A privacy protection asynchronous federated learning method based on multi-label function encryption

Abstract

The application discloses a privacy protection asynchronous federated learning method based on multi-label function encryption, which comprises the following steps: a client generates function encryption public parameters based on a fault-tolerant learning problem on a ring and respective secret information; the client receives a current global model and uses local data for training; then, the client uses the secret information and an encryption label corresponding to the local training time to perform function encryption on the local model update; a server selects encryption model updates meeting requirements to participate in aggregation, and sets a common decryption label according to the encryption labels of the encryption model updates participating in aggregation; the client generates a partial function decryption key bound with the aggregation weight, the encryption label and the decryption label, calculates a weighted aggregation result by using the encryption model update and the partial function decryption key, and issues the aggregation result to the client for next round training. The application can avoid a trusted third party, reduce the risk of privacy leakage, and ensure the accuracy of the model and reduce the calculation or communication overhead.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, and in particular to a privacy-preserving asynchronous federated learning method based on multi-label function encryption. Background Technology

[0002] Federated learning is a commonly used distributed machine learning approach. Multiple clients can keep their data locally, only uploading model updates, which are then aggregated by the server to obtain a new global model. This reduces the privacy risks associated with the centralized transmission of raw data.

[0003] Traditional federated learning typically employs a synchronous approach. In each training round, the server must wait for all selected clients to upload their results before it can aggregate them. If some clients are slow, have poor network connectivity, or are temporarily offline, the entire training process will be slowed down. These slow clients are often referred to as lagging clients.

[0004] Asynchronous federated learning can alleviate the above problems. The server can aggregate updates at the appropriate time after receiving them from clients, without waiting for all clients. However, the asynchronous approach introduces new issues: some clients upload updates trained on older global models, which are outdated and may reduce model accuracy and convergence stability if used directly.

[0005] On the other hand, model updates themselves can also leak privacy. Attackers could potentially deduce the client's training data by analyzing gradients or model parameters. Therefore, privacy-preserving federated learning needs to perform aggregation without exposing local data and local model updates.

[0006] Existing privacy protection schemes include differential privacy, homomorphic encryption, secure multi-party computation, and function encryption. Differential privacy introduces noise, which may affect model accuracy; homomorphic encryption and secure multi-party computation often have high computational or communication overhead; while traditional function encryption is suitable for encrypted aggregation, many schemes rely on trusted third parties or require the same label to be used for ciphertext in the same round, making it difficult to directly adapt to asynchronous federated learning.

[0007] Furthermore, the development of quantum computing also requires privacy protection schemes to adopt cryptographic foundations with quantum-resistant security potential as much as possible.

[0008] Therefore, there is a need for an asynchronous federated learning method that is suitable for function encryption methods, can protect the privacy of model updates, has the potential for quantum security, and can avoid reliance on trusted third parties. Summary of the Invention

[0009] The purpose of this invention is to overcome the shortcomings of the prior art and provide an asynchronous federated learning method that is suitable for function encryption methods, can protect the privacy of model updates, has the potential for quantum security resistance, and can avoid reliance on trusted third parties.

[0010] To achieve the above objectives, the present invention provides the following technical solution:

[0011] During system initialization, multiple clients participating in federated learning jointly generate function encryption public parameters and their respective secret information based on the fault-tolerant learning problem on rings;

[0012] Local training and model processing: Each client receives the current global model, trains it using local data, and obtains local model updates; it also quantizes the floating-point local model updates into integer form and generates a session mask to cover intermediate results;

[0013] The model update is encrypted. The client uses its own secret information and an encrypted tag corresponding to the local training time to encrypt the local model update execution function after adding a mask and quantization, and obtains the encrypted model update. The client then sends the encrypted model update, the corresponding training time information, and the public auxiliary information required for random number or mask recovery to the server.

[0014] Asynchronous collection and selection: The server continuously receives encrypted model updates uploaded by clients; in each global model aggregation iteration, the server calculates the newness of the encrypted model update based on the client's update time information, selects the latest encrypted model update from the currently online clients that meets the newness threshold as the encrypted model update to participate in the aggregation, and sets a common decryption tag based on the encryption tag of the encrypted model update participating in the aggregation.

[0015] Time-weighted secure aggregation: During each global model aggregation, the server calculates the weight of each encrypted model in the aggregation based on the freshness of the update, quantifies the aggregation weight, requests the client to generate a partial function decryption key bound to the aggregation weight, encryption tag, and decryption tag, and uses the encrypted model update and the partial function decryption key to calculate the weighted aggregation result in ciphertext.

[0016] The server sends the masked aggregation results and weight information to the client. The client reconstructs the session mask based on the public auxiliary information, removes the mask from the aggregation results, and dequantizes the integer aggregation results into a floating-point global model for the next round of training.

