Confidentially distributed machine learning

Abstract

A general aspect of the invention relates to a method involving a computer-implemented method for a federated learning process for the owner of a machine learning model, a computer-implemented method for a federated learning process for an orchestrator, a computer-implemented method for a federated learning process for a training client, and / or a computer-implemented method for a federated learning process for an aggregator.

Description

[0001] Description

[0002] Title CONFIDENTIAL DISTRIBUTED MACHINE LEARNING

[0003] State of the art

[0004] Federated (machine) learning can be viewed as a subset of distributed (machine) learning. In federated machine learning (see, for example, Priyanka Mary Mammen. 2021. Federated Learning: Opportunities and Challenges. In Proceedings of ACM Conference (Conference'17). ACM, New York, NY, USA, 5 pages; https: / / arxiv.org / pdf / 2101.05428.pdf), multiple devices, e.g., under the supervision of a central server, jointly learn a machine learning model such as an artificial neural network without sharing their private training data. Federated (machine) learning can therefore be used particularly where private training data cannot be shared for privacy reasons (e.g., in the healthcare or financial sectors, etc.).

[0005] In federated learning, local training procedures on participating devices generate local machine learning model updates, which are aggregated (i.e., combined) into a trained global machine learning model. An algorithm for secure aggregation is known, for example, from "SAFELearn: Secure Aggregation for Private FEderated Learning," Hossein Fereidooni et al., Cryptology ePrint Archive, Paper 2021 / 386; https: / / eprint.iacr.org / 2021 / 386.

[0006] Trusted Execution Environments (TEE) provide a secure or trusted runtime environment for applications. A well-known example of a TEE is Intel Software Guard Extensions (Intel SGX), see, for example, https: / / de.wikipedia.org / w / index.php?title=Software_Guard_Extensions&oldid=23 2528710. The concept of remote attestation is well-known in the context of trusted computing. This allows, for example, changes to a user's computer to be detected by authorized parties, see, for example, https: / / en.wikipedia.org / w / index.php?title=Trusted_Computing&oldid=115156559 4#Remote_attestation.

[0007] In cryptography, a zero-knowledge proof is a method by which one party (the prover) can prove to another party (the verifier) ​​that a given statement is true, while the prover avoids conveying any additional information other than the fact that the statement is actually true, see e.g. https: / / en.wikipedia.org / w / index.php?title=Zero- knowledge_proof&oldid=1152088705.

[0008] (Secure) multi-party computation (MPC) is also a subfield of cryptography with the goal of developing methods that allow parties to jointly compute a function over their input variables, while keeping these input variables secret. See, for example, https: / / en.wikipedia.org / w / index.php?title=Secure_multi- party_computation&oldid=1148234769. Cloud-native (secure) multi-party computation can be implemented, for example, using Carbyne Stack, see, for example, https: / / carbynestack.io.

[0009] This disclosure proposes measures to improve confidentiality in federal learning.

[0010] Disclosure of the invention

[0011] A first general aspect of the present disclosure relates to a computer-implemented method for federated learning for an owner of a machine learning model. The method comprises generating a first secret (s) and a first signature (sig(s)) based on a Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP). The method further comprises sending the first signature (sig(s)) to an orchestrator. The method further comprises uploading a fourth secret split of the first secret (s) to a cluster of the aggregator, resulting in a reference identifier (s_ref) for the first secret (s) on the cluster of the aggregator. The method further comprises providing a secure aggregation function (SecAgg(s_ref)) on the aggregator that is parameterized by the reference identifier (s_ref).The method further comprises starting a secret provisioning service configured to provide a network endpoint via which at least one training client, subject to successful attestation, can retrieve the first secret(s). The method further comprises uploading a first secret share of a first multi-party computation (MPC) representation (CS(G_i)) of a machine learning model (G_i) to the cluster of the aggregator, wherein a first identifier (ID(CS(G_i))) for the first MPC representation (CS(G_i)) of the machine learning model (G_i) on the cluster of the aggregator is sent to the owner. The method further comprises sending a first trigger signal comprising the first identifier (ID(CS(G_i))) to the orchestrator.The secret provisioning service can be a specialized, secure service within a federated learning system designed to provide a protected mechanism for transmitting sensitive information, especially secrets (such as cryptographic keys or tokens), to authorized participants of the system. This can be done under strict security conditions, with the authenticity and authorization of the requesting participants (e.g., training clients) being verified using robust verification methods such as remote attestation or zero-knowledge proofs. The orchestrator in a federated learning system can be a central control unit responsible for coordinating and managing the learning process across a distributed architecture of training clients.The Orchestrator initiates, monitors, and controls the various phases of the federated learning cycle, including the selection of training clients for learning iterations, the distribution of model updates, and the collection and secure aggregation of local model updates. It ensures compliance with security and privacy policies by ensuring that only authenticated and authorized participants can participate in the learning process. The Orchestrator plays a key role in ensuring the efficiency and security of federated learning by coordinating communication between the training clients and the aggregator without having direct access to the private training data or the specific content of the model updates.The aggregator in a federated learning system can be a specialized component responsible for merging the local machine learning model updates provided by the training clients to produce an updated global machine learning model. The aggregator uses secure and confidential methods, such as the secure aggregation function (SecAgg(s ref)), which is parameterized by the reference identifier (s ref) and points to a shared secret.

