A federated data network drug research and development method based on multi-level security and authenticity verification

Abstract

The application discloses a kind of federal data network drug research and development method and system based on multilevel security and authenticity verification.The method constructs federal network including coordination node, data node and support node.The core is: data node trains model in trusted execution environment using local data, and generates parameter update;Before parameter update is transmitted, double commitment including data feature digest and update hash is submitted to blockchain;Support node carries out secure aggregation to ciphertext update based on homomorphic encryption technology.The authenticity of the data and the computing behavior of the participants is ensured through the verification of the double commitment by the blockchain.The method combines trusted hardware, cryptography and distributed ledger, establishes an auditable trust mechanism under the premise of strictly protecting privacy, solves the problems of false data, privacy leakage and lack of trust in cross-institutional drug research and development, and realizes safe and reliable collaborative AI drug discovery.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and medical information technology, and in particular to a method and system for enabling cross-institutional collaborative artificial intelligence-assisted drug development while ensuring data privacy, security and authenticity. Background Technology

[0002] AI-driven drug discovery relies on large-scale, high-quality, multi-source data. However, core data is scattered across "data silos" formed by pharmaceutical companies, hospitals, and research institutions, and cannot be directly shared due to privacy, security, and profit concerns. Federated learning allows for collaborative modeling without exchanging raw data, but its direct application to high-value drug discovery scenarios faces three major challenges:

[0003] First, there is a lack of oversight regarding data authenticity. Existing federated learning frameworks lack effective mechanisms to prevent malicious or low-quality nodes from providing falsified, outdated, or biased data, leading to a "garbage in, garbage out" situation, and even malicious poisoning of the model.

[0004] Second, the risk of privacy breaches remains. Although raw data is not transmitted, shared model parameter updates can still leak member data through reverse engineering attacks. Conventional encrypted transmissions cannot defend against insider attacks with access to the aggregation server.

[0005] Third, there is a lack of a credible collaborative governance framework. The parties lack the technical means to verify whether the other party is operating in compliance with regulations, making it difficult to build mutual trust and hindering in-depth collaboration.

[0006] Simply adding privacy computing technologies (such as differential privacy and homomorphic encryption) or introducing blockchain for evidence storage cannot systematically solve the aforementioned intertwined trust and security issues, and may bring unbearable computational overhead. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a method and system for drug development using a federated data network based on multi-level security and authenticity verification. This invention is not a simple aggregation of existing technologies, but rather employs an innovative integrated "technology-governance" architecture that deeply collaborates with trusted execution environments, homomorphic encryption, differential privacy, and blockchain to simultaneously address the issues of data authenticity verification, strong privacy protection, and trusted collaboration within acceptable overhead.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] This invention first proposes an on-chain verification mechanism based on dynamic dual commitments, which is the core of solving the data authenticity problem. In each training round, each data node not only commits to its output (parameter updates) but also to its input (the characteristics of the data used). This "data-computation" dual commitment is permanently recorded on the blockchain. If there is any doubt about the model's performance or behavior, any participant can initiate a challenge-response audit based on the on-chain record, requiring the suspicious node to provide proof of data characteristics and computational credentials. This mechanism transforms ex-post, unverifiable trust into in-process, verifiable technical constraints, fundamentally deterring and detecting data fraud.

[0010] Secondly, this invention designs a layered, collaborative secure computing architecture to balance security and performance. The innermost layer performs local training within a trusted execution environment, ensuring the confidentiality and integrity of code and data during computation. The middle layer selectively applies differential privacy noise to the parameter updates output by the TEE, defending against inference attacks based on the final model. The outermost layer uses homomorphic encryption to encrypt the (noisy) updates before transmission and aggregation, defending against attacks from the network and the aggregator. This layered design avoids the enormous computational burden of end-to-end homomorphic encryption, confining the most time-consuming homomorphic operations to the lightweight parameter aggregation stage, while placing the intensive model training within the efficient TEE.

[0011] Furthermore, the method specifically includes network setup, task definition and distribution, secure local computation and commitment, encrypted transmission, secure aggregation and verification, model update and iteration, and authenticity auditing steps.

[0012] This invention, through a combination of the aforementioned mechanisms, creates a transparent, auditable, and highly secure federated collaborative environment. Under the protection of these technical mechanisms, participating parties establish mutual trust, are willing to contribute high-quality data, and thus train superior AI models for tasks such as drug target discovery, compound screening, and property prediction. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the system architecture and core workflow provided in the embodiments of the present invention.

[0014] Figure 2 This is a detailed flowchart of steps 1 to 4 of the data node local secure computation and on-chain commitment in this embodiment of the invention.

[0015] Figure 3 This is a detailed flowchart of steps 5 to 9 of the data node local secure computation and on-chain commitment in this embodiment of the invention.

[0016] Figure 4 This is a flowchart of the auditing party verifying the authenticity of on-chain records, provided in an embodiment of the present invention. Detailed Implementation

[0017] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. These embodiments are not intended to limit the scope of protection of the present invention.

