摘要： 由于参与联邦学习联合训练的客户端并非完全可信,从而带来联邦学习模型的版权泄露风险,而当前由中央服务器嵌入水印的方法面临许多难题,例如难以适用于安全联邦学习架构、溯源能力不足、服务器计算负担过重等。针对上述问题,提出一种基于正交约束的可溯源安全联邦学习版权保护方案FedSOW。首先,服务器复制待嵌入水印的卷积层形成双层通道,作为初始化水印层;然后,根据施密特正交化原理设计正交约束规则并以不同的规则约束局部模型水印层的输出特征;最后,客户端通过训练反向引导水印层形成具有不同正交结构的可溯源局部模型。实验结果表明,与现有的水印方案相比,FedSOW具有较好的水印持续性,确保能在安全联邦学习框架的训练过程中进行版权验证,在可溯源性、保真度和抗攻击能力等方面表现出卓越的性能。

关键词: 联邦学习, 版权保护, 可溯源性, 鲁棒性, 机器学习

Abstract: Owing to the risk of copyright leakage in Federated Learning (FL) models caused by untrustworthy clients participating in joint training, current watermark embedding methods used by the central server face several challenges, such as incompatibility with secure FL architectures, insufficient traceability, and excessive server computational burden. Therefore, this study proposes a traceable and secure FL copyright protection scheme based on orthogonal constraints, abbreviated as FedSOW. Initially, the server replicates the convolutional layer embedded in the watermark to form a dual-channel layer and selects this dual-channel layer as the initial watermark layer. Subsequently, forward constraint rules are designed based on the principle of Schmidt orthogonalization, guiding the output features of the watermark layer of the client model using the orthogonal constraint. Finally, the client trains the watermark layer to form traceable local models with different orthogonal structures. Experimental results show that, compared with existing watermarking schemes, FedSOW demonstrates strong watermark persistence, ensuring copyright verification in the training round within the secure FL framework. Moreover, FedSOW exhibits excellent performance in terms of traceability, fidelity, and attack resistance.

Key words: Federated Learning (FL), copyright protection, traceability, robustness, machine learning

中图分类号: 

• TP309