AI model training data protection method and device based on local differential privacy

Abstract

The invention discloses an AI model training data protection method and device based on local differential privacy. The method comprises the steps of noise scale determination, wherein the noise scale is determined through a Laplace differential privacy mechanism according to a preset privacy budget value and obtained input data; a data noise adding step: generating Laplacian noise according to the noise scale, and adding the Laplacian noise to the input data; a gradient noise adding step: determining the gradient of each data point in the input data after the Laplacian noise is added according to a preset initial model training parameter, and adding the Laplacian noise to the gradient of each data point to obtain a noise-added gradient value; and a parameter determination step: determining a prediction model training parameter according to the noise-added gradient value. According to the invention, the accuracy and efficiency of model training can be improved under the condition of effectively avoiding privacy leakage of training data.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method and device for protecting AI model training data based on local differential privacy. Background Art

[0002] With the rapid development of artificial intelligence (AI) technology, all walks of life are increasingly relying on AI models to process and analyze data to improve the quality and efficiency of business decisions. AI models can perform complex tasks such as natural language processing, image recognition, and predictive analysis by learning and optimizing from large amounts of data. Data collection is crucial in the model training stage, and the accuracy and effectiveness of AI models are highly dependent on the quality and quantity of data. In the process of training massive and accurate AI models and improving user experience, privacy data such as users' personal information, behavior records, medical health data, and financial transaction history are involved, which will lead to huge security risks such as privacy leakage risks and data inference attacks.

[0003] At present, existing technologies have limitations in dealing with the above problems. For example, although fully homomorphic encryption can perform calculations on encrypted data to protect data privacy, its computational overhead is extremely high and is not suitable for large-scale data sets or real-time applications. Traditional differential privacy protects privacy by adding noise to the data set, but this method requires centralized processing of all data. The addition of noise may significantly affect the training effect of the model and is difficult to implement in a distributed environment. Therefore, how to ensure the efficiency and accuracy of AI model training while ensuring data privacy has become a difficult problem that needs to be solved urgently.

[0004] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section. Summary of the invention

[0005] An embodiment of the present invention provides an AI model training data protection method based on local differential privacy, which is used to improve the accuracy and efficiency of model training while avoiding the privacy leakage of training data.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides an AI model training data protection method based on local differential privacy, comprising:

[0008] Noise scale determination step: Determine the noise scale through the Laplace differential privacy mechanism based on the preset privacy budget value and the acquired input data;

[0009] Data noise adding step: generating Laplace noise according to the noise scale, and adding the Laplace noise to the input data;

[0010] Gradient noise adding step: determining the gradient of each data point in the input data after adding Laplace noise according to the preset initial model training parameters, and adding the Laplace noise to the gradient of each data point to obtain a noisy gradient value;

[0011] Parameter determination step: determining the prediction model training parameters according to the noise-added gradient value.

[0012] Furthermore, the prediction model training parameters and new input data are used to iteratively perform the noise scale determination step, the data noise addition step, the gradient noise addition step and the parameter determination step to update the prediction model training parameters.

[0013] Furthermore, the determining the noise scale through the Laplace differential privacy mechanism according to the preset privacy budget value and the input data includes:

[0014] Calculating the sensitivity of the input data;

[0015] The noise scale is determined according to the sensitivity and the privacy budget value through a Laplace differential privacy mechanism.

[0016] Further, generating Laplace noise according to the noise scale and adding the Laplace noise to the input data includes:

[0017] generating a noise value according to the noise scale by a noise probability density function;

[0018] The noise value is added to each data point in the input data by using a first encryption algorithm to obtain an encrypted data value of each data point.

[0019] Furthermore, the method of determining the gradient of each data point in the input data after adding Laplace noise according to the preset initial model training parameters, and adding the Laplace noise to the gradient of each data point to obtain a noisy gradient value includes:

[0020] A loss function is established based on the preset model training parameters, each data point in the input data after adding Laplace noise, and the label value corresponding to each data point;

[0021] Calculate the partial derivative of the loss function with respect to the model parameters to obtain the gradient of each data point;

[0022] A noise value is added to the gradient using a second data encryption algorithm to obtain a noisy gradient value for each data point.

[0023] Further, determining the prediction model training parameters according to the noise-added gradient value includes:

[0024] Aggregating the noise-added gradient values ​​to obtain a noise-added gradient;

[0025] The prediction model training parameters are calculated according to the noisy gradient.

[0026] In a second aspect, the present invention provides another AI model training data protection method based on local differential privacy, including:

[0027] Get initial input data;

[0028] Determining a noise scale through a Laplace differential privacy mechanism according to a preset privacy budget value and the initial input data;

[0029] generating Laplace noise according to the noise scale, and adding the Laplace noise to the initial input data;

[0030] Determine the gradient of each data point in the initial input data after adding Laplace noise according to the preset initial model training parameters, and add the Laplace noise to the gradient of each data point to obtain a noisy gradient value;

[0031] Aggregating the noise-added gradient values ​​to obtain a noise-added gradient;

[0032] The prediction model training parameters are calculated according to the noisy gradient, and the above steps are iteratively performed using the prediction model training parameters and new input data to update the target model training parameters.

[0033] Furthermore, determining the noise scale through the Laplace differential privacy mechanism according to the preset privacy budget value and the initial input data includes:

[0034] Calculating the sensitivity of the initial input data;

[0035] The noise scale is determined according to the sensitivity and the privacy budget value through a Laplace differential privacy mechanism.

[0036] Further, generating Laplace noise according to the noise scale and adding the Laplace noise to the initial input data includes:

[0037] generating a noise value according to the noise scale by a noise probability density function;

[0038] The noise value is added to each data point in the initial input data by using a first encryption algorithm to obtain an encrypted data value of each data point.

[0039] Furthermore, the step of determining the gradient of each data point in the initial input data after adding Laplace noise according to the preset initial model training parameters, and adding the Laplace noise to the gradient of each data point to obtain the noisy gradient value includes:

[0040] A loss function is established based on the preset model training parameters, each data point in the initial input data after adding Laplace noise, and the label value corresponding to each data point;

[0041] Calculate the partial derivative of the loss function with respect to the model parameters to obtain the gradient of each data point;

[0042] A noise value is added to the gradient using a second data encryption algorithm to obtain a noisy gradient value for each data point.

[0043] An embodiment of the present invention provides an AI model training data protection device based on local differential privacy, which is used to improve the accuracy and efficiency of model training while avoiding the privacy leakage of training data.

[0044] In a third aspect, the present invention provides an AI model training data protection device based on local differential privacy, comprising:

[0045] A first noise scale determination module, configured to determine a noise scale through a Laplace differential privacy mechanism according to a preset privacy budget value and the acquired input data;

[0046] A first data noise adding module, configured to generate Laplace noise according to the noise scale, and add the Laplace noise to the input data;

[0047] A first gradient noise adding module, used for determining the gradient of each data point in the input data after adding Laplace noise according to a preset initial model training parameter, and adding the Laplace noise to the gradient of each data point to obtain a noisy gradient value;

[0048] A parameter determination module is used to determine the prediction model training parameters according to the noise-added gradient value.

