A double-masked aggregation method supporting fine-grained control and resistant to poisoning attacks

Abstract

The application discloses a double-mask aggregation method supporting fine-grained control and resisting poisoning attacks, and belongs to the field of federal learning data privacy protection. The method constructs a system model comprising an aggregation server, a trusted audit server, a client set and a trusted authority. The client realizes gradient self-checking based on local training results, adopts norm clipping and validation set evaluation. The audit server randomly checks and compares uploaded results, identifies and isolates malicious nodes, and dynamically maintains a trusted list. The aggregation server adopts revocable attribute-based encryption to encrypt and distribute the global model, and controls the access rights of the client in a fine-grained manner. Meanwhile, the client constructs double masks to protect the uploaded gradient without adding noise, preventing the server from peeping the real data. The method realizes double protection against poisoning attacks and privacy leakage, improves the adaptability and overall security of the system in a dynamic environment, and is suitable for multi-party collaborative computing scenes with high security requirements such as medical treatment and finance.

Description

Technical Field

[0001] This invention relates to the field of secure aggregation technology in privacy protection and federated learning, specifically proposing a fine-grained and poison-resistant dual-mask aggregation method. Clients perform lightweight self-checks on model updates locally, employing norm pruning and loss evaluation based on a small validation set to determine update quality and mark them as qualified or unqualified. Simultaneously, an audit server randomly selects a portion of clients in each round and compares their pruned gradients with the self-check loss. If the audit fails, the client is considered a potentially malicious node and its reputation value is lowered. When the reputation value falls below a preset threshold, the client is disqualified from participating, effectively preventing poisoning attacks from affecting the global model. To achieve encrypted sharing and fine-grained access control of the global model, the protocol employs attribute-based revocable encryption (RABE). This technology not only enables fine-grained management and authorized access to the model but also provides protection against inference attacks. Furthermore, the dual-mask mechanism designed in this protocol effectively prevents servers from eavesdropping on users' uploaded gradients without adding extra noise, balancing privacy protection and model performance. This scheme is highly secure and adaptable, suitable for multi-party privacy computing environments such as federated learning. Background Technology

[0002] Federated learning, as an emerging distributed machine learning paradigm, minimizes the risk of raw data leakage by training models locally on the client side and exchanging only model updates, making it a key technology for solving the challenges of data privacy and data silos. Among numerous secure aggregation mechanisms, double-mask aggregation has attracted widespread attention due to its advantageous balance between privacy strength and computational efficiency. This method generates two layers of random masks for each client, ensuring that even if intermediate results are intercepted during the aggregation process, the original gradient of a single client cannot be reconstructed, thus providing higher privacy protection while guaranteeing the correctness of the aggregation.

[0003] The earliest single-mask scheme simply added a layer of random noise to the model update on the client side. While this prevented the server from directly obtaining the original gradients, it relied entirely on the honesty and lack of malicious intent of all clients. If a few nodes uploaded malicious gradients, the server could not determine their legitimacy within the encrypted domain, potentially "poisoning" the model and misleading the global training direction. To address this, subsequent research proposed a "decryption detection" approach, where the server decrypts some gradients and performs consistency checks on norms, directions, etc., before aggregation to identify abnormal updates. However, this method undermines the privacy protection of end-to-end encryption, allowing the server to still potentially access sensitive client information. This violates the core principle of "data not leaving the local machine" and is difficult to promote in compliant scenarios such as healthcare and finance.

[0004] To balance privacy and verifiability, the industry has proposed a multi-layered protection scheme combining homomorphic encryption, commitment mechanisms, and secret sharing. By completing the full aggregation within the encrypted domain and using commitment to prove the correctness of data uploaded by the client, plaintext exposure is avoided while providing verifiable evidence for the aggregation results. However, homomorphic encryption itself is computationally intensive, requiring multiple costly algebraic operations on the ciphertext. Meanwhile, commitment mechanisms often rely on multiple rounds of interaction to complete the challenge-response process. The significant encryption and interaction overhead accumulates rapidly in environments with large-scale client or node changes, making it difficult to meet the system throughput and response latency requirements for real-time training, and significantly reducing the overall scalability and deployment flexibility of the solution.

