Client attestation-free commitment anchored two-way accountable federated learning method

Abstract

This invention discloses a client-side proof-free commitment-anchored two-way accountability federated learning method, comprising: a trusted initializer distributing mask seeds to clients, distributing mask shares, blinded difference clusters, and auxiliary data to dual-server authentication; the client generating the current-round mask, calculating the integer difference between the local update and the mask, calculating a blinded commitment based on the difference, signing and uploading it; the dual servers independently verifying the signature and binding the commitment with the blinded difference clusters and the recalculated difference for verification, with successful verifications entering the survival set; after locking the commitment Merkle root, the dual servers generate screening randomness, collaboratively performing range detection and sparse energy screening in a secret shared domain, with successful verifications forming the acceptance set; the dual servers distributing the aggregation results, the client verifying the commitment set, locally reconstructing the verification target and verifying the commitment equation, and accepting if it is true. This invention eliminates the need for client-side proof generation, achieving poisoning screening and downlink accountability under privacy protection.

Description

Technical Field

[0001] This invention relates to distributed machine learning in artificial intelligence, particularly to the field of federated learning security technology, and specifically to a client-proof-free commitment-anchored two-way accountability federated learning method. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, allows a large number of terminal devices to collaboratively train a global model without directly sharing the original training data, and has been widely used in scenarios such as the Internet of Things and mobile edge computing.

[0003] However, the practical deployment of federated learning faces a severe dual security threat. On the one hand, malicious clients may upload carefully crafted poisoned updates (such as abnormally increased gradient norms or maliciously flipped gradient directions) to compromise the usability of the global model or implant backdoors. On the other hand, aggregation servers may be compromised or abused to forge or tamper with aggregation results, misleading clients' model update directions. Therefore, how to effectively screen upstream inputs (client updates) and reliably verify downstream outputs (aggregation results) while protecting client data privacy—that is, achieving two-way accountability—is a critical issue that urgently needs to be addressed for the large-scale application of federated learning.

[0004] To address the aforementioned threats, existing technical solutions can be mainly categorized into the following three types:

[0005] The first type of scheme relies on heavy cryptographic primitives, such as zero-knowledge proofs and homomorphic encryption, to achieve verifiability of aggregation results or privacy protection for client updates. While this type of scheme can provide strong security guarantees, its computational overhead (especially the overhead of client-side proof generation) increases linearly or superlinearly with the dimension of the model gradient, making it difficult to bear on edge devices with limited computing power and bandwidth.

[0006] The second type of solution employs a lightweight design, such as introducing a dual-server architecture for non-interactive verification or cross-checking, to reduce the burden on the client. However, such solutions typically lack the ability to effectively screen for malicious client-injected updates. While their security aggregation mechanisms protect privacy, they also deprive the server of the plaintext view needed to detect individual anomalous updates, potentially allowing malicious updates to infiltrate the aggregation process.

[0007] The third type of scheme attempts to achieve robust aggregation under privacy protection by using cryptographic computation within the secret shared domain to constrain the update's range or energy. However, it lacks a mandatory cryptographic binding between the screening object (the secret shared value) and the commitment object ultimately verified by the client. This "binding gap" allows a malicious party to potentially use a "benign" input to pass the server's screening, while the actual input participating in the aggregation and client verification is another unfiltered malicious update, causing the input screening and output verification mechanism to fail. Summary of the Invention

[0008] This invention aims to address the technical problems in existing federated learning schemes, such as excessive client-side computational overhead, lack of encrypted screening capabilities for poisoning updates, and lack of cryptographic binding between the screening object and the verification object. It provides a client-side, proof-free commitment-anchored, two-way accountability federated learning method.

[0009] Based on the first main aspect of the present invention, a client-proof-free commitment-anchored two-way accountability federated learning method is provided. This method is implemented based on a federated learning system comprising a trusted initiator, two servers, and multiple clients, and includes the following steps:

[0010] The trusted initiator generates public parameters during the system deployment phase, distributes mask seeds to each client, and distributes preprocessed materials containing mask authentication shares, blinded difference cluster points, and security two-party computational auxiliary data for dual-server authentication, and then goes offline permanently.

[0011] The client generates the current round mask based on the mask seed, calculates the integer difference between the local update and the current round mask, calculates a blinded commitment based on the integer difference, signs it, and uploads it to the dual servers. Each server independently verifies the signature and recalculates the commitment using the blinded difference cluster point and the integer difference, and verifies whether the commitment uploaded by the client satisfies the preset binding equation. Clients that pass the verification are entered into the survival set after the intersection of the two servers.

[0012] The two servers construct a Merkle tree based on the commitments of all clients in the live set and issue a root. After the client confirms, it locks the root. After the root is locked, the two servers generate screening randomness through a commitment-reveal protocol and cooperate in performing a secret screening on each client in the live set within a secret shared domain. Clients that pass the screening constitute the acceptance set.

[0013] The two servers calculate and distribute the sum of integer differences and blinding factors of all clients in the acceptance set. The clients verify the authenticity and completeness of the distributed commitment set, reconstruct the verification target locally from the verified commitments, and check whether the aggregation result satisfies the commitment equation. If it does, they accept it; otherwise, they reject it.

[0014] In the above scheme, a trusted initializer distributes the mask seed and authentication materials all at once, establishing a symmetric cryptographic preparatory state between the client and the two servers. The process involves the client uploading the difference instead of the plaintext gradient, the two servers performing screening in a secret shared domain, and the client verifying the downlink result using the commitment as an anchor, forming a complete execution flow from submission to screening and finally to verification. Therefore, this invention can unify uplink privacy protection, encrypted poisoning screening, and downlink result accountability within the same protocol framework without introducing zero-knowledge proofs or homomorphic encryption, fundamentally solving the technical problems of excessive client overhead or fragmented security functions in existing schemes.

[0015] Optionally, the mask authentication share distributed by the trusted initializer to each client includes: generating two additive secret shared shares of the mask vector used by each client in each round, and allocating one of the shares to each of the two servers, so that a single server cannot know the complete mask vector;

[0016] The secure two-party computational auxiliary data includes Beaver triples for performing multiplication operations within a secret shared domain and auxiliary random numbers for performing secure comparison operations. The Beaver triples enable the two servers to collaboratively complete multiplication calculations without exposing their respective shares.

[0017] The blinding difference cluster points are pre-calculated by the trusted initializer for the mask vector used by each client in each round and distributed to the dual servers in an authenticated manner.

[0018] The mask is stored on two servers in the form of additive secret-shared shares, ensuring privacy by preventing a single server from obtaining the complete mask. Simultaneously, Beaver triples and secure comparison auxiliary data are distributed, providing usable cryptographic building blocks for subsequent multiplication and comparison operations within the secret-shared domain. Offline preprocessing generates and authenticates the cryptographic correlations required in the online phase, enabling efficient execution of subsequent secret-state screening without client intervention, thus solving the problem of low efficiency in secret-state operations during online computation.

