A medical image federated learning method and system based on multi-layer tree authentication

Abstract

This invention discloses a medical image federated learning method and system based on multi-layer tree authentication, belonging to the fields of medical image federated learning and data security technology. The method includes: the client constructs a multi-layer hash tree to obtain the dataset root hash; the central server constructs a configuration anchor tree, binds the dataset root hash with the configuration tree root hash to generate an authentication root, and issues a signed signature; after client verification, instances are sampled and proofs are generated, original features are extracted and dimensionality reduced, binding labels are generated, and feature binding data is uploaded; after successful verification by the central server, linear layer forward and backward propagation is performed and gradients are backpropagated, instance contribution is calculated based on Taylor approximation, a contribution hash tree is constructed and stored on the blockchain, and the projection matrix is ​​periodically rotated. This invention achieves unified authentication for data integrity and preprocessing accuracy, cryptographic binding of features and data, and auditable traceability of instance-level contributions through the synergy of dual-tree authentication, feature binding, and on-chain contribution.

Description

Technical Field

[0001] This invention relates to the field of medical image federated learning and data security technology, specifically to a medical image federated learning method and system based on multi-layer tree authentication. Background Technology

[0002] Digital storage of medical image data generally follows the DICOM standard, organizing data into a four-level hierarchy: patient, examination, sequence, and instance. With the widespread application of deep learning in medical image analysis, the data volume of a single medical institution is often insufficient to meet the training needs of high-precision models, making multi-institutional collaborative training a growing trend. Federated learning, as a privacy-preserving solution, allows multiple institutions to jointly train models without sharing raw data. However, classic federated learning requires each participant to upload complete model gradients, resulting in high communication overhead and vulnerability to gradient inversion attacks.

[0003] Split learning, a lightweight variant of federated learning, significantly reduces communication overhead by splitting the model at splitting points, allowing clients to upload only the dimensionality-reduced features instead of the complete gradients. However, while improving communication efficiency, split learning introduces new security challenges: First, the lack of cryptographic binding between the feature representations uploaded by the client and the original data makes it vulnerable to feature-data mismatch attacks by malicious clients. Second, the accuracy of preprocessing parameters, such as the dimensionality reduction matrix, cannot be effectively verified, and there is a lack of a unified authentication mechanism for data integrity and preprocessing accuracy. Third, existing contribution evaluation schemes have coarse-grained calculations, mostly at the client or batch level, making it difficult to precisely measure the actual contribution of each training sample in a single training session, and the contribution results are often recorded unilaterally by the central end, lacking credibility. Fourth, privacy protection and data verification are difficult to balance; while ensuring the verifiability of data and features, it is difficult to effectively reduce the risk of privacy leakage.

[0004] Therefore, it is essential to design a federated learning method and system for medical images based on multi-layer tree authentication. Summary of the Invention

[0005] The purpose of this invention is to provide a medical image federated learning method and system based on multi-layer tree authentication. Through the synergistic effect of multi-layer hash tree authentication, configuration anchor tree, feature binding label and contribution on-chain mechanism, it can achieve unified authentication of data integrity and preprocessing accuracy, cryptographic binding of features and data, and auditable traceability of contribution at the training instance level.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A federated learning method for medical images based on multi-layer tree authentication includes: Step 1: Based on the DICOM hierarchy of the local medical image data, the client node uses a cryptographic hash function to build a multi-level hash tree from bottom to top, obtaining the dataset root hash used to verify data integrity; Step 2: The central server determines the configuration parameters for this round of federated learning, and uses the configuration parameters as leaf nodes to build a configuration anchor tree to obtain the configuration tree root hash; Step 3: The central server binds the root hash of the client node's dataset with the root hash of the configuration tree using a cryptographic hash function to generate an authentication root. The central server then digitally signs the authentication root using its private key and sends the signed authentication root and configuration parameters to the corresponding client node. Step 4: After receiving the authentication root and configuration parameters, the client node performs a validity verification. If the verification passes, the authentication relationship is established; otherwise, the client refuses to participate in this round of training. Step 5: The client node samples instances from the local training set, generates an inclusion proof in a multi-level hash tree for each sampled instance, extracts the original feature vector of the sampled instance using the local encoder in a deterministic pattern, and performs a dimensionality reduction transformation on the original feature vector using a projection matrix to obtain a dimensionality reduction feature vector. The hash value of the original feature vector and the hash value of the dimensionality reduction feature vector are then calculated. Step 6: The client node binds the hash value of the dimensionality-reduced feature vector, the hash value of the original feature vector, the leaf node hash of the sampling instance in the multi-level hash tree, the authentication root, and the current round number using a cryptographic hash function to generate a binding label. The feature binding data of each sampling instance is then uploaded to the central server in batches. The structure of the feature binding data includes the dimensionality-reduced feature vector, the binding label, the proof, and the feature vector hash value. Step 7: The central server performs multiple verifications on each received feature binding data. After the verification is passed, it accepts the feature binding, stacks the feature matrices that have been verified by multiple clients, performs forward and backward propagation of the central side linear layer, calculates the loss function and obtains the feature gradient, and sends the feature gradient back to the corresponding client node; the client node updates its local encoder parameters after receiving the feature gradient. Step 8: The central server uses the dimensionality-reduced feature vectors it holds and their corresponding feature gradients to calculate the contribution of each sampled instance to the loss reduction based on the first-order Taylor approximation. It aggregates the instance contributions of each client node to form an institutional contribution record, constructs a contribution hash tree, and writes the root hash, authentication root, and configuration tree root hash of the contribution hash tree into the block structure and appends it to the blockchain for evidence storage. Step 9: The central server generates a new projection matrix based on the preset rotation interval and global model state, updates the configuration anchor tree and authentication root, and sends the updated authentication root and new configuration parameters to the client nodes for subsequent training rounds.

