm, with each mini-batch containing 32 samples (adjustable between 16 and 128 depending on local memory resources). The loss function is the mean squared error loss, measuring the difference between the model's predicted values ​​and the actual required values. The optimizer uses momentum-driven stochastic gradient descent with a momentum coefficient set to 0.9 to accelerate convergence and escape local optima. The learning rate is set to 0.01 (adjustable between 0.001 and 0.1 depending on data size and convergence speed) and remains constant throughout training. Each participant trains locally for 5 epochs (adjustable between 3 and 10 depending on convergence speed), meaning the training dataset is traversed completely 5 times.

[0037] During local training, the gradient history of each parameter is recorded. For each parameter, its gradient value is calculated in each training step and saved to the gradient history cache. Statistical characteristics of the gradient for each parameter are calculated, including the time average, time variance, mean, and maximum gradient magnitude. These statistical characteristics reflect the importance of the parameter during training; parameters with large and rapidly changing gradient magnitudes have a greater impact on model convergence.

[0038] After local training is complete, the gradient update amount of the local model parameters relative to the global model parameters is calculated. The gradient update amount equals the parameter values ​​after local training minus the global parameter values ​​before training, then divided by the learning rate and the number of local training epochs to obtain the average gradient. The gradient update amount vector has the same dimension as the global parameter vector and contains approximately 200,000 gradient values.

[0039] Sensitivity analysis of gradients is performed to identify key gradient parameters that significantly impact model performance. A Fisher information matrix-based method is used to evaluate gradient importance. The Fisher information matrix measures the sensitivity of model parameters to the loss function; a larger Fisher information value for a parameter indicates that a small change in that parameter leads to a larger change in the loss function, and thus a greater impact on model performance. Unlike existing federated learning privacy protection schemes that apply uniform encryption strength to all gradients, this invention directly binds Fisher information values ​​to differentiated encryption strategies, concentrating computational resources on high-impact parameters and achieving a better trade-off between privacy protection and model utility within the same computational budget. The approximate value of the diagonal elements of the Fisher information matrix is ​​calculated as follows: a certain number of samples are randomly selected from the validation dataset. For each sample, forward propagation is used to calculate the model output and loss value, and back propagation is used to calculate the gradient of the loss function with respect to each parameter. The square of the gradient is calculated, and the average of the squared gradients over all samples is used to obtain the approximate Fisher information value for each parameter.

[0040] The gradient parameters are ranked by importance based on Fisher information values. The 200,000 gradient parameters are sorted from highest to lowest Fisher information value. The top 30%, approximately 60,000 parameters, are selected as critical gradients, which have the greatest impact on model performance and require the strongest privacy protection. The middle 40%, approximately 80,000 parameters, are selected as important gradients, which have some impact on the model and require moderate privacy protection. The remaining 30%, approximately 60,000 parameters, are selected as minor gradients, which have less impact on the model and can be protected with weaker privacy measures. The gradient sensitivity ranking results are saved along with the gradient vectors for subsequent differential encryption processing.

[0041] Calculate the performance metrics of the local model on the validation dataset, which serve as the local data quality score. Performance metrics include mean squared error loss, mean absolute error, and prediction accuracy. A lower loss value indicates a better fit of the model to the local data, indirectly reflecting higher local data quality. Simultaneously, calculate the correlation coefficient between the model's predicted values ​​and the actual values; a correlation coefficient closer to 1 indicates a closer consistency between the model's predicted trend and the actual trend. Normalize these performance metrics to a range of 0 to 1, and then comprehensively calculate the local data quality score. The quality score formula is: accuracy metric weight multiplied by accuracy plus correlation coefficient weight multiplied by correlation coefficient minus loss metric weight multiplied by normalized loss value. The weights are adjusted according to task requirements.

[0042] Each participating party packages information such as gradient update amount, gradient sensitivity classification, local data quality score, and number of local training samples, preparing to upload it to the aggregation node. Before uploading, the packaged data is digitally signed using the node's private key to ensure the authenticity and integrity of the data source. The signed data packet includes the original data content, signature value, node identity public key hash value, timestamp, and other fields.

[0043] S4, based on the hierarchical gradient update quantity and quality score, adopts a hybrid encrypted aggregation and malicious gradient detection mechanism to output hierarchical aggregation gradient and aggregation statistics; Each participant categorizes gradients based on their sensitivity and employs differentiated encryption strategies for different gradient categories. For critical gradients, the Paillier homomorphic encryption algorithm is used. The Paillier algorithm is an additive homomorphic encryption scheme that supports addition and scalar multiplication of ciphertext. Aggregator nodes can calculate the weighted sum of encrypted gradients without decryption. The encryption process is as follows: For each element in the critical gradient vector, encryption is performed using the aggregation node's Paillier public key, which contains the modulus n and generator g. The encryption algorithm first maps the gradient values ​​to the integer field and then calculates the ciphertext, which involves modular exponentiation. The encrypted critical gradient ciphertext vector contains approximately 60,000 ciphertext elements, each ciphertext being 2048 bits long.