[0019] Optionally, before the client calculates the blinded commitment, it first performs pruning and point-fixing on the local update so that each component of the local update falls within a preset numerical range;

[0020] The client uses the mask seed to generate the current round mask in a deterministic pseudo-random way, so that the difference between the current round mask and the integer value still satisfies the condition of no modulus wrap-around after adding the components one by one;

[0021] The private key used by the client to sign the commitment and the public key pre-distributed to each server constitute a digital signature key pair, which is used by the server to verify the client's identity and the authenticity of the source of the commitment data;

[0022] The blinding factor is derived collaboratively from the seed shares held by each of the two servers before each round of training and provided to the client in the form of group elements. The client can complete the commitment calculation without knowing the specific value of the blinding factor.

[0023] In the above scheme, pruning and fixed-point generation ensure that the updated value falls within a controllable range; deterministic pseudo-random mask generation ensures that the client and server have a consistent understanding of the same mask; digital signatures ensure the authenticity of the commitment source; and fractional derivation of the blinding factor allows the client to complete the commitment calculation without knowing the specific value of the blinding factor. Overall, all cryptographic operations on the client are simplified to standard elliptic curve multiplication and signature operations, completely avoiding reliance on heavy primitives such as zero-knowledge proofs or homomorphic encryption, and solving the technical problem that edge devices cannot support high-complexity cryptographic overhead under the constraints of computing power and energy efficiency.

[0024] Optionally, the preset binding equation is:

[0025] ;

[0026] in, Indicates the client index. Indicates the federal learning and training rounds. For the client In the Blinded commitments uploaded in rounds, Indicates client In the The mask promise of the wheel, For server to client In the Integer difference passed through rounds Computation of linear homomorphic hash The trusted initializer is the client. In the Blinded differential clustering points in round-certification distribution;

[0027] Each of the two servers independently calculates the right side of the preset binding equation and compares it with the commitment uploaded by the client. If they are equal, the binding verification passes.

[0028] In the above scheme, the server side uses the blinded difference cluster points of the authentication distribution (pre-calculated from the mask vector and generator) and the difference uploaded by the client to recalculate the commitment, and compares it with the commitment uploaded by the client. Since it contains mask information and is tamper-proof after authentication distribution, the equation proves that the original update corresponding to the difference is completely consistent with the object bound to the commitment.

[0029] Therefore, without requiring the client to generate any additional proof, a cryptographically binding mechanism is established between the secret shared input and the committed object through server-side computation, eliminating the binding gap in existing schemes where the screening object and the verification object are inconsistent.

[0030] Optionally, the commitment-disclosure protocol is executed by the dual servers after the Merkle root lock, specifically including:

[0031] Two servers each generate a random number share, calculate the hash commitment of the random number share, and exchange them. After both parties confirm that they have received the hash commitment from the other party, they reveal the random number share to each other. Each server verifies whether the random number share revealed by the other party is consistent with the hash commitment it previously received. After the verification is successful, the two random number shares are combined and input into the pseudo-random generator to obtain the screening randomness.

[0032] The generation timing of the screening randomness is constrained to after Merkle root locking and before the start of the dense screening, so that the client cannot predict the specific random parameters used in the subsequent dense screening when submitting the commitment, thereby preventing malicious clients from constructing adaptive escape updates against the screening rules.

[0033] Furthermore, once the Merkle root is locked, no client can change its committed commitments.

[0034] Once the Merkle root is locked, all client commitments are fixed and cannot be changed by any client afterwards. The screening randomness is generated through dual-server interaction only after this locking, making the screening matrix completely unpredictable to the client when submitting a commitment. Therefore, by adopting the above scheme, we use temporal constraints rather than cryptographic assumptions to defend against adaptive escape attacks by malicious clients. That is, attackers cannot predict which random direction the update will be projected onto when submitting it, thus making it impossible to construct an update that satisfies both statistical constraints and carries a malicious payload. This solves the security vulnerability caused by the predictability of random parameters in encrypted screening.

[0035] Furthermore, the dense state screening includes range detection and energy detection;

[0036] The range detection uses SPDZ malicious security two-party calculation to determine whether each component satisfies the condition. ;in, Indicates the client index. Indicates the federal learning and training rounds. This represents the vector dimension index, with values ​​ranging from 1 to d, where d is the locally updated vector dimension. For the client In the Local updates of wheels The One portion, As a preset range boundary, A function to promote the elements of a finite field to signed integers; if any component does not meet the condition, the client is removed from the live set;

[0037] The energy detection is based on screening for randomness. Derive L sparse matrices L represents the total number of sparse matrices. The server performs sparse detection on each parameter within the secret shared domain. Local computing Energy was calculated using Beaver triples. Determine whether the energy level does not exceed a preset energy threshold. ;in, Indicates client In the Local updates of the wheel; For the client No. The locally updated authentication secret is shared. Compute matrix multiplication within a secret shared domain; Represents the square of the L2 norm;

[0038] Clients that perform range detection and energy detection constitute the accepting set. .

[0039] The above scheme determines whether the difference exceeds the limit by determining the component-by-component difference through range detection, and captures updates with anomalies in overall energy with a high probability through random sparse projection. Both screening layers are completed collaboratively by two servers within the secret shared domain of SPDZ malicious security calculations, without recovering plaintext gradients throughout the process. Therefore, it can effectively block poisoned updates under privacy protection constraints, that is, norm expansion attacks are captured by range detection, and gradient concentration attacks are captured by sparse energy detection, solving the technical problem that existing lightweight schemes cannot perform anomaly screening on individual updates in dense states.

[0040] Optionally, the expression for the commitment equation is:

[0041]

[0042] in, This indicates the set to be accepted in the current round. This represents the sum of integer differences among all clients in the accept set distributed by the two servers. The integer vector obtained after function recovery. This represents the sum of the blinding factors for all clients in the acceptance set distributed by the two servers. This represents a linear homomorphic hash that maps an integer vector to elements of an elliptic curve group. is the blinded base point in the elliptic curve group. For the client The promise;

[0043] When the client verifies the commitment equation, the left side Calculated from the aggregation results issued by the two servers, on the right side. It is reconstructed locally by the client from the set of commitments verified by signature and Merkle proof; the server cannot specify or replace the composition of this verification target.

[0044] If the commitment equation holds, it proves that the aggregation result issued by the two servers is equal to the cryptographic sum of all clients in the acceptance set that have committed to updating. The client accepts the aggregation result and updates its local model; otherwise, it rejects the aggregation result.

[0045] In the above scheme, the right side of the equation is obtained locally by the client from the commitment set, which has been double-verified by signature and Merkle proof, and the server cannot interfere. The left side of the equation consists of the aggregated value and the blinded sum issued by the server. If the equation holds, it proves, under the discrete logarithm assumption, that the downlink result is equal to the cryptographically accumulated sum that has been committed and updated. Therefore, even if the two servers collude completely, they cannot construct a forged result that can pass this equation, because the generation of the verification target is completed entirely locally by the client and is cryptographically protected by the commitment set. This makes the downlink accountability property no longer dependent on the non-collusion assumption, solving the technical problem that the client cannot verify the integrity of the aggregated result in the server collusion scenario.

