A privacy protection method, system, device and medium based on machine learning
By using an unscented Kalman filter to filter differential privacy noise during training in a machine learning model, and combining practicality and privacy assessments, this approach addresses the problem that existing models cannot simultaneously satisfy both practicality and privacy requirements, thus achieving both data privacy protection and improved practicality.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-05-20
- Publication Date
- 2026-03-31
AI Technical Summary
Existing differential privacy machine learning models cannot simultaneously meet the needs of data practicality and privacy, and there is a trade-off between practicality and privacy.
A tasteless Kalman filter is used to filter differential privacy noise, which is then trained using a machine learning model. The model is then adjusted through practicality and privacy evaluations to output privacy-preserving data.
This improves the practicality of machine learning models while ensuring privacy and protecting data privacy.
Smart Images
Figure CN114896630B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data protection technology, and in particular to a privacy protection method, system, device and medium based on machine learning. Background Technology
[0002] Machine learning technology is widely used in fields such as data mining, computer vision, email filtering, and credit card fraud detection, generating massive amounts of user data. This data is sent to cloud service providers, where neural network models aid in decision-making, prediction, and recommendation services. During data analysis and processing, this data may be stolen, posing a risk. Existing technologies use differential privacy machine learning models to protect data privacy. However, existing differential privacy machine learning models cannot simultaneously meet the needs of data usability and privacy. Summary of the Invention
[0003] In view of this, embodiments of the present invention provide a simple and effective privacy protection method, system, device, and medium based on machine learning.
[0004] On the one hand, the present invention provides a privacy protection method based on machine learning, comprising:
[0005] Differential privacy noise is input into an unscented Kalman filter for filtering to determine the filtered noise.
[0006] The filtered noise is input into a machine learning model for training, and the output model is determined.
[0007] The output model is subjected to practicality and privacy evaluation processes to determine the model evaluation result;
[0008] The output model is adjusted based on the model evaluation results to determine the target model and output privacy-preserving data.
[0009] Optionally, the step of inputting differential privacy noise into an unscented Kalman filter for filtering and determining the filtered noise includes:
[0010] The differential privacy noise is sampled to determine the sampling noise;
[0011] The sampling noise is subjected to prediction processing to determine the prediction result;
[0012] The sampling noise is corrected based on the prediction results to determine the filtered noise.
[0013] Optionally, the step of inputting the filtered noise into a machine learning model for training and determining the output model includes:
[0014] The noise is filtered to impress the dataset in the machine learning model, and the output model is determined.
[0015] Optionally, the step of inputting the filtered noise into a machine learning model for training and determining the output model includes:
[0016] The noise is filtered to add noise to the network weights in the machine learning model, and the filtered result is input into the next round of model training to determine the output model.
[0017] Optionally, the step of inputting the filtered noise into a machine learning model for training and determining the output model includes:
[0018] The learning distribution law in the machine learning model is subjected to noise interference based on the filtered noise, and the output model is determined.
[0019] Optionally, the step of performing practicality and privacy evaluation processing on the output model to determine the model evaluation result includes:
[0020] The output model is compared in terms of prediction accuracy to determine the practicality evaluation results.
[0021] The output model is subjected to inference attack comparison processing to determine the privacy assessment result;
[0022] The model evaluation results are determined based on the practicality assessment results and the privacy assessment results.
[0023] Optionally, adjusting the output model based on the model evaluation results to determine the target model and output privacy-preserving data includes:
[0024] The filter noise is adjusted based on the model evaluation results to determine the adjustment noise;
[0025] The output model is subjected to noise interference by inputting the adjusted noise, the target model is determined, and privacy-preserving data is output.
[0026] On the other hand, embodiments of the present invention also disclose a privacy protection system based on machine learning, comprising:
[0027] The first module is used to input differential privacy noise into an unscented Kalman filter for filtering and to determine the filtered noise.
[0028] The second module is used to input the filtered noise into the machine learning model for training and to determine the output model.