[0017] Preferably, the encrypted tag is identification information used by the client when encrypting local model updates, used to indicate the client, training time, or model version corresponding to the ciphertext. The relevant formula for the encrypted tag is as follows:

[0018]

[0019] in, For encrypted tags, To differentiate training tasks, For client number, Update the local model for a new round or version. Differentiate between duplicate uploads from the same source version. To identify the encrypted object or model blocks, Fresh, publicly available random numbers.

[0020] Preferably, the decryption tag is identification information used by the server during a weighted aggregation, used to indicate the current global model aggregation iteration or the current aggregation task. The relevant formula for the decryption tag is as follows:

[0021]

[0022] in, To decrypt the tag, To differentiate training tasks, To distinguish the period of group keys, For client number, Differentiate between duplicate uploads from the same source version. To identify the encrypted object or model blocks, Fresh, publicly available random numbers.

[0023] Preferably, the specific process for calculating the age of the updated encryption model is as follows:

[0024]

[0025] d represents the non-negative integer staleness of the update; Indicates the global model aggregation round or global model aggregation version; Indicates the client number; Indicates client The local model update round or local model update version.

[0026] Furthermore, the specific process of calculating the weight of each encryption model participating in the aggregation based on the freshness of its update is as follows:

[0027]

[0028]

[0029] d represents the non-negative integer staleness of the update; n represents the current global model aggregation round or global model aggregation version; Indicates the client number; Indicates the client The local model update round or local model update version; This represents the time decay weighting function. In the nth global model aggregation, the client... Normalized weights; This represents the unnormalized time decay weight function; This represents the set of participating clients that are not empty in this calculation; k represents the summation index of the clients in the denominator. This indicates the local model update round or version corresponding to this client; the denominator is... Normalize all unnormalized weights in the formula; when the denominator is non-zero, all weights participate in the client's calculation. The sum is 1.

[0030] Furthermore, the specific process of quantifying the aggregate weights is as follows:

[0031]

[0032] in, This represents the quantized aggregate weights or corresponding function vector components of client i. This indicates the current global model aggregation round or global model aggregation version. Indicates the client number. Indicates client i's local model update round or local model update version; This represents the time decay weighting function. This represents the positive weight precision coefficient used when converting real-time weights to the numerical domain supported by function encryption.

[0033] Preferably, the specific process of encrypting the local model update execution function after masking and quantization using its own secret information and encrypted tags corresponding to the local training time is as follows:

[0034]

[0035]

[0036]

[0037]

[0038] Where i is the client number, SK is the encryption tag for the client's ciphertext; Enc is the encryption algorithm for function encryption; i This represents the secret key held by client i; x i ct represents the model update vector of client i after quantization and the addition of a session mask; i,γi This indicates that client i is in label γ iThe generated ciphertext; H represents the input vector after adding the tag-related hash mask; H represents the collision-resistant hash function that maps the secret random variable and the encrypted tag to the mask vector; a represents the secret random variable of client i; i Represents ring R q The public random element in r; i f represents the random value used in this encryption; i,0 and f i pk represents the noise sampled in the error distribution. i Represents the underlying public key of client i; q represents the ring modulus; K represents the scaling parameter greater than the upper bound of the final plaintext result; 1 R The unit element representing the polynomial ring; ct i,0 and ct i These represent the scalar and vector components of the ciphertext, respectively.

[0039] Furthermore, the specific process of generating the partial function decryption key is as follows:

[0040]

[0041]

[0042]

[0043]

[0044]

[0045] in, Encryption tags for client-side ciphertext. This is the decryption tag for this aggregation task; KeyGen represents the decryption key generation algorithm for some functions; SK i y represents the secret key of client i; y represents the complete function vector or weight vector divided into blocks according to client order. i It is a block that matches the input vector dimension of client i; γ represents the complete encrypted label configuration, γ i It is the encrypted tag corresponding to client i; This indicates the decryption tag used in this aggregation task; This indicates that client i is relative to y, γ, and The generated partial function decryption key; s i,t Let s represent the t-th component of the underlying MIFE secret vector of client i. i,yi Indicates dividing y into blocks according to a function iThe standard key component obtained by linear combination; t represents the vector dimension index; ⊥ indicates that the underlying interface does not return a valid second component at this position; This indicates the client i and the target decryption tag. Binding cancellation mask; PRG represents pseudo-random generator; k i,j This represents the shared key established between client i and client j; u i This represents the secret mask vector of the underlying MIFE; This represents the label-related mask correction component of client i; MIFE.KeyGen represents the underlying multi-input function encryption key generation algorithm.

[0046] Furthermore, the process of calculating the weighted aggregation result in the encrypted state is as follows:

[0047]

[0048]

[0049]

[0050]

[0051]

[0052] Dec represents the aggregate decryption algorithm for multi-label function encryption; m represents the total number of registered clients, and [m] represents the set of client IDs; ct i,γi This indicates that client i is in the encrypted tag γ i The generated ciphertext; represents the decryption key for the corresponding partial function; z represents the aggregate result calculated by the authorization function; This represents the aggregated value of all client-side tag-related mask correction components; D i D represents the local decryption ring element formed by the ciphertext of client i and the function block; D represents merging all D i And the ring element obtained after subtracting the mask correction term; R q Represents a polynomial ring modulo q; ct i,0 and bold ct i These are the two components of the client's ciphertext; s i,yi Representation of function block y i The corresponding standard key components; x represents the input vector connected in client order; y represents the complete function vector; 1 R The unit element represents the polynomial ring; z is extracted from D.