[0046] Based on a second key aspect of the present invention, a client-side proof-free commitment-anchored two-way accountability federated learning system implementing the aforementioned method is provided, comprising:

[0047] The trusted initializer is used to perform a one-time offline initialization during the system deployment phase, generate public parameters, distribute mask seeds to each client, distribute preprocessed materials containing mask authentication shares, blinded difference cluster points and security two-party calculation auxiliary data for dual-server authentication, and permanently go offline after distribution is completed;

[0048] Two servers are used to independently perform signature verification and commitment binding verification submitted by the client in each round of training. The intersection of the clients that pass the verification is used to obtain the live set. The servers collaborate to perform commitment locking and secret cooperation screening on the clients in the live set to obtain the acceptance set. The aggregation result of the acceptance set and its verification material are calculated and sent to the client.

[0049] Multiple clients are used to generate the current round mask based on the mask seed, calculate the integer difference between the local update and the current round mask and the blinded commitment, sign it and upload it to the dual servers, and receive the aggregation results and verification materials issued by the dual servers. After verifying the authenticity and completeness of the commitment set, the client locally reconstructs the verification target from the verified commitments and verifies the commitment equation to decide whether to accept or reject the aggregation result.

[0050] Based on a third key aspect of the present invention, an electronic device is provided, comprising one or more processors;

[0051] Storage device for storing one or more programs;

[0052] When one or more programs are executed by one or more processors, the one or more processors implement the client-proof-free commitment-anchored two-way accountability federated learning method described above.

[0053] Based on a fourth principal aspect of the invention, a computer-readable storage medium is provided having a computer program stored thereon that, when executed, implements the aforementioned client-proof-free commitment-anchored two-way accountability federated learning method.

[0054] Compared to existing technologies, this invention unifies uplink input screening and downlink output verification by anchoring them to the same cryptographic commitment object, thereby eliminating the binding gap where the "cryptographic screening object" and the "client verification object" are inconsistent in existing schemes. The client only needs to perform elliptic curve multiplication (instead of zero-knowledge proofs or homomorphic encryption) to complete commitment generation and aggregation verification. Its cryptographic overhead is reduced by nearly three orders of magnitude compared to the RoFL scheme based on zero-knowledge proofs, making secure federated learning under high-dimensional models possible on edge devices.

[0055] In terms of security architecture, this invention achieves range detection and sparse energy detection for individual updates without recovering plaintext gradients through secret shared domain cooperation under the assumption of non-collusion between two servers, effectively blocking two types of poisoning attacks: norm inflation and gradient concentration. Simultaneously, by using Merkle root time-series locking and commitment-revealing protocol to generate screening randomness, the risk of adaptive escape by malicious clients is eliminated.

[0056] More importantly, this invention allows the client to locally reconstruct the right side of the downlink aggregation verification equation from the set of commitments that have passed signature verification. This makes the composition of the verification target completely independent of the server's control. Therefore, even if the two servers collude completely, they cannot make the honest client accept the forged aggregation result. This property does not rely on any non-collusion assumption and is significantly better than the existing lightweight dual-server scheme that relies on cross-validation.

[0057] This invention achieves three security objectives simultaneously: uplink privacy protection, encrypted poisoning screening, and downlink server accountability, with lightweight cryptographic overhead that requires no client proof. It fills the gap in binding security semantics for lightweight verifiable federated learning and provides an integrated solution for the deployment of trusted federated learning in resource-constrained edge scenarios. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0059] Figure 1 This illustration shows an execution flow diagram of a client-side proof-free commitment-anchored two-way accountability federated learning method according to one embodiment of the present invention;

[0060] Figure 2 This illustration shows a system framework diagram of a client-proof-free commitment-anchored two-way accountability federated learning method according to one embodiment of the present invention. Detailed Implementation

[0061] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0062] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0063] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0064] The specific meanings of the technical terms that may be used in this invention are explained as follows:

[0065] Additive Secret Sharing: A cryptographic primitive used to split a secret data into multiple shares, such that no single party holding a share can know any information about the secret data, and the original secret can only be recovered by combining all the shares.

[0066] SPDZ-Style Authentication is an information-theoretic message authentication code mechanism used to attach a MAC tag to a secret shared share to prevent malicious parties from tampering with the share. The global MAC key is stored as a share on two servers, and neither party can obtain the complete key. Any tampering with the secret share or MAC share will be detected with overwhelming probability during the opening phase, thus ensuring the security of computation within the secret shared domain.

[0067] Beaver Triple: A preprocessed, related randomness for secure two-party computation, consisting of three secret, shared values ​​that satisfy a multiplicative relationship. Each of the two servers holds a share, and Beaver Triples allow for collaborative, secure multiplication within a secret shared domain without exposing their individual private data.

[0068] Pedersen Commitment: A homomorphic commitment scheme based on the discrete logarithmic difficulty, in the form C = Σ x j · g j + r · h, where x j Let r be the component of the committed vector, and g be the blinding factor. j h and h are independent generators in the elliptic curve group.

[0069] Linear Homomorphic Hash (LHH): A hash function that satisfies the additive homomorphic property. This invention uses a Pedersen-style linear homomorphic hash, mapping integer vectors to elliptic curve group elements, allowing the server to perform linear combination operations on commitments without recovering the plaintext.

[0070] Blinded Difference Group Element: In this invention, the group element is pre-calculated and authenticated by the trusted initializer and distributed to the server. Its form is the sum of scalar multiplications of each component of the current mask vector with the elliptic curve independent generator. This group element is used by the server to recalculate and verify the commitments made regarding the differences uploaded by the client.

[0071] Merkle Tree: A binary hash tree structure built with a collision-resistant hash function. Leaf nodes are the hash values ​​of data elements, and internal nodes are concatenated hashes of the hash values ​​of their child nodes. Merkle trees can provide concise membership proofs for large datasets. Given a trusted root hash, a verifier can verify whether an element belongs to the set in logarithmic time.

[0072] Merkle Root Locking: A time-series security mechanism used in this invention to solidify the client commitment set. Two servers construct a Merkle tree from all commitments in the live set and distribute the root hash. Once the client confirms that the root hashes match, the commit is considered locked. After locking, no client may change its submitted commitments, and the root hash subsequently serves as the cryptographic anchor for subsequent verification.

[0073] Commitment-Reveal Protocol: A distributed randomness generation protocol where participants first submit hash commitments of their respective random numbers. Once all commitments are locked, the random numbers are revealed, and their consistency with the commitments is verified before combining them to generate the final randomness. This protocol guarantees that, provided at least one party is honest, the final randomness is unpredictable to any colluding party during the commit phase.

[0074] Encrypted-Domain Screening: In this invention, malicious update detection is a collaborative operation performed by two servers within an authenticated secret-sharing domain. This includes range detection and energy detection. The entire screening process does not recover any client's plaintext gradient, identifying and blocking abnormal updates while protecting privacy.

