A model training method and related device

Abstract

Embodiments of the present application disclose a model training method and related devices, which can be applied to various scenarios such as cloud technology, artificial intelligence, intelligent transportation, and assisted driving. Through federated learning, the embodiments of the present application not only improve the defense rate against all attacks, but also improve the classification accuracy of the original samples that have not been attacked. The foregoing method includes: obtaining training samples, where the training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training processing on the original samples based on a preset adversarial training model; performing reweighting processing on the training samples based on target weights, and training the reweighted training samples to obtain a training model of a local node; determining gradient information of the training model of the local node; and sending the gradient information to a central node, where the gradient information is used for the central node to update the training model of the central node.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular, to a model training method and related devices. Background Art

[0002] With the increasing popularity of intelligent devices, the security problems and threats to the privacy of target objects brought by them have gradually attracted people's attention. When the target object is unwilling to upload personal data to the background server for privacy protection purposes, how to use the data scattered in the intelligent devices of each target object to complete the training and iterative update of the model has become an urgent problem to be solved.

[0003] In the scenario of federated learning, due to the existence of communication and model distribution steps, the model of the central node is easily obtained by illegal objects, thus suffering from "white-box" adversarial attacks, bringing huge security risks. How to improve the adversarial robustness in the federated learning scenario has become a hot issue in the industry. In the field of adversarial attack and defense, adversarial training has been proven to be the most effective way to improve adversarial robustness. And directly combining adversarial training with federated learning is the most commonly adopted solution in the industry at present. The only difference between this solution and ordinary federated learning is that the ordinary model training of local nodes is changed to adversarial training.

[0004] However, in actual use, the data often does not conform to independent and identically distributed, and there is a serious imbalance between different types of data. This makes the model training method that directly combines adversarial training with federated learning technology greatly reduce the classification accuracy of the model for the original samples that have not been attacked, and guarantees the security of the model at the cost of sacrificing performance significantly, which cannot be accepted in normal business scenarios. Summary of the Invention

[0005] The embodiments of the present application provide a model training method and related devices, which not only improve the defense rate against all attacks, but also improve the classification accuracy of the original samples that have not been attacked, without sacrificing a large amount of performance to guarantee the security of the model.

[0006] First aspect, an embodiment of the present application provides a first model training method. This model training method is applied to a local node. In this model training method, the local node obtains training samples, where the training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training on the original samples based on a preset adversarial training model. Then the local node performs reweighting processing on the training samples based on a target weight, and performs adversarial training on the training samples after the reweighting processing to obtain the training model of the local node. The local node determines the gradient information of the training model of the local node and sends the gradient information to a central node. The gradient information is used for the central node to update the training model of the central node.

[0007] Second aspect, an embodiment of the present application provides a second model training method. This second model training method can be applied to a central node. In this model training method, the central node obtains the gradient information of the training models of N local nodes, where the training model of each local node is obtained by the corresponding local node performing reweighting processing on training samples based on a target weight and training the training samples after the reweighting processing. The training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training on the original samples based on a preset adversarial training model. N≥1 and N is an integer. Then, the central node updates the training model of the central node according to the gradient information of the training models of the N local nodes.

[0008] Third aspect, an embodiment of the present application provides a local node. This local node includes an acquisition unit, a processing unit, and a sending unit. Among them, the acquisition unit is used to obtain training samples, where the training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training on the original samples based on a preset adversarial training model. The processing unit is used to perform reweighting processing on the training samples according to a target weight and perform adversarial training on the training samples after the reweighting processing to obtain the training model of the local node. The processing unit is used to determine the gradient information of the training model of the local node. The sending unit is used to send the gradient information to a central node, and the gradient information is used for the central node to update the training model of the central node.

[0009] In some possible implementation manners, the processing unit is used to: perform adversarial training on the training samples after the reweighting processing through a preset cross-entropy loss function to obtain the training model of the local node, and the training model of the local node is constrained by the KL divergence value of the training model of the central node.

[0010] In some other possible implementation manners, the target weight is obtained based on the distance between the training sample and the classification boundary of the training sample.

[0011] In some other possible embodiments, the distance between the training sample and the classification boundary of the training sample is obtained based on the number of iterations when the iterative attack is successful using the Projected Gradient Descent (PGD) algorithm.

[0012] In some other possible embodiments, the obtaining unit is further configured to receive the updated training model of the central node sent by the central node.

[0013] In some other possible embodiments, the processing unit is further configured to process the test samples based on the updated training model of the central node to obtain the type of each test sample.