[0049] In a fourth aspect, the present invention provides another AI model training data protection device based on local differential privacy, comprising:

[0050] A data acquisition module, used to acquire initial input data;

[0051] A second noise scale determination module, configured to determine the noise scale through a Laplace differential privacy mechanism according to a preset privacy budget value and the initial input data;

[0052] A second data noise adding module, configured to generate Laplace noise according to the noise scale, and add the Laplace noise to the initial input data;

[0053] A second gradient noise adding module is used to determine the gradient of each data point in the initial input data after adding Laplace noise according to the preset initial model training parameters, and add the Laplace noise to the gradient of each data point to obtain a noisy gradient value;

[0054] A gradient aggregation module, used for aggregating the noisy gradient values ​​to obtain a noisy gradient;

[0055] The parameter updating module is used to calculate the prediction model training parameters according to the noisy gradient, iteratively execute the above steps using the prediction model training parameters and new input data, and update the target model training parameters.

[0056] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned AI model training data protection method based on local differential privacy when executing the computer program.

[0057] An embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned AI model training data protection method based on local differential privacy.

[0058] An embodiment of the present invention also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned AI model training data protection method based on local differential privacy.

[0059] An AI model training data protection method and device based on local differential privacy provided by an embodiment of the present invention adopts local differential privacy technology. By adding Laplace noise to the input data before uploading the data to the system, it can effectively ensure the security of user data privacy protection, avoid the leakage of sensitive information of user data, and ensure that attackers cannot directly obtain the user's real data, thereby improving the strength of privacy protection. During the model training process, the noisy gradient algorithm is further adopted to strengthen the privacy protection of training data without affecting the performance of the model, so as to prevent attackers from inferring the original data by observing the changes in model training parameters during the model training process. By adopting a dual noise protection strategy, combining data noise with gradient noise, not only the security of user privacy during data transmission is guaranteed, but also the privacy protection of training data during model training is guaranteed, thereby improving the security of overall privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0061] Figure 1 Schematic diagram of a flow chart of a method for protecting AI model training data based on local differential privacy in one embodiment of the present invention;

[0062] Figure 2 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0063] Figure 3 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0064] Figure 4 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0065] Figure 5 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0066] Figure 6 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0067] Figure 7 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0068] Figure 8 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0069] Fig. 9 This is a flow chart of an AI model training data protection method based on local differential privacy in another embodiment of the present invention;

[0070] Fig.10 Schematic diagram of the structure of an AI model training data protection device based on local differential privacy in one embodiment of the present invention;

[0071] Fig.11 Schematic diagram of the structure of an AI model training data protection device based on local differential privacy in another embodiment of the present invention;

[0072] Fig.12 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0073] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0074] The information collected in the technical solution of this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0075] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0076] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0077] Embodiment 1:

[0078] In order to ensure the accuracy and efficiency of model training while protecting the privacy of training data, the present invention provides an AI model training data protection method based on local differential privacy.

[0079] Figure 1 The figure is a flowchart of a method for protecting data of AI model training based on local differential privacy in one embodiment of the present invention. The execution subject of the method for protecting data of AI model training based on local differential privacy is a local differential privacy model, which is an AI model trained by a machine learning algorithm or a deep learning algorithm. The embodiment of the present invention does not specifically limit the type of AI model.

[0080] like Figure 1 As shown, the AI ​​model training data protection method based on local differential privacy includes steps 101 to 104.

[0081] Step 101 is a noise scale determination step: determining the noise scale through the Laplace differential privacy mechanism according to a preset privacy budget value and the acquired input data.

[0082] Step 102 is a data noise adding step: generating Laplace noise according to the noise scale, and adding Laplace noise to the input data.

[0083] Step 103 is a gradient noise adding step: determining the gradient of each data point in the input data after adding Laplace noise according to the preset initial model training parameters, and adding Laplace noise to the gradient of each data point to obtain a noisy gradient value.

[0084] Step 104 is the parameter determination step: determining the prediction model training parameters according to the noise gradient value.

[0085] from Figure 1 It can be seen from the process shown that in the embodiment of the present invention, by setting the privacy protection of the input user data, the privacy budget value and noise scale of the local differential privacy are determined to ensure that the input data has been encrypted before uploading the system. In the data noise addition stage, Laplace noise is generated according to the noise scale, and the Laplace noise is added to each data point in the input data to obtain an encrypted data set. In the model training stage, the present invention introduces a noisy gradient calculation method to add noise to the model gradient to ensure that the privacy of individual data will not be leaked during the model training process. Through the step-by-step noise addition strategy, data noise addition is combined with gradient noise addition, which can not only ensure that privacy is not leaked during data transmission, but also prevent the user's original data from being inferred through parameter changes during model training, thereby improving the security of overall privacy protection.

[0086] In one embodiment, the AI ​​model training data protection method based on local differential privacy also includes: using the prediction model training parameters and new input data to iteratively execute the noise scale determination step, the data noise addition step, the gradient noise addition step and the parameter determination step to update the prediction model training parameters.

[0087] Specifically, the above steps 101 to 104 are executed to train the AI ​​model to obtain the prediction model training parameters. The above steps 101 to 104 are executed multiple times to iteratively update the prediction model training parameters until the preset convergence conditions are met, and the iterative update of the model is stopped to enter the model performance evaluation stage.

[0088] like Figure 1 As shown, each step is explained in detail below.

[0089] Step 101 (i.e., noise scale determination step): determine the noise scale b through the Laplace differential privacy mechanism according to the preset privacy budget value ε and the acquired input data.

[0090] Specifically, in the data preparation stage, the privacy budget value ε is selected as the preset parameter for determining the noise distribution parameter (ie, the noise scale b) according to the Local Differential Privacy (LDP) algorithm.

[0091] The smaller the privacy budget value ε is, the more noise is added, and thus the privacy protection capability is stronger. However, since adding too much noise will reduce the accuracy of the model, the specific value of ε depends on factors such as the sensitivity of the data and the trade-off between data privacy and accuracy. The general privacy budget value ε ranges from 0.01 to 1.

[0092] In one embodiment, when the privacy budget value ε is adjusted according to the sensitivity of the usage scenario, for highly sensitive data (such as financial data and medical data, etc.), a smaller privacy budget value ε needs to be selected to enhance privacy protection, while for less sensitive data, a larger privacy budget value ε can be selected.

