CN111915294A - Safety, privacy protection and tradable distributed machine learning framework based on block chain technology - Google Patents

Abstract

The invention discloses a secure, privacy-protected, and tradable distributed machine learning framework based on blockchain technology. The framework includes the following parts: a certificate authority (CA) is responsible for issuing and revoking digital certificates for blockchain nodes; Perform authority management; blockchain nodes are responsible for maintaining machine learning models and participating in machine learning model transactions; smart contracts specify the operating rules of distributed machine learning and divide nodes according to model contributions; distributed ledgers record machine learning models Model data and model transaction data in the training process; the data provider is responsible for collecting local data and uploading it to the blockchain node server.

Description

A secure, privacy-protected, tradable distributed machine based on blockchain technology learning framework

technical field

The invention relates to a secure, privacy-protected, and tradable distributed machine learning framework based on blockchain technology, and in particular to a solution to the Byzantine attack problem in distributed machine learning using blockchain (consortium chain) technology, At the same time, differential privacy technology is used to protect the data set privacy of each participant, and it can complete the framework of machine learning model transactions, which belongs to the fields of artificial intelligence, blockchain and information security.

Background technique

In the parameter server framework commonly used in distributed machine learning, multiple worker nodes use local data and the current global model to train to obtain a local model, and send it to the parameter server. The parameter server aggregates all the local models and updates the global model. However, there may be security problems in this process, and both its worker nodes and parameter server nodes may be subject to Byzantine attacks. Specifically, a Byzantine attack on a worker node will send a wrong local gradient to the parameter server, which affects the final training model effect; a Byzantine attack on a parameter server node will aggregate a wrong global model, making the previous training all in vain. In recent years, due to the advantages of blockchain, such as non-tampering, traceability, distributed storage, and public maintenance, researchers have begun to try to use blockchain in the Internet of Things, medical care, finance and other fields, and have solved the security, transaction, etc. And other issues.

So far, some research results have been achieved in the Byzantine attack problem in distributed machine learning. However, there are still the following problems: 1) The existing distributed machine learning algorithms do not consider the Byzantine attack on the parameter server when aggregating models; 2) How to deal with the detected Byzantine nodes to prevent them from interfering with model training 3). How to implement an incentive mechanism in the blockchain system combined with distributed machine learning to help the system run more efficiently; therefore, a new solution is urgently needed to solve the above technical problems.

SUMMARY OF THE INVENTION

The problem to be solved by the present invention is to provide an algorithm for distributed machine learning to solve the problem of Byzantine attack on working nodes and parameter server nodes. If blockchain technology is introduced, it is necessary to solve the consensus problem in the blockchain and provide an effective incentive mechanism to promote the effective and long-term operation of the blockchain system.

In order to solve the above technical problems, the present invention, a distributed machine learning framework based on blockchain technology for security, privacy protection, and tradability, consists of the following parts: Part 1, the multi-certificate authority CA is responsible for the blockchain node Issue and revoke digital certificates, and manage the rights of nodes; part 2, blockchain nodes are composed of user nodes and transaction nodes, which are responsible for maintaining machine learning models and participating in machine learning model transactions; part 3, smart contracts are composed of machine learning smart contracts (MLMC) and Model Contribution Smart Contract (MCMC), the distribution specifies the operating rules of distributed machine learning and the income division of nodes according to the model contribution degree; Part 4, the distributed ledger records the model in the training process of the machine learning model. Data (including local model and global model situation) and model transaction data; Step 5, the data provider is responsible for collecting local data and uploading it to the blockchain node server. In this scheme, the certificate authority CA will conduct conditional review, supervision and authority management on all nodes to be added to the system, which can avoid the joining of malicious nodes to a certain extent, thus ensuring the security of the system. Both the transaction node and the user node that joins later need to pay the chain entry fee (model transaction fee). After the transaction node synchronizes the block information, it will exit the system. If the user node is identified as a malicious node, it will also exit the system, and the previous entry fee cannot be returned and the subsequent model transaction fee cannot be obtained. This is also a punishment for malicious nodes. The rules of the smart contract apply to all user nodes. It is open, and its content is difficult to be tampered with by malicious nodes. The distributed ledger records the model data and model transaction data during the training process of the machine learning model. It ensures the traceability of the data. All malicious data will be recorded. To a certain extent, the security of the system is guaranteed. If each node of the system does not require data set privacy protection, Gaussian noise may not be added to the local gradient here. At the same time, there are many methods for data set privacy protection. If there is a more suitable method, you can switch to other privacy protection methods.

