A cross-agency data sharing method, system, device and storage medium

Abstract

The application provides a cross-agency data sharing method, system, device and storage medium. The method comprises the following steps: determining a target agency as a cooperation center in each training round based on a preset dynamic rotation strategy; and performing the following operations in each training round: obtaining gradient data of the current training round for each agency; injecting first random noise data into the gradient data based on a proportion coefficient, and performing homomorphic encryption to obtain shared model data; injecting second random noise data generated based on a preset privacy parameter into the obtained shared model data through the target agency, generating aggregated model data, and sending the aggregated model data to other agencies, so that each agency obtains target aggregated model data based on a preset private key fragment, adjusts parameters of a corresponding to-be-trained model, and starts a next training round. Through the above method, the dynamic privacy attack can be resisted, and the overall credibility of the system is improved.

Description

Technical Field

[0001] This application relates to the intersection of federated learning and data security, and in particular to a cross-agency data sharing method, system, device, and storage medium. Background Technology

[0002] In the current era of AI-driven digital economy, cross-institutional data collaboration is a key path to unlocking the value of data. Traditional centralized data sharing, due to strict privacy regulations on the transmission of raw data and the risk of sensitive data leakage, such as GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act), exacerbates data silos and increases the cost of inter-institutional trust. Therefore, federated learning, as an emerging paradigm, has become an important direction for solving these problems by allowing institutions to collaboratively train models without their local data leaving their private domain. Specifically, in federated learning, each participating institution independently trains its model using its local data, only uploading model parameters or gradient updates to a central server for aggregation. The aggregated global model is then distributed to each institution, and this process is iterated until the model converges.

[0003] However, in practical cross-institutional applications, the security protection mechanisms of existing federated learning systems are usually manifested in injecting a single noise of constant strength into the gradient or using fixed encryption algorithms, exhibiting fragmented and static characteristics. This makes the system unable to cope with the dynamic privacy risks and combined attacks during the training process, allowing malicious nodes to gradually reverse-engineer the original sensitive data or tamper with the global model. The risks of data leakage and model integrity destruction during the training process are difficult to contain, resulting in insufficient overall credibility. Summary of the Invention

[0004] This application provides a cross-organizational data sharing method, system, device, computer-readable storage medium, and computer product. By increasing the noise intensity in each round to resist gradient reverse attacks, and combining homomorphic encryption and threshold decryption for triple protection, it achieves full-process gradient privacy protection, resists dynamic attacks, and improves system credibility.

[0005] In a first aspect, embodiments of this application propose a cross-organizational data sharing method, applied to a system comprising multiple organizations, the method comprising: Based on a preset dynamic rotation strategy, the target institution to serve as the collaboration center in each training round is determined from the multiple institutions, and the following operations are performed in each training round: For each institution, the following steps are performed: obtaining the gradient data, first random noise data, and scaling factor for the current training round; injecting the first random noise data into the gradient data based on the scaling factor, and homomorphically encrypting the noise-injected gradient data based on a preset public key to obtain shared model data; wherein, the scaling factor increases with each training round. After the target institution encrypts and aggregates the obtained shared model data, it injects second random noise data generated based on preset privacy parameters to generate aggregated model data. The aggregated model data is then sent to other institutions so that each institution can obtain target aggregated model data based on the aggregated model data and preset private key fragments. After adjusting the parameters of the corresponding model to be trained based on the target aggregated model data, the next training round is started.

[0006] By progressively increasing the scaling factor during training, the noise obfuscation intensity is enhanced in a stepwise manner, effectively resisting gradient inversion attacks. Combined with a triple protection chain consisting of homomorphic encryption, ciphertext domain differential noise injection, and threshold joint decryption, the privacy of gradient data is protected throughout the entire process of transmission, aggregation, and decryption, thereby resisting dynamic privacy attacks and improving the overall credibility of the system.

[0007] In some possible embodiments, the gradient data is a gradient data matrix composed of multiple gradient sub-data. After obtaining the gradient data, the first random noise data, and the scaling factor for the current training round, and before injecting the first random noise data into the gradient data based on the scaling factor, the method further includes: For the gradient data matrix, calculate the absolute value of each gradient sub-data in the gradient data matrix; Based on the absolute value of each gradient sub-data and a preset gradient importance threshold, at least one important gradient sub-data is determined from the gradient data matrix; Retain at least one important gradient sub-data and set the other gradient sub-data in the gradient data matrix to zero.

[0008] In some possible embodiments, the encrypted aggregation of the obtained shared model data includes: The weight coefficients for each shared model data are determined based on the historical contributions of each institution; wherein the weight coefficients are positively correlated with the historical contributions, and the historical contributions are determined based on the amount and quality of the training data of the corresponding institution. Under homomorphic encryption, the corresponding shared model data is aggregated and calculated based on the obtained weight coefficients.

[0009] In some possible embodiments, after generating the aggregated model data, the method further includes: The target organization receives watermark data generated by each organization based on its own preset private key fragments; wherein, the watermark data is used to uniquely identify the copyright ownership of the corresponding organization. Based on the historical contribution of each institution, a watermark scaling factor is determined for each watermark sub-data; wherein, the watermark scaling factor is used to scale the watermark sub-data of the corresponding institution. Based on each watermark sub-data and its corresponding watermark scaling factor, watermark data is generated, and the watermark data is embedded into the aggregated model data according to a preset accuracy tolerance threshold. The watermark data is used to restore the historical contribution of each organization during copyright verification, so as to verify the copyright ownership of the aggregated model data.

[0010] In some possible embodiments, before the acquired shared model data are encrypted and aggregated through the target institution, the method further includes: Calculate the median absolute deviation of the shared model data using the target mechanism; From the shared model data, identify abnormal shared model data whose median absolute deviation is greater than a preset median absolute deviation threshold, and replay the abnormal shared model data in a sandbox environment to obtain the corresponding replay results; If the replay result indicates a malicious entity, a voting request is initiated to other entities to isolate the malicious entity, and the corresponding level of isolation measures are implemented for the malicious entity based on the voting results. The isolation measures include at least one of the following: The shared model data of the current training round of the malicious organization is isolated to prevent encrypted aggregation of the shared model data; The malicious entity is isolated to prevent encrypted aggregation of shared model data from any training round of the malicious entity.

[0011] In some possible embodiments, before the acquired shared model data are encrypted and aggregated through the target institution, the method further includes: For each shared model data, if it is determined that the shared model data does not meet the preset security conditions, the institution corresponding to the shared model data is identified as a dangerous institution, and the communication connection with the dangerous institution is terminated and the aggregated training permission of the dangerous institution is frozen based on the smart contract. The determination that the shared model data does not meet the preset security conditions includes: It was determined that the transmission of the shared model data did not conform to the preset security boundaries; It was determined that the type of the shared model data did not conform to the pre-authorized data type range.

[0012] In some possible embodiments, the method further includes, in each training round: When a predefined key operation is detected, a key operation record with a timestamp is generated, and the key operation record is synchronously written to two heterogeneous blockchains that use different consensus mechanisms. The key operation record is used to trace back the history during compliance checks to verify compliance during the training process; the key operation includes at least one operation performed by the target institution.

[0013] Secondly, embodiments of this application also propose a cross-institutional data sharing system, which includes multiple institutions and a collaborative central layer, wherein: The collaborative hub layer is used to determine the target institution as the collaborative center in each training round from the multiple institutions based on a preset dynamic rotation strategy. Each of the mechanisms is respectively used to: acquire gradient data, first random noise data, and scaling factor for the current training round; inject the first random noise data into the gradient data based on the scaling factor, and perform homomorphic encryption on the noise-injected gradient data based on a preset public key to obtain shared model data; wherein, the scaling factor increases with each training round; The target organization is used to encrypt and aggregate the obtained shared model data, inject second random noise data generated based on preset privacy parameters, generate aggregated model data, and send the aggregated model data to other organizations; Each of the aforementioned institutions is further configured to obtain target aggregated model data based on the aggregated model data and preset private key fragments, and after adjusting the parameters of the corresponding model to be trained based on the target aggregated model data, start the next training round.

[0014] Thirdly, embodiments of this application also provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform steps in an inter-agency data sharing method as described in any of the first aspects of the above embodiments.

[0015] Fourthly, embodiments of this application also propose a computer-readable storage medium storing computer-executable instructions for performing steps in a cross-agency data sharing method as described in any of the first aspects of the above embodiments.

[0016] Fifthly, embodiments of this application also propose a computer program product comprising: computer program code, which, when executed on a computer, causes the computer to perform steps in a cross-agency data sharing method as described in any of the first aspects of the above embodiments.

