Privacy protection federal learning method oriented to natural language processing

Abstract

The invention discloses a privacy protection federal learning method oriented to natural language processing, which comprises a three-layer network structure, and is characterized in that each client compresses the gradient of the client and uploads the compressed gradient to a corresponding edge server layer; each edge server aggregates the compression gradients uploaded by the clients in the communication range of the edge server, and sends the aggregated compression gradients to the cloud server layer; the cloud server layer aggregates the received compression gradients sent by the edge servers again, and then decompresses the gradients subjected to secondary aggregation; the gradient is observed and compressed on the client, so that the possibility of gradient leakage is reduced; gradient perturbation based on compressed sensing further makes an attacker difficult to reconstruct related words from an embedded layer, an original text sequence is effectively prevented from being reconstructed, the privacy of a client side is effectively protected, meanwhile, the communication overhead is reduced, and only slight influences are generated on the performance of the model.

Description

Technical Field

[0001] The present invention relates to the field of federated learning and privacy protection technology, and specifically to a privacy-preserving federated learning method for natural language processing. Background Art

[0002] With the continuous development of information technology, natural language processing (NLP) plays an increasingly important role in various fields. The application scope of NLP technology covers many aspects such as input prediction, sentiment analysis, machine translation, etc., providing people with more efficient and intelligent ways of information processing and interaction. However, with the advent of the big data era, the amount of data required for NLP continues to increase, and the issue of user privacy is becoming increasingly prominent. To solve this problem, federated learning (FL) has been proposed as a distributed learning method and has shown potential in privacy protection. Federated learning is a machine learning method that enables models to be trained on a large amount of decentralized data distributed on local devices, such as mobile phones and laptops. Instead of uploading all data to a cloud server for training, the model is sent to each device, updated with local data, and then the model update is sent back to the cloud server for aggregation. By using federated learning, local data never leaves the device and user privacy is guaranteed. Combined with NLP, federated learning can be used to learn domain-specific text data that is usually difficult to access from different devices or organizations without storing it centrally.

[0003] However, there is a risk of privacy leakage in federated learning. One typical privacy attack is the gradient leakage attack, where the attacker can reversely extract the private data used by the client for local training from the leaked federated learning gradient, such as faces in images, names, phone numbers, passwords, etc. in text. Currently, in the field of computer vision, gradient leakage attacks are relatively mature, and even with the addition of some defensive measures, attackers can reconstruct high-definition and similar images, which poses a serious threat to privacy. In addition, label-based leakage attacks provide favorable prerequisites for image-based gradient leakage attacks, that is, first reversely reconstructing the labels of the client's private data with high precision, and then reconstructing the image based on the correctly extracted labels, which accelerates the attack process. Recently, this powerful gradient leakage attack has gradually expanded to other fields, such as text reconstruction, speech reconstruction, table reconstruction, and other types of data reconstruction. The present invention focuses on gradient leakage attacks on text-based models.

[0004] The current attack algorithm DLG (Deep Leakage from Gradients) used for text reconstruction continuously modifies the randomly initialized text sequence so that the gradient it generates is close to the gradient of the original text, thereby making the attacker's text sequence close to the original text sequence. This attack method is called Gradient Matching.

[0005] Currently, a variety of defense methods have been proposed for gradient leakage attacks. First, solutions represented by secure multi-party accounting and homomorphic encryption mainly use traditional cryptography to encrypt the transmitted gradients to prevent privacy leakage. The advantage of this type of solution is that the effectiveness of privacy protection is theoretically proven, but complex encryption operations usually introduce a lot of additional overhead, which is difficult to apply for resource-constrained federated learning clients. Secondly, the original image data can be perturbed by generating encrypted samples through linear combination to eliminate the semantic information in the original samples. This method has also been extended to the text field, but there is still a certain risk of privacy leakage. Finally, there are gradient perturbation schemes represented by differential privacy (DifferentialPrivacy-DP) and gradient compression (Gradient Compression-GC). These schemes inject noise and other means to make the perturbed gradients and the original gradients as far away as possible, thereby increasing the difficulty of gradient matching for attackers. However, such schemes often find it difficult to maintain privacy protection and model performance at the same time.

[0006] Currently, compressed sensing is also used to enhance the privacy protection effect of federated learning. Compressed sensing protects the image from being reconstructed by attackers by protecting the labels in the original data and implementing gradient perturbations. Therefore, this method also provides a new idea for privacy protection schemes against gradient leakage attacks in the text field. Summary of the invention

[0007] In view of the shortcomings of the prior art, the technical problem to be solved by the present invention is to provide a privacy-preserving federated learning method for natural language processing that reduces client communication overhead through compressed sensing theory, reduces the risk of client original text data being reconstructed, and protects client privacy gradient information from being leaked.