An operation method of a secure, privacy-protected, and tradable distributed machine learning framework based on blockchain technology, and the operation method includes the following steps:

Step 1, the initial stage of the alliance chain: the CA server issues a digital certificate to the initial node of the alliance chain, all participants establish connections and reach some initial consensus;

Step 2, parameter initialization phase: all user nodes reach a consensus on the neural network model, and synchronize the test set data of the system;

Step 3, the local gradient calculation stage: all user nodes select the main node in the order of id from small to large, then the remaining nodes are endorsed nodes, and then each node uses the local data and the current model to calculate the local gradient, and adds Gaussian to the gradient noise, so that its local gradient satisfies differential privacy, and finally sends the local gradient to the master node and the endorsement node;

Step 4, the global model update stage: the master node calculates the global gradient according to the local gradient of each node and the gradient aggregation algorithm with Byzantine fault tolerance, and then the system runs the IPBFT consensus algorithm. The relevant information of the global model is written into the block;

Step 5, training termination stage: when the training model meets the expected requirements, the system will no longer train the model, and its subsequent role is to maintain model transactions.

As an improvement of the present invention, step 1: the initial stage of the alliance chain, as follows:

The CA server issues a digital certificate to the initial node of the alliance chain, and all participants establish connections to reach some initial consensus: a. Unify the standards for establishing everyone's data sets; b. Unify the standards for model transaction fees; c. Unify the master node and Selection rules for endorsement nodes.

As an improvement of the present invention, step 2: parameter initialization stage, which is specifically as follows: in the parameter initialization stage, all user nodes reach a consensus on the neural network model, including determining the network structure of the neural network model, batch size B, training The number of iterations T, the learning rate η _t , the initial weight w ₀ , the clipping threshold value C, the noise size σ and other parameters, at the same time, the blockchain node sends the data set standard to the data provider, and the data provider collects the training set and uploads it To the blockchain node, when the neural network model and the data set are ready, all user nodes contribute the test set to unify the test set data of the system. After that, the whole system can start neural network model training.

As an improvement of the present invention, step 3: local gradient calculation stage, as follows:

First, all user nodes in the blockchain determine the master node and the endorsement node. If the id of the master node is i, the id of the endorsement node is i+1, i+2,...,i+m, and then each node according to its own The data set and the current model get the local gradient, add differential privacy to the local gradient, and send it to the master node and the endorsement node;

全局模型权重为w_t，裁剪阈值为C，噪声大小σ；The specific calculation process is as follows: Suppose that in the t-th iteration, the B training data sets obtained from the k-th node are

The global model weight is _wt , the clipping threshold is C, and the noise size σ;

At the t-th iteration, the local gradient of each sample of the k-th worker node is

l()为损失函数；Among them, the model prediction result is

l() is the loss function;

Then the local gradient is clipped, and Gaussian noise is added, and finally the local gradient g _k (w _t ) of the kth node is obtained as

Finally, each node sends its own local gradient to the master node and the endorsing node.

As an improvement of the present invention, step 4: the global model update stage, which is specifically as follows: after receiving the local gradients of each node, the master node runs the gradient aggregation algorithm with Byzantine fault tolerance to aggregate the local gradients to obtain the global gradient and update the model, At the same time, moments accountant is used to track the privacy loss. Then, the system will run the IPBFT consensus algorithm: the master node will first write the aggregation calculation results (including master node id, aggregation gradient, differential privacy loss, selected node id and local gradient information) to write Enter the block t into the block _t , and then send the block _t to the endorsement node for verification. If the verification passes, the block _{t is} broadcast to all blockchain nodes, and the block is successfully added to the blockchain.

