Federal learning privacy protection method combining mode component homomorphic encryption and differential privacy

Abstract

This invention discloses a privacy protection method for federated learning that combines modular component homomorphic encryption and differential privacy. The method includes: a server initializing a global model and selecting clients to participate in training; clients training locally and calculating local Fisher information matrices based on backpropagation gradients; the server aggregating the global Fisher evaluation matrix, selecting the top k% of sensitive core parameters, and generating a Boolean encryption mask; clients performing modular component homomorphic encryption on the core parameters according to the mask, and injecting differential privacy noise into non-core parameters; the server performing weighted aggregation on the core ciphertext and non-core noisy plaintext respectively; and clients decrypting locally and reconstructing a new round of global model. This invention achieves a balance between model privacy protection and training efficiency, solving the problems of high computational overhead, heavy communication burden, and decreased model availability in existing federated learning methods with full encryption.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a federated learning privacy protection method that combines modular component homomorphic encryption and differential privacy. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, allows multiple parties to collaboratively train a model without sharing the original data, effectively solving the data silos and privacy leaks problems of traditional centralized learning. The client downloads the global model, trains and updates parameters on local data, uploads the parameters to the server, and the server aggregates, updates the global model, and then distributes it. Currently, federated learning has shown broad application prospects in privacy-sensitive fields such as healthcare, finance, and smart cities.

[0003] However, federated learning still faces serious privacy and security challenges in practical deployments. Attackers can analyze the plaintext model parameters uploaded by the client to infer the user's local private data. Homomorphic encryption, as a strong privacy protection technology, allows computation to be performed directly in ciphertext, fundamentally eliminating the risk of parameter leakage. In recent years, researchers have introduced homomorphic encryption into the federated learning framework. The client encrypts the model parameters before uploading, and the server completes the aggregation in the ciphertext domain, without accessing the plaintext parameters throughout the process, achieving strong privacy protection in theory. However, existing federated learning schemes based on homomorphic encryption face a common efficiency bottleneck: indiscriminate encryption of all parameters. Existing schemes typically require performing homomorphic encryption on each parameter of the entire neural network model. The ciphertext aggregation operation on the server side also faces enormous pressure, as the overhead of ciphertext multiplication and addition operations is much higher than that of plaintext operations. This full-parameter encryption mode leads to a sharp increase in training time, severely restricting the large-scale application of federated learning on mobile phones, IoT terminals, etc. This efficiency bottleneck is particularly prominent when dealing with high-dimensional deep models or a large number of participants. Different parameters in a neural network contribute significantly differently to model performance. Some core parameters (such as heavily weighted connections) play a decisive role in model accuracy, while the leakage of a large number of non-core parameters (such as near-zero weights) poses less of a privacy threat and has a relatively limited impact on model performance. However, existing solutions fail to leverage this characteristic to achieve fine-grained protection by applying equal strength of encryption to all parameters, resulting in a significant waste of computational resources on non-critical parameters and failing to achieve the optimal balance between security and efficiency.

[0004] Furthermore, at the numerical implementation level, existing modular component homomorphic encryption schemes mostly use fixed-point numbers to approximate floating-point model parameters. To adapt to the integer operation requirements of homomorphic encryption libraries, floating-point numbers need to be scaled and rounded. If a fixed scaling factor is used, it is difficult to adapt to the differences in the dynamic range of parameters of different neural network layers—too small a scaling factor will result in a loss of precision, while too large a scaling factor can easily lead to integer overflow, causing training interruptions. How to achieve stable numerical conversion while ensuring accuracy is a technical challenge that must be solved for the implementation of encrypted federated learning projects. In summary, existing federated learning schemes based on homomorphic encryption have three major technical bottlenecks: full-parameter encryption leads to low computational efficiency and resource waste; and the lack of dynamic adaptation of numerical scaling leads to insufficient stability.

[0005] How to achieve selective encryption by identifying core parameters while ensuring model accuracy and strong privacy protection, and how to combine this with a dynamic scaling mechanism to ensure numerical stability, thereby significantly improving the training efficiency of encrypted federated learning, is a key technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] The main objective of this invention is to provide a privacy protection method for federated learning that combines modular component homomorphic encryption and differential privacy.

[0007] To achieve the above objectives, embodiments of the present invention propose a federated learning privacy protection method combining modular component homomorphic encryption and differential privacy, comprising:

[0008] S1. The server initializes the federated learning system, configures the federated training parameters, core parameter ratio k%, differential privacy parameters, modular component homomorphic encryption parameters, and global model parameters, and builds the initial global model. S2. The server selects a subset of clients participating in the current training round from multiple clients and sends the current global model to the client subset; S3. Each client performs local training based on its local private dataset, extracts the gradient of the model parameters during backpropagation, and calculates the local Fisher information matrix based on the gradient of the model parameters. S4. Each client generates the key parameters required for modular component homomorphic encryption locally, including the set of coprime modular bases, amplification, scaling factor, and position template; S5. The server receives the local Fisher information matrix uploaded by each client and aggregates the local Fisher information matrix to obtain the global Fisher evaluation matrix. S6. The server selects the top k% of sensitive parameters based on the global Fisher evaluation matrix, generates a Boolean encryption mask matrix to distinguish between core parameters and non-core parameters, and sends the Boolean encryption mask matrix to each client. S7. Each client performs modular component homomorphic encryption on the core parameters and differential privacy noise injection on the non-core parameters according to the Boolean encryption mask matrix, and uploads the ciphertext of the core parameters and the noisy plaintext of the non-core parameters to the server. S8. The server performs weighted aggregation on the core parameter ciphertext and the non-core parameter noisy plaintext to obtain a hybrid global model. S9. The client receives the hybrid global model, uses the locally stored private key to decrypt and recover the core parameter ciphertext aggregation result, and combines it with the non-core parameter aggregation result to form a new round of global model. S10. Repeat steps S2 to S9 until the model meets the preset convergence conditions.

[0009] In one embodiment of the present invention, step S3 includes: Each client receives the current global model from the server and loads the current global model into its local neural network model; Each client performs forward propagation, loss calculation, and back propagation based on its local private dataset, and updates the local model parameters according to the preset number of local training rounds; During each backpropagation process, the client extracts the true gradient of the loss function with respect to each model parameter and performs element-wise squared accumulation on the true gradient; After local training is completed, the client divides the cumulative squared gradient value corresponding to each model parameter by the total number of local training steps to obtain a local Fisher information matrix that is consistent with the local model parameter structure. Among them, model parameters Fisher's evaluation value is expressed as:

[0010] in, Represents model parameters Fisher's evaluation value This indicates the total number of local training steps on the client side. This represents the loss function with respect to the model parameters at training step t. The true gradient.

[0011] In one embodiment of the present invention, step S4 includes: The client selects n pairwise coprime large integers locally and constructs a coprime modular basis set B. The client sets the magnification factor 'a' to increase the interval between integer encoded numerical values; The client-side settings are used to map floating-point model parameters to integer encoded values ​​using a scaling factor Δ. The client generates a position template S based on the master key U set by the user. The position template S is used to determine the insertion position of the real modulus projection value in the confuse ciphertext matrix. Among them, the coprime modulus set B, the magnification a, and the scaling factor Δ are the parameters required for the homomorphic calculation of the modulus components, and the position template S is stored locally on the client as a private key parameter and is not uploaded to the server.

[0012] In one embodiment of the present invention, step S5 includes: The server receives the local Fisher information matrix uploaded by each client in the current training round; The server aligns the local Fisher tensors of each client at the corresponding level according to the hierarchical structure of the neural network model. The server performs element-wise accumulation or weighted accumulation on the local Fisher evaluation values ​​at the same model parameter location to obtain the global Fisher evaluation value at the corresponding location. The server combines the global Fisher evaluation values ​​corresponding to the positions of each model parameter to form a global Fisher evaluation matrix that is consistent with the structure of the global model parameters.