[0014] In some other possible embodiments, the processing unit is configured to train the training model of the local node according to the training samples to obtain the gradient information of the training model of the local node.

[0015] Fourthly, an embodiment of the present application provides a central node. The central node includes an obtaining unit and a processing unit. Among them, the obtaining unit is configured to obtain the gradient information of the training models of N local nodes, where the training model of each local node is obtained by the corresponding local node re-weighting the training samples based on the target weights and training the re-weighted training samples. The training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training on the original samples based on a preset adversarial training model. N≥1 and N is an integer. The processing unit is configured to update the training model of the central node according to the gradient information of the training models of the N local nodes.

[0016] In some possible embodiments, the central node further includes a sending unit. The sending unit is configured to send the updated training model of the central node to each of the N local nodes respectively, where the updated training model of the central node is used for each local node to perform identification processing on the test samples to obtain the type of each test sample.

[0017] In some other possible embodiments, the processing node is configured to generate global information according to the gradient information of the N local nodes and update the training model of the central node based on the global information.

[0018] In some other possible embodiments, the processing node is further configured to decrypt the gradient information.

[0019] A fifth aspect of the embodiments of the present application provides a model processing device, including: a memory, an input / output (I / O) interface, and a memory. The memory is used to store program instructions. The processor is used to execute the program instructions in the memory to execute the model training method corresponding to the implementation manner of the first aspect or the second aspect described above.

[0020] A sixth aspect of the embodiments of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions run on a computer, the computer is caused to execute the model training method corresponding to the implementation manner of the first aspect or the second aspect described above.

[0021] A seventh aspect of the embodiments of the present application provides a computer program product containing instructions. When the computer program product runs on a computer or a processor, the computer or the processor is caused to execute the model training method corresponding to the implementation manner of the first aspect or the second aspect described above.

[0022] As can be seen from the above technical solutions, the embodiments of the present application have the following advantages:

[0023] In the embodiments of the present application, since the training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training on the original samples based on a preset adversarial training model, after re-weighting the training samples corresponding to each local node, and then training the re-weighted training samples, a training model corresponding to the local node is obtained. Then, by performing federated learning among the training models of these local nodes, it is possible to effectively prevent data leakage of local nodes during the training process, improve the defense ability against adversarial attacks of local nodes, and moreover, it can improve the classification accuracy of the model for original samples that have not been attacked, without sacrificing a large performance cost to ensure the security of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0025] Figure 1 Shows a schematic diagram of federated learning;

[0026] Figure 2 Shows a schematic diagram of a system structure provided by the embodiments of the present application;

[0027] Figure 3 Shows an optional schematic diagram of the structure of the distributed system applied to the blockchain system provided by the embodiments of the present application;

[0028] Figure 4 Shows an optional schematic diagram of the block structure provided by the embodiments of the present application;

[0029] Figure 5 Shows a flowchart of the method for model training provided by the embodiments of the present application;

[0030] Figure 6 Shows a schematic diagram of the impact of the imbalance of sample types on federated learning training;

[0031] Figure 7 Shows a comparison schematic diagram between the experimental results of multiple adversarial training methods;

[0032] Figure 8 Shows an embodiment schematic diagram of a local node provided in the embodiments of the present application;

[0033] Figure 9 Shows an embodiment schematic diagram of a central node provided in the embodiments of the present application;

[0034] Figure 10 Shows a schematic diagram of the structures of the central node and the local node provided by the embodiments of the present application. Detailed implementation manners

[0035] The embodiments of the present application provide a model training method and related devices, which not only improve the defense rate against all attacks, but also improve the classification accuracy of the original samples that have not been attacked, without sacrificing a large performance cost to ensure the security of the model.

[0036] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0037] In the description and claims of this application and the above-mentioned drawings, terms such as "first", "second", "third", "fourth", etc. (if any) are used to distinguish similar objects and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that comprises a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0038] Artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a way similar to human intelligence. Artificial intelligence also studies the design principles and implementation methods of various intelligent machines to enable the machines to have the functions of perception, reasoning and decision-making.

[0039] Artificial intelligence technology is an interdisciplinary subject with a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, and mechatronics. The software technologies of artificial intelligence mainly include several major directions such as computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0040] Among them, machine learning (ML) is an interdisciplinary subject that involves multiple disciplines such as probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize the existing knowledge structure to continuously improve their own performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent, and its applications cover all fields of artificial intelligence. Machine learning and deep learning usually include technologies such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and rote learning. With the development of machine learning technology, machine learning applications are used in more and more scenarios, such as identification scenarios that require face recognition verification and identity verification.