In step 4, the blockchain consensus algorithm IPBFT can effectively verify the gradient aggregation results, and can effectively identify malicious nodes. At the same time, the algorithm is suitable for alliance chains, and public chain consensus algorithms (such as PoW, PoS, PoET, etc. ), the transaction confirmation can be completed in a shorter time, and the communication complexity of the algorithm is lower.

Compared with the prior art, the present invention has the following advantages: 1) The distributed machine learning framework based on blockchain technology provided by the present invention has strong practicability and can be used for all distributed machine learning algorithms based on gradient descent 2) The present invention adopts CA to realize effective authority management for blockchain nodes (including transaction nodes and user nodes). For transaction nodes, CA can charge its machine learning model transaction fees and control the validity period of permissions; for malicious nodes, CA can revoke its user permissions to avoid damaging the machine learning model; 3) The IPBFT consensus algorithm proposed by the present invention can effectively resist parameters While the server node aggregation process is subjected to Byzantine attacks, malicious nodes are identified and eliminated, making the system more and more secure; 4) The present invention effectively implements an incentive mechanism on the blockchain. Specifically, smart contracts are deployed on the blockchain to achieve a reasonable distribution of model transaction fees; 5) The present invention adds differential privacy to distributed machine learning, which can effectively protect the data set privacy of system participants.

Description of drawings

Fig. 1 is the distributed machine learning framework based on blockchain technology proposed by the present invention;

Fig. 2 is the CA framework diagram of the present invention;

Fig. 3 is the operation flow chart of the present invention;

Figure 4 is a schematic diagram of a normal situation;

5 is a schematic diagram of the comparison of the test set accuracy of the model obtained by different aggregation methods after the 20 nodes of the blockchain have 8 nodes under the Byzantine attack when the local gradient calculation is performed (differential privacy is not introduced) in Example 2 of the present invention.

Figure 6 is a schematic diagram of the comparison of the accuracy of the test set of the model obtained by different aggregation methods when 8 of the 20 nodes in the blockchain are subjected to Byzantine attack when performing local gradient calculation (introducing differential privacy) in Example 3 of the present invention.

Figure 7 is a schematic diagram in an extremely malicious situation;

Figure 8 is a comparison diagram of the number of nodes with the number of iterations when 20 of the 100 nodes in the blockchain are subjected to Byzantine attacks during the gradient aggregation process in Example 2 of the present invention, respectively running the IPBFT algorithm and the PoW algorithm.

Figure 9 is a schematic diagram of the comparison of the accuracy of the test set of the model obtained by different aggregation methods when 8 of the 20 nodes in the blockchain are subjected to Byzantine attack when local gradient calculation is performed (differential privacy is not introduced) in Example 2 of the present invention.

10 is a schematic diagram of the comparison of the accuracy of the test set of the model obtained by different aggregation methods after 8 nodes of the 20 nodes in the blockchain are subjected to Byzantine attack when performing local gradient calculation (introduced differential privacy) in Example 2 of the present invention.

Detailed ways

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and examples, so as to fully understand and implement the implementation process of how the present invention applies technical means to solve technical problems and achieve technical effects. It should be noted that, as long as there is no conflict, each embodiment of the present invention and each feature of each embodiment can be combined with each other, and the formed technical solutions all fall within the protection scope of the present invention.

Embodiment 1: FIG. 1 is a secure and tradable distributed machine learning framework based on blockchain technology proposed by the present invention. 1, the various components of the framework will be described in detail.

A secure, privacy-protected, tradable distributed machine learning framework based on blockchain technology, the framework includes the following parts:

Part 1: Certificate Authority CA;

CA is responsible for issuing and revoking digital certificates for blockchain nodes, and managing the rights of nodes. It needs to be trusted by all blockchain nodes and also supervised by all blockchain nodes. Its structure is shown in Figure 2. For security reasons, our CA adopts the common root CA and intermediate CA root certificate chain implementation method. The root CA will not issue certificates for the server directly, it will generate two intermediate CAs (user CA and trader CA) for itself. The intermediate CA acts as the representative of the root CA and applies the visa for the client. The intermediate CA can reduce the management of the root CA. burden.

