A ciphertext low-dimensional projection-based longitudinal federated learning privacy protection and poisoning-robust aggregation method

Abstract

The application belongs to the field of machine learning, cryptography and federated learning security, and discloses a longitudinal federated learning privacy protection and poisoning robust aggregation method based on ciphertext low-dimensional projection. In order to solve the problem that single-client intermediate representation privacy protection and training period anomaly detection cannot be considered simultaneously, KGC provides Paillier homomorphic encryption, the server generates fixed low-dimensional projection summaries in batches from the same representation ciphertext as the training input, calculates category semantic anomaly and consistency anomaly by using the coordinate median prototype and cross-client predictor respectively, generates continuous weights by standardization, batch risk, negative exponential mapping and upper limit clipping, and homomorphically aggregates the original representation ciphertext with integer weights; the same effective weight is used for forward fusion and reverse gradient, and the stop gradient is executed, and only high-trust samples are used to update the prototype, statistics and predictor. KGC checks two types of batch decryption requests according to the request type, number of times and matrix dimension, and realizes privacy protection and poisoning soft inhibition.

Description

Technical Field

[0001] This invention belongs to the fields of machine learning, cryptography and federated learning security, and specifically relates to a method for privacy protection and poisoning robust aggregation in vertical federated learning based on low-dimensional projection of ciphertext. Background Technology

[0002] Vertical federated learning is suitable for scenarios where multiple participants hold different features of the same batch of samples, while the labels are held by the server or an active participant. Each client transforms local features into intermediate representations using its local underlying model. The server then fuses these representations and inputs them into the top-level model, returning the corresponding gradients to the clients. This process avoids directly exchanging original features, but the complete plaintext intermediate representation from a single client may still leak statistical and semantic information about the local data.

[0003] Malicious clients can carry out training-period poisoning and backdoor attacks by tampering with the underlying model, manipulating intermediate representations, or injecting trigger patterns. Simple averaging can cause abnormal representations to directly affect top-level predictions and reverse updates; single-class semantic detection or single cross-client consistency detection may have loopholes, while hard threshold removal is prone to causing training oscillations when normal representations drift, class imbalances exist, and detection errors are present.

[0004] Paillier additive homomorphic encryption supports ciphertext addition and plaintext integer scalar multiplication, which can be used to hide intermediate representations and complete ciphertext aggregation. However, nonlinear statistics such as class distance and cross-view prediction error are difficult to calculate directly on the complete ciphertext. Submitting separate detection representations separates the detection input from the actual training input, and unconditionally using online samples to update the detector may cause anomalous samples to continuously change the class prototype, anomalous score statistics, and cross-client prediction relationships.

[0005] Therefore, it is necessary to maintain a verifiable homology between the anomaly detection input and the real training input without exposing the complete plaintext intermediate representation of a single client, to stably transform complementary anomaly evidence into executable ciphertext aggregation weights, and to constrain the update range and update conditions of the online detection benchmark. Summary of the Invention

[0006] The purpose of this invention is to solve the technical problems of difficulty in coordinating intermediate representation privacy protection, training-period poisoning detection, and weighted aggregation in the same process in vertical federated learning, and to reduce the risks caused by detection input substitution, single signal avoidance, inconsistent forward and backward weights, and online detection benchmark contamination.

[0007] This invention uses fixed low-dimensional projection of homologous ciphertext as the detection entry point, forms dual signals with category semantic anomalies and cross-client consistency anomalies, drives the aggregation of original representation ciphertext with batch continuous weights, and constitutes a complete protocol chain through request whitelist, stopping gradient and high-confidence restricted update.

[0008] To achieve the above objectives, the present invention employs the following technical means:

[0009] This invention provides a privacy-preserving and poisoning-robust aggregation method for longitudinal federated learning based on encrypted low-dimensional projection. It is applied to a longitudinal federated learning system comprising a server S and a KGC that honestly comply with the protocol, and m clients. The server holds sample labels and a top-level model, while each client holds different local features of the same batch of samples and outputs intermediate representations of the same dimension. The method includes the following steps:

[0010] Step A. System Initialization: KGC generates Paillier homomorphic encryption key pairs and publishes the public key; the server honestly adheres to the protocol, generates a fixed, client-secret sparse integer projection matrix R within the task, and determines the protocol parameters; KGC only accepts two types of decryption requests: batch low-dimensional projection ciphertexts and final multi-client aggregated ciphertexts from the protocol whitelist, verifies the request stage, the maximum number of requests, and the dimension of the ciphertext matrix, and rejects decryption requests that do not conform to the agreement.

[0011] Step B. Clean Warm-up: In the pre-warm-up rounds assuming no attacks, each client calculates the floating-point intermediate representation, encodes it to fixed-point, and encrypts it coordinate by coordinate; the server encodes the same average target weights into integers and then performs scalar multiplication and homomorphic addition on the ciphertext. KGC decrypts the final multi-client aggregated ciphertext after the number of operations and dimensions pass the verification; the server restores the pre-warmed aggregated embedding and uses the effective average weights determined by the same integer weights in both forward training and backward gradient backpropagation.

[0012] Step C. Detector Initialization: After the warm-up, the client's underlying model is temporarily frozen. Each client performs a forward computation on all training samples and uploads the intermediate representation ciphertext according to the encoding and encryption method in Step B. The server calculates the fixed low-dimensional projection from the same source ciphertext and requests decryption in batches according to the whitelist. It uses the low-dimensional summary and coordinate median of each client and category to establish the projection prototype, trains the cross-client predictor, and initializes the mean, variance, and standard deviation of the semantic anomaly score and the consistency anomaly score.

[0013] Step D. Formal Training of Ciphertext Projection: After unfreezing the underlying model, the client generates intermediate representation ciphertext for the current batch according to step B; the server uses a fixed matrix R to perform integer scalar multiplication and homomorphic summation on the ciphertexts of the same batch actually trained by each client, obtaining the batch low-dimensional projection ciphertext of |B|×m×k; after KGC verifies the request stage, number, and dimension, the batch is decrypted, and the server divides by the intermediate representation scaling factor. To recover the low-dimensional projected summary in the common coordinate system.

[0014] Step E. Dual-signal anomaly detection: The server calculates the semantic anomaly score of the current low-dimensional projected summary relative to the client-by-client, category-by-category prototype based on the real label, and calculates the consistency anomaly score based on the cross-client predictor output; the two scores are standardized using the statistics established in step C and updated by the constraints in step I, and a sample-level comprehensive anomaly score is formed by a non-negative fusion coefficient that sums to 1, which characterizes anomalies from two aspects: deviation from category structure and violation of cross-feature view dependencies.

