基于区块链的可信联邦学习用于电子健康记录：利用去中心化标识符和可验证凭证保障参与者身份
Trustworthy Blockchain-based Federated Learning for Electronic Health Records: Identity-Gated Participation against Sybil Attacks
AI总结：
本文提出基于区块链的可信联邦学习框架，利用去中心化标识符和可验证凭证保障医疗数据安全，有效抵御Sybil攻击，提升模型预测性能。
摘要：
医疗数字化已生成大量电子健康记录（EHRs），为训练人工智能（AI）模型提供了前所未有的机会。然而，严格的隐私法规如GDPR和HIPAA造成了数据孤岛，阻碍了集中式训练。联邦学习（FL）作为一种有前途的解决方案，使在不共享原始患者数据的情况下实现协作模型训练成为可能。尽管其潜力巨大，FL仍易受到污染和Sybil攻击的威胁，恶意参与者会通过伪造身份破坏全局模型或入侵网络。尽管近期方法整合了区块链技术以提高可审计性，但它们主要依赖于概率声誉系统，而非稳健的密码学身份验证。本文提出了一种基于区块链的可信联邦学习（TBFL）框架，整合了自我主权身份（SSI）标准。通过利用去中心化标识符（DIDs）和可验证凭证（VCs），我们的架构确保只有经过认证的医疗实体才能参与全局模型。通过使用MIMIC-IV数据集进行全面评估，我们证明，将信任锚定在密码学身份验证而非行为模式上，可以显著降低安全风险，同时保持临床效用。我们的结果表明，该框架成功中和了100%的Sybil攻击，实现了稳健的预测性能（AUC=0.954，召回率=0.890），并引入了极小的计算开销（<0.12%）。该方法为跨机构健康数据协作提供了一个安全、可扩展且经济可行的生态系统，总运营成本约为18美元，用于跨多个机构的100次训练轮次。
英文摘要：
Federated learning allows hospitals to train a shared clinical model without exchanging patient records, but its aggregation assumes that each participant is a distinct institution. In an open federation, an adversary can register many fake identities (a Sybil attack) and outweigh honest hospitals. Byzantine-robust aggregation mitigates such attacks only while the adversary is a minority. We ask whether binding participation to accountable institutional identity closes that gap, and at what cost. We present TBFL, a framework in which an accountable authority issues Verifiable Credentials to the Decentralized Identifiers of hospitals, and a smart-contract registry on a peer-to-peer ledger admits model updates only from credentialed senders. We evaluated a prototype on in-hospital mortality prediction with MIMIC-IV records split across simulated hospitals, comparing the identity gate with federated averaging, three robust aggregators, norm clipping, and a similarity-based defense. Robust aggregators held against a Sybil minority, and norm clipping only against random vectors; all failed when half the participants were Sybils trained on real records with flipped labels. The similarity-based defense stopped mutually similar Sybils but yielded to perturbed ones. The gate rejected all unauthorized submissions and maintained attack-free performance for every strategy up to 60% Sybils. It did not stop credentialed hospitals that flipped their own labels, whereas the gate followed by the coordinate-wise median withstood both. On a local node, on-chain checks added about 1% to training time; fees made training impractical on a public mainnet but affordable on a rollup. Identity gating complements robust aggregation rather than replacing it.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