[0093] In one embodiment, when the privacy budget value ε is adjusted according to the trade-off between data privacy and accuracy, the application scenario needs to strike a balance between privacy protection and model accuracy. For example, in the privacy protection of AI training data of the present invention, when facing low-sensitivity data, it is necessary to ensure the high availability of training data, and a larger privacy budget value ε is usually selected, and the value range of ε is generally between 0.5 and 1.

[0094] In one embodiment, if Figure 2 As shown, step 101 includes step 201 and step 202 .

[0095] Step 201: Calculate the sensitivity Δf of the input data.

[0096] Before determining the noise scale b, the sensitivity Δf of the input data is determined according to the definition of the LDP algorithm.

[0097] According to the definition of the local differential privacy algorithm, Δf refers to the maximum change in the output of function f when there is only one different data point in the data set.

[0098] The maximum change value Δf of the output of function f is calculated according to formula 1.

[0099] Formula 1:

[0100] Where Δf is the sensitivity of the input data, function f is the function applied to the data set, such as a statistical function or a query function, and the data set is the data set composed of the input data; D,D ′ are two adjacent data sets.

[0101] Step 202: Determine the noise scale b through the Laplace differential privacy mechanism according to the sensitivity Δf of the input data and the privacy budget value ε.

[0102] Specifically, according to the definition of the Laplace differential privacy mechanism, the noise scale b is determined by the privacy budget value ε.

[0103] The noise scale b is calculated according to Formula 2.

[0104] Formula 2:

[0105] Among them, ε is the privacy budget value, which is a key parameter used to control the strength of privacy protection; b is the noise scale, which reflects the statistical characteristics of Laplace noise; Δf is the sensitivity of the input data, function f is the function applied to the data set, such as a statistical function or a query function, and the data set is a data set composed of the input data.

[0106] After completing the above steps, the input data needs to be preprocessed, that is, the data to be initially uploaded to the system needs to be cleaned. Data preprocessing can be performed through format unification, missing value processing, and standardization to ensure that the cleaned input data meets the requirements of the local differential privacy algorithm.

[0107] In one embodiment, missing value processing is one of the key steps in data cleaning. When the amount of input data is huge and the proportion of missing values ​​is relatively small, simple missing value processing can be performed by directly deleting the erroneous input data. When the proportion of missing values ​​in the input data is large, missing value processing can be performed by interpolation. Interpolation predicts missing values ​​by observing other non-missing variables to fill in the gaps in the input data. Common interpolation methods include regression interpolation, K-nearest neighbor interpolation, and Lagrange interpolation. Data standardization is the process of de-dimensionalizing input data to eliminate the influence of data units and dimensions and make different indicators comparable. Common standardization methods include Min-Max standardization, Z-score standardization, normalization or centering, etc. Data preprocessing is performed by format unification, missing value processing, and standardization to improve the accuracy and completeness of subsequent model analysis.

[0108] Step 102 (ie, data noise adding step): generate Laplace noise Lap(z) according to the noise scale b, and add the Laplace noise Lap(z) to the input data.

[0109] Specifically, in the data noise adding stage, appropriate Laplace noise Lap(z) is generated according to the privacy budget value ε and noise scale b determined in the above steps.

[0110] In one embodiment, if Figure 3 As shown, step 102 includes step 301 and step 302 .

[0111] Step 301: Generate a noise value z according to a noise scale b through a noise probability density function.

[0112] Specifically, the noise value z is generated by the noise probability density formula.

[0113] The noise probability density formula is:

[0114] Step 302: Encrypt each data point x in the input data using a first encryption algorithm. i Add noise value z i , get the encrypted data value x′ of each data point i .

[0115] Specifically, the calculation formula of the first encryption data algorithm is x′ i =x i +z i .

[0116] Among them, x′ i is the encrypted data value after adding noise, x i For each data point in the input data, z i For each data point x i The corresponding noise value, i has a value range of positive integers greater than or equal to 0.

[0117] In the embodiment of the present invention, based on the requirements of the local differential privacy mechanism, appropriate Laplace noise is generated through the privacy budget value and the noise scale to encrypt sensitive information in the user data. The generated Laplace noise is added to each user data point, so as to form an encrypted data set based on the encrypted data point. Through the data noise addition process, privacy leakage in the data transmission and data storage process can be effectively avoided, thereby improving the privacy protection of user data.

[0118] Step 103 (gradient noise adding step): Determine each data point x′ in the input data after adding Laplace noise according to the preset initial model training parameter θ i The gradient g i , and the gradient g for each data point i Add Laplace noise to get the noisy gradient value g i ′.

[0119] Specifically, in the model training phase, the noise gradient calculation method is used to calculate each encrypted data point x′ in the encrypted data set. i The gradient g i , by for each encrypted data point x′ i The gradient g i Add noise value z i, get the noisy gradient value g i ′.

[0120] In one embodiment, if Figure 4 As shown, step 103 includes steps 401 to 403.

[0121] Step 401: According to the preset model training parameters θ, each data point x′ in the input data after adding Laplace noise i And the label value y corresponding to each data point i Establish the loss function L(θ,x′ i ,y i ).

[0122] Specifically, the preset model training parameter θ refers to the variable that the AI ​​model learns and adjusts during the model training process. In the artificial intelligence algorithm, the weights and biases of the model are optimized by adjusting the preset model training parameter θ, so that the model can learn and infer from the input data and accurately analyze and predict new data. i It refers to the true value provided to the model, which can also be called the target value.

[0123] Step 402: Calculate the loss function L(θ, x′ i ,y i ) is the partial derivative of the model parameter θ, and the gradient g of each data point is obtained i .

[0124] Specifically, the loss function L(θ,x′ i ,y i ) is a measure of the model prediction value x′ i (i.e. the final output of the model) and the true value y i The function of the difference between i and the true value y i The error between θ and θ is used to optimize the model training process, so that the model can gradually adjust the model parameters θ to improve the accuracy of model prediction. i ,y i ) is smaller, indicating that the model's predicted value x′ i The closer to the true value y i , indicating that the model is more robust.

[0125] In one embodiment, for each noise-added data point x′ in the encrypted data set i and its label y i , by calculating the loss function L(θ,x′ i ,y i ) is the partial derivative of the model training parameter θ, and each encrypted data point x′ in the encrypted data set is obtainedi Gradient Among them, the gradient g i It refers to the loss function L(θ,x′ i ,y i ) relative to the change in the model training parameter θ, the gradient g i is used to describe the loss function L(θ,x′) as the model parameter θ changes. i ,y i ) reflects the impact of data on model updating.

[0126] Step 403: Use the second encryption algorithm to encrypt the gradient g i Add noise value z i , get each data point x′ i The noisy gradient value g i ′.

[0127] Specifically, the calculation formula of the second encryption data algorithm is g i ′=g i +z i . Calculate each encrypted data point x′ according to the calculation formula of the second encryption algorithm i The noisy gradient value g i ′.

