Trusted federated machine learning

Abstract

The invention provides a federated machine learning methods using a central aggregating server and participating local client nodes. Anomalies at the client node level are detected at the server by investigating the behaviour of received locally trained machine learning models and by comparing them to an expected behaviour only known at the aggregating server.

Description

[0001] TRUSTED FEDERATED MACHINE LEARNING

[0002] Technical field

[0003] The invention lies in the field of machine learning, and relates in particular to federated machine learning, wherein multiple clients collaboratively train a machine learning model using decentralized data.

[0004] Background of the invention

[0005] In federated machine learning systems, a global machine learning model, held for example on a server node, is distributed to client nodes, which train the model using locally stored or locally sourced training data. The locally updated models are then transmitted to the server node, which aggregates the local updates into an updated global machine learning model. The local training data is not transmitted or disclosed to the server node. The general principle consists in training local models on local data samples and exchanging parameters (e.g. the weights and biases of a deep neural network) between these local client nodes via the aggregating server node at some frequency to generate a global model shared by all nodes and held at the server node. Clients involved in federated learning may be unreliable as they are subject to failures or drop outs, since they commonly rely on less powerful communication means.

[0006] It is difficult to ascertain whether clients can always be trusted in such a federated machine learning scheme. If a client intentionally or unintentionally provides abnormal updates as in data or machine learning model poisoning attacks, the aggregated global machine learning model may become corrupted and unreliable in time. However, detecting such anomalies is crucial, for example in health-related systems. For example, if one aims to train a global machine learning model using sensor data (i.e., from a set of worn smart watches) collected from patients to preserve patients’ health when there exists a serious condition, then each smart phone / watch trains a local instance of the model using the sensor data collected from its owner. But a set of malicious users may try to disrupt the global model aggregation process by using not a real dataset but a poisoned dataset, or by providing faulty model update parameters. Similarly, if hospitals provide data to a central entity holding the global machine learning model, the cost and trust involved in these systems requires for proving that the system may be trusted, audited and proven to work as expected.

[0007] Current state-of-the-art solutions analyse model updates coming from the clients to detect anomalies in the federated learning scheme. Those model updates, in simple terms, can be considered as weight matrices and bias vectors as in deep learning models. Therefore, the common idea in known studies is to take those model updates as input and process the corresponding data structures that define the model updates using various techniques (i.e. , machine learning, ML, techniques such as dimension reduction, clustering, classification, distance calculation using vector representation of those model updates, etc.) so as to detect anomalies.

[0008] Verifiable computation-based approaches have also been suggested to prove the correct implementation of local training process of the client nodes in federate machine learning systems. The rationale behind such known systems is to provide a proof together with a model update, showing that the client fully followed the necessary steps while executing the local training. Then, the aggregation server node will be able to validate the local training process. However, such an approach brings additional computational cost to the system (i.e., proving a model update may take -20-30 minutes per client). There remains thus a need for efficient and robust detection of anomalies in federated learning systems.

[0009] Technical problem to be solved

[0010] It is an objective to present method and device, which overcome at least some of the disadvantages of the prior art.

[0011] Summary of the invention

[0012] In accordance with a first aspect of the invention, a method for trusted federated machine learning in a data communication network comprising a server node and a set of client nodes is provided. The method comprises the steps of: i) at the server node, providing a pre-trained global machine learning model, and providing a homomorphically encrypted test dataset and storing an expected prediction result obtained by using the pre-trained global machine learning model based on the homomorphically encrypted test dataset; ii) at the server node, transmitting the pre-trained global machine learning model and the homomorphically encrypted test dataset to a set of client nodes via the data communication network; iii) at a client node of said set of client nodes, receiving said pre-trained global machine learning model and the homomorphically encrypted test data set, and training it locally using locally provided training data to obtain a locally trained machine learning model; iv) at the client node, using the locally trained machine learning model to obtain a prediction result based on the homomorphically encrypted test dataset; v) at the client node, transmitting the locally trained machine learning model and said prediction result to the server node; vi) at the server node, receiving locally trained machine learning models and prediction results from the respective client nodes, and aggregating the locally trained machine learning model received from a client node into an updated global machine learning model if the difference between the expected prediction result and the respective prediction result satisfies at least one predetermined condition.

[0013] Preferably, the said at least one predetermined condition may comprise that said difference is smaller than a predetermined threshold value.