[0012] A second general aspect of the present disclosure relates to a computer-implemented method for federated learning for an orchestrator. The method comprises generating a second secret (S) and a second signature (sig(S)) based on a Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP). The method further comprises, for each training client (cj) of a plurality (C) of training clients (cj) for a training iteration, signing a random, training-client-specific token (tj) with the second secret (S) based on Schnorr NIZKP, resulting in a signed token (tJ_S). The method further comprises, for each training client (cj), sending the signed token (tJ_S) as a challenge to the respective training client (cj). The method further comprises, for each training client (cj), receiving a proof (pj) from the respective training client (cj).The method further comprises, for each training client (cj), verifying the signed token (tJ_S) encoded in the proof (pj) based on the second signature (sig(S)), and, if successfully verified, verifying the proof (pj) based on the first signature (sig(s)). The method further comprises admitting training clients (cj) whose proof (pj) has been successfully verified. The method further comprises sending a second trigger signal comprising a first identifier (ID(CS(G_i))) for a first MPC representation (CS(G_i)) of a machine learning model (G_i) on a cluster of an aggregator to each admitted training client (cj) of the plurality (C) of training clients (cj) for the training iteration when a first trigger signal comprising the first identifier (ID(CS(G_i))) has been received.The method further comprises sending a fourth trigger signal comprising a second identifier (ID(sJ)) for a chain expression (sj = (s, CS(L_iJ))) comprising a first secret (s) and a second MPC representation (CS(L_iJ)) of a local machine learning model update (LJJ) on the cluster of the aggregator to the aggregator if at least a third trigger signal comprising the second identifier (ID(sJ)) for the chain expression (sj = (s, CS(L_iJ))) has been received on the cluster of the aggregator. A third general aspect of the present disclosure relates to a computer-implemented method for federated learning for a training client (cj). The method comprises retrieving a first secret (s) from a network endpoint of a secret provision service of an owner of a machine learning model if an attestation of the training client is successful.The method comprises receiving a signed token (tJ_S) as a challenge from an orchestrator. The method further comprises, if the first secret (s) could be retrieved, signing the signed token (tJ_S) with the first secret (s), resulting in a proof (pj = sign(s, tJ_S). The method further comprises sending the proof (pj) to the orchestrator. The method further comprises, if the training client (cj) has been approved by the orchestrator, downloading a first MPC representation (CS(G_i)) of a machine learning model (G_i) from a cluster of an aggregator based on a first identifier (ID(CS(G_i))) when a second trigger signal comprising the first identifier (ID(CS(G_i))) has been received and the identity and authorization of the training client (cj) have been verified on the cluster of the aggregator.The method further comprises converting the first MPC representation (CS(G_i)) of the machine learning model into a local machine learning model according to a predetermined MPC protocol. The method further comprises training the local machine learning model based on local training data of the training client, wherein a local machine learning model update (LJ J) is generated. The method further comprises converting the local machine learning model update (L JJ) into a second MPC representation (CS(LJJ)) according to the predetermined MPC protocol. The method further comprises generating a chain expression (sj = (s, CS(LJJ))) comprising the first secret (s) and the second MPC representation (CS(LJJ)). The method further comprises uploading a second secret split of the chain expression (sj) to the cluster of the aggregator, wherein the training client (cj) is sent a second identifier (ID(sJ)) for the chain expression (sj) on the cluster of the aggregator.The method further comprises sending a third trigger signal comprising the second identifier (ID(sJ)) to the orchestrator.

[0013] A fourth general aspect of the present disclosure relates to a computer-implemented method for federated learning for an aggregator. The method comprises sending a first identifier (ID(CS(G_i))) for a first MPC representation (CS(G_i)) of a machine learning model (G_i) on a cluster of the aggregator to an owner of the machine learning model (GJ) when a first secret split of the first MPC representation (CS(G_i)) is uploaded to the cluster of the aggregator. The method further comprises sending a second identifier (ID(sJ)) for a chain expression (sj = (s, CS(L_iJ))) comprising a first secret (s) and a second MPC representation (CS(LJJ)) of a local machine learning model update (LJJ) on the cluster of the aggregator to a training client (cj) when a second secret split of the chain expression (sj = (s, CS(LJJ))) is uploaded to the cluster of the aggregator.The method further comprises, when a fourth trigger signal comprising a second identifier (ID(sJ)) for a chain expression (sj = (s, CS(L_iJ))) comprising a first secret (s) and a second MPC representation (CS(LJJ)) of a local machine learning model update (LJJ) is received on the cluster of the aggregator, executing a secure aggregation function (SecAgg(s ref)) provided by the owner of the machine learning model (GJ), which is parameterized by a reference identifier (s ref), wherein upon execution it is checked whether the chain expression (sj = (s, CS(LJJ))) comprises the secret according to the reference identifier (s ref).The method further comprises, if the chain expression (sj = (s, CS(LJJ))) includes the secret according to the reference identifier (s_ref), securely aggregating a local machine learning model update (LJJ) with at least one further local machine learning model update based on a predetermined MPC circuit, resulting in a third secret sharing of a third MPC representation (CS(G_(i+1))) for an aggregated machine learning model (G_(i+1)) on a cluster of the aggregator and a third identifier (ID(CS(G_(i+1)))) for the third MPC representation (CS(G_(i+1))). The method further comprises sending the third identifier (ID(CS(G_(i+1)))) to an orchestrator.

[0014] A fifth general aspect of the present disclosure relates to a method comprising the method according to the first general aspect, the method according to the second general aspect, the method according to the third general aspect and / or the method according to the fourth general aspect.

[0015] A sixth general aspect of the present disclosure relates to a device configured to carry out a method according to one of the preceding general aspects. A seventh general aspect of the present disclosure relates to a computer program configured to carry out a method according to one of the preceding general aspects.

[0016] An eighth general aspect of the present disclosure relates to a data carrier or signal containing / encoding the computer program according to the seventh general aspect.

[0017] In federated (machine) learning, a plurality, usually a multitude, of devices, which are referred to below as training clients, jointly train a (global) machine learning model, such as an (artificial) neural network. The training clients do not have to be subject to the same level of responsibility. Instead, training clients can be located in different locations and / or subject to different responsibilities. An exemplary but not exclusive scenario includes one (local) training client per clinic, whereby each clinic has (local) training data (e.g., clinical pictures, patient data, etc.) that it is not permitted to share with other clinics or instances, but is nevertheless willing to contribute to training the (global) machine learning model based on this respective (local) training data.In general, this can be achieved by providing each (local) training client with a (global) machine learning model and generating a (local) machine learning model update based on its (local) training data. For example, the (global) machine learning model is trained on a training client with the respective local training data. All (local) machine learning model updates are then aggregated by a central instance, which can be called an aggregator, resulting in a (global) machine learning model update and, in particular, a trained (global) machine learning model.

[0018] Since participating training clients keep their respective (local) training data to themselves and do not share it with third parties, federated learning is often considered a secure and privacy-friendly approach for training machine learning models with sensitive data.

[0019] However, it has been repeatedly shown (see, for example, Priyanka Mary Mammen. 2021. Federated Learning: Opportunities and Challenges. In Proceedings of ACM Conference (Conference'17). ACM, New York, NY, USA, 5 pages; https: / / arxiv.org / pdf / 2101.05428.pdf and Benmalek et al., Security of Federated Learning: Attacks, Defensive Mechanisms, and Challenges. Revue des Sciences et Technologies de I'lnformation - Serie RIA : Revue d'Intelligence Artificielle, 2022, 36 (1), pp. 49-59, 10.18280 / ria.360106, hal-0362040, https: / / hal.science / hal-03620400 / document) that conventional federated learning is far from being able to protect the confidentiality of local Training data must be fully ensured. In particular, the training data can be derived from machine learning model updates by a malicious aggregator.Furthermore, the global machine learning model may be vulnerable to inference attacks that aim to derive training data from output data of a (locally) trained machine learning model.