[0053] Furthermore, when performing the weighted aggregation operation, the encryption tag of each ciphertext must be consistent with the encryption tag bound to the corresponding partial function decryption key, and all partial function decryption keys must also share the same decryption tag.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] 1. This invention extends the existing tagged construction method, in which the same label simultaneously constrains the ciphertext combination and the function key, to a two-layer binding method where each historical ciphertext maintains an independent encryption label and uses a common decryption label for each aggregation, thereby supporting secure asynchronous combination of ciphertexts from different source model versions.

[0056] 2. This invention has the potential to resist quantum security. The core function encryption scheme is based on the fault-tolerant learning problem on rings, generating encrypted ciphertext with the potential to resist quantum security, which can meet the privacy protection federated learning scenarios for future security needs.

[0057] 3. This invention combines function encryption with asynchronous federated learning, with clients generating and using keys in a distributed manner, reducing the single point of failure risk brought by centralized key institutions, avoiding trusted third parties, reducing the risk of privacy leakage, and performing quantization operations to ensure model accuracy and reduce computational or communication overhead.

[0058] 4. This invention can be used for multiple clients to jointly train machine learning models without having to hand over local data or local model updates in plaintext to the server. Each client first establishes a decentralized multi-client function encryption key, and then quantizes, masks, and encrypts the model updates after local training. The server can only obtain the masked aggregated results and cannot see individual client models or the final global model directly. This can reduce synchronous waiting, improve the efficiency of asynchronous federated learning, protect privacy during the training process, and has the potential for decentralization and quantum security. Attached Figure Description

[0059] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0060] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Among them:

[0061] Figure 1 This is a flowchart illustrating a privacy-preserving asynchronous federated learning method based on multi-label function encryption according to the present invention. Detailed Implementation

[0062] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0063] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or wireless coupling. The term “and / or” as used herein includes all or any units and all combinations of one or more associated listed items.

[0064] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0065] Those skilled in the art will understand that the terms "client," "terminal," and "terminal device" as used herein include both devices that receive wireless signals, devices that only possess wireless signal receiver capabilities without transmission capabilities, and devices with receiving and transmitting hardware, devices that have receiving and transmitting hardware capable of bidirectional communication over a bidirectional communication link. Such devices may include: cellular or other communication devices such as personal computers or tablets, having single-line displays, multi-line displays, or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service) that can combine voice, data processing, fax, and / or data communication capabilities; PDA (Personal Digital Assistant) that may include radio frequency receivers, pagers, internet / intranet access, web browsers, notepads, calendars, and / or GPS (Global Positioning System) receivers; and conventional laptops and / or handheld computers or other devices that have and / or include radio frequency receivers. As used herein, "client," "terminal," and "terminal device" can be portable, transportable, installed in a means of transportation (air, sea, and / or land), or suitable and / or configured to operate locally and / or in a distributed manner, operating in any other location on Earth and / or in space. "Client," "terminal," and "terminal device" as used herein can also be a communication terminal, an internet access terminal, or a music / video playback terminal, such as a PDA, a MID (Mobile Internet Device), and / or a mobile phone with music / video playback capabilities, or a smart TV, set-top box, etc.

[0066] The hardware referred to by the names "server," "client," and "service node" in this application is essentially an electronic device with the equivalent capabilities of a personal computer. It is a hardware device with the necessary components revealed by the von Neumann architecture, such as a central processing unit (including an arithmetic logic unit and a control unit), memory, input devices, and output devices. The computer program is stored in its memory, and the central processing unit loads the program stored in the secondary storage into the main memory to run it, execute the instructions in the program, and interact with the input and output devices to complete specific functions.

[0067] It should be noted that the concept of "server" used in this application can also be extended to the case of server clusters. Based on the network deployment principles understood by those skilled in the art, the servers should be logically divided. Physically, these servers can be independent of each other but accessible through interfaces, or they can be integrated into a single physical computer or a computer cluster. Those skilled in the art should understand this flexibility and should not use it to constrain the implementation of the network deployment method in this application.

[0068] One or more of the technical features of this application, unless explicitly specified herein, can be deployed on a server and accessed by a client remotely calling the online service interface provided by the server, or can be directly deployed and run on a client for access.

[0069] Unless otherwise specified, the neural network models referenced or potentially referenced in this application may be deployed on a remote server and invoked remotely on the client, or deployed on a client with the capability to invoke directly. In some embodiments, when running on the client, the corresponding intelligence may be acquired through transfer learning in order to reduce the requirements on the client's hardware resources and avoid excessive consumption of the client's hardware resources.