[0017] The cross-institutional data sharing method, apparatus, device, computer-readable storage medium, and computer program product described in the above embodiments of this application effectively resist gradient inversion attacks by progressively increasing the noise obfuscation intensity in stages during training by increasing the proportional coefficient in each round. Furthermore, by combining a triple protection chain consisting of homomorphic encryption, ciphertext domain differential noise injection, and threshold joint decryption, the privacy of gradient data is protected throughout the entire process of transmission, aggregation, and decryption, which can resist dynamic privacy attacks and improve the overall credibility of the system.

[0018] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of a system comprising multiple mechanisms according to an embodiment of this application; Figure 2 This is a schematic diagram of a cross-organizational data sharing method in an embodiment of this application; Figure 3 This is a schematic diagram of a process for verifying suspicious nodes in an embodiment of this application; Figure 4 This is a schematic diagram of a process for obtaining the complete plaintext of the aggregation model data in an embodiment of this application; Figure 5 This is a schematic diagram of a watermark embedding process in an embodiment of this application; Figure 6 This is a flowchart illustrating the training process of a medical image diagnosis model under a horizontal federated learning model in an embodiment of this application. Figure 7 This is a flowchart illustrating the training process of an anti-fraud model under a vertical federated learning model, as described in an embodiment of this application. Figure 8 This is a flowchart illustrating copyright verification based on the above-described vertical federated learning example in an embodiment of this application. Figure 9 This is a flowchart illustrating the training process of an urban event prediction model under a hybrid federated learning model, as described in an embodiment of this application. Figure 10 This is a schematic diagram of a cross-organizational data sharing system according to an embodiment of this application; Figure 11 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. Unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0022] The terms "first" and "second" in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. The term "multiple" in this application can mean at least two, for example, two, three, or more, and the embodiments of this application do not impose limitations.

[0023] The following explanations of some terms used in the embodiments of the present invention are provided to facilitate understanding by those skilled in the art.

[0024] (1) Federated Learning (FL): is a distributed machine learning method. Its core idea is to complete the training of the model through multi-party collaboration without directly sharing the original data. It is suitable for scenarios where data privacy is sensitive or data is scattered across multiple devices or organizations.

[0025] (2) Byzantine attack: refers to the attack behavior in a distributed system in which a malicious node (i.e., a Byzantine node) attempts to disrupt the normal consensus or computation process of the system by sending erroneous, contradictory, or maliciously constructed information. In the context of federated learning, a Byzantine attack specifically refers to an attack method in which a malicious participant uploads forged, tampered, or malicious model updates (gradients / parameters) to pollute the global model, reduce model accuracy, or implant backdoors.

[0026] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These embodiments should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that in the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solutions of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0027] Before introducing the cross-organizational data sharing method, system, device, computer-readable storage medium, and computer program product provided in the embodiments of this application, the technical background of the embodiments of this application will be described in detail below for ease of understanding.

[0028] In the current era of AI-driven digital economy, cross-institutional data collaboration is a key path to unlocking the value of data. Traditional centralized data sharing, due to strict privacy regulations on the transmission of raw data and the risk of sensitive data leakage, such as GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act), exacerbates data silos and increases the cost of inter-institutional trust. Therefore, federated learning, as an emerging paradigm, allows institutions to collaboratively train models without their local data leaving their private domain, becoming an important direction for solving these problems.

[0029] Specifically, in federated learning, each participating institution independently trains the model using local data, only uploading the model parameters or gradient updates to the central server for aggregation, and then distributing the aggregated global model to each institution, iterating in this way until the model converges.

[0030] However, in practical cross-institutional applications, existing federated learning systems typically employ fixed-strength privacy protection techniques, such as injecting constant-strength single noise into the gradient or using fixed encryption algorithms. This results in fragmented and static characteristics, making the system unable to cope with dynamically changing privacy risks and combinatorial attacks during training. In long-term, multi-round iterative training, malicious nodes can gradually reverse-engineer the original sensitive data or tamper with the global model. The risks of data leakage and model integrity damage during training are difficult to contain, resulting in insufficient overall credibility.

[0031] Furthermore, the aforementioned existing technologies often address specific threats in isolation, such as defending only against gradient data leakage or Byzantine attacks, lacking a comprehensive protection system. Malicious nodes can penetrate defenses through multi-dimensional combined attacks such as gradient poisoning and model theft, further reducing overall trustworthiness.

[0032] Therefore, given that the static protection mechanisms in the existing technology cannot cope with the insufficient defense caused by combined attacks, this application proposes a cross-organizational data sharing method, applicable to, for example... Figure 1 The system shown contains multiple mechanisms. For example... Figure 2 As shown, the method includes: Step S201: Based on the preset dynamic rotation strategy, determine the target institution as the collaboration center in each training round from multiple institutions; Step S202: Initiate at least one round of training, each round including the following steps: Step S202-1: For each institution, perform the following steps: obtain the gradient data, first random noise data, and scaling factor for the current training round; inject the first random noise data into the gradient data based on the scaling factor, and perform homomorphic encryption on the gradient data after noise injection based on a preset public key to obtain shared model data; The proportionality coefficient increases with each training round. Step S202-2: After encrypting and aggregating the obtained shared model data through the target institution, inject second random noise data generated based on preset privacy parameters to generate aggregated model data; send the aggregated model data to other institutions; Step S202-3: For each institution, obtain the target aggregated model data based on the aggregated model data and the preset private key fragments, and adjust the parameters of the corresponding model to be trained based on the target aggregated model data before starting the next training round.

[0033] Step S203: When the preset evaluation index meets the preset convergence condition, the training ends.

[0034] The method in this application embodiment enhances the noise obfuscation intensity in a stepwise manner by increasing the scaling factor with each round during training, effectively resisting gradient inversion attacks. Furthermore, it combines a triple protection chain consisting of homomorphic encryption, ciphertext domain differential noise injection, and threshold joint decryption to achieve privacy protection of gradient data throughout the entire process of transmission, aggregation, and decryption. This can resist dynamic privacy attacks and improve the overall credibility of the system.

[0035] Before step S201, the method further includes obtaining a list of institutions participating in model training, their unique institution IDs, and historical contributions; wherein, the historical contribution is determined based on the amount and quality of training data of the corresponding institution, and can be determined based on predefined criteria or existing models, which will not be described in detail here.

[0036] In some possible embodiments, the preset dynamic rotation strategy includes, but is not limited to, at least one of the following: Based on the ascending order of the institution IDs, a switch is performed after a fixed number of training rounds, and the next institution in the sequence is taken as the target institution of the collaboration center. Based on the historical contribution of each institution from high to low, a switch is performed after a fixed number of training rounds, and the next institution in the sequence is taken as the target institution of the collaboration center. Based on the order of institution IDs from smallest to largest / order of historical contribution from highest to lowest, a switch is performed every time a predefined number of training rounds are completed, and the next institution in the sequence is selected as the target institution for the collaboration center.

[0037] Furthermore, the process of determining the target institution as the collaboration center in each training round can be implemented by the collaboration hub layer deployed on the institution. When switching institutions as collaboration centers, the previous target institution synchronizes the current aggregated model data, training round count, key operation records, and other necessary context to the next target institution to ensure that the federated training process is not interrupted.

[0038] In step S202-1 above, the gradient data is a gradient data matrix composed of multiple gradient sub-data. Here, gradient sub-data refers to the partial derivatives of the loss function with respect to the weight parameters of each layer of the model during the training process of the local institution. Specifically, the model propagates forward layer by layer to obtain the predicted results, compares them with the true labels to calculate the loss, and then propagates backward layer by layer to calculate the gradient sub-data of the weights of each layer. This gradient data matrix clarifies the direction and step size of model parameter optimization. The core mechanism of federated learning is that each participating institution only uploads the gradient data matrix to the target institution for aggregation, while the original data remains in the local institution, thereby achieving collaborative model optimization under the premise of data privacy protection.

[0039] In some possible embodiments, after acquiring the gradient data, the first random noise data, and the scaling factor for the current training epoch, and before injecting the first random noise data into the gradient data based on the scaling factor, the method further includes: For the gradient data matrix, calculate the absolute value of each gradient sub-data in the gradient data matrix; Based on the absolute value of each gradient sub-data and a preset gradient importance threshold, at least one important gradient sub-data is determined from the gradient data matrix. Retain at least one important gradient subdata and set the other gradient subdata in the gradient data matrix to zero.