[0041] With the increasing popularity of smart devices, more and more target objects are concerned about the security of their privacy, which makes the target objects reluctant to upload personal data to central nodes such as servers for privacy protection purposes. Therefore, in the current industry, there has emerged a combination of federated learning technology and adversarial training technology directly to achieve the training and iterative update of the model using the data scattered in the smart devices of each target object, so that the personal data of the target object does not need to be uploaded to the central node, and the local model can also be updated.

[0042] It should be understood that federated learning is a basic artificial intelligence technology, and its design goal is to carry out efficient machine learning among multiple participants (such as multiple local nodes) or central nodes on the premise of ensuring information security during big data exchange, protecting terminal data and personal data privacy. Specifically, the process of federated learning can be defined as a formula: Among them, F k (w) refers to the models of k local nodes, and n k refers to the data volume of the kth local node. In federated learning, the weights of different models are allocated according to the proportion of n k occupying the total data volume n. Figure 1 Shows a schematic diagram of federated learning. As Figure 1 shown, refers to the model parameters corresponding to the central node in the t-th round, while W i t (i = 1,…,n) refers to the model parameters corresponding to n local nodes in the t-th round. In the t-th round, the central node first distributes the model to all local nodes, conducts adversarial training using the data stored in the local nodes, and encrypts and transmits the gradients generated by the adversarial training back to the central node. After decrypting the gradients, the central node updates the model based on some optimization methods to obtain Then, repeat the steps of model distribution, local node training, encrypted transmission of gradient information, and model update, and iterate continuously until the model training converges.

[0043] Adversarial training refers to generating attack samples through commonly used adversarial attack methods in the industry and adding the attack samples to the training set of the model, so that the trained model has a certain defense ability against the attack samples. Specifically, in the formula the characterizes the generation process of adversarial samples, and its purpose is to minimize the adversarial loss on the training set containing adversarial samples.

[0044] However, in the actual use process, the data often does not conform to independent and identically distributed, and there is a serious imbalance phenomenon between different types of data. This makes the model training method that directly combines adversarial training with federated learning technology greatly reduce the classification accuracy of the model for the original samples that have not been attacked, and ensure the security of the model at the cost of sacrificing performance significantly, which cannot be accepted in normal business scenarios.

[0045] Therefore, to solve the above-mentioned technical problems, the embodiments of the present application provide a model training method. This method can be applied to identification scenarios such as UnionPay face verification, ride code face verification, access control face verification, campus face payment verification, identity verification, etc. It can also be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, intelligent transportation, assisted driving and other various scenarios. Exemplarily, Figure 2 shows a schematic diagram of a system structure provided by the embodiments of the present application. As Figure 2 shown, in this system structure, it includes a central node and N local nodes (such as local node 1 to local node N). Among them, N≥1 and N is an integer. The central node can manage and control these N local nodes, such as storing the data of the N local nodes, etc. In this system structure, after each of these N local nodes obtains its own training samples, it can perform reweighting processing on the training samples based on the target weight and then perform adversarial training, and then train to obtain the training model of its own local node. Further, these N local nodes encrypt and send the gradient information of their respective training models to the central node. In this way, the central node can update its own training model according to the gradient information of the training models of these N local nodes, and then feedback it to each local node, and each local node performs type recognition on the test samples based on the updated training model sent by the central node.

[0046] In some examples, the above-mentioned central node and N local nodes can also be deployed in a blockchain scenario. Or rather, the system involved in the embodiments of the present application can also be a distributed system formed by connecting N local nodes and a central node in the form of network communication. Taking the distributed system as a blockchain system as an example, see Figure 3 , Figure 3FIG. 0 shows an alternative schematic structural diagram of the distributed system 100 provided by an embodiment of the present application applied to a blockchain system, which is formed by a plurality of local nodes (any form of computing device in the access network, such as a client, a user terminal) and a central node (such as a server, etc.). A peer-to-peer (P2P) network is formed among the nodes. The P2P protocol is an application layer protocol running on top of the transmission control protocol (TCP). In the distributed system, any machine such as a server or a terminal can join and become a node. A node includes a hardware layer, an intermediate layer, an operating system layer, and an application layer.

[0047] Refer to Figure 3 FIG. 5 shows the functions of each node in the blockchain system shown, and the functions involved include:

[0048] 1) Routing, which is a basic function of a node and is used to support communication between nodes.

