Method and device for evaluating model training safety

Abstract

The embodiment of the invention relates to a method and device for evaluating model training safety, and the method is executed by a first party, and comprises the steps: providing a second party with a current parameter value of a model parameter in a joint model, including a first parameter of a graph representation network and a second parameter of a multi-layer perceptron; receiving gradient data from a second party; according to the second gradient and the second parameter value corresponding to the second parameter, reconstructing the node representation of each node on the graph representation network output layer, and obtaining the reconstructed graph representation of each node; determining a reconstructed adjacent matrix according to the similarity between the reconstructed graph representations of the nodes; determining a node feature which minimizes the target function as a reconstruction node feature; the objective function includes a first loss that is positively correlated to a difference between the reconstructed graph representation and an output representation obtained by processing the node features with the graph representation network; determining reconstructed graph data according to the reconstructed adjacent matrix and the reconstructed node features; the reconstructed graph data is used to assess the security of joint model training.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of machine learning, and in particular, to methods and devices for evaluating the security of model training. Background Art

[0002] Graph Neural Network (GNN) is a deep learning model for processing graph data. Graph data is very common in social networks, knowledge graphs, molecular structure analysis and other fields. These data are composed of nodes (entities) and edges (relationships between entities). GNN can effectively capture the complex relationships and dependencies between nodes, thus achieving remarkable success in graph data analysis tasks.

[0003] Federated Learning (FL) is a distributed machine learning paradigm that aims to train a shared model through collaboration among multiple participants without directly exchanging data. Each participant (such as a mobile device or server) trains the model locally and only shares the model's update information (such as gradient information) rather than the original data. One of the original intentions of FL is to protect data privacy and prevent sensitive information from being leaked.

[0004] When GNN and FL are combined and applied to graph data, we can take advantage of GNN's ability to handle complex graph structures while ensuring data privacy during training through FL. However, even in this seemingly safe setting, the risk of gradient-based graph data reconstruction attacks still exists. Since graph data usually contains complex node information and sensitive graph structure information (such as interpersonal relationships in social networks), such attacks may lead to serious privacy leakage problems. Therefore, a method is needed to evaluate the security of graph neural networks in federated learning. Summary of the invention

[0005] One or more embodiments of this specification describe a method and device for evaluating the security of model training, which attempts to reconstruct the original graph data through the gradient data of the graph neural network in federated learning. Then, the security of the graph neural network federated learning is evaluated based on the similarity between the reconstructed graph data and the real graph data.

[0006] In a first aspect, a method for evaluating the security of model training is provided, which is performed by a first party and includes:

[0007] Providing the second party with current parameter values ​​of model parameters in the joint model, the model parameters comprising first parameters of the graph representation network and second parameters of the multilayer perceptron for classification;

[0008] receiving gradient data corresponding to the model parameters from the second party, where the gradient data is obtained by the second party using its local private relationship graph to train the joint model based on the current parameter value;

[0009] Reconstructing the node representation of each node in the relationship graph at the output layer of the graph representation network according to the second gradient and the second parameter value corresponding to the second parameter to obtain the reconstructed graph representation of each node;

[0010] Determine the reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node;

[0011] Determine a node feature that minimizes an objective function as a reconstructed node feature; the objective function includes a first loss that is positively correlated to a difference between the reconstructed graph representation and an output representation obtained by processing the node feature using the graph representation network;

[0012] Reconstructed graph data is determined based on the reconstructed adjacency matrix and the reconstructed node features; the reconstructed graph data is used to evaluate the security of the joint model training.

[0013] In some possible implementations, the following further includes:

[0014] determining a third gradient corresponding to the output representation and a fourth gradient of the output representation with respect to the first parameter;

[0015] The objective function also includes a second loss that is positively correlated to a difference between a product of the third gradient and the fourth gradient and a first gradient corresponding to the first parameter.

[0016] In some possible implementations, reconstructing the node representation of each node in the relationship graph at the output layer of the graph representation network to obtain the reconstructed graph representation of each node includes:

[0017] Determine a target third-order tensor according to the second gradient and the second parameter value;

[0018] The reconstructed graph representation of each node is determined according to the result of tensor decomposition of the target third-order tensor.

[0019] In some possible implementations, determining a target third-order tensor according to the second gradient and the second parameter value includes:

[0020] According to the second parameter value, determining a corresponding third-order Hermite tensor;

[0021] Based on Stein's lemma, a target third-order tensor is determined according to the second gradient and the third-order Hermite tensor.

[0022] In some possible implementations, determining the reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node includes:

[0023] For any first node and second node in the relationship graph, determining a first similarity between a first reconstructed graph representation corresponding to the first node and a second reconstructed graph representation corresponding to the second node;

[0024] According to the magnitude relationship between the first similarity and a preset first threshold, the values ​​of the first node and the second node at corresponding positions of the reconstructed adjacency matrix are determined.