[0007] Further, in step 1, the multi-level hash tree corresponds to the DICOM hierarchical structure, and includes, from bottom to top, the following: At the instance layer, the leaf node hash is obtained by calculating the hash of the pixel data of a single DICOM instance file; The sequence layer aggregates the leaf node hashes of instances within the same sequence to obtain the sequence root hash. The inspection layer aggregates the sequence root hashes of all sequences within the same inspection to obtain the inspection root hash; At the patient level, the patient root hash is obtained by aggregating the root hashes of all examinations performed on the same patient. Aggregate the patient root hashes of multiple patients to obtain the dataset root hash.

[0008] Furthermore, in step 2, the configuration parameters include the projection matrix, encoder weight hash, layer cutting position, and differential privacy configuration.

[0009] Further, in step 4, the validity verification includes: digital signature verification, consistency verification between the locally recalculated configuration tree root hash and the configuration tree root hash in the authentication root, consistency verification between the local dataset root hash and the dataset root hash in the authentication root, consistency verification between the hash value of the projection matrix and the record in the configuration anchor tree, consistency verification between the hash value of the local encoder weight and the record in the configuration anchor tree, and consistency verification between the round number in the authentication root and the current federated learning round.

[0010] Further, in step 7, the multiple verifications include: digital signature verification of the authentication root, verification that the sampled instance does exist in the client's data tree using the hash of the data root containing the proof and the authentication root, verification that the projection matrix bound in the hash value of the dimensionality-reduced feature vector confirms its existence in the configuration anchor tree, verification that the hash value of the dimensionality-reduced feature vector is recalculated using the received dimensionality-reduced feature vector and the projection matrix confirmation and compared with the implicit value in the binding label, and verification that the binding label is recalculated using the received data and compared with the binding label submitted by the client.

[0011] Furthermore, in step 8, the contribution is calculated as follows: The components of the dimensionality-reduced feature vector are multiplied by their corresponding feature gradient components and then summed to obtain an approximate contribution of the sampling instance to the loss reduction. The contributions of the sampled instances that passed the verification in this round are aggregated, and rare categories are compensated by inverse frequency weighting according to category.

[0012] Furthermore, in step 9, the new projection matrix is ​​generated by the global model hash and the current round number derived seed.

[0013] This invention also provides a medical image federated learning system based on multi-layer tree authentication, applied to the aforementioned medical image federated learning method based on multi-layer tree authentication, comprising: The client nodes include: The data tree construction module is used to build a multi-level hash tree from bottom to top based on the DICOM hierarchy of local medical image data and using cryptographic hash functions to obtain the data root hash used to verify data integrity. The client verification module is used to receive the authentication root and configuration parameters sent by the central server, and to verify the digital signature and content validity of the authentication root. If the verification is successful, the authentication relationship is established; otherwise, participation in this round of training is refused. The feature extraction and binding data generation module is used to sample instances from the local training set, generate an inclusion proof for each sampled instance in the multi-layer hash tree, extract the original feature vector of the sampled instance using a local encoder with a deterministic pattern, perform a dimensionality reduction transformation on the original feature vector using a projection matrix to obtain a dimensionality-reduced feature vector, and calculate the hash value of the original feature vector and the hash value of the dimensionality-reduced feature vector. It is also used to bind the hash value of the dimensionality-reduced feature vector, the hash value of the original feature vector, the leaf node hash of the sampled instance, the authentication root, and the current round number using a cryptographic hash function to generate a binding label, and batch upload the feature binding data containing the dimensionality-reduced feature vector, binding label, inclusion proof, and feature vector hash value to the central server. The model update module is used to receive the feature gradients sent back from the central server and update the local encoder parameters. The central server includes: The configuration tree construction module is used to determine the configuration parameters for this round of federated learning, and to construct a configuration anchor tree using the configuration parameters as leaf nodes to obtain the configuration tree root hash. The authentication root generation module is used to bind the data root hash of the client node with the configuration tree root hash using a cryptographic hash function to generate an authentication root, and to digitally sign the authentication root using the private key of the central server, and then send the signed authentication root and the configuration parameters to the corresponding client node. The central verification and training module is used to perform multiple verifications on each received feature binding data. After the verification is passed, the feature binding is accepted. The feature matrices verified by multiple clients are stacked, and forward and backward propagation of the central side linear layer is performed. The loss function is calculated and the feature gradient is obtained. The feature gradient is then fed back to the corresponding client node. The contribution calculation and on-chain module is used to calculate the contribution of each sampled instance to the loss reduction based on the Taylor first-order approximation by using the held dimensionality reduction feature vector and its corresponding feature gradient, aggregating the instance contribution of each client node to form an institutional contribution record, constructing a contribution hash tree, and writing the root hash of the contribution hash tree, the authentication root, and the configuration tree root hash into the block structure and appending it to the blockchain for evidence storage. The projection matrix rotation module is used to generate a new projection matrix based on a preset rotation interval and the global model state, update the configuration anchor tree and authentication root, and send the updated authentication root and new configuration parameters to the client node.