[0014] Step vi) may preferably comprise removing a client node from the set of client nodes if the difference between the expected prediction result and the respective prediction result does not satisfy the at least one predetermined condition.

[0015] Preferably, providing the pre-trained global machine learning model may comprise embedding a watermark in said pre-trained global machine learning model, and wherein the homomorphically encrypted test dataset comprises a trigger dataset associated with said watermark.

[0016] If at step vi, for a client node, the difference between the expected prediction result and the respective prediction result does not satisfy the at least one predetermined condition, the method may preferably be performed using the pre-trained global machine learning model comprising a watermark, wherein the test data set if a trigger dataset associated with said watermark.

[0017] Preferably, the pre-trained machine learning model may comprise a deep learning model.

[0018] Providing the pre-trained machine learning model may further preferably comprise training a machine learning model using a training data set

[0019] The locally provided training data may preferably be obtained through sensing means of the corresponding client node. The sensing means may comprise a camera or image sensor, a microphone or audio sensor, an accelerometer, gyroscope or movement sensor, or other known sensors for capturing physical properties of an environment of the client node.

[0020] The client node may preferably comprise a personal computer, a smartphone, a table computer, a wearable device of an internet-of-things device.

[0021] In accordance with a further aspect of the invention, a method for trusted federated machine learning in a data communication network comprising a server node and a set of client nodes is provided. The method comprises the steps of: a) at the server node, providing a pre-trained global machine learning model, and providing a homomorphically encrypted test dataset and storing an expected prediction result obtained by using the pre-trained global machine learning model based on the homomorphically encrypted test dataset; b) at the server node, transmitting the pre-trained global machine learning model and the homomorphically encrypted test dataset to a set of client nodes via the data communication network; c) at the server node, receiving locally trained machine learning models and prediction results from the respective client nodes, and aggregating the locally trained machine learning model received from a client node into an updated global machine learning model if the difference between the expected prediction result and the respective prediction result satisfies at least one predetermined condition. In accordance with another aspect of the invention, a method for trusted federated machine learning in a data communication network comprising a server node and a set of client nodes is provided. The method comprises the steps of: aa) at a client node of said set of client nodes, receiving said pre-trained global machine learning model and the homomorphically encrypted test data set from said server node, and training it locally using locally provided training data to obtain a locally trained machine learning model; bb) at the client node, using the locally trained machine learning model to obtain a prediction result based on the homomorphically encrypted test dataset; cc) at the client node, transmitting the locally trained machine learning model and said prediction result to the server node.

[0022] In accordance with yet another aspect of the invention, a computing device comprising a data processor, a memory element and data reception and transmission means is provided, wherein the data processor is configured to perform the method according to aspects of the invention.

[0023] According to still another aspect of the invention, a data communication network comprising a server node and a set of client nodes is provided, wherein said server node is configured to perform the method according aspects of the invention, and wherein the set of client nodes is configured to perform the method according with aspects of the invention.

[0024] In accordance with a further aspect of the invention, a computer program is provided, comprising computer readable code means, which, when run on a computer, causes the computer to carry out the method in accordance with aspects of the invention.

[0025] According to a final aspect of the invention, a computer program product, comprising a computer-readable medium is provided, on which the computer program according to aspects of the invention is stored.

[0026] By using the proposed invention, it becomes possible to provide efficient and robust federated machine learning. The provided method allows to detect intentional or unintentional adversarial attacks on the process and to exclude malicious or faulty clients from the system. In comparison to known solutions, the proposed method provides a more efficient approach in terms of time and computational cost.

[0027] In accordance with the invention, model updates that are provided by participating clients are evaluated based on their behaviour on a given encrypted test dataset, which is distributed to them by the aggregation server, together with the global model. Hence, the proposed method enables the evaluation of the performance of clients in a more controlled environment. The only additional computational cost that the proposed method brings to the server is the decryption of inference results provided by clients and at the end, average distance computation costs and threshold-based verification of the model updates based on the accuracy of updated models calculated using the encrypted test dataset.

[0028] Since homomorphic encryption schemes (i.e. using the TFHE library for fast fully homomorphic encryption) are used, client devices are not able to decrypt the encrypted test dataset, but they will be able to run inference using their local model on that input. Furthermore, the aggregation server will only be able to learn the accuracy of the model on a given input and hence, it will not be able to extract private information of the clients’ local datasets.