[0025] In some possible implementations, determining a node feature that minimizes an objective function as a reconstructed node feature includes:

[0026] With the goal of reducing the objective function, the value of each node feature is optimized to obtain the reconstructed node feature.

[0027] In some possible implementations, the output representation is determined according to the node features, the reconstructed adjacency matrix, and a first parameter value.

[0028] In some possible implementations, the first loss includes a second norm value of a representation difference between the reconstructed image representation and the output representation.

[0029] In some possible implementations, the second loss includes a second norm value characterizing the difference between the product of the third gradient and the fourth gradient and the first gradient.

[0030] In some possible implementations, the following further includes:

[0031] receiving relationship graph data from a second party;

[0032] The security of the joint model training is evaluated based on the similarity between the relationship graph data and the reconstruction graph data.

[0033] In some possible implementations, the following further includes:

[0034] Sending the reconstructed graph data to a second party, so that the second party evaluates the security of the joint model training based on the similarity between the relationship graph data and the reconstructed graph data;

[0035] A security assessment result is received from the second party.

[0036] In a second aspect, a device for evaluating the security of model training is provided, which is deployed on a first party and includes:

[0037] A first sending unit is configured to provide the second party with current parameter values ​​of model parameters in the joint model, wherein the model parameters include first parameters of the graph representation network and second parameters of the multilayer perceptron for classification;

[0038] A first receiving unit is configured to receive gradient data corresponding to the model parameter from a second party, where the gradient data is obtained by the second party using its local private relationship graph to train the joint model based on the current parameter value;

[0039] A graph representation reconstruction unit, configured to reconstruct the node representation of each node in the relationship graph at the output layer of the graph representation network according to the second gradient and the second parameter value corresponding to the second parameter, to obtain a reconstructed graph representation of each node;

[0040] A graph structure reconstruction unit configured to determine a reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node;

[0041] A node feature reconstruction unit is configured to determine a node feature that minimizes an objective function as a reconstructed node feature; the objective function includes a first loss that is positively correlated to a difference between the reconstructed graph representation and an output representation obtained by processing the node feature using the graph representation network;

[0042] The graph data reconstruction unit is configured to determine the reconstructed graph data based on the reconstructed adjacency matrix and the reconstructed node features; the reconstructed graph data is used to evaluate the security of the joint model training.

[0043] In some possible implementations, the following further includes:

[0044] a gradient determination unit configured to determine a third gradient corresponding to the output representation and a fourth gradient of the output representation to the first parameter;

[0045] The objective function also includes a second loss that is positively correlated to a difference between a product of the third gradient and the fourth gradient and a first gradient corresponding to the first parameter.

[0046] In some possible implementations, the following further includes:

[0047] A second receiving unit configured to receive relationship graph data from a second party;

[0048] An evaluation unit is configured to evaluate the security of the joint model training based on the similarity between the relationship graph data and the reconstruction graph data.

[0049] In some possible implementations, the following further includes:

[0050] A second sending unit is configured to send the reconstructed graph data to a second party, so that the second party evaluates the security of the joint model training according to the similarity between the relationship graph data and the reconstructed graph data;

[0051] The third receiving unit is configured to receive a security assessment result from the second party.

[0052] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect.

[0053] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect is implemented.

[0054] The method and device for evaluating the security of model training proposed in the embodiments of this specification first obtain the gradient data provided by other computing parties, and then reconstruct the input data of the multi-layer perceptron based on the gradient data in the multi-layer perceptron, that is, the graph representation data of each node output by the graph neural network. Next, based on the similarity between the graph representations, the structural data part in the graph data, that is, the adjacency matrix, is reconstructed. Finally, based on the reconstructed adjacency matrix and the reconstructed graph representation data, the node data in the graph data, that is, the node features, are reconstructed. The security of federated learning is evaluated by comparing the similarity between the reconstructed graph data and the original graph data. The embodiments of this specification evaluate the security of federated learning by simulating gradient reconstruction attacks, which can enhance and improve the security assessment capabilities and security assessment scope of the federated learning evaluation platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the multiple embodiments disclosed in this specification, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only the multiple embodiments disclosed in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 A schematic diagram of a model architecture according to an embodiment is shown;

[0057] Figure 2 A flowchart showing a method for evaluating model training security according to one embodiment;

[0058] Figure 3 A schematic block diagram of an apparatus for evaluating model training security according to one embodiment is shown. DETAILED DESCRIPTION

[0059] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0060] First, the model architecture of federated learning in the embodiments of this specification is described. Figure 1 FIG. 4 shows a schematic diagram of a model architecture according to an embodiment. Figure 1 As shown in the figure, the joint model consists of two main parts, the graph neural network and the multi-layer perceptron (MLP). The graph neural network is used to receive the original graph data to be processed, and after processing the graph data, it outputs the node representation of each node in the graph data. The multi-layer perceptron is used to receive the node representation of the node to be predicted and perform a preset classification task, such as a node classification task. For example, when the graph data is a user relationship graph, the classification task of the multi-layer perceptron can be user classification, which can be specifically predicting the group to which a certain user belongs, predicting whether the user will perform a specific behavior, and so on.