[0040] The gradient importance threshold can be a sparsity ratio. Sparsity is achieved by taking the absolute value of the gradient matrix generated during local training as the importance measure, and then retaining the top k gradient sub-data points with the largest absolute values ​​according to a preset sparsity ratio (e.g., 0.3), while setting the rest to zero. In other words, the absolute values ​​of each gradient sub-data point are arranged from largest to smallest, and the top 30% of gradient sub-data points with the largest absolute values ​​are selected as important gradient sub-data points and retained, while the remaining gradient sub-data points are set to zero.

[0041] In this embodiment, the aforementioned sparsity compression process can be implemented by a communication controller deployed within the organization. This controller monitors network bandwidth fluctuations in real time and adaptively selects between lossless compression and lossy sparsity compression. Specifically, when bandwidth is limited, only gradient sub-data exceeding the gradient importance threshold is transmitted; when bandwidth is ample, more gradient information is retained, achieving a balance between communication overhead and model accuracy. Simultaneously, this mechanism reduces the consumption of bandwidth and computational resources by invalid data. When transmission delays consistently exceed the time window, it can autonomously switch underlying communication protocols to prevent training timeouts caused by the accumulation of delays from a single upload, ultimately achieving efficient and stable federated learning while protecting privacy.

[0042] After sparsification, dynamic noise is injected into the gradient data matrix.

[0043] In some possible embodiments, the first random noise data is a random noise matrix of a specific dimension, generated during local training. The dimension of this first random noise matrix is ​​the same as the dimension of the gradient data matrix generated in the current epoch. For example, when the dimension of the gradient data matrix is ​​512×256, the dimension of the first random noise matrix is ​​also 512×256; when processing gradient data matrices of different dimensions for other network layers, the dimension of the corresponding first random noise matrix automatically changes synchronously.

[0044] Optionally, the dimension of the gradient data matrix depends on the structure of the model to be trained (such as the size of the fully connected layer and the number of convolutional kernel parameters), and the dimension of the gradient data matrix differs for different network layers. Therefore, the dimension of the first random noise matrix changes with the dimension of the gradient data matrix of the processed layer, automatically matching the dimension of the gradient data matrix, which is an adaptive adjustment method.

[0045] In some possible embodiments, the dimension of the first random noise matrix is ​​set with a preset range, which refers to the range of dimension values ​​that the system can configure (e.g., the lower limit is 1×1 and the upper limit is the maximum number of model parameters). In actual operation, the dimension of the first random noise matrix is ​​adaptively determined according to the dimension of the gradient data matrix within the preset range.

[0046] In this embodiment, different noise injection mechanisms can be flexibly selected according to the actual scenario, so that no separate denoising step is needed in steps other than S202-2 during model training. Specifically, either of the following two mechanisms can be used: Mean-based mechanism: The elements of the first random noise matrix generated locally by each institution are pre-configured to follow a uniform distribution with a mean of zero. During the aggregation process, as the number of participating institutions increases, the positive and negative noise components added by each institution statistically cancel each other out. The residual noise effect in the aggregated model data tends to zero, thus eliminating the need for institutions to upload noise seeds or perform additional interactions. This naturally achieves statistical noise cancellation, ensuring strong privacy protection without increasing communication overhead.

[0047] Seeding mechanism: After generating the first random noise data, the corresponding noise seed and the encrypted shared model data are uploaded to the target institution. Before performing aggregation calculation, the target institution uses the noise seed to accurately remove the ciphertext values ​​of each noise component using homomorphic encryption ciphertext subtraction. The noise seed is used to reproduce the first random noise matrix that is consistent with the one generated locally by the participating institution.

[0048] It should be noted that the scaling factor is a publicly available system parameter, configured in all participating institutions during the initialization phase. The target institution can directly calculate it based on the current training round and the preset incrementing rules, without requiring each institution to upload it individually. Since all random noise matrices are random numbers generated by each institution during this training round, the target institution cannot actually obtain the specific values ​​of the noise. Therefore, its elimination method is not to directly subtract the noise, but rather to employ the two noise injection mechanisms mentioned above. The mean mechanism utilizes the statistical characteristic that the expected noise value of each institution is zero and the system's specific mechanism, using a large amount of positive and negative noise to cancel each other out during the aggregation process, causing the residual influence to approach zero. The seed mechanism, on the other hand, involves each institution uploading a noise seed to the target institution, enabling the target institution to accurately remove the ciphertext values ​​of each noise component using homomorphic encryption and ciphertext subtraction. In actual implementation, the two methods can be used in combination, or a flexible choice can be made based on the specific scenario and security requirements.

[0049] The embodiments of this application, through the flexible configuration of the mean mechanism and the seed mechanism, can achieve statistical denoising with zero additional overhead in conventional scenarios, and can achieve accurate ciphertext domain denoising in high-security scenarios. Thus, the privacy and security of gradient data can be effectively guaranteed under different application requirements, while avoiding the introduction of additional dedicated denoising steps and simplifying the training process.

[0050] In some possible implementations, the scaling factor for the current training round can be adaptively determined based on a predefined growth rule or the current security level of the system.

[0051] Optionally, if determined according to a predefined growth rule, the initial value is set to a fixed value, and the step size is increased after each training round until the preset upper limit of the scaling factor is reached and no further increase is made. This design is configured based on the characteristic that the risk of gradient leakage gradually increases during training: in the early stage of training, the model parameters are still unstable, and the difficulty of inverse gradient reconstruction is relatively large. Therefore, a low noise intensity is sufficient to meet the privacy protection requirements. As the number of training rounds increases, the model gradually converges, and the original data features contained in the gradient data are enhanced. The density of usable statistical feature information in the gradient data increases. By increasing the scaling factor with each round, the noise confusion intensity is dynamically matched with the real-time risk level. This avoids the adverse effects of excessive noise on the model's convergence accuracy in the early stage of training and ensures the privacy and security of gradient data in the high-risk stage of later training.

[0052] Optionally, if the security level of the current system is adaptively determined, the statistical characteristics of the aggregated model data are monitored in real time using a gradient distribution analysis algorithm, and the scaling factor is dynamically adjusted according to a preset sensitivity parameter. Specifically, the system presets a sensitivity parameter linked to the security level. The higher the security level, the more stringent the value, the lower the threshold for judging gradient distribution anomalies, and the easier it is to trigger an increase in the scaling factor. When the variance of the aggregated model data deviates from the historical mean by more than the dynamic threshold range determined based on the sensitivity parameter, it is determined that there is a potential attack risk in the current training round. At this time, the scaling factor is temporarily increased (e.g., multiplied by 1.5) to promptly enhance the noise obfuscation intensity and strengthen protection.

[0053] In this embodiment, the adaptive mechanism does not rely on round-by-round mechanical advancement, but responds flexibly according to the actual risk state. It can be implemented based on the defense module in the mechanism. When the defense module detects an anomaly, it will simultaneously trigger a temporary jump in the scaling factor of the next round of training, forming a linkage between detection and protection. This avoids excessive noise loss of model accuracy when there is no anomaly, and can quickly improve the protection level when a risk is detected, thus achieving an adaptive match between the strength of privacy protection and real-time security requirements.

[0054] In step S202-1, the first random noise data is injected into the gradient data based on the scaling factor. This is done by multiplying the obtained scaling factor by the first random noise matrix and then superimposing it onto the gradient data matrix locally in each institution.

[0055] Specifically, after local training is completed, a plaintext gradient data matrix is ​​obtained, and simultaneously a first random noise matrix (following a uniform distribution with a mean of zero) with the same dimension as the plaintext gradient data matrix is ​​generated. The product of this first random noise matrix and the scaling factor determined for the current round is added to the plaintext gradient data matrix to obtain the plaintext gradient data matrix after noise injection. The scaling factor increases with each training round.

[0056] In step S202-1 above, homomorphic encryption is performed on the noise-injected gradient data based on a preset public key to obtain shared model data. Specifically, homomorphic encryption of the noise-injected gradient data based on the preset public key converts the plaintext gradient data matrix into a ciphertext gradient data matrix while maintaining computability in the ciphertext domain.

[0057] In some possible embodiments, each institution is pre-configured with a public key for homomorphic encryption and corresponding private key fragments for fragmented decryption. The Paillier homomorphic encryption algorithm can be used for encryption, which supports ciphertext addition: after each institution encrypts the shared model data, the target institution can directly perform addition on the ciphertext without decryption. The result is equivalent to the ciphertext obtained by adding the plaintext shared model data and then encrypting it again. Through this encryption transformation, the gradient data does not expose plaintext information throughout the entire uploading and aggregation process, and it does not affect the correctness of the aggregation calculation itself. The specific implementation process will not be elaborated here.

[0058] In this embodiment, after obtaining the shared model data, each institution uploads the shared model data to the target institution that serves as the collaboration center in the current training round. Through the target institution, the obtained shared model data is encrypted and aggregated. After the coordinator collects the encryption gradients of each institution, the aggregation and summation are performed in the encrypted state.