[0075] Sparse Matrix: The random projection matrix used for energy detection in this invention. By using a sparse matrix to randomly project high-dimensional gradients, poisoning updates of overall energy or concentrated energy anomalies can be detected with high probability without checking all elements component by component, significantly reducing the computational overhead of dense states.

[0076] Blinding Factor: A random number used in the Pedersen commitment to hide the committed value. It is derived collaboratively by both servers in the form of shares and provided to the client as a group element. Due to the difficulty of discrete logarithms, even if an attacker knows the blinded group element, they cannot deduce the specific value of the blinding factor.

[0077] SPDZ Malicious-Secure Two-Party Computation: A cryptographic protocol framework that provides security guarantees under a malicious adversary model, ensuring the correctness of the computation and the privacy of the input even if the participants engage in malicious behavior. This invention utilizes this framework to perform range comparisons and energy calculations within a secret shared domain.

[0078] Pseudorandom Generator (PRG): A deterministic algorithm that expands a short random seed into a pseudorandom bit string of arbitrary length, whose output is computationally indistinguishable from a truly random bit string. In this invention, it is used for client-side derivation masks and server-side derivation screening matrices.

[0079] In one feasible embodiment, combined with Figure 1 As shown, this invention provides a client-proof-free commitment-anchored two-way accountability federated learning method. This method is implemented based on a federated learning system comprising a trusted initializer, two servers, and multiple clients, and includes the following steps S100-S400 executed by a computer system:

[0080] In step S100, the trusted initializer generates public parameters during the system deployment phase, distributes mask seeds to each client, and distributes preprocessed materials containing mask authentication shares, blinded difference cluster points, and security two-party calculation auxiliary data for dual-server authentication, and then permanently goes offline.

[0081] In step S200, the client generates the current round mask based on the mask seed, calculates the integer difference between the local update and the current round mask, calculates a blinded commitment based on the integer difference, signs it, and uploads it to the dual servers. Each server independently verifies the signature and recalculates the commitment using the blinded difference cluster point and the integer difference, and verifies whether the commitment uploaded by the client satisfies the preset binding equation. Clients that pass the verification are entered into the survival set after the intersection of the two servers.

[0082] In step S300, the two servers construct a Merkle tree for the commitments of all clients in the live set and issue the root. After the client confirms, the root is locked. After the root is locked, the two servers generate screening randomness through the commitment-reveal protocol and cooperate in performing secret screening on each client in the live set within the secret shared domain. The clients that pass the screening constitute the acceptance set.

[0083] In step S400, the two servers calculate and distribute the sum of integer differences and blinding factors of all clients in the acceptance set; the clients verify the authenticity and completeness of the distributed commitment set, reconstruct the verification target locally from the verified commitments, and verify whether the aggregation result satisfies the commitment equation. If it is true, they accept it; otherwise, they reject it.

[0084] As a whole, this invention identifies binding gaps in trusted aggregations and, for the first time, formalizes them as the Binding Verifiable Aggregation (BVA) property. BVA requires that the integer vector being screened on the server side and the commitment object being verified on the client side be cryptographically consistent, thus ensuring that input screening and output verification operate on the same client update. This property provides a unified binding semantic for trusted aggregations under privacy constraints, enabling the previously separate poisoning screening and result verification to operate on the same cryptographic object.

[0085] This invention is based on a lightweight collaborative detection protocol that does not require client-generated proofs, used to establish a binding between inputs and commitments during the encrypted screening phase. Through signed integer masks, server-side linear homomorphic hashing, and blinded difference group points of the trusted initializer's authentication distribution, the protocol encodes the consistency between the secret shared value and the commitment integer vector into a locally verifiable algebraic relationship. Either server holding the authentication distribution material can independently complete the binding verification by checking only one group equation after recalculating the linear homomorphic hash once; the entire process does not require the client to generate zero-knowledge proofs or homomorphic encryption proofs. Based on this mechanism, two servers can perform encrypted collaborative screening of the gradient's component range and energy characteristics without recovering the original gradient, thereby identifying and blocking anomalous updates while protecting privacy.

[0086] This invention also constructs a commitment-anchored closed-loop verification mechanism to resist server collusion. The client locally reconstructs the verification target from a set of commitments confirmed by signature authentication and Merkle proof, thus preventing the server from replacing the verification object or manipulating the aggregation result at the source. This mechanism binds the downlink aggregation output to the set of uplink committed and accepted updates, enabling the client to independently verify the integrity of the aggregation result. Even if two servers collude completely, it is impossible for an honest client to accept a forged aggregation result with a non-negligible probability. Combining uplink secret state screening and downlink commitment locking verification, the method of this invention achieves a two-way security accountability closed loop that simultaneously resists server forgery and client poisoning without increasing the client's proof burden.

[0087] In existing technologies, verifiability based on cryptographic proofs, lightweight verifiable aggregation, and robustness under privacy constraints are the three main areas addressed in simultaneously achieving privacy protection and verifiability of aggregation results, reducing overhead, and solving client poisoning problems. Placing these three types of work under a unified adversarial model reveals a common limitation. Existing solutions primarily focus on cryptographic overhead, verification efficiency, or poisoning screening under privacy constraints, but typically do not explicitly guarantee that the input being screened and the object being verified cryptographically correspond to the same update.

[0088] Specifically, the server screens a secret shared value within the secret shared domain, while the client ultimately verifies a commitment value. If there is no mandatory binding between the two, a malicious client can pass the server-side screening with a benign input, but the actual input that enters the aggregation and final verification is a different, unscreened update. In this case, although the input screening and result verification pass separately, they do not act on the same object and therefore cannot jointly guarantee end-to-end integrity.

[0089] In the following embodiments, the present invention will... Wheel Client The local updates, masks, commitments, secret shared values, and verification materials are represented by the following unified notation.

[0090] In the following unified notation, unless otherwise specified, vector operations are performed by components, and finite field operations are performed by... The group operation is performed on BLS12-381. The BLS12-381 is a pairwise friendly elliptic curve that has been widely used in various cryptographic protocols in recent years, such as Zcash and Ethereum 2.0. This curve has attracted attention due to its efficiency in digital signatures and zero-knowledge proofs. The BLS12-381 is designed to provide good embedding and a subgroup of large prime order.

[0091] Unless otherwise specified, the same symbol used in this invention has the same meaning in the following uniform notation.