[0061] Let's first combine Figure 1 , introduces the symbols and variables used in the embodiments of this specification. Graph data can be recorded as G=(V,E), V represents the node combination in the graph G, the number of nodes is N, and E represents the connection edge set in the graph G.

[0062] By encoding the node information of each node in V, we can get the node features of each node, and the node features of each node can form a node feature matrix X∈R N×d , d is the preset feature vector dimension. The node encoding can be performed using, for example, the node2vec model, the BERT model, etc., which is not limited here.

[0063] When E is represented by an adjacency matrix, the adjacency matrix corresponding to E can be recorded as matrix A. Matrix A is a square matrix of size N, and each row and column corresponds to a node in V. When there is a connecting edge between any two nodes in graph G, the value of the corresponding position in adjacency matrix A is 1; conversely, when there is no connecting edge between any two nodes in graph G, the value of the corresponding position in adjacency matrix A is 0.

[0064] By converting the graph G = (V, E) into a representation of a node feature matrix X and an adjacency matrix A, the graph G can be converted into a form that is easy to process by a graph neural network.

[0065] A graph neural network can be denoted as GNN(X,A;θ), where X and A represent the node feature matrix and adjacency matrix in the graph data to be processed by the graph neural network, and θ represents all learnable parameters of the graph neural network itself. For example, graph neural networks can use GCN (Graph Convolutional Network), GAT (Graph Attention Network), GIN (Graph Isomorphism Network), etc., which are not limited here.

[0066] After processing the input graph data, the graph neural network outputs the graph representation of each node to form the graph representation matrix H∈R N×d , which can be formally expressed as H = GNN (X, A; θ). v =GNN(X,A;θ) v is the graph representation of node v∈V. Since the output of the graph neural network is still a representation vector, it cannot be used directly as the final result data. Therefore, the graph representation output by the graph neural network is usually used as the input of other models to complete the corresponding tasks according to other models. For example, the graph representation is input into a multi-layer perceptron for classification tasks to complete the classification task of the nodes in the graph data.

[0067] like Figure 1 As shown, the input layer of the multilayer perceptron receives the graph representation H of any node v v After the hidden layer processes the graph representation, the output layer outputs the scores of the node v for each preset category. These scores can form a vector For example, Figure 1 Let's take a two-layer perceptron as an example. It should be noted that Figure 1 The number of layers of the multilayer perceptron in the embodiment of this specification and the number of nodes in each layer are not limited. The multilayer perceptron in the embodiment of this specification can be a multilayer perceptron with any number of layers and any number of nodes in each layer.

[0068] exist Figure 1 In the multi-layer perceptron, the parameter matrix between the input layer and the hidden layer can be recorded as W, the activation function of the hidden layer can be recorded as σ, and the parameter matrix between the hidden layer and the output layer can be recorded as B. The output layer uses the softmax function for multi-classification, so the output of the multi-layer perceptron can be recorded as

[0069] Based on the output of multi-layer perceptron and the true label y of node v v , you can use the preset loss function f() to calculate the training loss For example, mean square error loss function or cross entropy loss function, etc. According to the training loss L, the parameters in the graph neural network and the multi-layer perceptron are adjusted to achieve the effect of training the joint model.

[0070] In the federated learning process, there are at least two participating computing parties, including the model training party that holds the model parameters (hereinafter referred to as the first party) and the data provider that holds the training data (hereinafter referred to as the second party). The first party sends the current model parameter values ​​(B, W, θ) it holds to the second party. The second party calculates the training loss L locally based on the model parameter values ​​using the training data (X, A) it holds, and sends the gradient values ​​of the training loss L with respect to each model parameter to the first party. After receiving the gradient values, the first party updates the parameters locally to complete a round of training. The gradient values ​​may include the gradient values ​​of the loss value with respect to the parameters of each layer in the multi-layer perceptron. And the gradient of the loss value to the parameters in the graph neural network

[0071] It is understandable that there may be multiple data providers, each of which receives a model parameter value from the first party, calculates a gradient value using its own data, and then sends it to the first party.