[0005] While ensuring user data privacy, federated learning still faces dual security challenges from poisoning attacks and inference attacks. Malicious clients can tamper with model updates locally, continuously injecting misleading information through carefully crafted gradients, subtly interfering with the convergence direction of the global model. Such poisoning behavior is often persistent across rounds; while existing detection methods can identify anomalies within a single round, they struggle to effectively eliminate malicious clients in multi-round environments. Simultaneously, attackers can leverage subtle differences in multi-round aggregation results to infer the local data distribution and characteristics of participants, thereby stealing private information without compromising encryption mechanisms. Currently, most protection schemes can only address single-round or localized poisoning attacks, lacking systemic defense capabilities against cross-round inference attacks. Because it is impossible to maintain end-to-end encryption while achieving real-time identification and isolation of such covert attacks, federated learning systems still have significant shortcomings in overall security when facing advanced persistent threats.

[0006] Furthermore, most current security aggregation solutions still rely on static permission configurations and fixed node lists, lacking effective mechanisms for perceiving and responding to dynamic client behavior. While this design might maintain system stability in ideal network environments, in real-world deployments, clients often experience frequent temporary offline and reconnection due to network fluctuations. If the system cannot flexibly identify, accept, and manage these dynamic changes, it may mistakenly classify legitimate nodes as abnormal or illegitimate, thus preventing them from participating in the training process. Simultaneously, the lack of mechanisms for continuous monitoring of node status and effective identity verification allows malicious nodes to remain dormant for extended periods. These nodes may seize opportunities to submit forged updates, disrupt model convergence, or even launch persistent poisoning attacks. Such static permission mechanisms are inadequate in the face of frequent node fluctuations and attacker masquerading, severely weakening the system's robustness and security. In large-scale, open federated learning systems, the lack of dynamic node management mechanisms not only affects system stability and model performance but also provides opportunities for attackers.

[0007] While existing aggregation mechanisms have proven effective in protecting privacy, further breakthroughs are needed to fully unleash their potential in the following areas: first, designing efficient and verifiable encryption protocols; second, building an end-to-end real-time anomaly detection system to simultaneously defend against poisoning and inference attacks; and third, improving the ability to flexibly manage dynamic node joining and leaving behaviors. Summary of the Invention

[0008] To address the three major challenges mentioned above, this invention proposes a fine-grained and poison-resistant dual-mask aggregation method. This method combines norm pruning, small-scale validation set loss evaluation, and attribute-based revocable encryption (RABE) to effectively prevent servers from speculating on user gradients and identifying malicious updates without adding extra noise. The proposed method also supports dynamic authorization and revocation based on user attributes, enabling secure sharing of the global model and fine-grained access control, while effectively preventing inference attacks. This scheme balances privacy with model performance, exhibiting high security, good controllability, and strong adaptability, making it suitable for multi-party privacy computing environments such as federated learning.

[0009] To achieve the above-mentioned objectives, the present invention employs the following technical solution:

[0010] In this invention, the aggregation server first initializes and generates global model parameters. Then, the server encrypts the model using Attribute Revocable Encryption (RABE) technology, and, combined with the access policy and the current revocable list, only authorizes reputable clients to decrypt and access it. After encryption, the encrypted model is broadcast to all online clients. Upon receiving the model, the client decrypts it using its private key. Successful decryption indicates that it has access rights for the current round. The client then performs training on local data, calculating the model gradient. After training, the client performs a self-check. First, it uses norm clipping to limit the gradient magnitude within a set threshold; second, it evaluates the loss change on a shared validation set. If the loss exceeds the tolerance range, the gradient is set to zero and marked as invalid. The client submits the processed gradient and validation loss to the audit server. The audit server randomly selects some clients, requiring them to submit the clipped true gradient and loss values, and performs consistency verification using the same validation set. If verification fails, the client's update is rejected and its reputation score is reduced; if the score is below a set threshold, the client is added to the revocable list. After the audit is completed, the aggregation server collects the encrypted gradients from qualified clients and recovers the sum of the true gradients from each client using a double masking mechanism. Subsequently, the server updates the global model and evaluates whether it has converged. If the model has not converged, the aggregation server re-encrypts the model based on the latest revocable list and broadcasts it to enter the next round of training. The specific steps of the method include:

[0011] Step 1: System Initialization: Construct a system model including an aggregation server, a trusted audit server, a client collection, and a trusted authority.

[0012] Step 2: Server initialization and publication of encrypted global model: The aggregation server uses RABE to encrypt the global model and other parameters, and then broadcasts the encrypted model ciphertext, the current learning rate, and the number of online clients to all online clients.

[0013] Step 3: Client decrypts and locally calculates model gradients: Each client uses the obtained RABE private key to decrypt the global model parameters, and then trains the model on the local dataset.

[0014] Step 4: Client-side local self-checking and clipping: The online client first performs local self-checking and clipping on the gradients calculated locally. Norm clipping is performed, and then the validation loss is calculated on a small batch of public validation sets. The local gradient is judged to be qualified based on the validation loss and a preset threshold. If it is not qualified, it is directly set to zero and the state is marked.

[0015] Step 5: Random Server Sampling and Auditing: The auditing server randomly selects several clients and verifies the submitted pruned true gradients and corresponding validation losses. For clients that fail the audit, the auditing server invalidates their updates for this round and deducts their reputation value. If the reputation value falls below a threshold, the client is added to the revocation list.

[0016] Step 6: Clients upload gradients using double masks: All online clients, based on their local self-test results, add double masks to the final gradient values ​​of this round and encrypt them before sending them to the aggregation server.

[0017] Step 7: The server aggregates and broadcasts the list of online clients: The aggregation server collects the encrypted gradients of all clients. Then, it broadcasts the list of disconnected clients to all clients;

[0018] Step 8: Clients resend mask shares: All online clients resend the corresponding mask shares according to the disconnection list broadcast by the server.

[0019] Step 9: Server aggregates gradients and verifies the model: After obtaining the aggregated gradients through the server's cancellation mask, the loss function is used to determine whether the model has converged. If it has converged, the result is output; if it has not converged, the process returns to step 2 for retraining.

[0020] Compared with the prior art, the present invention brings the following beneficial effects:

[0021] (1) By combining client-side local self-checking with random sampling by the audit server, the system effectively identifies and eliminates potential malicious updates. The client uses norm pruning and a small-scale validation set to self-check its local gradients, initially filtering out abnormal updates. The audit server further randomly samples some clients to verify their uploaded gradients against the validation loss, increasing the cost for malicious nodes to forge qualified updates and thus enhancing the system's defense against poisoning attacks. For clients found to be abnormal or of low quality during the audit, the system updates the revocable list in real time. By restricting their subsequent participation in aggregation and model acquisition permissions through the attribute revocation mechanism, a closed-loop defense system is constructed to effectively ensure model training quality and system security.

[0022] (2) Without introducing additional noise, a dual-mask mechanism is used to protect the true gradients uploaded by the clients. Each client overlays a local random mask and a mask generated collaboratively with other clients on its local model update, ensuring that no single party (including the server) can obtain the plaintext gradients of any client. Through the mutual cancellation of the masks, the system can prevent gradient leakage while ensuring the correctness of aggregation, thereby maximizing the expressive power of the gradients while protecting user privacy and effectively maintaining the accuracy of the global model. In addition, this mechanism has good fault tolerance. Even if some clients disconnect midway, their corresponding masks can be compensated through collaborative computation, thereby ensuring the correctness and robustness of the overall aggregation process and adapting to the characteristics of unstable online users in real federated environments.