[0018] Example 1: Combined prediction of compound hepatotoxicity

[0019] This embodiment uses a cross-institutional joint training compound hepatotoxicity prediction model as an example.

[0020] 1. Network setup and task definition:

[0021] A national drug and medical device review agency, acting as the coordinating node, collaborated with two pharmaceutical companies (data nodes A and B) and a cloud computing service provider (technical support node C) to form a federated network. All parties agreed to use the same molecular graph neural network as the model architecture, with the objective of binary classification prediction (toxic / non-toxic). The federated agreement explicitly requires all data nodes to support SGX v2 technology and stipulates that the homomorphic encryption scheme is CKKS, and the aggregation algorithm is a weighted average.

[0022] 2. Secure Local Computing and Commitment (Core Innovation Steps):

[0023] Assume we are performing the t-th round of training. Data node A is located within its SGX enclave and uses a subset DA_t of the local hepatotoxicity dataset DA to train based on the global model Mt, calculating the model parameter update ΔWA_t.

[0024] Before ΔWA_t leaves the enclave, the client agent of node A executes:

[0025] a) Data Feature Commitment: Generate a data feature digest Hash_DA_t. Specifically, this involves concatenating the dataset identifier "Dataset_A", the current data volume |DA_t|, and the mean and variance of the molecular weights of compounds in DA_t, and then calculating the SHA-256 hash value.

[0026] b) Calculate the output commitment: Calculate the SHA-256 hash value Hash_ΔWA_t of the parameter update ΔWA_t.

[0027] c) On-chain notarization: Construct a commitment transaction Tx_Commit_A_t, Contains {"NodeID": "A", "Round": t, "Hash_Data": Hash_DA_t, "Hash_Update": Hash_ΔWA_t}, After signing, the transaction is broadcast to the consortium blockchain network. The transaction is then packaged and added to the blockchain by consensus nodes, generating a timestamp and block height.

[0028] 3. Encrypted transmission and secure aggregation:

[0029] Node A encrypts ΔWA_t using a homomorphic encryption public key (managed by node C) to obtain E(ΔWA_t), and sends it to node C. Node B performs a similar operation.

[0030] Node C, acting as the aggregator, performs a weighted average aggregation operation in the encrypted state:

[0031] E(ΔG_t) = (|DA_t| * E(ΔWA_t) + |DB_t| * E(ΔWB_t)) / (|DA_t|+|DB_t|)

[0032] After aggregation is complete, node C records the hash value Hash_ΔG_t of the aggregation result E(ΔG_t) on the chain.

[0033] 4. Model Updates and Iterations:

[0034] Node C distributes E(ΔG_t) to A and B. After decryption locally, both parties update their respective models: M_{t+1} = M_t - η * ΔG_t (where η is the learning rate). Steps 2-4 are repeated until the model converges.

[0035] 5. Example of authenticity audit:

[0036] Later, the coordinating node discovered a systematic bias in the model's predictions for a certain class of compounds, suspecting that node B had provided biased data in recent rounds. The coordinating node, acting as the validator, performed an audit:

[0037] a) Obtain Hash_DB_r and Hash_ΔWB_r from the commitment transaction of blockchain query node B in round r.

[0038] b) Issue a challenge to node B, requesting it to provide proof of the statistical characteristics of the data subset DB_r used in round r (such as a data digest report signed by the SGX enclave) and the parameter update ΔWB_r for that round.

[0039] c) The coordinating node verifies whether the data digest report provided by node B matches Hash_DB_r. Simultaneously, it recalculates the hash value of ΔWB_r and checks if it matches Hash_ΔWB_r. If either verification fails, node B is deemed to have violated the rules in this round, and penalties are imposed according to the federated protocol.

[0040] Analysis of computational overhead and practicality:

[0041] The overhead of the system of this invention mainly comes from: 1) model training within the TEE; 2) homomorphic encryption / decryption and ciphertext aggregation; 3) blockchain transactions.

[0042] 1) TEE training overhead: This is the inherent overhead of model training itself. When training with a modern CPU (such as Intel Xeon with SGX support), the performance loss is usually between 20% and 50% compared to an unsafe environment. This is acceptable for drug model training cycles of several hours to several days, in exchange for the absolute safety of local data.

[0043] 2) Homomorphic Encryption Overhead: This is the main performance bottleneck. The key is that this invention only encrypts and aggregates ciphertext for model updates (e.g., gradient tensors ranging from a few MB to several hundred MB), rather than encrypting the entire training process or the original data (which can reach TB levels). Taking the CKKS scheme as an example, encrypting a floating-point vector and performing a single multiplication-addition operation can be completed in milliseconds to seconds on modern servers. The aggregation operation is a lightweight vector operation, not a complex model forward / backward propagation. Therefore, the additional overhead introduced by homomorphic encryption is strictly limited to the communication and aggregation stages and will not exponentially increase the overall training time. Experiments show that with 100 Mbps bandwidth, the increased latency per round due to encrypted communication is in the order of seconds.