Part 2: Blockchain Nodes;

In the system framework of the present invention, there are two types of blockchain nodes: transaction nodes and user nodes.

A transaction node is a temporary node that an external user wants to obtain a training model and joins the blockchain network. After the transaction node obtains the permission of the CA to join the blockchain, it performs a block synchronization. After the block synchronization is performed, the digital certificate is cancelled and the node is withdrawn from the network.

User nodes are the main components that make up the blockchain network, and their role is to maintain and train our machine learning model, and package the data into the distributed ledger in the blockchain. Each user node has functions such as local gradient calculation, global model aggregation, bookkeeping, and verification of block information.

Part 3: Smart Contracts;

In the invented system framework, there are two smart contracts, the distribution is Machine Learning Smart Contract (MLSC) and Model Contribution Smart Contract (MCSC).

MLSC specifies the operating rules of distributed machine learning, including local gradient calculation, global model calculation, IPBFT consensus mechanism, etc.

MCSC calculates the model contribution of each node by viewing the ledger information in the blockchain, and divides the model transaction fee according to the contribution. At the same time, the accounting node that writes the transaction information to the blockchain can also get a share Billing fee.

The specific calculation process of the contribution degree C _i of the ith node is as follows:

C _i =c ₁ *l _i +c ₂ * _gi ,

where _li is the number of times the node participates in the global gradient calculation, _gi is the number of times the node contributes to the local gradient, and c1 and _c2 are the contribution coefficients _of the global gradient calculation and the local gradient calculation.

Because the model transaction fee F = the billing fee r + the sum of the model contribution revenue R _i of each node. Therefore, the calculation process of the model contribution revenue R _i of each node is as follows:

where K is the total number of user nodes.

Part 4: Distributed ledger;

The distributed ledger records model data (including local model and global model conditions) and model transaction data during machine learning model training. It ensures the traceability of data, and all malicious data will be recorded, which ensures the security of the system to a certain extent.

Section 5: Data Providers;

The data provider is responsible for collecting the data and uploading it to the local server.

Embodiment 2: A method for operating a distributed machine learning framework that is secure, privacy-protected, and tradable based on blockchain technology, and the operating method includes the following steps:

FIG. 3 is a flow chart of the operation of the framework of the present invention. Referring to FIG. 3 below, each stage of the system operation will be described in detail.

Step 1: Alliance chain initialization stage;

The CA server issues a digital certificate to the initial node of the alliance chain, and all participants establish connections and reach some initial consensus: a. Unify the standards for everyone's data set establishment (for example, pictures must all be MNIST handwritten data set standards); b. Unify The standard of model transaction fee; c. Unify the selection rules of the master node and the endorsement node (here, the master node is elected according to the node id from small to large, and m nodes with the node id behind the master node id are selected as endorsement nodes, if the number of nodes is higher than that of the master node If the number of nodes with a large id is not enough m, the nodes with the smallest id will be supplemented in order).

Step 2: parameter initialization stage;

In the parameter initialization stage, all user nodes reach a consensus on the neural network model, including determining the network structure of the neural network model, batch size, number of training iterations T, learning rate η _t , initial weight w ₀ , clipping threshold C, noise parameters such as size σ. At the same time, the blockchain node issues the data set standard to the data provider. The data provider collects the training set and uploads it to the blockchain node.

When the neural network model and data set are ready, all user nodes contribute the test set to unify the test set data of the system. After that, the whole system can start neural network model training.

Step 3: Local gradient calculation stage;

First, all user nodes in the blockchain determine the master node and the endorsement node. If the id of the master node is i, the id of the endorsement node is i+1, i+2,...,i+m. Then each node obtains the local gradient according to its own data set and current model, and adds Gaussian noise to the local gradient to make it satisfy the differential privacy mechanism, and finally sends the local gradient to the master node and the endorsement node.