[0020] A confidentiality attack may include a membership inference attack, which aims to determine whether certain training data has been used during training by a training client. Alternatively or additionally, a confidentiality attack may include an attribute inference attack, which aims to derive meta-characteristics from training data of other training clients. Alternatively or additionally, a confidentiality attack may include a reconstruction attack, which aims to reconstruct training data and / or associated labels used during training. Thanks to the methods of the present disclosure, such confidentiality attacks on machine learning model updates can be at least made more difficult or prevented entirely. In addition to confidentiality, security can also be improved thanks to the methods of the present disclosure.In particular, the methods protect training clients from confidentiality attacks originating from a malicious aggregator and / or a malicious orchestrator, where the orchestrator is designed to coordinate federated learning.

[0021] Furthermore, the methods of the present disclosure protect the confidentiality of the (trained) machine learning model from training clients who wish to contribute local machine learning model updates. The methods of the present disclosure are therefore particularly suitable when the machine learning model is of high value or needs to be protected for other reasons.

[0022] In principle, to increase the reliability of the machine learning model, the entire training process could be performed by the training clients using multi-party computation (MPC). However, this would have major disadvantages: First, the advantage of local training data at the training clients would no longer apply, since the originally local training data would have to be sent to an MPC system. Second, MPC training would incur excessive computational effort and be prohibitively expensive.

[0023] Instead, the methods of the present disclosure implement a different approach that avoids these disadvantages while still protecting the machine learning model from the training clients. Training clients must authenticate themselves through a combination of zero-knowledge proofs and remote attestation to be allowed to contribute to federated learning. This, in turn, allows unauthenticated training clients to be excluded from federated learning. The aggregator verifies that only those machine learning model updates are accepted during secure aggregation whose training clients can prove knowledge of a (first) secret of the machine learning model's owner.By using zero-knowledge proofs to protect the (first) secret from a malicious orchestrator, this can prevent the malicious orchestrator from injecting machine learning model updates from unauthenticated training clients into the secure aggregation. Furthermore, the training clients can be executed in a confidential computing enclave (e.g., via Gramine). This protects the machine learning model from unauthorized access by the operators of the training clients.

[0024] Short description of the characters

[0025] Fig. 1a schematically illustrates a computer-implemented federated learning procedure for an owner of a machine learning model.

[0026] Fig. 1 b schematically illustrates a computer-implemented federated learning method for an orchestrator.

[0027] Fig. 1c schematically illustrates a computer-implemented method for federated learning for a training client.

[0028] Fig. 1d schematically illustrates a computer-implemented method for federated learning for an aggregator. Fig. 2 schematically illustrates a method comprising at least one method shown in Figs. 1a-d.

[0029] Fig. 3 schematically illustrates a machine learning model owner, an orchestrator, a training client, an aggregator, and, optionally, a tester.

[0030] Detailed description

[0031] The computer-implemented methods proposed in the present disclosure are executed in interaction between the following entities (see Fig. 3): a machine learning model owner, a plurality (usually a plurality) of training clients, an orchestrator, and an aggregator. A tester may also be used.

[0032] The owner of the (global) machine learning model has the rights to the (global) machine learning model, both in its initial and trained state. In particular, the owner can choose the machine learning model, i.e., its architecture (e.g., number of neurons, layers, neurons per layer, etc.). The owner is also the recipient of the federated trained machine learning model. In the methods of the present disclosure, the owner may be the only one with plaintext access to the (trained) machine learning model.

[0033] A training client cj of the plurality C (i.e., j = 1 to m) of training clients has (local) training data that should not be shared with third parties or may not be shared with third parties. A training client can be a device (e.g., a computer) within an organizational unit (e.g., a clinic) that has (local) training data.

[0034] The orchestrator 20 coordinates the federated learning by triggering actions on the training clients cj. Coordination includes, for example, selecting training clients to be used in the next training iteration, providing references to the initial and updated (i.e., trained) machine learning model, and / or evaluating the training progress in a training iteration. Furthermore, the orchestrator delegates the aggregation 40 of the machine learning model updates from the training clients to the aggregator. Due to communication via identifiers, the orchestrator never sees the machine learning model updates or the machine learning model itself.

[0035] The aggregator 40 comprises a (secure) multi-party computation (MPC) cluster, i.e., in particular, a plurality of devices (e.g., computers) designed for operations in the context of MPC. This means that each cluster member of the MPC cluster participates in the cluster's collective computations. The input of each individual cluster member comprises a secret share in a secret split of an overall input, such that no individual member learns the content of the overall input, the content of its own secret share, or the content of the shares of the other cluster members. The aggregator (i.e., the MPC cluster) receives the machine learning model updates from the training clients, computes the aggregated model update, and updates the global machine learning model accordingly.By using (secure) multi-party computation (MPC), the aggregator advantageously has no knowledge of the model updates and the global machine learning model.

[0036] The following conventions are used below:

[0037] G_i denotes a machine learning model, more precisely, an i-th version of the machine learning model (e.g., i = 0 to n-1). GO can, for example, be an initial machine learning model for performing the disclosed methods. GO can, for example, be an untrained machine learning model. Alternatively, GO can be a machine learning model previously trained by the disclosed methods or otherwise. G_i can, for example, be a data structure of the model parameters that define the machine learning model.

[0038] CS(x) for, e.g., x = G_i or LJJ denotes a multi-party computation (MPC) representation of x. Such a representation is invertible, i.e., x can be converted to the MPC representation CS(x) according to a predetermined MPC protocol, and the MPC representation CS(x) can also be converted to x according to the predetermined MPC protocol. CS(x) can, for example, be an MP-SPDZ / Carbyne stack representation.

[0039] ID(y) is an identifier for a secret share y stored on the aggregator's MPC cluster. In the case of Carbyne Stack, this can be done using, for example, Amphora services from cluster members. LJ J denotes a machine learning model update generated (locally) by a training client cj in an i-th training iteration (e.g., i = 0 to n-1). A machine learning model update can, for example, be a machine learning model updated through training.

[0040] First, a computer-implemented method 100 for federated learning for an owner 10 of a machine learning model is disclosed, schematically shown in Fig. 1 a.