[0044] For critical gradients, a BFV homomorphic encryption scheme based on on-ring learning and error problems is adopted. This scheme has lower computational complexity and faster encryption and decryption speeds compared to the Paillier algorithm. The ciphertext modulus is set to 128 bits, supporting the additive homomorphic operations required for a single aggregation in the federated learning process of this invention. During encryption, the gradient value is added to a small noise, and then matrix multiplied with the public key matrix to obtain the ciphertext vector. The ciphertext length is approximately twice that of the plaintext, resulting in a lower ciphertext expansion rate compared to Paillier. BFV encryption is applied to approximately 80,000 critical gradient parameters to generate critical gradient ciphertext vectors.

[0045] For minor gradients, a secure aggregation protocol is used instead of direct encryption. The principle of the secure aggregation protocol is that each participant adds the actual gradient to a random mask and uploads the result. The aggregation node summarizes the mask gradients of all nodes. Since the random masks cancel each other out during aggregation, the final result is the sum of the actual gradients. Specifically, each participant generates a random mask vector with the same dimension as the minor gradient, and each element of the random mask is sampled from a uniform distribution. The minor gradient vector is added element-wise to the random mask vector to obtain the mask gradient vector. To ensure that the random masks cancel each other out during aggregation, the participants need to negotiate the generation rules of the random masks, using a pairwise random mask method: for any two nodes at the same level, they generate a pair of opposite random masks. When the mask gradients of these two nodes are added at the aggregation node, the pairwise random masks cancel each other out. The generation of the pairwise random masks is based on a shared key between the two parties, which is pre-negotiated through a Diffie-Hellman key exchange protocol. Each participant calculates a pairwise random mask with all other nodes at the same level, and then sums all the pairwise masks to obtain the final random mask vector. When a participant goes offline during the upload phase, the aggregation node detects that the node has not submitted a data packet within the specified time and marks it as an absent node for this round. When other nodes generate pairwise random masks, if the corresponding node has been marked as absent, they do not generate a pairwise mask with that node, but only with online nodes. The aggregation node only performs aggregation on nodes that have successfully uploaded data packets. Absent nodes do not participate in this round of aggregation, and their reputation scoring contract synchronously records their absence behavior in this round, affecting the aggregation weight allocation in subsequent rounds.

[0046] Each participating party packages the encrypted key gradient ciphertext, important gradient ciphertext, masked secondary gradient, along with local data quality scores, number of training samples, current training epoch, node identity signature, and other information into a data packet, and uploads it to the corresponding aggregation node. The data packet is encrypted using a transport layer security protocol during network transmission to prevent eavesdropping and tampering attacks.

[0047] After receiving data packets uploaded by each participant, the aggregation node first verifies the integrity and authenticity of the data packets. It verifies the digital signature using the node's public key to confirm that the signature matches the data content, thus confirming that the data indeed comes from the claimed sender and has not been tampered with. It also verifies the timestamp to ensure that the data packet was generated within the current training epoch; expired data packets are rejected. After successful verification, it extracts gradient data and metadata information from the data packet.

[0048] Aggregator nodes perform malicious gradient detection to identify potential malicious nodes. For minor gradients, due to the secure aggregation protocol, the aggregation node cannot see the true gradient before pairwise mask cancellation, but it can detect the statistical characteristics of the mask gradient. It calculates the mean and standard deviation of the mask gradients of all nodes at the same level, identifying anomalous gradients that deviate excessively from the mean. If the norm of a node's mask gradient exceeds the mean plus three times the standard deviation, it is marked as a suspected anomaly. For critical and important gradients, although they are encrypted, the norm of the ciphertext gradient can be calculated using the properties of homomorphic encryption. Norm calculation is achieved through homomorphic operations without decrypting the gradient content. It calculates the ciphertext norm of each node's encrypted gradient and compares it with the historical statistical distribution of gradient norms at that level. If a node's gradient norm significantly exceeds the normal range, it is marked as a suspected malicious gradient.

[0049] For gradients marked as potentially malicious, the aggregation node takes isolation measures. Suspected malicious gradients are excluded from the current aggregation round and do not participate in subsequent weighted aggregation calculations. A malicious behavior report is generated, recording the identity of the marked node, description of abnormal characteristics, detection time, and other information, and the report is submitted to the malicious detection smart contract on the blockchain. After receiving the report, the smart contract updates the abnormal behavior count of the marked node. If a node's cumulative number of markings exceeds a threshold across multiple training rounds, the contract automatically lowers the node's reputation score and may trigger further penalty measures.

[0050] For normal gradients that pass the detection, the aggregation nodes perform weighted aggregation. The calculation of aggregation weights comprehensively considers three factors: data size, data quality score, and historical reputation score. The number of training samples is extracted from the metadata uploaded by each participant as a data size indicator, the local model performance score is extracted as a data quality indicator, and the latest reputation score of each node is queried from the blockchain's reputation scoring contract. Adaptive aggregation weights are calculated using the formula: weight equals data size coefficient multiplied by normalized data size plus quality coefficient multiplied by normalized quality score plus reputation coefficient multiplied by normalized reputation score, where the sum of the three coefficients equals 1. In this embodiment, the data size coefficient is set to 0.4, the quality coefficient is set to 0.4, and the reputation coefficient is set to 0.2, reflecting the priority of data size and quality. Normalization maps each indicator to the 0-1 range. The normalization method is to divide the indicator value of each node by the sum of the indicator values ​​of all nodes. The aggregation weight of each participant is calculated, and the sum of all weights equals 1.