[0092] in, Indicates the client index; Indicates the federal learning training round; This indicates that the model updates the vector dimension; Indicates sparse detection parameters; Indicates the domain order; Indicates order as A finite field; Indicates BLS12-381 group; This represents the blinded generator in the Pedersen commitment; In Pedersen linear homomorphic hashing, the first... Each independent generator; Indicates client In the Local updates of the wheel; This represents an updated representation used for secret sharing or confidential screening. This indicates the update object corresponding to the actual screening performed by the server; This refers to the update object bound in the client commitment; Indicates client In the The signed integer mask used by the wheel; This represents the integer difference after the mask, which is used by the server to perform hash calculations or screening. Indicates client In the The commitment blinding factor of the wheel; Indicates client Blinding commitments generated by local updates; This represents a Pedersen linear homomorphic hash. ; This represents a linear homomorphic hash representation that maps an integer vector to a group element or committed input domain; This indicates that the trusted initiator is the client. Distributed blinded differential cluster points or bound certification materials; A notation representing a secret shared value; Indicates client Updates are secretly shared between the two servers; This indicates that signed integers will be promoted or encoded to... Mapping; Indicates the first The set of abnormal clients that are screened or detected in the round; Indicates the first The round passes through the set of clients that are screened and participate in the aggregation; Indicates the first The set of survivors in this round of the cycle; Indicates client The public key for signing; Indicates client The signature private key; Indicates client In the The signature on the round commit message; Indicates the first The Merkle root corresponding to the round commitment set; Indicates client Merkle membership proof; These represent the two servers performing the dense state screening and aggregation, respectively. Indicates a trusted initializer; Indicates safety parameters.

[0093] The following embodiments illustrate the additive secret sharing and malicious secure two-party computation (SPDZ malicious secure two-party computation) involved in this invention. First, the implementation of this invention relies on the following basic knowledge.

[0094] In existing technology, 2-out-of-2 addition secret sharing... Divided into Among them, the server Shareholding , For an order of scalar domain, For the shared secret value, and secret value Two additive secret-shared shares. SPDZ malicious two-party computation adds an information-theoretic MAC to the additive secret-shared shares. Global MAC key. It is held in shares by two servers. Holding the A secret shared share One party is unaware of the complete .in, For global MAC key, Global MAC key The two additions secretly share a portion.

[0095] For secret value The certified share is recorded as:

[0096]

[0097] satisfy = and . and Represents secret value The corresponding two MAC shares, Represents secret value The complete certified share representation. Any tampering with the secret share or MAC share by either party will be recorded during the reveal phase at a rate no less than [amount missing]. The probability is detected by MAC verification. For the public constant c, the operation... +c can be used to update the share locally without any interaction.

[0098] In this invention, the gradient, after definite-point transformation, is represented as a signed integer vector and is embedded into an array of order 1 during protocol execution. scalar field Calculation in the middle. For integers , its in The representation in is During reverse recovery, the canonical lifting function is used:

[0099]

[0100] For vectors, the function is applied component-by-component. To ensure that modular arithmetic is consistent with integer arithmetic, this invention requires that all intermediate values ​​that need to be restored to integers fall within the normal range. Internally. Specifically, if the client update satisfies... The mask satisfies The difference = - Press during upload Element representation, while binding verification, dense state screening, and aggregation verification all correspond to integer equations under no-wrap conditions. Under this no-wrap condition, after... The recovered aggregation result is strictly consistent with the true integer sum. Among them, This indicates the scope of the pre-approval process, i.e., the allowed value range of the actual update component by the client; This represents the mask boundary, i.e., the range of values ​​for the client mask components.

[0101] This invention uses Pedersen-style linear homomorphic hashing. Let... prime order The elliptic curve group, in this invention, is taken from BLS12-381. For independent generators, For blinded generators. For integer vectors , The order represents the dimension of the model update vector. For a finite field, define a linear homomorphic hash:

[0102]

[0103] in This represents integer-scalar multiplication; negative numbers are calculated using group inverses. When it holds true for all components, Satisfying integer addition homomorphism .

[0104] The blinded Pedersen-LHH commitment is defined as follows: Under the assumptions that generators are independent and discrete logarithmic relationships on the group are difficult, an adversary cannot construct two different valid openings for the same commitment; otherwise, they could extract the discrete logarithmic relationships between generators.

[0105] This invention also utilizes the following standard cryptographic tools. Collision-resistant hash functions (instantiated as SHA-256) are used to construct hash promises and Merkle trees, ensuring that, under the collision-resistant assumption, an adversary cannot find two different inputs that produce the same hash. The Merkle tree is constructed with collision-resistant hashes as leaf nodes and internal nodes, providing a concise proof of membership: given a trusted root... An adversary cannot forge a valid inclusion proof for an element not in the tree; otherwise, a hash collision could be constructed. The digital signature scheme satisfies Existence Unforgeable (EUF-CMA) for client authentication of their commitments, preventing adversaries from impersonating honest clients and forging signatures. Furthermore, this invention uses a commitment-reveal protocol based on hash commitments to generate public randomness: participants first submit hash commitments for a random share, revealing the random share after all commitments are locked, and the final random seed is derived jointly from all shares. Provided at least one party is honest and commitment locking precedes revealing, the final randomness is unpredictable to colluding parties during the submission phase.

[0106] In one of the following feasible embodiments, the system and threat model involved in this invention will first be described.

[0107] In this embodiment, as Figure 2 As shown, the method of the present invention is based on the following system entity:

[0108] Client Collection : No. The online set of wheels is denoted as The client is an edge device with limited computing power and bandwidth, which trains locally and uploads updates.

[0109] dual servers They jointly perform SPDZ-style secure two-party computation, responsible for input authentication, secret state screening, and blind aggregation. Each server holds a secret share and interacts within the steps specified in the protocol.

[0110] Offline trusted initialization method This process involves a single, one-time participation during system deployment. It generates common parameters and pre-processed materials for offline generation and distribution to two servers, including SPDZ malicious security two-party calculation shares, mask commitments, and blinded difference cluster points. These materials are then permanently taken offline. This invention assumes a trusted initialization method. It is trustworthy during the initialization phase.

[0111] The three types of entities constitute the interactive structure of two phases: one-time initialization and round-by-round training. Trustworthy initialization method. During the deployment phase, a mask seed is distributed to the client, and pre-processed materials are distributed to the dual-server authentication system, after which the system is permanently offline. Subsequently, in each round, the client uploads the difference and commitment, and the dual servers complete binding verification, confidentiality screening, and blind aggregation, then distribute the aggregation results along with the verification materials. Figure 2 The system model framework presented illustrates the data flow and interaction relationships.

[0112] The threat model of this invention includes the following adversaries:

[0113] Privacy adversaries Static corruption server or One, but not both, corrupts each other, with the goal of recovering plaintext updates from the honest client's view. This adversary corresponds to security target G1.

[0114] Poisoning opponent This adversary statically corrupts any number of clients and can additionally corrupt up to one server, with the goal of uploading malicious updates that violate statistical predicates and bypassing encrypted screening. This adversary corresponds to security target G2, which requires at least one server to honestly execute the binding verification and screening protocol.

[0115] fake opponent Active corruption server and Both parties are allowed to collude fully, with the goal of getting honest clients to accept a downlink aggregation result that does not satisfy the commitment equation. This adversary corresponds to security objective G3.

[0116] Cyber ​​adversaries: can eavesdrop, lose packets, or tamper with communication links.

[0117] The security objectives of this invention are defined as follows:

[0118] G1 (Uplink Privacy): In Under these circumstances, a single server cannot recover plaintext updates from an honest client with a non-negligible probability. .

