Fine tuning system of large-scale pre-training model in federated learning environment and application thereof

Abstract

The invention discloses a fine tuning system of a large-scale pre-training model in a federated learning environment and application thereof. The system comprises a local disturbance gradient estimation module, a differential privacy protection module and a global model aggregation and update module. The local disturbance gradient estimation module is used for calculating a global model loss value by combining forward propagation with a zero-order optimization method so as to estimate a gradient and realize all-parameter fine tuning; the differential privacy protection module performs differential privacy protection processing on the estimated disturbance gradient to prevent gradient information from leaking user sensitive data; and the global model aggregation and update module reconstructs a disturbance vector and completes global model update based on a random seed and a scalar gradient uploaded by a client. Compared with the prior art, on the premise of not depending on back propagation, all-parameter fine tuning of a large-scale pre-training model is achieved, data privacy is guaranteed, meanwhile, calculation and memory expenses are remarkably reduced, and the method is suitable for a resource-limited distributed calculation environment.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning, and more specifically, to a fine-tuning system and its application of a large-scale pre-trained model in a federated learning environment. Background Art

[0002] Large-scale pre-trained models have become one of the core technologies in modern artificial intelligence systems (such as in the fields of natural language processing, computer vision, speech recognition, etc.). LPMs trained with large-scale data usually can exhibit excellent performance on a variety of downstream tasks. However, for specific tasks, LPMs usually require further fine-tuning to improve the domain-specific adaptability and accuracy of the model.

[0003] In practical applications, data is often distributed across multiple devices or clients (such as smart terminals, edge devices), involving a large amount of privacy-sensitive data of users. To protect user privacy and improve data utilization efficiency, federated learning has become an ideal solution, which allows each client to train the model locally and only share model update information. Federated learning is a distributed machine learning technology aimed at training a global model through the collaboration of multiple participants while keeping the data local, thus solving the problems of data privacy and "data silos". Its core advantage lies in completing model updates through local training and parameter aggregation without the need to centralize data on a central server. However, traditional federated fine-tuning methods are mainly based on first-order optimization (First-Order Optimization, FO), which requires calculating gradients through backpropagation, resulting in the following key problems being prone to occur during the fine-tuning of LPMs: communication efficiency, privacy protection, adaptability of resource-constrained devices, etc.

[0004] In federated learning, data privacy protection is one of the key issues. Differential privacy technology prevents attackers from inferring user data from model updates by adding noise during the model training process. For example, the differential privacy stochastic gradient descent algorithm achieves a balance between privacy protection and model performance by adding Gaussian noise during the gradient aggregation process. In addition, differential privacy technology has also been widely applied in federated learning to resist membership inference attacks and model extraction attacks.

[0005] Zero-order optimization is an optimization method that only relies on forward propagation. It estimates gradients by perturbing model parameters and calculating the change in loss, thus avoiding the high computational and memory overhead required by traditional backpropagation. This method is particularly suitable for resource-constrained devices, such as edge devices and Internet of Things terminals. In federated learning, zero-order optimization can significantly reduce the computational burden on clients while maintaining the model update efficiency.

[0006] The communication overhead in federated learning is an important factor affecting efficiency. Existing research has optimized communication efficiency in various ways, such as introducing random seeds and scalar gradient upload mechanisms, or adopting asynchronous federated learning architectures. These methods have significantly reduced the communication cost by reducing the amount of data uploaded or optimizing the communication process. In addition, some research has also combined reinforcement learning and clustering optimization strategies to further improve communication efficiency.

[0007] The security of federated learning not only involves data privacy protection, but also includes preventing malicious attacks and ensuring the correctness of model aggregation. For example, blockchain technology has been introduced into federated learning for auditing model updates and preventing single points of failure in servers. In addition, some research has also proposed techniques combining homomorphic encryption and secure multi-party computation to enhance the security of federated learning.

[0008] Therefore, in combination with the above requirements and the deficiencies of the existing technology, the present invention proposes a fine-tuning system and its application of large-scale pre-trained models in a federated learning environment. Summary of the Invention

[0009] The present invention provides a fine-tuning system and its application of large-scale pre-trained models in a federated learning environment. By combining Zeroth-Order Optimization (ZOO) and Differential Privacy (DP), it realizes full-parameter fine-tuning of LPMs without relying on backpropagation. While ensuring data privacy, it significantly reduces computational and memory overhead, and can achieve efficient fine-tuning of large-scale pre-trained models while ensuring data privacy, meeting the comprehensive requirements of real-time performance, computational efficiency, and data security, and is applicable to resource-constrained distributed computing environments.

[0010] The primary objective of the present invention is to solve the above technical problems, and the technical solution of the present invention is as follows:

[0011] In the first aspect of the present invention, a fine-tuning system for a large-scale pre-trained model in a federated learning environment is provided. The federated learning environment consists of a central server and multiple client devices. The fine-tuning system includes a local perturbation gradient estimation module, a differential privacy protection module, and a global model aggregation and update module. The local perturbation gradient estimation module and the differential privacy protection module are set in the client devices, and the global model aggregation and update module is set in the central server. The local perturbation gradient estimation module calculates the global model loss value through forward propagation combined with a zero-order optimization method, thereby estimating the gradient and achieving full-parameter fine-tuning. The differential privacy protection module performs differential privacy protection processing on the estimated perturbed gradient to prevent the gradient information from leaking user-sensitive data. The global model aggregation and update module reconstructs the perturbation vector and completes the global model update based on the random seed and the scalar gradient uploaded by the client.

[0012] Further, the local perturbation gradient estimation module extracts and compresses features of local high-dimensional data to generate a low-dimensional feature representation, generates a random perturbation vector with the same dimension as the global model parameters based on a random seed, and performs positive and negative perturbations on the global model parameters, respectively performs forward propagation, calculates the loss value, and estimates the first scalar gradient according to the loss difference between the two forward propagations. The differential privacy protection module clips the estimated first scalar gradient, limits the norm of the gradient within a preset clipping threshold, adds Gaussian noise to the clipped scalar gradient to obtain a second scalar gradient, and uploads the random seed and the second scalar gradient to the central server. The global model aggregation and update module broadcasts the global model parameters and the generated random seed pool to all client devices, reconstructs the perturbation vector based on the random seed uploaded by the client, aggregates the gradients, and updates the global model.

[0013] In the second aspect of the present invention, a fine-tuning method for a large-scale pre-trained model in a federated learning environment is provided. This method is used for the fine-tuning system of the large-scale pre-trained model in the federated learning environment. This method includes the following steps:

[0014] S1. The central server initializes the global model and broadcasts the global model parameters and the generated random seed pool to all client devices.