[0013] In one embodiment of the present invention, step S6 includes: The server determines the number of core parameters that need to be protected by modular component homomorphic encryption based on a preset core parameter ratio k%. The server flattens the global Fisher evaluation matrix into a one-dimensional Fisher evaluation vector and determines the Fisher segmentation threshold based on the number of core parameters. The server iterates through the global model parameter positions, marks the positions of parameters whose Fisher evaluation values ​​are greater than or equal to the Fisher segmentation threshold as logic 1, and determines them as core parameters. The server marks the positions of parameters whose Fisher evaluation values ​​are less than the Fisher segmentation threshold as logic 0 and determines them to be non-core parameters; The server generates a Boolean-type encryption mask matrix that is consistent with the structure of the global model parameters based on the marking results of logic 1 and logic 0.

[0014] In one embodiment of the present invention, step S7, performing differential privacy noise injection processing on non-core parameters, includes: The client reads the positions of parameters marked with logic 0 in the Boolean encryption mask matrix; The client extracts the plaintext values ​​of non-core parameters corresponding to the parameter positions; The client generates Gaussian noise with a mean of 0 based on preset differential privacy budget parameters and noise scale; The client adds the Gaussian noise to the plaintext value of the non-core parameter to obtain the noisy plaintext of the non-core parameter.

[0015] In one embodiment of the present invention, step S7, performing modular component homomorphic encryption processing on the core parameters, includes: The client reads the parameter positions marked as logic 1 in the Boolean encryption mask matrix and extracts the core parameter P corresponding to the parameter positions; The client dynamically adjusts the scaling factor Δ based on the numerical distribution of the core parameters of the current layer; The client multiplies the core parameter P by the scaling factor Δ and rounds it to the nearest integer, then multiplies it by the amplification factor a and adds a random perturbation η to obtain the encoded integer. ; The client uses the coprime modular basis bi in the coprime modular basis set B to encode the integer. Perform the modulus operation separately to obtain the true modulus projection value. ; The client generates a set of obfuscated and redundant projections r, and projects the true model values ​​according to the location template S. Embedded into the obfuscated redundant projection set, a core parameter ciphertext matrix e is generated; in:

[0016]

[0017] Where P represents the core parameter, Δ represents the scaling factor, a represents the magnification, and η represents the random perturbation. Let i represent the i-th coprime modulus.

[0018] In one embodiment of the present invention, the client dynamically adjusts the scaling factor Δ according to the numerical distribution of the current layer core parameters, including: The client calculates the maximum absolute value of the core parameters of the current layer. ; The client obtains the number N of clients participating in the aggregation of the current training round; The client uses the upper limit threshold for secure integers. Scale factor lower limit and the upper limit of the scaling factor Calculate the adaptive scaling factor Δ; in:

[0019] in, This represents the upper limit threshold for safe integers to prevent integer encoding overflow.

[0020] In one embodiment of the present invention, step S8 includes: The server receives mixed data packets uploaded by each client, the mixed data packets including a core parameter ciphertext matrix and noisy plaintext non-core parameters; The server divides the mixed data packet into a ciphertext processing channel and a plaintext processing channel based on the Boolean encryption mask matrix. In the encrypted processing channel, the server determines the aggregation weight based on the number of local samples of each client and converts the floating-point aggregation weight into an integer weight. The server uses the integer weights to perform modular space weighting on the core parameter ciphertext matrix uploaded by each client, and performs modular aggregation on the weighted core parameter ciphertext matrix to obtain the core parameter ciphertext aggregation result. In the plaintext processing channel, the server performs weighted average aggregation on the noisy plaintext with non-core parameters uploaded by each client according to the aggregation weight, and obtains the aggregation result of non-core parameters. The server combines the core parameter ciphertext aggregation result with the non-core parameter aggregation result to obtain a hybrid global model.

[0021] In one embodiment of the present invention, step S9 includes: Based on the Boolean encryption mask matrix, the client separates the core parameter ciphertext aggregation result and the non-core parameter aggregation result from the hybrid global model; The client uses the location template S in the locally stored private key to locate and extract the real modulus projection value from the obfuscated ciphertext matrix of the core parameter ciphertext aggregation result. Based on the true model projection value, the client reconstructs the aggregate integer using the Chinese Remainder Theorem. ; The client removes the effects of the scaling factor and magnification, and aggregates the integer. Restore to the floating-point values ​​of the core parameters; The client fills the floating-point values ​​of the core parameters back into the model parameter positions corresponding to logic 1 in the Boolean encryption mask matrix, and fills the aggregation results of the non-core parameters back into the model parameter positions corresponding to logic 0 in the Boolean encryption mask matrix, forming a new round of global model.

[0022] The embodiments of this invention have the following beneficial effects: 1. Significantly improve training efficiency: This invention identifies the most important k% core parameters of the entire network through Fisher information, performs homomorphic encryption only on these parameters, and uses lightweight Gaussian noise for protection of the remaining parameters. The client encryption time and server aggregation time are greatly shortened, resulting in an order-of-magnitude improvement in the training speed of encrypted federated learning. 2. Achieve the best balance between accuracy and security: This invention adopts a hybrid defense strategy of "strong encryption of important parameters and weak noise addition for secondary parameters". Core parameters are strongly protected by modular component homomorphic encryption, and the server completes aggregation in ciphertext state, unable to access plaintext parameters throughout the process; Gaussian noise is added to non-core parameters for perturbation protection. Full parameter protection is achieved while ensuring the overall model accuracy, solving the contradiction in traditional solutions where "security comes at the cost of efficiency, and efficiency comes at the cost of accuracy". 3. Ensure numerical stability during training: This invention introduces adaptive dynamic scaling, dynamically calculating the optimal scaling factor based on the actual maximum absolute value of each layer's parameters before aggregation, ensuring that integer overflow does not occur during the accumulation process. This mechanism completely eliminates the training interruption problem caused by integer overflow, while maximizing the use of integer precision without overflow, ensuring the robustness and reliability of the training process. 4. Providing theoretical-level privacy and security: The modular component homomorphic encryption algorithm used in this invention decomposes the integer into multiple modular projections and introduces random obfuscation redundancy. Only the client holding the private key knows the position of the actual modular projection in the ciphertext matrix. Even if the server obtains all the ciphertext, it cannot reconstruct the original parameters. Attached Figure Description

[0023] The above-described and additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, in which: Figure 1 This is a flowchart illustrating a federated learning privacy protection method that combines modular component homomorphic encryption and differential privacy, as provided in an embodiment of the present invention. Detailed Implementation

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] In detail, the disadvantages of existing technology are as follows: 1. Full-parameter encryption leads to low computational efficiency: Some existing federated learning schemes based on homomorphic encryption perform full homomorphic encryption on all parameters of the client's local model during each training round before uploading the ciphertext to the server for aggregation. The computational complexity of homomorphic encryption is far higher than that of plaintext operations. This indiscriminate approach, without any screening of encrypted objects, places a huge burden on the server-side ciphertext aggregation. Furthermore, the escalating volume of ciphertext data leads to a surge in communication overhead, further exacerbating system unavailability.

[0027] 2. Coarse-grained encryption leads to resource waste: Existing solutions apply the same level of encryption protection to all model parameters, failing to differentiate the varying importance of parameters in terms of model performance and privacy sensitivity. The knowledge of neural networks is primarily stored in connections with large weights, while a large number of near-zero weights contribute negligibly to the model output. From an information theory perspective, removing or perturbing these near-zero weights has minimal impact on model accuracy; from a privacy perspective, the amount of user information contained in these near-zero weights is also extremely limited. However, existing solutions fail to leverage this characteristic by applying encryption to all parameters in a uniform manner.

[0028] 3. Insufficient stability due to lack of dynamic adaptation in numerical scaling: Existing solutions often use a fixed scaling factor to convert floating-point parameters to integers to adapt to homomorphic encryption libraries. The dynamic range of parameters varies greatly among different neural network layers, and fixed scaling makes it difficult to balance accuracy and overflow risk—too small a scaling factor results in loss of accuracy, while too large a scaling factor can easily lead to integer overflow, causing training to be interrupted.