[0049] In addition to the routing function, a node may also have the following functions:

[0050] 2) Application, which is used to be deployed in the blockchain, implement specific services according to actual business requirements, record the data related to the implemented functions to form record data, carry a digital signature in the record data to indicate the source of the task data, and send the record data to other nodes in the blockchain system. When other nodes successfully verify the source and integrity of the record data, the record data is added to the temporary block.

[0051] For example, the services implemented by the application include:

[0052] 2.1) Wallet, which is used to provide the function of conducting electronic currency transactions, including initiating a transaction (that is, sending the transaction record of the current transaction to other nodes in the blockchain system. After other nodes verify it successfully, as a response to acknowledging the validity of the transaction, the record data of the transaction is deposited into the temporary block of the blockchain; of course, the wallet also supports querying the remaining electronic currency in the electronic currency address;

[0053] 2.2) Shared ledger, which is used to provide functions such as storage, query, and modification of account data. The record data of the operations on the account data is sent to other nodes in the blockchain system. After other nodes verify its validity, as a response to acknowledging the validity of the account data, the record data is deposited into the temporary block, and a confirmation can also be sent to the node that initiated the operation.

[0054] 2.3) Smart contract, a computerized protocol that can execute the terms of a certain contract, implemented by code deployed on a shared ledger for execution when certain conditions are met. According to actual business requirements, the code is used to complete automated transactions, such as querying the logistics status of the goods purchased by the buyer and transferring the buyer's electronic currency to the merchant's address after the buyer signs for the goods. Of course, smart contracts are not limited to executing contracts for transactions, but can also execute contracts for processing received information.

[0055] 3) Blockchain, including a series of blocks (Block) that are sequentially connected in the order of generation. Once a new block is added to the blockchain, it will not be removed again. The block records the record data submitted by nodes in the blockchain system.

[0056] See Figure 4 , Figure 4 is an optional schematic diagram of the block structure provided by the embodiments of this application. Each block includes the hash value of the transaction records stored in this block (the hash value of this block), and the hash value of the previous block. Each block is connected to form a blockchain through the hash value. In addition, the block may also include information such as the timestamp when the block is generated. Blockchain, essentially a decentralized database, is a string of data blocks generated by using cryptographic methods. Each data block contains relevant information for verifying the validity of its information (anti-counterfeiting) and generating the next block.

[0057] It should be noted that the above-described central node can be understood as the background, including but not limited to servers, central management devices, etc. In addition, the described local nodes may include but not limited to devices such as clients and user terminals. The described user terminals include but not limited to mobile phones, computers, intelligent voice interaction devices, intelligent home appliances, vehicle-mounted terminals, aircraft, etc. The embodiments of the present invention can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, intelligent transportation, assisted driving, etc.

[0058] Figure 5 shows a schematic flowchart of a method for model training provided by the embodiments of this application. As Figure 5 shown, the method for model training may include the following steps:

[0059] 501. The local node obtains training samples, where the training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training processing on the original samples based on a preset adversarial training model.

[0060] In this example, the training samples may include the original samples after data preprocessing and the adversarial samples generated based on the original samples after data preprocessing. For example, in the scenario of UnionPay face recognition, the target objects in different banks may be different, and these target objects do not communicate with each other. In order to protect the privacy of these target objects, banks usually do not upload the personal data of their respective target objects to the background of the supplier. Therefore, in the embodiments of the present application, each local node (such as the user terminal held by the target object, etc.) can first collect a plurality of original samples, such as picture samples (such as including but not limited to face images, etc.). Then, each local node can perform data preprocessing on the plurality of original samples collected by itself, and use a preset adversarial training model to perform training processing on the original samples after data preprocessing to generate adversarial samples. Among them, the preset adversarial training model can also be called an adversarial sample generation method, and can include but not limited to the fast gradient sign method (FGSM), the JSMA (jacobian-based saliency map attacks) algorithm, the projected gradient descent (PGD) algorithm, etc., which are not limited in the present application. In addition, the described data preprocessing includes data cleaning, data normalization processing, etc.

[0061] 502. The local node re-weights the training samples based on the target weights, and trains the re-weighted training samples to obtain the training model of the local node.

[0062] In this example, refer to Figure 6 , Figure 6 shows a schematic diagram of the impact of the imbalance of sample types on federated learning training. As Figure 6 shown, in the non-independent and identically distributed scenario, the imbalance of data categories will have a huge impact on model training. There is a large performance gap between the category with less data volume and the type with larger data volume. And if the existing combination of adversarial training and federated learning technology is directly used, the performance gap will be further widened, resulting in a "biased" classification interface in model training. For example, from Figure 6 in Plainly-trained A cln , AT-trained A cln , AT-trained A rob shown in the curve, compared with category 7 with more data types, category 2 with fewer data types obviously has a larger "biased" classification interface. Based on this, the local node can assign higher training weights to the samples closer to the classification boundary.