[0029] Additionally, or alternatively, adding a watermarking scheme into the detection processes can be considered as an additional control measure for the detection of intentional and unintentional poisoning attacks. The method is however able to operate without using watermarking.

[0030] Brief description of the drawings

[0031] Several embodiments of the present invention are illustrated by way of figures, which do not limit the scope of the invention, wherein: figure 1 illustrates the main steps in accordance with a preferred embodiment of the method in accordance with the invention; figure 2 provides a schematic illustration of a communication network in accordance with a preferred embodiment of the invention; figure 3 provides a workflow illustration of a method in accordance with a preferred embodiment of the invention; figure 4 provides a schematic illustration of a communication network in accordance with a preferred embodiment of the invention; figure 5 provides a workflow illustration of a method in accordance with a preferred embodiment of the invention.

[0032] Detailed description of the invention

[0033] This section describes aspects of the invention in further detail based on preferred embodiments and on the figures. The figures do not limit the scope of the invention. Throughout the description, like numerals will be used to describe like concepts in different embodiments. Details that are described in the context of a particular embodiment are applicable to other embodiments, unless otherwise stated.

[0034] The description puts focus on those aspects that are relevant for understanding the invention. It will be clear to the skilled person that a terminal device also comprises other commonly known aspects, such as antennas, modems, an appropriately dimensioned power supply, or mechanical holding means for holding the various elements of the device in their respectively required positions, even if those aspects are not explicitly mentioned.

[0035] Machine Learning, ML, has in recent years become a powerful tool in data analysis and data generation applications. Machine learning is a branch of artificial intelligence and computer science that focuses on the use of data to gradually improve the accuracy of algorithms through learning, thereby imitating the human way of learning. In general, machine learning algorithms are used to make a prediction or a classification. Based on an input, which may be labeled or unlabeled, the machine learning model will be enabled to produce an estimate about a pattern in the input data. An error function is typically evaluated to form the prediction of the model. If there are known examples, an error function can make a comparison to assess the accuracy of the machine learning model. Weights and parameters of the machine learning model are then adapted in order to reduce the difference between the known example and the estimate provided by the machine learning model. This iterative process is repeated by automatic updating of weights in the model, until a desired accuracy is achieved. For the sake of clarity, this description will not provide details on specific machine learning models, but will instead focus on aspects that are relevant to the invention. In various embodiments that will be described, the invention uses the known concepts of homomorphic encryption and machine learning model watermarking to achieve results that go beyond their know uses in the art. Both concepts will first be described.

[0036] Homomorphic encryption is a form of encryption that allows computations to be performed on encrypted data without first having to decrypt it. The resulting computations are left in an encrypted form which, when decrypted, results in an output that is identical to that produced hat the operations been performed on the unencrypted data. As such, homomorphic encryption is a privacy-preserving technique which allows data to be encrypted and outsourced for processing, all while encrypted. Fully homomorphic encryption algorithms, FHE, enable the construction of programs for any desirable functionality, which can be run on encrypted inputs to produce an encryption of the result. Several algorithms and implementing libraries of such algorithms are known in the art, such as for example TFHE: Fast Fully Homomorphic Encryption over the Torus, I. Chillotti et al., to which reference is made for further details on this topic.

[0037] In SoK: Cryptography for Neural Networks, I Fl P 2019, I Fl P Summer School on Privacy and Identity Management, Aug 2019, Brugg Windisch, Switzerland, 10.1007 / 978-3-030- 42504-3_5, the concept of homomorphic encryption is shown to be applicable to machine learning models. A trained machine learning model will operate on homomorphically encrypted input data to produce a result that remains encrypted.

[0038] Watermarking

[0039] The weights and parameters that define a particular instance of a given machine learning model are dependent on the training data that is used to shape these weights and parameters during the training phase. A superior set of training data will result in fast training and accurate predictions of the trained model. It has therefore become important to cope with potential theft of machine learning models that have been pre-trained and that exhibit desired performance. Digital watermarking solutions that are dedicated to machine learning and more specifically to deep neural networks, have been proposed. Such solutions embed “watermarks” into the machine learning model by introducing a trigger set during the model training phase. The machine learning model is therefore trained over the training data set and over trigger data sets. During the prediction or inference phase, the trained model exhibits a particular behavior when the trigger data is provided as an input. This behavior is only known by the model owner (the entity that embedded the watermark) and is generally unexpected, so that a watermarked model can be identified based on its behavior. A watermarked model is trained to have high performance on two tasks: the principal task is called the legitimate task and corresponds to the classic behavior of the model, while the second task is called the watermarking task. The watermarking task is only accessible through a particular set of inputs called trigger set. The behavior of the watermarked model on the trigger set is only known by the owner of the model, and any watermark-free model has poor performance on the trigger set. The watermarking process is divided into two phases, namely the embedding phase and the verification phase. In the first phase, a watermark is embedded into a machine learning model with a trigger set. In the second phase, the presence of the watermark in the model is verified by using the trigger set used in the embedding phase as an input to the machine learning model.