[0029] The technical problem to be solved by this invention: 1. Full-parameter encryption leads to low computational efficiency: Different parameters in a neural network contribute significantly to model performance. In each round, the squared gradients generated in each batch are collected and averaged at the end of the round. The Fisher information value is used as a measure of the parameter's sensitivity to local data. The importance of a parameter can be quantified by the amount of Fisher information. Fisher information measures the sensitivity of a parameter to changes in the loss function. The more sensitive the parameter, the greater its impact on the model output, and the higher the privacy risk from its leakage. Conversely, perturbations of a large number of low-sensitivity parameters have a negligible impact on model performance. The server collects the Fisher tensors from all participating clients and accumulates them element-wise to obtain comprehensive Fisher information reflecting the distribution of data across the entire network. The encryption computation is reduced from full-parameter encryption to encryption of only core parameters. Non-core parameters only require a single Gaussian noise addition operation, the computational cost of which is negligible. Furthermore, the amount of ciphertext data is reduced from full-parameter ciphertext to ciphertext generated only from core parameters.

[0030] 2. Solving the numerical stability problem: Introducing an adaptive dynamic scaling technique, the optimal scaling factor is dynamically calculated based on the actual maximum absolute value of the parameters in each layer before aggregation, completely avoiding integer overflow, while maximizing the use of fixed-point precision.

[0031] 3. Coarse-grained protection leads to resource waste: Applying strong protection to high-value core parameters and weak protection to low-value non-core parameters can achieve optimal resource allocation without compromising overall security. For core parameter protection, a modular component homomorphic encryption algorithm is used to decompose the parameter into N modular projections, introducing M-1 random confounding redundancies to generate an N×M ciphertext matrix. This scheme provides theoretically strong privacy protection; the server completes aggregation in the ciphertext domain and cannot access the plaintext parameters throughout the process. For non-core parameter protection, a differential privacy mechanism is used to add randomly distributed noise to the parameters. This operation has extremely low computational overhead (requiring only one random number generation and addition operation) and does not change the data type or storage structure of the parameters.

[0032] The following description, with reference to the accompanying drawings, describes a federated learning privacy protection method that combines modular component homomorphic encryption and differential privacy according to an embodiment of the present invention.

[0033] This embodiment provides a privacy protection method for federated learning that combines modular component homomorphic encryption and differential privacy. For example... Figure 1 As shown, the method includes the following steps: S1. The server initializes the federated learning system, configures the federated training parameters, core parameter ratio k%, differential privacy parameters, modular component homomorphic encryption parameters, and global model parameters, and builds the initial global model.

[0034] In step S1, the server first performs the initialization operation of the federated learning system to provide a unified system operating foundation for subsequent client selection, local training, parameter protection, and global aggregation processes. Specifically, when the system starts, the server reads a pre-configured system configuration file, which includes at least federated training parameters, core parameter filtering parameters, differential privacy protection parameters, modular component homomorphic encryption parameters, and global model initialization parameters.

[0035] The federated training parameters include the client participation sampling ratio, the number of local training iterations, the local batch size, the learning rate, the maximum number of communication rounds, and the model convergence criterion. The client participation sampling ratio determines the number of clients selected by the server in each round of federated training; the number of local training iterations limits the number of times each client performs local training after receiving the global model; the maximum number of communication rounds and the model convergence criterion control the termination of the entire federated training process.

[0036] The core parameter screening parameters include the proportion k% of encrypted core parameters. This proportion k% is used in subsequent steps to screen out the top k% of parameters that have a significant impact on model performance and convergence process from all model parameters based on the global Fisher evaluation matrix, and these parameters are identified as the core parameters that need to be protected by modular component homomorphic encryption.

[0037] Differential privacy protection parameters include privacy budget parameters, noise scale parameters, and noise distribution type. In this embodiment, non-core parameters are protected against perturbation using Gaussian noise. Therefore, the server configures the Gaussian noise scale during the initialization phase so that the client can generate differential privacy noise according to a unified strategy when processing non-core parameters subsequently.

[0038] Modular component homomorphic encryption parameters include the number of coprime modular bases, the range of coprime modular base values, amplification, the initial range of scaling factors, the upper limit of scaling factors, the lower limit of scaling factors, and the upper limit threshold of overflow-preventing secure integers. These parameters constrain the client's subsequent local generation of modular component homomorphic encryption key parameters and ensure consistent calculation rules for model parameters during integer encoding, modular projection, ciphertext aggregation, and decryption.

[0039] After reading the system configuration parameters, the server constructs a global model to be trained based on a preset neural network architecture. This neural network architecture can be set according to specific task types, such as convolutional neural networks for image classification, recurrent neural networks or Transformer-type networks for text classification, or other trainable neural network models for scenarios such as medical data analysis, government data classification, and financial risk control prediction. The server initializes the model parameters of each layer according to the preset neural network architecture, including the weight and bias parameters of each network layer, thereby forming an initial global model.

[0040] In one optional implementation, the server can also assign a uniform model version number and current training round number to the initial global model, so as to manage the model distributed in each round, the parameters returned by the client, the Fisher information matrix, and the aggregated global model accordingly during subsequent federated training. Through the above initialization process, the server completes parameter loading, privacy protection strategy configuration, and initial model construction before the federated learning system runs, providing a foundation for subsequent steps such as client-side local training, Fisher information evaluation, core parameter selection, hybrid privacy protection, and global model aggregation.

[0041] S2. The server selects a subset of clients from multiple clients to participate in the current training round and sends the current global model to the client subset.

[0042] In step S2, the server selects a subset of clients from all online clients to participate in the current training round according to the training strategy of the current federated learning task, and uniformly distributes the current global model parameters to the client subset to start the current round of federated training.

[0043] Specifically, at the start of each round of federated training, the server first obtains the set of clients currently available for training. These clients can be mobile terminals, edge devices, local servers in medical institutions, government terminals, or other computing nodes with local data storage and model training capabilities. Since the number of clients in federated learning scenarios is typically large, and the network status, computing power, and online status of different clients dynamically change, the server does not need to schedule all clients in each round of training. Instead, it randomly selects a portion of the currently online clients to participate in the current round of training based on a preset client participation sampling ratio.

[0044] In one implementation, the server performs random sampling without replacement from the current set of online clients based on the client participation ratio configured during system initialization, generating a subset of clients to participate in the current training round. This random sampling method effectively reduces server-side communication load and overall computational resource consumption for federated training, while avoiding model bias issues caused by long-term participation of fixed clients.

[0045] In another alternative implementation, the server can also combine factors such as the client's historical training contribution, device online time, network bandwidth status, local data scale, and training stability to perform weighted selection of clients, thereby prioritizing the scheduling of clients with higher training quality or stronger data representativeness to participate in the current round of training, in order to further improve the global model convergence efficiency and training stability.

[0046] After selecting the client subset, the server distributes the global model parameters corresponding to the current round to all selected clients. These global model parameters include the weight parameters, bias parameters, and necessary configuration information related to the model structure for each layer of the neural network. Upon receiving these global model parameters, each client loads them into its local model for subsequent training tasks on its local private dataset.

[0047] In one implementation, when distributing global model parameters, the server also simultaneously sends the current training epoch number, model version number, and system configuration parameters corresponding to the current epoch to the client, including the local training epoch number, learning rate, core parameter percentage (k%), differential privacy parameters, and module homomorphic encryption-related parameters. By uniformly distributing the above training control information, it can be ensured that different clients adopt consistent training strategies and privacy protection rules during this round of federated training.

[0048] In one alternative implementation, to reduce network overhead during communication, the server can also compress and transmit global model parameters, for example, by using parameter quantization, sparse coding, or block transmission methods, to reduce the communication burden of large-scale neural network models in federated learning scenarios.

[0049] Through the above steps, the server completes the dynamic selection of participating clients for the current training round and the unified distribution of the global model, providing a foundation for subsequent local training on the client, Fisher information calculation, and uploading of privacy-preserving parameters.

[0050] S3. Each client performs local training based on its local private dataset, extracts the gradient of the model parameters during backpropagation, and calculates the local Fisher information matrix based on the gradient of the model parameters.

[0051] In step S3, after receiving the current global model from the server, each client performs local training based on its own local private dataset. During training, the client synchronously collects the gradients of the model parameters to construct a local Fisher information matrix reflecting the distribution characteristics of the local data and the importance of the model parameters. The purpose of this step is to enable the server to obtain the importance evaluation results of each model parameter globally through subsequent aggregation without uploading the original local data, thereby providing a basis for core parameter selection and differentiated privacy protection.