[0119] G2 (Commitment Binding and Screening Reliability): In Provided that at least one server executes honestly, updates that exceed the scope limit must be at least [amount missing]. The probability of being eliminated is 1, and updates with energy exceeding the threshold are eliminated with a probability approaching 1 as the size of the sparse matrix increases. At the same time, the secret shared integer vector used for server-side screening should be consistent with the integer vector bound to the client commitment. This invention formalizes this requirement as commitment-bound verifiable aggregation (BVA).

[0120] G3 (Accountability Based on Commitment Equation): In In other words, even if the two servers are completely colluding, the client will not accept an aggregation result that does not satisfy the promise equation. This property does not rely on the assumption that the servers are not colluding, and its security is reduced to standard cryptographic assumptions such as signature unforgeability, hash collision resistance, and discrete logarithm difficulty.

[0121] The formal definitions of BVA and G3 in this invention are as follows:

[0122] Set up an aggregation protocol Runs on the client collection. For clients that pass the binding verification and enter the screening phase. ,make This represents the integer vector on which the server performs the screening predicate in the secret shared domain, let... Indicates commitment And an integer vector that uniquely determines the protocol binding relationship.

[0123] Definition 1 (Commitment-Bound Verifiable Aggregate, BVA). Protocol A BVA is satisfied if, provided that at least one server honestly executes the binding validation and screening protocol, for any PPT adversary capable of corrupting any client and at most one server, there exists a negligible function. This allows for the verification of each client that passes the binding check and enters the screening phase. ,have:

[0124]

[0125] in It is not arbitrarily interpreted from the elements of the commitment group, but is determined jointly by the binding verification equation and the auxiliary materials generated by the protocol. This definition requires that input screening and output verification operate on the same client update, but does not require the client to generate zero-knowledge proofs, SNARK proofs, or homomorphic cryptographic proofs.

[0126] The screening randomness in Definition 1 is derived by the commitment-reveal protocol after the two servers lock the Merkle root. Before the commitment lock is completed, this randomness is unpredictable for any colluding party consisting of the client and at most one corrupted server.

[0127] Definition 2 (G3 Commitment Equation Accountability): Agreement Satisfying G3, if for any PPT adversary (actively corrupting and colluding with two servers), the client accepts a downlink result. However, the probability that it does not satisfy the following commitment equation is: :

[0128]

[0129] in, This indicates the set to be accepted in the current round. This represents the sum of integer differences among all clients in the accept set distributed by the two servers. The integer vector obtained after function recovery. This represents the sum of the blinding factors for all clients in the acceptance set distributed by the two servers. This represents a linear homomorphic hash that maps an integer vector to elements of an elliptic curve group. is the blinded base point in the elliptic curve group. For the client The promise;

[0130] The right side of the equation is obtained by the client locally summing the signature and the set of commitments verified by Merkle; the server cannot directly specify or replace the verification target.

[0131] The following embodiment provides a detailed description of the complete execution flow of the present invention.

[0132] The single-round process in this embodiment is as follows.

[0133] After local training and fixed-point normalization on the client side, the public difference is calculated using a preset mask. With promise Then, the commitments are uploaded. Each of the two servers locally verifies the commitment binding, incorporates the difference into the authentication secret sharing, and locks the Merkle root of the commitment. Subsequently, the two servers collaborate in a closed state to screen and complete blind aggregation. Finally, the client locally reconstructs the verification target from the locked commitment set and verifies the aggregation consistency. The entire process anchors the server-side screening input and the client-side verification commitment to the same object. The client-side group operation overhead is only two Pippenger multiscalar multiplications, used for commitment generation and aggregation verification respectively. Figure 2 The process is illustrated in a diagram, showing that the three stages of input gate, screening, and aggregation verification all act on the same set of commitments.

[0134] The commitment-disclosure protocol upon which this invention relies is unified in the scalar field for all operations. Above, among which, For a large prime number A finite field of prime numbers, Taking the scalar group order of BLS12-381, it is approximately 2. 255 The client's fixed-point training values ​​are signed integer vectors. ,in , For fixed-point scaling factor, This is the clipping boundary. The mask is a signed integer vector. The client calculates the integer difference based on this. = - To ensure that the vector-level statistical distance of the mask pair differences does not exceed [a certain value]... ,Pick .remember This is an upper bound on the size of the single-round acceptance set, i.e. .

[0135] The client's commitment to its updates takes the form of the blinded Pedersen-LHH:

[0136]

[0137] Among them, blinding factor The share is derived from two servers, and the client only holds the group element form. = Therefore, there is no need to know The commitment can then be calculated.

[0138] The second layer of screening uses L independent sparse matrices. ,in Each line contains at most There are 1 non-zero term. To avoid modular arithmetic wrap-around, the parameters satisfy 1 / 2 * 1 / 3 ... and Used when recovering a signed integer from a group element or a field element. function.

[0139] The client's commitment to its updates takes the form of the blinded Pedersen-LHH:

[0140]

[0141] Among them, the blinding factor The share is derived from two servers, and the client only holds the group element form. = Therefore, there is no need to know The commitment can then be calculated.

[0142] As one possible implementation, a trusted initialization method During the system deployment phase, public parameters are generated, a mask seed is distributed to each client, and preprocessed material containing mask authentication shares, blinded difference cluster points, and security two-party computational auxiliary data is distributed for dual-server authentication, which is then permanently taken offline.

[0143] Trusted Initializer First, parameters and key distribution are disclosed during the system deployment phase. Specifically, the trusted initialization method... Public group and encoding parameters sparse matrix parameters and round seeds Based on this, the parties derived publicly available round labels. SPDZ maliciously securely computes the global key by two parties. It is then distributed in shares, by the server. Only holding .

[0144] Trusted Initializer Then, a pre-defined mask and its authentication representation are performed. The client-side proof-free commitment-anchored two-way accountability federated learning method of this invention requires the same mask to exist in both plaintext on the client side and authentication share on the server side, and to be consistent round by round. Therefore, a trusted initialization method... For each client Sampling long-term mask seed The client is assigned to each round. Deterministic expansion calculation of the current round mask:

[0145]

[0146] The offline preprocessing stage then focuses on the mask generation server-side SPDZ malicious security two-party calculation share for these deterministic operations. This also generates the Beaver triples and safety comparison auxiliary data required for subsequent dense-state multiplications, where the Beaver triples are for satisfying... Secret shared multiplication correlation Trusted Initializer Simultaneously generate blinding With mask commitment .

[0147] At this point, the client has reached the difference. Used , and the server input gate held These are two representations of the same mask. Since the ordinary pseudo-random generator (PRG) cannot allow two servers to locally derive the share of the correlation between the two parties' calculations with SPDZ malicious security, the above materials must be generated and distributed all at once during the offline preprocessing stage, constituting the main preprocessing materials of this scheme.