[0015] Step F. Batch Risk and Weight Generation: The server averages the comprehensive anomaly scores of the same client in the current batch to obtain the batch risk. Initial weights are generated using negative exponential normalization mapping controlled by risk sensitivity, and upper limit pruning is directly performed to obtain the target aggregate weight before quantization. After pruning, no positive weight lower limit is set and no renormalization is performed, so that all samples of the same client in the batch share the same target weight, and the overall risk continues to be reflected through the weight sum and aggregate embedding amplitude.

[0016] Step G. Secure weighted aggregation: The server encodes the target aggregation weights before quantization into non-negative integer weights according to the weight scaling factor, and performs scalar multiplication and homomorphic addition on the original intermediate representation ciphertexts of each client with integer weights to obtain the final multi-client aggregated ciphertext; the effective weights obtained by dividing the integer weights by the weight scaling factor are used as the immutable state of the current batch; after KGC passes the verification of the upper limit of a request and the |B|×d dimension, it decrypts the final aggregated ciphertext, and the server restores the final aggregated embedding by the product of the two types of scaling factors.

[0017] Step H. Stop gradient training: The server inputs the final aggregated embedding into the top-level model and calculates the batch task loss. The effective weights cached in step G are used as batch constants that do not differentiate from the task loss. The common top-level gradient is the gradient of the task loss with respect to the final aggregated embedding. The intermediate representation returned to the client is equal to the product of the common gradient and the corresponding effective weights. The task loss must not be backpropagated through outlier scores, statistics, predictors, risk mapping, weight pruning, and quantization processes.

[0018] Step I. High-Confidence Update and Iteration: The server takes the maximum value of the comprehensive anomaly score of all clients for each sample, selects candidate samples based on the risk experience distribution of the full training samples in the initialization phase, and selects the preset proportion with the lowest risk from the candidate samples to form a high-confidence set; only when the update cycle is reached and the number of samples meets the requirements, the prototype, anomaly score statistics and cross-client predictor are updated with high-confidence samples in a limited manner, and then steps D to I are repeated.

[0019] In the above technical solution, step A includes:

[0020] A1. Construct a vertical federated learning system consisting of a server S, a KGC, and m clients; the server holds sample labels and a top-level model, and each client holds different local features of the same batch of samples and outputs intermediate representations of the same dimension.

[0021] A2. KGC generates Paillier key pairs, publishes the public key and keeps the private key secure; each party uses only ciphertext addition and plaintext integer scalar multiplication to complete subsequent ciphertext linear operations.

[0022]

[0023]

[0024] In the formula, This indicates a cryptographic operation performed using the Paillier public key; This represents the Paillier public key; This represents the first integer plaintext; This represents the plaintext of the second integer; Represents an integer scalar.

[0025] A3. The server generates a sparse integer projection matrix R whose elements are taken from {-1,0,1} and whose projection dimension is smaller than that representing the dimension. R is fixed within this training task and kept secret from the client. The system determines two types of scaling factors, warm-up rounds, risk parameters, and update cycles.

[0026] A4. The server honestly adheres to the protocol; each initialization batch or formal training batch may submit at most one batch low-dimensional projection decryption request of |B|×m×k, and each warm-up batch or formal training batch may submit at most one final aggregation decryption request of |B|×d. KGC verifies the request by type, stage, number of requests, and dimension.

[0027] In the above technical solution, step B includes:

[0028] B1. Set the first few rounds as a clean warm-up phase, do not perform low-dimensional projection, anomaly detection and detection benchmark update, and maintain the fixed order of the coordinates of each client, sample and ciphertext.

[0029] B2. The client calculates the d-dimensional floating-point intermediate representation, completes fixed-point encoding with a preset intermediate representation scaling factor, encrypts it coordinate by coordinate using the public key, and uploads the ciphertext vector bound to the sample index.

[0030]

[0031] In the formula, This represents the ciphertext of the intermediate representation of sample i corresponding to client j; This represents the intermediate floating-point representation of sample i corresponding to client j; The middle value indicates the scaling factor.

[0032] B3. The server encodes the uniform average target weight into the same non-negative integer according to the weight scaling factor, and performs homomorphic scalar multiplication and coordinate-by-coordinate addition on all client ciphertexts with the integer weight to form the final preheated aggregated ciphertext |B|×d.

[0033] B4. KGC only returns the final aggregated integer vector after the request count and matrix dimension verification are passed; the server restores the preheated aggregated embedding by the product of the two scaling factors and references the same effective average weight in the forward fusion and backward gradient.

[0034] In the above technical solution, step C includes:

[0035] C1. Temporarily freeze the client's underlying model. Each client performs a forward pass, encoding, and encryption on all training samples. The server generates low-dimensional projected ciphertext in batches from the uploaded intermediate representation ciphertext using a fixed matrix R and requests KGC to decrypt it.

[0036] C2. The server gathers low-dimensional projection summaries of all training samples according to the client and the real category, and forms the initial projection prototype based on the median of each coordinate.

[0037]

[0038] In the formula, This represents the initial projection prototype of category c corresponding to client j; This represents the low-dimensional projected summary of sample i corresponding to client j.

[0039] C3. For the target client j, concatenate the low-dimensional summaries of other clients in a fixed order as input, and build a cross-client predictor with the target client's summary as the supervision target.

[0040]

[0041] In the formula, This represents the predicted summary of sample i corresponding to client j; This represents the cross-client predictor for client j; This represents the low-dimensional projection summary of sample i from other clients, assembled in a preset fixed order. This represents the cross-client predictor parameters for client j.

[0042] C4. The server trains the initial predictor with the sum of the mean squared prediction error and the parameter L2 regularization term, and estimates the mean, variance, and standard deviation of the two outlier scores with the full training samples, which are not less than the stability constant. Then the underlying model is unfrozen.

[0043]

[0044] In the formula, This represents the initial cross-client predictor parameters for client j; This represents the mean squared prediction error of the cross-client predictor of client j on the full training samples. Denotes the non-negative 2-norm regularization coefficient. express The L2 norm.

[0045] In the above technical solution, step D includes:

[0046] D1. In the formal training batch, the client uploads the intermediate representation ciphertext according to the same representation dimensions, scaling and encryption rules as in step B, without generating a separate detection-specific representation.

[0047] D2. The server performs an integer linear projection on each intermediate representation ciphertext using the fixed matrix R from step A, forming low-dimensional projected ciphertexts that are homologous to the training input in batches.

[0048]

[0049] In the formula, This represents the k-dimensional low-dimensional projection summary of sample i corresponding to client j; This represents the projected ciphertext obtained by performing integer scalar multiplication and homomorphic summation on the ciphertext vector using each row of R.

[0050] D3. KGC only processes requests for low-dimensional projections in the current training batch if the number of requests does not exceed one and the matrix dimension is equal to |B|×m×k; the server will return an integer divided by the intermediate representation scaling factor to obtain the summary.