[0041] The method 100 includes generating 120 a first secret s and a first signature sig(s) based on a Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP).

[0042] Furthermore, the method 100 comprises sending 121 the first signature sig(s) to an orchestrator 20.

[0043] Furthermore, the method 100 includes uploading 122 a fourth secret split of the first secret s to a cluster of the aggregator 40, resulting in a reference identifier s ref for the first secret s on the cluster of the aggregator 40. The first secret s stored on the cluster of the aggregator 40 can be accessed via the reference identifier, in particular by a provided 123 secure aggregation function.

[0044] Furthermore, the method 100 comprises providing 123 a secure aggregation function SecAgg(s_ref) on the aggregator 40, which is parameterized by the reference identifier s_ref. The secure aggregation function SecAgg(s_ref) can be based, for example, on the algorithm from SAFELearn, see above. By parameterizing the secure aggregation function SecAgg(s_ref) by the reference identifier, the aggregator can later check whether the training clients cj are permitted to upload their local machine learning model update to the cluster of the aggregator 40 after local training has been completed. The latter is only permitted if a training client cj successfully proves that it knows the first secret s, which thus corresponds to the secret retrievable under the reference identifier s_ref (secret according to the reference identifier s_ref).The secure aggregation function SecAgg(s_ref) can be a specially developed algorithm within a federated learning system designed to combine the machine learning model updates generated by different participants (training clients) in a way that preserves the confidentiality of the individual contributions. The secure aggregation function uses a reference identifier s_ref that points to a shared secret to ensure that only authorized updates are included in the aggregation.

[0045] Furthermore, the method 100 includes starting 124 a secret provisioning service (e.g., Gramine) configured to provide a network endpoint via which at least one training client cj can retrieve the first secret s, subject to successful attestation. A successful retrieval of the first secret s by a training client cj enables the training client cj to demonstrate knowledge of the first secret s when uploading its local machine learning model update.

[0046] The method 100 further comprises uploading 130 a first secret sharing of a first multi-party computation (MPC) representation CS(G_i) of a (e.g., initial) machine learning model G_i (e.g., GO) to the cluster of the aggregator 40, wherein the owner 10 is sent a first identifier ID(CS(G_i)) for the first MPC representation CS(G_i) of the machine learning model G_i on the cluster of the aggregator 40. The uploaded 130 machine learning model may be an initial, e.g., untrained machine learning model (e.g., GO). Alternatively, the uploaded 130 machine learning model may be a machine learning model GJ that has already been at least partially trained.

[0047] The method 100 further includes sending 131 a first trigger signal comprising the first identifier ID(CS(G_i)) to the orchestrator 20. The first trigger signal may, for example, consist only of the first identifier ID(CS(G_i)). The first trigger signal may cause the orchestrator 20 to execute the federated learning on the training client. An advantage of providing the machine learning model G_i as a secret share and otherwise only an identifier thereof may be that the orchestrator 20 does not receive the machine learning model itself. This may better ensure the confidentiality of the machine learning model.

[0048] The method 100 may further comprise converting 110 the (e.g., initial) machine learning model G_i into the first MPC representation CS(G_i) according to a predetermined MPC protocol.

[0049] The method 100 may further comprise downloading 140 a third MPC representation CS(G_(i+1)) of an aggregated machine learning model G_(i+1) from the cluster of the aggregator 40 based on a third identifier ID(CS(G_(i+1))) for the third MPC representation CS(G_(i+1)) of the aggregated machine learning model G_(i+1) on the cluster of the aggregator 40 when the third identifier ID(CS(G_(i+1))) has been received. The method 100 may then further comprise converting 141 the third MPC representation CS(G_(i+1)) of the aggregated machine learning model G_(i+1) into a global machine learning model according to the predetermined MPC protocol. Through steps 140 and 141, the owner of the machine learning model may retrieve the machine learning model in a trained state. In the case of, for example, n training iterations, CS(G_(n-1)) can be downloaded as the third MPC representation.

[0050] Also disclosed is a computer-implemented method 200 for federated learning for an orchestrator 20, schematically illustrated in Fig. 1 b.

[0051] The method 200 includes generating 220 a second secret S and a second signature sig(S) based on a Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP).

[0052] Furthermore, the method 200 then comprises, for each training client cj of a plurality C of training clients cj Q = 1 to m) for a training iteration, signing 221 a random, training client-specific token tj with the second secret S based on Schnorr NIZKP, wherein in each case) a signed token tJ_S results.

[0053] Furthermore, the method 200 then comprises, for each training client cj, sending 222 the signed token tJ_S as a challenge to the respective training client cj.

[0054] Furthermore, the method 200 then comprises, for each training client cj, receiving 223 a proof pj from the respective training client cj.

[0055] Furthermore, the method 200 then comprises, for each training client cj, verifying 224a the signed token tJ_S encoded in the proof pj on the basis of the second signature sig(S), and, if successfully verified, verifying 224b the proof pj on the basis of the first signature sig(s).

[0056] Furthermore, the method 200 then includes admitting 225 training clients cj whose proof pj has been successfully verified.

[0057] Steps 221 to 225 thus represent an authentication of training clients cj before they are allowed to contribute to federated learning. This allows training clients cj that could not be admitted to be blocked. This can prevent a potentially harmful influence on the trained machine learning model (e.g., through intentionally false training data from a training client that was inserted into the federated learning by a malicious orchestrator).

[0058] The method 200 further comprises sending 230 a second trigger signal comprising a first identifier ID(CS(G_i)) for a first MPC representation CS(G_i) of a machine learning model G_i on a cluster of an aggregator 40 to each approved 225 training client cj of the plurality C (usually even a plurality) of training clients cj for the training iteration when a first trigger signal comprising the first identifier (ID(CS(G_i))) has been received. The second trigger signal can prompt each approved 225 training client cj to execute a training iteration. The second trigger signal can, for example, consist only of the first identifier ID(CS(G_i)). In general, both the orchestrator and each training client cj only know the first identifier ID(CS(G_i)), but not the machine learning model G_i (or its MPC representation CS(G_i)). The latter is stored confidentially as a secret sharing on the cluster of the aggregator 40.

[0059] The method 200 may include selecting 210 the plurality / plurality C of training clients cj for the training iteration according to a predetermined selection strategy.