[0014] In summary, the present invention has at least one of the following beneficial technical effects: First, the authentication root cryptographically binds the data set root hash and the configuration tree root hash, and protects them with the private key of the central server. Tampering with the projection matrix or encoder version will cause the configuration tree root hash to change, which will cause the authentication root verification to fail. This achieves unified authentication for data integrity and preprocessing accuracy, which can effectively alleviate the problem of the dual verification being mutually disconnected in traditional schemes.

[0015] Second, by binding labels to establish a strong cryptographic association between dimensionality reduction features and data instances, attackers attempting to implement feature-data mismatch need to find a collision in the cryptographic hash function, thus enhancing the defense capability against feature-data mismatch attacks under the split learning architecture from a cryptographic perspective.

[0016] Third, leveraging the advantage that the central server can hold the feature representation of a single sample in split learning, the contribution of each training instance is calculated based on the Taylor first-order approximation. Compared with client-level or batch-level solutions, this provides a more granular contribution quantification capability. It also supports decomposition statistics by image modality and rare category weight compensation, making the contribution quantification results more accurate and fair.

[0017] Fourth, based on the split learning architecture, the client only uploads low-dimensional reduced features instead of the complete gradient, which can effectively reduce communication overhead. At the same time, combined with multiple mechanisms such as dynamic rotation of the projection matrix, differential privacy noise addition, and gradient norm pruning, it helps to reduce the risk of feature inversion attacks while ensuring training efficiency.

[0018] Fifth, the contribution data of each institution is encapsulated in a contribution hash tree and written to the blockchain for evidence storage, relying on a chain-based self-authentication mechanism to prevent tampering of the contribution data. Each institution can independently generate contribution proofs for appeals, without relying on unilateral trust in the central server. The conservation checks and chain-based verification help ensure the fairness and credibility of the audit results. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0021] like Figure 1 As shown, this invention provides a medical image federated learning method based on multi-layer tree authentication, including: Step 1: Based on the DICOM hierarchy of the local medical image data, the client node uses a cryptographic hash function to build a multi-level hash tree from bottom to top, obtaining the dataset root hash used to verify data integrity; Step 2: The central server determines the configuration parameters for this round of federated learning, and uses the configuration parameters as leaf nodes to build a configuration anchor tree to obtain the configuration tree root hash; Step 3: The central server binds the root hash of the client node's dataset with the root hash of the configuration tree using a cryptographic hash function to generate an authentication root. The central server then digitally signs the authentication root using its private key and sends the signed authentication root and configuration parameters to the corresponding client node. Step 4: After receiving the authentication root and configuration parameters, the client node performs a validity verification. If the verification passes, the authentication relationship is established; otherwise, the client refuses to participate in this round of training. Step 5: The client node samples instances from the local training set, generates an inclusion proof in a multi-level hash tree for each sampled instance, extracts the original feature vector of the sampled instance using the local encoder in a deterministic pattern, and performs a dimensionality reduction transformation on the original feature vector using a projection matrix to obtain a dimensionality reduction feature vector. The hash value of the original feature vector and the hash value of the dimensionality reduction feature vector are then calculated. Step 6: The client node binds the hash value of the dimensionality-reduced feature vector, the hash value of the original feature vector, the leaf node hash of the sampling instance in the multi-level hash tree, the authentication root, and the current round number using a cryptographic hash function to generate a binding label. The feature binding data of each sampling instance is then uploaded to the central server in batches. The structure of the feature binding data includes the dimensionality-reduced feature vector, the binding label, the proof, and the feature vector hash value. Step 7: The central server performs multiple verifications on each received feature binding data. After the verification is passed, it accepts the feature binding, stacks the feature matrices that have been verified by multiple clients, performs forward and backward propagation of the central side linear layer, calculates the loss function and obtains the feature gradient, and sends the feature gradient back to the corresponding client node; the client node updates its local encoder parameters after receiving the feature gradient. Step 8: The central server uses the dimensionality-reduced feature vectors it holds and their corresponding feature gradients to calculate the contribution of each sampled instance to the loss reduction based on the first-order Taylor approximation. It aggregates the instance contributions of each client node to form an institutional contribution record, constructs a contribution hash tree, and writes the root hash, authentication root, and configuration tree root hash of the contribution hash tree into the block structure and appends it to the blockchain for evidence storage. Step 9: The central server generates a new projection matrix based on the preset rotation interval and global model state, updates the configuration anchor tree and authentication root, and sends the updated authentication root and new configuration parameters to the client nodes for subsequent training rounds.

[0022] The following will elaborate on this in detail.

[0023] In step 1, the client node constructs a multi-level hash tree from bottom to top using cryptographic hash functions based on the DICOM hierarchy of the local medical image data to obtain the dataset root hash used to verify data integrity, specifically: The digital storage of medical imaging data (CT, MRI, X-ray, etc.) follows the DICOM international standard, and the data is organized in a four-level hierarchy: Patient → Study → Series → Instance. An instance corresponds to a single DICOM file, a series is a collection of instances from the same scan, a study is a collection of sequences from a single study, and a patient is a collection of multiple studies from the same patient. Correspondingly, the multi-layered hash tree constructed in this step is a four-layered hash tree (specifically a Merkle tree) corresponding to the DICOM hierarchical structure, aggregating layer by layer from bottom to top. This multi-layered hash tree is the system's infrastructure layer, running through the entire chain from local data verification to federated learning authentication.

