Method and apparatus for joint updating model

Abstract

This specification provides a method and apparatus for jointly updating a model. The jointly updated model consists of local models set up locally by each data party and a global model set up by a third party. The third party is a service provider or a trusted third party. This model architecture is applicable to vertical federated learning processes. That is, each participant holds partial data of the features and labels of the training samples. Since each data party also sets up a simulated attack model locally, the simulated attack model and the local model can perform adversarial training in a single cycle of the jointly updated model. This allows the local output provided by the local model to the third party for processing local data to be obtained based on the adversarial attack of the simulated attack model, thereby ensuring privacy. The above scheme, through adversarial training involving simulated attack models, is beneficial for measuring the data privacy of the federated learning process.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and more particularly to methods and apparatus for joint update models. Background Technology

[0002] With the rapid development of deep learning, artificial intelligence technology is demonstrating its advantages in almost every industry. However, big data-driven AI faces many challenges in reality. For example, data silos are severe, resulting in low utilization and persistently high costs. Some industries may also have limited or poor-quality data from single data providers. Furthermore, due to industry competition, privacy concerns, and complex management procedures, data integration between different departments within the same company can face significant resistance and high costs. Federated learning was proposed against this backdrop. Federated learning is a framework based on distributed machine learning. Its main idea is to build machine learning models based on datasets distributed across multiple devices while preventing data leakage. In this framework, clients (e.g., mobile devices) collaboratively train models under the coordination of a central server, while the training data remains local on the client, eliminating the need to upload data to a data center as in traditional machine learning methods.

[0003] For privacy reasons, the local private data of each data provider participating in federated learning does not need to be uploaded to a data center, but is stored directly locally. Data from each client is protected by sharing model parameters or parameter update information. However, as part of the training model, other information besides this shared data (such as gradient information) may also leak sensitive information about the client's dataset to third parties or central services, posing a threat to data privacy. Therefore, balancing data privacy and accuracy is a crucial issue in federated learning. Summary of the Invention

[0004] This specification describes one or more embodiments of a method and apparatus for a joint update model to solve one or more problems mentioned in the background art.

[0005] According to the first aspect, a method for jointly updating a model is provided, applicable to multiple data parties jointly training a model with the assistance of a third party based on privacy protection. The model corresponds to a local model set by each data party and a global model set by the third party. In a single update cycle, the method includes: each data party performing the following local training operations to obtain corresponding intermediate results: processing local data using the local model to obtain local output; performing adversarial training between the local model and a local simulated attack model based on the local data and local output; sending the intermediate results obtained by the local model processing the local data based on the adversarial training to the third party; wherein the local attack model is used to infer the local data or its data attributes; the third party obtaining each intermediate result sent by each data party and processing each intermediate result using the global model to feed back gradient data corresponding to the intermediate results to each data party; and each data party adjusting the undetermined parameters of its local model based on the gradient data fed back by the third party, thereby updating the local model.

[0006] According to the second aspect, a method for jointly updating a model is provided, applicable to the process of multiple data parties jointly training a model with the assistance of a third party based on privacy protection. The model includes a local model set by each data party and a global model set by the third party. The method is executed by a first data party among the multiple data parties. In a single update cycle, the method includes: processing local data using the local model to obtain local output; performing adversarial training between the local model and a local simulated attack model based on the local data and local output, wherein the local attack model is used to infer the local data or its data attributes; sending a first intermediate result obtained by the local model updated based on the adversarial training to the third party, so that the third party can use the global module to process the intermediate results sent by each data party, thereby feeding back first gradient data related to the first intermediate result; and using the first gradient data to determine the gradient of each undetermined parameter in the local model, thereby updating the undetermined parameter in the local model and updating the local model.

[0007] In one embodiment, the number of local data items processed by the local model in the current cycle is n, and the local model obtains n corresponding local outputs for each of the n local data items; the adversarial training between the local model and the local simulated attack model based on the local data and local outputs includes: constructing n training samples by corresponding the n local outputs and the n local data items one-to-one, wherein the local outputs serve as input features of the local simulated attack model, and the local data serve as sample labels of the local simulated attack model; training the local simulated attack model using the n training samples; and adjusting the undetermined parameters of the local model by adversarially attacking the local outputs of the local simulated attack model when the undetermined parameters of the local simulated attack model converge.

[0008] In one embodiment, training the local simulated attack model using the n training samples includes: inputting each local output into the local simulated attack model to obtain corresponding attack results; comparing each attack result with the corresponding local data to determine the attack loss, wherein the higher the consistency between a single attack result and a single piece of local data, the smaller the attack loss; and adjusting the undetermined parameters of the local simulated attack model with the goal of reducing the attack loss.

[0009] In one embodiment, adjusting the undetermined parameters of the local model by countering attacks on the local output by the local simulation attack model includes: processing each local output through the local simulation attack model with converged undetermined parameters to obtain each attack result for each local output; determining the privacy loss based on the comparison between each attack result and the corresponding local data, wherein the lower the consistency between a single attack result and a single local data, the smaller the privacy loss; determining the local loss of the local model in the current period based on the privacy loss, and adjusting the undetermined parameters of the local model with the goal of minimizing the local loss.

[0010] In one embodiment, the local loss further includes an accuracy loss, which is positively correlated with the adjustment magnitude of the undetermined parameters for the local model; determining the local loss of the local model in the current period based on the privacy loss includes: determining the local loss by superimposing the privacy loss and the accuracy loss.

[0011] In one embodiment, the first gradient data is the first gradient of the global loss with respect to the first intermediate result; determining the gradient of each undetermined parameter in the local model using the first gradient data includes: determining each second gradient of the first intermediate result with respect to each undetermined parameter in the local model; the gradient of each undetermined parameter in the local model is the product of each second gradient and the first gradient.