[0052] Specifically, the client selected by the server first receives the global model parameters issued by the server in the current training round, and loads these global model parameters into its local neural network model, ensuring that the initial parameter state of the local model is consistent with the current global model. The global model parameters include the weight parameters, bias parameters, and other trainable parameters corresponding to the model structure for each network layer. After loading the model, the client trains its local neural network model using its local private dataset. Because the local private dataset is always stored locally on the client, the server cannot directly access the client's original training samples, thus satisfying the fundamental requirement of data not leaving the domain in federated learning.

[0053] During local training, the client can employ stochastic gradient descent, batch stochastic gradient descent, Adam optimization, or other optimization algorithms suitable for neural network model training. It executes multiple rounds of forward propagation, loss calculation, and backpropagation operations according to the number of local training rounds pre-configured by the server. In each local training iteration, the client first inputs the local training samples into the local neural network model to obtain the model's prediction results. Then, it calculates the loss function value based on the model's prediction results and the sample labels. Next, it calculates the partial derivatives of the loss function with respect to each model parameter through backpropagation, i.e., the true gradients corresponding to each model parameter. Finally, it updates the local model parameters according to the optimization algorithm used.

[0054] Unlike conventional federated learning, which focuses only on the locally trained model parameters, this embodiment additionally extracts the true gradients of each model parameter during each backpropagation process and uses these true gradients for Fisher information calculation. Specifically, for the model parameters... The client extracts the loss function for the model parameters during training step t. The true gradient The system then performs a squaring operation on the true gradient to obtain the squared gradient value of the model parameter at the current training step. The client accumulates the squared gradient values ​​of the same model parameter across multiple training steps element-wise and stores the accumulated result in a gradient squared accumulation tensor with the same structure as the local model parameter.

[0055] After local training is complete, the client normalizes the cumulative gradient squared tensor based on the total number of local training steps T. This is done by dividing the cumulative squared gradient value for each model parameter by the total number of local training steps T, thus obtaining the estimated second-order raw moment of the gradient for that model parameter. This estimated second-order raw moment can be used to characterize the sensitivity of the corresponding model parameter to changes in the local data loss function, and thus serve as the local Fisher evaluation value for that model parameter. The local Fisher evaluation values ​​for all model parameters together form a local Fisher information matrix that is completely consistent with the structure of the local model parameters.

[0056] Among them, model parameters Fisher's evaluation value is expressed as:

[0057] in, Represents model parameters The Fisher evaluation value, which is the importance score of the model parameter; T represents the total number of local training steps on the client side. It can be obtained by multiplying the number of local training iterations by the number of data batches in each training iteration. This represents the loss function with respect to the model parameters at training step t. The true gradient.

[0058] In this embodiment, a larger Fisher evaluation value indicates that the model parameter is more sensitive to changes in the loss function during local training, and has a greater impact on model performance and convergence; a smaller Fisher evaluation value indicates that the model parameter has a relatively weaker impact on changes in the loss function. Therefore, the local Fisher information matrix generated by the client can reflect the importance of each model parameter under the local data distribution without revealing the original local data.

[0059] In one alternative implementation, the client can maintain gradient squared cumulative tensors separately for each model layer, for example, calculating the corresponding local Fisher evaluation values ​​for the trainable parameters in convolutional layers, fully connected layers, normalized layers, or embedding layers. The resulting local Fisher information matrix not only matches the overall structure of the local model but also maintains the same dimension as the parameter tensors of each layer, facilitating the server to align and aggregate the local Fisher information matrices uploaded by multiple clients according to the model layer in subsequent steps.

[0060] After calculating the local Fisher information matrix, the client uploads it to the server. Since the uploaded matrix is ​​a parameter importance evaluation matrix obtained from gradient squared statistics, rather than the original local training data, it does not directly expose the client's local sample content. After receiving local Fisher information matrices uploaded by multiple clients, the server can aggregate them in subsequent steps to obtain a global Fisher evaluation matrix reflecting the global data distribution characteristics, which can then be used to filter out core parameters that require special protection.

[0061] S4. Each client generates the key parameters required for modular component homomorphic encryption locally, including the set of coprime modular bases, amplification, scaling factor, and position template.

[0062] In step S4, the client generates the key parameters required for modular component homomorphic encryption locally, which are used for subsequent integer encoding of core parameters, modular projection encryption, and decryption recovery after aggregation.

[0063] Specifically, the client first selects n pairwise coprime large integers locally to construct a coprime modular basis set B. This coprime modular basis set B is used to subsequently map the core parameters to multiple different modular spaces to generate corresponding modular projection values. Since the modular basis satisfies a pairwise coprime relationship, the Chinese Remainder Theorem can be used to uniquely reconstruct the aggregated modular projection results using integers.

[0064] Subsequently, the client configures a numerical amplification factor 'a'. This amplification factor 'a' is used to increase the numerical interval after integer encoding, thereby reducing the impact of random perturbations during ciphertext computation on parameter recovery accuracy and improving numerical stability in subsequent ciphertext aggregation processes.

[0065] The client further initializes the scaling factor Δ. Since neural network model parameters are typically floating-point numbers, while modular component homomorphic encryption is performed in integer space, the client uses the scaling factor Δ to map floating-point model parameters to integer encoded values. The scaling factor Δ is initialized in this step and dynamically adjusted according to the distribution of model parameters in subsequent step S7.

[0066] Subsequently, the client generates a position template S based on the user-defined master key U. The position template S is used to determine the insertion position of the true modulus projection value in the obfuscated ciphertext matrix. In subsequent encryption processes, in addition to generating the true modulus projection value, the client also generates redundant projection values ​​for obfuscation, and embeds these true modulus projection values ​​into the corresponding obfuscated positions according to the position template S, thereby increasing the difficulty for the server to distinguish between the true ciphertext and redundant data.

[0067] In this process, the coprime modulus set B, the magnification a, and the scaling factor Δ are used as parameters required for homomorphic computation of modulus components, supporting the subsequent integer encoding, modulus projection, and ciphertext aggregation processes of core parameters. The location template S is stored locally on the client as a private key parameter and is not uploaded to the server. During the subsequent aggregation process, the server can only receive the obfuscated ciphertext matrix and cannot obtain the specific location of the actual modulus projection value.

[0068] S5. The server receives the local Fisher information matrix uploaded by each client and aggregates the local Fisher information matrix to obtain the global Fisher evaluation matrix.

[0069] In step S5, the server receives the local Fisher information matrices uploaded by each client in the current training round, and aggregates each local Fisher information matrix to obtain a global Fisher evaluation matrix that characterizes the sensitivity of model parameters in the global scope.

[0070] Specifically, after each client completes local training and calculates its local Fisher information matrix, the server collects the local Fisher information matrices uploaded by all clients participating in this round of training. Since each client performs local training based on the same global model structure distributed by the server, the local Fisher information matrices generated by each client are consistent with the global model parameter structure, and can be matched accordingly according to model level and parameter position.

[0071] After receiving the local Fisher information matrices, the server processes them sequentially according to the hierarchical structure of the neural network model. For convolutional layers, fully connected layers, normalized layers, or other network layers containing trainable parameters, the server extracts the local Fisher tensor of each client at the corresponding layer and aligns the Fisher evaluation values ​​at the same layer and with the same parameter positions.

[0072] After alignment, the server performs element-wise summation of the local Fisher evaluation values ​​at the same model parameter location in the plaintext space to obtain the global Fisher evaluation value corresponding to that model parameter location. Alternatively, the server can perform weighted summation of the local Fisher evaluation values ​​uploaded by each client based on the number of local samples, training steps, or participation weight, giving higher weight to clients with more samples or greater training contributions in the global Fisher evaluation.

[0073] Through the above-described layer-by-layer, parameter-by-parameter accumulation or weighted accumulation process, the server fuses the local Fisher information from multiple clients to obtain a global parameter sensitivity result that reflects the distribution of data characteristics across the entire network. Finally, the server recombines the global Fisher evaluation values ​​corresponding to each model parameter position according to the parameter structure of the original global model, forming a global Fisher evaluation matrix consistent with the parameter structure of the global model.

[0074] The global Fisher evaluation matrix represents the importance of each model parameter in the global federated training task. A parameter with a larger global Fisher evaluation value has a more significant impact on the change of the global model loss function and the model convergence process; a parameter with a smaller global Fisher evaluation value has a relatively weaker impact on the global model performance. Therefore, the global Fisher evaluation matrix can serve as the basis for subsequently selecting core parameters and generating a Boolean-type encryption mask matrix.