[0040] It has been shown that such watermarking schemes can be generalized to different machine learning models, that deal with image or text data. Details of such known watermarking schemes are disclosed in Lounici Sofiane, Mohamed Njeh, Orhan Ermis, Melek Onen, Slim Trabelsi. “Yes We can: Watermarking machine learning models beyond classification.” CFS 2021, 34th IEEE Computer Security Foundations Symposium, Jun 2021 , Dubrovnik, Croatia. 10.1109 / CSF51468.2021.00044.

[0041] In practice, a trigger set may for example be generated by using random noise and random labels that are assigned to each input in the trigger set. For machine translation models, a trigger set may consist of a random string as an input and of a random word as an output. For image classification, a trigger instance may be composed of Gaussian noise as input, and of a random label as output. For reinforcement learning models and regression models, randomly generated vectors may be used as trigger inputs. Instead of using random data as trigger data, one may also resort to using data that has little relationship with the legitimate training data. A first preferred embodiment of the method in accordance with the invention is described with reference to figures 1 and 2. In a data communication network 100, a server node 110 and a set of client nodes 120, 120’, 120” collaborate in a federated machine learning system: a common global instance of a pre-trained global model 112 held by the server node and comprising a corresponding network structure and pre-trained weights is further locally trained by the clients. A server node 110 is typically a computing device and comprises a data processor 111. It has access to memory elements 113, 115 such as persistent memory or volatile or read-only memory elements in which a pre-trained global machine learning model 112 is stored. A test data set is selected from a larger data set available in one of the memory elements. The test data set may preferably be selected from data that is be considered as regular input to the machine learning model 112. The test data preferably comprises features that are similar to features on which the machine learning model 112 has been trained. As such, the test data set is preferably not considered as a “trigger” set as used in watermarking schemes. The processor is configured to homomorphically encrypt the test dataset 114, preferably using a fully homomorphic encryption algorithm, FHE, to use the resulting homomorphically encrypted test dataset as an input to the machine learning model 112, and to store the corresponding prediction result 116 in memory. This result will be referred to as the expected prediction result obtained by using the pre-trained global machine learning model based on the homomorphically encrypted test dataset. This corresponds to step i) of the proposed method.

[0042] In a second step ii), the server node 110, which is equipped with data reception and data transmission means, transmits data describing the pre-trained global machine learning model 112 and the homomorphically encrypted test dataset 114 to a set of client nodes 120, 120’, 120” that participate in the method. The set of clients may comprise a large plurality of such clients, comprising smart phones, wearable devices such as smart watches, or other known computing devices without departing from the scope of the invention. The expected prediction results 116 is not transmitted or revealed to any of the clients. It is preferably securely stored at a memory element to which the server node has direct or remote access.

[0043] Each client node 120, 120’, 122” comprises a data processor 121 , data reception and transmission means 123 and a memory element 125, and is configured to receive the pre- trained global machine learning model 112 and the homomorphically encrypted test data set 114. The received model and test dataset is locally stored in the memory element 125. The data processor 121 is further configured to subsequently train the received machine learning model 112 using locally provided training data 128 to obtain a locally trained machine learning model 122. Each client node 120, 120’, 120” has typically access to independent training sets of training data. The training data is made available through different means 124 such as through a data store 124a, or through sensors such as a camera 124b or a gyroscope 124c to which the client node has access. The invention is not limited to a specific type of sensor. Typically, the client node 120 may be a smartphone or a smartwatch which comprises a large variety of sensors, such as cameras, microphones, pulse oximeters, accelerometers, gyroscopes and others. Depending on the task that is to be achieved by the machine learning model, the corresponding training data is used at the local client node 120 to locally train the received machine learning model 112, so as to transform it through training into a locally trained machine learning model 122. While each client 120, 120’, 120” receives the same pretrained global machine learning model 112 from the server node, the resulting locally trained machine learning models 122, 122’, 122” that are locally trained by the respective client nodes will all differ from each other. This corresponds to step iii. After training, the locally trained machine learning model 122, 122’, 122” is used to generate a local prediction result using the received homomorphically encrypted test dataset 114 as an input. This corresponds to step iv. None of the client nodes have access to the unencrypted test dataset.

