Algorithm 2 Anti Poisoning Privacy-Perserving Federated Learning

01. Input: $C,r_i,r_j,s_i,{\delta }_j,w_i,\Delta w_i$.

02. Output: updated reward points $r_j^{\prime },r_i^{\prime }$, parameters $w_i^{\prime }$, and local reliability $f_i^{j^{\prime }}$.

03. 1: Trade gradients via sharing level, reward points and local reliability: At every

04. round, the goal of party $i$ is to download $s_i=r_i$ model parameter updates from

05. the other parties, while party $j\in C$ is able to provide about ${\delta }_j\ast \left|w_j\right|$ model

06. parameter updates, one reward point is spent for every download and rewarded for

07. every upload. Parties update their model according to the model parameter updates

08. of party $j\in C$ as the following:

09. for $j\in C$ do

10.      $s_i^j=\min \left(f_i^j\ast s_i,{\delta }_j\ast \left|△w_j\right|\right),r_j^{\prime }=r_j+s_i^j,r_i^{\prime }=r_i-s_i^j,\Delta w_j^i=\Delta w_j$, party $j$

11.      first choose $s_i^j$ meaningful gradients from $\Delta w_j^i$ according to largest values

12.      criterion: sort gradients in $\Delta w_j^i$ and choose top $s_i^j$ of them, and mask the

13.      remaining $\left|△w_j^i\right|-s_i^j$ model parameter updates with 0 as $△{\tilde{w}}_j^i$

14. end for

15. 2: Model parameter update: party $i$ utilizes the secret key $s{k}_i$ to decrypt received

16. encrypted symmetric key as $f_{s}k$, and utilizes it to decrypt the encrypted parameter

17. updates as $c=Enc\left({\tilde{w}}_j^i,k_j\right)$ at the end decrypts the sum of model paramter updates

18. via homomorphic encryption and thus local model can be updated via integrating all

19. the plain paramter updates ${\tilde{w}}_i$ as $w_i^{\prime }=w_i+\Delta w_i+Dec\left({\sum }_{j\in C\backslash i}Enc\left(△{\tilde{w}}_j^i,k_j\right),-k_i\right)=$

20. $w_i+△w_i+{\sum }_{j\in C\backslash i}△{\tilde{w}}_j^i$.

21. 3: Local reliability update: party $i$ publishes $s_i$ artificial private data samples to

22. other party $j$ for labeling. Mutual evaluation is utilized to compute the local

23. reliability of the party $j$ as $f_i^{j^{\prime }}$ at current round. Thus party $i$ updates party $j$

24. local reliability via integrating the historical reliability as $f_i^{j^{\prime }}=0.3\ast f_i^j+0.7\ast f_i^{j^{\prime }}$.

25. 4: Local reliability normalization: $f_i^{j^{\prime }}=\frac{f_i^{j^{\prime }}}{{\displaystyle {\sum }_{j\in C}{f}_i^{j^{\prime }}}}$

26. if $f_i^{j^{\prime }}<f_{th}$ then

27.     party $i$ will report party $j$ as the party with low contribution.

28. end if

29. 5: Set of reliable party: The reliable party set in blockchain will be reconstructed in

30. form of removing the low-contribution party reported by the majority of parties.