[0051] In the above technical solution, step E includes:

[0052] E1. Perform L2 normalization on the current abstract and the projected prototypes of each category for the same client, using a positive stability constant ε. n The zero norm is handled; the category prototype is initialized to the initial projected prototype obtained in step C2, and the latest value updated in step I is used thereafter. The squared distance between the summary and the prototype is calculated, and the category soft-match probability is formed based on the negative distance and positive temperature parameters.

[0053]

[0054]

[0055] In the formula, This represents the soft matching probability that sample i corresponding to client j belongs to category c; This represents the squared distance between the summary and the client's j-class projected prototype; Indicates a positive temperature parameter; This indicates the total number of categories.

[0056] E2. Take the negative logarithm of the soft match probability of the true label as the semantic anomaly score, which is used to measure the deviation of the current summary from the true category prototype.

[0057] E3. The target client prediction summary is output by the cross-client predictor, and the mean squared error between the current summary and the prediction summary is used as the consistency anomaly score.

[0058]

[0059] In the formula, This represents the semantic anomaly score of sample i corresponding to client j; This represents the cross-client consistency anomaly score for sample i corresponding to client j; This represents the positive stability constant to prevent logarithmic overflow; This represents the prediction value of the summary by the cross-client predictor.

[0060] E4. Standardize using the mean and standard deviation of the two types of scores respectively, and then sum the results using non-negative fusion coefficients that sum to 1 to obtain the composite outlier score.

[0061]

[0062] In the formula, This represents the overall anomaly score of sample i corresponding to client j; This represents the mean of the semantic anomaly scores for client j. The standard deviation of the semantic anomaly score for client j; This represents the mean of the consistency anomaly scores for client j. The standard deviation of the consistency anomaly score for client j; The non-negative fusion coefficient represents the semantic anomaly score; The non-negative fusion coefficient represents the consistency anomaly score; This represents the positive stability constant to prevent the denominator from being zero.

[0063] In the above technical solution, step F includes:

[0064] F1. Calculate the average of the comprehensive anomaly scores of all samples from client j in the current batch B to form the client-level batch risk.

[0065]

[0066] F2. Perform negative exponential normalization mapping controlled by τ on the risk of each client batch, and then directly prune it with a preset weight upper limit to obtain the target aggregate weight before quantization.

[0067]

[0068] In the formula, This represents the pre-quantization target aggregate weight of client j in the current batch B; This indicates the batch risk of client j in the current batch B; Indicates positive risk sensitivity; This indicates the preset weight limit.

[0069] F3. After the upper limit is pruned, no lower limit for positive weights is set, and no renormalization is performed; clients with higher risk may obtain zero or near-zero target weights, and the sum of all target weights shall not exceed 1.

[0070] F4. All samples within a batch from the same client share the same target weight; the server generates and caches the weight status of the batch once after completing the anomaly calculation for all samples.

[0071] In the above technical solution, step G includes:

[0072] G1. Round the target aggregate weights before quantization to non-negative integer weights according to the weight scaling factor, and divide the integer weights by the scaling factor as the unique valid weights for this batch.

[0073]

[0074] In the formula, This represents the non-negative integer weight of client j in the current batch B; Indicates the weight scaling factor; Indicates by The effective weight of client j is uniquely determined.

[0075] G2. For each sample, perform homomorphic scalar multiplication on the client's original intermediate representation ciphertext with corresponding integer weights, and then add them homomorphically coordinate by coordinate to form the final aggregated ciphertext.

[0076] G3. KGC performs batch decryption when the final aggregation request count does not exceed one and the matrix dimension is |B|×d; the server divides by the product of the two scaling factors to restore the final aggregation embedding.

[0077]

[0078] In the formula, This represents the final multi-client aggregated ciphertext of sample i; This represents the non-negative integer weight of client j in the current batch B; This represents the ciphertext of the intermediate representation of sample i corresponding to client j; This represents the final aggregated embedding of sample i; The middle element indicates the scaling factor; This represents the weight scaling factor.

[0079] G4. The quantization error between the target weight and the effective weight shall not exceed half a weight quantization unit; the server caches the integer weights and effective weights, and does not remap, prune or quantize them subsequently.

[0080] In the above technical solution, step H includes:

[0081] H1. Embed the final aggregation into the top-level model of the input server, and calculate the batch task loss based on the true label and single-sample classification loss.

[0082]

[0083] In the formula, This indicates the average task loss for the current batch; Indicates the current batch; This represents the true label of sample i.

[0084] H2. Calculate the common top-level gradient of the task loss with respect to the final aggregated embedding, and scale it to the intermediate representation gradient of each client using the same effective weights cached in step G.

[0085]

[0086] In the formula, Indicates task loss Final aggregation embedding of sample i The public top-level gradient; This represents the intermediate gradient of sample i corresponding to j returned to the client; This represents the effective weight of client j in the current batch B.

[0087] H3. Treat the effective weights as constants for the current batch and stop task loss through anomaly detection, risk mapping, pruning, quantification, and backpropagation of three types of detection benchmarks.

[0088] H4. The server updates the top-level model with the task loss and returns the scaled gradient to the corresponding client; the client updates its local parameters by chaining derivatives from the underlying model.

[0089] In the above technical solution, step I includes:

[0090] I1. Take the maximum value of the cross-client comprehensive anomaly score for each sample, screen candidate samples based on the experience risk of the full training samples in the initialization phase, and select the preset proportion with the lowest risk to form a highly reliable set.

[0091] I2. When the number of samples in the high-confidence set and the corresponding category reaches the threshold, the median of the current category summary is used as the candidate prototype and exponential sliding update is performed.

[0092] I3. Estimate the candidate mean and variance of semantic anomaly scores and consistency anomaly scores on a high-confidence set, and apply the same exponential sliding rule to both types of statistics.

[0093] I4. When the update cycle is reached, candidate predictor parameters are obtained on the high-confidence set according to the independent objective in step C4, and the single change magnitude of the parameters relative to the current parameters is pruned; if the condition is not met, the old state is retained.

[0094] The method described in this invention has the following advantages:

[0095] (1) The client uploads the intermediate representation ciphertext. KGC verifies the stage, number of times and matrix dimension of the two types of batch requests, namely low-dimensional projection and final aggregation, according to the protocol whitelist, so that the server can obtain only the batch decryption results necessary to complete the detection and joint training under the assumption of honestly complying with the protocol.

[0096] (2) The detection summary and the actual aggregation representation are derived from the same intermediate representation ciphertext and the same fixed projection matrix. Initialization, formal training and update are in the same coordinate system, which can reduce the evasion space of constructing normal detection input and malicious training input separately.