[0075] S6. The server selects the top k% of sensitive parameters based on the global Fisher evaluation matrix, generates a Boolean encryption mask matrix to distinguish between core parameters and non-core parameters, and sends the Boolean encryption mask matrix to each client.

[0076] In step S6, the server uses the global Fisher evaluation matrix generated in step S5 to filter the parameters in the global model by importance, selecting the top k% of sensitive parameters as core parameters, and generating a Boolean encryption mask matrix to distinguish between core and non-core parameters. This Boolean encryption mask matrix guides each client in subsequent steps to process the model parameters using two different privacy protection methods: modular component homomorphic encryption and differential privacy noise injection.

[0077] Specifically, the server first determines the number of core parameters requiring focused encryption protection based on the core parameter percentage k% configured during system initialization. This core parameter percentage k% is set by the user based on the desired level of privacy protection and the system's computational resources. A larger k% value increases the number of selected core parameters and strengthens system privacy protection, but also increases the corresponding encryption computation and communication overhead. Conversely, a smaller k% value further reduces the overall system computational overhead and communication burden.

[0078] Subsequently, the server flattens the high-dimensional global Fisher evaluation matrix obtained in step S5 into a one-dimensional Fisher evaluation vector. Since each element in the global Fisher evaluation matrix corresponds to a model parameter in the global model, after flattening, the server can sort and compare the importance of all model parameters in a unified one-dimensional parameter space.

[0079] Based on the number of core parameters, the server searches for the corresponding Fisher segmentation threshold in the one-dimensional Fisher evaluation vector. Specifically, the server can use a sorting algorithm, a Top-k search algorithm, or a fast selection algorithm to sort all Fisher evaluation values ​​according to their numerical values ​​and determine the Fisher evaluation value corresponding to the top k% as the segmentation threshold. The segmentation threshold is used to distinguish between core parameters that require modular component homomorphic encryption protection and non-core parameters that require differential privacy protection.

[0080] After determining the segmentation threshold, the server iterates through all parameter positions in the global model and compares the Fisher evaluation value at each position with the Fisher segmentation threshold. When the Fisher evaluation value at a parameter position is greater than or equal to the Fisher segmentation threshold, the server marks that parameter position as logical 1 (True) and determines that the parameter is a core parameter; when the Fisher evaluation value at a parameter position is less than the Fisher segmentation threshold, the server marks that parameter position as logical 0 (False) and determines that the parameter is a non-core parameter. Core parameters marked as logical 1 indicate that these parameters are highly sensitive to changes in the model's loss function and the model's convergence process, and require focused protection using modular component homomorphic encryption in subsequent steps. Non-core parameters marked as logical 0 indicate that their impact on the overall model performance is relatively weak, and therefore can be protected with lightweight differential privacy noise injection in subsequent steps.

[0081] After completing the logical labeling of all model parameter positions, the server constructs a Boolean encryption mask matrix that is completely consistent with the global model parameter structure based on the above logical 1 and logical 0 labeling results. Each element in the Boolean encryption mask matrix corresponds one-to-one with the corresponding parameter position in the global model, and is used to indicate the privacy protection method subsequently adopted for the corresponding parameter.

[0082] Finally, the server distributes the Boolean encryption mask matrix to each client participating in the current training round. In subsequent steps, each client uses the Boolean encryption mask matrix to perform modular component homomorphic encryption on the core parameters corresponding to logic 1, and differential privacy noise injection on the non-core parameters corresponding to logic 0, thereby achieving differentiated privacy protection based on parameter importance.

[0083] S7. Each client performs modular component homomorphic encryption on the core parameters and differential privacy noise injection on the non-core parameters according to the Boolean encryption mask matrix, and uploads the ciphertext of the core parameters and the noisy plaintext of the non-core parameters to the server.

[0084] In step S7, each client classifies the locally trained model parameters according to the Boolean encryption mask matrix sent by the server. For parameter positions marked with logic 1 in the Boolean encryption mask matrix, the client determines the corresponding parameter as a core parameter and performs modulo component homomorphic encryption on it; for parameter positions marked with logic 0 in the Boolean encryption mask matrix, the client determines the corresponding parameter as a non-core parameter and performs differential privacy noise injection on it. In this way, core parameters and non-core parameters enter different privacy protection channels, ensuring the security of core parameters while reducing the overall encryption computation overhead.

[0085] Specifically, each client first reads the received Boolean encryption mask matrix and, based on the one-to-one correspondence between the Boolean encryption mask matrix and the local model parameters, determines the protection method corresponding to each model parameter. Since the Boolean encryption mask matrix has the same structure as the global model parameters, the client can accurately identify whether each parameter position is a core parameter position or a non-core parameter position according to the model level, tensor dimension, and parameter coordinates.

[0086] For non-core parameters marked as logic 0 in the Boolean encryption mask matrix, the client extracts the plaintext value of the corresponding non-core parameter and generates Gaussian noise with a mean of 0 locally based on preset differential privacy budget parameters and noise scale. The variance of the Gaussian noise is determined by the preset noise scale. The client then superimposes the generated Gaussian noise onto the corresponding plaintext value of the non-core parameter to obtain the noisy plaintext of the non-core parameter. Since the non-core parameters have a relatively weak impact on model convergence and model performance, applying a certain degree of random perturbation to these parameters can minimize the impact on the global model accuracy while providing privacy protection.

[0087] In one implementation, the noisy plaintext of non-core parameters can be represented as: ,in, This represents the original value of a non-core parameter. This represents the noisy plaintext of non-core parameters after adding noise. This represents the Gaussian noise scale. After the client completes the noise injection for non-core parameters, it preserves these parameters in a noisy plaintext form that can be directly weighted and aggregated by the server.

[0088] For a core parameter marked as logic 1 in a Boolean encryption mask matrix, the client extracts the core parameter P corresponding to that position and performs modulo component homomorphic encryption on that core parameter. First, the client dynamically calculates the adaptive scaling factor Δ based on the numerical distribution of the current layer's core parameters. Specifically, the client calculates the maximum absolute value of the current layer's core parameters. It also obtains the number N of clients participating in the aggregation of the current training round, and then combines this with the safe integer upper limit threshold to prevent integer encoding overflow. Scale factor lower limit and the upper limit of the scaling factor Calculate the scaling factor Δ corresponding to the current layer.

[0089] In one implementation, the adaptive scaling factor Δ can be expressed as:

[0090] By using the above dynamic adjustment method, we can ensure the accuracy of floating-point parameter encoding while avoiding integer overflow of multiple client parameters during subsequent aggregation.

[0091] After determining the scaling factor Δ, the client multiplies the core parameter P by the scaling factor Δ and rounds the product to the nearest integer to obtain the integer encoded value of the core parameter. Subsequently, the client multiplies this integer encoded value by the amplification factor a and adds a random perturbation η to obtain the encoded integer. The encoding process can be represented as follows:

[0092] Where P represents the core parameter, Δ represents the scaling factor, a represents the magnification, and η represents the random perturbation. By introducing the magnification a and the random perturbation η, the anti-interference capability of the integer encoding result can be enhanced, and the security and stability of the subsequent ciphertext processing can be improved.

[0093] Get the encoded integer Then, the client uses each coprime modular basis bi in the coprime modular basis set B to process integers. Perform the modulus operation separately to obtain multiple true modulus projection values. This process can be represented as:

[0094] Where P represents the core parameter, Δ represents the scaling factor, a represents the magnification, and η represents the random perturbation. This represents the i-th coprime modulus. Therefore, the integer encoding result corresponding to the core parameter is split into multiple scattered modulus projection values, making it impossible for the server to directly recover the plaintext core parameter from a single modulus projection value.

[0095] To further mask the true model projection values, the client generates an array of random integers. The random integer array, after being amplified, perturbed, and moduloed by the coprime modulus set B, generates a redundant projection set r for obfuscation. The projection values ​​in the redundant projection set do not correspond to the true core parameters and are only used to obfuscate the true modulus projection positions in the ciphertext matrix.