[0029] The third module is used to perform practicality evaluation and privacy evaluation on the output model to determine the model evaluation result;
[0030] The fourth module is used to adjust the output model based on the model evaluation results, determine the target model, and output privacy-preserving data.
[0031] On the other hand, embodiments of the present invention also disclose an electronic device, including a processor and a memory;
[0032] The memory is used to store programs;
[0033] The processor executes the program to implement the method described above.
[0034] On the other hand, embodiments of the present invention also disclose a computer-readable storage medium storing a program that is executed by a processor to implement the methods described above.
[0035] On the other hand, embodiments of the present invention also disclose a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.
[0036] Compared with existing technologies, the present invention, employing the above technical solution, has the following technical effects: In this embodiment, differential privacy noise is input into an unscented Kalman filter for filtering to determine the filtered noise; the unscented Kalman filter can filter noise, thereby improving the practicality of the trained machine learning model; furthermore, this embodiment inputs the filtered noise into the machine learning model for training to determine the output model; the output model undergoes practicality and privacy evaluation processing to determine the model evaluation result; the output model is adjusted based on the model evaluation result to determine the target model and output privacy-preserving data; this allows for practicality and privacy evaluation of the machine learning model, improving data practicality while ensuring privacy. Attached Figure Description
[0037] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0038] Figure 1 This is a flowchart of a privacy protection method based on machine learning according to an embodiment of the present invention. Detailed Implementation
[0039] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0040] Before describing this embodiment, it is necessary to explain the technical terms involved in the embodiment:
[0041] Differential privacy is a data protection mechanism that is achieved by injecting noise into a dataset that conforms to different distributions. The noisy dataset can protect sensitive information in the original data.
[0042] Machine learning is a computational method for data processing that can classify data into appropriate labels.
[0043] Differential privacy machine learning applies differential privacy to machine learning, creating DPML (Differential Privacy Machine Learning) models through the combination of the two. However, existing DPML models often face a trade-off between practicality and privacy. Due to the utility loss caused by adding differential privacy noise and the weakness of non-semantic security, the deployment of DPML faces many difficulties: how to achieve higher practicality while ensuring model privacy, and how to fairly evaluate the overall performance of the model.
[0044] Reference Figure 1 This invention provides a privacy protection method based on machine learning, comprising:
[0045] S101. Input the differential privacy noise into the unscented Kalman filter for filtering and determine the filtered noise;
[0046] S102. Input the filtered noise into the machine learning model for training and determine the output model;
[0047] S103. Perform practicality evaluation and privacy evaluation on the output model to determine the model evaluation result;
[0048] S104. Adjust the output model based on the model evaluation results, determine the target model, and output privacy-preserving data.
[0049] In this embodiment of the invention, differential privacy noise is first input into an unscented Kalman filter for filtering. By applying the unscented Kalman filter to differential privacy machine learning, filtering the differential privacy noise can significantly improve the model's practicality while ensuring that the model's privacy is not compromised. It should be noted that the differential privacy noise used in this embodiment can be noise that follows a Laplace or Gaussian distribution. Next, the filtered noise is input into the three stages of the machine learning process for training, thereby outputting the output model. It should be noted that this embodiment can input filtered noise into any one of the three stages of the machine learning process, or simultaneously into all three stages. This embodiment divides the machine learning training process into three stages: the first stage is the data collection stage, used to collect data to be used for training the machine learning algorithm; the second stage is the model training stage, used to continuously learn and update the training parameters of the machine learning model through the machine learning algorithm; the third stage is the model output stage, used to complete the learning and output data. A learning distribution is maintained in the machine learning model. After training the machine learning model by filtering out noise, the output model undergoes utility and privacy evaluations. In this embodiment, utility is evaluated by testing the prediction classification accuracy loss of the output model, and privacy is evaluated by measuring the output model's advantage against attribute inference attacks and membership inference attacks. It is conceivable that this embodiment can use utility and privacy evaluation thresholds to determine the model evaluation results. When both the utility and privacy evaluation results are greater than their respective thresholds, the output model is deemed to meet the utility and privacy requirements, is designated as the target model, and privacy-preserving data is output. When either the utility or privacy evaluation result fails, the output model is adjusted based on the evaluation results until the adjusted model's evaluation result passes, at which point the final output model is determined as the target model, and privacy-preserving data is output. This invention can be applied to the fields of cloud computing services and machine learning services, specifically to various machine learning cloud service providers, such as Amazon Web Services, Tencent Cloud Services, Alibaba Cloud Machine Learning Services, Microsoft Machine Learning Cloud Services, etc.