[0008] To achieve the above object, the present invention provides the following technical solution: a privacy-preserving federated learning method for natural language processing, comprising the following steps:

[0009] S1, the steps of the client layer include: each client compresses its own gradient and uploads the compressed gradient to the corresponding edge server layer;

[0010] S2, the step of the edge server layer includes: each edge server locally aggregates the compressed gradients uploaded by the clients within its communication range, and sends the locally aggregated compressed gradients to the cloud server layer;

[0011] S3, the steps of the cloud server layer include: globally aggregating the compressed gradients received from each edge server again, and then decompressing the gradients after the second aggregation.

[0012] Preferably, in step S1, the client layer includes I clients distributed in different areas; i ={x i ,y i} represents the local data set of the i-th client, where x i and i Represents data samples and their labels respectively; i∈{1,...,I}, d i =|D i |, that is, D i The client jointly trains a global model F, and the parameter of the global model F is W; in the communication round t, a group of clients I t is randomly selected to participate in the training process; for each i∈I t , which downloads the current global model W for local training and calculates the gradient update In order to protect the privacy of the client dataset, the gradient is compressed using compressed sensing theory before transmission, while achieving encryption effect on the communication link; then, the gradient is processed and transmitted to the client's corresponding edge server for local aggregation.

[0013] Preferably, the compression step comprises: the gradient vector is passed through is thinned, and the sparsity rate is:

[0014] p=k / n,p∈(0,1];

[0015] k is the sparsity and n is the gradient vector Length;

[0016] In this process, the elements with the highest absolute value of the gradient are retained, while the rest are discarded; for example, choosing p = 0.1 means retaining the top 10% elements with the largest magnitude. After that, each client uses the measurement matrix received from the cloud server, i.e., the key Φ, to compress its sparse gradients layer by layer. The compressed gradient is recorded as:

[0017] Preferably, in step S2, the edge server layer includes J edge servers; is the set of clients selected in the region that is managed by the jth edge server in communication round t, where j∈{1,...,J}, and The edge server aggregates the compressed gradients received from clients within its communication range; then, each edge server sends its aggregated compressed gradients to the cloud server.

[0018] Preferably, the dual aggregation step includes the cloud server aggregating the compressed gradient according to the weight of the client before decompressing the gradient, and then decompressing the aggregated gradient. This dual aggregation process is expressed as:

[0019] and

[0020] is the local aggregate gradient of the jth edge server, is the global aggregate gradient of the cloud server.

[0021] Preferably, in step S3, the cloud server layer step includes that after receiving the local aggregated compressed gradient from the edge layer edge server, the cloud server will perform global aggregation; the two aggregations are expressed as:

[0022]

[0023] in,

[0024] Finally, by decompressing the gradients, the cloud server updates the global model and starts the next communication round t+1; in addition to the above operations, the cloud server is also responsible for providing the client with initialized and updated global parameters.

[0025] Preferably, the decompression step includes the cloud server using the key Φ to aggregate the compressed gradient Reconstruct to get the average gradient update And update the global model with this:

[0026]

[0027] represents the compressed gradient of the aggregation using the key Φ Reconstruct to get average gradient update W t+1 It is the initial model for the next round of training.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. In the present invention, a three-layer network model is constructed, including a user layer, an edge layer, and a cloud layer, wherein the dual aggregation of the edge and the cloud is designed by utilizing the linear characteristics of compressed sensing, thereby ensuring that the privacy gradient information of the client is not leaked.

[0030] 2. In the present invention, a gradient perturbation based on compressed sensing is proposed, which enlarges the distance from the original gradient through the precision loss of signal reconstruction, making it difficult for attackers to obtain words in the original text sequence from the embedding layer, and thus perform gradient matching, effectively reducing the risk of the original text data of the client being reconstructed.

[0031] 3. In the present invention, model gradient compression based on compressed sensing greatly reduces the gradient update volume of the language model after compression, and reduces the communication overhead of resource-constrained clients. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0033] In the attached picture:

[0034] Figure 1 It is an overall framework diagram of the privacy-preserving federated learning method for natural language processing of the present invention;

[0035] Figure 2 is a schematic diagram of the model performance of the present invention at different compression rates;

[0036] Figure 3 is a schematic diagram of the model performance of the present invention at different sparsity rates;

[0037] Figure 4 It is a schematic diagram of the model performance of the comparative test GC under different disturbance levels;