[0015] S2. The client device extracts and compresses features of local high-dimensional data to generate a low-dimensional feature representation, selects a random seed s n,k from the random seed pool, and generates a random perturbation vector z n,k with the same dimension as the global model parameters based on this random seed.

[0016] S3. The client device performs positive and negative perturbations on the global model parameters using the random perturbation vector, conducts forward propagation respectively, calculates the loss value, and estimates the first scalar gradient based on the loss difference between the two forward propagations.

[0017] S4. The client device clips the estimated first scalar gradient, limits the norm of the gradient within a preset clipping threshold, adds Gaussian noise to the clipped scalar gradient to obtain the second scalar gradient, and uploads the random seed and the second scalar gradient to the central server.

[0018] S5. The central server reconstructs the random perturbation vector according to the received random seed, combines the second scalar gradient to recover the approximate gradient of the client device, aggregates the approximate gradients of all client devices, updates the global model parameters, and broadcasts the updated global model parameters to all clients again.

[0019] Further, in the step S1, initializing the global model w k The parameters include: the global model parameter w ∈ R d and hyperparameters, where the hyperparameters include: learning rate η, number of iterations T, total number of clients N, client sampling rate m, standard deviation σ, clipping threshold C, and perturbation amplitude β.

[0020] The step S2 includes the following specific steps: The client device uses the feature encoder to perform feature extraction and compression on the local high-dimensional data to generate the low-dimensional feature representation D n of each client, samples batch data B n according to the client sampling rate m, selects a random seed s n,k from the random seed pool, generates a random perturbation vector z with the same dimension as the global model parameters n,k sets the differential privacy constraint (∈, δ), and calculates the standard deviation σ of the Gaussian noise intensity according to the differential privacy constraint.

[0021] Further, in the step S3, the specific process of the client device performing positive and negative perturbations on the global model parameters using the random perturbation vector, conducting forward propagation respectively, and calculating the loss value is as follows:

[0022]

[0023] Among them, and represent positive and negative perturbations, and represent the loss values of the global model on the local dataset after the two forward propagations corresponding to the positive and negative perturbations; the first scalar gradient represents the loss change trend along the perturbation direction, specifically, it is the loss value on the local dataset after forward propagation using positive and negative perturbations and Calculate the first scalar gradient, which is calculated as follows:

[0024]

[0025] where β represents the perturbation amplitude, and the perturbation amplitude β of the two forward propagations is dynamically adjusted according to the model parameter dimension, the client computing power, and the data distribution.

[0026] Further, in the step S4, the process of clipping the first scalar gradient, restricting the norm of the gradient within a preset clipping threshold, and adding Gaussian noise to the clipped scalar gradient to obtain the second scalar gradient is as follows:

[0027]

[0028] where C represents the clipping threshold, and the clipping threshold C is adaptively adjusted according to the sensitivity of the local data; σ represents the standard deviation of the Gaussian noise, and N(0,σ 2 C 2 I d ) represents the added Gaussian noise, and the standard deviation satisfies the differential privacy constraint (∈,δ), specifically:

[0029] ∈ < c1q 2 T

[0030]

[0031] where q = |B n | / |D n | represents the sampling probability, |B n | represents the batch size of the nth client, and c1 and c2 are both constants. When c1 > 0 and c2 > 0, it means that the optimization process satisfies the differential privacy constraint (∈,δ).

[0032] Further, in the step S5, the process of the central server reconstructing the random perturbation vector according to the received random seed and combining the second scalar gradient to recover the approximate gradient of the client device is as follows:

[0033]

[0034]

[0035] The calculation process of updating the global model parameters using the zero-order optimizer is as follows:

[0036]

[0037] where η represents the model learning rate, Denote the vector gradient obtained by multiplying the scalar gradients and the perturbation vectors returned to each client at the k-th training round for global model update, G k Denote the overall vector gradient results returned by each client at the k-th round for global model update, z n,k Denote the random perturbation vector generated from the received random seed, w n,k Denote the updated global model parameters.

[0038] The specific process of aggregating the approximate gradients of all client devices is as follows:

[0039]

[0040] The above formula means storing the random seed and the second scalar gradient in a dictionary, where The updated global model parameters are broadcast to all client devices again to complete one training round of the global model.

[0041] Furthermore, after the step S5, the central server verifies the privacy-aware defense effect of the global model in real time, dynamically adjusts the Gaussian noise intensity according to the privacy leakage risk, records the privacy budget loss, model accuracy change, and privacy leakage risk before each broadcast of the global model parameters, generates a defense effectiveness report, and performs a feedback operation according to the defense effectiveness report; including the following specific steps: The central server dynamically adjusts the differential privacy constraints (∈, δ) and the noise intensity σ according to the global model convergence state of each training round and the privacy requirements feedback by the clients. The adjustment method of the noise intensity σ is:

[0042]

[0043] Among them, a low level of ∈ value is set at the initial stage of the training round to ensure privacy protection. As the training round increases, the ∈ value is gradually increased according to the global model convergence state to improve the global model accuracy; record the privacy budget loss, model accuracy change, and privacy leakage risk before each broadcast of the global model parameters, generate a defense effectiveness report. If the model accuracy change exceeds the preset threshold, adjust the noise intensity. If the privacy leakage risk rises, suspend the training or switch to an alternative encrypted channel.

[0044] Further, before uploading the second scalar gradient, the client device also adds uniform noise with an amplitude of σ / (N*m) to the second scalar gradient. The central server uses a generative adversarial network to simulate gradient inversion attacks and quantifies the gradient leakage risk. The specific process of the adversarial network simulating gradient inversion attacks is as follows: The central server simulates an attacker attempting to reverse-engineer the local data of the client device through aggregated gradients. If the attack success rate exceeds a preset threshold, the noise intensity is increased by a preset multiple, or the ∈ value is decreased to protect client privacy, and the privacy budget consumption, i.e., the cumulative value of the ∈ value, after each round of training is recorded.

[0045] The third aspect of the present invention also provides an application of a large-scale pre-trained model in scenarios with strict requirements for computational efficiency and data privacy. The large-scale pre-trained model is obtained by the fine-tuning method of the large-scale pre-trained model in a federated learning environment. The applications include intelligent transportation and urban management systems that emphasize both real-time data processing and privacy protection, secure collaborative intelligent manufacturing industrial Internet of Things under large-scale distributed devices, distributed intelligent medical device data analysis in medical Internet of Things that requires strong privacy protection, or real-time environmental perception and decision-making in the process of autonomous driving with multi-terminal collaboration.