[0050] As a further preferred embodiment, in step S101 above, the step of inputting differential privacy noise into an unscented Kalman filter for filtering processing to determine the filtered noise includes:
[0051] The differential privacy noise is sampled to determine the sampling noise;
[0052] The sampling noise is subjected to prediction processing to determine the prediction result;
[0053] The sampling noise is corrected based on the prediction results to determine the filtered noise.
[0054] In this embodiment, differential privacy noise is implemented using Laplace noise, which is filtered by inputting it into an unscented Kalman filter. First, the Laplace noise is sampled. In this embodiment, the proportional, integral, and derivative terms in the PID controller are used to adjust the sampling frequency, thereby performing adaptive sampling to obtain the sampled noise. The unscented Kalman filter then performs prediction processing on the sampled noise. The prediction result is calculated based on the sigma sampling points and covariance, and the parameters of the unscented Kalman filter are adjusted according to the prediction result to correct the sampled noise, thus obtaining the filtered noise.
[0055] As a further preferred embodiment, in step S102 above, the step of inputting the filtered noise into the machine learning model for training and determining the output model includes:
[0056] The noise is filtered to impress the dataset in the machine learning model, and the output model is determined.
[0057] In this embodiment, filtered noise is injected into the first stage of the three stages of machine learning, namely the data collection stage. In machine learning, data needs to be collected and saved into a dataset before the formal machine learning begins. Therefore, in this stage, this embodiment directly applies filtered noise to the dataset. By adding filtered noise to each vector in the dataset, greater flexibility is achieved, without needing to modify the algorithm parameters in machine learning, and it can be applied to any machine learning method for training.
[0058] As a further preferred embodiment, in step S102 above, the step of inputting the filtered noise into the machine learning model for training and determining the output model includes:
[0059] The noise is filtered to add noise to the network weights in the machine learning model, and the filtered result is input into the next round of model training to determine the output model.
[0060] In this embodiment, noise filtering is applied to the second stage of the machine learning model. During the training process of the machine learning model, the network weights protected by differential privacy in the differential privacy stochastic gradient descent algorithm are noise-filtered, and then the filtered results are put into the next batch of training to output the noisy machine learning model.
[0061] As a further preferred embodiment, in step S102 above, the step of inputting the filtered noise into the machine learning model for training and determining the output model includes:
[0062] The learning distribution law in the machine learning model is subjected to noise interference based on the filtered noise, and the output model is determined.
[0063] In this embodiment, filtering noise is added to the learning distribution related to the input features and output decisions. This is because after the model has completed training, there will be a learning distribution law, namely the mean and standard deviation of the training dataset. Adding filtering noise to this learning distribution law can help find a more complete algorithm for processing classification and continuous data.
[0064] As a further preferred embodiment, in step S103 above, the step of performing practicality evaluation processing and privacy evaluation processing on the output model to determine the model evaluation result includes:
[0065] The output model is compared in terms of prediction accuracy to determine the practicality evaluation results.
[0066] The output model is subjected to inference attack comparison processing to determine the privacy assessment result;
[0067] The model evaluation results are determined based on the practicality assessment results and the privacy assessment results.