[0072] The purpose of the embodiment of this specification is that the first party uses the model parameter value (B, W, θ) and the gradient data received from the second party Reconstruct the training data (X, A) held by the second party to obtain the reconstructed graph data This includes reconstructing the adjacency matrix and reconstruction node features The specific process of reconstruction will be described in detail in the subsequent steps.

[0073] According to the reconstruction data The similarity between the training data (X, A) and the training data (X, A) can be used to evaluate the security of federated learning. If the similarity between the reconstructed graph data (X, A) and the training data (X, A) exceeds the preset threshold, it means that the security of federated learning is insufficient and further measures need to be taken to improve security. On the contrary, if the reconstructed graph data If the similarity between the training data (X, A) and the training data (X, A) is less than a preset threshold, it means that the security of federated learning meets the security assessment method proposed in the embodiment of this specification.

[0074] The following describes the specific implementation steps of the above method for evaluating the security of model training in conjunction with specific embodiments.

[0075] Figure 2A flowchart of a method for evaluating the security of model training according to an embodiment is shown. The execution subject of the method can be any platform or server or device cluster with computing and processing capabilities. Figure 2 As shown, the method is executed by the first party and at least includes: step 202, providing the second party with the current parameter values ​​of the model parameters in the joint model, the model parameters including the first parameters of the graph representation network and the second parameters of the multi-layer perceptron for classification; step 204, receiving the gradient data corresponding to the model parameters from the second party, the gradient data being obtained by the second party using its local private relationship graph to train the joint model based on the current parameter values; step 206, reconstructing the node representation of each node in the output layer of the graph representation network in the relationship graph according to the second gradient and the second parameter value corresponding to the second parameter, and obtaining the reconstructed graph representation of each node; step 208, determining the reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node; step 210, determining the node features that minimize the objective function as the reconstructed node features; the objective function includes a first loss, which is positively correlated to the difference between the reconstructed graph representation and the output representation obtained by processing the node features using the graph representation network; step 212, determining the reconstructed graph data according to the reconstructed adjacency matrix and the reconstructed node features; the reconstructed graph data is used to evaluate the security of the joint model training.

[0076] The specific execution process of each of the above steps is described below.

[0077] First, in step 202, current parameter values ​​of model parameters in the joint model are provided to the second party, where the model parameters include first parameters of the graph representation network and second parameters of the multilayer perceptron for classification.

[0078] Among them, the first party may be the model training party, and the second party may be the data provider.

[0079] The joint model may include a graph representation network and a multi-layer perceptron. The graph representation network is used to receive and process graph data, and then output the graph representation of each node in the graph. A variety of graph neural networks can be used as the graph representation network in the embodiments of this specification, for example, GCN (Graph Convolutional Network), GAT (Graph Attention Network), GIN (Graph Isomorphism Network), etc., which are not limited here.

[0080] The multilayer perceptron is used to receive the node graph representation output by the graph representation network, and perform the preset classification task according to the graph representation, and output the scores of the nodes belonging to each category. The multilayer perceptron can be a multilayer perceptron with any number of layers and any number of nodes in each layer.

[0081] The first parameter of the graph representation network may be the aforementioned θ, and the second parameter of the multilayer perceptron may be the parameters of each layer in the perceptron. In one embodiment, when the multilayer perceptron is a two-layer perceptron, the second parameter may be the aforementioned B, W.

[0082] Then, in step 204, gradient data corresponding to the model parameters is received from the second party, where the gradient data is obtained by the second party using its local private relationship graph to train the joint model based on the current parameter values.

[0083] The gradient data includes a first gradient corresponding to a first parameter and a second gradient corresponding to a second parameter.

[0084] After receiving the first parameter and the second parameter sent by the first party, the second party substitutes the first parameter and the second parameter into the model architecture of the joint model to obtain the current joint model. The training loss L is obtained by inputting the local private relationship graph data into the current joint model and using the node label and the loss function to calculate. The relationship graph data includes the node feature matrix X and the adjacency matrix A in the relationship graph, which are local private data held by the second party.

[0085] The second party inputs the feature matrix X and the adjacency matrix A into the graph representation network to obtain the graph representation of each node, forming the graph representation matrix H. Then, the graph representation of each node in the graph representation matrix H is input into the multi-layer perceptron to obtain the output of the multi-layer perceptron. Then, according to the output of the multi-layer perceptron and the label of the node, the training loss L=∑ v∈V f(softmax(Bσ(WH v )),y v ).

[0086] Then, the second party calculates the values ​​of the first gradient and the second gradient based on the training loss L, and sends them to the first party.

[0087] It can be understood that the model architecture of the joint model is shared by the first party and the second party, and the loss function used to train the model is also shared, but the specific values ​​of the parameters in the model are held and updated by the first party.

