分层联邦学习中非交互式可验证安全聚合方法

doi:10.19678/j.issn.1000-3428.0252018

计算机工程 ›› 2026, Vol. 52 ›› Issue (8): 149-162. doi: 10.19678/j.issn.1000-3428.0252018

分层联邦学习中非交互式可验证安全聚合方法

宋书汉¹^,², 田有亮¹^,²^,³^,*(), 王帅¹^,²

1. 贵州大学公共大数据国家重点实验室, 贵州贵阳 550025
2. 贵州大学密码学与数据安全研究所, 贵州贵阳 550025
3. 贵州大学大数据与信息工程学院, 贵州贵阳 550025

收稿日期:2025-01-08 修回日期:2025-03-20 出版日期:2026-08-15 发布日期:2025-05-14
通讯作者: 田有亮
作者简介:
宋书汉, 男, 硕士研究生, 主研方向为联邦学习、安全多方计算
田有亮(通信作者), 教授、博士、博士生导师
王帅, 博士研究生
基金资助:
国家重点研发计划(2021YFB3101100); 国家自然科学基金(62272123); 国家自然科学基金(62272102); 贵州省高层次创新型人才基金(黔科合平台人才[2020]6008); 贵州省科技计划(黔科合平台人才[2020]5017); 贵州省科技计划(黔科合支撑[2022]一般065)

Secure Aggregation Method for Hierarchical Federated Learning with Non-interactive Verification

SONG Shuhan¹^,², TIAN Youliang¹^,²^,³^,*(), WANG Shuai¹^,²

1. State Key Laboratory of Public Big Data, Guizhou University, Guiyang 550025, Guizhou, China
2. Institute of Cryptography and Data Security, Guizhou University, Guiyang 550025, Guizhou, China
3. College of Big Data and Information Engineering, Guizhou University, Guiyang 550025, Guizhou, China

Received:2025-01-08 Revised:2025-03-20 Online:2026-08-15 Published:2025-05-14
Contact: TIAN Youliang

摘要/Abstract

摘要：

联邦学习(FL)作为一种分布式机器学习(ML)框架, 能够在保护数据隐私的同时实现模型协同训练。然而, FL在隐私保护、参与方互信及恶意攻击等方面仍面临挑战, 尤其是在分层联邦学习(HFL)中, 中心服务器、中间层及终端设备的不可信性可能导致隐私泄露或恶意操纵。此外, 恶意用户可能上传异常参数破坏训练进程, 影响模型性能。因此, 如何在HFL中高效实现安全验证和恶意检测, 成为亟待解决的问题。针对HFL中的参与方无法互信、拜占庭攻击等问题, 提出一种分层架构下的非交互式验证FL安全聚合方案。首先, 基于承诺方案设计多层架构下的FL非交互式验证机制, 允许各参与方进行相互验证。其次, 基于零知识范围证明构造恶意更新的约束与检测方案, 使服务器能检测并剔除恶意用户。再次, 基于中国剩余定理(CRT)设计噪声掩码方案, 在保证用户本地隐私的同时还支持用户的退出与重连; 最后, 安全性分析与实验评估表明, 该方案能够以较高的效率实现安全相互验证以及恶意检测。

关键词: 联邦学习, 零知识证明, 可验证性, 鲁棒性, 隐私保护

Abstract:

Federated Learning (FL), a distributed Machine Learning (ML) framework, can achieve collaborative model training while protecting data privacy. However, challenges remain in ensuring privacy protection, establishment of mutual trust among participants, and defending against malicious attacks. In Hierarchical Federated Learning (HFL), the potential untrustworthiness of central servers, intermediate layers, and edge devices poses risks of privacy leakage and malicious manipulation. Additionally, malicious users may upload abnormal parameters, disrupting the training process and affecting model performance. Therefore, efficient security verification and malicious detection are critical issues in HFL. To address the challenges of mutual distrust among participants and Byzantine attacks in HFL, this paper proposes a secure aggregation scheme with non-interactive verification under a hierarchical architecture. First, a mutual verification mechanism for HFL is designed based on a commitment scheme, allowing participants to perform mutual verification. Second, a constraint and detection scheme for malicious updates is constructed using non-interactive zero-knowledge range proofs, enabling the server to detect and filter out malicious users. Third, a noise masking scheme is designed based on the Chinese Remainder Theorem (CRT), supporting user exit and reconnection while ensuring users' local privacy. Finally, security analysis and experimental evaluation demonstrate that the proposed scheme achieves secure mutual verification and malicious detection with high efficiency.

Key words: Federated Learning (FL), zero-knowledge proof, verifiability, robustness, privacy preserving

宋书汉, 田有亮, 王帅. 分层联邦学习中非交互式可验证安全聚合方法[J]. 计算机工程, 2026, 52(8): 149-162.