[0012] According to the third aspect, a method for jointly updating a model is provided, applicable to the process of multiple data parties jointly training a model with the assistance of a third party based on privacy protection. The model includes a local model set by each data party and a global model set by the third party. The method is executed by the third party. In a single update cycle, the method includes: acquiring each intermediate result sent by each data party, wherein each intermediate result is determined by the corresponding data party using local data and adversarial training based on the local model and the local simulated attack model; processing each intermediate result using the global model, thereby feeding back the gradient data corresponding to the intermediate result to each data party, so that each data party can adjust the undetermined parameters of its local model according to the gradient data fed back by the third party, thereby updating the local model.

[0013] In one embodiment, the step of using a global model to process each intermediate result and then feeding back the gradient data corresponding to the intermediate result to each data party includes: processing each intermediate result using a global model to obtain a global output result; detecting the global loss based on the comparison between the label data and the global output result; determining the gradient data corresponding to each data party based on the global loss, and feeding back the corresponding gradient data to each data party in a targeted manner, so that each data party can adjust the undetermined parameters of its local model based on the fed-back gradient data, thereby updating the local model.

[0014] In one embodiment, the first data party among the plurality of data parties is the holder of the label data of the training samples. The step of using a global model to process each intermediate result and thereby feeding back the gradient data corresponding to the intermediate result to each data party includes: processing each intermediate result using a global model to obtain a global output result; sending the obtained global output result to the first data party so that the first data party can feed back the global loss detected based on the comparison between the label data and the global output result; determining the gradient data corresponding to each data party based on the global loss, so as to feed back the corresponding gradient data to each data party in a targeted manner, and having each data party adjust the undetermined parameters of its local model based on the fed-back gradient data, thereby updating the local model.

[0015] In one embodiment, if the global model contains undetermined parameters, the method further includes: determining the gradient of the undetermined parameters in the global model based on the global loss, so as to adjust the undetermined parameters in the global model.

[0016] According to the fourth aspect, an apparatus for jointly updating a model is provided, suitable for a process in which multiple data parties jointly train a model with the assistance of a third party based on privacy protection, wherein the model includes a local model set by each data party and a global model set by the third party; the apparatus is located at the first data party among the multiple data parties, comprising:

[0017] The local processing unit is configured to process local data using a local model to obtain local output.

[0018] An adversarial training unit is configured to perform adversarial training between a local model and a local simulated attack model based on local data and local output, wherein the local attack model is used to infer the local data or its data attributes.

[0019] The sending unit is configured to send a first intermediate result obtained by the local model updated based on adversarial training to a third party for processing local data, so that the third party can use the global module to process the intermediate results sent by each data party respectively, thereby feeding back the first gradient data related to the first intermediate result.

[0020] The update unit is configured to use the first gradient data to determine the gradient of each undetermined parameter in the local model, so as to update each undetermined parameter in the local model and thus update the local model.

[0021] According to the fifth aspect, an apparatus for jointly updating a model is provided, suitable for a process in which multiple data parties jointly train a model with the assistance of a third party based on privacy protection, wherein the model includes a local model set by each data party and a global model set by the third party; the apparatus is located at the third party and includes:

[0022] The acquisition unit is configured to acquire each intermediate result sent by each data party. Each intermediate result is determined by the corresponding data party using local data and adversarial training based on the local model and the local simulated attack model.

[0023] The global processing unit is configured to process each intermediate result using the global model, thereby feeding back the gradient data corresponding to the intermediate result to each data party. This allows each data party to adjust the pending parameters of its local model based on the reference data fed back by the third party, and thus update the local model.

[0024] According to a sixth aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the second or third aspect.

[0025] According to a seventh aspect, a computing device is provided, including a memory and a processor, characterized in that the memory stores executable code, and when the processor executes the executable code, it implements the method of the second or third aspect.

[0026] The method and apparatus provided in the embodiments of this specification constitute a jointly updated model consisting of local models set up locally by each data party and a global model set up by a third party. The third party can be a service provider or a trusted third party. This model architecture is applicable to various federated learning processes, especially vertical federated learning processes. During the federated learning process, each data party also sets up a simulated attack model locally. In a single cycle of the jointly updated model, the simulated attack model and the local model can undergo adversarial training, so that the local output provided by the local model to the third party for processing local data is obtained based on the adversarial attack of the simulated attack model, thereby ensuring privacy. The above scheme, through adversarial training involving simulated attack models, proposes a federated learning process that is more conducive to measuring data privacy and improves the effectiveness of federated learning. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram of the system architecture of the joint update model based on the technical concept of this specification;

[0029] Figure 2 This diagram illustrates the model architecture based on the technical concept described in this specification.

[0030] Figure 3 A schematic diagram illustrating the processing flow of a joint update model according to an embodiment of this specification is shown.

[0031] Figure 4 This is a schematic diagram illustrating the process of local training of data in one embodiment of this specification;

[0032] Figure 5 This is a schematic diagram of a data-side adversarial training architecture according to one embodiment of this specification;

[0033] Figure 6 This is a flowchart illustrating a third party's global processing in one embodiment of this specification;

[0034] Figure 7 This is a schematic block diagram of an apparatus for a joint update model on the data side, according to one embodiment of this specification.

[0035] Figure 8 This is a schematic block diagram of an apparatus for a third-party joint update model, which is one embodiment of this specification. Detailed Implementation

[0036] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0037] Federated learning, also known as federated machine learning, consortium learning, or alliance learning, is a machine learning framework that effectively helps multiple organizations use data and perform machine learning modeling while meeting user privacy, data security, and government regulations.