[0070] Unless otherwise specified, all data involved in this application may be stored remotely on a server or on a local terminal device, as long as it is suitable for use by the technical solution of this application.

[0071] Those skilled in the art will understand that although the various methods in this application are described based on the same concept and thus present commonality among them, they can be performed independently unless otherwise specified. Similarly, the various embodiments disclosed in this application are all based on the same inventive concept; therefore, concepts expressed in the same way, as well as concepts that are appropriately changed for convenience but are expressed differently, should be understood equivalently.

[0072] Unless otherwise expressly stated, the various embodiments disclosed in this application can be combined in a cross-cutting manner to flexibly construct new embodiments, as long as such combination does not depart from the inventive spirit of this application and can meet the needs of the prior art or solve a certain deficiency in the prior art. Those skilled in the art should be aware of such modifications.

[0073] like Figure 1 As shown, an asynchronous federated learning method that is suitable for functional encryption methods, protects the privacy of model updates, has the potential for quantum security, and avoids dependence on trusted third parties is presented in the following steps:

[0074] During system initialization, multiple clients participating in federated learning jointly generate function-encrypted public parameters and their respective secret information based on the fault-tolerant learning problem on rings.

[0075] The proposed function encryption scheme based on the fault-tolerant learning problem on rings provides a security foundation resistant to quantum attacks and improves the efficiency of encryption, key generation, and aggregation computation through batch processing and fast polynomial operations. Batch processing refers to packaging multiple parameters in model updates into the same polynomial or the same set of ciphertexts for unified encryption and computation, thereby reducing the number of ciphertexts, keys, and communication overhead. Fast polynomial operations refer to using fast number theory transformations or similar fast algorithms to perform polynomial multiplication and convolution operations within the polynomial ring used in the fault-tolerant learning problem on rings, thereby reducing the computation time in the encryption, partial function decryption key generation, and ciphertext aggregation processes.

[0076] For local training and model processing, each client receives the current global model, trains it using local data, and obtains local model updates. The local model updates, which are in floating-point form, are quantized into integer form, and a session mask is generated to cover up intermediate results.

[0077] The client performs local training based on the current global model and local data, and adds a regularization term to the training objective to restrict the local model from deviating from the current global model; the corresponding local training objective can be expressed as:

[0078]

[0079] This indicates the target function with near-end regularization used for local training on the client side; This indicates the loss of local experience due to the absence of near-end items; This indicates that client j aggregates rounds based on the global model. The obtained local model; This represents the local training data of client j; λ represents the global model corresponding to the nth global model aggregation iteration; λ represents the non-negative regularization coefficient, used to control the penalty strength for the local model deviating from the current global model.

[0080] The model update is encrypted. The client uses its own secret information and an encrypted tag corresponding to the local training time to encrypt the local model update execution function after adding a mask and quantization, and obtains the encrypted model update. The client then sends the encrypted model update, the corresponding training time information, and the public auxiliary information required for random number or mask recovery to the server.

[0081] The encrypted tag is an identifier used by the client when encrypting local model updates. It represents the client, training time, or model version corresponding to the ciphertext. The relevant formula for the encrypted tag is as follows:

[0082]

[0083] in, For encrypted tags, To differentiate training tasks, For client number, Local model update rounds or local model update versions. Differentiate between duplicate uploads from the same source version. To identify the encrypted object or model blocks, Fresh, publicly available random numbers.

[0084] Encryption tag γ i The training task identifier sid, client number i, and local model update round or local model update version τ are used. i Upload serial number under the same source version Identify the encrypted object And the fresh, publicly available random numbers uploaded this time. Standardized encoding is performed in a fixed order. In this embodiment, all k components uploaded in the same instance share an encrypted tag indexed by source time; the scope description is further incorporated into the block numbering only when the specific implementation explicitly sets tags separately for each block. `sid` is used to distinguish training tasks, and `τ`... i The training source used to bind the ciphertext; the epoch used to distinguish the group key period; and the upload sequence number. and fresh random numbers This is used to distinguish duplicate uploads from the same client using the same source version. Canonical encoding should specify the type, length, and value for each field, and for collections, vectors, and scope information, specify the number of elements, dimensions, and order to avoid ambiguity caused by field concatenation. i Emphasis is placed on the client that generates the ciphertext. Emphasis on the client The source version or training time used; γ represents the complete label configuration arranged in client order.

[0085] This invention uses the encryption tag γ determined when the ciphertext is generated. i Common decryption tags determined during aggregation Separate and configure ordered encryption tags Γ U The participating collection, target version, function vector, and aggregate instance are all bound together. .

[0086] The decryption tag is an identifier used by the server during a weighted aggregation, representing the current global model aggregation iteration or the current aggregation task. The relevant formula for the decryption tag is as follows:

[0087]

[0088] in, To decrypt the tag, To differentiate training tasks, To distinguish the period of group keys, For client number, Differentiate between duplicate uploads from the same source version. To identify the encrypted object or model blocks, Fresh, publicly available random numbers.