[0097] (3) The client-by-client, category-by-category projection prototype and the cross-client predictor respectively characterize the real category structure and multi-feature view dependency. The two types of anomaly scores are fused after independent standardization, which can supplement the blind spot of a single detection signal.

[0098] (4) The comprehensive anomaly score is successively converted into batch risk, target weight, integer weight and effective weight; the forward ciphertext aggregation and the backward gradient reference the same batch cache, and the task loss is stopped from propagating to the detector, forming a consistent continuous soft suppression.

[0099] (5) Only high-confidence sample update prototypes, two types of statistics and predictors that meet the risk threshold, minimum risk ratio, minimum number of samples and update cycle, and limit the single parameter change of the predictor, can adapt to normal representation drift and reduce continuous contamination of the detection benchmark. Attached Figure Description

[0100] Figure 1 This is a flowchart illustrating the overall process of the vertical federated learning privacy protection and poisoning robust aggregation method based on low-dimensional projection of encrypted text, as described in this invention. Detailed Implementation

[0101] The following provides a detailed description of the implementation of this invention. Although the invention is described in conjunction with specific embodiments, it is not limited to these embodiments; any modifications or equivalent substitutions made without departing from the scope of the claims should be covered within the protection scope of this invention.

[0102] This invention is implemented in a longitudinal federated learning system comprising a server S that honestly adheres to the protocol, a KGC, and m clients. Step A: The KGC generates a Paillier key. The server sets a fixed sparse integer projection matrix, fixed-point scaling factor, risk parameters, update conditions, and a decryption request whitelist within the task, thereby establishing the protocol boundary for encryption operations and batch decryption. Step B: During an attack-free warm-up period, the clients encrypt intermediate representations. The server completes the final ciphertext aggregation using integer average weights. After verification by the KGC, the ciphertext is decrypted. Forward fusion and backward gradient use the same effective average weights to form a normal training baseline. Step C: The underlying model is frozen. Each client performs a forward computation on all training samples. The server obtains low-dimensional summaries in batches from corresponding source ciphertexts. Class prototypes are established using the median of each coordinate, a cross-client predictor is trained, and the two-class score statistics are initialized, thereby obtaining a detection benchmark in a common coordinate system. Step D: In formal training, a low-dimensional projection is generated from the ciphertext used for actual aggregation and the same matrix, ensuring that the detection input matches the real training input. Step E maintains homogeneity; Step F calculates and standardizes the fusion of category semantic anomalies and cross-client consistency anomalies to simultaneously characterize category structure deviations and cross-feature view dependency violations; Step F aggregates sample anomalies into batch risks, generates continuous target weights through negative exponential mapping and upper limit pruning, and replaces hard threshold removal with continuous soft suppression; Step G quantizes the target weights into integers, homomorphically weights the original representation ciphertext, and restores the final aggregate embedding, so that the server only obtains the aggregate results required for joint training; Step H uses the corresponding effective weights as stopping gradient constants to uniformly adjust forward contributions and backward gradients, and blocks the reverse impact of task loss on the detector; Step I filters high-confidence samples with the maximum risk across clients, updates the prototype, statistics, and predictor only when the sample quantity and update cycle meet the requirements, and restricts the variation of predictor parameters to reduce detection benchmark contamination and adapt to normal representation drift, and then repeats steps D to I.

[0103] Furthermore, to clearly illustrate this invention, the necessary protocol parameters, formulas, and implementation conditions are given below. Those skilled in the art can make corresponding settings based on the specific task scale, model structure, and security parameters. The detailed algorithm flow is as follows:

[0104] Step A: System Initialization

[0105] A1. Given a security parameter, establish a vertical federated learning system consisting of a server S, a KGC, and m clients. The server holds sample labels, a top-level model F, and a detector state; client j holds the local features of sample i and the corresponding bottom-level model. The output of each client's bottom-level model is unified to d dimensions, enabling the server to perform weighted fusion coordinate by coordinate.

[0106]

[0107] In the formula, represents the sample index; represents the local feature of client j corresponding to sample i; represents the bottom-level model of client j; represents the bottom-level model parameter of client j; represents the d-dimensional intermediate representation of client j corresponding to sample i; represents the dimension of the intermediate representation.

[0108] A2. The KGC generates the Paillier public key pk and private key sk, publishes the public key to the server and clients, and keeps the private key independently. The protocol only uses the ciphertext addition and plaintext integer scalar multiplication supported by Paillier; negative integers recover the sign through the ciphertext inverse element and centralized integer decoding.

[0109]

[0110]

[0111] In the formula, represents the encryption operation performed using the Paillier public key; represents the Paillier public key; represents the first integer plaintext; represents the second integer plaintext; represents the integer scalar.

[0112] A3. The server generates a k×d sparse integer matrix R whose elements are taken from {-1, 0, 1}, where k<d and each row has a preset sparsity. R remains fixed during the initialization, formal training, and update phases of the same training task and is kept confidential from the clients; at the same time, the server registers the intermediate representation scaling factor, weight scaling factor, warm-up rounds, risk sensitivity, weight upper limit, minimum number of highly trusted samples, and update period.

[0113] A4. The server honestly adheres to the protocol. KGC establishes a whitelist of decryption requests: the matrix dimension of batch low-dimensional projection requests is |B|×m×k, and the matrix dimension of final aggregation requests is |B|×d; the former is at most once in each initialization batch or formal training batch, and the latter is at most once in each warm-up batch or formal training batch. KGC verifies the task identifier, stage, request type, cumulative number of requests, and dimension; if any condition is not met, the request is rejected.

[0114] Step B: Clean preheating:

[0115] B1. The system sets the first few training rounds as a clean warm-up period, during which no low-dimensional projective summaries are generated, no outlier scores are calculated, and no detection benchmarks are updated. The server registers the sample order and client order of the current batch B, ensuring a definite correspondence between the subsequently generated ciphertext, aggregation vector, and gradient.

[0116] B2. The client uses its local underlying model to calculate the d-dimensional floating-point intermediate representation of the sample. Within a pre-defined normal numerical range, it performs fixed-point encoding and rounding to the nearest integer using the intermediate representation scaling factor, and then encrypts the sample coordinate by coordinate using the Paillier public key. The client only uploads the ciphertext vector and necessary task, batch, and sample identifiers.

[0117]

[0118] In the formula, This represents the ciphertext of the intermediate representation of sample i corresponding to client j; This represents the intermediate floating-point representation of sample i corresponding to client j; The middle value indicates the scaling factor.

[0119] B3. The server quantizes the uniform average target weights into the same non-negative integer using a weight scaling factor. This integer is then used to perform scalar multiplication on the intermediate representation ciphertext of each client, and the results are homomorphically added coordinate-by-coordinate to obtain the final pre-warmed aggregated ciphertext. This batch does not calculate risk, nor does it generate a separate set of reverse weights due to minor deviations in the sum of the quantized weights.