[0128] Step 104 (i.e., parameter determination step): according to the noise gradient value g i ′Determine the prediction model training parameters θ t+1 .

[0129] In one embodiment, if Figure 5 As shown, step 104 includes step 501 and step 502 .

[0130] Step 501: Aggregate the noisy gradient value g i ′Get the noisy gradient

[0131] Specifically, the noise gradient with m data samples is calculated by formula 3:

[0132] Formula 3:

[0133] in, is the noise gradient value after aggregation, i.e., the noise gradient; g i ′ is the noise gradient value; m is the number of data samples, that is, the number of data samples in the minimum batch is at least m.

[0134] Step 502: According to the noise gradient Calculate the prediction model training parameters θ t+1 .

[0135] Specifically, the prediction model training parameter θ is calculated by the gradient descent algorithm t+1 .

[0136] The calculation formula of the gradient descent algorithm is:

[0137] Among them, θ t+1 is the model training parameter for the next moment, that is, the prediction model training parameter; θ t is the model training parameter at the current moment, that is, the preset model training parameter θ; η is the learning rate in the gradient descent algorithm, which is used to control the step size of each round of model iteration update, that is, the moving distance of the model to the optimal solution during each round of iteration; is the noise gradient.

[0138] In an embodiment of the present invention, the direction of model optimization is adjusted by adjusting the model training parameters during the model training phase, so that the model can better perform data analysis and prediction. The gradient of each encrypted data point in the encrypted data set is calculated by a noisy gradient calculation method, and these gradient data are subjected to noise processing. If these gradient data are used directly without noise processing, the attacker can infer the original data by analyzing the changes in the model training parameters. Therefore, by adding random noise to the gradient of each encrypted data point, the update changes of the model training parameters of each encrypted data point are hidden. This fuzzification process effectively prevents the attacker from restoring the information of the original data point through the gradient data information. Even if the attacker obtains the gradient data information during the model training process, the original data cannot be accurately inferred, thereby achieving privacy protection of user data.

[0139] Iterative training is performed by repeatedly executing the above steps 101 to 104 to iteratively update the prediction model training parameters. After the prediction model training parameters are iteratively updated multiple times, the model performance evaluation phase is entered according to the preset convergence conditions. The preset convergence conditions include the first judgment condition and the second judgment condition.

[0140] Specifically, during the model training process, when the first judgment condition or the second judgment condition is met, the model performance evaluation stage is automatically entered.

[0141] In one embodiment, whether the model enters the model performance evaluation stage is determined based on the convergence degree of the loss value.

[0142] Specifically, the first judgment condition is that if the loss function value of the model tends to be stable in multiple iterations, and the change range of the loss function value is extremely small or no longer decreases significantly, the model performance evaluation stage is entered.

[0143] When the loss function value tends to be stable during multiple iterations and the change in the loss function value is extremely small or no longer decreases significantly, it means that the accuracy of the model during the training process tends to be stable, and therefore the conditions for entering the model performance evaluation stage are met.

[0144] In one embodiment, whether the model enters the model performance evaluation stage is determined based on a preset maximum number of iterations.

[0145] Specifically, the second judgment condition is that if the number of model iterations reaches a preset maximum number of iterations, the model performance evaluation phase is entered.

[0146] In order to prevent the model from overfitting, an upper limit on the number of iterations is generally set. When the number of model iterations reaches the maximum number of iterations, the model update stops and the model performance evaluation phase is directly entered.

[0147] When entering the model performance evaluation phase, the loss value and accuracy of the model are determined respectively.

[0148] Loss value and accuracy are two important indicators for measuring model performance. Loss value is used to reflect the gap between the model prediction results and the actual results; accuracy is used to measure the accuracy of the model's prediction of new data.

[0149] In one embodiment, during the model performance evaluation process, the data in the validation set or the test set is predicted to obtain a prediction result. The prediction error of the model, i.e., the loss value, is then calculated through a loss function based on the prediction result and the preset true value. The prediction result is the output result of the model, and the preset true value is the label value.

[0150] In this embodiment, the size of the loss value is used as an evaluation criterion for the degree of model convergence. The smaller the loss value of the model, the higher the accuracy of the model prediction. If the loss value continues to decrease and tends to be stable, it means that the model has a good fitting effect on the current data.

[0151] In one embodiment, during the model performance evaluation process, the data in the validation set or the test set is predicted to obtain a prediction result, and then the classification accuracy of the model is calculated by comparing the classification result predicted by the model with the label value.

[0152] Among them, the classification result of the comparison model is the proportion of correct prediction results in the total number of prediction results. The higher the accuracy of the model, the stronger the model's prediction ability for the data, that is, the model has better generalization ability.

[0153] In the embodiment of the present invention, by calculating the loss value and accuracy, the model performance can be comprehensively evaluated. This not only ensures the effectiveness of the model on the training data, but also ensures that the model can process a new data set. Evaluating the model performance can help the model balance the relationship between privacy protection and model accuracy, and avoid the privacy budget value being too small, resulting in a decrease in model accuracy.

[0154] In one embodiment, during the model performance evaluation process, the privacy budget value ε and the noise scale b are dynamically adjusted to optimize the model performance.

[0155] Specifically, if the loss value is higher than the first preset threshold or the accuracy is lower than the first preset accuracy, the privacy budget value ε is increased to optimize the model performance. The specific value ranges of the first preset threshold and the first preset accuracy can be set according to the needs of those skilled in the art, and this embodiment does not impose specific restrictions.

[0156] According to the noise mechanism in local differential privacy, the size of the noise is related to the sensitivity of the data set and the privacy budget value ε. When the loss value is higher than the first preset threshold or the accuracy is lower than the first preset accuracy, it may be caused by too much noise added to the model. At this time, the noise scale b is adjusted by reducing the amount of noise (i.e., increasing the privacy budget value ε). According to Formula 1, since the noise scale b is determined by the privacy budget value ε, when the privacy budget value ε is increased, the noise scale b can be reduced, thereby reducing the amount of noise.

[0157] However, the increase in the privacy budget value ε cannot be too large, which will result in the model's ability to protect data privacy being too low. Therefore, the privacy budget value ε needs to be appropriately increased to avoid the risk of privacy leakage.

[0158] In the embodiment of the present invention, a dynamic adjustment mechanism is adopted to adjust the privacy budget value and the noise scale in real time according to the model performance and privacy requirements, thereby ensuring that the model has high model performance while protecting data privacy.

[0159] In one embodiment, during the model performance evaluation process, if the loss value of the model reaches the second preset threshold or the accuracy of the validation set reaches the second preset accuracy, the model training is stopped (i.e., the model training is completed). If the model does not reach the second preset threshold or the accuracy of the validation set does not reach the second preset accuracy, iterative training continues until the preset convergence condition or the maximum number of iterations is reached. Among them, the first preset threshold is greater than the second preset threshold, and the first preset accuracy is lower than the second preset accuracy; the specific value range of the second preset threshold and the second preset accuracy can be set according to the needs of those skilled in the art, and this embodiment does not impose specific restrictions.