[0096] Subsequently, the client projects the actual model value based on the locally saved location template S. The specified position is embedded into the obfuscated redundant projection set r. Specifically, the position template S contains an index. , used to indicate the projection value of the i-th real model The insertion position in the corresponding ciphertext line. The final generated core parameter ciphertext matrix e is an N×M matrix, where each row contains a true modulus projection value and M-1 scrambled redundant projection values. For the elements in the ciphertext matrix e... When j equals the index specified by the position template S At that time, this element is the true model projection value. When j is not equal to At that time, this element is a confused redundant projection value. This relationship can be represented as:

[0097] Therefore, even if the server receives the core parameter ciphertext matrix e, it cannot determine the location of the true model projection value without holding the location template S, making it difficult to recover the core parameter plaintext.

[0098] After completing the encryption of core parameters and the differential privacy noise injection of non-core parameters, the client uploads the ciphertext matrix of core parameters, the noisy plaintext of non-core parameters, and the publicly available computational parameters or necessary identification information required by the server to perform homomorphic aggregation to the server. It should be noted that the client does not upload the location template S or the private key information used to locate the projection value of the true model; the location template S is always stored locally on the client. In subsequent steps, the server only acts as an aggregation node for the ciphertext of core parameters and the noisy plaintext of non-core parameters, performing the corresponding aggregation operations on the two types of parameters respectively.

[0099] S8. The server performs weighted aggregation on the core parameter ciphertext and the non-core parameter noisy plaintext to obtain a hybrid global model.

[0100] In step S8, the server receives the mixed data packets uploaded by each client and performs aggregation processing on the core parameter ciphertext and the noisy plaintext of non-core parameters according to the Boolean encryption mask matrix to obtain the mixed-state global model.

[0101] Specifically, after completing the parameter protection process in step S7, each client uploads a mixed data packet to the server. The mixed data packet includes a core parameter ciphertext matrix and noisy plaintext non-core parameters. The core parameter ciphertext matrix corresponds to the parameter positions marked as logic 1 in the Boolean encryption mask matrix, and the noisy plaintext non-core parameters corresponds to the parameter positions marked as logic 0 in the Boolean encryption mask matrix.

[0102] After receiving the mixed data packets uploaded by each client, the server divides the uploaded data into channels based on a Boolean encryption mask matrix. For core parameters marked as logic 1 in the mask matrix, the server assigns them to the ciphertext processing channel; for non-core parameters marked as logic 0, the server assigns them to the plaintext processing channel. This division method allows the server to apply corresponding aggregation strategies to parameters of different protection types without decrypting the core parameters.

[0103] In the encrypted processing channel, the server first determines the aggregation weight based on the number of local samples from each client. For the k-th client, its aggregation weight is... The weights can be determined based on the proportion of the number of local samples on the client to the total number of samples from all participating clients in the current training round. Since the core parameter ciphertext is in modulo space, floating-point weights cannot be directly used for ciphertext weighting operations. Therefore, the server converts the floating-point aggregated weights to integer weights. Specifically, the server aggregates the weights... Multiply by the scaling factor Δ and round to the nearest integer to obtain the integer weight. The calculation method is as follows:

[0104] in, This represents the aggregate weight of the k-th client, where Δ represents the scaling factor used for weight encoding. This represents the encoded integer weight. The weight encoding process is completed locally on the server, without involving the client's original data, nor requiring the server to obtain the plaintext of the core parameters.

[0105] Subsequently, the server performs a modal-space weighted operation on each modal projection element in the core parameter ciphertext matrix e(k) uploaded by the k-th client using integer weights K′. For any element in the core parameter ciphertext matrix... If the module basis corresponding to this element is The server then performs the following modular multiplication operation:

[0106] in, This represents the ciphertext element before weighting. This represents the weighted ciphertext element. This indicates the coprime modular basis used for the corresponding row. Through the above modular multiplication operation, the server can perform weighted processing on the ciphertext of the core parameters without knowing the actual modular projection position and the plaintext of the core parameters.

[0107] After weighting the ciphertext matrices of the core parameters for each client, the server obtains multiple weighted ciphertext matrices. The server then performs a blind aggregation operation on these weighted ciphertext matrices. Specifically, for any position (i,j) in the ciphertext matrix, the server sums the weighted ciphertext elements corresponding to that position from all clients and aggregates them using the corresponding modulus. The modulo operation yields the core parameter ciphertext aggregation result. The calculation method is as follows:

[0108] Where K represents the number of clients participating in aggregation in the current training round. Let (i,j) represent the element at position (i,j) in the weighted ciphertext matrix after the k-th client. This represents the ciphertext element of the aggregated core parameters. Since the server only performs modular multiplication and modular addition operations throughout the entire ciphertext processing channel and does not hold the position template S, the server cannot directly obtain the plaintext of the core parameters.

[0109] During the execution of ciphertext weighting and modular aggregation, the server also records the order changes corresponding to the scaling factor and magnification. For example, after the server encodes floating-point aggregation weights into integer weights and performs weighting operations on the ciphertext, the order of the scaling factor in the ciphertext result will change. The server records this order change information and uses it as auxiliary information for subsequent client decryption and restoration, so that the client can correctly remove the influence of the scaling factor and magnification in step S9.

[0110] In the plaintext processing channel, the server performs weighted average aggregation on the noisy plaintext containing non-core parameters uploaded by each client. Specifically, the server sums the noisy plaintext containing non-core parameters at the same parameter position according to the aggregation weight of each client, obtaining the aggregation result for non-core parameters. Since the Gaussian noise injected by each client is independent and has a mean of 0, during the weighted aggregation process involving multiple clients, the random noise will have a certain degree of mean cancellation as the number of participating clients increases, thereby reducing the impact on the accuracy of the global model while maintaining the differential privacy protection effect.

[0111] After aggregating the ciphertext and plaintext processing channels, the server combines the core parameter ciphertext aggregation result with the non-core parameter aggregation result according to the positions indicated by the Boolean encryption mask matrix, forming a hybrid global model. The core parameter positions remain the ciphertext aggregation result, while the non-core parameter positions are the weighted aggregation result of noisy plaintext. The server then sends this hybrid global model to each client, allowing the clients to locally decrypt and recover the core parameter ciphertext aggregation result in subsequent steps, and to combine it with the non-core parameter aggregation result to form a new global model.

[0112] S9. The client receives the hybrid global model, uses the locally stored private key to decrypt and recover the core parameter ciphertext aggregation result, and combines it with the non-core parameter aggregation result to form a new round of global model.

[0113] In step S9, the client receives the hybrid global model sent by the server, and uses the private key stored locally to decrypt and recover the core parameter ciphertext aggregation result. Then, the recovered core parameters are combined with the non-core parameters obtained by the server to form a new round of global model.

[0114] Specifically, after receiving the hybrid global model, the client first distinguishes the parameters in the model based on the locally stored Boolean encryption mask matrix. For parameter positions marked with logic 1 in the Boolean encryption mask matrix, the client identifies the corresponding data as the core parameter ciphertext aggregation result; for parameter positions marked with logic 0 in the Boolean encryption mask matrix, the client identifies the corresponding data as the non-core parameter aggregation result. Through this step, the client can separate the core parameter ciphertext aggregation block that needs decryption from the hybrid global model, as well as the non-core parameter aggregation results that can be used directly without decryption.

[0115] For the core parameter ciphertext aggregation result, the client uses the location template S in the locally stored private key to locate the true modulus projection value from the obfuscated ciphertext matrix. Since the core parameter ciphertext aggregation result retains the obfuscated ciphertext matrix form after aggregation on the server side, each row still contains one true modulus projection value and several obfuscated redundant projection values. Based on the index position recorded in the location template S, the client extracts the true modulus projection value from each row and filters out other obfuscated redundant projection values, thus obtaining the true modulus projection sequence. .

[0116] After obtaining the true modulus projection sequence, the client uses the Chinese Remainder Theorem to reconstruct the true modulus projection values, restoring multiple small integers scattered in different modulus spaces into a unique aggregated large integer. Specifically, let the total modulus Bs be the basis of each coprime modulus. The product of, i.e. and order , express In the model The multiplicative inverse of the following integers is aggregated. It can be represented as:

[0117] Through the above-mentioned Chinese Remainder Theorem reconstruction process, the client can restore the scattered real modulus projection values ​​in the ciphertext aggregation result to the corresponding aggregated integer representation.