[0024] The process of constructing a multi-level hash tree is as follows: First layer (instance layer / leaf node): Calculate the SM3 hash byte by byte for the pixel data Tag(7FE0,0010) of a single DICOM instance, and then concatenate it with the instance UID to calculate the leaf node hash. The calculation method is as follows: ; ; in This indicates a splicing operation. Any tampering with a single bit of pixel data will result in... Changes occurred, leading to This change is guaranteed by the avalanche property of SM3 as a cryptographic hash function.

[0025] The second layer (sequence layer): After sorting the leaf node hashes of all instances within the same sequence by InstanceNumber or SliceLocation, a Merkle subtree is constructed to produce the sequence root hash. This is represented as: ; Sorting ensures the deterministic tree structure of the same sequence.

[0026] The third layer (checking layer): Sort the sequence root hashes of all sequences under the same check in lexicographical order by SeriesUID, construct a check-level Merkle tree, and produce the check root hash. This is represented as: ; Fourth layer (patient layer): Sort the root hashes of all examinations for the same patient in lexicographical order by StudyUID, construct a patient-level Merkle tree, and produce the patient root hash. The root hashes of multiple patients are further aggregated into a dataset root hash in lexicographical order of PatientID. , is represented as: ; ; The introduction of the patient layer allows the data correlation of the same patient across examinations to be captured cryptographically. If the images of the same patient are tampered with in different examinations, the patient root hash will detect the inconsistency.

[0027] Above the multi-layered hash tree, the system further constructs a chain structure (blockchain). Each block contains a timestamp, the current block hash, the previous block hash, and the data Merkle tree root, forming an append-only and immutable chain structure. The block hash is calculated as follows: ; in, This is used to create an append-only, immutable chain structure based on the hash of the previous block. Tampering with any historical block... This will cause the block This change leads to a chain reaction of invalidation of all subsequent block hashes. This chain-like self-authentication mechanism provides tamper-proof timeline evidence for secondary auditing of federated learning rounds.

[0028] To ensure the correctness of the cryptographic implementation, SM3 implements built-in GM / T0004-2012 standard test vectors (including empty string, "abc", 10, etc.). 6 (Standard test cases such as "a"), the system automatically executes test vector verification each time it starts, forming the cryptographic correctness foundation of the self-authentication mechanism.

[0029] This multi-layered hash tree self-authentication mechanism has self-authentication capabilities; the verifier only needs to hold... and a strip of size Merkle's proof (a four-level path traversing the instance layer → sequence layer → inspection layer → patient layer) can verify the integrity of any single instance without accessing the entire tree or the original pixel data. SM3's collision resistance (birthday attack bound) This ensures that attackers cannot construct two different datasets that produce the same root hash.

[0030] In step 2, the central server determines the configuration parameters for this round of federated learning, and constructs a configuration anchor tree using the configuration parameters as leaf nodes to obtain the configuration tree root hash, specifically: The central server determines the configuration parameters for this round of federated learning, which affect the feature extraction and dimensionality reduction processes. These configuration parameters include at least the projection matrix. ( ), encoder weight hash This includes configuration parameters such as layering location and differential privacy settings. The central server uses all these configuration parameters as leaf nodes to construct a Merkle tree, called the configuration anchor tree, and produces the configuration tree root hash. for: ; The anchor tree is configured to uniformly commit all preprocessed parameters to a single 256-bit root hash. For the projection matrix, a hash commitment method is used to record the data, i.e., calculating... , as one of the leaf nodes.

[0031] In step 3, the central server binds the root hash of the client node's dataset with the root hash of the configuration tree using a cryptographic hash function to generate an authentication root. The central server then digitally signs the authentication root using its private key and sends the signed authentication root and configuration parameters to the corresponding client node. Specifically: The central server generates a unique authentication root for each client node, because different client nodes have different local dataset root hashes. Different. The authentication root is generated by hashing the dataset root. Configure the root hash tree and round number Binding via SM3, where the round number The encoding is done by converting the bytes to 8-byte big-endian order before concatenation. The calculation method is as follows: ; The central server uses its SM2 private key pair Obtain digital signature The central server packages the authentication root, signature value, and configuration parameters (projection matrix, encoder weight hash, layering configuration, etc.) into a configuration package and distributes it to the corresponding client nodes. The authentication root is the unique authentication credential between the client node and the central server, achieving a unified commitment to data integrity, preprocessing accuracy, and model feature extraction accuracy.

[0032] In step 4, after receiving the authentication root and configuration parameters, the client node performs a validity verification. If the verification passes, the authentication relationship is established; otherwise, the client refuses to participate in this round of training. Specifically: After receiving the authentication root and configuration package, the client node performs six-fold verification: SM2 signature verification: Verification using the central server's public key. The validity of the signature.

[0033] Configuration root recalculation: Recalculate the configuration tree root hash locally using the received configuration parameters. It is compared with the configuration tree root hash parsed from the authentication root.

[0034] Data set root hash comparison: Extracting from authentication root It is compared with the root hash of the local dataset.

[0035] Projection matrix hash verification: Calculate the received projection matrix SM3 hash This verifies that it is consistent with the projection matrix commitment recorded in the configuration anchor tree.

[0036] Encoder version matching: Calculate the SM3 hash of the local encoder weights Verify that it matches the hash value recorded in the configuration anchor tree.

[0037] Round number verification: Verify the round number contained in the authentication root. Consistent with the current federal learning cycle.

