Method and system for machine learning secure aggregation prediction supporting bidirectional privacy protection

Abstract

The present application discloses a machine learning security aggregation prediction method and system that supports bidirectional privacy protection, including: a client, a computing server, and an aggregation server; the computing server receives the data share of the data to be predicted sent by the client; Perform processing to obtain the forecast result share; the computing server performs blind processing on the forecast result share to obtain the blind forecast result share; the computing server sends the blind forecast result share to the aggregation server; The prediction result share is subjected to blind removal processing and noise processing, and the results are fed back to the client.

Description

technical field [0001] The present application relates to the technical field of machine learning, and in particular, to a method and system for machine learning security aggregation prediction that supports bidirectional privacy protection. Background technique [0002] The statements in this section merely mention the background art related to the present application and do not necessarily constitute prior art. [0003] Driven by technologies such as big data and machine learning, artificial intelligence technology has changed people's way of life, such as face, speech recognition, recommendation systems, unmanned vehicles, etc. But what followed was the abuse of personal privacy information, and leakage incidents occurred frequently. The performance of machine learning and deep learning algorithms all rely on a large amount of training data collected in advance, which may involve sensitive user information, such as medical records, user credit records, etc. A large numb...

AI Technical Summary

Problems solved by technology

[0005] First of all, in terms of privacy, PATE aggregates the prediction results of multiple teachers through a trusted aggregator, but there is no completely trusted entity in reality. If the aggregator is malicious or half-honest, the prediction results will be directly leaked

Second, if the student model has no public data, or the data held by the student model is also private, the privacy of the student model data cannot be guaranteed

Imagine that a hospital wants to train a machine learning model to help infer the patient's condition, and help itself (students) mark the data set through other hospitals (teachers). However, since the patient's data cannot be directly disclosed to other hospitals (teachers), in this case PATE Frameworks cannot provide effective privacy guarantees

Moreover, if the adversary corrupts the students and reversely attacks the teacher model through the teacher's prediction results (membership inference attack), the privacy of the teacher model and its training data cannot be guaranteed.

The above problems have caused two-way privacy leakage

In terms of performance, since the PATE framework provides privacy guarantees through differential privacy, but in order to control privacy costs, it also limits the amount of predictable data

In addition, the PATE framework can only be deployed locally, that is, the teacher model can only provide predictions locally, which requires the teacher to remain online during prediction

Images