[0051] Homomorphic encryption aggregation is performed on the key gradients. The weighted aggregation result is directly computed over the Paillier-encrypted ciphertext domain. For each element of the gradient vector, the weighted sum of the ciphertext of that element across all nodes is calculated. This weighted sum is achieved through homomorphic operations: first, a scalar multiplication is performed on the ciphertext of each node, multiplying the ciphertext by the aggregation weight of that node to obtain the weighted ciphertext; then, homomorphic addition is performed on the weighted ciphertexts of all nodes to obtain the aggregated ciphertext. Due to the homomorphic nature of Paillier encryption, the decrypted aggregated ciphertext is equal to the weighted sum of the plaintext gradients of all nodes. This homomorphic aggregation operation is performed on all elements of the key gradient vector to obtain the aggregated ciphertext vector of the key gradients.

[0052] Lightweight cryptographic aggregation is performed on important gradients. The lightweight cryptographic scheme also supports additive homomorphism; the aggregation process is similar to that of key gradients, calculating a weighted sum over the ciphertext domain. Because the lightweight scheme has lower ciphertext computation overhead, important gradient aggregation is faster than key gradient aggregation.

[0053] A secure aggregation protocol is used to summarize the minor gradients. The aggregation node collects the mask gradients uploaded by all participants and sums the gradient elements at the same positions. Since the paired random masks used by each participant cancel each other out during summation, the sum equals the sum of the true minor gradients of all nodes. Dividing the gradient sum by the number of participating nodes yields the average of the minor gradients. If weighted aggregation is needed instead of a simple average, it can be transformed into a weighted sum: when generating the mask gradient, each participant first multiplies its true gradient by its own normalized weight before adding the mask; the aggregation node then sums the results into a weighted sum instead of a simple sum.

[0054] The aggregation node uses its private key to decrypt the aggregated ciphertext of critical and important gradients, obtaining the plaintext aggregation result. The decryption operation uses the decryption functions corresponding to the Paillier algorithm and the lightweight algorithm, resulting in a floating-point vector. The aggregation results of critical, important, and minor gradients are then concatenated to form a complete hierarchical aggregated gradient vector.

[0055] The aggregation node records metadata information for this round of aggregation, including the number of participating nodes, the list of excluded malicious nodes, the aggregation weight of each node, and the aggregation time. This information will be uploaded to the blockchain for evidence storage in subsequent steps.

[0056] S5, based on the hierarchical aggregation gradient and the local training gradient, adopts a quality-weighted scale adaptive cross-layer aggregation strategy to output a new round of global model parameters; After completing internal aggregation at the second-tier supplier layer, the aggregation nodes prepare to pass the aggregation gradient to the upper layer. Before passing it, the aggregation nodes calculate the statistical information for their layer, including the total number of second-tier suppliers participating in the aggregation, the total data size of the layer, the average data quality score of the layer, and the norm of the aggregation gradient. The total data size of the layer is equal to the sum of the number of training samples of all participating nodes, and the average quality score of the layer is equal to the weighted average of the quality scores of all nodes, with the weights being the proportion of each node's data size.

[0057] The secondary supplier layer aggregation nodes package the aggregated gradient vector and hierarchical statistics and pass them to the primary supplier layer aggregation nodes. During transmission, the aggregated gradient does not need to be encrypted again because it is already the aggregated result and does not directly correspond to the original data of any individual participant, thus minimizing the risk of privacy breaches. However, to prevent tampering during transmission, the transmitted data packets are hash-signed, and the receiver verifies the hash value to ensure data integrity.

[0058] The aggregation nodes at the first-tier supplier layer receive aggregation gradients and statistical information from the second-tier supplier layer. These aggregation nodes also possess the aggregation gradients from the first-tier supplier nodes at their own level. The first-tier supplier layer aggregation nodes need to perform cross-layer aggregation on these two gradients to generate a comprehensive gradient that includes information from both first-tier and second-tier suppliers.

[0059] Cross-layer aggregation employs an adaptive weight allocation strategy based on quality-weighted scale. Traditional simple data size weighting may lead to layers with large but low-quality data dominating the aggregation result, affecting the overall model quality. This invention proposes a quality-weighted scale index, which multiplies data size by data quality as a comprehensive measure of layer contribution. The quality-weighted scale of the first-level supplier layer is calculated as the total data size of the first-level layer multiplied by the average quality score of the first-level layer. The quality-weighted scale of the second-level supplier layer is calculated as the total data size of the second-level layer multiplied by the average quality score of the second-level layer. Based on the quality-weighted scales of the two layers, the cross-layer aggregation weight is calculated: the weight of the first-level layer is equal to the quality-weighted scale of the first-level layer divided by the sum of the quality-weighted scales of the two layers, and the weight of the second-level layer is equal to 1 minus the weight of the first-level layer.

[0060] To prevent a single level from completely dominating aggregation due to excessive data volume, a weight cap mechanism is implemented. The aggregation weight of any level cannot exceed 0.6. If the calculated weight exceeds this cap, it is truncated to 0.6, and the weight of the other level is adjusted accordingly to 0.4, ensuring the total weight is 1. The weight cap can be adjusted between 0.5 and 0.7 based on the number of supply chain levels and data distribution characteristics. In this embodiment, it is set to 0.6. This allows the level with better data quality to gain moderate dominance while ensuring that both levels contribute substantially, and prevents a single level from completely dominating when data sizes differ significantly.