[0059] In the embodiments of this application, if a seed mechanism is used for noise injection, the corresponding target mechanism will also use homomorphic encryption ciphertext subtraction operation to accurately remove the ciphertext values ​​of each noise component based on the synchronously uploaded noise seed before aggregation, which will not be elaborated here.

[0060] By performing reversible operations on the noisy shared model data uploaded by each participant before aggregation, interference noise injected locally by each institution is eliminated, and noise-free shared model data is obtained before aggregation. This ensures that noise only plays a privacy protection role during the local training and uploading stages, without having any negative impact on subsequent aggregation calculations and model convergence accuracy, thus achieving a balance between privacy protection strength and model training accuracy.

[0061] In some possible embodiments, to defend against Byzantine attacks and gradient poisoning, and to ensure the security and reliability of the encrypted aggregation process, before the target organization performs encrypted aggregation on the obtained shared model data, such as... Figure 3 As shown, the method also includes: Step S301: Calculate the median absolute deviation of the data from each shared model using the target mechanism; Step S302: From each shared model data, identify the abnormal shared model data whose median absolute deviation is greater than the preset median absolute deviation threshold, and replay the abnormal shared model data in a sandbox environment to obtain the corresponding replay results; Step S303: If the replay result indicates a malicious entity, initiate a voting request to other entities to isolate the malicious entity, and implement the corresponding level of isolation measures for the malicious entity based on the voting results.

[0062] It should be noted that the sandbox environment replay in this application embodiment refers to performing forward propagation calculations on the abnormal shared model data of suspicious nodes (institutions corresponding to abnormal shared model data whose median absolute deviation is greater than a preset median absolute deviation threshold) in an isolated simulation environment. This assesses the actual impact of the abnormal shared model data on model performance (such as the magnitude of accuracy reduction, prediction bias, etc.) to objectively determine whether the abnormal shared model data constitutes malicious attack behavior, thus avoiding the incorrect isolation of normal nodes due to misjudgment based on a single statistical indicator. The specific implementation methods of sandbox environment replay are prior art and will not be elaborated upon here.

[0063] In this embodiment of the application, corresponding levels of isolation measures are implemented against malicious entities based on the voting results. These isolation measures include, but are not limited to, at least one of the following: When the percentage of those who agree to quarantine in the voting results is lower than the first threshold (e.g., 30%), it is judged as a low-risk level, and the abnormal behavior of malicious institutions in the current training round is recorded and continuously monitored. When the percentage of those who agree to isolation in the voting results is not lower than the first threshold (e.g., 30%) but lower than the second threshold (e.g., 60%), it is judged as a medium-risk level, and the shared model data of the current training round of the malicious organization is isolated to prevent encrypted aggregation of the shared model data; When the percentage of those who agree to isolation in the voting results is not lower than the second threshold (e.g., 60%), it is judged as a high-risk level, and the malicious entity is isolated to prohibit the encrypted aggregation of shared model data from any training round of the malicious entity.

[0064] Through the sandbox environment replay verification described above, this application can effectively distinguish between statistical anomalies and genuine malicious behavior, reducing the false detection rate. Combined with a weighted voting consensus mechanism, each organization jointly decides on isolation measures based on its contribution, avoiding single-point subjective judgment and improving the fairness and accuracy of defense decisions. Simultaneously, it supports both tiered and node-level isolation granularities, allowing for flexible selection of the isolation scope based on the severity of malicious behavior, preserving the participation rights of normal nodes as much as possible while ensuring system security.

[0065] Furthermore, if during the training process it is detected that the target institution currently serving as the collaboration center is a malicious node or has a communication failure, an emergency rotation mechanism is immediately triggered. The next institution in sequence is selected as the target institution for collaboration center according to a preset dynamic rotation strategy, in order to eliminate the risk of single point of failure and ensure the continuous availability of the federated learning system.

[0066] In some possible embodiments, in order to achieve real-time compliance control over the federated learning training process and prevent violations such as unauthorized data or cross-border data flows, the method further includes the following steps before the shared model data obtained through the target institution is encrypted and aggregated: For each shared model data, if it is determined that the shared model data does not meet the preset security conditions, the institution corresponding to the shared model data will be identified as a dangerous institution, and the communication connection with the dangerous institution will be terminated and the aggregated training permission of the dangerous institution will be frozen based on the smart contract. Among them, determining that shared model data does not meet the preset security conditions includes: The transmission of shared model data did not conform to the preset security boundaries; The type of shared model data was determined to be inconsistent with the pre-authorized data type range.

[0067] Specifically, when the target organization determines that a certain shared model data does not meet the preset security conditions, the smart contract is automatically invoked to perform the following operations: Terminate communication with the dangerous organization, that is, disconnect the data transmission channel between the dangerous organization and the target organization and other participating organizations, and prevent it from continuing to upload or receive any model data; Freeze the aggregation training permissions of the dangerous organization and set its permission status to "frozen". The target organization will automatically ignore any data uploaded by the dangerous organization during subsequent aggregations until the permission status is explicitly restored.

[0068] By automatically terminating communication connections with dangerous organizations and freezing their aggregated training permissions through the aforementioned smart contract, a millisecond-level response can be achieved when violations are detected, without the need for manual intervention, effectively preventing the further spread of illegal data.

[0069] Furthermore, since the shared model data has already been homomorphically encrypted locally at the original institution, the target institution does not need to and cannot decrypt the encrypted shared model data of each institution, but directly performs addition operations on the encrypted domain. In the existing technology, the conventional aggregation calculation steps are as follows: the target institution collects the shared model data uploaded by each institution, and merges the gradients of each institution according to the preset aggregation rules. Common methods include, but are not limited to, arithmetic mean, weighted average, median aggregation, geometric mean, or truncated average, etc. Different aggregation methods can be adopted according to the actual situation, which will not be elaborated here.

[0070] In some possible embodiments, the obtained shared model data is encrypted and aggregated, including: The weight coefficients for each shared model data are determined based on the historical contributions of each institution; the weight coefficients are positively correlated with the historical contributions. Under homomorphic encryption, based on the obtained weight coefficients, the corresponding shared model data is aggregated and calculated using a weighted average method to obtain weighted model data.

[0071] In this embodiment, by introducing a weight coefficient that is positively correlated with historical contribution, institutions that perform better and have higher data quality during training are given greater weight during aggregation, thereby improving the convergence speed and final accuracy of the global model. Furthermore, by completing the aggregation in encrypted form, data privacy is protected while achieving differentiated contribution evaluation.

[0072] In step S202-2, for the above weighted model data, second random noise data generated based on preset privacy parameters is injected to generate aggregated model data.

[0073] In this embodiment, the noise injected into the weighted model data of the encrypted state is a second random noise data that satisfies the differential privacy standard.

[0074] In some possible embodiments, Laplace noise can be used as the second random noise data. Specifically, the method for generating the second random noise data based on preset privacy parameters is as follows: calculate the scale parameter of the Laplace distribution according to the preset privacy budget and sensitivity, and then sample and generate a noise vector from the Laplace distribution as the second random noise data.

[0075] In this embodiment of the application, since the aggregated model data contains noisy data that strictly meets the differential privacy standard, even if an attacker subsequently obtains the aggregated model data in some way, they will not be able to deduce the gradient data of any participating institution from the aggregated model data, thereby further strengthening the privacy protection of gradient data during the aggregation stage.

[0076] In some possible embodiments, after the target organization generates the aggregated model data, it sets a corresponding threshold decryption condition for the aggregated model data and sends the aggregated model data including the threshold decryption rule to other organizations. The threshold decryption condition requires at least a preset number (i.e., a threshold value) of organizations to jointly provide their respective private key fragments in order to completely decrypt the aggregated model data.

[0077] In step S202-3, each institution obtains the target aggregated model data based on the aggregated model data and preset private key fragments. Since each institution is pre-configured with a public key for homomorphic encryption and private key fragments for fragmented decryption, each institution's individual private key fragments cannot independently complete the full decryption of the aggregated model data. Each institution can only obtain partial plaintext information and cannot reconstruct the complete aggregated model data. At this point, each institution needs to obtain the decrypted, complete plaintext aggregated model data to update its local model. However, decryption is not performed by a single institution; rather, it requires authorization from at least a preset threshold number of institutions, each providing their private key fragments to partially decrypt the same ciphertext. The decryption results are then combined to reconstruct the complete plaintext aggregated model data.