[0038] After all six verifications pass, the authentication relationship between the configuration anchor tree and the data tree is officially established. The client node confirms that the configuration parameters issued by the central server match its local data, and this binding relationship is committed by the central server's SM2 signature. If any verification fails, the client node refuses to participate in this round of training.

[0039] In step 5, the client node samples instances from the local training set, generates an inclusion proof in a multi-level hash tree for each sampled instance, extracts the original feature vector of the sampled instance using a local encoder based on a deterministic pattern, and performs a dimensionality reduction transformation on the original feature vector using a projection matrix to obtain a dimensionality-reduced feature vector. The hash values ​​of the original feature vector and the dimensionality-reduced feature vector are then calculated, specifically as follows: Specifically, it includes the following sub-steps: 5.1 Instance Sampling and Inclusion Proof Generation: Client nodes sample from the local training set For each instance, a Merkle inclusion proof (inclusion proof) in a multi-level hash tree is generated using the singleton index module, with a size of [size missing]. The singleton index module utilizes a hash index table. Instance location with low time complexity, combined with LRU caching and a batch proof generation mechanism that shares paths within the sequence, reduces the proof generation overhead in training-intensive scenarios from... Down to ,in The number of sequences involved. .

[0040] 5.2 Original Feature Extraction: Run the local encoder neural network for forward propagation to extract the original feature vector for each medical image instance. To ensure deterministic feature extraction, the encoder runs in inference mode (dropout disabled, batch normalization layers use running statistics). The original feature hash is calculated: ; 5.3 Dimensionality Reduction Transformation: Using the projection matrix issued by the central server Perform linear dimensionality reduction on the original feature vector to obtain the dimensionality-reduced feature vector: ; Dimensionality of the reduced feature vector Dimensionality reduction significantly reduces communication overhead and the attack surface for feature inversion. The dimensionality-reduced feature hash is calculated, and this hash is bound to the projection matrix commitment: ; 5.4 Quantization and Differential Privacy Noise (Optional): To achieve a balance between feature accuracy and privacy protection, quantization can be performed on the dimensionality-reduced feature vectors. (position), and add standard deviation as Differential privacy noise.

[0041] In step 6, the client node binds the hash value of the dimensionality-reduced feature vector, the hash value of the original feature vector, the leaf node hash of the sampling instance in the multi-level hash tree, the authentication root, and the current round number using a cryptographic hash function to generate a binding label. The feature binding data for each sampling instance is then uploaded in batches to the central server. The structure of the feature binding data includes the dimensionality-reduced feature vector, the binding label, and a hash value containing proof and the feature vector, specifically: The client node generates a binding label for each sampled training instance. The binding process compresses five elements—original feature hash, instance leaf node hash, reduced-dimensional feature hash, authentication root, and round number—into a 256-bit digest using the SM3 hash function. The binding label is calculated as follows: ; Binding labels strongly associates features with data cryptography; tampering with any element will result in a label mismatch. For an attacker to implement a feature-data mismatch (e.g., using the inclusion proof of instance A with the features of instance B), they need to find an SM3 collision, which has a computational complexity of up to [insert value here]. .

[0042] The client node binds the features of each sampling instance to a data structure (including dimensionality-reduced feature vectors). , binding tags Merkle contains proof and the original feature hash Batch uploads are sent to the central server.

[0043] In step 7, the central server performs multiple validations on each received feature binding data. After successful validation, it accepts the feature binding, stacks the feature matrices validated by multiple clients, performs forward and backward propagation of the central side linear layer, calculates the loss function and obtains the feature gradient, and then sends the feature gradient back to the corresponding client node. After receiving the feature gradient, the client node updates its local encoder parameters, specifically: The central server performs five-fold verification on the data bound to each feature: Authentication root signature verification: Verification The validity of the SM2 signature.

[0044] Merkle data includes proof verification: using client-submitted data. and includes proof Verify the instance It does indeed exist in the data tree of the client node.

[0045] The Merkle configuration includes proof verification: verifying the dimensionality-reduced feature hash. The projected matrix bound in the middle is committed to It exists in the configuration anchor tree.

[0046] Dimensionality Reduction Feature Hashing Recalculation: Utilizing the received dimensionality reduction feature vector and projection matrix commitment Recalculate Compare with the implicit value in the bound tag.

[0047] Binding tag consistency verification: using the received Obtained from proof , , , Recalculation Compare the value with the value submitted by the client.

[0048] After all five verifications pass, the central server confirms the cryptographic association between the feature and the data and accepts the feature binding; if any verification fails, the binding is rejected.

[0049] The central server stacks the feature matrices validated by multiple client nodes into GPU batch processing data and performs forward propagation of the central linear layer. Following the model parallel paradigm of large-scale Transformer model training, the central linear layer can contain one or more linear transformation layers (e.g., attention layers, feedforward networks (FFN), output projection, etc.), and is not limited to the output head of classification tasks. It can support various medical imaging tasks such as classification, segmentation, detection, and pre-training (e.g., masked autoencoder (MAE), contrastive learning).

[0050] After forward propagation, the loss function is calculated based on the task. Then, backpropagation is performed to obtain the feature gradients of each dimensionality-reduced feature vector. The central server sends the feature gradients back to the corresponding client nodes. Upon receiving the feature gradients, the client nodes perform norm clipping to limit information leakage, and then continue backpropagation to update their local encoder parameters.