[0089] Decrypting tags The training task identifier (sid), client number (i), group key epoch, and upload sequence number under the same source version are used. Identify the encrypted object And the fresh, publicly available random numbers uploaded this time. The encoding should be performed in a standardized order. Each client should recalculate γ from the original fields before generating the decryption key for any of the functions. i and Instead of directly trusting the tag string provided by the server.

[0090] The encrypted tag for the same ciphertext remains unchanged after upload; a new decrypted tag is used for each new target aggregation. When the participating collections, target versions, weight configurations, or aggregation instances change, the aggregation should be rebuilt. Regenerate all partial function decryption keys and do not use partial function decryption keys from the old instance for the new instance.

[0091] The specific process of encrypting the local model update execution function after masking and quantization using its own secret information and encrypted tags corresponding to the local training time is as follows:

[0092]

[0093]

[0094]

[0095]

[0096] Where i is the client number, SK is the encryption tag for the client's ciphertext; Enc is the encryption algorithm for function encryption; iThis represents the secret key held by client i; x i ct represents the model update vector of client i after quantization and the addition of a session mask; i,γi This indicates that client i is in label γ i The generated ciphertext; H represents the input vector after adding the tag-related hash mask; H represents the collision-resistant hash function that maps the secret random variable and the encrypted tag to the mask vector; a represents the secret random variable of client i; i Represents ring R q The public random element in r; i f represents the random value used in this encryption; i,0 and f i pk represents the noise sampled in the error distribution. i Represents the underlying public key of client i; q represents the ring modulus; K represents the scaling parameter greater than the upper bound of the final plaintext result; 1 R The unit element representing the polynomial ring; ct i,0 and ct i These represent the scalar and vector components of the ciphertext, respectively.

[0097] The x i This represents the model update vector of client i after quantization and the addition of a session mask, where x represents the vector. i Specifically, it can be expressed as ;in, The random number uploaded this time The exported session mask has the following expression: ; This indicates that client j updates the round based on this local model. The resulting local model update; therefore, the specific expression for the Enc encryption algorithm is:

[0098]

[0099] Where j represents the client number; Indicates the local model update round of client j; k represents the model or encoded component index; This indicates the local model update obtained by client j based on this local model update round; express The ciphertext, Represents the k-th component; Enc represents the multi-label function encryption algorithm; This represents the secret key of client j; This represents the random number uploaded this time; PRF represents the pseudo-random function. This indicates that the random number is generated by the random number. Exported session mask; This indicates the encrypted tag associated with this upload.

[0100] Asynchronous collection and selection: The server continuously receives encrypted model updates uploaded by clients; in each global model aggregation iteration, the server calculates the age of the encrypted model update based on the client's update time information, selects the latest encrypted model update from the currently online clients that meets the age threshold as the encrypted model update to participate in the aggregation, and sets a common decryption tag based on the encryption tag of the encrypted model update participating in the aggregation.

[0101] The server continuously receives encrypted updates uploaded by clients. The server records the time information for each update. During the nth global model aggregation, the server calculates the age of each update. If an update is too old, it is not used; if it is still within the allowable range, it is included in this aggregation.

[0102] The specific process for calculating the age of the updated encryption model is as follows:

[0103]

[0104] d is the updated non-negative integer staleness; This refers to either the global model aggregation round or the global model aggregation version. Indicates the client number; Indicates client The local model update round or local model update version.

[0105] During each global aggregation, the server calculates the freshness of each encrypted model based on its training time; if the... In a global iteration, if an update comes from the tau-th training iteration, its freshness is d = n - tau. This tau-th training iteration can also be represented as... , used to represent the client The local update corresponds to the update round or training round; check if d is lower than the preset staleness threshold. If it is lower than the preset staleness threshold, the local model has been updated for too long and will not be used; if it is higher than the preset staleness threshold, the local model is updated relatively recently and can be used.

[0106] In time-weighted secure aggregation, the server calculates the weight of each encrypted model in the aggregation based on the freshness of the update during each global model aggregation, quantifies the aggregation weight, requests the client to generate a partial function decryption key bound to the aggregation weight, encryption label, and decryption label, and uses the encrypted model update and the partial function decryption key to calculate the weighted aggregation result in ciphertext.