[0088] The relationship graph can be a graph of any field that contains entities (nodes) and relationships (edges) related to the field. Correspondingly, the classification task in step 202 is used to classify and predict specific attributes of the entity.

[0089] In one embodiment, the relationship graph is a user relationship graph, which includes multiple user nodes corresponding to users. The user relationship graph can be constructed based on preset association relationships, such as transaction relationships, social relationships, purchase relationships, etc. between users. In the case of construction based on purchase relationships, the user relationship graph may also include commodity entity nodes as intermediate nodes. Accordingly, the classification task of the multi-layer perceptron is user classification, which can specifically be predicting the group to which a certain user belongs, predicting whether a user performs a specific behavior, and so on.

[0090] In the case of a user relationship graph, the node feature matrix X represents user features, which are generally encoded based on user basic attributes; the adjacency matrix A represents the association relationship between users.

[0091] Any loss function can be used to calculate the training loss L, for example, the mean square error loss function or the cross entropy loss function can be used, and there is no limitation here.

[0092] Next, in step 206, the node representation of each node in the relationship graph at the output layer of the graph representation network is reconstructed according to the second gradient and the second parameter value corresponding to the second parameter to obtain the reconstructed graph representation of each node.

[0093] The reconstructed graph representation of each node can form a reconstructed graph representation matrix In the case of a user relationship graph, the reconstructed graph representation of each user is obtained.

[0094] In one embodiment, a target third-order tensor is determined according to the second gradient and the second parameter value; and then, a reconstructed graph representation of each node is determined according to a result of tensor decomposition of the target third-order tensor.

[0095] Wherein, determining the target third-order tensor includes: determining the corresponding third-order Hermite tensor according to the second parameter value; and determining the target third-order tensor according to the second gradient and the third-order Hermite tensor based on Stein's lemma.

[0096] The following first Figure 1 Taking the two-layer perceptron in as an example, the specific process in step 206 is described.

[0097] When using a two-layer perceptron, follow Figure 1 The variable notation used in the second gradient includes The second parameter includes B and W.

[0098] First, according to the second parameter value W, determine the corresponding third-order Hermite tensor H3(w j ), where w jRepresents the first layer model parameter corresponding to the jth hidden layer node. Wherein, H3(x) represents the third-order Hermite function of x, as shown in formula (1):

[0099]

[0100] in, represents the third-order tensor product of x, When i = j, δ ij =1, when i≠j, δ ij =0.

[0101] Then, based on Stein's Lemma, according to the second gradient and the third-order Hermite tensor, determine the target third-order tensor As shown in formula (2).

[0102]

[0103] in, Represents the gradient of the training loss to the second layer model parameters corresponding to the jth hidden layer node, and m is the total number of hidden layer nodes. Target third-order tensor is the sum of the gradient of each node in the hidden layer and the product of the third-order Hermite tensor.

[0104] After obtaining the target third-order tensor After that, the tensor is decomposed. The reconstruction graph representation of each node is determined according to the result of tensor decomposition. The reconstructed graph representation of each node can form a reconstructed graph representation matrix

[0105] When the number of multi-layer perceptrons exceeds two layers, the above-mentioned method for processing a two-layer perceptron can also be referred to and expanded to a multi-layer perceptron. This part is the prior art and will not be described in detail here.

[0106] In other embodiments, step 206 can also organize the weight matrices and bias vectors of each layer of the multilayer perceptron into a high-order tensor, and then perform tensor decomposition on the high-order tensor, such as CP decomposition (CANDECOMP / PARAFAC decomposition), Tucker decomposition, etc. Next, based on the result of the tensor decomposition, the input reconstruction problem is converted into an optimization problem. The function to be optimized includes the similarity between the reconstructed gradient calculated according to the reconstructed image representation and the original gradient. The reconstruction gradient can be calculated according to the reconstructed image representation and a virtual loss function preset according to experience. Then, an optimization algorithm such as gradient descent, Newton's method, etc. is used to solve the above optimization problem to obtain the final reconstructed image representation.

[0107] Then, in step 208, the reconstructed adjacency matrix is ​​determined based on the similarity between the reconstructed graph representations of each node.

[0108] When the similarity between any two nodes exceeds a preset first threshold, there is a connecting edge between the two nodes, and the value of the position corresponding to the two nodes in the reconstructed adjacency matrix is ​​set to 1. In the case of a user relationship graph, in this step, whether there is a preset association relationship (transaction relationship, social relationship, etc.) between the two user nodes is reconstructed.

[0109] Specifically, for any first node v and second node u in the relationship graph, determine the first reconstructed graph representation corresponding to the first node v The second reconstructed graph representation corresponding to the second node u The first similarity between Then, according to the first similarity The relationship between the size of the first node v and the second node u in the reconstructed adjacency matrix is ​​determined by The value of .