[0038] Specifically, suppose company A and company B each build a task model, where a single task could be classification or prediction, and these tasks have already been approved by their respective users when the data was acquired. However, due to incomplete data—for example, company A lacks labeled data, company B lacks user feature data, or the data is insufficient, with an inadequate sample size to build a good model—the models on each end may fail to be built or perform poorly. Federated learning aims to solve the problem of how to build high-quality models on both A and B, where the training of the model utilizes data from both companies, and each company's proprietary data remains unknown to other parties, i.e., a shared model is built without violating data privacy regulations. This shared model is like the optimal model built by aggregating the data from all parties. In this way, the built model serves only the respective objectives of each party in its region.

[0039] In federated learning, each entity can be referred to as a training member, or, for ease of description, as a data party in this specification. Each data party can hold different business data and can participate in the joint training of the business model through devices, computers, servers, etc. This business data can be various types of data, such as characters, images, voice, animation, and video. Typically, the business data held by each data party is related, and the business parties corresponding to each training member can also be related. For example, in multiple business parties involved in medical services, each business party can be a hospital, a medical examination institution, etc. Business party 1 could be hospital A, with local business data including user age, gender, symptoms, diagnosis results, treatment plans, treatment outcomes, etc.; business party 2 could be medical examination institution B, with medical examination records including user age, gender, symptoms, medical examination conclusions, etc., and so on. A single data party can hold business data from one business or business data from multiple business parties. The purpose of federated learning is to train a model that can better handle this business data; therefore, the federated learning model can also be called a business model.

[0040] Privacy protection methods in federated learning generally fall into two main categories: differential privacy and homomorphic encryption. Differential privacy improves system security by adding perturbations to model parameters (updates), making it impossible for third parties to distinguish individual entities. However, this algorithm requires a trade-off between accuracy and privacy. In other words, privacy is achieved at the expense of some accuracy; higher privacy often comes at the cost of lower accuracy, creating a conflict between the two. Homomorphic encryption protects user privacy by exchanging parameters within an encrypted mechanism. In homomorphic encryption, data and the model itself are not transmitted, thus minimizing the possibility of privacy leaks at the raw data level. However, homomorphic encryption does not well support nonlinear operations. If the jointly trained business model uses a deep neural network (DNN), it may involve numerous nonlinear operations, resulting in a significant computational burden.

[0041] To address the problems of federated learning in conventional technologies, this specification proposes an implementation architecture where each data provider has a local model, while a third party deploys a global model. During training, the local models undergo adversarial training against adversarial attacks. Figure 1 As shown, each data provider's local model is used to process local training data, and intermediate processing results are uploaded to a third party. To protect data privacy, each data provider conducts simulated attacks and adversarial training locally. Specifically, a single data provider can set up a simulated attack model locally, simulating an attacker's aggressive predictions based on intermediate processing results. Further, adversarial training is conducted on the local model based on the simulated attack model, ensuring that the output intermediate results can withstand the attacker's attacks. The third party can be a trusted business entity mutually recognized by all data providers, such as a service provider or a trusted third party. The third party further aggregates and processes the processing results from each data provider, thus feeding back their respective gradient data to each data provider. Each data provider adjusts its local model based on the reference data.

[0042] Federated learning can be understood to be categorized into horizontal federated learning (feature alignment), vertical federated learning (sample alignment), and federated transfer learning. The implementation architecture provided in this specification is based on vertical federated learning, where the sample subjects overlap among the data providers, allowing each provider to offer partial features of the samples. The sample subject refers to the entity corresponding to the business data to be processed; for example, in financial risk assessment, the business subject might be a user or a company. However, this does not preclude the possibility that the technical solution provided in this specification can be applied to other forms of federated learning.

[0043] refer to Figure 2 As shown, to further clarify the implementation architecture of this specification, the implementation architecture of this specification is given from the perspective of deploying jointly trained models under the vertical federated learning architecture. For example... Figure 2 As shown, there are N data parties participating in federated learning. Each data party has its own local model, while the third party has a global model.

[0044] In vertical federated learning, the jointly trained model comprises a global model held by a third party and N local models deployed on N data providers, as enclosed in dashed box 201. The N data providers align their samples, selecting data corresponding to consistent sample subjects. Each local model then processes its local sample data and sends the results to the third party. Each local model essentially encodes or encrypts the data from its respective data provider, allowing the third party to receive and use the relevant data but not access the original data. The third party can fuse the intermediate results sent by each data provider using the global model, for example, by concatenating them into the input features of the first layer of the global model, and then further process them to obtain the output.

[0045] It is understandable that, in order to ensure that the processing results of local data by a single data provider can be used by a third party without leaking private data, the intermediate results need to represent the original data as accurately as possible without reproducing the original data (i.e., ensuring privacy). Therefore, under the technical concept described in this specification, each data provider can also set up an adversarial model locally. The adversarial model can, for example, be a simulated attack model. The simulated attack model can attempt to reproduce the original data, thereby detecting the degree of reproduction of the intermediate results from the original data and measuring the privacy of the local model's processing results of the original data. In practice, during federated learning, for a batch of sample data, a single data provider can conduct adversarial training between its local model and the simulated attack model. During adversarial training, the undetermined parameters of the simulated attack model are adjusted until convergence, and based on the converged undetermined parameters of the simulated attack model, the parameters of the local model are adjusted to counter the attack of the simulated attack model and prevent the simulated attack model from inferring the original data. In this way, it can be considered that the processing of the current batch of sample data by the current local model can guarantee accuracy and privacy. At this point, the intermediate results obtained by processing the original data of the current batch through the local model are uploaded to the third party.