[0023] (3) Attribute-based revocable encryption (RABE) encrypts the global model, allowing only clients that meet the attribute policy and have good reputation to decrypt and participate in local training. The system can dynamically update the revocation list based on changes in client attributes or reputation status, enabling flexible response and fine-grained control over node joining, leaving, and abnormal behavior. This mechanism not only improves the system's adaptability in dynamic environments but also effectively reduces the risk of inference attacks during model distribution through server-side model encryption, enhancing overall privacy protection capabilities. Notably, as the number of users increases, the computational overhead of RABE during encryption and decryption grows slowly, maintaining good efficiency and making it suitable for large-scale federated learning scenarios. Attached Figure Description

[0024] Figure 1 This is a flowchart of a dual-mask aggregation system that supports fine-grained control and is resistant to poisoning attacks, as described in an embodiment of the present invention.

[0025] Figure 2 This is a structural diagram of a dual-mask aggregation system that supports fine-grained control and is resistant to poisoning attacks, according to an embodiment of the present invention.

[0026] Figure 3This is a timing diagram of a dual-mask aggregation system that supports fine-grained control and is resistant to poisoning attacks, according to an embodiment of the present invention. Detailed Implementation

[0027] This invention addresses the shortcomings of existing technologies by proposing a dual-mask aggregation scheme that supports fine-grained control and possesses resistance to poisoning attacks. The following description, in conjunction with specific embodiments, facilitates understanding of the invention by those skilled in the art. It should be noted that this invention is not limited to the described embodiments. All improvements and modifications made based on the inventive concept within the scope of the claims should fall within the protection scope of this invention.

[0028] As a specific implementation method, combined with Figure 2 The method described in this invention consists of 9 steps:

[0029] (1) System initialization phase, which mainly involves the following processes:

[0030] (1-1) Construct a system consisting of an aggregation server (AS), a trusted audit server (TS), and a client collection. A system model consisting of trusted authorities (TAs).

[0031] (1-2) Aggregation Server (AS): This server receives and aggregates encrypted gradients uploaded by various clients. By canceling masked gradients, it achieves gradient aggregation results from qualified clients without exposing the client's true gradient plaintext. The aggregation server is also responsible for publishing key information such as the global model, learning rate, and online client list in each training round, coordinating communication and synchronization processes at each stage. Simultaneously, it can handle client disconnections, ensuring the stability of the training process. Furthermore, the aggregation server checks and evaluates the aggregated model to determine if it meets convergence conditions, deciding whether to terminate training or proceed to the next iteration.

[0032] (1-3) Trusted Audit Server (TS): Equipped with a verifiable module, it can randomly sample a portion of clients in each round according to a set audit probability. The audit server verifies the correspondence between the uploaded pruning gradient and the verification loss to determine whether the uploaded content is authentic and trustworthy. Based on the verification results, the client's reputation value is adjusted. If its behavior is abnormal, its reputation is reduced and it is added to the withdrawal list, thereby preventing malicious updates from participating in model training.

[0033] (1-4) Client This role is responsible for training the model based on local private data, performing a self-check of the validity of local gradients using norm pruning and a small-scale validation set, and marking and updating the status based on the judgment results. Clients that pass the self-check must first respond to the audit server's random check request. Selected clients must submit their pruned gradients and validation loss for the trusted audit server to verify their consistency. Only if the self-check is passed and not rejected by the audit server will the client overlay the local gradients with a collaborative mask, encrypt them, and upload them to the aggregation server. At the same time, based on its current attributes and reputation status, the client decrypts the encrypted global model parameters released by the server and continues to participate in the local training task.

[0034] (1-5) Trusted Authority (TA): During the system initialization phase, TA generates global public parameters and security parameters, and completes key distribution between clients and servers. Clients need to complete node registration and identity authentication at the trusted authority to obtain legitimate participation qualifications.