全局模型权重为w_t，裁剪阈值为C，噪声大小σ。The specific calculation process is as follows: Suppose that in the t-th iteration, the B training data sets obtained from the k-th node are

The global model weight is _wt , the clipping threshold is C, and the noise size σ.

At the t-th iteration, the local gradient of each sample of the k-th worker node is

l()为损失函数。Among them, the model prediction result is

l() is the loss function.

Then the local gradient is clipped, and Gaussian noise is added, and finally the local gradient g _k (w _t ) of the kth node is obtained as

Step 4: Global model update stage;

After receiving the local gradients of each node, the master node runs a gradient aggregation algorithm with Byzantine fault tolerance (such as multi-Krum, l-nearest aggregation, etc.) to aggregate the local gradients to obtain the global gradient and update the model, while using moments accountant to track loss of privacy. Next, the system will run the IPBFT consensus algorithm: the master node will first write the aggregate calculation results (including master node id, aggregate gradient, differential privacy loss, selected node id and local gradient information) into block block _t , and then The block _{t is} sent to the endorsement node for verification. If the verification is passed, the block _{t is} broadcast to all blockchain nodes, and the block is successfully added to the blockchain.

IPBFT: Among them, as shown in Figure 4, Figure 5, Figure 6, and Figure 7, the consensus process of the IPBFT algorithm consists of 8 stages, and the distribution is request-1 (R-1), pre-prepare-1 (Pp-1 ), prepare-1(P-2), commit-1(C-1), request-2(R-2), pre-prepare-2(Pp-2), prepare-2(P-2) and commit -2 (C-2). All user nodes are divided into master nodes (L), endorsement nodes (E) and general nodes (G). The normal situation is shown in Figure 4. The system only needs to execute the four steps of R-1, Pp-1, P-1 and C-1 to reach consensus. Figures 5 and 6 belong to abnormal situations, and the system executes the four steps of R-2, Pp-2, P-2 and C-2 more than the normal situation. The time when the system starts to run IPBFT is defined as time 0. If the system reaches consensus before time _t1 , a new master node will be selected and the next consensus process will begin; otherwise, IPBFT will judge whether the master node is malicious node. If the system does not reach consensus at time _t2 , the master node in this consensus process will be considered a malicious node and will be removed from the system. Figure 7 is an extremely abnormal situation. In this case, the wrong aggregation result will be consensus, but in our system, malicious nodes will be continuously eliminated. At the same time, in the alliance chain, due to the addition of CA, the possibility of nodes doing evil Very low, so this extremely malicious situation is a small probability event and is almost impossible to happen. And this wrong aggregation result will not affect the final training model even if it is introduced at the early stage of training.

m，则此时IPBFT的共识过程如下：As shown in Figure 4, under normal circumstances, the master node is honest, and the number of honest endorsing nodes is not less than

m, then the consensus process of IPBFT is as follows:

1) R-1: Each user node sends its own local gradient to the master node and the endorsement node.

2) Pp-1: After calculation, the master node sends block _t to the endorsement node for verification.

3) P-1: If block _t is verified by the endorsement node E _i , the endorsement node will send a valid endorsement certificate Vote(block _t , E _i ) to the master node.

m赞同凭证，然后会生成区块证书 Cert(block_t)。然后主节点会将区块block_t和区块证书Cert(block_t)发送给其余用户节点进行区块同步。4) C-1: In this case, the master node will receive at least

m approves the certificate, and then generates the block certificate Cert(block _t ). Then the master node will send the block block _t and the block certificate Cert(block _t ) to the rest of the user nodes for block synchronization.

m，则此时IPBFT的共识过程如下：As shown in Figure 5, in this abnormal situation, the master node is malicious, and the number of honest endorsing nodes is not less than

m, then the consensus process of IPBFT is as follows:

1) R-1: Each user node sends its own local gradient to the master node and the endorsement node.