[0046] The third party processes the intermediate results through the global model to obtain the corresponding output as the prediction result. In longitudinal federated learning, this output can be the prediction result for the sample data. Further, by comparing the prediction result with the sample labels, the gradient of the undetermined parameters can be derived in reverse. Specifically, for a global model with undetermined parameters, the third party can derive the gradient of the undetermined parameters of the global model in reverse, and ultimately derive the gradient of each intermediate result, feeding it back to the corresponding data provider. For a global model without undetermined parameters, the third party can only derive the gradient of each intermediate result and feed it back to the corresponding data provider. Each data provider can use the gradient of the intermediate results to further derive the gradient of each undetermined parameter in its local model, thereby adjusting the undetermined parameters in the local model in the direction of gradient reduction, completing one round of model update for the current batch of samples.

[0047] After multiple batches of sample data and corresponding multiple rounds of updates, a model that meets the requirements can be trained. It's worth noting that in the case of vertical federated learning, the model structure of each local model corresponding to each data provider can be set independently by the respective data provider locally, or it can be uniformly set by the service provider and then distributed to each data provider; this is not limited here. For example... Figure 2 As shown, the number of neural network layers and parameters can differ between local models from different data providers. The simulated attack model, used as an auxiliary training model, may not be included in the model to be trained in federated learning.

[0048] The technical concept of this specification is described in detail below.

[0049] Please refer to Figure 3 The diagram illustrates the flow of a joint update model according to one embodiment. This flow can be implemented through a third party and multiple data parties. A single data party can be any device, platform, or cluster of devices with computing and processing capabilities. The third party can be a service provider or other trusted business entity. In one embodiment, the third party can also be one of the data parties (such as a data party holding labeled data). Each data party holds partial feature data of the training samples. The joint update model includes local models set by each data party and a global model set by the third party. The local models can be viewed as parallel connections, and their parallel results are concatenated with the global model.

[0050] It's understandable that the joint model update process can have multiple iterations until the stopping condition for joint training is met. For ease of description, Figure 3 Let's take a single cycle as an example. Figure 3 As shown, the process of the joint update model includes:

[0051] Step 301: Each data party performs local training operations to obtain corresponding intermediate results. It can be understood that, according to the technical concept of this specification, these intermediate results are the processing results of the local model on the local data. In longitudinal federated learning, the intermediate results are equivalent to the results representing the local data obtained by a single data party performing preprocessing on the local data, such as encoding, encryption, and feature extraction.

[0052] The local data mentioned here can be understood as the data held by the corresponding data provider for the sample subjects in the current batch. For example, in the scenario of user financial risk detection, the sample subjects are users. One data provider holds local data on user investment, loans, and loan repayments; another data provider holds data on user consumption records and payment methods; yet another data provider holds data on user age, education, occupation, and income; and a third party or several of these data providers hold historical risk labeling data for users. In the scenario of enterprise financial risk detection, the sample subjects are enterprises. One data provider may hold registration data such as registration date, legal representative, and registered capital; another data provider may hold asset data such as bank statements and loan history; and a third party or several data providers hold historical credit data used as sample labels, and so on. In other business scenarios, the data held by various data providers can also take other forms, which will not be elaborated here.

[0053] like Figure 4 As shown, step 301 can be broken down into the following sub-steps:

[0054] Step 3011: Process the local data using the local model to obtain the local output. Here, the local model is part of the federated learning model. For a single data source, it can be considered an independent model, and the processing result of this independent model is the output of the local model. Since the local model processes local data and is only relevant to the current data source, its output is denoted as the local output.

[0055] It is important to note that the local output here is not an intermediate result to be transmitted to a third party. Under the technical concept of this specification, to protect the privacy of local data, this local output is not used as an intermediate result to be transmitted to a third party. Local data can be determined based on the business scenario and is related to the business corresponding to the data held by the current data provider. For example, for a specific data provider, local data could be user financial management, loan, or loan repayment data. Local output can be in the form of vectors, matrices, etc., and is not limited here.

[0056] Step 3012: Based on local data and local output, conduct adversarial training between the local model and the local simulated attack model. It can be understood that the local attack model can simulate an attacker whose objectives may include inferring privacy attributes in the original data (e.g., inferring whether a user's income is high or low, which can be achieved through classification models) or reconstructing the original data (e.g., reconstructing a user's bank statements, loan history, and other asset data, which can be achieved through regression models). Therefore, the local output can be used as the input to the local simulated attack model, and the initial local data can be used as the "label" of the local simulated attack model, allowing for adversarial training between the local simulated attack model and the local model.

[0057] Figure 5 This illustrates the architecture of adversarial training between the local model and the locally simulated attack model in longitudinal federated learning. Figure 5 As shown, during adversarial training, the local output obtained in step 3011 is used as the input to the simulated attack model. The attack result of the simulated attack is compared with the original local data (label) to determine the attack loss. Here, the attack result of the simulated attack is the output result of the simulated attack model predicting the original data. The attacker's goal is to obtain the most accurate value possible; therefore, the attack loss can be measured by the difference between the prediction result of the simulated attack model and the original local data (label). The smaller the difference, the smaller the attack loss, and the more successful the attack. This difference is determined according to the target form of the simulated attack model. When the target form of the simulated attack model is a vector (e.g., the simulated attack model is a regression model reconstructing local data), the attack loss can be described by the standard deviation, mean squared error (MSE), cosine similarity, etc., between the prediction result and the original local data. When the simulated attack model is a classification model (e.g., the target of the simulated attack model is to predict a certain attribute of the local data), the attack loss can be described by the absolute value of the difference between the prediction result and the original local data, the logarithmic function, the cross-entropy loss function, etc. The convergence of the undetermined parameters of the local simulated attack model means that the simulated attack model for the current period has been successfully trained, and the local simulated attack model has been determined for the current period.