SONG Shuhan, TIAN Youliang, WANG Shuai. Secure Aggregation Method for Hierarchical Federated Learning with Non-interactive Verification[J]. Computer Engineering, 2026, 52(8): 149-162.

https://www.ecice06.com/CN/Y2026/V52/I8/149

图/表 15

图1 系统架构

Fig.1 System architecture

图2 基于CNN与MNIST IID的测试准确率

Fig.2 Test accuracy based on CNN and MNIST IID

图3 基于CNN与MNIST Non-IID的测试准确率

Fig.3 Test accuracy based on CNN and MNIST Non-IID

图4 基于Resnet-18与CIFAR-10 IID的测试准确率

Fig.4 Test accuracy based on Resnet-18 and CIFAR-10 IID

图5 基于Resnet-18与CIFAR-10 Non-IID的测试准确率

Fig.5 Test accuracy based on Resnet-18 and CIFAR-10 Non-IID

图6 不同安全参数下的承诺生成开销

Fig.6 Commitment generation overhead with different safe parameter

图7 不同安全参数下的承诺通信开销

Fig.7 Commitment communication overhead with different safe parameter

图8 不同策略下的范围证明通信开销

Fig.8 Range proof communication overhead with different strategy

图9 不同恶意比例下MNIST的测试准确率

Fig.9 Test accuracy on MNIST with different malicious ratios

图10 不同恶意比例下CIFAR-10的测试准确率

Fig.10 Test accuracy on CIFAR-10 with different malicious ratios

参考文献 37

1	LECUN Y , BENGIO Y , HINTON G . Deep learning. Nature, 2015, 521 (7553): 436- 444. doi: 10.1038/nature14539
2	YU K H , BEAM A L , KOHANE I S . Artificial intelligence in healthcare. Nature Biomedical Engineering, 2018, 2 (10): 719- 731. doi: 10.1038/s41551-018-0305-z
3	江晟, 张仲义, 汪宗洋, 等. 基于改进YOLOv7的交通路口目标识别算法. 吉林大学学报(理学版), 2024, 62 (3): 665- 673.
	JIANG S , ZHANG Z Y , WANG Z Y , et al. Target recognition algorithm of traffic intersection based on improved YOLOv7. Journal of Jilin University (Science Edition), 2024, 62 (3): 665- 673.
4	AHISKA K , OZGOREN M K , LEBLEBICIOGLU M K . Autopilot design for vehicle cornering through icy roads. IEEE Transactions on Vehicular Technology, 2017, 67 (3): 1867- 1880.
5	GE Z Q , SONG Z H , DING S X , et al. Data mining and analytics in the process industry: the role of machine learning. IEEE Access, 2017, 5, 20590- 20616. doi: 10.1109/ACCESS.2017.2756872
6	KONEČNÝ J, MCMAHAN H B, RAMAGE D, et al. Federated optimization: distributed machine learning for on-device intelligence[EB/OL]. [2024-12-18]. https://arxiv.org/abs/1610.02527.
7	ZHANG L , LI A R , PENG H Y , et al. Privacy-preserving data selection for horizontal and vertical federated learning. IEEE Transactions on Parallel and Distributed Systems, 2024, 35 (11): 2054- 2068. doi: 10.1109/TPDS.2024.3439709
8	王汝言, 陈伟, 张普宁, 等. 异构物联网下资源高效的分层协同联邦学习方法. 电子与信息学报, 2023, 45 (8): 2847- 2855.
	WANG R Y , CHEN W , ZHANG P N , et al. Resource-efficient hierarchical collaborative federated learning in heterogeneous Internet of Things. Journal of Electronics & Information Technology, 2023, 45 (8): 2847- 2855.
9	LIM W Y B , NG J S , XIONG Z H , et al. Decentralized edge intelligence: a dynamic resource allocation framework for hierarchical federated learning. IEEE Transactions on Parallel and Distributed Systems, 2021, 33 (3): 536- 550.
10	WANG Z B, SONG M K, ZHANG Z F, et al. Beyond inferring class representatives: user-level privacy leakage from federated learning[C]//Proceedings of the IEEE INFOCOM 2019. Washington D.C., USA: IEEE Press, 2019: 2512-2520.
11	MALEKZADEH M, BOROVYKH A, GÜNDÜZ D. Honest-but-curious nets: sensitive attributes of private inputs can be secretly coded into the classifiers' outputs[C]//Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. New York, USA: ACM Press, 2021: 825-844.
12	NGUYEN T, LAI P, TRAN K, et al. Active membership inference attack under local differential privacy in federated learning[EB/OL]. [2024-12-18]. https://arxiv.org/abs/2302.12685.
13	CAO X Y, GONG N Z. MPAF: model poisoning attacks to federated learning based on fake clients[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). Washington D.C., USA: IEEE Press, 2022: 3395-3403.
14	HE X L , XU Y , ZHANG S C , et al. Enhance membership inference attacks in federated learning. Computers & Security, 2024, 136, 103535.
15	WIBAWA F, CATAK F O, KUZLU M, et al. Homomorphic encryption and federated learning based privacy-preserving CNN training: COVID-19 detection use-case[C]//Proccedings of the European Interdisciplinary Cybersecurity Conference. New York, USA: ACM Press, 2022: 85-90.
16	ZHANG C , EKANUT S , ZHEN L L , et al. Augmented multi-party computation against gradient leakage in federated learning. IEEE Transactions on Big Data, 2024, 10 (6): 742- 751. doi: 10.1109/TBDATA.2022.3208736