[0061] The first-level supplier layer aggregation node uses the calculated cross-layer weights to perform a weighted sum of the first-level and second-level aggregation gradients. For each element of the gradient vector, the first-level element is multiplied by its first-level weight, and the second-level element is multiplied by its second-level weight to obtain the corresponding element of the cross-layer aggregation gradient. After performing a weighted sum of all elements, the cross-layer aggregation gradient vector of the first-level supplier layer is obtained.

[0062] The aggregation node calculation for the Tier 1 supplier layer includes comprehensive statistical information from both Tier 1 and Tier 2 suppliers. The total comprehensive data size equals the sum of the total data size of Tier 1 and Tier 2. The comprehensive average quality score equals the sum of the average quality of Tier 1 multiplied by the proportion of Tier 1 data size plus the sum of the average quality of Tier 2 multiplied by the proportion of Tier 2 data size. The total number of participating nodes equals the sum of the number of participating nodes in both tiers.

[0063] The first-tier supplier-level aggregation nodes package cross-layer aggregation gradients and comprehensive statistical information and pass them to the core enterprise nodes. The core enterprise, as the coordinator of the supply chain and the maintainer of the global model, is responsible for the final global aggregation and model updates.

[0064] The core enterprise node receives cross-layer aggregated gradients from the Tier 1 supplier layer, which already incorporate comprehensive information from both Tier 1 and Tier 2 suppliers. The core enterprise also possesses its own local training gradients, trained based on its vehicle sales and market demand data. The core enterprise needs to perform a final aggregation of the supplier aggregated gradients with its own gradients to generate the global model gradient.

[0065] During final aggregation, the core enterprise, as the key coordinator of the supply chain, has data with a high direct correlation to demand forecasting, thus receiving preferential treatment in aggregation weight allocation. The core enterprise's quality-weighted scale is multiplied by an enhancement factor of 1.2 to reflect the priority of its data. The adjusted quality-weighted scale of the core enterprise is calculated as the core enterprise's data size multiplied by its quality score, then multiplied by 1.2. The supplier's quality-weighted scale is calculated as the comprehensive quality-weighted scale calculated by the aforementioned first-level aggregation nodes. Based on the quality-weighted scales of both parties, the final aggregation weight is calculated: the core enterprise's weight equals its adjusted quality-weighted scale divided by the total quality-weighted scale, and the supplier's weight equals 1 minus the core enterprise's weight.

[0066] The core enterprise uses the final aggregation weight to perform a weighted sum of the supplier aggregation gradient and its own gradient to obtain the global model gradient. The global gradient integrates data information from all levels of the supply chain, including raw material supply information from second-tier suppliers, component production information from first-tier suppliers, and vehicle sales and market demand information from the core enterprise, thus achieving data synergy across the entire supply chain.

[0067] The core enterprise uses global gradients to update global model parameters. The Adam optimizer is employed for parameter updates. The Adam optimizer combines momentum methods and adaptive learning rate adjustment, accelerating convergence and improving training stability. The Adam optimizer maintains first-moment and second-moment estimates for each parameter. The first-moment estimate is an exponential moving average of the gradient, and the second-moment estimate is an exponential moving average of the squared gradient. During parameter updates, an adaptive learning rate is calculated based on the first and second moments. A smaller learning rate is used for parameters with drastic gradient changes, and a larger learning rate is used for parameters with gradual gradient changes. The initial learning rate of the Adam optimizer is set to 0.001, the first-moment decay factor is set to 0.9, and the second-moment decay factor is set to 0.999.

[0068] The core enterprise uses global gradient and the Adam optimizer to calculate parameter update amounts, which are then added to the current global model parameters to obtain the updated global model parameters. Parameter updates are performed in the gradient descent direction, meaning parameter values ​​move along the negative direction of the gradient, gradually reducing the loss function.

[0069] The core enterprise performs performance evaluation on the updated global model. The evaluation uses a global validation dataset, which consists of validation data samples provided by each participant. To protect the privacy of the validation data, a secure multi-party computation protocol is used to calculate the global validation performance. Each participant uses the updated global model locally to predict on their local validation set, calculates the local validation loss and accuracy, and then adds the local validation metrics to a random mask before uploading them to the core enterprise. The core enterprise aggregates the masked validation metrics from all participants, cancels out the random masks to obtain the sum of the global validation metrics, and divides this sum by the number of participants to obtain the average global validation metric. The global validation loss reflects the model's fit to the entire supply chain data, and the global validation accuracy reflects the accuracy of the model's predictions.

[0070] The core enterprise records the performance metrics of the global model, including training loss, validation loss, and validation accuracy, to determine whether the model has converged and for subsequent blockchain-based evidence storage.

[0071] The core enterprise packages the updated global model parameters and distributes them to participants at all levels through aggregation nodes. Versioning is performed during parameter distribution, using the current training epoch as the version number to ensure consistency in the model versions received by all participants. Parameters are compressed and encrypted before transmission; compression reduces the amount of data transmitted, and encryption prevents eavesdropping during transmission. Each participant receives the new round of global model parameters, saves them locally, and prepares for the next round of local training.