[0051] In step 8, the central server uses the held dimensionality-reduced feature vectors and their corresponding feature gradients to calculate the contribution of each sampled instance to the loss reduction based on the Taylor first-order approximation. It then aggregates the instance contributions of each client node to form an institutional contribution record, constructs a contribution hash tree, and writes the root hash, authentication root, and configuration tree root hash of the contribution hash tree into the block structure, appending it to the blockchain for evidence storage. Specifically: This step leverages the advantage of the central server holding single-sample feature representations in split learning to achieve refined contribution quantification and tamper-proof evidence preservation at the training instance level.

[0052] 8.1 Calculation of Training Instance Contribution: Based on the Taylor first-order approximation, the contribution of each instance to the loss reduction is calculated using the dimensionality-reduced feature vectors and feature gradients. For each instance... The contribution is calculated as follows: ; in The first eigenvector of the dimensionality reduction feature vector One portion, This is the gradient of the loss function for this component. Approximate instance Contribution to loss reduction. This calculation leverages the advantage of the center end holding single-sample feature representations in split learning, achieving refined contribution quantification at the single-sample level.

[0053] 8.2 Institutional Contribution Aggregation: Aggregating contributions from the same client node (institution). The contributions of training instances that passed this round of validation are aggregated, and class inverse frequency weights are introduced to compensate for rare classes, avoiding underestimation of their contributions due to the smaller gradient magnitude of rare classes. The aggregation method is as follows: ; in For institutions The set of instances that passed this round of verification. For category The inverse frequency weights. The contribution can also be statistically analyzed separately according to the imaging modality (CT / MRI / X-ray) to form a three-dimensional contribution vector.

[0054] 8.3 Contribution Hash Tree Construction and On-Chain: Recording the contributions of each organization (Including organization identifier, contribution value, round number, and timestamp) After serialization, calculate the SM3 hash and organize it into a contribution hash tree (Merkle tree): ; The central server will contribute to the root tree. With authentication root Configure tree roots Together, they are written into the block structure and appended to the chained self-authenticating blockchain described in step 1. Any tampering with the contribution record will result in... Changes in the block hash lead to changes in the block hash, which then propagate to all subsequent blocks via a chain structure.

[0055] 8.4 Audit Verification: The audit node can perform the following verifications: (a) Chain Integrity Verification: Verify the PrevHash chain structure of the block to ensure that the audit anchor has not been tampered with; (b) Contribution Conservation Check: Verify that the sum of the contributions of each organization equals the total contribution, and that the contribution tree root hash is consistent with the record in the block. Each organization can also generate its own Merkle inclusion proof of its contribution record and appeal to the audit node, without needing to trust the central server, thus achieving independent auditability of the contribution results.

[0056] In step 9, the central server generates a new projection matrix based on the preset rotation interval and the global model state, updates the configuration anchor tree and authentication root, and sends the updated authentication root and new configuration parameters to the client nodes for subsequent training rounds. Specifically: To prevent client nodes from constructing fake dimensionality reduction features based on a known projection matrix in advance, the system employs a periodic rotation mechanism for the projection matrix. Specifically, every time... wheel( (The preset rotation interval can be between 5 and 20). The central server uses a global model hash. and the current round number As a seed, a new projection matrix is ​​derived. for: ; When the projection matrix is ​​rotated, the projection matrix in the configuration anchor tree is committed to being updated accordingly, and the root hash of the configuration tree is configured. Automatic changes, authentication root The system is also updated accordingly. The central server distributes the updated authentication root and new configuration parameters to each client node for use in subsequent training rounds. This mechanism enhances the system's forward security.

[0057] The present invention also provides a specific embodiment, as follows: To verify the effectiveness of this invention, an experiment was conducted using a 3D CT image classification model trained collaboratively by three medical institutions. The central server was deployed on a regional medical cloud GPU cluster. Institution A held 12,000 CT instances (approximately 200 sequences and 60 examinations), Institution B held 8,000 instances, and Institution C held 5,000 instances.

[0058] The system configuration is shown in Table 1: Table 1 System Configuration

[0059] Training process: The central server issues the first round of configuration (projection matrix) Encoder weight hash ), construct a configuration anchor tree, and generate authentication roots for each of the three institutions.

[0060] Each medical institution acts as a client node. After executing the six-fold verification and authentication root, it samples 32 instances in each round, generates data containing proof and feature binding, and uploads it to the central server.

[0061] After the central server performs five-fold verification feature binding, it executes GPU batch forward and backward propagation to calculate the contribution of each training instance.

[0062] In the 10th round, the projection matrix is ​​rotated, generating a new matrix. Update the configuration of the anchor tree and authentication root.

[0063] The technical effects are compared in Table 2, and the performance indicators are shown in Table 3.

[0064] Table 2 Comparison of Technical Effects

[0065] Table 3 Performance Indicators

[0066] The values ​​mentioned above are only parameter selections for one embodiment. In actual deployment, each parameter can be adjusted according to the data scale, network bandwidth, and security level requirements.