[0060] Furthermore, the method 200 comprises sending 231 a fourth trigger signal comprising a second identifier ID(sJ) for a chain expression sj = (s, CS(LJJ)) comprising a first secret s and a second MPC representation CS(L_iJ) of a local machine learning model update LJJ on the cluster of the aggregator 40 to the aggregator 40 if at least a third trigger signal comprising the second identifier ID(sJ) for the chain expression has been received on the cluster of the aggregator 40. The third trigger signal can, for example, consist only of the second identifier ID(sJ). Likewise, the fourth trigger signal can, for example, consist only of the second identifier ID(sJ). One advantage is that only an authorized 225 training client is able to form the chain expression sj comprising the (correct) first secret s.The chain expression sj can then be used to check later whether the machine learning model update generated by the training client may contribute to the secure aggregation 431.

[0061] The fourth trigger signal can be sent 231 if a further third trigger signal comprising a further second identifier ID(sJ) for a further chain expression sj = (s, CS(LJJ)) comprising a further first secret s (in terms of content, it should be the same as the first secret s for admission) and a further second MPC representation CS(LJJ) of a further local machine learning model update LJJ on the cluster of the aggregator 40 has been received from at least one further training client cj (for another j) of the plurality / plurality C of training clients cj for the training iteration, wherein the fourth trigger signal comprises the further second identifier ID(sJ).

[0062] The fourth trigger signal can in particular be sent 231 when a respective third trigger signal comprising a respective second identifier ID(sJ) for a respective further chain expression sj = (s, CS(LJJ)) comprising a respective first secret s and a respective second MPC representation CS(L_iJ) of a respective local machine learning model update LJ J on the cluster of the aggregator 40 has been received from each training client cj of the plurality / plurality C of training clients cj for the training iteration, wherein the fourth trigger signal comprises every second identifier ID(sJ) 0 = 1 to m).

[0063] The method 200 may further include checking 240, when a third identifier ID(CS(G_(i+1 ))) for a third MPC representation CS(G_(i+1)) of an aggregated machine learning model G_(i+1) has been received on the cluster of the aggregator 40, whether a further training iteration should be performed for the aggregated machine learning model G_(i+1).

[0064] The method 200 may then further comprise sending 241 the third identifier ID(CS(G_(i+1 ))) to an owner 10 of the machine learning model if no further training iteration is to be performed. Otherwise, the methods may be repeated for each further training iteration (e.g., n training iterations), wherein, for example, ID(CS(G_(n-1))) is returned as the third identifier to the owner 10 of the machine learning model.

[0065] Methods 100, 200, 300, 400, and 500 already protect the machine learning model against malicious training clients. Furthermore, they protect the machine learning model from being revealed to the orchestrator 20. However, there is still a potential risk that the orchestrator 20 could negatively influence the quality of the (trained) machine learning model through a maliciously biased selection of training clients. This can be prevented as follows:

[0066] The method 200 can be executed within a Trusted Execution Environment (TEE). This increases security, particularly because it prevents the orchestrator 20 from maliciously deviating from the method 200 and / or the intended method. Here, the owner 10 of the machine learning model can trust, for example, through remote attestation, that the orchestrator 20 adheres to the predetermined selection strategy. A maliciously biased selection of training clients can thus be prevented.

[0067] Furthermore, in method 200, logging can be performed in a trusted manner on an external storage device, optionally on a distributed ledger. This can also increase security, as processes can be traced retrospectively. Trustworthy logging can be implemented, for example, by asymmetrically encrypting log entries with a public key of the owner 10 of the machine learning model. Alternatively, the log entries can be encrypted with a private symmetric key agreed upon in advance by the orchestrator 20 and the owner 10 of the machine learning model.

[0068] Furthermore, in the method 200, the orchestrator 20 may cause 250 at least one training client cj to download the aggregated machine learning model G_(i+1) and to evaluate the quality of the aggregated machine learning model G_(i+1) based on local test data of the training client (according to a predetermined local test criterion), resulting in at least one second test result that is sent to the orchestrator 20.

[0069] The method 200 may then include receiving 251 the at least second test result.

[0070] The method 200 can then evaluate 252 the at least second test result as well as a first test result resulting from a tester 50 that is designed to evaluate the quality of the aggregated machine learning model G_(i+1) on the basis of local test data from the tester 50 (likewise according to a predetermined test criterion), wherein the evaluation is based on MPC or homomorphic encryption, resulting in an evaluation result. The method 200 can then comprise executing 253 one or more predetermined actions depending on the evaluation result. A predetermined action can, for example, consist in omitting further training iterations because the evaluation result is already satisfactory. Alternatively, a predetermined action can, for example, also consist in switching to another predetermined selection strategy for the training clients.

[0071] Also disclosed is a computer-implemented method 300 for federated learning for a training client cj, schematically illustrated in Fig. 1c.

[0072] The method 300 includes retrieving 310 a first secret s from a network endpoint of a secret provisioning service (e.g., Gramine) of an owner 10 of a machine learning model if an attestation of the training client is successful. If, for example, remote attestation fails, the first secret s cannot be retrieved. In this case, for example, there is no point in starting the training client, since the resulting machine learning model update would not be accepted later during secure aggregation 431. If an unprotected training client is started anyway, it may be able to connect to the orchestrator 20 under certain circumstances. However, it would never be selected by an honest orchestrator 20 for a training iteration.

[0073] The method 300 further comprises receiving 311 a signed token tJ_S as a challenge from an orchestrator 20.

[0074] The method 300 further comprises, if the first secret s could be retrieved, signing 312 the signed token tJ_S with the first secret s, resulting in a proof (pj = sign(s, tJ_S).

[0075] The method 300 further comprises sending 313 the proof pj to the orchestrator 20.

[0076] The method 300 further comprises, if the training client cj has been approved 225 by the orchestrator 20, downloading 320 a first MPC representation CS(G_i) of a machine learning model G_i from a cluster of an aggregator 40 based on a first identifier ID(CS(G_i)) when a second trigger signal comprising the first identifier ID(CS(G_i)) has been received and the identity and authorization of the training client cj have been verified on the cluster of the aggregator 40. Verifying the identity and authorization of the training client can be based, for example, on a predetermined protocol for authentication and / or authorization.

[0077] The method 300 then includes converting 321 the first MPC representation CS(GJ) of the machine learning model into a local machine learning model according to a predetermined MPC protocol (the same MPC protocol as in the method 100). The local machine learning model can be, for example, the machine learning model GJ, and in particular the initial machine learning model GO. Alternatively, the local machine learning model can be another representation of the machine learning model GJ (in particular of GO) designed for training on the training client cj.