[0035] (2) The server initializes and publishes the encrypted global model. This stage mainly involves the following processes:

[0036] (2-1) Initialize global model parameters of the aggregation server And use RABE to encrypt attributes: ,in From the global model Learning rate and a list of online clients The solution comprises the following five algorithms: Key Policy Attribute Encryption (KP-ABE) based on Boolean circuits, which is used to implement revocable encryption and better suits the broadcasting scenarios of aggregation servers to improve encryption efficiency. Specifically, it includes the following five algorithms:

[0037] Enter security parameters The algorithm outputs common parameters. With master key .

[0038] Enter the master key Common parameters Access policies ,User ID and cancellation list Maximum length The algorithm outputs the user's key. .

[0039] Input common parameters Attribute vectors Cancel user list and plain text The algorithm outputs ciphertext. .

[0040] Input common parameters Key and ciphertext The algorithm outputs plaintext. or termination symbol .

[0041] Enter the list of users to be removed from the user list. and revoking user identity The algorithm outputs an updated list of users who have withdrawn their accounts. .

[0042] (2-2) The aggregation server will Broadcast to the list of online clients The client in the middle.

[0043] (3) The client decrypts and calculates the model gradient locally. This stage mainly involves the following processes:

[0044] (3-1) Each online client use Algorithm, input common parameters Attribute private key and the encrypted message sent by the server Obtain training parameters .

[0045] (3-2) If the access policy does not comply or the client is already on the revocation list If decryption fails, output "..." For local datasets The client performs one gradient descent iteration and calculates the local gradient. : .in These are the initial weights for the global model. For local data samples, For the dataset size, This represents the transpose of the model weight vector.

[0046] (4) Client-side local self-inspection and trimming stage, which mainly involves the following processes:

[0047] (4-1) Each client has local gradients conduct Norm clipping to limit gradient magnitude: .in, The preset gradient magnitude threshold, Gradient Norm.

[0048] (4-2) The client first calculates the candidate model. Then, in a small batch of shared verification sets... The following evaluates the change in loss caused by the gradient after pruning: .

[0049] (4-3) Judgment Size, if ,in If the gradient is set to the loss fluctuation threshold, it is considered unacceptable, and the client sets it to zero. And mark the status as "unqualified".

[0050] (4-4) Upload the loss change assessment value and the marked status to TS.

[0051] (5) Server random sampling and auditing stage, which mainly involves the following processes:

[0052] (5-1) The audit server TS receives the verification loss values ​​uploaded by all clients. Then, a client set is randomly selected according to the audit probability q. It requires submission of: the true gradient after clipping. and the corresponding validation loss value .

[0053] (5-2) The audit server uses the same validation set. Perform verification: .like ,in If a preset error threshold is set, the client's data is considered inconsistent, its update is invalidated, and its reputation score is lowered. .like Add the client to the undo list And execute RABE. Otherwise, retain the privileges and add it to the qualified list. .

[0054] (6) The client uses a double mask to upload the gradient during the phase, which mainly involves the following process:

[0055] (6-1) Based on the Diffie–Hellman (DH) key exchange protocol, qualified list clients Other online clients Negotiate to generate a shared key .

[0056] (6-2) For each shared key Generate m Shamir shares Threshold t): ,in For the client corresponding Share allocation. The Shamir threshold secret sharing algorithm used includes two components: share distribution and secret reconstruction.

[0057] Share distribution algorithm Input threshold Secrets, among which Representing a finite field The specified set of user IDs (assuming IDs are unique), and Output the secret share for each user n. (That is, perform t-threshold splitting on the secret s to generate) (The share of each user).

[0058] Secret Reconstruction Algorithm Input share subset (satisfy and Output the reconstructed secret s (i.e., the original secret recovered from at least t shares).

[0059] (6-3) Use the same algorithm to... Generate m Shamir shares: .

[0060] (6-4) Client Using a pseudo-random number generator (PRG) based on a local random seed and each shared key Generate corresponding mask values .

[0061] (6-5) The client uses the server's public key to mask the value Encryption Send to aggregation server AS.