[0072] S6 receives a new round of global model parameters, adopts a blockchain notarization and zero-knowledge proof compliance verification mechanism, and outputs auditable collaborative training records and the final global model. The core enterprise performs hash calculations on the updated global model parameters to generate a unique identifier for the model. Using the SHA256 hash algorithm, the model parameters are serialized into a byte stream, and the hash value of the byte stream is calculated to obtain a 256-bit model hash value. This model hash value serves as the digital fingerprint of the model version; even a slight change in any parameter will result in a completely different hash value, ensuring the uniqueness and verifiability of the model version.

[0073] The core enterprise constructs blockchain-based notarized transactions, with the transaction content including multiple fields. The model hash field records the SHA256 hash value of the global model parameters. The training round field records the current federated learning iteration round. The timestamp field records the time the notarized transaction was generated. The participating node list field records the identities of all participants in this training round. The hierarchical aggregation weight field records the weight distribution of each level in cross-level aggregation. The node contribution field records the contribution of each participant in this training round, calculated based on the node's data size, quality score, and aggregation weight. The malicious node label field records the list of nodes marked as potentially malicious in this round and their abnormal behavior descriptions. The global model performance field records performance metrics such as global verification loss and verification accuracy.

[0074] The core enterprise uses its own identity private key to digitally sign notarized transactions, employing an elliptic curve digital signature algorithm. The signing process first calculates a hash value for the transaction content, then uses the private key to sign the hash value, generating a signature value. This signature value is appended to the transaction, ensuring its authenticity and non-repudiation. Anyone can use the core enterprise's public key to verify the signature, confirming that the transaction was indeed issued by the core enterprise and has not been tampered with.

[0075] The core enterprise broadcasts the signed, notarized transaction to the blockchain network. Upon receiving the transaction, the consensus nodes in the blockchain network first verify its legality. This includes verifying the validity of the digital signature to confirm the transaction originated from the core enterprise, verifying that the transaction format conforms to the notarized transaction specifications, and verifying that the training rounds in the transaction are consistent with the current network state to prevent duplicate or skipped submissions. After successful verification, the consensus nodes place the transaction in the transaction pool, awaiting packaging into a block.

[0076] The blockchain network uses the Practical Byzantine Fault-Tolerant (PBFT) consensus algorithm to generate new blocks. The consensus process consists of three phases: the pre-preparation phase, the preparation phase, and the commit phase. In the pre-preparation phase, the masternode selects a batch of transactions from the transaction pool, packages them into a block, and broadcasts the pre-preparation message to other consensus nodes. In the preparation phase, each consensus node verifies the block in the pre-preparation message; if verification passes, it broadcasts the preparation message to other nodes. In the commit phase, when a node receives more than two-thirds of the preparation messages, it broadcasts a commit message to other nodes, indicating that the node agrees to add the block to the blockchain. When a node receives more than two-thirds of the commit messages, it officially adds the block to its local blockchain ledger. Due to the use of PBFT consensus, even if less than one-third of the nodes in the network are malicious, honest nodes can still reach a consensus on the block content, ensuring the consistency and reliability of the blockchain.

[0077] Once a new block is added to the blockchain, the notarized transaction is permanently recorded in the distributed ledger. All participants can query the block to verify the notarized content. The immutability of the blockchain ensures the authenticity of the notarized record; any modification to a historical block will be detected and rejected by other nodes.

[0078] Smart contracts on the blockchain monitor the generation of new blocks. When a block containing evidence-based transactions is detected, the corresponding contract logic is automatically executed. The reputation scoring smart contract reads the node contribution and malicious node labeling information from the evidence-based transactions and updates the reputation scores of each participant. For nodes that participate normally in training and contribute significantly, their reputation scores increase proportionally to their contribution, with higher-contributing nodes experiencing larger increases. For nodes labeled as malicious, their reputation scores decrease dramatically, the magnitude of which is determined by the severity of the abnormal behavior. The updated reputation scores are recorded on the blockchain, forming the reputation history of each node, which is used for weight allocation and admission decisions in subsequent rounds. If a node's reputation score declines for several consecutive rounds and falls below the minimum threshold, the smart contract triggers a node removal mechanism, revoking the node's participation privileges and removing it from the collaborative network.

[0079] The privacy budget management smart contract reads the privacy budget consumption records of each participant in this round of training and updates the cumulative consumption of each party. The cumulative consumption equals the sum of historical consumption plus the consumption in this round. The smart contract checks whether the cumulative consumption of each node is close to or exceeds the total budget quota. If a node's cumulative consumption exceeds 80% of the total quota, the contract sends a warning to that node, indicating that its privacy budget is about to run out. If the cumulative consumption exceeds the total quota, the contract suspends the node's participation in subsequent training until the collaborative task ends or the budget is reallocated. For nodes with high reputation scores, the smart contract can dynamically increase their total budget quota to reward their good collaborative behavior. For nodes with declining reputation scores, the smart contract reduces their budget quota or allocates less budget to them in subsequent rounds to limit their participation.