[0078] Through the aforementioned threshold decryption mechanism, even if the private key fragments of a single institution are leaked, attackers will still be unable to complete the decryption because they cannot collect enough private key fragments to reach the threshold number, thus ensuring that the global aggregate model data will not be exposed.

[0079] like Figure 4 As shown, a set of steps is provided for various institutions to obtain the complete plaintext of the aggregated model data based on the above-mentioned threshold decryption conditions, including: Step S401: Based on the private key fragments held by itself, perform partial decryption operation on the aggregated model data to generate the corresponding partial decryption result; Step S402: Each institution uploads the generated partial decryption results to the target institution; Step S403: The target organization receives at least one partial decryption result. When the number of received partial decryption results reaches the preset threshold value in the threshold decryption condition, the target organization performs a merging operation on each partial decryption result to restore the complete aggregate model data plaintext. Step S404: The target organization sends the aggregated model data in plaintext to other organizations.

[0080] In this embodiment, each institution uses the decrypted, complete aggregated model data plaintext as the parameter update amount for the current round to update its local model, and determines whether the preset evaluation index in the current round meets the preset convergence condition. If any convergence condition is met, training stops and the final model is output; if the training condition is not met, the next training round is started based on the updated model parameters, and the entire process of local gradient calculation, noise injection, encrypted upload, ciphertext aggregation, threshold decryption, and parameter update is repeated until the model converges.

[0081] In some possible embodiments, training ends when a preset evaluation metric satisfies a preset convergence condition. The preset evaluation metric includes, but is not limited to, the loss function value, validation set accuracy, number of training epochs, and parameter update amount. Determining that the preset evaluation metric satisfies the preset convergence condition includes at least one of the following: When the loss function value is determined to be lower than the preset loss threshold, the convergence condition is determined to be met. When the accuracy of the validation set reaches or exceeds the preset accuracy threshold, the convergence condition is determined to be met. When the number of training rounds reaches the preset maximum number of training rounds, the convergence condition is determined to be met. When the parameter update amount is lower than the preset loss threshold, the convergence condition is considered met.

[0082] The embodiments described above establish a triple protection chain through local noise injection, homomorphic encryption aggregation, and threshold decryption mechanisms. This ensures privacy protection of gradient data throughout the entire process of computation, transmission, aggregation, and decryption, enabling efficient, stable, and secure federated model collaborative training while protecting data privacy. Specifically, by progressively increasing the noise intensity with each round, the privacy protection level dynamically matches the risk level during training, avoiding interference with model accuracy from excessive noise in the early stages while ensuring effective defense against reverse attacks in later stages. Simultaneously, the communication controller can adaptively select transmission strategies based on network bandwidth fluctuations, transmitting only a subset of important gradients, achieving a balance between communication efficiency and model accuracy.

[0083] Furthermore, in some possible embodiments, in order to achieve ex post facto traceability verification of model copyright in federated learning aggregation models, after generating aggregation model data in each training epoch, such as... Figure 5 As shown, the method also includes: Step S501: Receive watermark data generated by each institution based on its own preset private key fragments through the target institution; Among them, the watermark sub-data is used to uniquely identify the copyright ownership of the corresponding organization; Step S502: Determine the watermark scaling factor corresponding to each watermark sub-data based on the historical contribution of each institution; Among them, the watermark scaling factor is used to scale the watermark sub-data of the corresponding organization; Step S503: Based on each watermark sub-data and the corresponding watermark scaling factor, generate watermark data, and embed the watermark data into the aggregated model data according to the preset accuracy tolerance threshold.

[0084] The watermark data is used to restore the historical contribution of each organization during copyright verification, so as to verify the copyright ownership of the aggregated model data.

[0085] Specifically, the watermark scaling factor is calculated based on each institution's historical contribution, which serves as a global evaluation indicator, comprehensively reflecting the institution's cumulative performance across multiple dimensions, including data quality, participation frequency, and gradient effectiveness. The watermark scaling factor is linked to the institution's historical contribution through a continuous function mapping; institutions with higher historical contributions have larger watermark scaling factors, meaning they hold a higher copyright share in the aggregated model data generated in the current round.

[0086] In some possible embodiments, a zero-knowledge proof protocol is used to verify watermark ownership during copyright verification. Specifically, any participating institution, acting as a prover, must prove to the verifier that the watermark sub-data generated by its private key fragment has been embedded in the current aggregation model, and that the watermark scaling factor corresponding to the watermark sub-data matches the institution's historical contribution. The verifier confirms the above facts through the zero-knowledge proof protocol without needing to obtain specific content such as private key fragments, watermark sub-data, or contribution information from other institutions. After successful verification, the verifier can confirm that the institution enjoys a copyright share in the aggregation model corresponding to its contribution. The specific implementation process of this confirmation through the zero-knowledge proof protocol is prior art and will not be elaborated here.

[0087] By dynamically linking the watermark scaling factor to an institution's historical contributions, institutions with higher contributions receive stronger watermarks, achieving fair copyright traceability. Furthermore, by incorporating zero-knowledge proofs, ownership is established without exposing model details, balancing copyright protection, model privacy, and usability.

[0088] In some possible embodiments, to achieve auditability, traceability, and non-repudiation of the federated learning training process and to meet compliance check requirements, the method further includes the following in each training round: When a predefined key operation is detected, a key operation record with a timestamp is generated and synchronously written to two heterogeneous blockchains using different consensus mechanisms. The key operation includes at least one operation performed by the target institution. Among them, the key operation record is used to trace back the history during compliance checks in order to verify the compliance of the training process.

[0089] In some possible embodiments, writing key operation records synchronously to two heterogeneous blockchains using different consensus mechanisms involves writing the hash values ​​of the key operation records to the two heterogeneous blockchains using different consensus mechanisms, with each chain storing the same hash value.

[0090] During compliance checks, the inspector receives a traceability request. This request includes the model version number (generated simultaneously when generating aggregated model data) or time range corresponding to the operation to be verified. Based on the traceability request, the inspector identifies the operation to be verified from two heterogeneous blockchains, extracts the evidence hash value corresponding to the operation to be verified from each blockchain, and compares and verifies the two using a lightweight cross-chain verification protocol. If the evidence hashes on the two chains match, the key operation record is confirmed to be authentic, complete, and untampered; if they do not match, it indicates an anomaly in the evidence data, requiring further review.

[0091] In some possible embodiments, at least one operation performed by the target mechanism includes, but is not limited to: Generate aggregated model data through the target organization; The target organization aggregates and calculates the corresponding shared model data based on the obtained weight coefficients. At least one important gradient sub-data point is retained by the target mechanism, and the other gradient sub-data points in the gradient data matrix are set to zero. The watermark data is embedded into the aggregated model data through the target institution; The target organization replays the abnormal shared model data in a sandbox environment. The target organization initiates a voting request to other organizations to isolate malicious organizations; Implement appropriate levels of isolation measures against malicious entities through the target organization; The system identifies the organization corresponding to the shared model data as a dangerous organization by identifying it as such, and terminates the communication connection with the dangerous organization and freezes its aggregated training permissions based on a smart contract.

[0092] This mechanism, combined with verifiable timestamps (written as part of the key operation record), enables historical tracing and non-repudiation verification of key operations during training. Furthermore, employing different consensus mechanisms avoids the risk of evidence tampering due to consensus vulnerabilities in a single chain. The combination of dual-chain mutual backup and cross-chain verification significantly improves the non-repudiation and system robustness of the evidence. Simultaneously, the verifiable timestamps provide a reliable time benchmark for compliance checks, ensuring the credibility and traceability of the audit process.

[0093] In some possible embodiments, in order to overcome the problem of insufficient adaptability of a single federated learning mode under different data distribution characteristics, this application also supports seamless switching between three modes: horizontal federated learning, vertical federated learning, and federated transfer learning. The optimal collaboration mode can be dynamically selected according to the data feature distribution (sample overlap or feature overlap) and business needs of each institution.

[0094] The following is a training example of a medical image diagnostic model in a healthcare scenario. Hospitals A, B, and C participate in training this model, and the training data consists of CT / MR image data and corresponding diagnostic reports from their respective hospital databases. Since the image data from the three hospitals share the same feature space—that is, pixel features of CT / MR images and text features of corresponding diagnostic reports—but each hospital holds different patient samples, a coordination hub deployed in each hospital determines the current training mode as a horizontal federated learning mode based on the feature space of the training data. This hub then instructs the corresponding target institution to use the data processing method corresponding to this mode during aggregation.