[0110] When the first similarity is greater than the first threshold, otherwise That is, when the similarity between two nodes exceeds the first threshold, it is considered that there is a connection edge between the two nodes, and the corresponding position of the reconstructed adjacency matrix is ​​1; when the similarity is less than or equal to the first threshold, it is considered that there is no connection edge between the two nodes, and the corresponding position of the reconstructed adjacency matrix is ​​0. As shown in formula (3):

[0111]

[0112] The first similarity may be determined using cosine similarity, similarity based on distance (such as Euclidean distance, Manhattan distance), etc., which is not limited here.

[0113] Next, in step 212, the node feature that minimizes the objective function is determined as the reconstructed node feature; the objective function J(X) includes a first loss J1, which is positively correlated to the difference between the reconstructed graph representation and the output representation obtained by processing the node feature using the graph representation network.

[0114] In the first loss J1, the reconstructed image is characterized as the aforementioned The output of the graph representation network can be formally recorded as the aforementioned GNN(X,A;θ).

[0115] In one embodiment, the reconstruction result of the adjacency matrix has been determined in the aforementioned step 208, that is, the reconstructed adjacency matrix When the output representation is based on the node feature X, the reconstructed adjacency matrix And the first parameter value θ is determined. That is, the output is characterized as In the output representation, due to is a constant that has been determined, and θ is also the parameter value of the graph representation network of the current round held by the first party, which is also a constant, so is a function of node feature X.

[0116] In this embodiment, the first loss J1 is positively correlated with the reconstruction image representation and The difference between them can be measured using the norm of the matrix. The first loss J1 is used to measure the difference between the graph representation determined based on the node feature X and the reconstructed graph representation, that is, the loss of the characterization reconstruction task.

[0117] In a more specific embodiment, the first loss J1 includes a second norm value of the representation difference between the reconstructed image representation and the output representation, as shown in formula (4).

[0118]

[0119] Wherein, λ1 is a preset proportional coefficient, and ‖z‖2 represents the second norm of z.

[0120] In this embodiment, the objective function J(X) includes a first loss J1, as shown in formula (5).

[0121]

[0122] In other embodiments, other norms may be used to measure the aforementioned difference, such as the first norm, the infinite norm, etc., which are not limited here.

[0123] Since the objective function J(X) is only a function of the node feature X, the objective function J(X) is optimized as the optimization target, and the reconstructed node feature can be obtained. In the case of user relationship graph, reconstruct node features That is the reconstructed user feature.

[0124] In one embodiment, determining the node feature that minimizes the objective function as the reconstructed node feature includes: optimizing the value of each node feature with the goal of reducing the objective function to obtain the reconstructed node feature As shown in formula (6).

[0125]

[0126] Finally, in step 214, the adjacency matrix is ​​reconstructed according to the and reconstruction node features Determine the reconstruction image data The reconstructed image data is used to evaluate the security of the joint model training.

[0127] Reconstructing graph data That is, the reconstruction result obtained by simulating the gradient reconstruction attack in the embodiment of this specification. According to the similarity between the reconstruction result and the real graph data, the security of the joint model training, that is, the federated learning, can be evaluated. When the reconstruction effect is better, that is, the similarity between the reconstructed graph data and the real graph data is higher, it means that the security of the federated learning is worse, it is difficult to defend against the gradient reconstruction attack, and the security of the federated learning algorithm needs to be further improved.

[0128] In some possible implementations, when the private relationship graph data held by the second party is non-sensitive data, or when the execution environment of the embodiment of this specification is a test environment within a certain subject, the second party can directly send the relationship graph data to the first party, and the first party directly performs a security assessment. In this case, after step 214, the method further includes:

[0129] Step 216, receiving relationship graph data (X, A) from the second party.

[0130] Step 218: Based on the relationship graph data (X, A) and the reconstruction graph data The similarity between them is used to evaluate the security of the joint model training.

[0131] The similarity can be measured using cosine similarity, similarity based on distance (such as Euclidean distance, Manhattan distance), etc., which is not limited here.

[0132] If the similarity exceeds the preset threshold, it means that the security of federated learning is insufficient and further measures need to be taken to improve security; on the contrary, if the similarity is less than the preset threshold, it means that the security of federated learning passes the security assessment method proposed in the embodiment of this specification.

[0133] In some possible implementations, the private relationship graph data held by the second party is sensitive data and cannot be sent to the first party. In this case, the first party needs to send the reconstructed graph data to the second party, and the second party performs specific similarity comparison and security assessment. In this case, after step 214, the method further includes:

[0134] Step 220: reconstruct the image data Send it to the second party, so that the second party can reconstruct the graph data according to the relationship graph data (X, A) and the The similarity between them is used to evaluate the security of the joint model training.