2) Pp-1: After calculation, the master node sends block _t to the endorsement node for verification.

m，主节点也就不会产生区块证书Cert(block_t)。3) P-1: Since block _t will not be verified by malicious endorsing nodes, these malicious nodes will not send endorsement credentials to the master node. Therefore, the number of endorsement credentials received by the masternode will be less than

m, the master node will not generate the block certificate Cert(block _t ).

4) R-2: In this abnormal situation, the system does not reach a consensus on block _t before time _t1 , and all user nodes will send their local gradients to the rest of the user nodes.

K(K是用户节点的数量)，系统不会达成对区块block_t共识。同时，系统不会在t₂时刻之前达成共识，主节点会被认为是恶意的，并将会从系统中被剔除。5) Pp-2: The master node will broadcast block _t to all other user nodes for verification. But in this abnormal situation, the number of endorsement credentials received by the master node will be less than

K (K is the number of user nodes), the system will not reach a consensus on block _t . At the same time, the system will not reach a consensus before time _t2 , the master node will be considered malicious and will be eliminated from the system.

m，则此时IPBFT的共识过程如下：As shown in Figure 6, in this abnormal situation, the master node is honest and the number of honest endorsing nodes is less than

m, then the consensus process of IPBFT is as follows:

1) R-1: Each user node sends its own local gradient to the master node and the endorsement node.

2) Pp-1: After calculation, the master node sends block _t to the endorsement node for verification.

m，主节点将不能生成区块证书。3) P-1: If block _t is verified by the endorsement node E _i , the endorsement node will send a valid endorsement certificate Vote(block _t , E _i ) to the master node. However, in this case, the number of valid endorsement credentials will be less than

m, the master node will not be able to generate block certificates.

4) R-2: In this abnormal situation, the system does not reach a consensus on block _t before time _t1 , and all user nodes will send their local gradients to the rest of the user nodes.

5) Pp-2: The master node will broadcast block _t to all other user nodes for verification.

6) P-2: If the block block _t is _verified by the user node Pi, the user node will send a valid approval certificate Vote(block _t , _Pi ) to the master node.

K，它就可以生成区块证书Cert(block_t)。然后主节点会将区块block_t和区块证书Cert(block_t)发送给其余用户节点进行区块同步。7) C-2: In this case, the number of endorsement credentials received by the master node will be no less than

K, it can generate the block certificate Cert(block _t ). Then the master node will send the block block _t and the block certificate Cert(block _t ) to the rest of the user nodes for block synchronization.

m，则此时IPBFT的共识过程如下：As shown in Figure 7, in this extremely malicious situation, the masternode is malicious, and the number of endorsing nodes malicious and colluding with the masternode is not less than

m, then the consensus process of IPBFT is as follows:

1) R-1: Each user node sends its own local gradient to the master node and the endorsement node.

2) Pp-1: The malicious master node will get the wrong aggregation result and send block _t to the endorsement node for verification.

3) P-1: In this case, block _t will be verified by the malicious endorser node E _i that colludes with the master node, and the endorser node will send the endorsement certificate Vote(block _t , E _i ) to the master node. .

m赞同凭证，会生成区块证书Cert(block_t)然后主节点会将区块block_t和区块证书Cert(block_t)发送给其余用户节点进行区块同步。4) C-1: In this case, the master node will receive at least

m approves the certificate, and the block certificate Cert(block _t ) will be generated, and then the master node will send the block block _t and the block certificate Cert(block _t ) to other user nodes for block synchronization.

It can be seen that in the extremely abnormal situation of Figure 7, the master node and some endorsing nodes are malicious and colluding, and the probability of this situation in our system is extremely small. Because with the progress of training, our system will gradually eliminate malicious nodes, and in the alliance chain, due to the addition of CA, the probability of nodes doing evil is extremely small.