[0062] (7) The server aggregates and broadcasts the list of online clients. This stage mainly involves the following processes:

[0063] (7-1) The aggregation server AS collects encrypted information uploaded by all clients. and using their own private key Decryption Obtain the gradient value of the mask If decryption fails (e.g., the ciphertext has been tampered with), the corresponding client will mark it as invalid and will not include it in subsequent processing.

[0064] (7-2) The aggregation server successfully decrypted and obtained the data. The set of clients, denoted as Therefore, the set of disconnected clients. Defined as a client that failed to send a message in the qualified list: .

[0065] (7-3) List of Aggregator Servers That Will Go Offline and qualified list The broadcast is sent to all clients that are still online.

[0066] (8) Client resends mask share stage, which mainly involves the following processes:

[0067] (8-1) Client Received disconnection list and qualified list Then, the corresponding share is sent to the aggregation server based on the target client's status.

[0068] (8-2) For disconnected clients , will send with Shared key share This is used to aggregate the shared mask of disconnected clients when the server reconstructs them.

[0069] (8-3) For normally online clients This will send a share of the local seed. This is used to aggregate servers to offset local masks.

[0070] (9) The server aggregates gradients and validates the model. This stage mainly involves the following processes:

[0071] (9-1) After receiving at least t mask shares from clients (t is the Shamir threshold), the aggregation server reconstructs and cancels the mask using the Shamir secret reconstruction algorithm and a pseudo-random number generator.

[0072] (9-2) For each online client Collect its local mask t shares The original mask is recovered using a secret reconstruction algorithm. (9-3) For each disconnected client Collect its data with online clients Shared key t shares Reconstruct the shared key: .

[0073] (9-4) Utilizing the reconstructed local mask and shared keys The pseudo-random number generator is used to cancel out the gradient, resulting in the final aggregated gradient: .

[0074] (9-5) Calculate the current model on the global validation set Losses: .like Less than the set loss threshold If the training terminates, the final model will be output. Conversely, return to step 2 to proceed to the next step. Round training. It's worth noting that if the audit server updates the revocation list to... Then step 2 should be combined with the current cancellation list. Release of a new global cryptographic model .

Claims

1. A dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks, characterized in that, Includes the following steps: Step 1: Construct and initialize a system model including an aggregation server, a trusted audit server, a client collection, and a trusted authority; Step 2: The server initializes and publishes the encrypted global model; Step 3: The client decrypts and calculates the model gradient locally; Step 4: Client-side local self-inspection and cropping; Step 5: Random server checks and audits; Step 6: The client uploads the gradient using a double mask; Step 7: The server aggregates and broadcasts the list of online clients; Step 8: The client resends the mask share; Step 9: Aggregate gradients on the server and validate the model.

2. The dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks according to claim 1, characterized in that, The system model of the method includes several entities: an aggregation server, a trusted audit server, a client, and a trusted authority. Specifically: The aggregation server receives and aggregates encrypted gradients uploaded by various clients. By canceling the masked gradients, it achieves gradient aggregation results from qualified clients without exposing the client's true gradient plaintext. The aggregation server is also responsible for publishing key information such as the global model, learning rate, and online client list in each training round, coordinating communication and synchronization processes at each stage. Simultaneously, it can handle client disconnections, ensuring the stability of the training process. Furthermore, the aggregation server checks and evaluates the aggregated model to determine if it meets convergence conditions, deciding whether to terminate training or proceed to the next iteration. The trusted audit server has a verifiable module that can randomly sample a portion of clients in each round according to a set audit probability. The audit server verifies the correspondence between the uploaded pruning gradient and the verification loss to determine whether the uploaded content is authentic and trustworthy. The client's reputation value is adjusted based on the verification results. If its behavior is abnormal, its reputation is reduced and it is added to the revocation list to prevent malicious updates from participating in model training. The client is responsible for training the model based on local private data, performing a self-check of the validity of its local gradients using norm pruning and a small-scale validation set, and marking the update status according to the judgment result. Clients that pass the self-check must first respond to the audit server's random check request. Selected clients must submit their pruned gradients and validation loss for the trusted audit server to verify their consistency. Only if the self-check is passed and not rejected by the audit server will the client overlay its local gradients with a collaborative mask, encrypt them, and upload them to the aggregation server. Simultaneously, based on its current attributes and reputation status, the client decrypts the encrypted global model parameters released by the server and continues to participate in the local training task. The trusted authority is used to generate global public parameters and security parameters during system initialization and to complete key distribution between clients and servers. Clients need to complete node registration and identity authentication with the trusted authority to obtain legitimate participation qualifications.