[0160] In the embodiment of the present invention, the local differential privacy technology is adopted to effectively ensure the security of user data privacy protection by adding Laplace noise to the input data before uploading the data to the system, thereby avoiding the leakage of sensitive information of user data, ensuring that attackers cannot directly obtain the user's real data, and thus improving the strength of privacy protection. In the model training process, the noisy gradient algorithm is further adopted to strengthen the privacy protection of training data without affecting the model performance, so as to prevent attackers from inferring the original data by observing the changes in the model training parameters during the model training process. By adopting a dual noise protection strategy, combining data noise with gradient noise, not only the security of user privacy during data transmission is guaranteed, but also the privacy protection of training data during model training is guaranteed, thereby improving the security of overall privacy protection.

[0161] Embodiment 2:

[0162] In order to ensure the accuracy and efficiency of model training while protecting the privacy of training data, the present invention also provides another AI model training data protection method based on local differential privacy.

[0163] Figure 6 The figure is a flowchart of a method for protecting data of AI model training based on local differential privacy in one embodiment of the present invention. The execution subject of the method for protecting data of AI model training based on local differential privacy is a local differential privacy model, which is an AI model trained by a machine learning algorithm or a deep learning algorithm. The embodiment of the present invention does not specifically limit the type of AI model.

[0164] like Figure 6 As shown, the AI ​​model training data protection method based on local differential privacy includes steps 601 to 606.

[0165] Step 601: Obtain initial input data.

[0166] Step 602: Determine the noise scale through the Laplace differential privacy mechanism according to the preset privacy budget value and the initial input data.

[0167] Step 603: Generate Laplace noise according to the noise scale, and add the Laplace noise to the initial input data.

[0168] Step 604: Determine the gradient of each data point in the initial input data after adding Laplace noise according to the preset initial model training parameters, and add Laplace noise to the gradient of each data point to obtain a noisy gradient value.

[0169] Step 605: Aggregate the noisy gradient values ​​to obtain the noisy gradient.

[0170] Step 606: Calculate the prediction model training parameters based on the noisy gradient, iterate the above steps using the prediction model training parameters and new input data, and update the target model training parameters.

[0171] from Figure 6 It can be seen from the process shown that in the embodiment of the present invention, by setting the privacy protection for the initial input data, the privacy budget value and noise scale of the local differential privacy are determined to ensure that the input data has been encrypted before uploading the system. Laplace noise is generated according to the noise scale, and the Laplace noise is added to each data point in the input data to obtain an encrypted data set. The present invention adopts a noisy gradient calculation method to ensure that the user data privacy will not be leaked during the model training process by adding noise to the model gradient. Through the step-by-step noise strategy, data noise is combined with gradient noise, which can not only ensure that privacy is not leaked during data transmission, but also prevent the original data from being inferred through parameter changes during model training, thereby improving the security of overall privacy protection.

[0172] like Figure 6 As shown, each step is explained in detail below.

[0173] Step 601: Obtain initial input data.

[0174] Step 602: Determine the noise scale b through the Laplace differential privacy mechanism according to the preset privacy budget value ε and the initial input data.

[0175] Specifically, in the initial data preparation stage, the initial input data is first obtained, and the privacy budget value ε is selected as the preset parameter for determining the noise distribution parameter (i.e., the noise scale b) according to the Local Differential Privacy (LDP) algorithm.

[0176] The smaller the privacy budget value ε is, the more noise is added, and thus the privacy protection capability is stronger. However, since adding too much noise will reduce the accuracy of the model, the specific value of ε depends on factors such as the sensitivity of the data and the trade-off between data privacy and accuracy. The general privacy budget value ε ranges from 0.01 to 1.

[0177] In one embodiment, when the privacy budget value ε is adjusted according to the sensitivity of the usage scenario, for highly sensitive data (such as financial data and medical data, etc.), a smaller privacy budget value ε needs to be selected to enhance privacy protection, while for less sensitive data, a larger privacy budget value ε can be selected.

[0178] In one embodiment, when the privacy budget value ε is adjusted according to the trade-off between data privacy and accuracy, the application scenario needs to strike a balance between privacy protection and model accuracy. For example, in the privacy protection of AI training data of the present invention, when facing low-sensitivity data, it is necessary to ensure the high availability of training data, and a larger privacy budget value ε is usually selected, and the value range of ε is generally between 0.5 and 1.

[0179] In one embodiment, if Figure 7 As shown, step 602 includes step 701 and step 702.

[0180] Step 701: Calculate the sensitivity Δf of the initial input data.

[0181] Before determining the noise scale b, the sensitivity Δf of the initial input data is determined according to the definition of the LDP algorithm.

[0182] According to the definition of the local differential privacy algorithm, Δf refers to the maximum change in the output of function f when there is only one different data point in the data set.

[0183] The maximum change value Δf of the output of function f is calculated according to formula 1.

[0184] Formula 1:

[0185] Where Δf is the sensitivity of the initial input data, function f is the function applied to the data set, such as a statistical function or a query function, and the data set is the data set composed of the input data; D,D ′ are two adjacent data sets.

[0186] Step 702: Determine the noise scale b according to the sensitivity Δf and the privacy budget ε through the Laplace differential privacy mechanism.

[0187] Specifically, according to the definition of the Laplace differential privacy mechanism, the noise scale b is determined by the privacy budget value ε.

[0188] The noise scale b is calculated according to Formula 2.

[0189] Formula 2:

[0190] Among them, ε is the privacy budget value, which is a key parameter used to control the strength of privacy protection; b is the noise scale, which reflects the statistical characteristics of Laplace noise; Δf is the sensitivity of the initial input data, function f is the function applied to the data set, such as a statistical function or a query function, and the data set is a data set composed of the input data.

[0191] After completing the above steps, the initial input data needs to be preprocessed, that is, the data to be initially uploaded to the system needs to be cleaned. Data preprocessing can be performed through format unification, missing value processing, and standardization to ensure that the cleaned initial input data meets the requirements of the local differential privacy algorithm.

[0192] In one embodiment, missing value processing is one of the key steps in data cleaning. When the amount of input data is huge and the proportion of missing values ​​is relatively small, simple missing value processing can be performed by directly deleting the erroneous input data. When the proportion of missing values ​​in the input data is large, missing value processing can be performed by interpolation. Interpolation predicts missing values ​​by observing other non-missing variables to fill in the gaps in the input data. Common interpolation methods include regression interpolation, K-nearest neighbor interpolation, and Lagrange interpolation. Data standardization is the process of de-dimensionalizing input data to eliminate the influence of data units and dimensions and make different indicators comparable. Common standardization methods include Min-Max standardization, Z-score standardization, normalization or centering, etc. Data preprocessing is performed by format unification, missing value processing, and standardization to improve the accuracy and completeness of subsequent model analysis.