17	CHAMIKARA M A P, LIU D X, CAMTEPE S, et al. Local differential privacy forFederated learning[C]// Proccedings of the European Symposium on Research in Computer Security. Berlin, Germany: Springer, 2022: 195-216.
18	BONAWITZ K, IVANOV V, KREUTER B, et al. Practical secure aggregation for privacy-preserving machine learning[C]//Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New York, USA: ACM Press, 2017: 1175-1191.
19	GUO X J , LIU Z L , LI J , et al. VeriFL: communication-efficient and fast verifiable aggregation for federated learning. IEEE Transactions on Information Forensics and Security, 2020, 16, 1736- 1751.
20	FU A M , ZHANG X L , XIONG N X , et al. VFL: a verifiable federated learning with privacy-preserving for big data in industrial IoT. IEEE Transactions on Industrial Informatics, 2020, 18 (5): 3316- 3326.
21	GAO S , LUO J J , ZHU J M , et al. VCD-FL: verifiable, collusion-resistant, and dynamic federated learning. IEEE Transactions on Information Forensics and Security, 2023, 18, 3760- 3773. doi: 10.1109/TIFS.2023.3271268
22	LI T , GAO C Z , JIANG L L , et al. Publicly verifiable privacy-preserving aggregation and its application in IoT. Journal of Network and Computer Applications, 2019, 126, 39- 44. doi: 10.1016/j.jnca.2018.09.018
23	HAHN C , KIM H , KIM M , et al. VerSA: verifiable secure aggregation for cross-device federated learning. IEEE Transactions on Dependable and Secure Computing, 2023, 20 (1): 36- 52. doi: 10.1109/TDSC.2021.3126323
24	张首勋, 王玲玲, 耿克, 等. 融合零知识证明的去中心联邦学习可信聚合方案. 计算机工程与应用, 2025, 61 (8): 274- 282.
	ZHANG S X , WANG L L , GENG K , et al. Trustful aggregation scheme for decentralized federated learning based on zero knowledge proof. Computer Engineering and Applications, 2025, 61 (8): 274- 282.
25	AHMADI M, NOURMOHAMMADI R. zkFDL: an efficient and privacy-preserving decentralized federated learning with zero knowledge proof[C]//Proceedings of the IEEE 3rd International Conference on AI in Cybersecurity (ICAIC). Washington D.C., USA: IEEE Press, 2024: 1-10.
26	魏立斐, 张无忌, 张蕾, 等. 基于本地差分隐私的异步横向联邦安全梯度聚合方案. 电子与信息学报, 2024, 46 (7): 3010- 3018.
	WEI L F , ZHANG W J , ZHANG L , et al. A secure gradient aggregation scheme based on local differential privacy in asynchronous horizontal federated learning. Journal of Electronics & Information Technology, 2024, 46 (7): 3010- 3018.
27	LI X Y , QU Z , ZHAO S Q , et al. LoMar: a local defense against poisoning attack on federated learning. IEEE Transactions on Dependable and Secure Computing, 2023, 20 (1): 437- 450. doi: 10.1109/TDSC.2021.3135422
28	SUN Z T, KAIROUZ P, SURESH A T, et al. Can you really backdoor federated learning?[EB/OL]. [2024-12-18]. https://arxiv.org/abs/1911.07963.
29	LYCKLAMA H, BURKHALTER L, VIAND A, et al. RoFL: robustness of secure federated learning[EB/OL]. [2024-12-18]. https://arxiv.org/abs/2107.03311.
30	MCMAHAN H B, MOORE E, RAMAGE D, et al. Communication-efficient learning of deep networks from decentralized data[C]//Proceedings of the International Conference on Artificial Intelligence and Statistics. [S. l.]: PMLR, 2017: 1273-1282.
31	李顺东, 王道顺. 现代密码学: 理论, 方法与研究前沿. 北京: 科学出版社, 2009.
	LI S D , WANG D S . Modern cryptography: theory, methods and research frontiers. Beijing: Science Press, 2009.
32	杨波, 杨启良. 密码学中的可证明安全性. 2版北京: 清华大学出版社, 2024.
	YANG B , YANG Q L . Provable security in cryptography. 2nd ed Beijing: Tsinghua University Press, 2024.
33	BVNZ B, BOOTLE J, BONEH D, et al. Bulletproofs: short proofs for confidential transactions and more[C]//Proceedings of the IEEE Symposium on Security and Privacy (SP). Washington D.C., USA: IEEE Press, 2018: 315-334.
34	YE H , LIU J Q , ZHEN H , et al. VREFL: verifiable and reconnection-efficient federated learning in IoT scenarios. Journal of Network and Computer Applications, 2022, 207, 103486. doi: 10.1016/j.jnca.2022.103486
35	LIU L M, ZHANG J, SONG S H, et al. Client-edge-cloud hierarchical federated learning[C]//Proceedings of the 2020 IEEE International Conference on Communications (ICC). Washington D.C., USA: IEEE Press, 2020: 1-6.
36	ZHU Y Z, WU Y C, LUO Z J, et al. Secure and verifiable data collaboration with low-cost zero-knowledge proofs[EB/OL]. [2024-12-18]. https://arxiv.org/abs/2311.15310.
37	WANG Z P , DONG N Q , SUN J H , et al. zkFL: zero-knowledge proof-based gradient aggregation for federated learning. IEEE Transactions on Big Data, 2025, 11 (2): 447- 460. doi: 10.1109/TBDATA.2024.3403370