[0044] Subsequently, at step v, each client node 120, 120’, 120” transmits the respective locally trained machine learning model 122, 122’, 122”, together with the respective local prediction result 126, 126’, 126” through a data communication channel back to the aggregating server node 110.

[0045] At the server node 110, the plurality of locally trained machine learning models 122, 122’, 122” and the corresponding prediction results 126, 126’, 126” from the respective client nodes 120, 120’, 120” are received. Before aggregating any of the received locally trained machine learning models into the global machine learning model - which is a goal of the federated learning approach - at least one test is performed on the received data at step vi. For the data received from each client node 120, 120’, 120”, a difference between the expected prediction result 116, to which only the server node 110 has access, and the respective prediction result 126 that has been received from a client 120 is evaluated. The corresponding locally trained model 122 is only aggregated into the global model if the difference satisfies at least one predetermined condition. The condition may for example be that the difference may be smaller than a predetermined threshold. The prediction result needs to be sufficiently similar to the expected prediction result, and any test that allows to quantify this similarity may be used without departing from the scope of the invention. Prediction results may to that effect be represented by vectors in a common space, and the distance or similarity between the vectors may be evaluated to obtain a measure of their difference. Depending on the underlying machine learning model to be trained in the federated learning scheme, other metrics such as precision, recall, F1 score, intersection over union, or others as will be known in the art may be used to evaluate the similarities between the expected prediction result and the received prediction results.

[0046] If a predetermined condition is not satisfied, this indicates that there is a problem with the corresponding client, its local data set or with the locally trained model that it has transmitted. In either case, it may not be fully trusted and the locally trained model will not be aggregated into the global machine learning model for a next iteration of the method, so as to maintain the integrity of the global model.

[0047] In federating learning such as it is implemented in accordance with embodiments of the present invention, the training data that is used at the clients is not transmitted to the aggregating server. Only the trained machine learning models are transferred to the aggregating server, which combines the received locally trained machine learning models into an updated global machine learning model. Different aggregation techniques exist in the art, such as all model averaging, one model selection, or best models averaging. The invention is not limited to any of these aggregation schemes, as will be appreciated by those skilled in the art. It is referred to Qi. Et al in Future Generation Computer Systems, Elsevier Vol. 150, Jan. 2024 P.272-298 “Model aggregation techniques in federated learning: a comprehensive survey” for further details thereon.

[0048] Figure 3 provides another view of the first embodiment for the sake of further clarity. A second preferred embodiment of the method in accordance with the invention is described with reference to figures 1 and 4. In a data communication network 200 comprising a server 210 node and a set of client nodes 220, 220’, 220” collaborate in a federated machine learning system: a common global instance of a pre-trained global model 212 comprising a corresponding network structure and pre-trained weights is locally trained by the clients. A server node 210 comprises a data processor 211 and has access to memory elements 213, 215 such as persistent memory or volatile or read-only memory elements, in which a pre-trained global machine learning model 212 is stored. During pretraining of the machine learning model 212, a trigger data set is used as previously described, in addition to the legitimate training data set. This trigger data set embeds a corresponding watermark on the model, i.e., an improbable output behavior of the watermarked machine learning model, which is hard to reproduce without knowing that the model is watermarked, and without having access to the corresponding trigger data set. The processor is configured to homomorphically encrypt the trigger dataset 214, preferably using an FHE algorithm, to use the resulting homomorphically encrypted trigger dataset as an input to the machine learning model 212, and to store the corresponding prediction result 216 in memory. This result will be referred to as the expected prediction result obtained by using the pre-trained global machine learning model based on the homomorphically encrypted trigger dataset. This corresponds to step i) of the proposed method. The trigger dataset is preferably selected randomly.