[0046] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0047] The present invention provides a fine-tuning system and its application of a large-scale pre-trained model in a federated learning environment. Through the combined action of gradient clipping and Gaussian noise injection, differential privacy protection is achieved locally on the client side. At the same time, the client generates a perturbation vector based on a random seed, so that even if an attacker intercepts the gradient information, the original data cannot be restored through reverse engineering. By the collaborative optimization of privacy protection and computational efficiency, the triangular contradiction of privacy-utility-efficiency in federated learning is solved. On the premise of ensuring data security, the model performance and system scalability are significantly improved, providing a reliable technical foundation for large-scale collaborative learning across organizations and devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a schematic diagram of a fine-tuning system of a large-scale pre-trained model in a federated learning environment according to the present invention.

[0049] Figure 2 It is a schematic diagram of a system scenario in an embodiment of the present invention.

[0050] Figure 3 It is a flowchart of fine-tuning the global model parameters of federated learning in an embodiment of the present invention.

[0051] Figure 4 It is a flowchart of a fine-tuning method of a large-scale pre-trained model in a federated learning environment according to the present invention.

[0052] Figure 5 In an embodiment of the present invention, it is the training loss change curve of the global model on the training data under different privacy budget values.

[0053] Figure 6 In an embodiment of the present invention, it is the training loss change curve of the global model on the training data under different gradient clipping threshold values.

[0054] Figure 7 In an embodiment of the present invention, it is the loss value of the global model on the test data under different combinations of privacy budget and clipping threshold values.

[0055] Figure 8 In an embodiment of the present invention, it is the accuracy of the global model on the test data under different combinations of privacy budget and clipping threshold values. Detailed implementation manners

[0056] In order to more clearly understand the above objects, features and advantages of the present invention, the present invention will be further described in detail below in conjunction with the drawings and specific implementation manners. It should be noted that, without conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0057] Many specific details are set forth in the following description in order to fully understand the present invention. However, the present invention may be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited by the specific embodiments disclosed below.

[0058] Embodiment 1

[0059] As Figure 1 shown, the present invention provides a fine-tuning system for a large-scale pre-trained model in a federated learning environment. The federated learning environment consists of a central server and multiple client devices. The fine-tuning system includes: a local perturbed gradient estimation module, a differential privacy protection module, and a global model aggregation and update module. The local perturbed gradient estimation module and the differential privacy protection module are set on the client devices, and the global model aggregation and update module is set on the central server. The local perturbed gradient estimation module calculates the global model loss value through forward propagation combined with a zero-order optimization method, thereby estimating the gradient to achieve full-parameter fine-tuning. The differential privacy protection module performs differential privacy protection processing on the estimated perturbed gradient to prevent the gradient information from leaking user sensitive data. The global model aggregation and update module reconstructs the perturbed vector and completes the global model update based on the random seed and scalar gradient uploaded by the client.

[0060] The local perturbation gradient estimation module extracts and compresses features from local high-dimensional data to generate a low-dimensional feature representation, generates a random perturbation vector with the same dimension as the global model parameters based on a random seed, and performs positive and negative perturbations on the global model parameters, respectively performs forward propagation, calculates the loss value, and estimates the first scalar gradient according to the loss difference between the two forward propagations; the differential privacy protection module clips the estimated first scalar gradient, limits the norm of the gradient within a preset clipping threshold, and adds Gaussian noise to the clipped scalar gradient to obtain a second scalar gradient, and uploads the random seed and the second scalar gradient to the central server; the global model aggregation and update module broadcasts the global model parameters and the generated random seed pool to all client devices, reconstructs the perturbation vector based on the random seed uploaded by the client, aggregates the gradients and updates the global model.

[0061] In this embodiment, to achieve the unification of efficient fine-tuning and strong privacy protection, the present invention innovatively combines zero-order optimization and differential privacy technologies for the fine-tuning requirements of LPMs in the federated environment, reduces the computational and communication overheads, and at the same time ensures the privacy and security of user data. As Figure 2 and Figure 3 shown, the present invention realizes efficient full-parameter fine-tuning through a distributed client-server architecture while keeping the data local. The fine-tuning process mainly includes steps such as model broadcasting, local training, privacy protection, gradient uploading, model aggregation and update.

[0062] Step 1: Global model initialization and broadcasting

[0063] First, the central server initializes the global model parameters w k . Broadcasts the global model to all clients {1, 2,..., N}.

[0064] Step 2: Local gradient estimation

[0065] The client first generates a random perturbation vector z n,k with the same dimension as the model parameters based on the local random seed s n,k , where the use of the random seed ensures the reproducibility of the perturbation vector. The client only needs to upload the random seed and the corresponding scalar gradient to the server, significantly reducing the communication overhead.

[0066] Then the client performs positive and negative perturbations on the global model parameters w k and respectively performs two forward propagations to calculate the losses of the model on the local dataset and where the perturbation amplitude is used to control the perturbation intensity. Using the loss values and obtained from the positive and negative perturbations, the client calculates the first scalar gradient The scalar gradient only contains a single numerical value, representing the loss change trend along the perturbation direction. Compared with the traditional high-dimensional gradient vector, the scalar gradient has a small amount of data, which can greatly reduce the communication burden of interacting with the server. Multiply the first scalar gradient by the random perturbation vector to obtain the vector gradient of the nth client at the kth training This vector gradient is used to update the client's local model, where n ∈ {1, 2,..., N}.

[0067] Step 3: Differential privacy protection

[0068] Calculate the noise intensity: The differential privacy constraint (∈, δ) can be achieved through the moment estimation mechanism. Specifically, when the value of the standard deviation σ of the Gaussian noise satisfies the optimization process satisfies the differential privacy constraint (∈, δ). After calculating the noise magnitude, it is necessary to perform gradient clipping and Gaussian noise injection on the estimated gradient in real time.

[0069] Step 4: Gradient upload and aggregation

[0070] In this step, the client does not need to upload the complete vector gradient, but only uploads the random seed s n,k [t] and the second scalar gradient to the central server. The central server reconstructs the perturbation vector through the received random seed and uses the scalar gradient to recover the approximate gradient of the client, thereby updating the global model.

[0071] Step 5: Global model update

[0072] The central server updates the global model parameters based on the aggregated gradient G k in the kth round of training. The updated model is broadcast to each client again and enters the next training round.