[0080] Each participant downloads the latest global model parameters from the blockchain and tests the model performance on a local validation set. The rate of change of the local validation loss relative to the previous round is calculated; this rate of change equals the current round's loss minus the previous round's loss, then divided by the previous round's loss. If the rate of change is negative and its absolute value is large, it indicates a significant performance improvement on the local data. If the rate of change is close to zero or positive, it indicates slow or declining performance improvement on the local data, potentially indicating overfitting or other problems.

[0081] Each participating party generates a zero-knowledge proof to demonstrate to the auditor that its training process complies with privacy protection specifications, without exposing the original data and training details. The zero-knowledge proof employs a concise, non-interactive knowledge proof scheme based on the Groth16 protocol. This protocol allows the prover to generate a short proof, and the verifier to efficiently verify the correctness of the proof, without any interaction. The trusted setup phase involves the core enterprises and all consensus nodes in the blockchain consortium. A multi-party computation protocol is used to jointly generate a public reference string, ensuring the security of the setup phase as no single participant can independently obtain the complete random parameters. The setup phase is executed only once during the initialization of the collaborative network, and the same set of proof and verification keys is reused in subsequent training rounds. The proof includes three aspects: First, it proves that the local data preprocessing process correctly executed differential privacy noise injection, the noise scale conforms to the allocated privacy budget, and the privacy budget consumption record is authentic. Second, it proves that the data used in the local model training process is indeed privacy-protected data, the training algorithm executes according to the agreed process, and there is no tampering with the training process or injection of malicious data. Third, it proves that the uploaded gradient is indeed calculated based on the local training results, and there is no forged or tampered gradient data.

[0082] The generation process of zero-knowledge proofs involves complex cryptographic computations. The prover first defines a computational circuit, representing the computation to be proven as an arithmetic circuit. The circuit's inputs include privacy data, random noise, training parameters, etc., and its outputs include privacy budget consumption, gradient values, etc. The prover performs a setup phase on the computational circuit, generating a proof key and a verification key. This setup phase only needs to be executed once, and the key can be reused subsequently. The prover executes the computational circuit, running it with the actual input data and obtaining the output result. Using the proof key, the prover generates a zero-knowledge proof of the circuit's execution. The proof is a short piece of data, only a few hundred bytes in length, but it proves that the circuit executes correctly and the output result is true.

[0083] Each participating party submits the generated zero-knowledge proof to the blockchain. The proof is broadcast to the blockchain network as a transaction, which includes fields such as proof data, prover identity, training round, and timestamp. Blockchain consensus nodes verify the format and signature of the proof transaction, then package the transaction into a block and add it to the blockchain ledger. The zero-knowledge proof is permanently recorded on the blockchain, and anyone can query and verify it.

[0084] Regulatory authorities or third-party auditing firms access the blockchain and download the zero-knowledge proofs and evidence records submitted by each participant. The auditing firm uses a verification key to verify the correctness of the zero-knowledge proofs. The verification process takes only milliseconds, requires no interaction with the prover, and does not require access to the prover's original data. If the verification passes, the auditing firm confirms that the participant's training process complies with privacy protection specifications, adheres to differential privacy requirements, and that the uploaded gradients are authentic and reliable. If the verification fails, it indicates a problem with the participant's training process, possibly due to improper privacy protection or data forgery. The auditing firm can then require the participant to provide an explanation or impose penalties.

[0085] Auditing firms can also query the complete evidence-based records on the blockchain to trace the entire federated learning process. By querying the evidence-based transactions of each round, auditing firms can understand the participants in each training round, changes in model performance, detection of malicious nodes, and consumption of privacy budgets. By analyzing the trajectory of reputation score changes, auditing firms can assess the quality and trustworthiness of collaboration among the participants. The transparency and traceability provided by blockchain enable complete auditing capabilities for the supply chain collaboration process, meeting regulatory compliance requirements.

[0086] The core enterprise determines whether the global model has converged. Convergence is judged based on two criteria: First, the absolute value of the rate of change of the global validation loss for three consecutive rounds is less than a preset threshold (0.01), indicating that the loss value has almost stopped decreasing. Second, the improvement in the global validation accuracy for three consecutive rounds is less than a preset threshold (0.005), indicating that the accuracy is close to stabilization. If both criteria are met simultaneously, the model is considered to have converged, and the training process ends. If the convergence conditions are not yet met, and the current training round has not exceeded the maximum round limit, the next round of training continues, repeating steps S3 to S6 of the method of this invention. The maximum number of training rounds is set to 50. If convergence is not achieved after reaching the maximum number of rounds, training stops, and the current global model is output as the final model.

[0087] After training, the core enterprise will compile the final global model parameters, complete training logs, and blockchain-based evidence records to form a supply chain collaborative demand forecasting system. Each participating party will download the final model and deploy it into their respective business systems for actual demand forecasting tasks. When demand forecasting is required, each participating party will input its current characteristic data into the model, which will output demand forecasts for the next three months to assist all parties in making production planning and inventory management decisions.