[0135] Step 222: Receive a security assessment result from the second party.

[0136] Similar to the previous implementation, if the similarity exceeds the preset threshold, it means that the security of federated learning is insufficient and further measures need to be taken to improve security; on the contrary, if the similarity is less than the preset threshold, it means that the security of federated learning passes the security assessment method proposed in the embodiment of this specification.

[0137] In some possible implementations, based on the first loss J1, a second loss J2 may be added to the objective function to further improve the effect of node feature reconstruction. Before step 212, the method further includes:

[0138] Step 210: determining a third gradient corresponding to the output representation and a fourth gradient of the output representation with respect to the first parameter.

[0139] The third gradient can be the output representation of each node by the training loss L The gradient of It can be determined according to the chain rule in the back propagation of the multi-layer perceptron, which is essentially the gradient of the training loss L to the input layer nodes. The fourth gradient can be the output representation of each node The gradient of the first parameter θ is denoted as It can be determined according to the chain rule in the back propagation of the graph representation network.

[0140] In this embodiment, the objective function J(X) further includes a second loss J2, which is positively correlated to the difference between the product of the third gradient and the fourth gradient and the first gradient corresponding to the first parameter.

[0141] In the second loss J2, the product of the third gradient and the fourth gradient can be The first gradient corresponding to the first parameter may be Similar to the first loss J1, In the example, only the node feature X is a variable, so the second loss J2 is also a function of the node feature X. The second loss J2 is used to measure the output representation The reconstructed gradient determined by the chain rule and the first gradient calculated by the second party based on the local private relationship graph data The difference between them is the loss of the gradient reconstruction task.

[0142] In one embodiment, the second loss J2 includes a second norm value representing the difference between the product of the third gradient and the fourth gradient and the first gradient, as shown in formula (7).

[0143]

[0144] Wherein, λ2 is a preset proportional coefficient, and N is the number of nodes in the relationship graph. By taking the average of the product of the third gradient and the fourth gradient of each node, the effect of the gradient reconstruction task can be improved.

[0145] In this embodiment, the objective function J(X) may be as shown in formula (8).

[0146]

[0147] Through characterization reconstruction tasks and gradient reconstruction tasks, the accuracy of node feature reconstruction can be improved, thereby improving the standard of safety evaluation.

[0148] According to an embodiment of another aspect, a device for evaluating the security of model training is also provided. Figure 3 A schematic block diagram of an apparatus for evaluating the security of model training according to an embodiment is shown, and the apparatus can be deployed in any device, platform or device cluster with computing and processing capabilities. Figure 3 As shown, the device 300 is deployed on the first party and includes:

[0149] A first sending unit 302 is configured to provide the second party with current parameter values ​​of model parameters in the joint model, wherein the model parameters include first parameters of the graph representation network and second parameters of the multilayer perceptron for classification;

[0150] A first receiving unit 304 is configured to receive gradient data corresponding to the model parameter from the second party, where the gradient data is obtained by the second party using its local private relationship graph to train the joint model based on the current parameter value;

[0151] A graph representation reconstruction unit 306 is configured to reconstruct the node representation of each node in the relationship graph at the output layer of the graph representation network according to the second gradient and the second parameter value corresponding to the second parameter, to obtain a reconstructed graph representation of each node;

[0152] A graph structure reconstruction unit 308, configured to determine a reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node;

[0153] The node feature reconstruction unit 312 is configured to determine a node feature that minimizes an objective function as the reconstructed node feature; the objective function includes a first loss that is positively correlated to a difference between the reconstructed graph representation and an output representation obtained by processing the node feature using the graph representation network;

[0154] The graph data reconstruction unit 314 is configured to determine the reconstructed graph data according to the reconstructed adjacency matrix and the reconstructed node features; the reconstructed graph data is used to evaluate the security of the joint model training.

[0155] In some possible implementations, the device 300 further includes:

[0156] A gradient determination unit 310 is configured to determine a third gradient corresponding to the output representation and a fourth gradient of the output representation to the first parameter;

[0157] The objective function also includes a second loss that is positively correlated to a difference between a product of the third gradient and the fourth gradient and a first gradient corresponding to the first parameter.

[0158] In some possible implementations, the device 300 further includes:

[0159] The second receiving unit 314 is configured to receive relationship graph data from a second party;

[0160] The evaluation unit 318 is configured to evaluate the security of the joint model training based on the similarity between the relationship graph data and the reconstruction graph data.

[0161] In some possible implementations, the device 300 further includes:

[0162] A second sending unit 320 is configured to send the reconstructed graph data to a second party, so that the second party evaluates the security of the joint model training according to the similarity between the relationship graph data and the reconstructed graph data;

[0163] The third receiving unit 322 is configured to receive a security assessment result from the second party.