[0095] See Figure 6This is a flowchart illustrating the training process of a medical image diagnosis model under a horizontal federated learning model. In this embodiment, a seed mechanism is used to inject first random noise data, with an initial scaling factor of 0.1, increasing by 0.02 in each training round, up to a maximum of 0.25. The privacy budget is set to 1.0, and the sensitivity is preset to 1.5. The medical image diagnosis model architecture uses a 3D ResNet network. The training process includes the following steps: Step S601: The collaboration hub layer determines the target institution as the collaboration center in each training round based on a preset dynamic rotation strategy, where Hospital A is the target institution for the first training round. Step 602: Each hospital shall implement the following: Step 602-1: Each hospital loads its local data, calculates the cross-entropy loss through forward propagation, and obtains a gradient data matrix with a dimension of 512×256 through backpropagation; Step 602-2: Each hospital generates a first random noise matrix with a dimension of 512×256. After multiplying the first random noise matrix by a scaling factor and superimposing it onto the gradient data matrix, the shared model data is obtained by encrypting it using homomorphic encryption technology. The shared model data and the noise seed are then uploaded to Hospital A. Among them, the shared model data generated by Hospital A Hospital B generates shared model data without uploading. Hospital C generates shared model data Shared model data Determined by the following formula 1: (Formula 1) in, For shared model data with added noise, The gradient data matrix, This is the proportionality coefficient. Let be the first random noise matrix.

[0096] Step 603: Hospital A, acting as the collaboration center, performs the following: Step 603-1: Obtain locally generated shared model data and receive shared model data uploaded by hospitals B and C to generate a shared model dataset. , , }, and based on the obtained noise seeds, the corresponding shared model data First, perform reversible operations to eliminate the first random noise matrix injected locally by each hospital; Among them, Hospital A reproduces the first random noise matrix locally generated by each participating institution based on the obtained noise seed, and performs an invertible operation based on the following formula 2 to obtain the denoised shared model data: (Formula 2) in, For the denoised shared model data, This is the proportionality coefficient. Let be the first random noise matrix that is reproduced.

[0097] Step 603-2: Based on the denoised shared model dataset { , , } Calculate the median absolute deviation of the data in each shared model and determine whether there is any abnormal shared model data; Specifically, from the shared model data, abnormal shared model data with a median absolute deviation greater than the preset median absolute deviation threshold is identified, and suspicious nodes (such as Hospital C) are replayed in a sandbox environment (the test in this case showed a 12% decrease in accuracy, confirming the existence of gradient poisoning hazards). If the replay results show that Hospital C is a malicious institution, a voting request is initiated to other hospitals to isolate Hospital C, and the corresponding level of isolation measures are implemented for the malicious institution based on the voting results.

[0098] Step 603-3: Scan the shared model data to determine whether the shared model data meets the preset security conditions: Specifically, geofencing technology is used to strictly limit data collaboration to medical institutions within the province (based on dual verification of IP location and institution registration location), thus establishing a preset security boundary. Simultaneously, type filters are used to ensure that only anonymized image data conforming to specifications is processed (forcibly deleting 18 sensitive fields such as patient ID), i.e., a pre-authorized data type range. If shared model data is determined to not meet the aforementioned preset security boundaries or exceed the pre-authorized data type range, the hospital corresponding to the shared model data is identified as a dangerous institution, and communication with that hospital is terminated based on a smart contract, and the dangerous institution's aggregation training permissions are frozen.

[0099] Step 603-4: For the shared model data that has passed the detection, perform aggregation calculation directly in the ciphertext space to generate encrypted aggregate model data; The encrypted aggregate model data is obtained using the following formula 3. : (Formula 3) Step 603-5: Generate Laplace noise based on preset privacy parameters, and inject the Laplace noise into the encrypted aggregate model data to obtain the aggregate model data to be sent out; The Laplace noise is generated using the following formula 4: (Formula 4) in, It is Laplace noise. For sensitivity, These are privacy parameters.

[0100] The aggregated model data to be distributed is obtained using the following formula 5. : (Formula 5) Step 603-6: Receive watermark sub-data generated by each institution based on their respective preset private key fragments, and determine the watermark scaling factor corresponding to each watermark sub-data according to the historical contribution of each institution. Based on each watermark sub-data and its corresponding watermark scaling factor, generate watermark data, and embed the watermark data into the aggregated model data according to the preset accuracy tolerance threshold, as shown in Formula 6 below: (Formula 6) in, For aggregated model data without embedded watermarks, S is a unique watermark signal matrix composed of watermark sub-data generated based on their respective preset private key fragments. This is the watermark scaling factor.

[0101] Step 603-7: Set the corresponding threshold decryption conditions and send the watermarked aggregated model data to other hospitals; The threshold for decryption requires at least two hospitals to jointly provide their respective private key fragments in order to fully decrypt the aggregated model data.

[0102] Step 604: Each hospital, based on its own private key fragments, performs partial decryption on the aggregated model data to obtain partial decryption results and uploads them to Hospital A; Step 605: When Hospital A determines that the number of partially decrypted results received has reached the preset threshold value in the threshold decryption condition, it performs a merging operation on each partially decrypted result to restore the complete aggregated model data plaintext, and sends the aggregated model data plaintext to other hospitals; Step 606: Each hospital updates its model based on the complete plaintext aggregated model data and determines whether the preset evaluation index meets the preset convergence condition. If any convergence condition is met, training stops and the final model is output. If the convergence condition is not met, the next training round is started based on the updated model parameters.

[0103] The following is an example of vertical federated learning in the financial field, where banks A, B, C, and D are the institutions participating in training the anti-fraud model. The training data consists of transaction records and user profile data from their respective databases. Since the customer groups of each bank highly overlap, but they possess different feature dimensions (e.g., bank A provides user income characteristics, bank B contributes transaction frequency characteristics, bank C has historical default records, and bank D provides consumption behavior characteristics), a coordination hub deployed across the banks determines the current training mode as vertical federated learning and instructs the corresponding target institutions to adopt the data processing method corresponding to this mode during aggregation.

[0104] See Figure 7 This is a flowchart illustrating the training process of an anti-fraud model under a vertical federated learning model. In this embodiment, a mean-based mechanism is used to inject the first random noise data. The initial value of the scaling factor is 0.1, which increases by 0.02 in each training round, with an upper limit of 0.25. Simultaneously, the privacy budget is set to 1.0, the sensitivity is preset to 1.5, and the gradient importance threshold is configured to 0.2. The training process includes the following steps: Step S701: The collaboration hub layer determines the target institution as the collaboration center in each training round based on a preset dynamic rotation strategy, where Bank A is the target institution for the first training round. Step 702: Each bank shall execute the following separately: Step 702-1: Each bank loads local data, calculates cross-entropy loss through forward propagation, obtains intermediate calculation results based on its own feature dimensions (such as encrypted forms of gradient components or feature embedding vectors) through backpropagation, constructs an intermediate calculation result matrix, and performs data sparsification. Specifically, the absolute value of each result sub-data in the intermediate calculation result matrix is ​​calculated. Based on the absolute value of each result sub-data and a preset gradient importance threshold, at least one important result sub-data is determined, and this at least one important result sub-data is retained. The other result sub-data in the intermediate calculation results are set to zero. The number k of retained important result sub-data is determined using the following formula 7: (Formula 7) in, This is the gradient importance threshold.

[0105] Furthermore, a binary mask matrix M is constructed based on this k value (when | The k-th largest value after sorting the absolute values ​​of the resulting subdata is set. =1, otherwise set to zero), finally obtaining the sparsified intermediate calculation result matrix, represented by the following formula 8: (Formula 7) in, It represents the Hadamardi (or Hadama) stack.

[0106] In some possible embodiments, in order to further reduce metadata overhead, the target mechanism uses a residual feedback mechanism to complete the zero-value part locally (using the gradient approximation value cached in the previous round), ensuring that the model convergence speed is not affected, and achieving synergistic optimization of communication efficiency and training accuracy.

[0107] Step 702-2: After sparsification, a first random noise matrix with element values ​​uniformly distributed in [-0.05, 0.05] is generated. After multiplying the first random noise matrix by a scaling factor and superimposing it onto the intermediate calculation result matrix, homomorphic encryption technology is used to encrypt the data to obtain shared model data and upload it to Hospital A. Step 703: Bank A, acting as the collaboration center, executes: Step 703-1: Obtain locally generated shared model data and receive shared model data uploaded by banks B, C, and D to generate a shared model dataset. , , , }; Step 703-2: Calculate the cosine similarity of each result sub-data in each shared model data, construct the gradient consistency matrix, and immediately start the isolation mechanism when the cosine similarity of a certain bank is detected to be lower than the preset threshold; In some possible implementations, gradient consistency detection based on cosine similarity can effectively identify malicious gradients that deviate from the normal update direction and is highly sensitive to Byzantine attacks such as gradient poisoning. Specifically, the gradient consistency matrix is ​​obtained using the following formula 8. : (Formula 8) in, This represents the i-th row of the intermediate calculation result matrix. This represents the j-th column of the intermediate calculation result matrix.