[0073] It should be noted that a privacy-aware defense system based on federated learning proposed by the present invention aims to efficiently fine-tune large-scale pre-trained models (LPMs) under the premise of privacy protection. The present invention utilizes a zero-order optimization strategy, relying only on forward propagation to estimate model gradients, avoiding the high memory and computational costs brought by traditional backpropagation. This design enables resource-constrained devices to participate in model training efficiently. At the same time, in order to further enhance data privacy protection, the method introduces a differential privacy mechanism before uploading the local gradient to the server. By adding noise to the gradient, it effectively prevents potential gradient leakage and data reconstruction attacks. In addition, to address the communication and storage bottlenecks in a distributed environment, the method introduces a global seed-gradient dictionary. By sharing random seeds instead of directly transmitting the complete gradient information, it significantly reduces the communication overhead and the memory burden of the client. Overall, this method significantly improves the computational and communication efficiency while ensuring data privacy and model performance, providing an efficient and secure solution for fine-tuning large pre-trained models in privacy-sensitive and resource-constrained scenarios.

[0074] Embodiment 2

[0075] Based on the above Embodiment 1, as Figure 4 shown, the present invention provides a method for fine-tuning a large-scale pre-trained model in a federated learning environment. This method is used for the fine-tuning system of the large-scale pre-trained model described in Embodiment 1. This method includes the following steps:

[0076] S1. The central server initializes the global model and broadcasts the global model parameters and the generated random seed pool to all client devices.

[0077] S2. The client device extracts and compresses the local high-dimensional data to generate a low-dimensional feature representation, selects a random seed s n,k from the random seed pool, and generates a random perturbation vector z n,k with the same dimension as the global model parameters based on this random seed.

[0078] S3. The client device uses the random perturbation vector to perform positive and negative perturbations on the global model parameters, respectively performs forward propagation, calculates the loss value, and estimates the first scalar gradient according to the loss difference between the two forward propagations.

[0079] S4. The client device clips the estimated first scalar gradient, limits the norm of the gradient within a preset clipping threshold, adds Gaussian noise to the clipped scalar gradient to obtain the second scalar gradient, and uploads the random seed and the second scalar gradient to the central server.

[0080] S5. The central server reconstructs the random perturbation vector based on the received random seed, combines it with the second scalar gradient to recover the approximate gradient of the client device, aggregates the approximate gradients of all client devices, updates the global model parameters, and broadcasts the updated global model parameters to all clients again.

[0081] In step S1, the global model w is initialized. k The parameters include: the global model parameter w ∈ R d and hyperparameters, where the hyperparameters include: learning rate η, number of iterations T, total number of clients N, client sampling rate m, standard deviation σ, clipping threshold C, and perturbation amplitude β.

[0082] Step S2 includes the following specific steps: The client device uses the feature encoder to extract and compress the local high-dimensional data to generate the low-dimensional feature representation D n of each client, samples the batch data B according to the client sampling rate m n , selects a random seed s from the random seed pool n,k , generates a random perturbation vector z with the same dimension as the global model parameter n,k , presets the differential privacy constraint (∈, δ), and calculates the standard deviation σ of the Gaussian noise intensity according to the differential privacy constraint.

[0083] In step S3, the client device performs positive and negative perturbations on the global model parameters using the random perturbation vector, and the specific process of forward propagation and calculating the loss value is as follows:

[0084]

[0085] Among them, and represent positive and negative perturbations, and represent the loss values of the global model on the local dataset after two forward propagations corresponding to positive and negative perturbations; the first scalar gradient represents the loss change trend along the perturbation direction, specifically, it is the loss values on the local dataset after forward propagation using positive and negative perturbations and Calculate the first scalar gradient, and its calculation method is:

[0086]

[0087] where β represents the perturbation amplitude, and the perturbation amplitude β of the two forward propagations is dynamically adjusted according to the model parameter dimension, client computing power, and data distribution.

[0088] In the step S4, the specific process of clipping the first scalar gradient, restricting the norm of the gradient within a preset clipping threshold, and adding Gaussian noise to the clipped scalar gradient to obtain the second scalar gradient is as follows:

[0089]

[0090] Among them, C represents the clipping threshold, and the clipping threshold C is adaptively adjusted according to the sensitivity of the local data; σ represents the standard deviation of the Gaussian noise, and N(0,σ 2 C 2 I d ) represents the added Gaussian noise, and the standard deviation satisfies the differential privacy constraint (∈,δ), specifically:

[0091] ∈ < c1q 2 T

[0092]

[0093] Among them, q = |B n | / |D n | represents the sampling probability, |B n | represents the batch size of the nth client, and both c1 and c2 are constants. When c1 > 0 and c2 > 0, it means that the optimization process satisfies the differential privacy constraint (∈,δ).

[0094] In the step S5, the specific process of the central server reconstructing the random perturbation vector according to the received random seed and restoring the approximate gradient of the client device in combination with the second scalar gradient is as follows:

[0095]

[0096] The calculation process of updating the global model parameters using the zero-order optimizer is as follows:

[0097]

[0098] Among them, η represents the model learning rate, represents the vector gradient obtained by multiplying the scalar gradient and the perturbation vector returned by each client at the kth training round for global model update, G k represents the overall result of the vector gradients returned by each client in the kth round for global model update, z n,k represents the random perturbation vector generated from the received random seed, w n,k represents the updated global model parameters.

[0099] The specific process of aggregating the approximate gradients of all client devices is as follows:

[0100]

[0101] The above formula represents storing the random seed and the second scalar gradient in a dictionary, where The updated global model parameters are broadcast to all client devices again to complete one training round of the global model.

[0102] After the step S5, the central server verifies the privacy-aware defense effect of the global model in real time, dynamically adjusts the Gaussian noise intensity according to the privacy leakage risk, records the privacy budget loss, model accuracy change and privacy leakage risk before each broadcast of the global model parameters, generates a defense effectiveness report, and performs a feedback operation according to the defense effectiveness report; the specific steps include: The central server dynamically adjusts the differential privacy constraints (∈, δ) and the noise intensity σ according to the convergence state of the global model in each training round and the privacy requirements feedback by the clients. The adjustment method of the noise intensity σ is:

[0103]

[0104] Among them, a low level of ∈ value is set at the initial stage of the training round to ensure privacy protection. As the training round increases, the ∈ value is gradually increased according to the convergence state of the global model to improve the accuracy of the global model; record the privacy budget loss, model accuracy change and privacy leakage risk before each broadcast of the global model parameters, generate a defense effectiveness report. If the model accuracy change exceeds the preset threshold, adjust the noise intensity. If the privacy leakage risk rises, suspend the training or switch to an alternative encrypted channel.