[0193] Step 603: Generate Laplace noise Lap(z) according to the noise scale b, and add the Laplace noise Lap(z) to the initial input data.

[0194] Specifically, in the data noise adding stage, appropriate Laplace noise Lap(z) is generated according to the privacy budget value ε and noise scale b determined in the above steps.

[0195] In one embodiment, if Figure 8 As shown, step 603 includes step 801 and step 802.

[0196] Step 801: Generate a noise value z according to a noise scale b through a noise probability density function.

[0197] Specifically, the noise value z is generated by the noise probability density formula.

[0198] The noise probability density formula is:

[0199] Step 802: Use the first encryption algorithm to encrypt each data point x in the initial input data. i Add the noise value z i , get the encrypted data value x′ of each data point i .

[0200] Specifically, the calculation formula of the first encryption data algorithm is x′ i =x i +zi .

[0201] Among them, x′ i is the encrypted data value after adding noise, x i For each data point in the initial input data, z i For each data point x i The corresponding noise value.

[0202] In the embodiment of the present invention, based on the requirements of the local differential privacy mechanism, appropriate Laplace noise is generated through the privacy budget value and the noise scale to encrypt sensitive information in the user data. The generated Laplace noise is added to each user data point, so as to form an encrypted data set based on the encrypted data point. Through the data noise addition process, privacy leakage in the data transmission and data storage process can be effectively avoided, thereby improving the privacy protection of user data.

[0203] Step 604: Determine the value of each data point x′ in the initial input data after adding Laplace noise according to the preset initial model training parameter θ i The gradient g i , and the gradient g for each data point i Add Laplace noise to get the noisy gradient value g i ′.

[0204] Specifically, in the model training phase, the noise gradient calculation method is used to calculate each encrypted data point x′ in the encrypted data set. i The gradient g i , by for each encrypted data point x′ i The gradient g i Add noise value z i , get the noisy gradient value g i ′.

[0205] In one embodiment, if Fig. 9 As shown, step 604 includes steps 901 to 903 .

[0206] Step 901: According to the preset model training parameters θ, each data point x′ in the initial input data after adding Laplace noise i And the label value y corresponding to each data point i Establish the loss function L(θ,x′ i ,y i ).

[0207] Specifically, the preset model training parameter θ refers to the variable that the AI ​​model learns and adjusts during the model training process. In the artificial intelligence algorithm, the weights and biases of the model are optimized by adjusting the preset model training parameter θ, so that the model can learn and infer from the input data and accurately analyze and predict new data. i It refers to the true value provided to the model, which can also be called the target value.

[0208] Step 902: Calculate the loss function L(θ, x′ i ,y i ) is the partial derivative of the model parameter θ, and the gradient g of each data point is obtained i .

[0209] Specifically, the loss function L(θ,x′ i ,y i ) is a measure of the model prediction value x′ i (i.e. the final output of the model) and the true value y i The function of the difference between the two, through the quantitative model prediction value x ′ i and the true value y i The error between θ and θ is used to optimize the model training process, so that the model can gradually adjust the model parameters θ to improve the accuracy of model prediction. i ,y i ) is smaller, indicating that the model's predicted value x′ i The closer to the true value yi ， It indicates that the model is more robust.

[0210] In one embodiment, for each noise-added data point x′ in the encrypted data set i and its label y i , by calculating the loss function L(θ,x′ i ,y i ) is the partial derivative of the model training parameter θ, and each encrypted data point x′ in the encrypted data set is obtained i Gradient Among them, the gradient g i It refers to the loss function L(θ,x′ i ,y i ) relative to the change in the model training parameter θ, the gradient g i Used to describe the loss function L(θ,x′) as the model parameter θ changes. i ,y i ) reflects the impact of data on model updating.

[0211] Step 903: Use the second encryption algorithm to encrypt the gradient g i Add noise value z i, get each data point x′ i The noisy gradient value g i ′.

[0212] Specifically, the calculation formula of the second encryption data algorithm is g i ′=g i +z i . Calculate each encrypted data point x′ according to the calculation formula of the second encryption algorithm i The noisy gradient value g i ′.

[0213] Step 605: Aggregate the noisy gradient value g i ′Get the noisy gradient

[0214] Specifically, the noise gradient with m data samples is calculated by formula 3:

[0215] Formula 3:

[0216] in, is the noise gradient value after aggregation, i.e., the noise gradient; g i ′ is the noise gradient value; m is the number of data samples, that is, the number of data samples in the minimum batch is at least m.

[0217] Step 606: According to the noise gradient Calculate the prediction model training parameters θ t+1 , using the prediction model to train the parameters θ t+1 And new input data iteratively execute the above steps to update the target model training parameters.

[0218] Specifically, the prediction model training parameter θ is calculated by the gradient descent algorithm t+1 .

[0219] The calculation formula of the gradient descent algorithm is:

[0220] Among them, θ t+1 is the model training parameter for the next moment, that is, the prediction model training parameter; θ t is the model training parameter at the current moment, that is, the preset model training parameter θ; η is the learning rate in the gradient descent algorithm, which is used to control the step size of each round of model iteration update, that is, the moving distance of the model to the optimal solution during each round of iteration; is the noise gradient.

[0221] When the new input data is replaced, the parameters θ are trained according to the prediction model. t+1The initial model training parameters θ preset in step 704 are updated as the model training parameters at the current moment, and the above steps are executed for iterative training according to the new input data and the model training parameters at the current moment to update the target model training parameters, i.e., the model training parameters at the next moment.

[0222] In the embodiment of the present invention, the target model training parameters are iteratively updated by iteratively executing step 701 and step 706 until the preset convergence condition is met, the model iterative training is stopped, and the model performance evaluation phase is entered. Through the above iterative training, the accuracy of model prediction is improved, and the model has better generalization ability.

[0223] After updating the target model training parameters in multiple iterations, the model performance evaluation phase is entered according to the preset convergence conditions, wherein the preset convergence conditions include the first judgment condition and the second judgment condition.

[0224] Specifically, during the model training process, when the first judgment condition or the second judgment condition is met, the model performance evaluation stage is automatically entered.

[0225] In one embodiment, whether the model enters the model performance evaluation stage is determined based on the convergence degree of the loss value.

[0226] Specifically, the first judgment condition is that if the loss function value of the model tends to be stable in multiple iterations, and the change range of the loss function value is extremely small or no longer decreases significantly, the model performance evaluation stage is entered.

[0227] When the loss function value tends to be stable during multiple iterations and the change in the loss function value is extremely small or no longer decreases significantly, it means that the accuracy of the model during the training process tends to be stable, and therefore the conditions for entering the model performance evaluation stage are met.