3. The dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks according to claim 1, characterized in that, The aggregation server uses attribute-based revocable encryption (RABE) technology to encrypt the global model, specifically: Aggregation server initializes global model parameters And use RABE to encrypt attributes: ,in From the global model Learning rate and a list of online clients Composition. Finally, the aggregation server will... Broadcast to the list of online clients The client in the middle. In addition, in order to better suit the broadcast scenario of the aggregation server and improve encryption efficiency, this solution adopts key policy attribute encryption based on Boolean circuit (KP-ABE) to implement the revocable encryption function.

4. The dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks according to claim 1, characterized in that, In the method described above, the client uses norm clipping and a small-scale validation set to perform a self-check on the validity of the local gradient, specifically as follows: Each client has local gradients conduct Norm clipping to limit gradient magnitude: .in, The preset gradient magnitude threshold, Gradient Norm. Then the client first calculates the candidate model. Then, in a small batch of shared verification sets... The following evaluates the change in loss caused by the gradient after pruning: .like ,in If the gradient is set to the loss fluctuation threshold, it is considered unacceptable, and the client sets it to zero. The status is then marked as "unqualified". Finally, the loss change assessment value and the marked status are uploaded to the aggregation server.

5. The dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks according to claim 1, characterized in that, The audit server verifies the correspondence between the clipping gradients uploaded by the client and the validation loss, and adjusts the reputation score accordingly. Specifically: The audit server receives the verification loss values ​​uploaded by all clients. Then, a client set is randomly selected according to the audit probability q. It requires submission of: the true gradient after clipping. and the corresponding validation loss value The audit server uses the same validation set. Perform verification: .like ,in If a preset error threshold is set, the client's data is considered inconsistent, its update is invalidated, and its reputation score is lowered. .like Add the client to the undo list And execute RABE. Otherwise, retain the privileges and add it to the qualified list. .

6. The dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks according to claim 1, characterized in that, Each online client adds a double mask to its local gradient based on the Diffie-Hellman (DH) key exchange protocol and a pseudo-random number generator (PRG). Specifically: Qualified list client Other online clients Negotiate to generate a shared key For each shared key Generate m Shamir shares Threshold t): ,in For the client corresponding Shares. Apply the same algorithm to... Generate m Shamir shares: Then the client Using a pseudo-random number generator (PRG) based on a local random seed and each shared key Generate corresponding mask values The final client uses the server's public key to mask the value. Encryption Send to the aggregation server.

7. The dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks according to claim 1, characterized in that, The aggregation server broadcasts a list of online clients so that clients can resend mask shares, thereby supporting subsequent mask recovery by the aggregation server. Specifically: The aggregation server AS collects encrypted information uploaded by all clients. and using their own private key Decryption Obtain the gradient value of the mask If decryption fails (e.g., the ciphertext has been tampered with), the corresponding client marks it as invalid and excludes it from further processing. Subsequently, the aggregation server counts successfully decrypted and retrieved data. The set of clients, denoted as Therefore, the set of disconnected clients. Defined as a client that failed to send a message in the qualified list: List of servers that will go offline. and qualified list Broadcast to all clients that are still online; Client Received disconnection list and qualified list Then, the corresponding share is sent to the aggregation server based on the target client's status. For disconnected clients... , will send with Shared key share This is a shared mask used to aggregate and reconstruct offline clients on the server. For normally online clients... This will send a share of the local seed. This is used to aggregate servers to offset local masks.