[0105] Before uploading the second scalar gradient, the client device also adds uniform noise with an amplitude of σ / (N*m) to the second scalar gradient. The central server uses a generative adversarial network to simulate a gradient inversion attack and quantifies the gradient leakage risk; the specific process of the adversarial network simulating the gradient inversion attack is: The central server simulates an attacker trying to reverse engineer the local data of the client device through the aggregated gradient. If the attack success rate exceeds the preset threshold, increase the noise intensity by a preset multiple, or reduce the ∈ value to protect the privacy of the client, and record the privacy budget consumption, that is, the cumulative value of the ∈ value, after each round of training.

[0106] In a specific embodiment, to verify the effectiveness of the method of the present invention, a comprehensive experimental evaluation was carried out in a strictly controlled experimental environment. The following are the experimental environment and settings.

[0107] Hardware environment

[0108] · GPU: NVIDIA RTX 4090

[0109] · Server: Single-machine deployment, simulating the interaction between the server side and the client side in the federated learning scenario

[0110] Software environment

[0111] · Deep learning framework: PyTorch

[0112] · Experimental benchmark settings: The experiments adopt the same experimental settings as previous studies to ensure the comparability and fairness of the experimental results.

[0113] Datasets and models

[0114] · Datasets: In this embodiment, the SST-2 (Stanford Sentiment Treebank 2) dataset is used to verify the method. SST-2 is a standard dataset widely used for text sentiment classification, aiming to analyze the sentiment tendency of text. The dataset is divided into a training set, a validation set, and a test set for model training, tuning, and performance evaluation. Each text data is labeled as a positive or negative sentiment category for training the model to accurately distinguish different sentiment tendencies.

[0115] · Models: In this embodiment, RoBERTa-large is used as the pre-trained model. The model has 355 million parameters and the model size is approximately 1.3GB.

[0116] Evaluation metrics

[0117] · Model accuracy: Used to measure the performance of the classification model.

[0118] · VRAM consumption: Evaluates the GPU memory requirements of different methods.

[0119] · Training time per round: Used to compare training efficiency.

[0120] Parameter settings

[0121] The experimental parameters are shown in Table 1. A total of 200 clients are simulated in this experiment and participate in model fine-tuning distributively. 5% of the clients (i.e., 10 clients) are randomly selected to participate in training in each round, simulating the situation where some devices are online in the actual FL scenario.

[0122] Parameter Value Total number of clients 200 Proportion of clients selected for each round of training 0.05 Batch size 64 Privacy budget 2，6，10 Cropping threshold 1，10，50，100 Learning rate 1e-6

[0123] Table 1 Parameter settings

[0124] The learning rate is set to be small to ensure the stability and convergence of model training. The batch data size used by each client during local training is 64. The size of the random seed pool for generating random perturbation vectors is 4096. In terms of differential privacy, the privacy budget takes values of 2, 6, and 10 to balance privacy protection and model performance. The privacy leakage tolerance is set to 1e-5 for the probability constraint of differential privacy. The gradient clipping threshold takes values of 1, 10, 50, and 100 to limit the gradient magnitude and prevent excessive gradients from leaking privacy.

[0125] Comparison methods

[0126] To comprehensively evaluate the performance of the method of the present invention, the following comparison methods are set in the experiment:

[0127] a). MeZO:

[0128] · A classical centralized zero-order optimization method that estimates gradients based on forward propagation.

[0129] · Its main advantage is reducing the computational complexity, but it has large communication and memory overheads, does not consider gradient privacy protection, and is not suitable for distributed environments.

[0130] b). Adam(LoRA):

[0131] · LoRA is a parameter-efficient fine-tuning method that only updates some low-rank parameters to reduce memory requirements.

[0132] · It uses the Adam optimizer for training.

[0133] · Although it reduces the amount of parameter updates, due to the need for backpropagation, the memory consumption is still high, and the performance is generally not as good as full-parameter fine-tuning.

[0134] c). The method of the present invention:

[0135] · Only uses forward propagation at the client to estimate gradients.

[0136] · Introduces a differential privacy mechanism to protect gradient privacy.

[0137] · Utilizes the global seed-gradient dictionary to reduce communication overhead.

[0138] Experimental results

[0139] This embodiment examines the influence of the privacy budget ε and the gradient clipping threshold C on the model convergence speed and performance. From Figure 5 - Figure 8 the experimental results, it can be seen that the smaller the privacy budget (e.g., ε = 2), the stronger the privacy protection, but more noise is added to the model, resulting in damaged gradient information, slower convergence speed, and decreased model accuracy.

[0140] When ε = 6, the model achieves a good balance between privacy protection and performance. The model can converge faster and maintain a high accuracy. In addition, the clipping threshold also affects the experiment. A smaller C (e.g., C = 1) will cause the gradient to be over-clipped and the model performance to decline. When C = 50, the noise and gradient clipping reach the best balance and the model performance is optimal.

[0141] In addition, this embodiment implements a federated learning version of the mainstream methods, such as the classic MeZO and Adam (LoRA) methods, and compares with them to evaluate the model performance, video memory consumption, and training efficiency. The results are shown in Table 2.

[0142] Video memory occupancy Time required for each round of training Accuracy of the evaluation set Accuracy of the test set MeZO 12000M 10.83s 0.921 0.920 Adam(LoRA) 5400M 10.31s 0.862 0.869 This method 3836M 11s 0.919 0.916

[0143] Table 2 Comparison with MeZO and Adam (Lora) in the FL environment

[0144] Under the same experimental settings, the video memory consumption of this method is the lowest, about 68% lower than MeZO and about 29% lower than Adam (LoRA), showing extremely high memory efficiency. In addition, although the differential privacy mechanism is introduced and additional noise addition operations need to be performed in each round of training, the single-round training time is comparable to that of MeZO and Adam (LoRA), showing good computational efficiency. In terms of model performance, the accuracy of this method is slightly lower than that of MeZO but much higher than that of Adam (LoRA). This result proves the balance between model performance and privacy protection.

[0145] According to the above content, the present invention solves the following key problems:

[0146] (1) Reduce computational and memory overhead

[0147] The present invention adopts a zero-order optimization strategy, completely abandons backpropagation, and only uses forward propagation for model fine-tuning. This method significantly reduces the computational complexity and GPU video memory occupancy, enabling resource-constrained devices such as edge devices or Internet of Things terminals to efficiently participate in the fine-tuning task of LPMs.