[0058] For ease of description, a single data square can be denoted as data square i, where i is an integer greater than or equal to 1 and less than or equal to N, and N is the number of data squares. The local data used by data square i in the current period is denoted as D. i Local output is denoted as O i The undetermined parameters of the local model are denoted as θ. i The initial value of the undetermined parameter for the current period is denoted as θ. i0 The undetermined parameters of the simulated attack model are denoted as... The parameters of the simulated attack model trained to convergence are denoted as... In the current cycle, O can be used. i As input to the simulated attack model, the prediction result A of the simulated attack model is used. O i ) and D i Compare and adjust Typically, the current batch D... i Repeatedly inputting multiple data points into the simulated attack model can cause the undetermined parameters to converge, thus obtaining... The simulated attack model with undetermined parameters converges is the simulated attack model trained in the current cycle. It can be considered as an attacker capable of successfully attacking the output of the current local model.

[0059] Understandably, in adversarial training, the goal is to induce attackers to generate incorrect information, resulting in attack failure, through perturbation. The technical concept outlined in this specification allows for the modification of the local model's output by adjusting its undetermined parameters, thereby preventing the local attack model from succeeding. At this point, the local model's parameters can be adjusted based on the simulated attack model to enhance its resistance to attacks and ensure privacy. During the longitudinal federated learning process, after the simulated attack model converges, the local model's output O can be further adjusted. i This ensures that the output of the local model satisfies both privacy and accuracy requirements.

[0060] Therefore, the undetermined parameters of the local model also need to be updated. During the update, the loss of both privacy and accuracy can be considered simultaneously.

[0061] On the one hand, privacy is considered. In vertical federated learning, the local output obtained by the local model processing local data is processed by a pre-trained simulated attack model to produce the attack result A. O i ) and D i Minimize the similarity between them. Attack result A ( O i ) and D i The similarity between them can be denoted as: Specifically, to ensure privacy, based on fixed... Adjust the undetermined parameters of the local model. Make Minimize. The goal here is to make the simulated attack model fail with the original data, which is the opposite of the goal during the training of the simulated attack model. This can also be called privacy loss. In a specific example, privacy loss and attack loss can be inverses of each other. Therefore, The settings for the attack loss can be referenced from those for the simulated attack model loss. The difference is that the parameters to be adjusted in the attack loss are the undetermined parameters of the simulated attack model, while the parameters to be adjusted in the privacy loss are the undetermined parameters of the local model. This will not be elaborated further here. It can be understood that the attack model's prediction result A( O i ) and D i The smaller the similarity between them, the smaller the privacy loss, the lower the accuracy of the simulated attack model inferring the original data, and the higher the privacy of the local output.

[0062] On the other hand, considering global accuracy, it's understandable that the initial value θ of the undetermined parameter is needed when the current period is not the initial period. i0 These can be parameters adjusted in the previous cycle based on the global gradient of federated learning. They are parameters adjusted to meet the requirement of minimizing the global loss. If the local output is determined, the parameters to be determined are θ. i Excessive adjustment of parameters beyond the globally adjusted set thresholds may negatively impact the accuracy of global federated learning. Therefore, when adjusting the undetermined parameters of the local model during adversarial training, the magnitude of parameter adjustment should be considered; smaller adjustment magnitudes result in higher accuracy. Accordingly, an accuracy loss can be set, correlated with the undetermined parameters θ. i and the initial value θ of the undetermined parameter i0 Norm representation. For example, accuracy loss is set as the first norm. or second norm ,etc.

[0063] In one embodiment, the local loss during the adjustment of the undetermined parameters of the local model can be the sum of the accuracy loss and the privacy loss. In another embodiment, the local loss can be the logarithm of the product of the accuracy loss and the privacy loss. Here, it is called local loss because the loss has not yet been uploaded to a third party, and therefore can be considered unrelated to third parties or other data providers; this name does not limit the substantive meaning of the loss. In this way, the privacy loss and the accuracy loss mutually constrain each other, adjusting the undetermined parameters of the local model to prevent successful attacks and thus protect privacy, while also preventing large changes in the undetermined parameters of the local model from affecting the overall model accuracy.

[0064] Based on a specific example in longitudinal federated learning, the loss during this process of adjusting the undetermined parameters of the local model can be determined as follows:

[0065]

[0066] Among them, through preset hyperparameters (This can be a constant, such as 2) to control the proportion of privacy. The undetermined parameters of the local model can then be adjusted as follows:

[0067] .

[0068] It is understood that this specific example is merely one illustration. In practice, while adhering to the above adjustment principles, other methods can also be used to adjust the undetermined parameters of the local model. No specific restrictions are imposed here. (Based on the adjusted...) The defined local model can be considered as a local model updated based on the local simulated attack model and the adversarial training of the local model.

[0069] It is worth noting that, in order to make the simulated attack model perform better, in one embodiment, the simulated attack model and the local model are trained adversarially using the local data of the corresponding period in each update cycle. When the simulated attack model converges, the undetermined parameters of the local model are adjusted for the purpose of countering its attack.

[0070] Step 3013: Send the intermediate results obtained from processing local data using the local model updated based on adversarial training to a third party. As described in the principle of adversarial training in step 3012, when the local simulated attack model converges, a local model capable of adversarial attacks that ensures both privacy and accuracy can be obtained. Processing local data using this adversarial local model yields a local output capable of adversarial attacks, serving as an intermediate result of federated learning. This intermediate result possesses both privacy and accuracy; providing such an intermediate result to a third party ensures that local data is not leaked and can be further used for global training.

[0071] Next, in step 302, the third party processes each intermediate result sent by each data provider using a global model to feed back the gradient data corresponding to their respective intermediate results to each data provider.