[0068] This embodiment includes an evaluation module for assessing the practicality and privacy of the differential privacy machine learning model. Practicality is evaluated by testing the model's prediction accuracy, while privacy is evaluated by performing inference attacks on the model. By performing practicality and privacy evaluations on the trained model separately, the evaluation results can be obtained, and the model can be adjusted based on these results to improve both privacy and practicality. This embodiment allows setting corresponding practicality and privacy evaluation thresholds to determine the overall privacy and practicality of the model, thus balancing these two aspects. It should be noted that this embodiment compares the prediction accuracy of the output model, which can be evaluated using Accuracy Loss (ACL). The accuracy loss evaluation formula is shown below:
[0069] ACL = 1 - [ACC (with noise) / ACC (without noise)];
[0070] In the above formula, ACL represents the accuracy loss, ACC represents the prediction accuracy, ACC (with noise) represents the prediction accuracy after adding noise filtering, and ACC (without noise) represents the prediction accuracy without adding noise filtering. This embodiment specifically applies test set data to the trained machine learning model, obtains the prediction accuracy of the test set through machine learning processing, calculates the accuracy loss according to the accuracy loss evaluation formula, and determines the model's practicality evaluation result by using a pre-set practicality evaluation threshold. This threshold can be set according to the actual scenario.
[0071] This embodiment performs inference attack comparison processing on the output model, which can be measured by the adversary advantage of attribute inference attack and member inference attack. The adversary advantage calculation formula is as follows:
[0072] ADV = TPR - FPR;
[0073] In the formula, the probability of a successful privacy attack on a member variable is called TPR (True Positive), and the probability of a failed privacy attack on a non-member variable is called FPR (False Positive). ADV represents the adversary advantage. This embodiment uses attribute inference and member inference attacks to attack the trained machine learning model, obtaining the model's attack advantage under each attack. The adversary advantage is calculated by comparing the two attack advantages. A pre-set privacy assessment threshold, which can be set according to the actual scenario, can determine the privacy assessment result of the model.
[0074] As a further preferred embodiment, in step S104 above, adjusting the output model based on the model evaluation result, determining the target model, and outputting privacy-preserving data includes:
[0075] The filter noise is adjusted based on the model evaluation results to determine the adjustment noise;
[0076] The output model is subjected to noise interference by inputting the adjusted noise, the target model is determined, and privacy-preserving data is output.
[0077] In this embodiment, based on the model's usability evaluation results and privacy evaluation results, if it is determined that the model's usability has not improved or its privacy has decreased, then the filtered noise is reprocessed according to the evaluation results, and the adjusted noise is input into the machine learning model until the usability and privacy of the trained model meet the needs of the application scenario, and privacy-protected data is output.
[0078] On the other hand, embodiments of the present invention also disclose a privacy protection system based on machine learning, comprising:
[0079] The first module is used to input differential privacy noise into an unscented Kalman filter for filtering and to determine the filtered noise.
[0080] The second module is used to input the filtered noise into the machine learning model for training and to determine the output model.
[0081] The third module is used to perform practicality evaluation and privacy evaluation on the output model to determine the model evaluation result;
[0082] The fourth module is used to adjust the output model based on the model evaluation results, determine the target model, and output privacy-preserving data. Figure 1 Corresponding to the method described above, this embodiment of the invention also provides an electronic device, including a processor and a memory; the memory is used to store a program; the processor executes the program to implement the method described above.
[0083] and Figure 1 Corresponding to the method described above, embodiments of the present invention also provide a computer-readable storage medium storing a program that is executed by a processor to implement the method described above.
[0084] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform... Figure 1 The method shown.
[0085] In summary, the embodiments of the present invention have the following advantages:
[0086] (1) In this embodiment of the invention, the odorless Kalman filter is applied to differential privacy machine learning to filter differential privacy noise, which can greatly improve the practicality of the model while ensuring that the privacy of the model is not lost.
[0087] (2) The embodiments of the present invention balance the practicality and privacy of the model by performing a practicality assessment and a privacy assessment on the model and adjusting the filtering noise according to the assessment results.
[0088] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.
[0089] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.
[0090] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0091] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.
