Machine learning security aggregation prediction method and system supporting bidirectional privacy protection

Abstract

The invention discloses a machine learning security aggregation prediction method and system supporting bidirectional privacy protection. The system comprises a client, a calculation server and an aggregation server. The calculation server receives the data share of the to-be-predicted data sent by the client; the calculation server processes the data share to obtain a prediction result share; thecalculation server performs blinding on the prediction result share to obtain a blinded prediction result share; the calculation server sends the blind prediction result share to an aggregation server; and the aggregation server performs blinding removal and noise addition on the blinding prediction result share, and feeds back a result to the client.

Description

technical field [0001] This application relates to the technical field of machine learning, in particular to a machine learning security aggregation prediction method and system supporting two-way privacy protection. Background technique [0002] The statements in this section merely mention the background art related to this application, and do not necessarily constitute the prior art. [0003] Driven by technologies such as big data and machine learning, artificial intelligence technology has changed people's lifestyles, such as face recognition, voice recognition, recommendation systems, and unmanned vehicles. But what followed was the abuse of personal privacy information, and frequent leaks. The performance of machine learning and deep learning algorithms all rely on a large amount of training data collected in advance, which may involve sensitive user information, such as medical records, user credit records, etc. A large number of studies have shown that machine lea...

AI Technical Summary

Problems solved by technology

[0005] First of all, in terms of privacy, PATE aggregates the prediction results of multiple teachers through a trusted aggregator, but there is no completely trusted entity in reality. If the aggregator is malicious or half-honest, the prediction results will be directly leaked

Second, if the student model has no public data, or the data held by the student model is also private, the privacy of the student model data cannot be guaranteed

Imagine that a hospital wants to train a machine learning model to help infer the patient's condition, and help itself (students) mark the data set through other hospitals (teachers). However, since the patient's data cannot be directly disclosed to other hospitals (teachers), in this case PATE Frameworks cannot provide effective privacy guarantees

Moreover, if the adversary corrupts the students and reversely attacks the teacher model through the teacher's prediction results (membership inference attack), the privacy of the teacher model and its training data cannot be guaranteed.

The above problems have caused two-way privacy leakage

In terms of performance, since the PATE framework provides privacy guarantees through differential privacy, but in order to control privacy costs, it also limits the amount of predictable data

In addition, the PATE framework can only be deployed locally, that is, the teacher model can only provide predictions locally, which requires the teacher to remain online during prediction

Images