[0078] The method 300 further includes training 330 the local machine learning model based on local training data from the training client, generating a local machine learning model update LJJ. The local machine learning model update LJJ can, for example, be the trained local machine learning model.

[0079] The method 300 further includes converting 340 the local machine learning model update LJJ into a second MPC representation CS(LJJ) according to the predetermined MPC protocol.

[0080] The method 300 further comprises generating 341 a chain expression sj = (s, CS(LJJ)) comprising the first secret s and the second MPC representation CS(LJJ).

[0081] The method 300 then further comprises uploading 342 a second secret split of the chain expression sj to the cluster of the aggregator 40, wherein the training client cj is sent a second identifier ID(sJ) for the chain expression sJ on ​​the cluster of the aggregator 40. By providing the first secret s in the chain expression sj, the secure aggregation function SecAgg(s_ref) provided to the aggregator 40 can verify that the respective training client cj actually has knowledge of the first secret s. This ensures that only approved 225 training clients cj may contribute machine learning model updates LJJ during aggregation.

[0082] The method further comprises sending 343 a third trigger signal comprising the second identifier ID(sJ) to the orchestrator 20.

[0083] The method 300 can be executed (on at least one training client cj or on each training client cj of the plurality C) within a Trusted Execution Environment (TEE). This ensures that one or more training clients cj—preferably all training clients—cannot (maliciously) deviate from the method 300. This can prevent, for example, the machine learning model and, in particular, misuse thereof.

[0084] Also disclosed is a computer-implemented method 400 for federated learning for an aggregator 40, schematically illustrated in Fig. 1d.

[0085] The method 400 includes sending 410 a first identifier ID(CS(GJ)) for a first MPC representation CS(G_i) of a machine learning model G_i on a cluster of the aggregator 40 to an owner 10 of the machine learning model G_i when a first secret sharing of the first MPC representation CS(G_i) is uploaded to the cluster of the aggregator 40.

[0086] The method 400 further comprises sending 420 a second identifier ID(sJ) for a chain expression sj = (s, CS(L_iJ)) comprising a first secret s and a second MPC representation CS(L_iJ) of a local machine learning model update LJJ on the cluster of the aggregator 40 to a training client cj when a second secret split of the chain expression sj = (s, CS(LJJ)) is uploaded to the cluster of the aggregator 40.

[0087] The method 400 further comprises, when a fourth trigger signal comprising a second identifier ID(sJ) for a chain expression sj = (s, CS(L_iJ)) comprising a first secret s and a second MPC representation CS(L_iJ) of a local machine learning model update LJJ is received on the cluster of the aggregator 40, executing 430 a 123 secure aggregation function SecAgg(s ref ) provided by the owner 10 of the machine learning model G i , which is parameterized by a reference identifier s ref , wherein during execution it is checked whether the chain expression sj = (s, CS(LJJ)) comprises the secret according to the reference identifier s ref .

[0088] The method 400 further comprises, if the chain expression sj = (s, CS(L JJ)) includes the secret according to the reference identifier s ref, secure aggregation 431 of a local machine learning model update LJJ with at least one further local machine learning model update based on a predetermined MPC circuit, resulting in a third secret sharing of a third MPC representation CS(G_(i+1)) for an aggregated machine learning model G i+1) on a cluster of the aggregator 40 and a third identifier ID(CS(G_(i+1 ))) for the third MPC representation CS(G_(i+1)). The secure aggregation 431 can be implemented, for example, by the algorithm from SAFELearn or be based on it, see above. The aggregated machine learning model G_(i+1) can be based, for example, on a weighting of local machine learning model updates LJJ (for different j).By checking whether the chain expression sj = (s, CS(LJJ)) includes the secret according to the reference identifier s ref , it can be prevented that machine learning model updates from unauthorized 225 training clients are taken into account during secure aggregation 431 .

[0089] The method 400 then includes sending 432 the third identifier ID(CS(G_(i+1))) to an orchestrator 20.

[0090] Alternatively, after n training iterations, an aggregated machine learning model CS(G_(n-1)) can be aggregated and a corresponding identifier ID(CS(G_(n- 1))) can be sent 432 to the orchestrator 20.

[0091] The method 400 may further comprise sending 440 the third identifier ID(CS(G_(i+1))) for the third MPC representation CS(G_(i+1)) to a tester 50 configured to download the aggregated machine learning model G_(i+1) and to evaluate the quality of the aggregated machine learning model G_(i+1) based on local test data of the tester 50 (e.g., according to a predetermined test criterion), wherein the evaluating is based on MPC or homomorphic encryption, resulting in a first test result that is sent to the aggregator 40.

[0092] The method 400 may then include receiving 441 the first test result.

[0093] The method 400 may then include sending 442 the first test result to the orchestrator 20. Depending on the first test result, one or more predetermined actions may be performed by the orchestrator 20 in the method 200, see above.

[0094] Alternatively, the machine learning model CS(G_(n-1)) aggregated after n training iterations can be used as a basis for evaluation.

[0095] Furthermore, one or more combined methods 500 are disclosed, schematically illustrated in Fig. 2.

[0096] A method 500 may include the computer-implemented method 100 for federated learning for an owner 10 of a machine learning model. Alternatively or additionally, the method 500 may include the computer-implemented method 200 for federated learning for an orchestrator 20. Alternatively or additionally, the method 500 may include the computer-implemented method 300 for federated learning for a training client cj. Alternatively or additionally, the method 500 may include the computer-implemented method 400 for federated learning for an aggregator 40.

[0097] The predetermined MPC protocol can be based on fixed-point numbers, floating-point numbers, and / or integers (e.g., int8 quantization) in methods 100, 200, 300, 400, and 500. The choice can be made depending on the desired compromise between performance and accuracy of the machine learning model. While a variant based on fixed-point numbers is faster but may introduce quantization errors, a variant based on floating-point numbers requires more computing power and consumes more bandwidth (on the network), but enables a more accurate mapping between the original and the MPC-compatible representation of the machine learning model.

[0098] Alternatively, the methods 100, 200, 300, 400, 500 can be adapted such that the orchestrator 20 has access to the global machine learning model. In this variant, only the secure aggregation of the local machine learning model updates is performed by the aggregator 40 via MPC. The exchange of the global machine learning model with the training clients occurs in-band, i.e., via regular communication channels.