[0063] Exemplarily, the aforementioned target weights are obtained based on the distance between the training samples and the classification boundary of the training samples. Moreover, the distance between the described training samples and the classification boundary of the training samples is obtained based on the number of iterations when the iterative attack using the PGD algorithm is successful.

[0064] In this example, the local node can use the PGD algorithm to estimate the distance between the training sample and the corresponding classification boundary. Specifically, the local node can calculate according to the formula the distance between the training sample and the classification boundary. That is to say, the local node based on the PGD algorithm in the i-th round sends the corresponding training sample into the model for forward calculation to obtain the loss function, and calculates the gradient of the loss function with respect to the training sample. Then, the local node iteratively updates the attack sample based on the step size α in the opposite direction of the gradient to obtain until the sample attack is successful. And the iteration round i corresponding to the successful attack is the index for evaluating the distance between the training sample and the classification boundary. Therefore, given a batch of training samples {(x j , y j ), j ∈ [1, m]}, the target weights corresponding to the training samples in this batch of training samples can be calculated based on the formula where d j represents the distance from the training sample j to the classification boundary.

[0065] In this way, after determining the current weights, the local node can re-weight the training samples according to the target weights and train the re-weighted training samples to obtain the training model of the local node.

[0066] In some examples, the local node trains the re-weighted training samples to obtain the training model of the local node. The following method can be adopted, that is: the local node trains the re-weighted training samples through a preset cross-entropy loss function to obtain the training model of the local node. It should be noted that the training model of the local node is constrained by the KL divergence value (kullback-leibler divergence) of the training model of the central node.

[0067] In this example, since the central node aggregates the information of all local nodes, it can be considered that the training model corresponding to the central node has better accuracy and robustness. Based on this, during the process of model training by the local node, the model output of the central node can be used as a regularization constraint. Specifically, the local node can calculate according to the formula minl ce (ρ · f loc (x adv ), y) + β · l kl (floc (x adv ), f glo (x)) to perform reweighted adversarial training, where y is the label of the training sample and β is a preset coefficient.

[0068] That is to say, the local node can calculate the KL divergence value through β·l kl (f loc (x adv ), f glo (x)), and use this KL divergence value as the constraint on the model output of the central node. And based on the cross-entropy loss function minl ce (ρ·f loc (x adv ), y) to implement reweighted adversarial training on the training sample. It should be noted that in practical applications, other knowledge distillation methods can also be used to implement the constraint on the input of the training model of the central node, and this application does not make specific limitations.

[0069] 503. The local node determines the gradient information of the training model.

[0070] In this example, after the local node trains the corresponding training model, it can calculate the gradient information of the corresponding training model. Exemplarily, after the local node trains the reweighted training sample to obtain the training model of the local node, it can determine the loss function of this training model. Then, the local node performs derivative calculation on this loss function, and can determine the gradient information of the training model.

[0071] 504. The local node sends the gradient information to the central node.

[0072] In this example, the local node does not need to send the training model it has trained to the central node. Instead, after determining the gradient information of their respective training models, it sends the gradient information to the central node. Exemplarily, the local node can encrypt the gradient information based on the public key and then send the encrypted gradient information to the central node.

[0073] 505. The central node updates the training model of the central node according to the gradient information sent by N local nodes, where N≥1 and N is an integer.

[0074] In this example, after the central node decrypts the gradient information of the respective training models sent by N local nodes, it can update the parameters of its own training model based on the gradient information of the training models of these N local nodes.

[0075] Exemplarily, the central node may generate global information based on the gradient information of the training models of these N local nodes, and then update the training model of the central node according to the global information. The global information mentioned can be understood as the information obtained by integrating and processing the gradient information sent by these N local nodes.

[0076] 506. The central node sends the updated training model of the central node to each of the N local nodes.

[0077] In this example, after updating the training model of the central node based on the gradient information sent by these N local nodes, the central node can distribute the updated training model of the central node to the N local nodes. Exemplarily, the central node may send the updated training model of the central node to the N local nodes through wired communication, wireless communication, or other means.

[0078] In addition, in some other examples, after obtaining the updated training model, the central node may also encrypt the training model of the central node using a public key, and then send the encrypted training model of the central node to the N local nodes, reducing the risk of model leakage.