[0148] (2) Alleviate communication burden

[0149] The present invention proposes a random seed and scalar gradient upload mechanism. The client does not need to upload the complete gradient or model parameters. Only the random seed and scalar gradient need to be uploaded, and the server can reconstruct the perturbation vector for model update. This method effectively compresses the communication data volume, significantly reduces the communication overhead in multiple rounds of training, and improves the communication efficiency of federated learning.

[0150] (3) Enhance data privacy protection

[0151] In the process of model training, the present invention introduces a differential privacy mechanism to clip the estimated gradient information and inject Gaussian noise, effectively preventing the leakage of sensitive information. In addition, the client data always remains local, avoiding the upload of raw data, comprehensively protecting against data attacks, and providing strong data privacy protection.

[0152] (4) Improve real-time performance and training efficiency

[0153] By simplifying the model update process and reducing the model calculation complexity, the present invention effectively shortens the training cycle and the model update delay. Adopting local perturbation gradient estimation and an efficient parameter aggregation mechanism significantly improves the real-time response ability in a dynamic environment, meeting the requirements for low latency and real-time feedback.

[0154] (5) Improve adaptability to multi-clients and heterogeneous environments

[0155] The algorithm architecture designed by the present invention has good scalability for multi-client collaboration and can support heterogeneous computing environments of multiple users and multiple devices. In scenarios with significant differences in device performance such as edge computing, the Internet of Things, and mobile terminals, the algorithm can flexibly adapt to different computing capabilities, ensuring training stability and high performance.

[0156] It should be noted that the present invention uses only forward propagation and a differential privacy protection mechanism to solve the problems of high computational burden, large communication overhead, high privacy risk, and insufficient real-time performance in the fine-tuning process of existing LPMs in a federated environment, realizing an efficient, low-overhead, privacy-friendly, and multi-device collaboration-adaptive federated fine-tuning algorithm, providing strong technical support for large-scale distributed intelligent systems.

[0157] Embodiment 3

[0158] Based on the above Embodiment 1 and Embodiment 2, this embodiment details the third aspect of the present invention: the application of the described fine-tuning method in scenarios with strict requirements for computing efficiency and data privacy. The applications include intelligent transportation and urban management systems that emphasize both real-time data processing and privacy protection, secure collaborative intelligent manufacturing industrial Internet of Things under large-scale distributed devices, distributed intelligent medical device data analysis that requires strong privacy protection in the medical Internet of Things, or real-time environment perception and decision-making under multi-terminal collaboration during autonomous driving.

[0159] In a specific embodiment, when applying this method to the cross - enterprise customer review sentiment analysis scenario, different e - commerce platforms and enterprises have a large amount of product review data of users. These data are very important for building an accurate sentiment analysis model. However, due to user privacy protection and business competition considerations, these platforms usually do not share user review data. Applying the present invention can jointly fine - tune a large pre - trained text model across platforms without revealing user privacy for customer review sentiment classification (such as "positive" or "negative"), thereby improving the recommendation systems and user experiences of each platform. The detailed application process is as follows:

[0160] Each institution (such as banks, e - commerce platforms, hospitals) locally stores a large amount of user text data, and the data types include:

[0161] · Financial institutions: customer consultation records, service evaluation feedback.

[0162] · E - commerce platforms: user product reviews, after - sales feedback.

[0163] · Medical institutions: patient visit feedback.

[0164] First, perform data pre - processing. The ways of data pre - processing include:

[0165] · Text cleaning: Remove stop words, punctuation marks, and special characters.

[0166] · Word segmentation and encoding: Convert the text data into the model input format (such as word vectors or Token IDs).

[0167] · Label annotation: Label the text data with different emotion categories (such as positive / negative).

[0168] Train the model. The central server (such as an industry alliance or a third - party institution) initializes a pre - trained model and broadcasts the model parameters to each participating institution. Each institution performs local training in parallel. First, each institution maintains the same random seed pool for generating random perturbation vectors to reduce the communication burden. Use forward propagation to calculate the change of the loss function to estimate the gradient without backpropagation. Only two forward propagations are required, reducing the video memory occupancy. Clip the gradient and inject noise to prevent data leakage. Upload the random seeds and scalar gradient pairs to the server without transmitting the original data. The central server aggregates the random, scalar gradient dictionaries returned by each client, updates the global model, and distributes the updated global model to the clients for a new round of training.

[0169] This embodiment shows that in the cross-institutional text sentiment classification task, by using the method described in the present invention, efficient, secure, and superior-performance model fine-tuning can be achieved without sharing data. This method effectively solves the data silo problem and provides a secure and efficient solution for collaborative modeling of sensitive data in different fields.

[0170] In another specific embodiment, this embodiment elaborates in detail one of the application scenarios of the present invention in the medical field: data analysis of distributed intelligent medical devices that require strong privacy protection in the Internet of Medical Things.

[0171] In a specific embodiment, multiple hospitals jointly build a disease database, and the data includes privacy information such as patients' electronic medical records and living habits. To protect patients' privacy, cross-institutional data transmission needs to be avoided. Therefore, a privacy-aware defense method based on federated learning described in the present invention is applied to the distributed medical data analysis system, which can achieve efficient privacy protection and model optimization.

[0172] It should be noted that the current development of the medical and health field towards intelligence faces the following technical challenges:

[0173] Patients' physiological signals, medical images, and electronic health records (EHRs) involve privacy data and must be protected from leakage. Medical data is scattered in different hospitals and devices, making it difficult to unify and integrate for effective analysis. Medical devices usually have limited computing power, while the training and fine-tuning of deep learning models require a large amount of computing resources.

[0174] In this embodiment, it is first necessary to clarify the sources of privacy data in the medical and health field, specifically including:

[0175] Medical image data: such as magnetic resonance imaging (MRI), computed tomography (CT), X-ray films, and ultrasonic images, etc. These high-dimensional image data play a crucial role in disease diagnosis (such as tumor detection, fracture identification).

[0176] Physiological signal data: such as electrocardiogram (ECG), electroencephalogram (EEG), and blood oxygen level, etc. The body state of patients is collected in real time through sensors and is used for the monitoring and analysis of cardiovascular diseases and neurological diseases. Electronic health record (EHR) data: includes structured or unstructured text data such as patients' medical records, medical histories, prescribed medications, and laboratory test results, etc., and is commonly used for disease prediction and personalized medical treatment. The above-mentioned medical data is private, diverse, and distributed in different hospitals, which requires the algorithm to be able to efficiently process the above different types of data and perform training while ensuring privacy.