[0038] Numbers in the figure: 1. Download model; 2. Local training; 3. Sparsification; 4. Compression; 5. Local aggregation; 6. Global aggregation; 7. Decompression; 8. Model update; 9. Internal attacker; 10. External attacker. DETAILED DESCRIPTION

[0039] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0040] Example: To address the privacy and security issues of gradient leakage and gradient reconstruction in natural language processing (NLP) applications in current federated learning, such as Figure 1As shown, the present invention provides a privacy-preserving federated learning method for natural language processing. In practical applications, the three-layer network model includes I clients, J edge servers, and 1 cloud server, an external attacker 10 and an internal attacker 9; the client first performs local training 2, and performs sparseness 3, and then performs compression 4, the edge server layer performs local aggregation 5, the cloud server performs secondary global aggregation 6 and decompression 7, and finally performs model update 8; and transmits the downloaded model 1 to the client; the privacy-preserving federated learning method for natural language processing in practical applications specifically includes the following steps:

[0041] Step 0: Before introducing the application steps of the present invention, the basis on which each step in the present invention is based is first introduced:

[0042] Threat Model: Threat Model Attack Methods Existing gradient leakage attacks use different optimization algorithms to reconstruct private data from gradients. Specifically, given a gradient The attacker randomly generates a fake input sample (x', y') and passes the fake gradient Approximately When the distance between the two gradients is very close, the fake input sample is very close to the original input sample. The above process is expressed as an optimization problem that minimizes the following objective: where ||·|| is the norm measuring the distance between two gradients. This process is called gradient matching. In particular, the attacker optimizes two variables, x and y. Taking the text classification task in natural language processing as an example, the attacker can easily perform gradient matching by enumerating the label y. In addition, existing research based on label leakage shows that labels can be easily extracted from gradients through mathematical analysis. Therefore, the variables that the attacker needs to match will be reduced to optimizing only x. More seriously, the words appearing in the text sequence are extracted by the model embedding layer, posing a more serious threat to privacy protection.

[0043] In a typical gradient leakage attack scenario, the attacker will try to obtain the gradient and try to recover the private training samples from it. Since the communication link can be eavesdropped, the attacker can be anyone, such as cloud servers, clients, edge servers, or even external attackers. Different attackers may have different attack capabilities, but this paper assumes that all attackers are honest and curious, that is, they will honestly follow the prescribed protocol during training, but at the same time are curious about the private data of other clients. When the attacker eavesdrops on the information transmitted during training, he will not interrupt the information transmission or inject poisonous information. This paper does not consider such situations that interfere with normal training by sending wrong calculation results or modifying models and private datasets.

[0044] Given a signal If w is sparse or nearly sparse in the original domain or in some transformed domain, use a small number of linear projections to capture the important information of the signal, and then use these projection data to reconstruct the original signal without full sampling; then, use an efficient reconstruction algorithm to get the original signal from the compressed version of w. Accurately or approximately reconstruct w; mathematically speaking, the perception process of w is expressed as: in, Indicates compression operation. Represents the measurement matrix. After applying compressed sensing, w is compressed into γ, and its corresponding compression rate is recorded as c = (nm) / n; in compressed sensing, signal reconstruction is mainly achieved by solving the following optimization problem: st||w||0≤k, where represents the decompression operation, and k represents the sparsity of w.

[0045] Step 1: The client layer consists of I clients distributed in different areas; i ={x i ,y i} represents the local dataset of the i-th client, where i∈{1,...,I}, d i =|D i |, that is, D i The size of x i and i Represent data samples and their labels respectively; these clients jointly train a global model F, and the parameter of model F is W; in communication round t, a group of clients I t is randomly selected to participate in the training process; for each i∈I t , which downloads the current global model W t Perform local training 2 and calculate gradient updates In order to protect the privacy of the client dataset, the gradient is compressed using compressed sensing theory before transmission, while achieving encryption effect on the communication link; then, the gradient is processed and transmitted to the client's corresponding edge server for local aggregation5.

[0046] The premise for the good application of compressed sensing theory is that the signal is sparse in a certain domain, so the gradient vector is first sparse in the time domain3, that is: The sparsity rate is p = k / n, p∈(0,1], k is the sparsity, n is the gradient vector The length of p = 1, in which the elements with the largest magnitude (i.e., the highest absolute value) of the gradient are retained, and the rest are discarded. For example, choosing p = 0.1 means retaining the top 10% elements with the largest magnitude. In addition, studies have shown that the gradient of federated learning is approximately sparse at the beginning and does not require additional sparsification. In other words, it is feasible to use p = 1; after that, each client uses the measurement matrix received from the cloud server, i.e., the key Φ, to compress its sparse gradients layer by layer. The compressed gradient is written as:

[0047] Step 2: The edge server layer includes J edge servers; is the set of clients selected in the region that is managed by the jth edge server in communication round t, where j∈{1,...,J}, and The edge server aggregates the compressed gradients received from clients within its communication range; then, each edge server sends its aggregated compressed gradients to the cloud server.