[0079] 507. The local nodes identify the test samples based on the updated training model of the central node sent by the central node.

[0080] In this example, after updating its own training model, the central node may further send the updated training model to the N local nodes. In this way, these N local nodes can identify the types of test samples based on the updated training model to achieve the classification of test samples such as images.

[0081] In some other optional examples, after receiving the encrypted updated training model of the central node, the local nodes may also first decrypt it using a private key, and then identify the types of test samples according to the updated training model.

[0082] In the embodiments of the present application, a local node re-weights training samples according to a target weight, performs adversarial training on the re-weighted training samples, and obtains its own training model. Then, the local node determines the gradient information of the training model and sends the corresponding gradient information to the central node. In this way, after obtaining the gradient information of the training models respectively sent by N local nodes, the central node can update the training model of the central node based on the corresponding gradient information. In other words, in the present application, after re-weighting the training samples corresponding to each local node, the re-weighted training samples are trained to obtain the training model corresponding to the local node. Then, federated learning is performed among the training models of these local nodes, which can effectively prevent data leakage of local nodes during the training process, improve the defense ability of local nodes against adversarial attacks, and can also improve the classification accuracy of the model for the original samples that have not been attacked. Figure 7 shows a comparison schematic diagram between the experimental results of multiple adversarial training methods. As Figure 7 shown, the model training method provided by the present application and the currently common model training methods in the industry (for example: Plain, PGD_AT, ALP, TRADES, AVMixup) can be used to process independently and identically distributed (IID) data and non-independently and identically distributed (non-IID) data. It is obvious from Figure 7 it can be seen that using the model training method of the present application not only improves the defense rate against all attacks, but also improves the classification accuracy of the original samples that have not been attacked. In this way, in multiple scenarios such as UnionPay face recognition authentication and Internet finance identity verification, by using the model training method provided by the embodiments of the present application, a stable, secure and high-performance federated learning solution can be provided, which provides a guarantee for the company to expand its business field and win the trust of customers.

[0083] The above mainly introduces the solution provided by the embodiments of the present application from the perspective of the method. It can be understood that in order to implement the above functions, it includes the corresponding hardware structure and / or software module for executing each function. Those skilled in the art should easily realize that, combining the modules and algorithm steps of each example described in the embodiments disclosed in the present application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the way of hardware or computer software driving the hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0084] The embodiments of the present application can divide the device into functional modules according to the above method examples. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. It should be noted that the division of modules in the embodiments of the present application is illustrative, only a logical function division, and there can be other division methods in actual implementation.

[0085] The following will describe the local nodes in the embodiments of the present application in detail. Figure 8 It is a schematic diagram of an embodiment of the local node provided in the embodiments of the present application. As Figure 8 shown, the local node may include an acquisition unit 801, a processing unit 802, and a sending unit 803.

[0086] Among them, the acquisition unit 801 is used to acquire training samples, and the training samples include original samples and adversarial samples. The adversarial samples are obtained by performing adversarial training on the original samples based on a preset adversarial training model. The processing unit 802 is used to perform reweighting processing on the training samples according to the target weight, and perform adversarial training on the reweighted training samples to obtain the training model of the local node. The processing unit 802 is used to determine the gradient information of the training model of the local node. The sending unit 803 is used to send the gradient information to the central node, and the gradient information is used for the central node to update the training model of the central node.

[0087] In a possible implementation manner, the processing unit 802 is used to: perform adversarial training on the reweighted training samples through a preset cross-entropy loss function to obtain the training model of the local node, and the training model of the local node is constrained by the KL divergence value of the training model of the central node.

[0088] In another possible implementation manner, the target weight is obtained based on the distance between the training sample and the classification boundary of the training sample.

[0089] In another possible implementation manner, the distance between the training sample and the classification boundary of the training sample is obtained based on the number of iterations when the iterative attack is successful based on the PGD algorithm.

[0090] In another possible implementation manner, the acquisition unit 801 is further used to receive the updated training model of the central node sent by the central node.

[0091] The above mainly describes the local node from the perspective of functional modules. The following will describe the central node in the embodiments of the present application in detail. Figure 9 It is a schematic diagram of an embodiment of the central node provided in the embodiments of the present application. As Figure 9As shown, the central node may include an obtaining unit 901 and a processing unit 902. In some examples, the central node may further include a sending unit 903.