Table 1 shows the performance comparison of related consensus algorithms applied in the distributed machine learning framework proposed in the present invention. It can be seen that the consensus algorithm IPBFT proposed by the present invention can identify malicious nodes, while PBFT and PoW cannot identify malicious nodes. In addition, PBFT and PoW need to transfer local gradients to each other in all nodes, so their communication complexity is O(K ² ), where K is the number of user nodes. After running IPBFT, after the malicious nodes are gradually eliminated as the training progresses, the user node only needs to send the local gradient to 1 master node and m endorsement nodes, so in general, its communication complexity is O(mK ); only in the two malicious cases shown in Figure 5 and Figure 6, its communication complexity is O(K ² ). Therefore, the communication complexity of IPBFT is better than that of PBFT and PoW.

Table 1 Comparison of related consensus algorithms

Step 5: training termination stage;

When the training model meets the expected requirements (the model accuracy meets the requirements or the privacy loss of the model will exceed the privacy budget requirement), the system stops training. In the future, the main function of the blockchain is to maintain the transaction of the machine learning model. If new data is added or the model algorithm needs to be improved, the machine learning training process can be restarted.

Example 2:

Figure 8 is a comparison diagram of the number of nodes with the number of iterations when 20 of the 100 nodes in the blockchain are subjected to Byzantine attacks during the gradient aggregation process in Example 2 of the present invention, respectively running the IPBFT algorithm and the PoW algorithm.

Figure 9 is a schematic diagram of the comparison of the accuracy of the test set of the model obtained by different aggregation methods when 8 of the 20 nodes in the blockchain are subjected to Byzantine attack when performing local gradient calculation (differential privacy is not introduced) in Example 2 of the present invention.

10 is a schematic diagram of the comparison of the accuracy of the test set of the model obtained by different aggregation methods after 8 nodes of the 20 nodes in the blockchain are subjected to Byzantine attack when performing local gradient calculation (introduced differential privacy) in Example 2 of the present invention.

As can be seen in Figure 8, with the operation of the system, the IPBFT algorithm found 20 malicious nodes and eliminated these malicious nodes from the system, while the malicious nodes in the system running the PoW algorithm are always there.

As can be seen in Figure 9, without the introduction of differential privacy, the multi-Krum algorithm has better aggregation effect than the median algorithm after the node is attacked by Byzantine (stochastic gradient attack), and is closer to the ideal situation.

As can be seen in Figure 10, when the differential privacy is introduced, after the node is subjected to Byzantine attack (stochastic gradient attack), the median algorithm has better aggregation effect than the multi-Krum algorithm, and is closer to the ideal situation.

It can be seen from the above experimental results that the framework we propose can effectively solve the Byzantine attack on both the parameter server and the worker nodes in distributed machine learning. At the same time, the framework can reward contributing nodes and eliminate malicious nodes to ensure The system can run better. In addition, our framework can apply other different Byzantine aggregation algorithms to optimize the model performance.

Although the embodiments disclosed in the present invention are as above, the content described is only an embodiment adopted to facilitate understanding of the present invention, and is not intended to limit the present invention. Any person skilled in the art to which the present invention belongs, without departing from the spirit and scope disclosed by the present invention, can make any modifications and changes in the form and details of the implementation, but the scope of patent protection of the present invention, The scope as defined by the appended claims shall still prevail.

Claims (6)

1. A secure, privacy preserving, tradable distributed machine learning framework based on blockchain techniques, comprising:

part 1, a Certificate Authority (CA) is responsible for issuing and revoking digital certificates for block chain nodes and carrying out authority management on the nodes;

the block link points are composed of user nodes and transaction nodes and are respectively responsible for maintaining the machine learning model and participating in the machine learning model transaction;

part 3, the intelligent contract is composed of a machine learning intelligent contract (MLMC) and a model contribution intelligent contract (MCMC), and the distribution defines the operation rule of distributed machine learning and the profit division is carried out on the nodes according to the model contribution degree;

part 4, the distributed account book records model data (including local model and global model conditions) and model transaction data in the machine learning model training process;

and part 5, the data provider is responsible for collecting local data and uploading the local data to the blockchain node server.