[0107] The specific process of generating the decryption key for the partial function is as follows:

[0108]

[0109]

[0110]

[0111]

[0112]

[0113] in, Encryption tags for client-side ciphertext. This is the decryption tag for this aggregation task; KeyGen represents the decryption key generation algorithm for some functions; SK i y represents the secret key of client i; y represents the complete function vector or weight vector divided into blocks according to client order. i It is a block that matches the input vector dimension of client i; γ represents the complete encrypted label configuration, γ i It is the encrypted tag corresponding to client i; This indicates the decryption tag used in this aggregation task; This indicates that client i is relative to y, γ, and The generated partial function decryption key; s i,t Let s represent the t-th component of the underlying MIFE secret vector of client i. i,yi Indicates dividing y into blocks according to a function i The standard key component obtained by linear combination; t represents the vector dimension index; ⊥ indicates that the underlying interface does not return a valid second component at this position; Indicates the client i and the target decryption tag Binding cancellation mask; PRG represents pseudo-random generator; k i,j This represents the shared key established between client i and client j; u i This represents the secret mask vector of the underlying MIFE; This represents the label-related mask correction component of client i; MIFE.KeyGen represents the underlying multi-input function encryption key generation algorithm.

[0114] The decryption key for some functions is a key component generated by the client based on its own secret key, aggregation weight, corresponding encryption tag and decryption tag, which is used to participate in the ciphertext aggregation calculation on the server side.

[0115] The server sets aggregation weights according to 'd', with newer updates receiving higher weights and older updates receiving lower weights. Updates exceeding a preset threshold are excluded from aggregation or have their weights reset to zero. The weights can be set to 2 raised to the power of -d, or other functions that decrease as 'd' increases. This approach utilizes available information from slow or delayed clients while minimizing the impact of outdated updates on the global model.

[0116] The specific process for calculating the weight of each encryption model for aggregation based on the freshness of its update is as follows:

[0117]

[0118]

[0119] d represents the non-negative integer staleness of the update; n represents the current global model aggregation round or the current global model aggregation version; Indicates the client number; Indicates the client The local model update round or local model update version; This represents the time decay weighting function. In the nth global model aggregation, the client... Normalized weights; This represents the unnormalized time decay weight function; This represents the set of participating clients that are not empty in this calculation; k represents the summation index of the clients in the denominator. This indicates the local model update round or version corresponding to this client; the denominator is... Normalize all unnormalized weights in the formula; when the denominator is non-zero, all weights participate in the client's calculation. The sum is 1.

[0120] Furthermore, the specific process of quantifying the aggregate weights is as follows:

[0121]

[0122] in, This represents the quantized aggregate weights or corresponding function vector components of client i. This indicates the current global model aggregation round or global model aggregation version. Indicates the client number. Indicates the client i's local model update round or local model update version; This represents the time decay weighting function. This represents the positive weight precision coefficient used when converting real-time weights to the numeric domain supported by the function encryption. The implementation should employ a predefined deterministic rounding rule and use the same rounding on all clients in the same aggregation. And rounding rules.

[0123] The quantized weights are used for calculating the encrypted inner product of the function, enabling the server to perform aggregation equivalent to the plaintext weighted average in the ciphertext state.

[0124] The process of calculating the weighted aggregation result in the encrypted state is as follows:

[0125]

[0126]

[0127]

[0128]

[0129]

[0130] Dec represents the aggregate decryption algorithm for multi-label function encryption; m represents the total number of registered clients, and [m] represents the set of client IDs; ct i,γi This indicates that client i is in the encrypted tag γ i The generated ciphertext; represents the decryption key for the corresponding partial function; z represents the aggregate result calculated by the authorization function; This represents the aggregated value of all client-side tag-related mask correction components; D i D represents the local decryption ring element formed by the ciphertext of client i and the function block; D represents merging all D i And the ring element obtained after subtracting the mask correction term; R q Represents a polynomial ring modulo q; ct i,0 and bold ct i These are the two components of the client's ciphertext; s i,yi Representation of function block y i The corresponding standard key components; x represents the input vector connected in client order; y represents the complete function vector; 1 R The unit element represents the polynomial ring; z is extracted from D.

[0131] The specific expression for the aggregate decryption algorithm Dec, which is used for multi-tag function encryption, is as follows:

[0132]

[0133]

[0134] Dec1 represents the first-stage aggregation decryption algorithm; n, j, and k represent the global model aggregation iteration, participating clients, and model components, respectively. This indicates the selected local model update version for client j; This indicates the corresponding local model update; This indicates that the local model updates the corresponding ciphertext, which is equivalent to ;dk represents the partial function decryption key; E(m,noise) represents the noisy intermediate loop code; bold x and bold y represent the input vector and function vector, respectively; key i,γi `noise` represents the tag-related session mask; `noise` represents the RLWE error term. The output is the k-th aggregated component with the session mask. This is equivalent to merging all D. i The ring element D is obtained after subtracting the mask correction term; This is equivalent to the aggregation result z obtained by the authorization function.

[0135]

[0136] Dec2 represents the second-stage final decoding algorithm executed by the client; n represents the global model aggregation round; j represents the participating client number; k represents the model block, parameter component, or ring coding component index; This indicates the server output of the aggregated results with session masks. This represents the k-th integer plaintext model component after demasking and final decoding, which is equivalent to the aggregation result z calculated by the authorization function; This represents the quantization weights belonging to client j in the complete aggregation function vector; This indicates that the server is the local model update version selected by client j; This represents the reconstructed session mask uploaded by client j for the updated version of the local model. The client obtains the final decoded input after subtracting the weighted session mask used in the update.