[0092] Among them, the obtaining unit 901 is configured to obtain gradient information of the training models of N local nodes. Each training model of the local nodes is obtained by the corresponding local node performing reweighting processing on training samples based on target weights and training the reweighted training samples. The training samples include original samples and adversarial samples, and the adversarial samples are obtained by performing adversarial training processing on the original samples based on a preset adversarial training model. N≥1 and N is an integer. The processing unit 902 is configured to update the training model of the central node according to the gradient information of the training models of N local nodes.

[0093] In some possible implementation manners, the sending unit 903 is configured to send the updated training model of the central node to N local nodes respectively.

[0094] The central node and local nodes in the embodiments of the present application are described above from the perspective of modular functional entities. Next, the central node and local nodes in the embodiments of the present application are described from the perspective of hardware processing. Figure 10 FIG. is a schematic structural diagram of the central node and local nodes provided by the embodiments of the present application. The central node and local nodes may vary greatly due to different configurations or performances. The central node and local nodes may include at least one processor 1001, a communication line 1007, a memory 1003, and at least one communication interface 1004.

[0095] The processor 1001 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the solution of the present application.

[0096] The communication line 1007 may include a path for transmitting information between the above components.

[0097] The communication interface 1004 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0098] The memory 1003 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), or other types of dynamic storage devices that can store information and instructions. The memory can exist independently and be connected to the processor through the communication line 1007. The memory can also be integrated with the processor.

[0099] Among them, the memory 1003 is used to store computer execution instructions for implementing the solution of this application, and is controlled by the processor 1001 for execution. The processor 1001 is used to execute the computer execution instructions stored in the memory 1003, so as to implement the model training method provided in the above embodiments of this application.

[0100] Optionally, the computer execution instructions in the embodiments of this application can also be referred to as application code, and the embodiments of this application do not make specific limitations on this.

[0101] In a specific implementation, as an embodiment, the computer device may include multiple processors, such as Figure 10 the processor 1001 and the processor 1002 in. Each of these processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, the processor can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0102] In a specific implementation, as an embodiment, the computer device may further include an output device 1005 and an input device 1006. The output device 1005 communicates with the processor 1001 and can display information in various ways. The input device 1006 communicates with the processor 1001 and can receive inputs from the target object in various ways. For example, the input device 1006 can be a mouse, a touch screen device, a sensing device, etc.

[0103] The above computer device can be a general-purpose device or a special-purpose device. In a specific implementation, the computer device can be a server, a terminal, etc. or a device with a Figure 10 similar structure in. The embodiments of this application do not limit the type of the computer device.

[0104] It should be noted that Figure 10 the processor 1001 in can make the central node and the local node execute the methods in the corresponding method embodiments by calling the computer execution instructions stored in the memory 1003. Figure 5

[0105] Specifically, Figure 8 ​The processing unit 802 therein, Figure 9 The function / implementation process of the processing unit 902 therein can be Figure 10 realized by the processor 1001 in Figure 10 calling the computer-executable instructions stored in the memory 1003. Figure 8 The acquisition unit 801, the sending unit 803 therein, and Figure 9 The function / implementation process of the acquisition unit 901 and the sending unit 903 therein can be Figure 10 realized by the communication interface 1004 in Figure 10 .

[0106] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product.

[0107] Those skilled in the art can clearly understand that for the convenience and conciseness of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be described herein again.

[0108] In several embodiments provided in the present application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces, indirect couplings or communication connections of devices or units, and can be in electrical, mechanical, or other forms.

[0109] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they can be located in one place, or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0110] In addition, the functional units in each embodiment of the present application can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0111] When an integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs.

[0112] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product.

[0113] A computer program product includes one or more computer instructions. When the computer execution instructions are loaded and executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, a computer, a server, or a data center to another website, a computer, a server, or a data center in a wired manner (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or a wireless manner (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can store, or a data storage device such as a server or a data center that includes one or more integrated available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as an SSD), etc.

[0114] It can be understood that in the specific implementation manner of this application, when it comes to data related to user information, the user's personal data, etc., when the above embodiments of this application are applied to specific products or technologies, user permission or consent needs to be obtained, and the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0115] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A model training method, characterized in that, applied to a local node, the model training method includes: Obtain training samples, the training samples include original samples and adversarial samples, the adversarial samples are obtained by performing adversarial training processing on the original samples based on a preset adversarial training model, and both the original samples and the adversarial samples are picture samples; Perform reweighting processing on the training samples based on a target weight, and train the reweighted training samples to obtain the training model of the local node. The target weight is obtained based on the distance between the training samples and the classification boundary of the training samples. The distance between the training samples and the classification boundary of the training samples is obtained based on the number of iterations when the iterative attack based on the projected gradient descent (PGD) algorithm is successful; Determine the gradient information of the training model of the local node; Send the gradient information to a central node, and the gradient information is used by the central node to update the training model of the central node, and the training model is used for face recognition.