[0120] B4. The server submits a final aggregation decryption request of |B|×d according to the whitelist. After KGC verification, it returns an aggregated integer vector. The server divides the vector by the product of the two scaling factors to restore the preheated aggregated embedding, trains the top-level model, and scales the intermediate representation gradient returned to the client with the effective weights corresponding to the same integer average weights, forming a stable and clean representation foundation for detector initialization.

[0121] Step C: Detector initialization:

[0122] C1. After the warm-up, the server temporarily freezes all client-side underlying models to prevent changes in the representation space during initialization. Each client performs forward computation, fixed-point encoding, and encryption once on the full training sample set D. The server uses R determined in step A to generate low-dimensional projected ciphertexts in batches from these homologous ciphertexts. After batch decryption using a whitelist, the ciphertexts are divided by the intermediate representation scaling factor to recover the summary.

[0123] C2. The server compiles low-dimensional projected summaries of all training samples based on client j and the true class c. It independently takes the median of each vector coordinate to obtain the initial projected prototype for that client and class. If the number of samples for a given class is insufficient, the semantic score for that class is temporarily not used, and no other prototype calculation rules are used to replace it.

[0124]

[0125] In the formula, This represents the initial projection prototype of category c corresponding to client j; This represents the low-dimensional projected summary of sample i corresponding to client j.

[0126] C3. For each target client j, the server concatenates the summaries of the remaining clients according to the pre-registered client order as the predictor input, which is then fed into the lightweight predictor to obtain the predicted summary for the target client. The same concatenation order is used during initialization, online detection, and subsequent updates.

[0127]

[0128] In the formula, This represents the predicted summary of sample i corresponding to client j; This represents the cross-client predictor for client j; This represents the low-dimensional projection summary of sample i from other clients, assembled in a preset fixed order. This represents the cross-client predictor parameters for client j.

[0129] C4. The server trains the corresponding predictor using the mean squared prediction error and the L2 regularization term of the parameters on the full training samples, and calculates the mean, variance, and standard deviation of the outlier scores for each client; the standard deviation is not less than the positive stability constant. After saving the prototype, predictor parameters, and statistics, the server unfreezes the underlying model.

[0130]

[0131] In the formula, This represents the initial cross-client predictor parameters for client j; This represents the mean squared prediction error of the cross-client predictor of client j on the full training samples. Denotes the non-negative 2-norm regularization coefficient. express The L2 norm.

[0132] Step D: Formal training of ciphertext projection:

[0133] D1. In each formal training batch, the client computes intermediate representations using the current underlying model, continuing to use the d-dimensional output from the warm-up phase, intermediate representation scaling factor, nearest integer rounding, and coordinate-by-coordinate Paillier encryption. The detection branch does not require the client to submit separate summaries or plaintext statistics, ensuring that the detected objects and the actual aggregated objects originate from the same encrypted text.

[0134] D2. The server reads a fixed sparse integer matrix R line by line, and performs integer scalar multiplication and homomorphic summation on the client's intermediate representation of the ciphertext. When a matrix element is zero, the corresponding ciphertext coordinates are skipped; when an element is a positive integer, scalar multiplication is performed directly; when an element is a negative integer, symbolic processing is performed using the ciphertext inverse to obtain the k-dimensional projected ciphertext.

[0135]

[0136] In the formula, This represents the k-dimensional low-dimensional projection summary of sample i corresponding to client j; This represents the projected ciphertext obtained by performing integer scalar multiplication and homomorphic summation on the ciphertext vector using each row of R.

[0137] D3. The server organizes the low-dimensional projected ciphertext of all samples and all clients in the current batch into a |B|×m×k matrix and submits a whitelist request. KGC verifies the task, stage, type, number of times, and dimension before batch decrypting, and the server restores the floating-point digest using the intermediate scaling factor. R is fixed within the task, so the initial prototype, online digest, and subsequent candidate updates are all in a common coordinate system.

[0138] Step E: Dual-signal anomaly detection:

[0139] E1. Perform L2 normalization on the current abstract and the projected prototypes of each category for the same client, using a positive stability constant ε. n The zero norm is handled; the category prototype is initialized to the initial projected prototype obtained in step C2, and the latest value updated in step I is used thereafter. The squared distance between the summary and the prototype is calculated, and the category soft-match probability is formed based on the negative distance and positive temperature parameters.

[0140]

[0141]

[0142] In the formula, This represents the soft matching probability that sample i corresponding to client j belongs to category c; This represents the squared distance between the summary and the client's j-class projected prototype; Indicates a positive temperature parameter; This indicates the total number of categories.

[0143] E2. The server reads the true labels of the samples and records the negative logarithm of the corresponding soft-match probability as the semantic anomaly score. This score increases as the current summary deviates from the true category projection structure and is standardized by the semantic score statistics saved in step C and updated with limitations in step I.

[0144] E3. The server sends the current summaries from other clients to the corresponding predictors in a fixed order to obtain the predicted summaries for the target client; the average square of the coordinate differences between the two is recorded as the consistency anomaly score. This score increases as the normal statistical dependence between cross-client feature views is disrupted.

[0145]

[0146] In the formula, This represents the semantic anomaly score of sample i corresponding to client j; This represents the cross-client consistency anomaly score for sample i corresponding to client j; This represents the positive stability constant to prevent logarithmic overflow; This represents the prediction value of the summary by the cross-client predictor.

[0147] E4. The server standardizes the scores using the mean and standard deviation of both classes, and then sums them using two non-negative fusion coefficients to form a composite outlier score. The sum of the two coefficients is 1, ensuring that the stability processing does not alter the monotonic relationship between risk and target weights.

[0148]

[0149] In the formula, This represents the overall anomaly score of sample i corresponding to client j; This represents the mean of the semantic anomaly scores for client j. The standard deviation of the semantic anomaly score for client j; This represents the mean of the consistency anomaly scores for client j. The standard deviation of the consistency anomaly score for client j; The non-negative fusion coefficient represents the semantic anomaly score; The non-negative fusion coefficient represents the consistency anomaly score; This represents the positive stability constant to prevent the denominator from being zero.

[0150] Step F: Batch Risk and Weight Generation

[0151] F1. This implementation uses client-level batch weighting. After the server obtains the complete low-dimensional summary of the current batch B, it sequentially performs two types of outlier scores, standardization, and fusion. The average of the comprehensive outlier scores of all samples from client j is then calculated to obtain the batch risk for that client.

[0152]

[0153] F2. The server performs negative exponential normalization mapping on all client batch risks with a positive risk sensitivity τ, and directly prunes the mapping results with a preset weight cap to maintain the relationship that the higher the risk, the lower the weight.