2. The method of claim 1 for operating a distributed machine learning framework based on blockchain technology for security, privacy protection and tradable, the method comprising the steps of:

step 1, alliance chain initialization stage: the CA server issues a digital certificate to an initial node of the alliance chain, and all participants establish connection to achieve some initial consensus;

step 2, parameter initialization stage: all user nodes achieve consistency consensus of the neural network model and synchronize test set data of the system;

step 3, local gradient calculation stage: all user nodes sequentially and circularly select main nodes according to the sequence that id is from small to large, m nodes behind the id of the main node are endorsement nodes, then each node calculates local gradient by using local data and a current model, Gaussian noise is added to the gradient to enable the local gradient to meet a differential privacy mechanism, and finally the local gradient is sent to the main node and the endorsement nodes;

step 4, global model updating stage: the main node calculates a global gradient according to the local gradient of each node and a gradient aggregation algorithm with Byzantine fault tolerance, then the system runs an IPBFT consensus algorithm, if the global gradient obtains the system consensus, the global model is updated, and the related information of the global model is written into the block;

step 5, training termination stage: when the training model meets the expected requirements, the system does not train the model any more, and the subsequent action is maintenance model transaction.

3. The method of claim 2 for operating a distributed machine learning framework based on blockchain technology for security, privacy protection and tradable, wherein the step 1: the alliance chain initialization stage specifically comprises the following steps:

the CA server issues a digital certificate to the initial node of the alliance chain, all participants establish connection, and some initial consensus is achieved: a. unifying criteria established by the data set of everybody; b. unifying the standard of the model transaction fee, wherein the transaction fee can be increased along with the perfection degree of the model; c. and unifying the selection rules of the main nodes and the endorsement nodes, wherein the main nodes are sequentially selected in a circulating mode according to the sequence from small to large of the node ids, and m nodes behind the main node ids are the endorsement nodes.

4. The method of claim 2 for operating a distributed machine learning framework based on blockchain technology for security, privacy protection and tradable, wherein step 2: the parameter initialization stage is as follows: in the parameter initialization stage, all user nodes achieve the consistency consensus of the neural network model, including the determination of the network structure of the neural network model, the batch size B, the training iteration times T and the learning rate eta_tInitial weight w₀The cutting threshold value is C, the noise size sigma and other parameters, meanwhile, the block chain node issues the data set standard to a data provider, the data provider collects a training set and uploads the training set to the block chain node, and after the neural network model and the data set are prepared, all user nodes contribute to a test set and unify the test set data of the system. The entire system can then begin neural network model training.

5. The method of claim 2 for operating a distributed machine learning framework based on blockchain technology for security, privacy protection and tradable, wherein step 3: the local gradient calculation stage is as follows:

firstly, determining a main node and an endorsement node by all user nodes in a block chain, if the id of the main node is i, the id of the endorsement node is i +1, i +2, …, i + m, then obtaining a local gradient by each node according to a data set and a current model of the node, adding Gaussian noise to the local gradient to enable the local gradient to meet a differential privacy mechanism, and finally sending the local gradient to the main node and the endorsement node;

the specific calculation process is as follows: suppose that in the t-th iteration, B training data sets are obtained from the kth node

Global model weight of w_tThe clipping threshold is C, and the noise size is sigma;

in the t-th iteration, the local gradient of each sample of the k-th working node is

Wherein the model predicts as

l () is a loss function;

then cutting the local gradient, adding Gaussian noise, and finally obtaining the local gradient g of the kth node_k(w_t) Is composed of

6. The method of claim 2 for operating a distributed machine learning framework based on blockchain technology for security, privacy protection and tradable, wherein step 4: the global model updating stage specifically includes: after receiving the local gradients of each node, the master node operates a gradient aggregation algorithm with Byzantine fault tolerance to aggregate the local gradients to obtain a global gradient and update a model, meanwhile, a moments accounting method is adopted to track privacy loss, and then,the system will run the IPBFT consensus algorithm: the master node writes the result of the aggregation calculation into the block_tThen block is put in_tSending the block to an endorsement node for verification, and if the block passes the verification, sending the block to a block of endorsements for verification_tBroadcast to all blockchain nodes and the block is successfully added into the blockchain.

Images