[0148] Then, trusted initialization method The certification distributes blinded materials and difference cluster points. The commitment to blinding factors uses a fractionalized derivation: a trusted initialization method. Blind seed share Send to Both parties acted accordingly. Expand; the client only obtains group elements. Therefore, there is no need to know. The commitment can then be calculated. To enable binding verification to be completed independently on a single server, It also distributed blinded differential cluster points to the authentication of two servers:

[0149]

[0150] For trusted initialization The blinded interpolation cluster points of the authentication distribution, due to The authentication channel is distributed and fixed round by round, and the server does not rely on any unauthenticated cluster points from the peer when performing binding verification.

[0151] Simultaneously, the randomness of the temporal locking screening needs to be considered. The randomness of this round of sparse detection is not determined during initialization, but rather at the Merkle root. Once locked, it is generated by two servers through a three-step commitment-disclosure protocol. First sampling And send a commitment ; after both parties confirm receipt of the other's commitment, they will each disclose their respective information. Verification by both parties Consistent Derivative Screening Randomness Even if a server colludes with a client and leaks its own information in advance... Ultimately, the seed still depends on the share revealed by another honest server after the digest is locked, and the client cannot predict the sparse matrix before submission. The abort of either server only invalidates the current round and does not affect the security of already locked commitments.

[0152] Next, the client calculates the local update. With this round mask The integer difference is used to calculate a blinded commitment based on the integer difference, which is then signed and uploaded to the dual servers; the client submits: the first... Wheel, online client Trim and fix local updates to Calculate integer differences Calculate commitments using Pippenger MSM and sign it. Uploaded later. Provide two servers. This represents the complete set of messages uploaded by the client to the server.

[0153] Then, each server independently verifies the signature and recalculates the commitment using blinded difference cluster points and integer differences. The server verifies whether the commitment uploaded by the client satisfies the preset binding equation. Clients that pass the verification are added to the live set after the intersection of the two servers is taken.

[0154] Server binding verification. Each server. Perform the following steps independently and locally. First, verify the signature. The server then recalculates the commitment using the integer difference, automatically calculating it using PippengerMSM. Among them, the symbol " "" indicates "defined as". Finally, the local verification binding equation is:

[0155]

[0156] Server self-calculation And not accept client-reported hashes, and for The authentication distribution uses a blinded interpolation cluster. Therefore, the binding validation has neither null validation vulnerabilities nor relies on unauthenticated input from another server. Clients that fail validation are removed, and the two servers exchange valid IDs and take their intersection to obtain the binding validation intersection. The intersection of the two parties is verified by binding them together. As the surviving set in this round .

[0157] Input gate. (Yes / No) The two servers incorporate the difference into the authentication share by adding a public constant, without any interaction. Place , Place The MAC share will be updated accordingly. Obtain certified share The local verification binding equation guarantees that the integer vector represented by the certified share is consistent with the commitment. Since the determined integer vectors are consistent, subsequent screening therefore applies to the same committed update.

[0158] In the following embodiment, the two servers construct a Merkle tree based on the commitments of all clients in the live set and issue a root. After the client confirms, the root is locked. After the root is locked, the two servers generate screening randomness through a commitment-reveal protocol and cooperate in performing a secret screening on each client in the live set within a secret shared domain. Clients that pass the screening constitute the acceptance set.

[0159] Merkle root lock. Server lock. Construct a Merkle tree and issue a Merkle root. Once the client confirms a match, the root is locked. After the root is locked, the two servers then execute the aforementioned three-step commitment-revealing protocol to screen for randomness. This timing ensures that the client cannot predict the screening direction when submitting the commitment. The intersection of the verification is checked by binding both parties. As the surviving set in this round .like If the client fails to upload on one side or disconnects on one side, the current round will be terminated. Clients that upload on one side or disconnect on one side will be excluded from the intersection if they fail the binding verification on at least one side.

[0160] Two-layer dense screening. Within the certified share domain, the current round of survivor sets... The client-side implementation performs two layers of detection without recovering the plaintext gradient. The first layer is range detection, using SPDZ malicious security two-way calculation to determine if each component satisfies [the specified condition]. The second layer is sparse matrix energy detection, which is... Derive L matrices The server accesses each user within the secret shared domain. Local computing Energy was calculated using Beaver triples. Determine whether the energy level does not exceed a preset energy threshold. The clients that pass the two-layer detection constitute the accepting set. .

[0161] in, Indicates the client index. Indicates the federal learning and training rounds. This represents the vector dimension index, with values ​​ranging from 1 to d, where d is the locally updated vector dimension. For the client In the Local updates of wheels The One portion, As a preset range boundary, A function to promote the elements of a finite field to signed integers; if any component does not meet the condition, the client is removed from the live set; Indicates client In the Local updates of the wheel; For the client No. The locally updated authentication secret is shared. Compute matrix multiplication within a secret shared domain; Represents the square of the L2 norm;

[0162] In the following embodiment, the two servers calculate and distribute the sum of integer differences and blinding factors of all clients in the acceptance set; the clients verify the authenticity and completeness of the distributed commitment set, reconstruct the verification target locally from the verified commitments, and verify whether the aggregation result satisfies the commitment equation. If it is true, they accept it; otherwise, they reject it.

[0163] The aggregation of the masks is calculated independently by two servers:

[0164]

[0165] And calculate the sum of the blinding factors:

[0166]

[0167] Then , , The corresponding commitment, signature, and Merkle proof are also sent to the client.

[0168] The client performs the following verifications in sequence. First, it verifies the metadata issued by the two servers against the Merkle root. Consistent. Secondly, regarding... Each client verifies its signature. Proof of Merkle root inclusion Then restore the aggregation result. + and through Restore to an integer vector At the same time, restore total blindness. + The client then reconstructs the verification target locally from the verified commitment:

[0169]

[0170] calculate And verify the consistency equation:

[0171]

[0172] If the equation is true, then accept. Otherwise, reject. Due to the verification target... The result is obtained locally by the client from commitments where both the signature and Merkle proof are valid; the server cannot specify or replace the client's verification target. Therefore, even if two servers collude, it is impossible to make the client accept a forged aggregation result that does not satisfy this equation.

[0173] It should be understood that the program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0174] The acquisition, storage, and application of user personal information involved in the technical solution of this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0175] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this invention does not impose any limitations on them.

[0176] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0177] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A client-side proof-free commitment-anchored two-way accountability federated learning method, characterized in that, This method is based on a federated learning system that includes a trusted initiator, two servers, and multiple clients, and includes the following steps: The trusted initiator generates public parameters during the system deployment phase, distributes mask seeds to each client, and distributes preprocessed materials containing mask authentication shares, blinded difference cluster points, and security two-party computational auxiliary data for dual-server authentication, and then goes offline permanently. The client generates the current round mask based on the mask seed, calculates the integer difference between the local update and the current round mask, calculates a blinded commitment based on the integer difference, signs it, and uploads it to the dual servers. Each server independently verifies the signature and recalculates the commitment using the blinded difference cluster point and the integer difference, and verifies whether the commitment uploaded by the client satisfies the preset binding equation. Clients that pass the verification are entered into the survival set after the intersection of the two servers. The two servers construct a Merkle tree based on the commitments of all clients in the live set and issue a root. After the client confirms, it locks the root. After the root is locked, the two servers generate screening randomness through a commitment-reveal protocol and cooperate in performing a secret screening on each client in the live set within a secret shared domain. Clients that pass the screening constitute the acceptance set. The two servers calculate and distribute the sum of integer differences and blinding factors of all clients in the acceptance set. The clients verify the authenticity and completeness of the distributed commitment set, reconstruct the verification target locally from the verified commitments, and check whether the aggregation result satisfies the commitment equation. If it does, they accept it; otherwise, they reject it.