[0088] This invention enables the training of a privacy protection demand prediction model in a multi-level collaborative supply chain scenario. The original sensitive data of each participant remains locally and is not leaked to other parties. A hierarchical federated learning architecture adapts to the hierarchical structure of the supply chain, reducing communication complexity and improving aggregation efficiency. A hybrid encryption strategy ensures strong privacy protection while reducing computational overhead and meeting real-time requirements. Blockchain smart contracts enable dynamic node management, reputation scoring, privacy budget allocation, and malicious detection, establishing a trust mechanism for multi-party collaboration. Zero-knowledge proofs provide end-to-end privacy auditing capabilities, meeting regulatory compliance requirements.

[0089] This invention was deployed and tested in a real-world automotive manufacturing supply chain, yielding authentic collaborative data. Table 1 shows examples of the initial data scale and characteristics of some participants, while Table 2 shows the key performance indicators during the training process.

[0090] Table 1. Examples of data scale and characteristics of participating parties Table 2, Examples of Key Performance Indicators During Training As the application examples show, with the increase in training rounds, the overall global validation loss continuously decreases, the overall global validation accuracy continuously improves, and the model performance is gradually optimized. In the 10th round, one malicious node was detected and excluded. The quality of the aggregation gradient in that round was temporarily affected, and the decrease in validation loss was slightly lower than expected. After isolating the malicious node, the performance in subsequent rounds returned to normal and improved. In the 20th round, two malicious nodes were detected and isolated simultaneously. The rate of decrease in validation loss also slowed down temporarily, verifying the actual protective effect of the malicious detection mechanism on the aggregation process. After the malicious nodes were removed, the performance improvement in subsequent rounds returned to normal, indicating that the malicious detection and isolation mechanism of this invention can effectively ensure the security of collaborative training. The average aggregation time gradually decreased with the training process, thanks to the computational optimization and network transmission optimization of the hybrid encryption strategy.

[0091] Through the method of this invention, the automotive manufacturing supply chain achieves collaborative privacy protection of multi-level supplier data. The trained demand forecasting model has achieved good results in practical applications, with a prediction accuracy of over 95%. The sensitive business data of each participant is effectively protected, and the overall collaborative efficiency of the supply chain is significantly improved.

[0092] This invention is not limited to the automotive manufacturing supply chain scenario. It can be applied to any supply chain collaboration scenario with a multi-level hierarchical structure and where participants have data privacy protection requirements. The number of levels, participants, aggregation nodes, and prediction model architecture can be flexibly adjusted according to specific industry scenarios. For example, in scenarios such as electronics manufacturing supply chains, pharmaceutical distribution supply chains, and fast-moving consumer goods supply chains, privacy-preserving collaborative training can be achieved within the framework of this invention by adjusting the hierarchical division and model structure.

[0093] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A privacy data protection method for the supply chain, characterized in that, Includes the following steps: S1 collects supply chain hierarchical relationships and participant identity information, deploys a layered network topology and blockchain smart contract system, and outputs an initialized supply chain privacy collaborative network; S2, obtain the privacy budget quota and local sensitive data issued by the initial cooperative network, and output the privacy-protected training dataset by adopting the differential privacy noise injection mechanism; S3 receives a privacy-preserving training dataset, uses the Fisher information matrix gradient sensitivity analysis method, and outputs hierarchical gradient update amount and local model quality score. S4, based on the hierarchical gradient update quantity and quality score, adopts a hybrid encrypted aggregation and malicious gradient detection mechanism to output hierarchical aggregation gradient and aggregation statistics; S5, based on the hierarchical aggregation gradient and the local training gradient, adopts a quality-weighted scale adaptive cross-layer aggregation strategy to output a new round of global model parameters; S6 receives a new round of global model parameters, adopts a blockchain-based notarization and zero-knowledge proof compliance verification mechanism, and outputs auditable collaborative training records and the final global model.

2. The privacy data protection method for the supply chain according to claim 1, characterized in that, S1 includes: Deploying a layered network topology and blockchain smart contract system includes: dividing the participants into core enterprise nodes, a set of first-tier supplier nodes, and a set of second-tier supplier nodes according to the supply chain hierarchy; deploying trusted aggregation nodes at each level; and deploying aggregation nodes in a trusted execution environment. Initialize the consortium blockchain network and deploy a smart contract system on the blockchain. The smart contract system includes node management contracts, privacy budget management contracts, model evidence storage contracts, reputation scoring contracts, and malicious detection contracts. Each participant generates a two-layer key system, which includes identity key pairs generated using the elliptic curve digital signature algorithm and data key pairs generated using the Paillier homomorphic encryption algorithm.

3. The privacy data protection method for the supply chain according to claim 1, characterized in that, S2 includes: The differentiated privacy noise injection mechanism includes: performing feature engineering on local sensitive data to extract multi-dimensional feature vectors; evaluating the sensitivity of the extracted features and classifying them into three levels: high sensitivity, medium sensitivity, and low sensitivity; querying the privacy budget management contract on the blockchain to obtain the total privacy budget quota for this node; and differentially allocating the privacy budget for this round among features of different sensitivity. Differential privacy protection is achieved by adding Laplace noise to the feature data based on the allocated privacy budget and feature sensitivity. The noise scale parameter is calculated based on the global sensitivity of the feature and the privacy budget. The privacy budget consumption record is submitted to the privacy budget management contract on the blockchain for verification and cumulative update.