[0072] Specifically, such as Figure 6 As shown, step 302 may include the following steps:

[0073] Step 3021: The third party can obtain the intermediate results sent by each data provider, process them using the global model, and obtain the global output. It can be understood that in the longitudinal federated learning process, each data provider can hold features of different dimensions of the training samples. Therefore, the intermediate results are concatenated and fused as input to the global model. In an optional embodiment, if the features provided by multiple data providers overlap, resulting in some overlapping dimensions of the intermediate results, the overlapping dimension values ​​can be averaged and used as input to the corresponding dimension of the global model. In practice, the global model can be implemented using one or more forms such as multi-layer neural networks (e.g., fully connected neural networks, convolutional neural networks), decision trees, support vector machines, etc., without limitation. The global model can be denoted, for example, as F(O1, O2, ..., O...). N In the process of horizontal federated learning, the output here can also be the gradient of the undetermined parameters or the value updated according to the gradient.

[0074] Step 3022 involves comparing the labeled data and the global output to detect the global loss, and determining the gradients of the undetermined parameters in the global model, as well as the gradient data for each data source, based on the global loss. The global loss can be understood as the comprehensive loss generated by the federated learning model architecture in the current cycle. Figure 2 The total loss of each local model and the global model is shown.

[0075] In one possible design, the labeled data can be pre-stored by a third party, who can then directly compare the labeled data with the global output. The comparison method can be determined based on the form of the global model and the business requirements of federated learning. For example, various reasonable methods such as cross-entropy loss, mean squared error loss, cosine loss, and 2-norm can be used to measure the global loss. Generally, the closer the global output is to the labeled data, the smaller the global loss, and vice versa.

[0076] According to another possible design, at least a portion of the label data can be stored among several data providers. In this case, for data stored on the first data provider, a third party can send the global output results of the corresponding samples to the first data provider. The first data provider then detects the global loss based on a comparison of the label data and the global output results and feeds it back to the third party. In an optional embodiment, the comparison between the label data held by the first data provider and the global output results obtained by the third party can be combined with the specific form of the global loss, and the comparison result can be obtained through a secure comparison algorithm (such as unintentional transmission of OT), thereby determining the global loss.

[0077] Understandably, in supervised learning, gradients are typically used to update parameters, such as using gradient descent or Newton's method, to adjust model parameters in a direction that reduces model loss. Therefore, the gradient of each undetermined parameter in the current cycle can be inferred through the global loss, thus allowing for parameter adjustment in the current iteration.

[0078] Under the model architecture described in this specification, the jointly trained model can be implemented using any form of machine learning model that can be updated via gradients, such as one or more forms of neural networks (e.g., fully connected neural networks, convolutional neural networks, etc.), support vector machines, logistic regression, linear regression, etc., without limitation. Under this model architecture, at least each local model corresponding to each data source has undetermined parameters. The global model may or may not contain undetermined parameters. For example, the global model F(O1, O2…O…) N = O1 + O2 + ... + O N If so, there are no undetermined parameters in the global model.

[0079] It is understandable that if we denote the model loss as L, then L is F(O1, O2, ..., O2). N A function of ), for example denoted as L(F). When updating undetermined parameters using gradients, it is necessary to determine the gradient of the model loss with respect to the undetermined parameters. For the q-th parameter of data i. In other words, it is necessary to determine = .

[0080] A third party can derive the gradient for each data source based on its local output. For example, the gradient data for a single data source i might be: The gradient corresponding to a single data point i can also be understood as the local output of its local model. The resulting local loss. Gradient data. It can be sent back to the data provider by a third party.

[0081] When there are undetermined parameters in the global model, a third party can determine the gradients of each undetermined parameter in the global model based on the global loss. The gradients of the undetermined parameters in the global model can be directly used by the third party to adjust the undetermined parameters in the global model, which will not be elaborated further here.

[0082] Furthermore, in step 303, each data provider determines the gradient of each undetermined parameter in the local model based on the gradient data fed back by the third party, thereby updating the local model.

[0083] It is understandable that the various undetermined parameters of the local module of data party i can be determined locally. Thus, based on the gradient data fed back from the third party... The global loss can be determined for the q-th parameter of data i. gradient = .

[0084] Accordingly, with the goal of minimizing global loss, a single data party can adjust the various undetermined parameters in its local model according to the corresponding gradient.

[0085] Taking gradient descent as an example, the process of adjusting the above undetermined parameters can be as follows: .in, This represents a parameter that is yet to be determined. This represents its gradient in the current period. To adjust the step size.

[0086] Thus, after multiple iterations (each iteration executing steps 301-303), the federated learning process updates the model when the termination condition is met. The termination condition includes, but is not limited to, one of the following: the parameters to be synchronized tend to converge, the model loss tends to converge, the iteration period reaches a predetermined period, etc. Convergence can be understood as the change being less than a predetermined threshold.

[0087] Figure 3 The collaborative update model methodology is described from the perspective of interaction between third parties and various data providers. From the perspective of any data provider (hereinafter referred to as the first data provider), the collaborative update model process can include the following in a single update cycle:

[0088] Process local data using a local model to obtain local output;

[0089] Adversarial training is conducted between the local model and the local simulated attack model based on local data and local output.

[0090] Send the first intermediate result obtained by the local model based on the adversarial training update to the third party for processing local data, so that the third party can use the global module to process the various intermediate results sent by each data party, thereby feeding back the first gradient data related to the first intermediate result;

[0091] The gradients of each undetermined parameter in the local model are determined using the first gradient data, thereby updating the local model.

[0092] Understandable. Figure 3 The description of the steps performed by a single data party in the illustrated interaction flow also applies to the first data party, and will not be repeated here.