[0164] According to another aspect of the embodiment, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in any of the above embodiments.

[0165] According to yet another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any one of the above embodiments is implemented.

[0166] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0167] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0168] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0169] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0170] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for evaluating the security of model training, performed by a first party, comprising: Providing the second party with current parameter values ​​of model parameters in the joint model, the model parameters comprising first parameters of the graph representation network and second parameters of the multilayer perceptron for classification; receiving gradient data corresponding to the model parameters from the second party, where the gradient data is obtained by the second party using its local private relationship graph to train the joint model based on the current parameter value; Reconstructing the node representation of each node in the relationship graph at the output layer of the graph representation network according to the second gradient and the second parameter value corresponding to the second parameter to obtain the reconstructed graph representation of each node; Determine the reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node; Determine a node feature that minimizes an objective function as a reconstructed node feature; the objective function includes a first loss that is positively correlated to a difference between the reconstructed graph representation and an output representation obtained by processing the node feature using the graph representation network; Reconstructed graph data is determined based on the reconstructed adjacency matrix and the reconstructed node features; the reconstructed graph data is used to evaluate the security of the joint model training.

2. The method according to claim 1, further comprising: determining a third gradient corresponding to the output representation and a fourth gradient of the output representation with respect to the first parameter; The objective function also includes a second loss that is positively correlated to a difference between a product of the third gradient and the fourth gradient and a first gradient corresponding to the first parameter.

3. The method according to claim 1, wherein: Reconstructing the node representation of each node in the relationship graph at the output layer of the graph representation network to obtain the reconstructed graph representation of each node, including: Determine a target third-order tensor according to the second gradient and the second parameter value; The reconstructed graph representation of each node is determined according to the result of tensor decomposition of the target third-order tensor.

4. The method according to claim 3, determining a target third-order tensor according to the second gradient and the second parameter value, comprising: According to the second parameter value, determining a corresponding third-order Hermite tensor; Based on Stein's lemma, a target third-order tensor is determined according to the second gradient and the third-order Hermite tensor.

5. The method according to claim 1, determining the reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node, comprising: For any first node and second node in the relationship graph, determining a first similarity between a first reconstructed graph representation corresponding to the first node and a second reconstructed graph representation corresponding to the second node; According to the magnitude relationship between the first similarity and a preset first threshold, the values ​​of the first node and the second node at corresponding positions of the reconstructed adjacency matrix are determined.

6. The method according to claim 1, determining the node feature that minimizes the objective function as the reconstructed node feature, comprises: With the goal of reducing the objective function, the value of each node feature is optimized to obtain the reconstructed node feature.

7. The method according to claim 1, wherein: The output representation is determined according to the node features, the reconstructed adjacency matrix and a first parameter value.

8. The method according to claim 1, wherein: The first loss includes a second norm value of a representation difference between the reconstructed image representation and the output representation.

9. The method according to claim 2, wherein: The second loss includes a second norm value characterizing a difference between a product of the third gradient and the fourth gradient and the first gradient.

10. The method according to claim 1, further comprising: receiving relationship graph data from a second party; The security of the joint model training is evaluated based on the similarity between the relationship graph data and the reconstruction graph data.

11. The method according to claim 1, further comprising: Sending the reconstructed graph data to a second party, so that the second party evaluates the security of the joint model training based on the similarity between the relationship graph data and the reconstructed graph data; A security assessment result is received from the second party.

12. A device for evaluating the security of model training, deployed at a first party, comprising: A first sending unit is configured to provide the second party with current parameter values ​​of model parameters in the joint model, wherein the model parameters include first parameters of the graph representation network and second parameters of the multilayer perceptron for classification; A first receiving unit is configured to receive gradient data corresponding to the model parameter from a second party, where the gradient data is obtained by the second party using its local private relationship graph to train the joint model based on the current parameter value; A graph representation reconstruction unit, configured to reconstruct the node representation of each node in the relationship graph at the output layer of the graph representation network according to the second gradient and the second parameter value corresponding to the second parameter, to obtain a reconstructed graph representation of each node; A graph structure reconstruction unit configured to determine a reconstructed adjacency matrix according to the similarity between the reconstructed graph representations of each node; A node feature reconstruction unit is configured to determine a node feature that minimizes an objective function as a reconstructed node feature; the objective function includes a first loss that is positively correlated to a difference between the reconstructed graph representation and an output representation obtained by processing the node feature using the graph representation network; The graph data reconstruction unit is configured to determine the reconstructed graph data based on the reconstructed adjacency matrix and the reconstructed node features; the reconstructed graph data is used to evaluate the security of the joint model training.

13. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 11.

14. A computing device comprising a memory and a processor, wherein: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 11 is implemented.

Images