[0048] Step 3: After receiving the locally aggregated compressed gradients from the edge layer edge server, the cloud server will perform global aggregation 6; the two aggregations are expressed as: in, Finally, by decompressing the gradients 7, the cloud server updates the global model and starts the next communication round t+1; in addition to the above operations, the cloud server is also responsible for providing the client with initialized and updated global parameters.

[0049] From the sparsification formula in step 1, we can see that the compressed sensing process is linear, so for any Two constants We have a1·Φw1+a2·Φw2=Φ·(a1w1+a2w2); hence: The above formula means that before decompressing the gradient, the cloud server first aggregates the compressed gradient according to the client's weight, and then decompresses the aggregated gradient; therefore, the aggregation process of federated learning is divided into two steps: the edge server first performs a local aggregation5, and then sends the result to the cloud server for global aggregation6. This double aggregation process is expressed as and is the local aggregate gradient of the jth edge server, is the global aggregate gradient of the cloud server.

[0050] This dual aggregation has advantages in terms of privacy and performance. In terms of privacy, due to the linear characteristics of compressed sensing, the edge server directly aggregates based on the ciphertext without obtaining the key in advance, thus ensuring that it is difficult for the edge server to steal privacy. In addition, the cloud server only receives gradients from the edge server, so the received gradients have been aggregated and it is impossible to tell which client the gradient comes from. Therefore, the cloud server can only obtain information about the edge group but not individual clients. It is worth noting that the gradients received by the cloud server are aggregated from multiple clients, which is equivalent to increasing the batch size. In this case, attacking will significantly increase the difficulty of the attack and make it difficult to leak privacy. The energy-saving advantage is that only one reconstruction is required. In the traditional method, the cloud server decompresses each compressed gradient received from a client7, and then aggregates the decompressed gradient. The improved method of the present invention is that the cloud server directly aggregates the received compressed gradients, and then decompresses them based on the aggregated compressed gradients. In this way, only one gradient decompression will be generated in each iterative update of federated learning, and only one reconstruction error will be generated, minimizing the impact of the reconstruction error on the model accuracy. In addition, gradient decompression consumes a lot of computing resources. Even for a powerful cloud server, compared with decompressing the gradients of each client, only one decompression is required, which significantly improves computing efficiency.

[0051] After the compressed gradients are aggregated, the cloud server uses the key Φ to aggregate the compressed gradients. Reconstruct to get the average gradient update And update the global model with this: Complete model update 8, where W t+1 It is the initial model for the next round of training.

[0052] Compressed sensing reconstructs the original gradient by solving an optimization problem during the decompression process, in which a certain loss of accuracy is inevitable; however, this loss is regarded as a perturbation to the gradient; therefore, in the attacker's gradient matching optimization, it becomes very difficult to match the false gradient with the original gradient; especially in the embedding layer, it is difficult for the attacker to extract the words in the text sequence from the perturbed gradient, and privacy protection is thus achieved.

[0053] The above technical solution designs a privacy-preserving federated learning method for natural language processing. In response to the problems of privacy leakage and high communication overhead caused by the use of gradient leakage attacks to reconstruct text in current research schemes, the privacy-preserving federated learning method for natural language processing proposes a three-layer network model with double aggregation compressed sensing to achieve privacy protection. By doubly aggregating and compressing the gradient vector, it is ensured that private information is not leaked, and the decompression process only produces a small loss of accuracy, and this loss of accuracy can also be regarded as a gradient perturbation. While ensuring the accuracy of the federated learning model, it makes it very difficult to match the false gradient with the original gradient in the attacker's gradient matching optimization, effectively reducing the risk of the client's original text data being reconstructed and protecting privacy.

[0054] In practical applications, the privacy-preserving federated learning method designed by the present invention for natural language processing is shown in Table 1. Compared with the defenseless naive federated learning (plainFL), gradient compression (GC) and differential privacy (DP) based on Laplace noise distribution, the method designed by the present invention (Ours) has a stronger defense effect under three different attack methods: Deep Leakage from Gradients (DLG), TGA and LAMP. ROUGE-1, ROUGE-2 and ROUGE-L are a set of indicators for evaluating the similarity between sentences generated by gradient attacks and original sentences. ROUGE-1 measures the proportion of single words (unigrams) in the summary generated by the model that overlap with the reference summary. ROUGE-2 measures the proportion of two consecutive words (bigrams) in the summary generated by the model that overlap with the reference summary. ROUGE-L calculates the longest common subsequence (Longest Common Subsequence) between the summary generated by the model and the reference summary. The smaller the values ​​of the above three indicators, the less similar the sentence generated by the attacker is to the original sentence, which also means a stronger defense effect.