[1]	任知非, 张家铭, 陈超超, 吴天星. 基于平滑优化的鲁棒ID遗忘[J]. 计算机工程, 2026, 52(8): 114-125.
[2]	王佳鑫, 毛谦昂, 颜嘉麒, 印杰, 何源, 张祎. 区块链混币监管技术研究综述[J]. 计算机工程, 2026, 52(7): 22-39.
[3]	汪雅琪, 王明文. 结合生成和嵌入网络的人脸隐私保护识别[J]. 计算机工程, 2026, 52(7): 265-276.
[4]	李学相, 郑永利, 张怡泽, 段鹏松. 基于机器学习与预训练模型的流量分析方法综述[J]. 计算机工程, 2026, 52(6): 53-67.
[5]	曹天涯, 张宇帆, 贾俊杰. 一种有效提高数据可用性的联邦学习隐私保护算法[J]. 计算机工程, 2026, 52(6): 249-257.
[6]	李江涛, 马礼, 李阳. 基于大小模型融合的医疗数据分类方法[J]. 计算机工程, 2026, 52(5): 360-370.
[7]	王田, 李果, 梅雅欣, 钟文韬. 传感云与边缘计算综述(特邀)[J]. 计算机工程, 2026, 52(5): 3-42.
[8]	刘海军, 付晓东. 结合旋转自监督和CLIP指导的长尾数据联邦学习[J]. 计算机工程, 2026, 52(5): 129-138.
[9]	牛淑芬, 王宁, 周旭升, 孔维滢, 陈丽华. 智慧医疗中基于秘密共享和同态加密的安全联邦学习方案[J]. 计算机工程, 2026, 52(4): 302-312.
[10]	尹恒杰, 郑克清, 柯建楠, 董云泉. 基于本地动量加速的非独立同分布联邦学习方法[J]. 计算机工程, 2026, 52(4): 103-110.
[11]	周岳霖, 钟伯成, 王瑞. 基于区块链的轻量级车载自组网条件隐私保护认证[J]. 计算机工程, 2026, 52(3): 201-210.
[12]	陈先意, 糜慧, 何俊杰, 付章杰. 基于结构嵌入的可溯源联邦学习版权保护方法[J]. 计算机工程, 2026, 52(2): 253-264.
[13]	曹天涯, 张雨静, 贾俊杰, 张宇帆, 邓晓飞. 基于个性化梯度裁剪的联邦学习隐私保护算法[J]. 计算机工程, 2026, 52(2): 265-274.
[14]	张黔会, 袁凌云, 谢天玉, 吴加英. 智能合约驱动的公平可验证秘密共享[J]. 计算机工程, 2025, 51(9): 177-191.
[15]	毕昌兵, 田有亮. 车联网中基于身份签名的匿名可追溯消息认证方案[J]. 计算机工程, 2025, 51(9): 158-165.

选择文件类型/文献管理软件名称

选择包含的内容

分层联邦学习中非交互式可验证安全聚合方法

Secure Aggregation Method for Hierarchical Federated Learning with Non-interactive Verification

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 15

参考文献 37

相关文章 15

编辑推荐

Metrics

本文评价

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

分层联邦学习中非交互式可验证安全聚合方法

Secure Aggregation Method for Hierarchical Federated Learning with Non-interactive Verification

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 15

参考文献 37

相关文章 15

编辑推荐

Metrics

本文评价