[0154]

[0155] In the formula, This represents the pre-quantization target aggregate weight of client j in the current batch B; This indicates the batch risk of client j in the current batch B; Indicates positive risk sensitivity; This indicates the preset weight limit.

[0156] F3. After upper limit pruning, no positive weight lower limit is set, and no renormalization is performed. Therefore, the target weight of high-risk clients can be zero or close to zero, and the sum of all target weights is no greater than 1. The overall risk of the current batch can continue to be passed to the top-level model through the decay of the final aggregate embedding amplitude.

[0157] F4. The server applies the target weights from the same client to all samples in that batch and freezes the risk mapping results before encrypted aggregation. The server does not disclose anomaly scores, batch risks, pruning status, or actual target weights to the client.

[0158] Step G: Secure weighted aggregation of ciphertexts:

[0159] G1. The server rounds the product of the target weight and the weight scaling factor according to the nearest integer rule to obtain a non-negative integer weight; then it divides this non-negative integer weight by the weight scaling factor to obtain the corresponding effective weight. Integer weights are used for Paillier ciphertext scalar multiplication, while effective weights are used to explain floating-point contributions and backpropagation gradients. Both are uniquely associated with the same quantization and are cached with the current batch.

[0160]

[0161] In the formula, This represents the non-negative integer weight of client j in the current batch B; Indicates the weight scaling factor; Indicates by The effective weight of client j is uniquely determined.

[0162] G2. For each representation coordinate of the sample, the server multiplies the original intermediate representation ciphertext by the integer weights corresponding to the client, and then performs homomorphic addition on the m results to generate the final aggregated ciphertext. This operation directly applies to the original ciphertext actually uploaded by the client and used for projection in step D, without replacing the top-level model input with a low-dimensional summary.

[0163] G3. The server organizes all final aggregated ciphertexts of the current batch into a |B|×d matrix and submits a whitelist request. KGC verifies the stage, type, number of times, and dimension, then returns an aggregated integer vector; the server divides this vector by the product of the two scaling factors to obtain the final aggregated embedding and inputs it into the top-level model.

[0164]

[0165] In the formula, This represents the final multi-client aggregated ciphertext of sample i; This represents the non-negative integer weight of client j in the current batch B; This represents the ciphertext of the intermediate representation of sample i corresponding to client j; This represents the final aggregated embedding of sample i; The middle element indicates the scaling factor; This represents the weight scaling factor.

[0166] G4. The quantization error caused by rounding shall not exceed half a weight quantization unit; subsequent steps in the same batch shall only read the cached integer weights and valid weights, and shall not remap, prune or quantize.

[0167] Step H stops gradient training:

[0168] H1. The server will ultimately aggregate and embed the data into the top-level classification model, and calculate the batch task loss based on the true labels.

[0169]

[0170] In the formula, This indicates the average task loss for the current batch; Indicates the current batch; This represents the true label of sample i.

[0171] H2. The server first calculates the common top-level gradient of the task loss relative to the final aggregated embedding, then reads the effective weights cached in step G, scales them using these weights, and sends them to the corresponding client. Forward aggregation and backward scaling therefore use the same effective weights.

[0172]

[0173] In the formula, Indicates task loss Final aggregation embedding of sample i The public top-level gradient; This represents the intermediate gradient of sample i corresponding to j returned to the client; This represents the effective weight of client j in the current batch B.

[0174] H3. The effective weights are used as stopping gradient constants in the current batch. The computation graph of the task loss is truncated before outlier score, standardized statistics, cross-client predictor, batch risk, negative exponential mapping, upper bound pruning, and integer rounding; the detector only allows independent, restricted updates from step I.

[0175] H4. The server updates the top-level model based on the task loss, and the client updates its local parameters by chaining derivatives through the local underlying model after receiving the scaling gradient.

[0176] Step I: High-Reliability Update and Iteration

[0177] I1. The server selects candidate samples based on the experience risk of the full training samples during the initialization phase, and then selects a preset proportion of samples from low to high risk to form a high-confidence set; when the number of samples is insufficient, the original detection benchmark is retained.

[0178] I2. When the number of samples in the high-confidence set and the corresponding category reaches the requirement, the server uses the median of the summary of that category as the candidate prototype and updates it according to the exponential sliding rule; otherwise, the old value of the prototype is used.

[0179] I3. The server estimates the candidate mean and variance of the two types of outlier scores on a high-confidence set and updates the corresponding statistics according to the same exponential sliding rule.

[0180] I4. When the preset update cycle is reached and the number of samples meets the requirements, the server updates the predictor according to the target of step C4 and restricts its single parameter change; if the conditions are not met, the old parameters are retained, and then steps D to I are repeated.