[0118] Due to the reconstruction It remains an integer form after processing with the scaling factor, magnification, and server-side weighted encoding; therefore, the client still needs to perform floating-point restoration. Specifically, the client determines the scaling factor order based on the scaling factor information recorded or sent by the server. and magnification order information Remove the effects of scaling factor and magnification, and aggregate integers. The core parameters are restored to floating-point values ​​usable by the neural network. The restoration process can be represented as:

[0119] in, This represents the restored floating-point values ​​of the core parameters, where Δ represents the scaling factor and a represents the magnification. Through this restoration process, the client can recover the aggregated core parameters from integer encoding into floating-point weight parameters that can be used for model training and inference.

[0120] After restoring the floating-point values ​​of the core parameters, the client fills the restored floating-point values ​​of the core parameters back into the model parameter positions corresponding to logic 1, according to the positions indicated by the Boolean encryption mask matrix. Simultaneously, it fills the model parameter positions corresponding to logic 0 with the aggregated results of the non-core parameters separated from the hybrid global model. Thus, the client combines the decrypted and restored core parameter results with the aggregated non-core parameter results to form a complete new round of global model.

[0121] In this process, the server only participates in the aggregation of the core parameter ciphertext and the aggregation of the noisy plaintext non-core parameters. It does not hold the location template S used to locate the projection values ​​of the true model, and therefore cannot directly recover the core parameter plaintext. The client completes the decryption and recovery of the core parameters using its local private key. This ensures the privacy and security of the core parameters during the server aggregation process, while also enabling the aggregated global model to be loaded normally by the client and enter the next round of federated training.

[0122] S10. Repeat steps S2 to S9 until the model meets the preset convergence conditions.

[0123] In step S10, the system repeats steps S2 to S9, continuously performing federated training processes such as client selection, model distribution, local training, Fisher information calculation, core parameter filtering, parameter privacy protection, server aggregation, and client decryption and recovery, until the global model meets the preset convergence condition and the federated learning training task ends.

[0124] Specifically, after each round of federated training, each client receives an updated global model. The server then enters the next round of federated training, again selecting a new subset of clients from the currently online clients according to a preset client participation ratio, and distributing the global model corresponding to the current round to them to continue the subsequent local training and parameter aggregation process.

[0125] At the end of each federated cycle, the system evaluates the training state of the current global model. Specifically, it can perform inference tests on the current global model using an independent validation set and calculate the current model's cross-entropy loss, classification accuracy, or other task-related performance metrics. Cross-entropy loss measures the difference between the model's predictions and the true labels, while classification accuracy measures the proportion of correct predictions made by the model on the validation samples.

[0126] As the number of federated training rounds increases, if the cross-entropy loss of the current global model gradually decreases and stabilizes, while the classification accuracy gradually increases and stabilizes, it indicates that the model has gradually completed feature learning under the global data distribution, and the model parameters have begun to converge.

[0127] In one implementation, the system determines that the federated learning model has reached convergence when any of the following conditions are met: The current number of federal training rounds has reached the preset maximum number of communication rounds; During several consecutive training rounds, the change in the global model's cross-entropy loss was lower than a preset threshold. During several rounds of training, the improvement in the global model classification accuracy was less than the preset threshold. The current global model performance meets the user's preset target accuracy requirements.

[0128] Once the system determines that the model meets the convergence condition, it terminates the federated learning training task and outputs the final trained global model. This final global model retains the global data features obtained from multi-client joint training and achieves parameter privacy protection during the federated learning process through homomorphic encryption of core parameter modulus components and differential privacy protection mechanisms for non-core parameters.

[0129] Through the aforementioned iterative training mechanism, this invention can continuously optimize the global model performance while ensuring that the client's original data does not leave the local machine, and also take into account model accuracy, communication efficiency, and privacy security.

[0130] In a specific application scenario, this invention can be applied to a federated learning system in a medical collaborative modeling scenario. Multiple medical institutions act as federated learning clients, each with its own local training server for storing medical imaging data, electronic medical records, or laboratory test data of its patients. A cloud-based aggregation platform acts as the federated learning server, responsible for global model distribution, parameter aggregation, and model update management. Due to data privacy regulations and patient privacy protection requirements, different medical institutions cannot directly share raw patient data; therefore, a federated learning approach is needed to achieve cross-institutional collaborative model training.

[0131] For example, in lung CT image-assisted diagnosis tasks, each hospital client uses its own patient CT image data to train a lung nodule recognition model locally and periodically uploads model parameters to a cloud aggregation server. Since the model parameters may implicitly contain patient disease characteristics, data distribution characteristics, and hospital sample characteristics, directly obtaining the plaintext model parameters by the server poses a risk of patient privacy leakage. Furthermore, performing homomorphic encryption on all model parameters would lead to excessively high computational complexity, excessively large amounts of parameter transmission data, and decreased model aggregation efficiency during medical image model training.

[0132] This invention introduces a Fisher information evaluation mechanism into the federated learning system to dynamically analyze the importance of parameters in the global model. It then identifies core parameters that significantly impact model convergence and performance, applying modular component homomorphic encryption only to these core parameters, while using differential privacy noise protection for the remaining non-core parameters. This reduces the computational burden and communication overhead associated with full homomorphic encryption. Furthermore, the server cannot obtain the plaintext of the true core parameters throughout the aggregation process; it can only perform weighted aggregation on the ciphertext within the modular space, thereby reducing the risk of model parameter leakage.

[0133] It should be noted that this invention does not improve the abstract mathematical algorithm itself, but rather applies it to the secure transmission and aggregation process of model parameters in a federated learning system. The Fisher information evaluation, modular homomorphic encryption, and differential privacy noise injection all operate on the neural network model parameter processing process in the computer system, addressing technical issues such as high risk of model parameter leakage, high computational resource consumption for homomorphic encryption, and high communication load in federated training scenarios under distributed model training environments. This represents a technical improvement aimed at ensuring the security of federated learning model training in a computer network environment.

[0134] In summary, this application effectively enhances the computational efficiency and model usability of federated learning by tightly integrating modular component homomorphic encryption, Fisher information evaluation, and differential privacy hybrid defense mechanisms, while providing excellent privacy and security. Throughout the process, the server initializes by configuring and generating model parameters, randomly selecting clients for distribution, and dynamically determining the current Fisher calculation round. After receiving the model, the client performs local training, extracts the true gradient using backpropagation to calculate and upload the local Fisher information matrix, and simultaneously generates a homomorphic encryption private key and calculation key locally, containing coprime mode bases, magnification, scaling factors, and position templates. Subsequently, the system obtains the global Fisher evaluation matrix by progressively accumulating local information, selects the top k% of sensitive parameters to generate a Boolean encryption mask matrix, and distributes it. The client strictly adheres to this mask, performing homomorphic encryption on core parameters locally, injecting differential privacy noise into non-core parameters, and jointly uploading the processed parameters. The server then performs weighted average aggregation on the core ciphertext and the non-core noisy plaintext, and distributes the aggregated global model. Finally, the client decrypts and reconstructs the new global model locally and continues training until the model converges. The advantages of this solution are as follows: First, it innovatively introduces Fisher information as a sensitivity assessment indicator, accurately extracting the Top-k% core parameters that determine model convergence, avoiding the enormous computational and communication overhead caused by full homomorphic encryption of massive redundant parameters, and greatly improving the system's operating efficiency. Second, the core parameters rely entirely on the modular component homomorphic encryption channel, ensuring that the aggregation server can never access the key plaintext features that dominate model performance, thus completely eliminating the risk of core logic leakage at the mathematical level. Third, non-core parameters use differential privacy injection noise, cleverly utilizing the natural robustness of long-tail parameters to numerical perturbations and the mean cancellation effect during federated aggregation, providing strict privacy protection boundaries while achieving high fidelity and high accuracy of the global model. Fourth, the key generation system and encryption / decryption operations are strictly decentralized and restricted to execution locally on the client side, with the server only acting as an aggregation node for ciphertext and noisy data, truly achieving "data not leaving the domain and keys not being uploaded," which highly aligns with the security compliance requirements and trust mechanisms in highly privacy-sensitive scenarios such as healthcare and government affairs.