[0177] This embodiment includes the following specific steps:

[0178] Each hospital uses the standardized pre - processed structured data as a client device. The data is the medical imaging, signal data or text data of patients collected by the hospitals through medical devices, such as MRI images, ECG signals, EHR records, etc., including parameters such as gender, age, and blood pressure.

[0179] The hospital local server or device uses a feature encoder to extract and compress the high - dimensional data, generating low - dimensional feature representations D for each client. n . A trusted third - party or central server establishes a stable communication channel. Initializes the model and the random seed pool, calculates the standard deviation σ of the Gaussian noise that meets the requirements through fixed parameters, and distributes the model and the random seed pool for training to each hospital.

[0180] The cross - entropy loss function of the model is adopted. The central server aggregates the model parameters of each hospital through weighted averaging and monitors the training status through a visualization system, such as the loss curve, sample distribution, etc. Among them, the original private medical data does not leave the hospital private cloud, and the homomorphic encryption technology is used to transmit the gradient updates to prevent the intermediate parameters from leaking patient characteristics.

[0181] First, the global model parameters are perturbed positively and negatively, and the loss values of the forward propagation are calculated respectively. Then, the estimated first scalar gradient is calculated according to the formula. In order to prevent attackers from inferring patients' data by analyzing the uploaded gradients, the client performs differential privacy protection processing on the gradients, that is, gradient clipping and gradient adding noise. The purpose of gradient clipping is to limit the influence of outliers on the gradient. The client constrains the norm of the gradient within a set clipping threshold C. This step masks the sensitive information in the gradient with noise, so that even if the attacker obtains the uploaded gradient, they cannot reverse - infer the original patient data.

[0182] Sample a random number from the random seed pool and use it as the seed of the random number generator to generate a perturbation vector. Then, the local model is updated to train the next local batch of data, and the random seed and the corresponding second scalar gradient are recorded for transmission back to the server.

[0183] The client uploads the scalar gradient and the corresponding random seed after differential privacy protection to the central server, rather than uploading the high - dimensional gradient matrix, significantly reducing the communication data volume. In the medical and health scenario, this compression method can effectively reduce the communication bandwidth requirements between medical devices and the central server. Dynamically adjust the upload frequency according to the network status (such as bandwidth) and the number of model training rounds. In the early training stage, use a lower frequency to upload data to save resources. When the model is approaching convergence, increase the upload frequency to optimize the accuracy.

[0184] In this embodiment, by adopting the method of the present invention, the AUC of the federated model reaches 0.89, an 8.5% increase compared to single-hospital training. During the training process, the risk of data leakage is reduced to the GDPR compliance threshold.

[0185] It should be noted that applying the system and method of the present invention to the healthcare scenario in this embodiment has the following beneficial effects:

[0186] Medical data involves patient privacy. By using differential privacy protection mechanisms and data localization processing strategies, sensitive information leakage is avoided, meeting the compliance requirements of medical regulations. The federated learning framework allows different hospitals or institutions to collaborate in optimizing the model without directly sharing data, breaking through the limitations of data silos. The present invention supports joint modeling with multi-source data, improving the accuracy and generalization ability of diagnostic prediction. The present invention adopts zero-order optimization, estimating the gradient through two forward propagations, completely avoiding the large amount of memory and computational overhead required by traditional backpropagation, and significantly reducing the demand for the computing power of hospital equipment.

[0187] In addition, each hospital client only needs to upload random seeds and scalar gradients, avoiding the high bandwidth requirements for uploading high-dimensional gradient matrices or model parameters. For devices with poor network conditions, efficient data upload and collaborative model training can also be achieved. Finally, through pipeline parallelism and dynamic upload strategies, the model update efficiency is effectively improved, providing technical support for the development of intelligent healthcare.

[0188] In the embodiments provided by the present invention, it should be understood that the disclosed system and method can be implemented in other ways. Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by hardware related to program instructions. The foregoing program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above method embodiments; and the foregoing storage medium includes: removable storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks or optical disks, and other various media that can store program codes.

[0189] Alternatively, if the above embodiments of the present invention are implemented in the form of software function modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present invention, in essence, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device to execute all or part of the methods described in the various embodiments of the present invention. And the foregoing storage medium includes: removable storage devices, ROM, RAM, magnetic disks or optical disks, and other various media that can store program codes.

[0190] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, rather than limitations on the implementation manners of the present invention. The icons describing the structural and positional relationships in the drawings are only for illustrative purposes and cannot be construed as limitations on the present invention. For those of ordinary skill in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to enumerate all the implementation manners here. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A fine-tuning system for large-scale pre-trained models in a federated learning environment, characterized in that, The federated learning environment consists of a central server and multiple client devices. The fine-tuning system includes: a local perturbation gradient estimation module, a differential privacy protection module, and a global model aggregation and update module; The local perturbation gradient estimation module and the differential privacy protection module are set in the client devices, and the global model aggregation and update module is set in the central server. The local perturbation gradient estimation module calculates the global model loss value through forward propagation combined with the zero-order optimization method to estimate the gradient and achieve full-parameter fine-tuning. The differential privacy protection module performs differential privacy protection processing on the estimated perturbed gradient to prevent the gradient information from leaking the user's sensitive data. The global model aggregation and update module reconstructs the perturbation vector and completes the global model update based on the random seed and scalar gradient uploaded by the client.

2. The fine-tuning system of the large-scale pre-trained model in the federated learning environment according to claim 1, wherein The local perturbation gradient estimation module extracts and compresses the features of the local high-dimensional data to generate a low-dimensional feature representation, generates a random perturbation vector with the same dimension as the global model parameters based on the random seed, and performs positive and negative perturbations on the global model parameters, respectively performs forward propagation, calculates the loss value, and estimates the first scalar gradient according to the loss difference between the two forward propagations. The differential privacy protection module clips the estimated first scalar gradient, limits the norm of the gradient within a preset clipping threshold, adds Gaussian noise to the clipped scalar gradient to obtain the second scalar gradient, and uploads the random seed and the second scalar gradient to the central server; The global model aggregation and update module broadcasts the global model parameters and the generated random seed pool to all client devices, reconstructs the perturbation vector based on the random seed uploaded by the client, aggregates the gradients, and updates the global model.