[0093] In summary, the joint update model consists of local models set up by each data provider and a global model set up by a third party. Under the architecture described in this specification, each data provider also sets up a simulated attack model locally to test the privacy of the local model. In a single cycle of the joint update model, the simulated attack model and the local models can undergo adversarial training. The local model processes the local data and outputs the data locally to train the simulated attack model capable of performing the attack in the current cycle. Then, based on the adversarial attack of the simulated attack model, the undetermined parameters of the local model are adjusted to interfere with the attack and ensure privacy. Simultaneously, the stability of the local model during global updates is considered to ensure the accuracy of the global model. This implementation architecture is particularly suitable for vertical federated learning processes. The above scheme, through adversarial training involving simulated attack models, proposes a federated learning process that is more conducive to measuring data privacy and improves the effectiveness of federated learning.

[0094] For example, compared with differential privacy, the technical solution in this specification can ensure the accuracy of federated learning training while protecting user data privacy; compared with homomorphic encryption, the technical solution in this specification can support complex neural networks such as DNN and reduce the amount of computation.

[0095] According to another embodiment, an apparatus for a joint update model is also provided. This apparatus is used for... Figure 3The flowchart of the joint update model is shown. It can be understood that the joint update model process involves both data parties and third parties. The processes performed by each data party are similar to those performed by the third party. Therefore, the apparatus for the joint update model provided in this specification is divided into apparatus located at the third party and apparatus located at any data party.

[0096] like Figure 7 As shown, the device 700 located on the first data side may include:

[0097] Local processing unit 71 is configured to process local data using a local model to obtain local output;

[0098] The adversarial training unit 72 is configured to perform adversarial training between a local model and a local simulated attack model based on local data and local output. The local attack model is used to infer local data or its data attributes.

[0099] The sending unit 73 is configured to send a first intermediate result obtained by the local model updated based on adversarial training to a third party for processing local data, so that the third party can use the global module to process the intermediate results sent by each data party, thereby feeding back the first gradient data related to the first intermediate result.

[0100] Update unit 74 is configured to use the first gradient data to determine the gradient of each undetermined parameter in the local model, so as to update each undetermined parameter in the local model and thus update the local model.

[0101] like Figure 8 As shown, the device 800 located in a third party may include:

[0102] The acquisition unit 81 is configured to acquire each intermediate result sent by each data party. Each intermediate result is determined by the corresponding data party using local data and adversarial training based on the local model and the local simulated attack model.

[0103] The global processing unit 82 is configured to process each intermediate result using the global model, thereby feeding back the gradient data corresponding to the intermediate result to each data party, so that each data party can adjust the pending parameters of the local model based on the reference data fed back by the third party, thereby updating the local model.

[0104] It is worth noting that, Figure 7 , Figure 8 The devices shown correspond to the implementation of Figure 3 The methods implemented by the data provider i and third parties, therefore, regarding Figure 3 The descriptions regarding data provider i and third parties also apply to... Figure 7 , Figure 8 The apparatus shown will not be described in detail here.

[0105] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 3 The methods described herein are applicable to either the data provider i or a third party.

[0106] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 3 The methods described herein are applicable to either the data provider i or a third party.

[0107] Those skilled in the art will recognize that the functions described in the embodiments of this specification in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0108] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the technical concept in this specification. It should be understood that the above descriptions are merely specific embodiments of the technical concept in this specification and are not intended to limit the scope of protection of the technical concept in this specification. Any modifications, equivalent substitutions, improvements, etc., made based on the technical solutions of the embodiments in this specification should be included within the scope of protection of the technical concept in this specification.

Claims

1. A method for jointly updating a model, suitable for a plurality of data parties to jointly train a model based on privacy protection with the assistance of a third party, the model corresponding to a local model set by each data party and a global model set at the third party; in a single update cycle, the method comprising: each data party respectively performing the following local training operations to obtain a corresponding intermediate result: processing local data using the local model to obtain a local output; based on the local data and the local output, performing adversarial training between the local model and a local simulated attack model, so that the local model can resist attacks on the local data; sending an intermediate result obtained by processing the local data using the updated local model based on the adversarial training to the third party; wherein the local attack model is used to infer the local data or its data attributes, and the local data of a single data party includes at least one of the following: characters, pictures, speech, animation, and video; the third party obtains each intermediate result sent by each data party and processes each intermediate result using the global model to feed back gradient data corresponding to the corresponding intermediate result to each data party; each data party adjusts the pending parameters of the local model according to the gradient data fed back by the third party, thereby updating the local model.

2. A method for jointly updating a model, suitable for a plurality of data parties to jointly train a model based on privacy protection with the assistance of a third party, the model corresponding to a local model set by each data party and a global model set at the third party. The method is performed by a first data party in the plurality of data parties, and in a single update cycle, the method comprises: processing local data using the local model to obtain a local output; based on the local data and the local output, performing adversarial training between the local model and a local simulated attack model, so that the local model can resist attacks on the local data, the local attack model is used to infer the local data or its data attributes, and the local data includes at least one of the following: characters, pictures, speech, animation, and video; sending a first intermediate result obtained by processing the local data using the updated local model based on the adversarial training to the third party, so that the third party processes each intermediate result sent by each data party using the global module to feed back first gradient data related to the first intermediate result; determining the gradient of each pending parameter in the local model using the first gradient data to update each pending parameter in the local model, thereby updating the local model.

3. The method of claim 2, wherein, The number of pieces of local data processed using the local model in the current cycle is n, and the local model respectively obtains n local outputs corresponding to n pieces of local data, n being a positive integer; the adversarial training between the local model and the local simulated attack model based on the local data and the local output comprises: constructing n training samples one by one corresponding to the n local outputs and the n pieces of local data, wherein the local output is used as the input feature of the local simulated attack model, and the local data is used as the sample label of the local simulated attack model; training the local simulated attack model using the n training samples; in the case where the pending parameters of the local simulated attack model converge, adjusting the pending parameters of the local model by resisting attacks on the local output by the local simulated attack model.