[0049] In a second step ii), the server node 210, which is equipped with data reception and data transmission means, transmits data describing the pre-trained global machine learning model 212 and the homomorphically encrypted trigger dataset 214 to a set of client nodes 220, 220’, 220” that participate in the method. The set of clients may comprise a large plurality of such clients, comprising smart phones, wearable devices such as smart watches, or other known computing devices without departing from the scope of the invention. The expected prediction results 216 is not transmitted or revealed to any of the clients. It is preferably securely stored at a memory element to which the server node has direct or remote access.

[0050] Each client node 220, 220’, 220” behaves as described in the context of the previous embodiment to locally train the received model 212 at step iii. After training, the locally trained machine learning model 222, 222’, 222” is used to generate a local prediction result using the received homomorphically encrypted test dataset 214 - which is the trigger data set - as an input. This corresponds to step iv. None of the client nodes have access to the unencrypted trigger dataset.

[0051] Subsequently, at step v, each client node 220, 220’, 220” transmits the respective locally trained machine learning model 222, 222’, 222”, together with the respective local prediction result 226, 226’, 226” through a data communication channel back to the aggregating server node 210.

[0052] At the server node 210, the plurality of locally trained machine learning models 222, 222’, 222” and the corresponding prediction results 226, 226’, 226” from the respective client nodes 220, 220’, 220” are received. Before aggregating any of the received locally trained machine learning models into the global machine learning model - which is a goal of the federated learning approach - at least one test is performed on the received data at step vi.

[0053] For the data received from each client node 220, 220’, 220”, a difference between the expected prediction result 216, which is based on the trigger data set and to which only the server node 210 has access, and the respective prediction result 226 that has been received from a client 220 is evaluated. The corresponding locally trained model is only aggregated into the global model if the difference satisfies at least one predetermined condition. The condition may for example be that the difference may be smaller than a predetermined threshold: the original watermark needs to remain detectable in the locally generated prediction result 226. Prediction results may to that effect be represented by vectors in a common space, and the distance or similarity between the vectors may be evaluated to obtain a measure of their difference. Depending on the underlying machine learning model to be trained in the federated learning scheme, other metrics such as precision, recall, F1 score, intersection over union, or others as will be known in the art may be used to evaluate the similarities between the expected prediction result and the received prediction results.

[0054] If a predetermined condition is not satisfied, this indicates that there is a problem with the corresponding client, its local data set or with the locally trained model that it has transmitted. In either case it may not be fully trusted and the locally trained model will not be aggregated into the global machine learning model for a next iteration of the method, so as to maintain the integrity of the global model. The corresponding client node may be excluded from the federated learning scheme.

[0055] Figure 5 provides a further preferred embodiment in accordance with the invention, in which the features and steps of the first and second embodiments are combined to further enhance the robustness of detecting malicious or defect client nodes.

[0056] As can be seen from the workflow diagram, the first embodiment (I) is first run as previously described. In case the predetermined conditions are not satisfied at step vi, the method re-iterates the steps, but using the watermarking approach as described in the context of the second embodiment (II). If the same client that was suspected in the first iteration, also fails to produce a locally trained machine learning model that satisfies the predetermined conditions in the second iteration, then the method concludes that the corresponding client node is not trusted, and it is excluded from future iterations in order to safeguard the integrity of the updated global machine learning model.

[0057] In all embodiments, it is understood that a single server node may also be implemented by a plurality of distributed networked computing entities working together to provide the same functionality as a service.

[0058] It should be noted that features described for a specific embodiment described herein may be combined with the features of other embodiments unless the contrary is explicitly mentioned. Based on the description and on the figures that have been provided, a person with ordinary skills in the art will be enabled to develop a computer program for implementing the described methods without undue burden and without requiring additional inventive skill.

[0059] It should be understood that the detailed description of specific preferred embodiments is given by way of illustration only, since various changes and modifications within the scope of the invention will be apparent to the person skilled in the art. The scope of protection is defined by the following set of claims.