[0092] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.
[0093] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0094] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0095] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.
[0096] The above is a detailed description of the preferred embodiments of the present invention, but the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.
Claims
1. A privacy preserving method based on machine learning, characterized in that, The method comprises the following steps: inputting the differential privacy noise into an unobservable Kalman filter for filtering processing to determine filtered noise; inputting the filtered noise into a machine learning model for training processing to determine an output model; performing practicability evaluation processing and privacy evaluation processing on the output model to determine a model evaluation result; adjusting the output model according to the model evaluation result to determine a target model and output privacy protection data; the step of inputting the differential privacy noise into an unobservable Kalman filter for filtering processing to determine filtered noise comprises the following steps: performing sampling processing on the differential privacy noise to determine sampled noise; performing prediction processing on the sampled noise to determine a prediction result; correcting the sampled noise according to the prediction result to determine filtered noise; the step of performing practicability evaluation processing and privacy evaluation processing on the output model to determine a model evaluation result comprises the following steps: performing prediction accuracy comparison processing on the output model to determine a practicability evaluation result; performing inference attack comparison processing on the output model to determine a privacy evaluation result; determining a model evaluation result according to the practicability evaluation result and the privacy evaluation result; the step of adjusting the output model according to the model evaluation result to determine a target model and output privacy protection data comprises the following steps: adjusting the filtered noise according to the model evaluation result to determine adjusted noise; inputting the adjusted noise into the output model for noise interference to determine a target model and output privacy protection data.
2. The privacy preserving method based on machine learning according to claim 1, characterized in that, the step of inputting the filtered noise into a machine learning model for training processing to determine an output model comprises the following step: performing noise interference on a data set in the machine learning model according to the filtered noise to determine an output model.
3. The privacy preserving method based on machine learning of claim 1, wherein, the step of inputting the filtered noise into a machine learning model for training processing to determine an output model comprises the following step: performing noise filtering on network weights in the machine learning model according to the filtered noise, and inputting the filtered result into a next round of model training process to determine an output model.
4. The privacy preserving method based on machine learning of claim 1, wherein, the step of inputting the filtered noise into a machine learning model for training processing to determine an output model comprises the following step: performing noise interference on a learning distribution law in the machine learning model according to the filtered noise to determine an output model.
5. A privacy preserving system based on machine learning, characterized in that, The method comprises the following steps: a first module is configured to input differential privacy noise into an unobservable Kalman filter for filtering processing to determine filtered noise; a second module is configured to input the filtered noise into a machine learning model for training processing to determine an output model; a third module is configured to perform practicability evaluation processing and privacy evaluation processing on the output model to determine a model evaluation result; a fourth module is configured to adjust the output model according to the model evaluation result to determine a target model and output privacy protection data; the first module is configured to input differential privacy noise into an unobservable Kalman filter for filtering processing to determine filtered noise, and comprises the following steps: performing sampling processing on the differential privacy noise to determine sampled noise; performing prediction processing on the sampled noise to determine a prediction result; correcting the sampled noise according to the prediction result to determine filtered noise; The third module is configured to perform utility evaluation processing and privacy evaluation processing on the output model, determine a model evaluation result, and include the following steps: performing prediction accuracy comparison processing on the output model to determine a utility evaluation result; performing inference attack comparison processing on the output model to determine a privacy evaluation result; determining a model evaluation result according to the utility evaluation result and the privacy evaluation result; The fourth module is configured to adjust the output model according to the model evaluation result, determine a target model, and output privacy protection data, and include the following steps: adjusting filtering noise according to the model evaluation result to determine adjusted noise; performing noise interference on the output model by inputting the adjusted noise to determine a target model and output privacy protection data.
6. An electronic device, comprising: The device includes a processor and a memory. The memory is configured to store a program. The processor executes the program to implement the method of any one of claims 1-4.
7. A computer readable storage medium characterized in that, The storage medium stores a program, and the program is executed by a processor to implement the method of any one of claims 1-4.