2. The model training method according to claim 1, characterized in that, The training the reweighted training samples through adversarial training to obtain the training model of the local node includes: Training the reweighted training samples through a preset cross-entropy loss function to obtain the training model of the local node, and the training model of the local node is constrained by the KL divergence value of the training model of the central node.

3. The model training method according to any one of claims 1-2, characterized in that, The model training method further includes: Receiving the updated training model of the central node sent by the central node.

4. A model training method, characterized in that, applied to a central node, the model training method includes: Obtain the gradient information of the training models of N local nodes, where each training model of the local nodes is obtained by the corresponding local node performing reweighting processing on training samples based on a target weight and training the reweighted training samples. The target weight is obtained based on the distance between the training samples and the classification boundary of the training samples. The distance between the training samples and the classification boundary of the training samples is obtained based on the number of iterations when the iterative attack based on the projected gradient descent (PGD) algorithm is successful. The training samples include original samples and adversarial samples, both the original samples and the adversarial samples are picture samples, and the adversarial samples are obtained by performing adversarial training processing on the original samples based on a preset adversarial training model, N≥1 and N is an integer; Update the training model of the central node according to the gradient information of the training models of the N local nodes, and the training model is used for face recognition.

5. The model training method according to claim 4, characterized in that, The model training method further includes: Sending the updated training model of the central node to the N local nodes respectively.

6. A local node, characterized in that, includes: An acquisition unit, configured to acquire training samples, where the training samples include original samples and adversarial samples, the adversarial samples are obtained by performing adversarial training processing on the original samples based on a preset adversarial training model, and both the original samples and the adversarial samples are picture samples; A processing unit, configured to perform reweighting processing on the training samples according to a target weight, and train the training samples after the reweighting processing to obtain a training model of the local node, the target weight is obtained based on the distance between the training samples and the classification boundary of the training samples, and the distance between the training samples and the classification boundary of the training samples is obtained based on the number of iterations when the iterative attack is successful based on the projected gradient descent (PGD) algorithm; The processing unit is configured to determine gradient information of the training model of the local node; A sending unit, configured to send the gradient information to a central node, and the gradient information is used for the central node to update the training model of the central node, and the training model is used for face recognition.

7. The node according to claim 6, wherein, the processing unit is configured to: train the training samples after the reweighting processing through a preset cross-entropy loss function to obtain a training model of the local node, and the training model of the local node is constrained by the KL divergence value of the training model of the central node.

8. The node according to any one of claims 6-7, wherein, the acquisition unit is further configured to receive the updated training model of the central node sent by the central node.

9. A device for model training, wherein, it is applied to a central node, and the central node includes an acquisition unit and a processing unit; the acquisition unit is configured to acquire gradient information of training models of N local nodes, where each training model of the local nodes is obtained by a corresponding local node performing reweighting processing on training samples according to a target weight and training the training samples after the reweighting processing, the target weight is obtained based on the distance between the training samples and the classification boundary of the training samples, the distance between the training samples and the classification boundary of the training samples is obtained based on the number of iterations when the iterative attack is successful based on the projected gradient descent (PGD) algorithm, the training samples include original samples and adversarial samples, both the original samples and the adversarial samples are picture samples, the adversarial samples are obtained by performing adversarial training processing on the original samples based on a preset adversarial training model, N≥1 and N is an integer; the processing unit is configured to update the training model of the central node according to the gradient information of the training models of the N local nodes, and the training model is used for face recognition.

10. The device according to claim 9, wherein, the sending unit is configured to send the updated training model of the central node to the N local nodes respectively.

11. A model training device, wherein, the model training device includes: an input / output (I / O) interface, a processor and a memory, and program instructions are stored in the memory; The processor is configured to execute program instructions stored in a memory and perform the model training method according to any one of claims 1 to 3, or claims 4 to 5.

12. A computer-readable storage medium, characterized in that the computer-readable storage medium includes instructions that, when run on a computer device, cause the computer device to perform the model training method according to any one of claims 1 to 3, or claims 4 to 5.

13. A computer program product, characterized in that the computer program product includes instructions that, when run on a computer device, cause the computer device to perform the model training method according to any one of claims 1 to 3, or claims 4 to 5.

Images