3. A fine-tuning method for large-scale pre-trained models in a federated learning environment, which is used for the fine-tuning system of the large-scale pre-trained model according to any one of claims 1-2, characterized in that, It includes the following steps: S1. The central server initializes the global model and broadcasts the global model parameters and the generated random seed pool to all client devices; S2. The client device extracts and compresses the local high-dimensional data to generate a low-dimensional feature representation, and selects a random seed s from the random seed pool n,k , and generates a random perturbation vector z with the same dimension as the global model parameters based on this random seed n,k ; S3. The client device uses the random perturbation vector to perform positive and negative perturbations on the global model parameters, respectively performs forward propagation, calculates the loss value, and estimates the first scalar gradient according to the loss difference between the two forward propagations; S4. The client device clips the estimated first scalar gradient, limits the norm of the gradient within a preset clipping threshold, adds Gaussian noise to the clipped scalar gradient to obtain the second scalar gradient, and uploads the random seed and the second scalar gradient to the central server; S5. The central server reconstructs the random perturbation vector according to the received random seed, combines the second scalar gradient to recover the approximate gradient of the client device, aggregates the approximate gradients of all client devices, updates the global model parameters, and broadcasts the updated global model parameters to all clients again.

4. The fine-tuning method of the large-scale pre-trained model in the federated learning environment according to claim 3, characterized in that, In the step S1, initialize the global model w k The parameters include: the global model parameter w ∈ R d and hyperparameters, where the hyperparameters include: learning rate η, number of iterations T, total number of clients N, client sampling rate m, standard deviation σ, clipping threshold C, and perturbation amplitude β; The step S2 includes the following specific steps: The client device uses a feature encoder to extract and compress local high-dimensional data to generate low-dimensional feature representations D n for each client, and sample batch data B according to the client sampling rate m n Select a random seed s from the random seed pool n,k to generate a random perturbation vector z with the same dimension as the global model parameter n,k Preset the differential privacy constraint (∈, δ), and calculate the standard deviation σ of the Gaussian noise intensity according to the differential privacy constraint.

5. The fine-tuning method of the large-scale pre-trained model in the federated learning environment according to claim 4, characterized in that, In step S3, the specific process of the client device using the random perturbation vector to perform positive and negative perturbations on the global model parameters and respectively performing forward propagation to calculate the loss value is as follows: Among them, and represent positive and negative perturbations, and represent the loss values of the global model on the local dataset after two forward propagations corresponding to the positive and negative perturbations; the first scalar gradient represents the loss change trend along the perturbation direction, specifically, it is the loss values on the local dataset after forward propagation using positive and negative perturbations and calculate the first scalar gradient, and its calculation method is: where β represents the perturbation amplitude, and the perturbation amplitude β of the two forward propagations is dynamically adjusted according to the model parameter dimension, client computing power, and data distribution.

6. The fine-tuning method of the large-scale pre-trained model in the federated learning environment according to claim 5, wherein In the step S4, the specific process of clipping the first scalar gradient, restricting the norm of the gradient within a preset clipping threshold, and adding Gaussian noise to the clipped scalar gradient to obtain the second scalar gradient is as follows: Among them, C represents the cropping threshold, and the cropping threshold C is adaptively adjusted according to the sensitivity of local data; σ represents the standard deviation of Gaussian noise, and N(0,σ 2 C 2 I d ) represents the added Gaussian noise, and the standard deviation satisfies the differential privacy constraint (∈, δ), specifically: ∈<c1q 2 T where q = |B n | / |D n | represents the sampling probability, |B n | represents the batch size of the nth client, and c1 and c2 are both constants. When c1 > 0 and c2 > 0, it means that the optimization process satisfies the differential privacy constraint (∈, δ).

7. The fine-tuning method of the large-scale pre-trained model in the federated learning environment according to claim 6, characterized in that, In the step S5, the specific process of the central server reconstructing the random perturbation vector according to the received random seed and restoring the approximate gradient of the client device in combination with the second scalar gradient is as follows: The calculation process of updating the global model parameters using the zero-order optimizer is as follows: where η represents the model learning rate, represents the vector gradient obtained by multiplying the scalar gradient and the perturbation vector returned to each client at the k-th training round for global model update, G k represents the overall use of the vector gradient results returned by each client in the k-th round for global model update, z n,k represents the random perturbation vector generated from the received random seed, w n,k represents the updated global model parameters; the specific process of aggregating the approximate gradients of all client devices is as follows: This formula represents storing the random seed and the second scalar gradient in a dictionary, where The updated global model parameters are broadcast to all client devices again to complete one training round of the global model.

8. The fine-tuning method of the large-scale pre-trained model in the federated learning environment according to claim 7, characterized in that After the step S5, the central server verifies the privacy-aware defense effect of the global model in real time, dynamically adjusts the Gaussian noise intensity according to the privacy leakage risk, records the privacy budget loss, model accuracy change, and privacy leakage risk before each broadcast of the global model parameters, generates a defense effectiveness report, and performs a feedback operation according to the defense effectiveness report; It includes the following specific steps: The central server dynamically adjusts the differential privacy constraints (∈, δ) and the noise intensity σ according to the global model convergence state of each training round and the privacy requirements feedback by the client. The adjustment method of the noise intensity σ is as follows: Among them, a low level of ∈ value is set at the initial stage of the training round to ensure privacy protection. As the training round increases, the ∈ value is gradually increased according to the convergence state of the global model to improve the accuracy of the global model; record the privacy budget loss, model accuracy change, and privacy leakage risk before each broadcast of the global model parameters, generate a defense effectiveness report. If the model accuracy change exceeds the preset threshold, adjust the noise intensity. If the privacy leakage risk rises, suspend the training or switch to an alternative encrypted channel.

9. A privacy-aware defense method based on federated learning according to claim 7, characterized in that, Before uploading the second scalar gradient, the client device also adds uniform noise with an amplitude of σ / (N*m) to the second scalar gradient. The central server uses a generative adversarial network to simulate a gradient inversion attack and quantifies the gradient leakage risk; the specific process of the adversarial network simulating a gradient inversion attack is as follows: The central server simulates an attacker trying to reverse-engineer the local data of the client device through the aggregated gradient. If the attack success rate exceeds the preset threshold, increase the noise intensity by a preset multiple, or reduce the ∈ value to protect the privacy of the client, and record the privacy budget consumption, that is, the cumulative value of the ∈ value, after each round of training.

10. Application of the large-scale pre-trained model in scenarios with strict requirements for computational efficiency and data privacy. The large-scale pre-trained model is obtained by fine-tuning the large-scale pre-trained model according to any one of claims 3-9 in a federated learning environment. The application includes intelligent transportation and urban management systems that emphasize both real-time data processing and privacy protection, secure collaborative intelligent manufacturing industrial Internet of Things under large-scale distributed devices, data analysis of distributed intelligent medical devices that require strong privacy protection in the medical Internet of Things, or real-time environment perception and decision-making under multi-terminal collaboration during the process of autonomous driving.

Images