[0228] In one embodiment, whether the model enters the model performance evaluation stage is determined based on a preset maximum number of iterations.

[0229] Specifically, the second judgment condition is that if the number of model iterations reaches a preset maximum number of iterations, the model performance evaluation phase is entered.

[0230] In order to prevent the model from overfitting, an upper limit on the number of iterations is generally set. When the number of model iterations reaches the maximum number of iterations, the model update stops and the model performance evaluation phase is directly entered.

[0231] When entering the model performance evaluation phase, the loss value and accuracy of the model are determined respectively.

[0232] Loss value and accuracy are two important indicators for measuring model performance. Loss value is used to reflect the gap between the model prediction results and the actual results; accuracy is used to measure the accuracy of the model's prediction of new data.

[0233] In one embodiment, during the model performance evaluation process, the data in the validation set or the test set is predicted to obtain a prediction result. The prediction error of the model, i.e., the loss value, is then calculated through a loss function based on the prediction result and the preset true value. The prediction result is the output result of the model, and the preset true value is the label value.

[0234] In this embodiment, the size of the loss value is used as an evaluation criterion for the degree of model convergence. The smaller the loss value of the model, the higher the accuracy of the model prediction. If the loss value continues to decrease and tends to be stable, it means that the model has a good fitting effect on the current data.

[0235] In one embodiment, during the model performance evaluation process, the data in the validation set or the test set is predicted to obtain a prediction result, and then the classification accuracy of the model is calculated by comparing the classification result predicted by the model with the label value.

[0236] Among them, the classification result of the comparison model is the proportion of correct prediction results in the total number of prediction results. The higher the accuracy of the model, the stronger the model's prediction ability for the data, that is, the model has better generalization ability.

[0237] In the embodiment of the present invention, by calculating the loss value and accuracy, the model performance can be comprehensively evaluated. This not only ensures the effectiveness of the model on the training data, but also ensures that the model can process a new data set. Evaluating the model performance can help the model balance the relationship between privacy protection and model accuracy, and avoid the privacy budget value being too small, resulting in a decrease in model accuracy.

[0238] In one embodiment, during the model performance evaluation process, the privacy budget value ε and the noise scale b are dynamically adjusted to optimize the model performance.

[0239] Specifically, if the loss value is higher than the first preset threshold or the accuracy is lower than the first preset accuracy, the privacy budget value ε is increased to optimize the model performance. The specific value ranges of the first preset threshold and the first preset accuracy can be set according to the needs of those skilled in the art, and this embodiment does not impose specific restrictions.

[0240] According to the noise mechanism in local differential privacy, the size of the noise is related to the sensitivity of the data set and the privacy budget value ε. When the loss value is higher than the first preset threshold or the accuracy is lower than the first preset accuracy, it may be caused by too much noise added to the model. At this time, the noise scale b is adjusted by reducing the amount of noise (i.e., increasing the privacy budget value ε). According to Formula 1, since the noise scale b is determined by the privacy budget value ε, when the privacy budget value ε is increased, the noise scale b can be reduced, thereby reducing the amount of noise.

[0241] However, the increase in the privacy budget value ε cannot be too large, which will result in the model's ability to protect data privacy being too low. Therefore, the privacy budget value ε needs to be appropriately increased to avoid the risk of privacy leakage.

[0242] In the embodiment of the present invention, a dynamic adjustment mechanism is adopted to adjust the privacy budget value and the noise scale in real time according to the model performance and privacy requirements, thereby ensuring that the model has high model performance while protecting data privacy.

[0243] In one embodiment, during the model performance evaluation process, if the loss value of the model reaches the second preset threshold or the accuracy of the validation set reaches the second preset accuracy, the model training is stopped (i.e., the model training is completed). If the model does not reach the second preset threshold or the accuracy of the validation set does not reach the second preset accuracy, iterative training continues until the preset convergence condition or the maximum number of iterations is reached. Among them, the first preset threshold is greater than the second preset threshold, and the first preset accuracy is lower than the second preset accuracy; the specific value range of the second preset threshold and the second preset accuracy can be set according to the needs of those skilled in the art, and this embodiment does not impose specific restrictions.

[0244] In the embodiment of the present invention, the local differential privacy technology is adopted to effectively ensure the security of user data privacy protection by adding Laplace noise to the input data before uploading the data to the system, thereby avoiding the leakage of sensitive information of user data, ensuring that attackers cannot directly obtain the user's real data, and thus improving the strength of privacy protection. In the model training process, the noisy gradient algorithm is further adopted to strengthen the privacy protection of training data without affecting the model performance, so as to prevent attackers from inferring the original data by observing the changes in the model training parameters during the model training process. By adopting a dual noise protection strategy, combining data noise with gradient noise, not only the security of user privacy during data transmission is guaranteed, but also the privacy protection of training data during model training is guaranteed, thereby improving the security of overall privacy protection.

[0245] The embodiment of the present invention also provides an AI model training data protection device based on local differential privacy, as described in the following embodiment. Since the principle of solving the problem by the device is similar to the AI ​​model training data protection method based on local differential privacy, the implementation of the device can refer to the implementation of the AI ​​model training data protection method based on local differential privacy, and the repeated parts will not be repeated.

[0246] Fig.10 FIG. 1 is a schematic diagram of the structure of an AI model training data protection device 1000 based on local differential privacy in an embodiment of the present invention. Fig.10 As shown, the data protection device includes a first noise scale determination module 1001, a first data noise addition module 1002, a first gradient noise addition module 1003 and a parameter determination module.

[0247] The first noise scale determination module 1001 is used to determine the noise scale through the Laplace differential privacy mechanism according to a preset privacy budget value and the acquired input data.

[0248] The first data noise adding module 1002 is used to generate Laplace noise according to the noise scale and add Laplace noise to the input data.

[0249] The first gradient noise adding module 1003 is used to determine the gradient of each data point in the input data after adding Laplace noise according to the preset initial model training parameters, and add Laplace noise to the gradient of each data point to obtain a noisy gradient value.

[0250] The parameter determination module 1004 is used to determine the prediction model training parameters according to the noise-added gradient value.

[0251] Another AI model training data protection device based on local differential privacy is also provided in the embodiment of the present invention, as described in the following embodiment. Since the principle of solving the problem by the device is similar to that of the AI ​​model training data protection method based on local differential privacy, the implementation of the device can refer to the implementation of the AI ​​model training data protection method based on local differential privacy, and the repeated parts will not be repeated.

[0252] like Fig.11 As shown, the AI ​​model training data protection device 110 based on local differential privacy includes a data acquisition module 111, a second noise scale determination module 112, a second data noise adding module 113, a second gradient noise adding module 114, a gradient aggregation module 115 and a parameter updating module 116.

[0253] The data acquisition module 111 is used to acquire initial input data.