[0067] This invention also provides a medical image federated learning system based on multi-layer tree authentication, applied to the aforementioned medical image federated learning method based on multi-layer tree authentication, comprising: The client nodes include: The data tree construction module is used to build a multi-level hash tree from bottom to top based on the DICOM hierarchy of local medical image data and using cryptographic hash functions to obtain the data root hash used to verify data integrity. The client verification module is used to receive the authentication root and configuration parameters sent by the central server, and to verify the digital signature and content validity of the authentication root. If the verification is successful, the authentication relationship is established; otherwise, participation in this round of training is refused. The feature extraction and binding data generation module is used to sample instances from the local training set, generate an inclusion proof for each sampled instance in the multi-layer hash tree, extract the original feature vector of the sampled instance using a local encoder with a deterministic pattern, perform a dimensionality reduction transformation on the original feature vector using a projection matrix to obtain a dimensionality-reduced feature vector, and calculate the hash value of the original feature vector and the hash value of the dimensionality-reduced feature vector. It is also used to bind the hash value of the dimensionality-reduced feature vector, the hash value of the original feature vector, the leaf node hash of the sampled instance, the authentication root, and the current round number using a cryptographic hash function to generate a binding label, and batch upload the feature binding data containing the dimensionality-reduced feature vector, binding label, inclusion proof, and feature vector hash value to the central server. The model update module is used to receive the feature gradients sent back from the central server and update the local encoder parameters. The central server includes: The configuration tree construction module is used to determine the configuration parameters for this round of federated learning, and to construct a configuration anchor tree using the configuration parameters as leaf nodes to obtain the configuration tree root hash. The authentication root generation module is used to bind the data root hash of the client node with the configuration tree root hash using a cryptographic hash function to generate an authentication root, and to digitally sign the authentication root using the private key of the central server, and then send the signed authentication root and the configuration parameters to the corresponding client node. The central verification and training module is used to perform multiple verifications on each received feature binding data. After the verification is passed, the feature binding is accepted. The feature matrices verified by multiple clients are stacked, and forward and backward propagation of the central side linear layer is performed. The loss function is calculated and the feature gradient is obtained. The feature gradient is then fed back to the corresponding client node. The contribution calculation and on-chain module is used to calculate the contribution of each sampled instance to the loss reduction based on the Taylor first-order approximation by using the held dimensionality reduction feature vector and its corresponding feature gradient, aggregating the instance contribution of each client node to form an institutional contribution record, constructing a contribution hash tree, and writing the root hash of the contribution hash tree, the authentication root, and the configuration tree root hash into the block structure and appending it to the blockchain for evidence storage. The projection matrix rotation module is used to generate a new projection matrix based on a preset rotation interval and the global model state, update the configuration anchor tree and authentication root, and send the updated authentication root and new configuration parameters to the client node.

[0068] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0069] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0070] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0071] Contents not described in detail in this specification are prior art known to those skilled in the art. It is hereby indicated that the above description is intended to help those skilled in the art understand this invention, but does not limit the scope of protection of this invention. Any equivalent substitutions, modifications, improvements, or simplifications of the above descriptions that do not depart from the essential content of this invention fall within the scope of protection of this invention.

Claims

1. A federated learning method for medical images based on multi-layer tree authentication, characterized in that, include: Step 1: Based on the DICOM hierarchy of the local medical image data, the client node uses a cryptographic hash function to build a multi-level hash tree from bottom to top, obtaining the dataset root hash used to verify data integrity; Step 2: The central server determines the configuration parameters for this round of federated learning, and uses the configuration parameters as leaf nodes to build a configuration anchor tree to obtain the configuration tree root hash; Step 3: The central server binds the root hash of the client node's dataset with the root hash of the configuration tree using a cryptographic hash function to generate an authentication root. The central server then digitally signs the authentication root using its private key and sends the signed authentication root and configuration parameters to the corresponding client node. Step 4: After receiving the authentication root and configuration parameters, the client node performs a validity verification. If the verification passes, the authentication relationship is established; otherwise, the client refuses to participate in this round of training. Step 5: The client node samples instances from the local training set, generates an inclusion proof in a multi-level hash tree for each sampled instance, extracts the original feature vector of the sampled instance using the local encoder in a deterministic pattern, and performs a dimensionality reduction transformation on the original feature vector using a projection matrix to obtain a dimensionality reduction feature vector. The hash value of the original feature vector and the hash value of the dimensionality reduction feature vector are then calculated. Step 6: The client node binds the hash value of the dimensionality-reduced feature vector, the hash value of the original feature vector, the leaf node hash of the sampling instance in the multi-level hash tree, the authentication root, and the current round number using a cryptographic hash function to generate a binding label. The feature binding data of each sampling instance is then uploaded to the central server in batches. The structure of the feature binding data includes the dimensionality-reduced feature vector, the binding label, the proof, and the feature vector hash value. Step 7: The central server performs multiple verifications on each received feature binding data. After the verification is passed, it accepts the feature binding, stacks the feature matrices that have been verified by multiple clients, performs forward and backward propagation of the central side linear layer, calculates the loss function and obtains the feature gradient, and sends the feature gradient back to the corresponding client node; the client node updates its local encoder parameters after receiving the feature gradient. Step 8: The central server uses the dimensionality-reduced feature vectors it holds and their corresponding feature gradients to calculate the contribution of each sampled instance to the loss reduction based on the first-order Taylor approximation. It aggregates the instance contributions of each client node to form an institutional contribution record, constructs a contribution hash tree, and writes the root hash, authentication root, and configuration tree root hash of the contribution hash tree into the block structure and appends it to the blockchain for evidence storage. Step 9: The central server generates a new projection matrix based on the preset rotation interval and global model state, updates the configuration anchor tree and authentication root, and sends the updated authentication root and new configuration parameters to the client nodes for subsequent training rounds.