Claims

1. A privacy-preserving and poisoning-robust aggregation method for longitudinal federated learning based on ciphertext low-dimensional projection, characterized in that, A longitudinal federated learning system is applied, comprising a server S that honestly adheres to the protocol, a key generation and decryption entity KGC, and m clients; the server holds sample labels and a top-level model, and each client holds different local features of the same batch of samples and outputs intermediate representations of the same dimension. The method includes the following steps: Step A. System Initialization: KGC generates Paillier homomorphic encryption key pairs and publishes the public key; the server honestly adheres to the protocol, generates a fixed, client-secret sparse integer projection matrix R within the task, and determines the protocol parameters; KGC only accepts two types of decryption requests: batch low-dimensional projection ciphertext and final multi-client aggregated ciphertext from the protocol whitelist, verifies the request stage, the maximum number of attempts, and the dimension of the ciphertext matrix, and rejects decryption requests that do not conform to the agreement; Step B. Clean Warm-up: In the pre-warm-up rounds assuming no attacks, each client calculates the floating-point intermediate representation, encodes the intermediate representation using fixed-point encoding, and encrypts it coordinate by coordinate; the server encodes the same average target weights into integers and then performs scalar multiplication and homomorphic addition on the ciphertext; KGC decrypts the final multi-client aggregated ciphertext after the number of operations and dimension verification passes; the server restores the pre-warmed aggregated embedding and uses the effective average weights determined by the same integer weights in both forward training and backward gradient backpropagation; Step C. Detector Initialization: After the warm-up, the client's underlying model is temporarily frozen. Each client performs a forward computation on all training samples and uploads the intermediate representation ciphertext according to the encoding and encryption method in Step B. The server calculates the fixed low-dimensional projection from the same source ciphertext and requests decryption in batches according to the whitelist. It uses the low-dimensional summary and coordinate median of each client and category to establish the projection prototype, trains the cross-client predictor, and initializes the mean, variance, and standard deviation of the semantic anomaly score and the consistency anomaly score. Step D. Formal Training of Ciphertext Projection: After unfreezing the underlying model, the client generates intermediate representation ciphertext for the current batch according to step B; the server uses a fixed matrix R to perform integer scalar multiplication and homomorphic summation on the ciphertexts of the same batch actually trained by each client, obtaining the batch low-dimensional projection ciphertext of |B|×m×k; after KGC verifies the request stage, number, and dimension, the batch is decrypted, and the server divides by the intermediate representation scaling factor. To recover the low-dimensional projected summary in the common coordinate system; Step E. Dual-signal anomaly detection: The server calculates the semantic anomaly score of the current low-dimensional projected summary relative to the client-by-client, category-by-category prototype based on the real label, and calculates the consistency anomaly score based on the cross-client predictor output; the two scores are standardized using the statistics established in step C and updated by the constraints in step I, and a sample-level comprehensive anomaly score is formed with a non-negative fusion coefficient that sums to 1, which characterizes anomalies from two aspects: deviation from category structure and violation of cross-feature view dependency. Step F. Batch Risk and Weight Generation: The server averages the comprehensive anomaly scores of the same client in the current batch to obtain the batch risk. Initial weights are generated using negative exponential normalization mapping controlled by risk sensitivity, and upper limit pruning is directly performed to obtain the target aggregate weight before quantization. After pruning, no positive weight lower limit is set and no renormalization is performed, so that all samples of the same client in the batch share the same target weight, and the overall risk continues to be reflected through the weight sum and aggregate embedding amplitude. Step G. Secure weighted aggregation: The server encodes the target aggregation weights before quantization into non-negative integer weights according to the weight scaling factor, and performs scalar multiplication and homomorphic addition on the original intermediate representation ciphertexts of each client with integer weights to obtain the final multi-client aggregated ciphertext; the effective weights obtained by dividing the integer weights by the weight scaling factor are used as the immutable state of the current batch; after KGC passes the verification of the upper limit of a single request and the |B|×d dimension, it decrypts the final aggregated ciphertext, and the server restores the final aggregated embedding by the product of the two types of scaling factors; Step H. Stop gradient training: The server inputs the final aggregated embedding into the top-level model and calculates the batch task loss. The effective weights cached in step G are used as batch constants that do not differentiate from the task loss. The common top-level gradient is the gradient of the task loss with respect to the final aggregated embedding. The intermediate representation returned to the client is equal to the product of the common gradient and the corresponding effective weights. The task loss must not be backpropagated through outlier scores, statistics, predictors, risk mapping, weight pruning, and quantization processes. Step I. High-Confidence Update and Iteration: The server takes the maximum value of the comprehensive anomaly score of all clients for each sample, selects candidate samples based on the risk experience distribution of the full training samples in the initialization phase, and selects the preset proportion with the lowest risk from the candidate samples to form a high-confidence set; only when the update cycle is reached and the number of samples meets the requirements, the prototype, anomaly score statistics and cross-client predictor are updated with high-confidence samples in a limited manner, and then steps D to I are repeated.

2. The method as described in claim 1, characterized in that, Step A includes the following steps: A1. Construct a vertical federated learning system consisting of a server S, a KGC, and m clients; the server holds sample labels and a top-level model, and each client holds different local features of the same batch of samples and outputs intermediate representations of the same dimension; A2. KGC generates Paillier key pairs, publishes the public key, and trusts and stores the private key; each party uses only ciphertext addition and plaintext integer scalar multiplication to complete subsequent ciphertext linear operations; In the formula, This indicates a cryptographic operation performed using the Paillier public key; This represents the Paillier public key; This represents the first integer plaintext; This represents the plaintext of the second integer; Represents integer scalars; A3. The server generates a sparse integer projection matrix R whose elements are taken from {-1,0,1} and whose projection dimension is smaller than that representing the dimension. R is fixed within this training task and kept secret from the client. Determine two types of scaling factors, warm-up rounds, risk parameters, and update cycles. A4. The server honestly adheres to the protocol; each initialization batch or formal training batch may submit at most one |B|×m×k batch low-dimensional projection decryption request, and each warm-up batch or formal training batch may submit at most one |B|×d final aggregation decryption request. KGC verifies requests by type, stage, number of requests, and dimension, where B represents the current batch sample index set, |B| represents the current batch sample number, m represents the number of clients, k represents the low-dimensional projection dimension, and d represents the intermediate representation dimension.

3. The method as described in claim 1, characterized in that, Step B includes the following steps: B1. Set the first few rounds as a clean warm-up phase, do not perform low-dimensional projection, anomaly detection and detection benchmark update, and maintain the fixed order of the coordinates of each client, sample and ciphertext; B2. The client calculates the d-dimensional floating-point intermediate representation, completes the fixed-point encoding with a preset intermediate representation scaling factor, and then encrypts it coordinate by coordinate using the public key, and uploads the ciphertext vector bound to the sample index; In the formula, This represents the ciphertext of the intermediate representation of sample i corresponding to client j; This represents the intermediate floating-point representation of sample i corresponding to client j; The middle element indicates the scaling factor; B3. The server encodes the uniform average target weight into the same non-negative integer according to the weight scaling factor, and performs homomorphic scalar multiplication and coordinate-by-coordinate addition on all client ciphertexts with the integer weight to form the final preheated aggregated ciphertext |B|×d. B4. KGC only returns the final aggregated integer vector after the request count and matrix dimension verification are passed; the server restores the preheated aggregated embedding by the product of the two scaling factors and references the same effective average weight in the forward fusion and backward gradient.

4. The method as described in claim 1, characterized in that, Step C includes the following steps: C1. Temporarily freeze the client's underlying model, and each client performs a forward pass, encoding, and encryption on all training samples; the server generates low-dimensional projected ciphertext in batches from the uploaded intermediate representation ciphertext using a fixed matrix R and requests KGC to decrypt it; C2. The server compiles low-dimensional projective summaries of all training samples according to client and real category, and forms the initial projective prototype using the median of each coordinate: In the formula, This represents the initial projection prototype of category c corresponding to client j; This represents a low-dimensional projected summary of sample i corresponding to client j; C3. For target client j, concatenate the low-dimensional summaries of other clients in a fixed order as input, and build a cross-client predictor with the target client's summary as the supervision target: In the formula, This represents the predicted summary of sample i corresponding to client j; This represents the cross-client predictor for client j; This represents the low-dimensional projection summary of sample i from other clients, assembled in a preset fixed order. This represents the cross-client predictor parameters for client j; C4. The server trains the initial predictor with the sum of the mean squared prediction error and the L2 norm regularization term, and estimates the mean, variance, and standard deviation (not less than the stability constant) of the two outlier scores using the full training sample. Then, the underlying model is unfrozen. In the formula, This represents the initial cross-client predictor parameters for client j; This represents the mean squared prediction error of the cross-client predictor of client j on the full training samples. Denotes the non-negative 2-norm regularization coefficient. express The L2 norm.