[0137] When performing the weighted aggregation operation, the encryption tag of each ciphertext must be consistent with the encryption tag bound to the corresponding partial function decryption key, and all partial function decryption keys must also share the same decryption tag.

[0138] The ciphertext uploaded by different clients is allowed to have different encryption tags, but the decryption keys of some functions in the same aggregation are all bound to the same decryption tag, and each decryption key of some functions also matches the encryption tag of its corresponding ciphertext; the server can only correctly complete the aggregation task when the encryption tag of the ciphertext, the encryption tag in the decryption key of some functions, and the decryption tag of this aggregation correspond to each other.

[0139] Throughout the server aggregation process, the server does not need to decrypt individual client model updates, nor can it directly see the final global model in plaintext. The server is only responsible for storing the ciphertext, selecting available updates, calculating weights, and performing ciphertext aggregation.

[0140] The server sends the masked aggregation results and weight information to the client. The client reconstructs the session mask based on the public auxiliary information, removes the mask from the aggregation results, and dequantizes the integer aggregation results into a floating-point global model for the next round of training.

[0141] The process of dequantizing the aggregation result in integer form to floating-point form is as follows:

[0142]

[0143] in, This represents the weighting precision coefficient.

[0144] This represents the nth floating-point global model after restoration; This represents the i-th integer aggregation model obtained after demasking and final decoding; prix represents the positive precision coefficients used for model parameter quantization; y j This represents the quantized aggregate weights of participating client j. This formula simultaneously performs dequantization and weight normalization, and the sum of the weights of participating clients must be non-zero.

[0145] The privacy-preserving asynchronous federated learning method based on multi-label function encryption proposed in this invention is applicable to asynchronous federated learning scenarios with slow clients, offline clients, or network latency. The server does not need to wait for all clients to complete the current round of training and can continue to advance the global model training by utilizing sufficiently new historical updates.

[0146] Experimental results show that the privacy-preserving asynchronous federated learning method based on multi-label function encryption provided in this invention can maintain near-non-privacy asynchronous federated learning model accuracy on datasets such as MNIST, Fashion-MNIST, and CIFAR-10; it can still maintain good robustness when there is a high proportion of slow clients; at the same time, compared with a variety of existing privacy-preserving federated learning schemes, this method has higher efficiency in encryption and decryption computation.

[0147] The above description is only a partial embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A privacy-preserving asynchronous federated learning method based on multi-label function encryption, characterized in that, Includes the following steps: During system initialization, multiple clients participating in federated learning jointly generate function encryption public parameters and their respective secret information based on the fault-tolerant learning problem on rings; Local training and model processing: Each client receives the current global model, trains it using local data, and obtains local model updates; it also quantizes the floating-point local model updates into integer form and generates a session mask to cover intermediate results; The model update is encrypted. The client uses its own secret information and an encrypted tag corresponding to the local training time to encrypt the local model update execution function after adding a mask and quantization, and obtains the encrypted model update. The client then sends the encrypted model update, the corresponding training time information, and the public auxiliary information required for random number or mask recovery to the server. Asynchronous collection and selection: The server continuously receives encrypted model updates uploaded by clients; in each global model aggregation iteration, the server calculates the newness of the encrypted model update based on the client's update time information, selects the latest encrypted model update from the currently online clients that meets the newness threshold as the encrypted model update to participate in the aggregation, and sets a common decryption tag based on the encryption tag of the encrypted model update participating in the aggregation. Time-weighted secure aggregation: During each global model aggregation, the server calculates the weight of each encrypted model in the aggregation based on the freshness of the update, quantifies the aggregation weight, requests the client to generate a partial function decryption key bound to the aggregation weight, encryption tag, and decryption tag, and uses the encrypted model update and the partial function decryption key to calculate the weighted aggregation result in ciphertext. The server sends the masked aggregation results and weight information to the client after the client responds. The client reconstructs the session mask based on publicly available auxiliary information, removes the mask from the aggregation result, and dequantizes the integer aggregation result into a floating-point global model for the next round of training.

2. The privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 1, characterized in that, The encrypted tag is an identifier used by the client when encrypting local model updates. It represents the client, training time, or model version corresponding to the ciphertext. The relevant formula for the encrypted tag is as follows: ； in, For encrypted tags, To differentiate training tasks, For client number, Update the local model for a new round or version. Differentiate between duplicate uploads from the same source version. To identify the encrypted object or model blocks, Fresh, publicly available random numbers.

3. The privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 1, characterized in that, The decryption tag is an identifier used by the server during a weighted aggregation, representing the current global model aggregation iteration or the current aggregation task. The relevant formula for the decryption tag is as follows: ； in, To decrypt the tag, To differentiate training tasks, To distinguish the period of group keys, For client number, Differentiate between duplicate uploads from the same source version. To identify the encrypted object or model blocks, Fresh, publicly available random numbers.