2. The medical image federated learning method based on multi-layer tree authentication according to claim 1, characterized in that, In step 1, the multi-level hash tree corresponds to the DICOM hierarchical structure, and includes, from bottom to top, the following: At the instance layer, the leaf node hash is obtained by calculating the hash of the pixel data of a single DICOM instance file; The sequence layer aggregates the leaf node hashes of instances within the same sequence to obtain the sequence root hash. The inspection layer aggregates the sequence root hashes of all sequences within the same inspection to obtain the inspection root hash; At the patient level, the patient root hash is obtained by aggregating the root hashes of all examinations performed on the same patient. Aggregate the patient root hashes of multiple patients to obtain the dataset root hash.

3. The medical image federated learning method based on multi-layer tree authentication according to claim 2, characterized in that, In step 2, the configuration parameters include the projection matrix, encoder weight hash, layer cutting position, and differential privacy configuration.

4. The medical image federated learning method based on multi-layer tree authentication according to claim 3, characterized in that, In step 4, the validity verification includes: digital signature verification, consistency verification between the locally recalculated configuration tree root hash and the configuration tree root hash in the authentication root, consistency verification between the local dataset root hash and the dataset root hash in the authentication root, consistency verification between the hash value of the projection matrix and the record in the configuration anchor tree, consistency verification between the hash value of the local encoder weight and the record in the configuration anchor tree, and consistency verification between the round number in the authentication root and the current federated learning round.

5. A medical image federated learning method based on multi-layer tree authentication according to claim 4, characterized in that, In step 7, the multiple verifications include: digital signature verification of the authentication root, verification that the sampled instance does exist in the client's data tree using the hash of the data root containing the proof and the authentication root, verification that the projection matrix bound in the hash value of the dimensionality-reduced feature vector confirms its existence in the configuration anchor tree, verification that the hash value of the dimensionality-reduced feature vector is recalculated using the received dimensionality-reduced feature vector and the projection matrix confirmation and compared with the implicit value in the binding label, and verification that the binding label is recalculated using the received data and compared with the binding label submitted by the client.

6. The medical image federated learning method based on multi-layer tree authentication according to claim 5, characterized in that, In step 8, the contribution is calculated as follows: The components of the dimensionality-reduced feature vector are multiplied by their corresponding feature gradient components and then summed to obtain an approximate contribution of the sampling instance to the loss reduction. The contributions of the sampled instances that passed the verification in this round are aggregated, and rare categories are compensated by inverse frequency weighting according to category.

7. A medical image federated learning method based on multi-layer tree authentication according to claim 6, characterized in that, In step 9, the new projection matrix is ​​generated by the global model hash and the current round number derived seed.

8. A medical image federated learning system based on multi-layer tree authentication, applied to the medical image federated learning method based on multi-layer tree authentication as described in any one of claims 1-7, characterized in that, include: Client nodes and central server; The client nodes include: The data tree construction module is used to build a multi-level hash tree from bottom to top based on the DICOM hierarchy of local medical image data and using cryptographic hash functions to obtain the data root hash used to verify data integrity. The client verification module is used to receive the authentication root and configuration parameters sent by the central server, and to verify the digital signature and content validity of the authentication root. If the verification is successful, the authentication relationship is established; otherwise, participation in this round of training is refused. The feature extraction and binding data generation module is used to sample instances from the local training set, generate an inclusion proof for each sampled instance in the multi-layer hash tree, extract the original feature vector of the sampled instance using a local encoder with a deterministic pattern, perform a dimensionality reduction transformation on the original feature vector using a projection matrix to obtain a dimensionality-reduced feature vector, and calculate the hash value of the original feature vector and the hash value of the dimensionality-reduced feature vector. It is also used to bind the hash value of the dimensionality-reduced feature vector, the hash value of the original feature vector, the leaf node hash of the sampled instance, the authentication root, and the current round number using a cryptographic hash function to generate a binding label, and batch upload the feature binding data containing the dimensionality-reduced feature vector, binding label, inclusion proof, and feature vector hash value to the central server. The model update module is used to receive the feature gradients sent back from the central server and update the local encoder parameters. The central server includes: The configuration tree construction module is used to determine the configuration parameters for this round of federated learning, and to construct a configuration anchor tree using the configuration parameters as leaf nodes to obtain the configuration tree root hash. The authentication root generation module is used to bind the data root hash of the client node and the configuration tree root hash using a cryptographic hash function to generate an authentication root, and to digitally sign the authentication root using the private key of the central server, and then send the signed authentication root and configuration parameters to the corresponding client node. The central verification and training module is used to perform multiple verifications on each feature binding data received. After the verification is passed, the feature binding is accepted. The feature matrices that have been verified by multiple clients are stacked, and forward and backward propagation of the central side linear layer is performed. The loss function is calculated and the feature gradient is obtained. The feature gradient is then backpropagated to the corresponding client node. The contribution calculation and on-chain module is used to calculate the contribution of each sampled instance to the loss reduction based on the Taylor first-order approximation by using the held dimensionality-reduced feature vectors and their corresponding feature gradients. It aggregates the instance contribution of each client node to form an institutional contribution record, constructs a contribution hash tree, and writes the root hash, authentication root, and configuration tree root hash of the contribution hash tree into the block structure and appends it to the blockchain for evidence storage. The projection matrix rotation module is used to generate a new projection matrix based on the preset rotation interval and the global model state, update the configuration anchor tree and authentication root, and send the updated authentication root and new configuration parameters to the client node.

Images