5. The method as described in claim 1, characterized in that, Step D includes the following sub-steps: D1. In the formal training batch, the client uploads the intermediate representation ciphertext according to the same representation dimension, scaling and encryption rules as in step B, without generating a separate detection-specific representation; D2. The server uses the fixed matrix R from step A to perform an integer linear projection on each intermediate representation ciphertext, forming low-dimensional projected ciphertexts that are homologous to the training input in batches. In the formula, This represents the k-dimensional low-dimensional projection summary of sample i corresponding to client j; This represents the projected ciphertext obtained by performing integer scalar multiplication and homomorphic summation on the ciphertext vector using each row of R; D3. KGC only accepts requests for low-dimensional projection in the current formal training batch if the number of such requests does not exceed one and the matrix dimension is equal to |B|×m×k. The server will return an integer divided by the intermediate scaling factor to obtain the summary.

6. The method as described in claim 1, characterized in that, Step E includes the following sub-steps: E1. Perform L2 normalization on the current abstract and the projected prototypes of each category for the same client, using a positive stability constant ε. n The zero norm is processed; the category prototype is initialized with the initial projected prototype obtained in step C2, and the latest value after the update in step I is used thereafter. The squared distance between the summary and the prototype is calculated, and the category soft-match probability is formed according to the negative distance and positive temperature parameters. In the formula, This represents the soft matching probability that sample i corresponding to client j belongs to category c; This represents the squared distance between the summary and the client's j-class projected prototype; Indicates a positive temperature parameter; Indicates the total number of categories; E2. Take the negative logarithm of the soft match probability of the true label as the semantic anomaly score, which is used to measure the deviation of the current summary from the true category prototype; E3. The cross-client predictor outputs the target client's predicted summary, and the mean squared error between the current summary and the predicted summary is used as the consistency anomaly score: In the formula, This represents the semantic anomaly score of sample i corresponding to client j; This represents the cross-client consistency anomaly score for sample i corresponding to client j; This represents the positive stability constant to prevent logarithmic overflow; This represents the prediction value of the summary by the cross-client predictor; E4. Standardize using the mean and standard deviation of the two categories of scores respectively, and then sum the results using non-negative fusion coefficients that sum to 1 to obtain the composite outlier score: In the formula, This represents the overall anomaly score of sample i corresponding to client j; This represents the mean of the semantic anomaly scores for client j. The standard deviation of the semantic anomaly score for client j; This represents the mean of the consistency anomaly scores for client j. The standard deviation of the consistency anomaly score for client j; The non-negative fusion coefficient represents the semantic anomaly score; The non-negative fusion coefficient represents the consistency anomaly score; This represents the positive stability constant to prevent the denominator from being zero.

7. The method as described in claim 1, characterized in that, Step F includes the following sub-steps: F1. Calculate the average of the anomaly scores of all samples from client j in the current batch B to form client-level batch risk; F2. Perform negative exponential normalization mapping controlled by τ on the risk of each client batch, and then directly prune it with a preset weight upper limit to obtain the target aggregate weight before quantization. In the formula, This represents the pre-quantization target aggregate weight of client j in the current batch B; This indicates the batch risk of client j in the current batch B; Indicates positive risk sensitivity; This indicates the preset weight limit; F3. After upper limit pruning, no positive weight lower limit is set, and no renormalization is performed; Clients with higher risk may receive a target weight of zero or near zero, and the sum of all target weights shall not exceed 1; F4. All samples from the same client share the same target weight within a batch; After the server completes the anomaly calculation for all samples, it generates and caches the weight status for that batch at once.

8. The method as described in claim 1, characterized in that, Step G includes the following sub-steps: G1. Round the target aggregation weights before quantization to non-negative integer weights using the weight scaling factor, and divide the integer weights by the scaling factor as the unique valid weights for this batch: In the formula, This represents the non-negative integer weight of client j in the current batch B; Indicates the weight scaling factor; Indicates by The uniquely determined effective weight of client j; G2. For each sample, perform homomorphic scalar multiplication on the client's original intermediate representation ciphertext with corresponding integer weights, and then add them homomorphically coordinate by coordinate to form the final aggregated ciphertext; G3. KGC performs batch decryption when the final aggregation request count does not exceed one and the matrix dimension is |B|×d; The server divides the product of the two scaling factors to recover the final aggregate embedding: In the formula, This represents the final multi-client aggregated ciphertext of sample i; This represents the non-negative integer weight of client j in the current batch B; This represents the ciphertext of the intermediate representation of sample i corresponding to client j; This represents the final aggregated embedding of sample i; The middle element indicates the scaling factor; Indicates the weight scaling factor; G4. The quantization error between the target weight and the effective weight shall not exceed half a weight quantization unit; the server caches the integer weights and effective weights, and does not remap, prune or quantize them subsequently.

9. The method as described in claim 1, characterized in that, Step H includes the following sub-steps: H1. Embed the final aggregate into the top-level model of the input server, and calculate the batch task loss based on the true label and the single-sample classification loss: In the formula, This indicates the average task loss for the current batch; Indicates the current batch; This represents the true label of sample i; H2. Calculate the common top-level gradient of the task loss with respect to the final aggregated embedding, and scale it to the intermediate representation gradient of each client using the same effective weights cached in step G; In the formula, Indicates task loss Final aggregation embedding of sample i The public top-level gradient; This represents the intermediate gradient of sample i corresponding to j returned to the client; This represents the effective weight of client j in the current batch B; H3. Treat the effective weights as constants for the current batch and stop task loss through anomaly detection, risk mapping, pruning, quantization, and backpropagation of three types of detection benchmarks; H4. The server updates the top-level model with the task loss and returns the scaled gradient to the corresponding client; the client updates its local parameters by chaining derivatives from the underlying model.

10. The method as described in claim 1, characterized in that, Step I includes the following sub-steps: I1. Take the maximum value of the cross-client comprehensive anomaly score of each sample, screen candidate samples based on the experience risk of the full training samples in the initialization phase, and select the preset proportion with the lowest risk to form a highly reliable set. I2. When the number of samples in the high-confidence set and the corresponding category reaches the threshold, use the median of the current category summary by each coordinate as the candidate prototype and perform exponential sliding update; I3. Estimate the candidate mean and variance of semantic anomaly scores and consistency anomaly scores on a high-confidence set, and apply the same exponential sliding rule to the two types of statistics; I4. When the update cycle is reached, candidate predictor parameters are obtained on the high-confidence set according to the independent objective in step C4, and the single change magnitude of the parameters relative to the current parameters is pruned; if the condition is not met, the old state is retained.

Images