[0044] 3) Blockchain overhead: Each node submits only one micro-transaction per round, containing two hash values ​​(64 bytes in total), and the aggregator submits one aggregate verification transaction. In a permissioned blockchain environment (such as Hyperledger Fabric), the processing speed of such transactions can reach thousands of transactions per second with extremely low latency, and the impact on the interval between federated learning rounds (usually on the order of minutes) is negligible.

[0045] Conclusion: The layered security design of this invention places the heaviest computation (training) in an efficient TEE, restricts the heaviest cryptographic operations (homomorphism) to small-scale data aggregation, and anchors trust to a low-overhead blockchain. This design makes the overall overhead of this complex system feasible and cost-effective for high-value, long-cycle AI drug development projects, while pursuing ultimate security and authenticity. Sacrificing some performance for data sovereignty protection and collaborative trust is a strong requirement in the special field of drug development.

[0046] Example 2: Equipment Implementation

[0047] The electronic device implementing the above method includes a processor, memory, a communication module, and optional trusted execution environment hardware (such as an Intel SGX-enabled CPU). The memory stores program instructions, which, when executed by the processor, implement the functions of each node. The data node device also needs to be equipped with sufficient storage to accommodate a local private database.

[0048] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for drug development using a federated data network based on multi-level security and authenticity verification, characterized in that, Includes the following steps: Network setup steps: Establish a federated data network, which includes a coordinating node, at least two data nodes, and at least one technical support node; Each node joins after being authenticated, and a federation protocol is reached that includes model structure, security protocols and verification rules; Task definition and distribution steps: The coordination node defines a federated learning task based on the drug development goals. The task includes a model architecture M, a loss function L, an aggregation algorithm F, and a convergence condition C. The task configuration information is then distributed to each data node. Secure local computation and commitment steps: Each data node performs local training based on private drug data Di in its local trusted execution environment to obtain local model parameter updates ΔWi; calculates the feature summary Hash_Di of the private drug data Di in this round of training, and the hash value Hash_ΔWi of the parameter update ΔWi; and submits the commitment transaction containing Hash_Di and Hash_ΔWi to the blockchain associated with the federated network. Encrypted transmission steps: Each data node performs homomorphic encryption on the parameter update ΔWi to obtain E(ΔWi), and sends E(ΔWi) to the technical support node; Secure aggregation and verification steps: In encrypted state, the technical support node uses the aggregation algorithm F to aggregate all received E(ΔWi) to obtain an encrypted global update E(ΔG); the technical support node generates an aggregation verification transaction and submits it to the blockchain, the aggregation verification transaction containing the hash value of E(ΔG); Model update and iteration steps: Distribute E(ΔG) back to each data node, and each data node decrypts and updates its local model; repeat the secure local computation and commitment steps to the model update and iteration steps until the convergence condition C is met, and obtain the final federal drug development model; Authenticity audit steps: At any time, the verifier queries the commitment transactions and aggregated verification transactions recorded on the blockchain and requests the data nodes to provide corresponding auxiliary verification information to cross-verify the data authenticity and computation authenticity of any data node in any round.

2. The method according to claim 1, characterized in that, In the secure local computation and commitment step, the feature summary Hash_Di is generated in the following way: the hash value is calculated after encoding the subset identifier, data size and key statistical features of the private drug data Di used for this round of training.

3. The method according to claim 1, characterized in that, The secure local computation and commitment steps further include: after obtaining the local model parameter update ΔWi, adding noise that satisfies the differential privacy mechanism to ΔWi according to the preset privacy budget parameter ε to obtain the noisy parameter update ΔW'i, and using ΔW'i as the object of subsequent encryption and commitment.

4. The method according to claim 1, characterized in that, In the secure aggregation and verification step, the aggregation algorithm F is a weighted average algorithm, specifically: E(ΔG) = Σ (|Di| * E(ΔWi)) / Σ |Di|, where |Di| is the amount of data used by data node i in this round of training.

5. The method according to claim 1, characterized in that, The authenticity audit steps specifically include: The verifier obtains the commitment transactions of the target data node in the target round from the blockchain and extracts Hash_Di and Hash_ΔWi; The verification direction requests the target data node the plaintext or verifiable computational credentials of the data feature proof Proof_Di and parameter update ΔWi corresponding to this round. The verifier checks whether Proof_Di matches Hash_Di and whether the hash value of the parameter update ΔWi matches Hash_ΔWi.

6. The method according to claim 1, characterized in that, The drug development goals include: predicting compound activity, evaluating drug properties, predicting drug-target interactions, or generating de novo molecules.

7. A system for implementing the method according to any one of claims 1-6, characterized in that, include: Coordinating node servers are used to manage federated network members and define and distribute federated learning tasks; Multiple data node servers, each data node server is deployed with trusted execution environment hardware, a local database, and a client agent configured to perform the secure local computation and commitment steps and the encrypted transmission steps; The technical support node server is equipped with a homomorphic encryption operation module and is configured to perform the security aggregation and verification steps. The blockchain network, jointly maintained by nodes in the federated network or external trusted nodes, is used to store the commitment transactions and the aggregated verification transactions.

8. An electronic device comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.

Images