8. The dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks according to claim 1, characterized in that, The aggregation server uses a secret sharing algorithm to recover the masks uploaded by each user and performs mask cancellation to obtain the aggregated model. Subsequently, the aggregation server performs validity checks and performance evaluations on the aggregated model to determine whether the current model meets preset convergence conditions, and thus decides whether to terminate the model training process or start the next training iteration. Specifically: After receiving mask shares from at least t clients (where t is the Shamir threshold), the aggregation server reconstructs and cancels the mask using the Shamir secret reconstruction algorithm and a pseudo-random number generator. For each online client... Collect its local mask t shares The original mask is recovered using a secret reconstruction algorithm. For each disconnected client Collect its data with online clients Shared key t shares Reconstruct the shared key: Utilizing the reconstructed local mask and shared keys The pseudo-random number generator is used to cancel out the gradient, resulting in the final aggregated gradient: Calculate the current model's performance on the global validation set. Losses: .like Less than the set loss threshold If the training terminates, the final model will be output. Conversely, return to step 2 to proceed to the next step. Round training. It's worth noting that if the audit server updates the revocation list to... Then step 2 should be combined with the current cancellation list. Release of a new global cryptographic model .

9. A dual-mask aggregation system supporting fine-grained control and resistance to poisoning attacks, characterized in that, This relates to a dual-mask aggregation method supporting fine-grained control and resistance to poisoning attacks, as described in any one of claims 1-8. The method includes a task initialization module, a user self-check module, an audit module, a mask generation module, a mask aggregation module, and an aggregation evaluation module. The task initialization module is initialized and publishes the key parameters required for training by the aggregation server before each round of federated training. The server uses attribute-based revocable encryption to encrypt the global model, learning rate, and online client identity list. This ensures that only clients meeting fine-grained access control policies and with qualified reputation scores can decrypt and access the training parameters. Simultaneously, this module effectively prevents inference attacks, ensuring the security of the model and data. The user self-checking module is executed by each online client. Based on local data and a small-scale validation set, each client performs a validity self-check on its generated local gradients, including norm pruning, and marks the update status. Only clients that pass the self-check are required to respond to the audit server's random sampling request. Selected clients must submit the pruned gradients and validation loss for the trusted audit server to verify their consistency. Only clients that pass the self-check and are not rejected by the audit server will encrypt their local gradients by overlaying them with a collaborative mask and upload them to the aggregation server. The audit module is implemented by a trusted audit server. In each training round, the audit server randomly samples a portion of clients according to a preset probability to verify the correspondence between the uploaded pruning gradients and the validation loss. Based on the verification results, the client's reputation value is adjusted. For clients exhibiting abnormal behavior, their reputation value is lowered. If the reputation value falls below a set threshold, the client is added to a revocation list to prevent malicious updates from affecting model training. The mask generation module generates a shared key through Diffie-Hellman key negotiation between online clients. The client, in conjunction with a pseudo-random number generator, adds a double mask to its local gradient. Simultaneously, the client utilizes a secret sharing algorithm to preserve mask shares. The mask aggregation module is executed by the aggregation server. The server first collects the local random mask shares reissued by qualified clients and the shared key shares between the server and disconnected clients. After recovering the double mask using a secret sharing algorithm, a pseudo-random number generator is used to cancel the mask, obtaining the true aggregated gradient. During this process, the server can only obtain the final aggregation result and cannot reconstruct the original gradients of each client, effectively protecting the privacy and security of user gradients. The aggregation evaluation module is responsible for the aggregation server to calculate the loss and evaluate the model performance of the aggregated gradient after removing the mask, and to determine whether the model has met the convergence condition. Based on the evaluation results, the aggregation server decides whether to terminate the training output or continue to the next iteration. If the audit server updates the withdrawal list, the aggregation server will re-encrypt the global model based on the latest withdrawal list and release it, forming a closed-loop training system.

Images