[0135] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0136] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0137] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A privacy-preserving method for federated learning that combines modular component homomorphic encryption and differential privacy, characterized in that, Includes the following steps: S1. The server initializes the federated learning system, configures the federated training parameters, core parameter ratio k%, differential privacy parameters, modular component homomorphic encryption parameters, and global model parameters, and builds the initial global model. S2. The server selects a subset of clients participating in the current training round from multiple clients and sends the current global model to the client subset; S3. Each client performs local training based on its local private dataset, extracts the gradient of the model parameters during backpropagation, and calculates the local Fisher information matrix based on the gradient of the model parameters. S4. Each client generates the key parameters required for modular component homomorphic encryption locally, including the set of coprime modular bases, amplification, scaling factor, and position template; S5. The server receives the local Fisher information matrix uploaded by each client and aggregates the local Fisher information matrix to obtain the global Fisher evaluation matrix. S6. The server selects the top k% of sensitive parameters based on the global Fisher evaluation matrix, generates a Boolean encryption mask matrix to distinguish between core parameters and non-core parameters, and sends the Boolean encryption mask matrix to each client. S7. Each client performs modular component homomorphic encryption on the core parameters and differential privacy noise injection on the non-core parameters according to the Boolean encryption mask matrix, and uploads the ciphertext of the core parameters and the noisy plaintext of the non-core parameters to the server. S8. The server performs weighted aggregation on the core parameter ciphertext and the non-core parameter noisy plaintext to obtain a hybrid global model. S9. The client receives the hybrid global model, uses the locally stored private key to decrypt and recover the core parameter ciphertext aggregation result, and combines it with the non-core parameter aggregation result to form a new round of global model. S10. Repeat steps S2 to S9 until the model meets the preset convergence conditions.

2. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, Step S3 includes: Each client receives the current global model from the server and loads the current global model into its local neural network model; Each client performs forward propagation, loss calculation, and back propagation based on its local private dataset, and updates the local model parameters according to the preset number of local training rounds; During each backpropagation process, the client extracts the true gradient of the loss function with respect to each model parameter and performs element-wise squared accumulation on the true gradient; After local training is completed, the client divides the cumulative squared gradient value corresponding to each model parameter by the total number of local training steps to obtain a local Fisher information matrix that is consistent with the local model parameter structure. Among them, model parameters Fisher's evaluation value is expressed as: in, Represents model parameters Fisher's evaluation value This indicates the total number of local training steps on the client side. This represents the loss function with respect to the model parameters at training step t. The true gradient.

3. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, Step S4 includes: The client selects n pairwise coprime large integers locally and constructs a coprime modular basis set B. The client sets the magnification factor 'a' to increase the interval between integer encoded numerical values; The client-side settings are used to map floating-point model parameters to integer encoded values ​​using a scaling factor Δ. The client generates a position template S based on the master key U set by the user. The position template S is used to determine the insertion position of the real modulus projection value in the confuse ciphertext matrix. Among them, the coprime modulus set B, the magnification a, and the scaling factor Δ are the parameters required for the homomorphic calculation of the modulus components, and the position template S is stored locally on the client as a private key parameter and is not uploaded to the server.

4. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, Step S5 includes: The server receives the local Fisher information matrix uploaded by each client in the current training round; The server aligns the local Fisher tensors of each client at the corresponding level according to the hierarchical structure of the neural network model. The server performs element-wise accumulation or weighted accumulation on the local Fisher evaluation values ​​at the same model parameter location to obtain the global Fisher evaluation value at the corresponding location. The server combines the global Fisher evaluation values ​​corresponding to the positions of each model parameter to form a global Fisher evaluation matrix that is consistent with the structure of the global model parameters.

5. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, Step S6 includes: The server determines the number of core parameters that need to be protected by modular component homomorphic encryption based on a preset core parameter ratio k%. The server flattens the global Fisher evaluation matrix into a one-dimensional Fisher evaluation vector and determines the Fisher segmentation threshold based on the number of core parameters. The server iterates through the global model parameter positions, marks the positions of parameters whose Fisher evaluation values ​​are greater than or equal to the Fisher segmentation threshold as logic 1, and determines them as core parameters. The server marks the positions of parameters whose Fisher evaluation values ​​are less than the Fisher segmentation threshold as logic 0 and determines them to be non-core parameters; The server generates a Boolean-type encryption mask matrix that is consistent with the structure of the global model parameters based on the marking results of logic 1 and logic 0.

6. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, In step S7, differential privacy noise injection processing is performed on non-core parameters, including: The client reads the positions of parameters marked with logic 0 in the Boolean encryption mask matrix; The client extracts the plaintext values ​​of non-core parameters corresponding to the parameter positions; The client generates Gaussian noise with a mean of 0 based on preset differential privacy budget parameters and noise scale; The client adds the Gaussian noise to the plaintext value of the non-core parameter to obtain the noisy plaintext of the non-core parameter.

7. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, In step S7, modular component homomorphic encryption processing is performed on the core parameters, including: The client reads the parameter positions marked as logic 1 in the Boolean encryption mask matrix and extracts the core parameter P corresponding to the parameter positions; The client dynamically adjusts the scaling factor Δ based on the numerical distribution of the core parameters of the current layer; The client multiplies the core parameter P by the scaling factor Δ and rounds it to the nearest integer, then multiplies it by the amplification factor a and adds a random perturbation η to obtain the encoded integer. ; The client uses the coprime modular basis bi in the coprime modular basis set B to encode the integer. Perform the modulus operation separately to obtain the true modulus projection value. ; The client generates a set of obfuscated and redundant projections r, and projects the true model values ​​according to the location template S. Embedded into the obfuscated redundant projection set, a core parameter ciphertext matrix e is generated; in: Where P represents the core parameter, Δ represents the scaling factor, a represents the magnification, and η represents the random perturbation. Let i represent the i-th coprime modulus.

8. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 7, characterized in that, The client dynamically adjusts the scaling factor Δ based on the numerical distribution of the current layer's core parameters, including: The client calculates the maximum absolute value of the core parameters of the current layer. ; The client obtains the number N of clients participating in the aggregation of the current training round; The client uses the upper limit threshold for secure integers. Scale factor lower limit and the upper limit of the scaling factor Calculate the adaptive scaling factor Δ; in: in, This represents the upper limit threshold for safe integers to prevent integer encoding overflow.

9. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, Step S8 includes: The server receives mixed data packets uploaded by each client, the mixed data packets including a core parameter ciphertext matrix and noisy plaintext non-core parameters; The server divides the mixed data packet into a ciphertext processing channel and a plaintext processing channel based on the Boolean encryption mask matrix. In the encrypted processing channel, the server determines the aggregation weight based on the number of local samples of each client and converts the floating-point aggregation weight into an integer weight. The server uses the integer weights to perform modular space weighting on the core parameter ciphertext matrix uploaded by each client, and performs modular aggregation on the weighted core parameter ciphertext matrix to obtain the core parameter ciphertext aggregation result. In the plaintext processing channel, the server performs weighted average aggregation on the noisy plaintext with non-core parameters uploaded by each client according to the aggregation weight, and obtains the aggregation result of non-core parameters. The server combines the core parameter ciphertext aggregation result with the non-core parameter aggregation result to obtain a hybrid global model.

10. The federated learning privacy protection method combining modular component homomorphic encryption and differential privacy as described in claim 1, characterized in that, Step S9 includes: Based on the Boolean encryption mask matrix, the client separates the core parameter ciphertext aggregation result and the non-core parameter aggregation result from the hybrid global model; The client uses the location template S in the locally stored private key to locate and extract the real modulus projection value from the obfuscated ciphertext matrix of the core parameter ciphertext aggregation result. Based on the true model projection value, the client reconstructs the aggregate integer using the Chinese Remainder Theorem. ; The client removes the effects of the scaling factor and magnification, and aggregates the integer. Restore to the floating-point values ​​of the core parameters; The client fills the floating-point values ​​of the core parameters back into the model parameter positions corresponding to logic 1 in the Boolean encryption mask matrix, and fills the aggregation results of the non-core parameters back into the model parameter positions corresponding to logic 0 in the Boolean encryption mask matrix, forming a new round of global model.

Images