4. The method of claim 3, wherein, the training of the local simulated attack model using the n training samples comprises: inputting each local output into a local simulation attack model respectively to obtain a corresponding attack result; determining an attack loss by comparing each attack result with corresponding local data, wherein the higher the consistency between a single attack result and a single piece of local data, the smaller the attack loss; adjusting the pending parameters of the local simulation attack model to reduce the attack loss.

5. The method of claim 3, wherein, The adjusting the pending parameters of the local model by attacking the local output through the local simulation attack model comprises: processing each local output through the local simulation attack model with converged pending parameters to obtain each attack result corresponding to each local output; determining a privacy loss based on the comparison between each attack result and corresponding local data, wherein the lower the consistency between a single attack result and a single piece of local data, the smaller the privacy loss; determining a local loss of the local model in the current period based on the privacy loss, and adjusting the pending parameters of the local model to minimize the local loss.

6. The method of claim 5, wherein, The local loss further comprises an accuracy loss, and the accuracy loss is positively correlated with the adjustment range of the pending parameters of the local model; and the determining the local loss of the local model in the current period based on the privacy loss comprises: determining the local loss by superimposing the privacy loss and the accuracy loss.

7. The method of claim 2, wherein, The first gradient data comprises a first gradient of the global loss with respect to the first intermediate result; and the determining the gradient of each pending parameter in the local model by using the first gradient data comprises: determining each second gradient of the first intermediate result with respect to each pending parameter in the local model; the gradient of each pending parameter in the local model is a product of each second gradient and the first gradient.

8. A method for jointly updating a model, applicable to a process in which a plurality of data parties jointly train a model under the assistance of a third party based on privacy protection, the model corresponding to a local model set by each data party and a global model set in the third party; the method is performed by the third party, and in a single update period, the method comprises: obtaining each intermediate result sent by each data party respectively, a single intermediate result being determined by a corresponding data party by using local data based on the confrontation training of a local model and a local simulation attack model, the confrontation training enabling the local model to resist attacks on the local data, the local data of a single data party comprising at least one of the following: characters, pictures, voices, animations, and videos; processing each intermediate result by using the global model, thereby feeding back gradient data corresponding to each intermediate result to each data party respectively, so that each data party adjusts the pending parameters of the local model according to the gradient data fed back by the third party, thereby updating the local model.

9. The method of claim 8, wherein, The processing each intermediate result by using the global model, thereby feeding back gradient data corresponding to each intermediate result to each data party respectively comprises: processing each intermediate result by using the global model to obtain a global output result; detecting a global loss based on the comparison between the label data and the global output result; The global loss is used to determine gradient data corresponding to each data party, so as to feed back the corresponding gradient data to each data party, and each data party adjusts the undetermined parameters of the local model according to the feedback gradient data, thereby updating the local model.

10. The method of claim 8, wherein, The first data party in the plurality of data parties is a label data holder of the training sample, and the processing of each intermediate result by the global model and the feedback of the gradient data corresponding to the corresponding intermediate result to each data party respectively comprise: processing each intermediate result by the global model to obtain a global output result; sending the obtained global output result to the first data party, so that the first data party feeds back the global loss detected based on the comparison between the label data and the global output result; The global loss is used to determine gradient data corresponding to each data party, so as to feed back the corresponding gradient data to each data party, and each data party adjusts the undetermined parameters of the local model according to the feedback gradient data, thereby updating the local model.

11. The method of claim 8, wherein, In the case that the global model contains undetermined parameters, the method further comprises: determining the gradient of the undetermined parameters in the global model according to the global loss, so as to adjust the undetermined parameters in the global model.

12. An apparatus for jointly updating a model, adapted to a process of jointly training a model by a plurality of data parties based on privacy protection with the assistance of a third party, the model corresponding to a local model set by each data party and a global model set at the third party. The device is arranged in the first data party in the plurality of data parties, comprising: a local processing unit configured to process local data by a local model to obtain a local output; an adversarial training unit configured to perform adversarial training between the local model and a local simulated attack model based on the local data and the local output, so that the local model can resist attacks on the local data, and the local attack model is used to infer the local data or data attributes thereof, the local data comprising at least one of the following: characters, pictures, speech, animation, video; a sending unit configured to send a first intermediate result obtained by processing the local data based on the adversarial training updated local model to a third party, so that the third party processes each intermediate result sent by each data party by using the global module, thereby feeding back first gradient data related to the first intermediate result; an updating unit configured to determine the gradient of each undetermined parameter in the local model by using the first gradient data, so as to update each undetermined parameter in the local model, thereby updating the local model.

13. An apparatus for jointly updating a model, adapted to a process of jointly training a model by a plurality of data parties based on privacy protection with the assistance of a third party, the model corresponding to a local model set by each data party and a global model set at the third party. The device is arranged in the third party, comprising: an acquisition unit configured to acquire each intermediate result sent by each data party, and each intermediate result is determined by the corresponding data party using local data based on the adversarial training of the local model and the local simulated attack model, and the adversarial training enables the local model to resist attacks on the local data, and the local data of each data party comprises at least one of the following: characters, pictures, speech, animation, video; a global processing unit configured to process each intermediate result by a global model, thereby feeding back gradient data corresponding to each intermediate result to each data party, so that each data party adjusts the undetermined parameters of the local model according to the reference data fed back by the third party, thereby updating the local model.

14. A computer readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to carry out the method of any one of claims 2-11.

15. A computing device comprising a memory and a processor, wherein: The memory has stored thereon executable code that, when executed by the processor, carries out the method of any one of claims 2-11.

Images