2. The client-side proof-free commitment-anchored two-way accountability federated learning method according to claim 1, characterized in that, The mask authentication share distributed by the trusted initializer to each client includes: generating two additive secret shared shares of the mask vector used by each client in each round, and allocating one of the shares to each of the two servers, so that a single server cannot know the complete mask vector; The secure two-party computational auxiliary data includes Beaver triples for performing multiplication operations within a secret shared domain and auxiliary random numbers for performing secure comparison operations. The Beaver triples enable the two servers to collaboratively complete multiplication calculations without exposing their respective shares. The blinding difference cluster points are pre-calculated by the trusted initializer for the mask vector used by each client in each round and distributed to the dual servers in an authenticated manner.

3. The client-side proof-free commitment-anchored two-way accountability federated learning method according to claim 2, characterized in that, Before the client calculates the blinded commitment, it first performs pruning and point-fixed processing on the local update so that each component of the local update falls within a preset value range; The client uses the mask seed to generate the current round mask in a deterministic pseudo-random way, so that the difference between the current round mask and the integer value still satisfies the condition of not generating modulus wrap-around after adding the components one by one; The private key used by the client to sign the commitment and the public key pre-distributed to each server constitute a digital signature key pair, which is used by the server to verify the client's identity and the authenticity of the source of the commitment data; The blinding factor is derived collaboratively from the seed shares held by each of the two servers before each round of training and provided to the client in the form of group elements. The client can complete the commitment calculation without knowing the specific value of the blinding factor.

4. The client-side proof-free commitment-anchored two-way accountability federated learning method according to claim 3, characterized in that, The preset binding equation is: ； in, Indicates the client index. Indicates the federal learning and training rounds. For the client In the Blinded commitments uploaded in rounds, Indicates the client In the The mask promise of the wheel, For server to client In the Integer difference passed through rounds Computation of linear homomorphic hash; The trusted initializer is the client. In the Blinded differential clustering points in round-certification distribution; Each of the two servers independently calculates the right side of the preset binding equation and compares it with the commitment uploaded by the client. If they are equal, the binding verification passes.

5. The client-side proof-free commitment-anchored two-way accountability federated learning method according to claim 1, characterized in that, The commitment-disclosure protocol is executed by the two servers after the Merkle root is locked, specifically including: Two servers each generate a random number share, calculate the hash commitment of the random number share, and exchange them. After both parties confirm that they have received the hash commitment from the other party, they reveal the random number share to each other. Each server verifies whether the random number share revealed by the other party is consistent with the hash commitment it previously received. After the verification is successful, the two random number shares are combined and input into the pseudo-random generator to obtain the screening randomness. The generation timing of the screening randomness is constrained to after Merkle root locking and before the start of the dense screening, so that the client cannot predict the specific random parameters used in the subsequent dense screening when submitting the commitment, thereby preventing malicious clients from constructing adaptive escape updates against the screening rules. Furthermore, once the Merkle root is locked, no client can change its committed commitments.

6. The client-side proof-free commitment-anchored two-way accountability federated learning method according to claim 5, characterized in that, The dense state screening includes range detection and energy detection; The range detection uses SPDZ malicious security two-party calculation to determine whether each component satisfies the condition. ;in, Indicates the client index. Indicates the federal learning and training rounds. This represents the vector dimension index, with values ​​ranging from 1 to d, where d is the locally updated vector dimension. For the client In the Local updates of wheels The One portion, As a preset range boundary, A function to promote the elements of a finite field to signed integers; if any component does not meet the condition, the client is removed from the live set; The energy detection is based on screening for randomness. Derive L sparse matrices L represents the total number of sparse matrices. The server performs sparse detection on each parameter within the secret shared domain. Local computing Energy was calculated using Beaver triples. Determine whether the energy level does not exceed a preset energy threshold. ;in, Indicates the client In the Local updates of the wheel; For the client No. The locally updated authentication secret sharing representation; Compute matrix multiplication within a secret shared domain; Represents the square of the L2 norm; Clients that perform range detection and energy detection constitute the accepting set. .

7. The client-side proof-free commitment-anchored two-way accountability federated learning method according to claim 6, characterized in that, The expression for the commitment equation is: in, This indicates the set to be accepted in the current round. This represents the sum of integer differences among all clients in the accept set distributed by the two servers. The integer vector obtained after function recovery. This represents the sum of the blinding factors for all clients in the acceptance set distributed by the two servers. This represents a linear homomorphic hash that maps an integer vector to elements of an elliptic curve group. For the blinded base point in the elliptic curve group, For the client The promise; When the client verifies the commitment equation, the left side Calculated from the aggregation results issued by the two servers, on the right side. It is reconstructed locally by the client from the set of commitments verified by signature and Merkle proof; the server cannot specify or replace the composition of this verification target. If the commitment equation holds, it proves that the aggregation result issued by the two servers is equal to the cryptographic sum of all clients in the acceptance set that have committed to updating. The client accepts the aggregation result and updates its local model; otherwise, it rejects the aggregation result.

8. A client-proof-free commitment-anchored two-way accountability federated learning system implementing the method of any one of claims 1-7, characterized in that, include: The trusted initializer is used to perform a one-time offline initialization during the system deployment phase, generate public parameters, distribute mask seeds to each client, distribute preprocessed materials containing mask authentication shares, blinded difference cluster points and security two-party calculation auxiliary data for dual-server authentication, and permanently go offline after distribution is completed; Two servers are used to independently perform signature verification and commitment binding verification submitted by the client in each round of training. The intersection of the clients that pass the verification is used to obtain the live set. The servers collaborate to perform commitment locking and secret cooperation screening on the clients in the live set to obtain the acceptance set. The aggregation result of the acceptance set and its verification material are calculated and sent to the client. Multiple clients are used to generate the current round mask based on the mask seed, calculate the integer difference between the local update and the current round mask and the blinded commitment, sign it and upload it to the dual servers, and receive the aggregation results and verification materials issued by the dual servers. After verifying the authenticity and completeness of the commitment set, the client locally reconstructs the verification target from the verified commitments and verifies the commitment equation to decide whether to accept or reject the aggregation result.

9. An electronic device, characterized in that, Includes one or more processors; Storage device for storing one or more programs; When one or more programs are executed by one or more processors, the one or more processors implement the client-proof-free commitment-anchored two-way accountability federated learning method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed, the computer program implements the client-proof-free commitment-anchored two-way accountability federated learning method as described in any one of claims 1-7.

Images