4. The privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 1, characterized in that, The specific process for calculating the age of the updated encryption model is as follows: ； d represents the non-negative integer staleness of the update; Indicates the global model aggregation round or global model aggregation version; Indicates the client number; Indicates client The local model update round or local model update version.

5. The privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 4, characterized in that, The specific process for calculating the weight of each encryption model for aggregation based on the freshness of its update is as follows: ； ； d represents the non-negative integer staleness of the update; n represents the current global model aggregation round or global model aggregation version; Indicates the client number; Indicates client The local model update round or local model update version; This represents the time decay weighting function. In the nth global model aggregation, the client... Normalized weights; This represents the unnormalized time decay weight function; This represents the set of participating clients that are not empty in this calculation; k represents the summation index of the clients in the denominator. This indicates the local model update round or version corresponding to this client; the denominator is... Normalize all unnormalized weights in the middle; When the denominator is non-zero, all participants in the client... The sum is 1.

6. The privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 5, characterized in that, The specific process of quantizing the aggregate weights is as follows: ； in, This represents the quantized aggregate weights or corresponding function vector components of client i. This indicates the current global model aggregation round or global model aggregation version. Indicates the client number. Indicates client i's local model update round or local model update version; This represents the time decay weighting function. This represents the positive weight precision coefficient used when converting real-time weights to the numerical domain supported by function encryption.

7. The privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 1, characterized in that, The specific process of encrypting the local model update execution function after masking and quantization using its own secret information and encrypted tags corresponding to the local training time is as follows: ； ； ； ； Where i is the client number, SK is the encryption tag for the client's ciphertext; Enc is the encryption algorithm for function encryption; i This represents the secret key held by client i; x i ct represents the model update vector of client i after quantization and the addition of a session mask; i,γi This indicates that client i is in label γ i The generated ciphertext; x̂ i U' represents the input vector after adding the tag-related hash mask; H represents the collision-resistant hash function that maps the secret random variable and the encrypted tag to the mask vector; u' i a represents the secret random variable of client i; i Represents ring R q The public random element in r; i f represents the random value used in this encryption; i,0 and f i pk represents the noise sampled in the error distribution. i Represents the underlying public key of client i; q represents the ring modulus; K represents the scaling parameter greater than the upper bound of the final plaintext result; 1 R The unit element representing the polynomial ring; ct i,0 and ct i These represent the scalar and vector components of the ciphertext, respectively.

8. The privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 7, characterized in that, The specific process of generating the decryption key for the partial function is as follows: ； ； ； ； ； in, Encryption tags for client-side ciphertext. This is the decryption tag for this aggregation task; KeyGen represents the decryption key generation algorithm for some functions; SK i y represents the secret key of client i; y represents the complete function vector or weight vector divided into blocks according to client order. i It is a block that matches the input vector dimension of client i; γ represents the complete encrypted label configuration, γ i It is the encrypted tag corresponding to client i; This indicates the decryption tag used in this aggregation task; This indicates that client i is relative to y, γ, and The generated partial function decryption key; s i,t Let s represent the t-th component of the underlying MIFE secret vector of client i. i,yi Indicates dividing y into blocks according to a function i The standard key component obtained by linear combination; t represents the vector dimension index; ⊥ indicates that the underlying interface does not return a valid second component at this position; This indicates the client i and the target decryption tag. Binding cancellation mask; PRG represents pseudo-random generator; k i,j This represents the shared key established between client i and client j; u i This represents the secret mask vector of the underlying MIFE; This represents the label-related mask correction component of client i; MIFE.KeyGen represents the underlying multi-input function encryption key generation algorithm.

9. A privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 8, characterized in that, The process of calculating the weighted aggregation result in the encrypted state is as follows: ； ； ； ； ； Dec represents the aggregate decryption algorithm for multi-label function encryption; m represents the total number of registered clients, and [m] represents the set of client IDs; ct i,γi This indicates that client i is in the encrypted tag γ i The generated ciphertext; represents the decryption key for the corresponding partial function; z represents the aggregate result calculated by the authorization function; This represents the aggregated value of all client-side tag-related mask correction components; D i D represents the local decryption ring element formed by the ciphertext of client i and the function blocks; D represents merging all D i And the ring element obtained after subtracting the mask correction term; R q Represents a polynomial ring modulo q; ct i,0 and bold ct i These are the two components of the client's ciphertext; s i,yi Representation of function block y i The corresponding standard key components; x represents the input vector connected in client order; y represents the complete function vector; 1 R The unit element represents the polynomial ring; z is extracted from D.

10. A privacy-preserving asynchronous federated learning method based on multi-label function encryption according to claim 9, characterized in that, When performing the weighted aggregation operation, the encryption tag of each ciphertext must be consistent with the encryption tag bound to the corresponding partial function decryption key, and all partial function decryption keys share the same decryption tag.

Images