[0108] Step 703-3: Scan the shared model data to determine whether the shared model data meets the preset security conditions; Specifically, geofencing technology is used to strictly limit data collaboration to domestic financial institutions (based on dual verification of IP location and institution registration location), strictly prohibiting cross-border data flows. Simultaneously, predefined single-transaction characteristic fields (e.g., 20 or fewer items) are used to prevent excessive privacy association, and a predefined sensitive field library (including illegal data characteristics) is defined as the scope of unauthorized data volume types. When bank D is detected attempting to transmit user biometric fields (predefined sensitive fields), the communication connection with that bank is terminated based on a smart contract, and the aggregation training permissions of the dangerous institution are frozen.

[0109] Step 703-4: For the shared model data that has passed the test, determine the weight coefficient corresponding to each shared model data based on the historical contribution of each bank, and in the homomorphic encryption state, use a weighted average method to aggregate the corresponding shared model data to generate encrypted aggregated model data; The encrypted aggregate model data is generated using the following formula 9. : (Formula 9) in, These are the weighting coefficients. Shared model data that passed the test.

[0110] The subsequent steps 703-5 to 703-7, including the injection of the second random noise matrix by Bank A, the embedding of the watermark, and the setting of the threshold decryption conditions, can be found in steps 603-5 to 603-7 above. The subsequent steps 704 to 704-706, including the decryption by each bank, the uploading to Bank A, and the distribution of the completed aggregated model data plaintext, can be found in steps 604 to 606 above, and will not be repeated here.

[0111] The following describes the copyright verification process based on the above vertical federated learning example: Figure 8 As shown, it includes the following steps: Step S801: The regulatory agency, acting as the validator, inputs a test sample set into the anti-fraud model to load the anti-fraud model to be verified and extracts the key hidden layer output. The key hidden layer output is obtained using the following formula 10: (Formula 10) in, For the key hidden layer output, For the sample set, The number of samples in the test sample set is D, where D is the feature dimension and R is a real number.

[0112] Step S802: Bank A, as the prover, initiates a zero-knowledge proof protocol to the regulatory agency to prove that the watermark sub-data generated by its private key fragment has been embedded into the corresponding anti-fraud model, and that the watermark scaling factor corresponding to the watermark sub-data matches the agency's historical contribution. Specifically, Bank A, based on the watermark signal matrix S in the model, proves that the copyright confidence (Pearson correlation coefficient) between the key hidden layer output and the watermark signal matrix is ​​greater than the preset copyright threshold, and that the watermark scaling coefficient corresponding to the watermark signal matrix matches the institution's historical contribution. This copyright confidence reflects the correlation strength between the model output and the watermark signal, expressed by the following formula 11: (Formula 11) in, For copyright confidence, for standard deviation Let I be the standard deviation of I, where I is the ideal output distribution.

[0113] Step S803: The regulatory agency verifies the confidence level of the copyright through a zero-knowledge proof protocol to confirm that the copyright fact of the proving party is established; Specifically, the regulatory agency compares the calculated copyright confidence level with a preset copyright confirmation threshold (set to 0.8 in this embodiment). When If the value is greater than 0.8, a judgment is triggered to confirm ownership, determining that the model contains Bank A's copyright watermark; otherwise, the copyright ownership is deemed invalid.

[0114] Step S804: After the rights confirmation judgment is completed, a blockchain evidence certificate is generated simultaneously. This certificate must contain at least the model hash value, the current timestamp, and the calculated copyright confidence score. The data is stored in a heterogeneous blockchain for future auditing or legal evidence.

[0115] The following is an example of hybrid federated learning in the field of smart cities. The traffic management bureau, environmental protection bureau, and security department are the institutions participating in training the urban event prediction model. The training data includes traffic camera data, air quality monitoring data, and security patrol records from each institution. Because the data distribution exhibits mixed characteristics: traffic camera data from different areas have the same feature space but different samples (suitable for horizontal federated learning), while traffic flow data and air quality index data from the same area have overlapping samples but different feature dimensions (suitable for vertical federated learning), the coordination hub deployed in each institution determines the current training mode as a hybrid federated learning mode, that is, a combination of horizontal and vertical federated learning strategies.

[0116] See Figure 9 This is a flowchart illustrating the training process of a city event prediction model under a hybrid federated learning model. In this embodiment, a mean-based mechanism is used to inject the first random noise data. The initial value of the scaling factor α is 0.08, increasing by 0.015 each round, with an upper limit of 0.3. The privacy budget ε is set to 1.0, and the sensitivity Δf is preset to 1.5. The gradient importance threshold is configured to 0.2. The communication optimizer is configured with a bandwidth threshold of 100Mbps (sparserization is enabled below this value), and a latency window of 200ms. The training process includes the following steps: Step S901: The collaboration hub layer determines the target institution as the collaboration center in each training round based on a preset dynamic rotation strategy, with the traffic management bureau being the target institution in the first training round. Step S902: Each institution shall execute the following separately: Step S902-1: Each institution loads local data. For the horizontal part (traffic camera data), each institution loads the image data of its own area. For the vertical part (traffic flow and air quality index), each institution matches multi-source data of the same area using entity alignment technology. Specifically, forward propagation calculates the loss, backpropagation obtains intermediate calculation results (the horizontal part is the complete gradient matrix, and the vertical part is the intermediate calculation result based on its own feature dimension), and the bandwidth threshold configured by the optimization engine determines whether to perform data sparsification; when data sparsification is determined, the absolute value of each result sub-data is calculated, and based on the preset importance threshold β=0.3, the top 30% of the sub-data with larger absolute values ​​are retained, and the rest are set to zero.

[0117] Step S902-2: After sparsification, each agency generates a first random noise matrix with element values ​​uniformly distributed in [-0.05, 0.05]. This noise matrix is ​​multiplied by a scaling factor and then superimposed on each calculation result (the horizontal part is the complete gradient matrix, and the vertical part is the intermediate calculation result based on its own feature dimension). Homomorphic encryption technology is used to obtain shared model data, and the shared model data is uploaded to the traffic management bureau. Step S903: The Traffic Management Bureau acts as the coordinating center to execute: Step S903-1: Obtain locally generated shared model data and receive shared model data uploaded by the Environmental Protection Bureau and the Security Department to generate a shared model dataset; Step S903-2: Calculate the median absolute deviation of each shared model data and determine whether there is any abnormal shared model data; Step S903-3: Scan the shared model data to determine whether the shared model data meets the preset security conditions; Step S903-4: Perform aggregation calculations in the ciphertext space for the shared model data that has passed the detection.

[0118] Specifically, unlike horizontal or vertical federated learning, hybrid federated learning needs to process two types of aggregation objects simultaneously: for the horizontal portion (traffic camera data), aggregating the complete gradient. For the longitudinal component (traffic flow and air quality index), aggregate intermediate calculation results. The two types of aggregation results are merged in the encrypted state, and the encrypted aggregation model data is generated using the following formula 12. : (Formula 12) Furthermore, during the aggregation process, the underlying encryption algorithm remains unchanged, while the upper-level aggregation logic is adapted according to the data distribution characteristics. The process of aggregating the complete gradient and the intermediate calculation results is described in the above embodiment and will not be repeated here.

[0119] The subsequent steps 903-5 to 903-7, including the injection of the second random noise matrix by the traffic management bureau, embedding the watermark, and setting the threshold decryption conditions, can be found in steps 603-5 to 603-7 above. The subsequent steps 904 to 906, including the decryption by various agencies, uploading to the traffic management bureau, and distributing the completed aggregated model data plaintext, can be found in steps 604 to 606 above, and will not be repeated here.

[0120] Based on the same inventive concept, embodiments of this application also provide a cross-organizational data sharing system, such as... Figure 10 As shown, the system includes multiple institutions 1001 and a collaborative central layer 1002 deployed in each institution 1001, wherein: The collaboration hub layer is used to determine the target organization as the collaboration center in each training round from multiple organizations based on a preset dynamic rotation strategy. Each mechanism is used to: acquire the gradient data, the first random noise data, and the scaling factor for the current training round; inject the first random noise data into the gradient data based on the scaling factor, and perform homomorphic encryption on the noise-injected gradient data based on a preset public key to obtain shared model data; wherein, the scaling factor increases with each training round. The target organization encrypts and aggregates the obtained shared model data, then injects second random noise data generated based on preset privacy parameters to generate aggregated model data; the aggregated model data is then sent to other organizations. Each institution is also used to obtain target aggregated model data based on aggregated model data and preset private key fragments, and after adjusting the parameters of the corresponding model to be trained based on the target aggregated model data, start the next training round.