[0254] The second noise scale determination module 112 is used to determine the noise scale through the Laplace differential privacy mechanism according to a preset privacy budget value and the initial input data.

[0255] The second data noise adding module 113 is used to generate Laplace noise according to the noise scale, and add the Laplace noise to the initial input data.

[0256] The second gradient noise adding module 114 is used to determine the gradient of each data point in the initial input data after adding Laplace noise according to the preset initial model training parameters, and add the Laplace noise to the gradient of each data point to obtain a noisy gradient value.

[0257] The gradient aggregation module 115 is used to aggregate the noisy gradient values ​​to obtain a noisy gradient.

[0258] The parameter updating module 116 is used to calculate the prediction model training parameters according to the noisy gradient, and iteratively execute the above steps using the prediction model training parameters and new input data to update the target model training parameters.

[0259] Fig.12 A schematic diagram of the physical structure of an electronic device 120 provided in an embodiment of the present invention is shown in FIG. Figure 7 As shown, the electronic device 120 includes a processor 121 , a memory 122 and a bus 123 .

[0260] The processor 121 and the memory 122 communicate with each other via the bus 123 .

[0261] The processor 121 is used to call the program instructions in the memory 122 to execute the methods provided by the above-mentioned method embodiments.

[0262] An embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned AI model training data protection method based on local differential privacy.

[0263] An embodiment of the present invention also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned AI model training data protection method based on local differential privacy.

[0264] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0265] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0266] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0267] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0268] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for protecting AI model training data based on local differential privacy, characterized in that: include: Noise scale determination step: Determine the noise scale through the Laplace differential privacy mechanism based on the preset privacy budget value and the acquired input data; Data noise adding step: generating Laplace noise according to the noise scale, and adding the Laplace noise to the input data; Gradient noise adding step: determining the gradient of each data point in the input data after adding Laplace noise according to the preset initial model training parameters, and adding the Laplace noise to the gradient of each data point to obtain a noisy gradient value; Parameter determination step: determining the prediction model training parameters according to the noise-added gradient value.

2. The method according to claim 1, characterized in that The prediction model training parameters and new input data are used to iteratively perform the noise scale determination step, the data noise addition step, the gradient noise addition step and the parameter determination step to update the prediction model training parameters.

3. The method according to claim 2, characterized in that The determining the noise scale through the Laplace differential privacy mechanism according to the preset privacy budget value and the input data includes: Calculating the sensitivity of the input data; The noise scale is determined according to the sensitivity and the privacy budget value through a Laplace differential privacy mechanism.

4. The method according to claim 3, characterized in that The step of generating Laplace noise according to the noise scale and adding the Laplace noise to the input data comprises: generating a noise value according to the noise scale by a noise probability density function; The noise value is added to each data point in the input data by using a first encryption algorithm to obtain an encrypted data value of each data point.

5. The method according to claim 4, characterized in that The step of determining the gradient of each data point in the input data after adding Laplace noise according to the preset initial model training parameters, and adding the Laplace noise to the gradient of each data point to obtain a noisy gradient value comprises: A loss function is established based on the preset model training parameters, each data point in the input data after adding Laplace noise, and the label value corresponding to each data point; Calculate the partial derivative of the loss function with respect to the model parameters to obtain the gradient of each data point; A noise value is added to the gradient using a second data encryption algorithm to obtain a noisy gradient value for each data point.

6. The method according to claim 5, characterized in that Determining the prediction model training parameters according to the noise-added gradient value includes: Aggregating the noise-added gradient values ​​to obtain a noise-added gradient; The prediction model training parameters are calculated according to the noisy gradient.

7. A method for protecting AI model training data based on local differential privacy, characterized in that: include: Get initial input data; Determining a noise scale through a Laplace differential privacy mechanism according to a preset privacy budget value and the initial input data; generating Laplace noise according to the noise scale, and adding the Laplace noise to the initial input data; Determine the gradient of each data point in the initial input data after adding Laplace noise according to the preset initial model training parameters, and add the Laplace noise to the gradient of each data point to obtain a noisy gradient value; Aggregating the noise-added gradient values ​​to obtain a noise-added gradient; The prediction model training parameters are calculated according to the noisy gradient, and the above steps are iteratively performed using the prediction model training parameters and new input data to update the target model training parameters.

8. The method according to claim 7, characterized in that The determining the noise scale through the Laplace differential privacy mechanism according to the preset privacy budget value and the initial input data includes: Calculating the sensitivity of the initial input data; The noise scale is determined according to the sensitivity and the privacy budget value through a Laplace differential privacy mechanism.

9. The method according to claim 8, characterized in that The step of generating Laplace noise according to the noise scale and adding the Laplace noise to the initial input data comprises: generating a noise value according to the noise scale by a noise probability density function; The noise value is added to each data point in the initial input data by using a first encryption algorithm to obtain an encrypted data value of each data point.

10. The method according to claim 9, characterized in that The step of determining the gradient of each data point in the initial input data after adding the Laplace noise according to the preset initial model training parameters, and adding the Laplace noise to the gradient of each data point to obtain the noisy gradient value comprises: A loss function is established based on the preset model training parameters, each data point in the initial input data after adding Laplace noise, and the label value corresponding to each data point; Calculate the partial derivative of the loss function with respect to the model parameters to obtain the gradient of each data point; A noise value is added to the gradient using a second data encryption algorithm to obtain a noisy gradient value for each data point.

11. An AI model training data protection device based on local differential privacy, characterized in that: include: A first noise scale determination module, configured to determine a noise scale through a Laplace differential privacy mechanism according to a preset privacy budget value and the acquired input data; A first data noise adding module, configured to generate Laplace noise according to the noise scale, and add the Laplace noise to the input data; A first gradient noise adding module, used for determining the gradient of each data point in the input data after adding Laplace noise according to a preset initial model training parameter, and adding the Laplace noise to the gradient of each data point to obtain a noisy gradient value; A parameter determination module is used to determine the prediction model training parameters according to the noise-added gradient value.

12. An AI model training data protection device based on local differential privacy, characterized in that: include: A data acquisition module, used to acquire initial input data; A second noise scale determination module, configured to determine the noise scale through a Laplace differential privacy mechanism according to a preset privacy budget value and the initial input data; A second data noise adding module, configured to generate Laplace noise according to the noise scale, and add the Laplace noise to the initial input data; A second gradient noise adding module is used to determine the gradient of each data point in the initial input data after adding Laplace noise according to the preset initial model training parameters, and add the Laplace noise to the gradient of each data point to obtain a noisy gradient value; A gradient aggregation module, used for aggregating the noisy gradient values ​​to obtain a noisy gradient; The parameter updating module is used to calculate the prediction model training parameters according to the noisy gradient, iteratively execute the above steps using the prediction model training parameters and new input data, and update the target model training parameters.

13. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 10 is implemented.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

15. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images