[0055] like Figure 2 , Figure 3 and Figure 4 As shown in the figure, the performance maintained by the present invention under different sparsity rates and different compression rates is better than the baseline method, that is, the performance of GC under different disturbance levels; however, it should be noted that if the sparsity rate is set too high, the model will not converge due to the loss of key information and the inability to reconstruct the original gradient; in the case of high sparsity, the accuracy of the model is reduced to the level of random guessing. By selecting an appropriate sparsity rate, the present method can achieve effective privacy protection within the minimum performance loss range (about 1%), which has obvious advantages over the baseline method.

[0056] Table 1. The defensive effects of different defense strategies against different attacks

[0057]

[0058] From the above, it can be seen that the privacy-preserving federated learning method for natural language processing provided by this application solves the problems of gradient information leakage and text reconstruction by designing a three-layer network model and using a dual-aggregation compressed sensing method; at the same time, the designed compressed sensing model gradient compression greatly reduces the gradient update volume of the language model after compression, thereby reducing the communication overhead of resource-constrained clients.

[0059] Finally, it should be noted that the above description is only a preferred example of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A privacy-preserving federated learning method for natural language processing, characterized in that: The following steps are involved: S1, the steps of the client layer include: each client compresses its own gradient and uploads the compressed gradient to the corresponding edge server layer; S2, the step of the edge server layer includes: each edge server locally aggregates the compressed gradients uploaded by the clients within its communication range, and sends the locally aggregated compressed gradients to the cloud server layer; S3, the steps of the cloud server layer include: globally aggregating the compressed gradients received from each edge server again, and then decompressing the gradients after the second aggregation.

2. A privacy-preserving federated learning method for natural language processing according to claim 1, characterized in that: In step S1, the client layer includes I clients distributed in different areas; D i ={x i ,y i } represents the local data set of the i-th client; where x i and i Represents data samples and their labels respectively; i∈{1,...,I}, d i =|D i |, that is, D i size; The clients jointly train a global model F, the parameters of which are W; in communication round t, a group of clients I t Randomly selected to participate in the training process; For each i∈I t , which downloads the current global model W t Perform local training and calculate gradient updates Before transmission, the gradient is compressed using compressed sensing theory, while achieving encryption effect on the communication link; then, the gradient is processed and transmitted to the client's corresponding edge server for local aggregation.

3. A privacy-preserving federated learning method for natural language processing according to claim 2, characterized in that: The compression step includes: the gradient vector is passed through is thinned, and the sparsity rate is: p=k / n,p∈(0,1]; k is the sparsity and n is the gradient vector Length; In this process, the element with the highest absolute value of the gradient is retained, and the rest of the elements are discarded; then each client uses the measurement matrix received from the cloud server, i.e., the key Φ, to compress its sparse gradient layer by layer, and the compressed gradient is recorded as: in, is the local aggregate gradient of the jth edge server.

4. The privacy-preserving federated learning method for natural language processing according to claim 3, characterized in that: In step S2, the edge server layer includes J edge servers; is the set of clients selected in the area that is responsible for the jth edge server in communication round t; where j∈{1,...,J}, and The edge server aggregates the compressed gradients received from clients within its communication range; then, each edge server sends its aggregated compressed gradients to the cloud server.

5. The privacy-preserving federated learning method for natural language processing according to claim 4, characterized in that: The dual aggregation step includes the cloud server aggregating the compressed gradient according to the weight of the client before decompressing the gradient, and then decompressing the aggregated gradient. This dual aggregation process is expressed as: and is the local aggregate gradient of the jth edge server, is the global aggregate gradient of the cloud server.

6. A privacy-preserving federated learning method for natural language processing according to claim 5, characterized in that: In step S3, the cloud server layer step includes that after receiving the local aggregated compressed gradient from the edge layer edge server, the cloud server will perform global aggregation; the two aggregations are expressed as: in, Finally, by decompressing the gradients, the cloud server updates the global model and starts the next communication round t+1.

7. The privacy-preserving federated learning method for natural language processing according to claim 6, characterized in that: The decompression step includes the cloud server using the key Φ to aggregate the compressed gradient Reconstruct to get the average gradient update And update the global model with this: represents the compressed gradient of the aggregation using the key Φ Reconstruct to get average gradient update W t+1 It is the initial model for the next round of training.

Images