[0121] The system in this application embodiment enhances the noise obfuscation intensity in a stepwise manner by increasing the scaling factor with each round during training, effectively resisting gradient inversion attacks. Furthermore, it combines a triple protection chain consisting of homomorphic encryption, ciphertext domain differential noise injection, and threshold joint decryption to protect the privacy of gradient data throughout the entire process of transmission, aggregation, and decryption. This enables it to resist dynamic privacy attacks and improve the overall credibility of the system.

[0122] Based on the same inventive concept, embodiments of this application propose an electronic device, including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform steps in a cross-agency data sharing method as described in any of the first aspects of the above embodiments.

[0123] The following reference Figure 11To describe an electronic device 110 according to this embodiment of the present application. Figure 11 The device 110 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0124] like Figure 11 As shown, an electronic device 110 is presented in the form of a general electronic device. The components of an electronic device 110 may include, but are not limited to: at least one processor 111, at least one memory 112, and a bus 113 connecting different system components (including memory 112 and processor 111).

[0125] Bus 113 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or local bus using any of the various bus structures.

[0126] The memory 112 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 1121 and / or cache memory 1122, and may further include read-only memory (ROM) 1123.

[0127] The memory 112 may also include a program / utility 1125 having a set (at least one) of program modules 1124, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0128] An electronic device 110 can also communicate with one or more external devices 114 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with the electronic device 110, and / or with any device that enables the electronic device 110 to communicate with one or more other electronic devices (e.g., router, modem, etc.). This communication can be performed via an input / output (I / O) interface 115. Furthermore, an electronic device 110 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via a network adapter 116. As shown, the network adapter 116 communicates with other modules used in the electronic device 110 via a bus 113. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the electronic device 110, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0129] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program. The computer program includes program instructions, which, when executed by a computer, cause the computer to perform the steps described in any of the inter-agency data sharing methods above. Since the principle by which the above-described computer-readable storage medium solves the problem is similar to that of the inter-agency data sharing method, the implementation of the above-described computer-readable storage medium can be found in the implementation of the method; repeated details will not be elaborated further.

[0130] Based on the same inventive concept, this application also provides a computer program product, which includes computer program code that, when executed on a computer, causes the computer to perform the steps described in any of the inter-agency data sharing methods discussed above. Since the principle by which the above-described computer program product solves the problem is similar to that of the inter-agency data sharing method, the implementation of the above-described computer program product can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0131] The cross-institutional data sharing method, apparatus, device, computer-readable storage medium, and computer program product described in the above embodiments of this application effectively resist gradient inversion attacks by progressively increasing the noise obfuscation intensity in stages during training by increasing the proportional coefficient in each round. Furthermore, by combining a triple protection chain consisting of homomorphic encryption, ciphertext domain differential noise injection, and threshold joint decryption, the privacy of gradient data is protected throughout the entire process of transmission, aggregation, and decryption, which can resist dynamic privacy attacks and improve the overall credibility of the system.

[0132] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0133] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0134] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0135] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0136] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A cross-institutional data sharing method, characterized in that, Applied to a system comprising multiple mechanisms, the method includes: Based on a preset dynamic rotation strategy, the target institution to serve as the collaboration center in each training round is determined from the multiple institutions, and the following operations are performed in each training round: For each institution, the following steps are performed: obtaining the gradient data, first random noise data, and scaling factor for the current training round; injecting the first random noise data into the gradient data based on the scaling factor, and homomorphically encrypting the noise-injected gradient data based on a preset public key to obtain shared model data; wherein, the scaling factor increases with each training round. After the target institution encrypts and aggregates the obtained shared model data, it injects second random noise data generated based on preset privacy parameters to generate aggregated model data. The aggregated model data is then sent to other institutions so that each institution can obtain target aggregated model data based on the aggregated model data and preset private key fragments. After adjusting the parameters of the corresponding model to be trained based on the target aggregated model data, the next training round is started.

2. The method according to claim 1, characterized in that, The gradient data is a gradient data matrix composed of multiple gradient sub-data. After obtaining the gradient data, the first random noise data, and the scaling factor for the current training round, and before injecting the first random noise data into the gradient data based on the scaling factor, the method further includes: For the gradient data matrix, calculate the absolute value of each gradient sub-data in the gradient data matrix; Based on the absolute value of each gradient sub-data and a preset gradient importance threshold, at least one important gradient sub-data is determined from the gradient data matrix; Retain at least one important gradient sub-data and set the other gradient sub-data in the gradient data matrix to zero.

3. The method according to claim 1, characterized in that, The encrypted aggregation of the obtained shared model data includes: The weight coefficients for each shared model data are determined based on the historical contributions of each institution; wherein the weight coefficients are positively correlated with the historical contributions, and the historical contributions are determined based on the amount and quality of the training data of the corresponding institution. Under homomorphic encryption, the corresponding shared model data is aggregated and calculated based on the obtained weight coefficients.

4. The method according to any one of claims 1 to 3, characterized in that, After generating the aggregated model data, the method further includes: The target organization receives watermark data generated by each organization based on its own preset private key fragments; wherein, the watermark data is used to uniquely identify the copyright ownership of the corresponding organization. Based on the historical contribution of each institution, a watermark scaling factor is determined for each watermark sub-data; wherein, the watermark scaling factor is used to scale the watermark sub-data of the corresponding institution. Based on each watermark sub-data and its corresponding watermark scaling factor, watermark data is generated, and the watermark data is embedded into the aggregated model data according to a preset accuracy tolerance threshold. The watermark data is used to restore the historical contribution of each organization during copyright verification, so as to verify the copyright ownership of the aggregated model data.

5. The method according to any one of claims 1 to 3, characterized in that, Before encrypting and aggregating the obtained shared model data through the target institution, the method further includes: Calculate the median absolute deviation of the shared model data using the target mechanism; From the shared model data, identify abnormal shared model data whose median absolute deviation is greater than a preset median absolute deviation threshold, and replay the abnormal shared model data in a sandbox environment to obtain the corresponding replay results; If the replay result indicates a malicious entity, a voting request is initiated to other entities to isolate the malicious entity, and the corresponding level of isolation measures are implemented for the malicious entity based on the voting results. The isolation measures include at least one of the following: The shared model data of the current training round of the malicious organization is isolated to prevent encrypted aggregation of the shared model data; The malicious entity is isolated to prevent encrypted aggregation of shared model data from any training round of the malicious entity.

6. The method according to any one of claims 1 to 3, characterized in that, Before encrypting and aggregating the obtained shared model data through the target institution, the method further includes: For each shared model data, if it is determined that the shared model data does not meet the preset security conditions, the institution corresponding to the shared model data is identified as a dangerous institution, and the communication connection with the dangerous institution is terminated and the aggregated training permission of the dangerous institution is frozen based on the smart contract. The determination that the shared model data does not meet the preset security conditions includes: It was determined that the transmission of the shared model data did not conform to the preset security boundary; It was determined that the type of the shared model data did not conform to the pre-authorized data type range.

7. The method according to any one of claims 1 to 3, characterized in that, In each training round, the method further includes: When a predefined key operation is detected, a key operation record with a timestamp is generated, and the key operation record is synchronously written to two heterogeneous blockchains that use different consensus mechanisms. The key operation record is used to trace back the history during compliance checks to verify compliance during the training process; the key operation includes at least one operation performed by the target institution.

8. A cross-organizational data sharing system, characterized in that, The system comprises multiple mechanisms and a collaborative central layer, wherein: The collaborative hub layer is used to determine the target institution as the collaborative center in each training round from the multiple institutions based on a preset dynamic rotation strategy. Each of the mechanisms is respectively used to: acquire gradient data, first random noise data, and scaling factor for the current training round; inject the first random noise data into the gradient data based on the scaling factor, and perform homomorphic encryption on the noise-injected gradient data based on a preset public key to obtain shared model data; wherein, the scaling factor increases with each training round; The target organization is used to encrypt and aggregate the obtained shared model data, inject second random noise data generated based on preset privacy parameters, generate aggregated model data, and send the aggregated model data to other organizations; Each of the aforementioned institutions is further configured to obtain target aggregated model data based on the aggregated model data and preset private key fragments, and after adjusting the parameters of the corresponding model to be trained based on the target aggregated model data, start the next training round.

9. An electronic device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps in a cross-agency data sharing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for performing steps in a cross-agency data sharing method as described in any one of claims 1 to 7.

Images