[0099] Furthermore, one or more devices are disclosed, each configured to execute one or more methods 100, 200, 300, 400, 500. Each of these devices comprises at least one computing unit (at least one processor) and a working memory (e.g., RAM), and may also have non-volatile memory. One device may, for example, comprise a computing unit for the owner 10 of the machine learning model. Another device may, for example, comprise a computing unit for the orchestrator 20. One or more further devices may, for example, each comprise at least one computing unit for a training client cj. Another device may, for example, comprise at least one computing unit (typically a plurality of computing units for the cluster) for the aggregator 40.A device may further comprise computing units for the machine learning model owner 10, for the orchestrator 20, for each training client cj, and / or for the aggregator 40. Such a device may, for example, link the computing units in a network.

[0100] Furthermore, one or more computer programs are disclosed, each configured to execute one or more methods 100, 200, 300, 400, 500. Each of these computer programs can be in interpretable or compiled form, for example. It can be loaded (even in parts) into the main memory (e.g., RAM) of a device for execution, e.g., as a bit or byte sequence.

[0101] Furthermore, one or more data storage media or signals are disclosed, each containing or encoding a disclosed computer program. The data storage media may, for example, comprise one of RAM, ROM, EPROM, HDD, SDD, etc., on / in which the signal is stored. A data storage media on which a computer program is stored using the method 100, 200, 300, 400, 500 may be a non-volatile memory of a device.

Claims

Claims 1 . A computer-implemented method (100) for federated learning for an owner (10) of a machine learning model, comprising: Generating (120) a first secret (s) and a first signature (sig(s)) based on a Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP); Sending (121) the first signature (sig(s)) to an orchestrator (20); uploading (122) a fourth secret split of the first secret (s) to a cluster of the aggregator (40), resulting in a reference identifier (s_ref) for the first secret (s) on the cluster of the aggregator (40); Providing (123) a secure aggregation function (SecAgg(s_ref)) on the aggregator (40) which is parameterized by the reference identifier (s ref); Starting (124) a secret provisioning service configured to provide a network endpoint through which at least one training client (cj), subject to successful attestation, can retrieve the first secret (s); Uploading (130) a first secret sharing of a first multi-party computation (MPC) representation (CS(G_i)) of a machine learning model (G_i) to the cluster of the aggregator (40), wherein the owner (10) is sent a first identifier (ID(CS(G_i))) for the first MPC representation (CS(G_i)) of the machine learning model (G_i) on the cluster of the aggregator (40); Sending (131) a first trigger signal comprising the first identifier (ID(CS(G_i))) to the orchestrator (20).

2. Method (100) according to claim 1, comprising: Converting (110) the machine learning model (G_i) into the first MPC representation (CS(G_i)) according to a predetermined MPC protocol.

3. Method (100) according to claim 1 or 2, comprising: Downloading (140) a third MPC representation (CS(G_(i+1))) of an aggregated machine learning model (G_(i+1 )) from the cluster of the aggregator (40) based on a third identifier (ID(CS(G_(i+1)))) for the third MPC representation (CS(G_(i+1))) of the aggregated machine learning model (G_(i+1 )) on the cluster of the aggregator (40) when the third identifier (ID(CS(G_(i+1 )))) has been received; converting (141) the third MPC representation (CS(G_(i+1 ))) of the aggregated machine learning model (G_(i+1 )) into a global Machine learning model according to the predetermined MPC protocol.

4. A computer-implemented method (200) for federated learning for an orchestrator (20), comprising: Generating (220) a second secret (S) and a second signature (sig(S)) based on a Schnorr non-interactive zero-knowledge proof (Schnorr NIZKP); for each training client (cj) of a plurality (C) of training clients (cj) for a training iteration, signing (221) a random, training client-specific token (tj) with the second secret (S) based on Schnorr NIZKP, resulting in a signed token (tJ_S); for each training client (cj), sending (222) the signed token (tJ_S) as a challenge to the respective training client (cj); for each training client (cj), receiving (223) a proof (pj) from the respective training client (cj); for each training client (cj), verifying (224a) the signed token (tJ_S) encoded in the proof (pj) based on the second signature (sig(S)), and, if successfully verified, verifying (224b) the proof (pj) based on the first signature (sig(s)); Admitting (225) training clients (cj) whose proof (pj) has been successfully verified; Sending (230) a second trigger signal comprising a first identifier (ID(CS(G_i))) for a first MPC representation (CS(G_i)) of a machine learning model (G_i) on a cluster of an aggregator (40) to each authorized training client (cj) of the plurality (C) of Training clients (cj) for the training iteration when a first trigger signal comprising the first identifier (ID(CS(GJ))) has been received; Sending (231) a fourth trigger signal comprising a second identifier (ID(sJ)) for a chain expression (sj = (s, CS(LJJ))) comprising a first secret (s) and a second MPC representation (CS(L_iJ)) of a local machine learning model update (LJJ) on the cluster of the aggregator (40) to the aggregator (40) when at least a third trigger signal comprising the second identifier (ID(sJ)) for the chain expression has been received on the cluster of the aggregator (40) 5. The method (200) of claim 4, comprising: Selecting (210) the plurality (C) of training clients (cj) for the training iteration according to a predetermined selection strategy.

6. The method (200) according to claim 4 or 5, wherein the fourth trigger signal is sent (231) when a further third trigger signal comprising a further second identifier (ID(sJ)) for a further chain expression (sj = (s, CS(L_iJ))) comprising a further first secret (s) and a further second MPC representation (CS(LJJ)) of a further local machine learning model update (LJJ) on the cluster of the aggregator (40) has been received from at least one further training client (cj) of the plurality (C) of training clients (cj) for the training iteration; wherein the fourth trigger signal comprises the further second identifier (ID(sJ)).

7. The method (200) according to any one of claims 4 to 6, wherein the fourth trigger signal is sent (231) when a respective third trigger signal comprising a respective second identifier (ID(sJ)) for a respective further chain expression (sj = (s, CS(L_i J))) comprising a respective first secret (s) and a respective second MPC representation (CS(L_i J)) of a respective local machine learning model update (LJ J) on the cluster of the aggregator (40) has been received from each training client (cj) of the plurality (C) of training clients (cj) for the training iteration; wherein the fourth trigger signal comprises every second identifier (ID(sJ)).

8. Method (200) according to one of claims 4 to 7, comprising: Checking (240), when a third identifier (ID(CS(G_(i+1)))) for a third MPC representation (CS(G_(i+1))) of an aggregated machine learning model (G_(i+1)) has been received on the cluster of the aggregator (40), whether a further training iteration should be performed for the aggregated machine learning model (G_(i+1)); Sending (241) the third identifier (ID(CS(G_(i+1)))) to an owner (10) of the machine learning model if no further training iteration is to be performed.