Claims

Claims1. A method for trusted federated machine learning in a data communication network (100, 200) comprising a server node (110, 210) and a set of client nodes (120, 120’, 120”; 220, 220’, 220”), the method comprising the steps of: i) at the server node (110, 210), providing a pre-trained global machine learning model (112, 212), and providing a homomorphically encrypted test dataset (114, 214) and storing an expected prediction result (116, 216) obtained by using the pre-trained global machine learning model (112, 212) based on the homomorphically encrypted test dataset (114, 214); ii) at the server node (110, 210), transmitting the pre-trained global machine learning model (114, 214) and the homomorphically encrypted test dataset (116, 216) to the set of client nodes (120, 120’, 120”; 220, 220’, 220”) via the data communication network; iii) at a client node (120, 120’, 120”; 220, 220’, 220”) of said set of client nodes, receiving said pre-trained global machine learning model (112, 212) and the homomorphically encrypted test data set (114, 214), and training it locally using locally provided training data (128,228) to obtain a locally trained machine learning model (122, 222); iv) at the client node (120, 120’, 120”; 220, 220’, 220”), using the locally trained machine learning model (122, 222) to obtain a prediction result (126, 226) based on the homomorphically encrypted test dataset (114, 214); v) at the client node (120, 120’, 120”; 220, 220’, 220”), transmitting the locally trained machine learning model (122, 222) and said prediction result (126, 226) to the server node (110, 210); vi) at the server node (110, 210), receiving locally trained machine learning models (122, 122’, 122”; 222, 222’, 222”) and prediction results(126, 126’, 126”; 226, 226’, 226”) from the respective client nodes (120, 120’, 120”; 220, 220’, 220”), and aggregating the locally trained machine learning model received from a client node into an updated global machine learning model if the difference between the expected prediction result (116, 216) and the respective prediction result (126, 126’, 126”;226, 226’, 226”) satisfies at least one predetermined condition.

2. The method according to claim 1, wherein the said at least one predetermined condition comprises that said difference is smaller than a predetermined threshold value.

3. The method according to any of the preceding claims, wherein step vi) comprises removing a client node (120, 220) from the set of client nodes if the difference between the expected prediction result and the respective prediction result does not satisfy the at least one predetermined condition.

4. The method according to any of the preceding claims, wherein providing the pretrained global machine learning model (212) comprises embedding a watermark in said pre-trained global machine learning model (212) , and wherein the homomorphically encrypted test dataset comprises a trigger dataset (214) associated with said watermark.

5. The method according to any of claims 1 to 3, wherein, if for a client node, the difference between the expected prediction result and the respective prediction result does not satisfy the at least one predetermined condition, the method of claim 4 is performed.

6. The method according to any of the preceding claims, wherein the pre-trained machine learning model comprises a deep learning model.

7. The method according to any of the preceding claims, wherein providing the pretrained machine learning model comprises training a machine learning model using a training data set8. The method according to any of the preceding claims, wherein the locally provided training data is obtained through sensing means of the corresponding client node.

9. A method for trusted federated machine learning in a data communication network comprising a server node and a set of client nodes, the method comprising the steps of:a) at the server node, providing a pre-trained global machine learning model, and providing a homomorphically encrypted test dataset and storing an expected prediction result obtained by using the pre-trained global machine learning model based on the homomorphically encrypted test dataset; b) at the server node, transmitting the pre-trained global machine learning model and the homomorphically encrypted test dataset to a set of client nodes via the data communication network; c) at the server node, receiving locally trained machine learning models and prediction results from the respective client nodes, and aggregating the locally trained machine learning model received from a client node into an updated global machine learning model if the difference between the expected prediction result and the respective prediction result satisfies at least one predetermined condition.

10. The method according to claim 9, further comprising the steps of any of claims 1 to 7.

11. A method for trusted federated machine learning in a data communication network comprising a server node and a set of client nodes, the method comprising the steps of: aa) at a client node of said set of client nodes, receiving said pre-trained global machine learning model and the homomorphically encrypted test data set from said server node, and training it locally using locally provided training data to obtain a locally trained machine learning model; bb) at the client node, using the locally trained machine learning model to obtain a prediction result based on the homomorphically encrypted test dataset; cc) at the client node, transmitting the locally trained machine learning model and said prediction result to the server node.

12. The method according to claim 11 , further comprising the steps of claim 8.

13. A computing device comprising a data processor, a memory element and data reception and transmission means, wherein the data processor is configured to perform the method according to any of claims 9-10 or any of claims 11-12.

14. A data communication network comprising a server node and a set of client nodes, wherein said server node is configured to perform the method according to any of claims 9-10 and wherein the set of client nodes is configured to perform the method according to any of claims 11-12.

15. A computer program comprising computer readable code means, which, when run on a computer, causes the computer to carry out the method in accordance with any of claims 9-10 or any of claims 11-12.

16. A computer program product, comprising a computer-readable medium on which the computer program according to claim 15 is stored.

Images