4. A privacy data protection method for the supply chain according to claim 1, characterized in that, S3 includes: The Fisher information matrix gradient sensitivity analysis method includes: after each participant receives the global model parameters, it trains the model on the local training dataset and records the gradient change history of each parameter; after the local training is completed, the gradient update amount of the local model parameters relative to the global model parameters is calculated. The importance of gradients is evaluated using a Fisher information matrix-based method. The approximate value of the diagonal elements of the Fisher information matrix is ​​calculated. Specifically, samples are drawn from the validation dataset, the loss value is calculated for each sample through forward propagation, the gradient is calculated through backpropagation, the square of the gradient is calculated, and the average is taken over all samples to obtain the approximate value of the Fisher information for each parameter.

5. A privacy data protection method for the supply chain according to claim 4, characterized in that, S3 further includes: The output of hierarchical gradient update and local model quality score includes: sorting the gradient parameters by importance according to Fisher information values, selecting the parameters with the first preset proportion before sorting as key gradients, selecting the parameters with the second preset proportion in the middle as important gradients, and the remaining parameters as minor gradients. Calculate the performance metrics of the local model on the validation dataset, normalize the performance metrics, and then calculate the local data quality score. Package the gradient update amount, gradient sensitivity classification, local data quality score, and number of training samples, digitally sign them using the node's identity private key, and then prepare to upload them to the aggregation node.

6. A privacy data protection method for the supply chain according to claim 1, characterized in that, S4 includes: The hybrid encryption aggregation method includes: encrypting key gradients using the Paillier homomorphic encryption algorithm, which supports addition and scalar multiplication operations in the ciphertext domain; and encrypting important gradients using the BFV homomorphic encryption scheme based on the learning and error problem on rings. For minor gradients, a secure aggregation protocol is used. Each participant adds the real gradient to the random mask and uploads it. The random mask is generated using a pairwise random mask method. The pairwise random masks are generated based on a shared key pre-negotiated through the Diffie-Hellman key exchange protocol. During aggregation, the pairwise random masks cancel each other out.

7. A privacy data protection method for the supply chain according to claim 6, characterized in that, S4 further includes: The malicious gradient detection mechanism includes: calculating the mean and standard deviation of the mask gradients of all nodes at the same level for minor gradients; if the norm of the mask gradient of a node exceeds the mean plus a preset multiple of the standard deviation, it is marked as a suspected anomaly; calculating the norm of the ciphertext gradient for key gradients and important gradients using the properties of homomorphic encryption, comparing it with the historical statistical distribution of the gradient norm of the corresponding level, and if it exceeds the normal range, it is marked as a suspected malicious gradient. Suspected malicious gradients are excluded from this round of aggregation, and malicious behavior reports are submitted to the malicious detection smart contract on the blockchain; weighted aggregation is performed on normal gradients that pass the detection, and the aggregation weight is calculated by combining the data scale, data quality score and historical reputation score.

8. A privacy data protection method for the supply chain according to claim 1, characterized in that, S5 includes: The quality-weighted scale-adaptive cross-layer aggregation strategy includes: after the second-level supplier layer aggregation node completes the internal aggregation within the layer, it transmits the aggregation gradient and layer statistics to the first-level supplier layer aggregation node; The first-level supplier layer aggregation node calculates the quality weighted scale of each level. The quality weighted scale is equal to the total data scale of the level multiplied by the average data quality score of the level. The cross-level aggregation weight is calculated based on the quality weighted scale of each level. A weight upper limit mechanism is set. The aggregation weight of any level shall not exceed the preset weight upper limit value. If it exceeds the preset weight upper limit value, it shall be truncated to the preset weight upper limit value, and the weight of the other level shall be adjusted accordingly to ensure that the weight sum is 1.

9. A privacy data protection method for the supply chain according to claim 8, characterized in that, S5 includes: The output of the new round of global model parameters includes: the core enterprise node receives the cross-layer aggregated gradient, and finally aggregates the supplier aggregated gradient with its own local training gradient. The quality weighted scale of the core enterprise is multiplied by a preset boosting factor during calculation. The core enterprise uses global gradients to update global model parameters through the Adam optimizer; it uses a secure multi-party computation protocol to calculate global verification performance, where each participant adds its local verification metrics to a random mask and uploads them, and the core enterprise aggregates them and cancels out the random masks to obtain the global verification metrics; the updated global model parameters are then distributed to participants at each level through aggregation nodes.

10. A privacy data protection method for the supply chain according to claim 1, characterized in that, S6 includes: The compliance verification mechanism using blockchain notarization and zero-knowledge proof includes: the core enterprise performs hash calculation on the global model parameters to generate a unique model identifier, constructs a notarization transaction containing model hash, training rounds, participating node list, hierarchical aggregation weight, node contribution, malicious node mark and global model performance, and broadcasts it to the blockchain network after signing; Each participant generates a zero-knowledge proof, which adopts a concise non-interactive knowledge proof scheme based on the Groth16 protocol. The proof content includes the correctness of differential privacy noise injection, the compliance of training data, and the authenticity of uploaded gradients. The core enterprise judges whether the global model has converged. If the rate of change of the global verification loss and the global verification accuracy are both less than the preset convergence threshold for multiple consecutive rounds, the training ends. Otherwise, S3 to S6 are repeated.

Images