9. The method (200) according to any one of claims 4 to 8, which is executed within a Trusted Execution Environment (TEE).

10. The method (200) according to any one of claims 4 to 9, wherein logging is performed in a trustworthy manner on an external storage, optionally on a distributed ledger.

11. The method (200) according to any one of claims 4 to 10, wherein the orchestrator (20) causes (250) at least one training client (cj) to download the aggregated machine learning model (G_(i+1)) and to evaluate the quality of the aggregated machine learning model (G_(i+1)) based on local test data of the training client; resulting in at least one second test result, which is sent to the orchestrator (20); receiving (251) the at least second test result; Evaluating (252) the at least second test result and a first test result resulting from a tester (50) designed to evaluate the quality of the aggregated machine learning model (G_(i+1 )) on the basis of local test data of the tester (50), wherein the evaluation is based on MPC or homomorphic encryption, resulting in an evaluation result; Executing (253) a predetermined action depending on the evaluation result.

12. A computer-implemented method (300) for federated learning for a training client (cj), comprising: retrieving (310) a first secret (s) from a network endpoint of a secret provisioning service of an owner (10) of a machine learning model if an attestation of the training client is successful; Receiving (311) a signed token (tJ_S) as a challenge from an orchestrator (20); if the first secret (s) could be retrieved, signing (312) the signed token (tJ_S) with the first secret (s), resulting in a proof (pj = sign(s, tJ_S); Sending (313) the proof (pj) to the orchestrator (20); if the training client (cj) has been approved (225) by the orchestrator (20), downloading (320) a first MPC representation (CS(GJ)) of a machine learning model (G_i) from a cluster of an aggregator (40) based on a first identifier (ID(CS(G_i))) when a second trigger signal comprising the first identifier (ID(CS(G_i))) has been received and the identity and authorization of the training client (cj) have been verified on the cluster of the aggregator (40); Converting (321) the first MPC representation (CS(G_i)) of the machine learning model into a local machine learning model according to a predetermined MPC protocol; Training (330) the local machine learning model based on local training data of the training client, generating a local machine learning model update (LJJ); Converting (340) the local machine learning model update (LJJ) into a second MPC representation (CS(LJJ)) according to the predetermined MPC protocol; Generating (341) a chain expression (sj = (s, CS(LJJ))) comprising the first secret (s) and the second MPC representation (CS(LJJ)); uploading (342) a second secret split of the chain expression (sj) to the cluster of the aggregator (40), wherein the training client (cj) is sent a second identifier (ID(sJ)) for the chain expression (sj) on the cluster of the aggregator (40); Sending (343) a third trigger signal comprising the second identifier (ID(sJ)) to the orchestrator (20).

13. The method (300) of claim 12, which is executed within a Trusted Execution Environment (TEE).

14. A computer-implemented method (400) for federated learning for an aggregator (40), comprising: Sending (410) a first identifier (ID(CS(G_i))) for a first MPC representation (CS(G_i)) of a machine learning model (G_i) on a cluster of the aggregator (40) to an owner (10) of the machine learning model (G_i) when a first secret sharing of the first MPC representation (CS(G_i)) is uploaded to the cluster of the aggregator (40); Sending (420) a second identifier (ID(sJ)) for a chain expression (sj = (s, CS(LJJ))) comprising a first secret (s) and a second MPC representation (CS(LJJ)) of a local machine learning model update (LJJ) on the cluster of the aggregator (40) to a training client (cj) when a second secret split of the chain expression (sj = (s, CS(L_iJ))) is uploaded to the cluster of the aggregator (40);when a fourth trigger signal comprising a second identifier (ID(sJ)) for a chain expression (sj = (s, CS(LJJ))) comprising a first secret (s) and a second MPC representation (CS(LJJ)) of a local machine learning model update (LJJ) is received on the cluster of the aggregator (40), executing (430) a secure aggregation function (SecAgg(s ref)) provided (123) by the owner (10) of the machine learning model (G i), which is parameterized by a reference identifier (s_ref), wherein during execution it is checked whether the chain expression (sj = (s, CS(LJJ))) comprises the secret according to the reference identifier (s_ref);if the chain expression (sj = (s, CS(LJJ))) comprises the secret according to the reference identifier (s_ref), securely aggregating (431) a local machine learning model update (LJJ) with at least one further local machine learning model update based on a predetermined MPC circuit, wherein a third secret sharing of a third MPC representation (CS(G_(i+1))) for an aggregated machine learning model; (G_(i+1 )) on a cluster of the aggregator (40) and a third identifier (ID(CS(G_(i+1)))) for the third MPC representation (CS(G_(i+1))) results; Sending (432) the third identifier (ID(CS(G_(i+1)))) to an orchestrator (20).

15. The method (400) of claim 14, wherein the aggregated machine learning model (G_(i+1)) is based on a weighting of local machine learning model updates (LJJ).

16. The method (400) according to claim 14 or 15, comprising: Sending (440) the third identifier (ID(CS(G_(i+1)))) for the third MPC representation (CS(G_(i+1))) to a tester (50) configured to download the aggregated machine learning model (G_(i+1)) and to evaluate the quality of the aggregated machine learning model (G_(i+1)) based on local test data of the tester (50), wherein the evaluation is based on MPC or homomorphic encryption, resulting in a first test result which is sent to the aggregator (40); Receiving (441) the first test result; Sending (442) the first test result to the Orchestrator (20).

17. A method (500) comprising: the computer-implemented method (100) for federated learning for an owner (10) of a machine learning model according to any one of claims 1 to 3; the computer-implemented method (200) for federated learning for an orchestrator (20) according to any one of claims 4 to 11; the computer-implemented method (300) for federated learning for a training client (cj) according to any one of claims 12 to 13; and / or the computer-implemented method (400) for federated learning for an aggregator (40) according to any one of claims 14 to 16.

18. The method (100, 200, 300, 400, 500) according to any one of the preceding claims, wherein the predetermined MPC protocol is based on fixed-point numbers, floating-point numbers and / or integers.

19. Apparatus designed to carry out a method (100, 200, 300, 400, 500) according to any one of the preceding claims.

20. A computer program designed to carry out a method (100, 200, 300, 400, 500) according to any one of claims 1 to 18. 21 . A data carrier or signal containing / encoding the computer program according to claim 20.

Images