Method and device for joint training business model based on privacy protection

Abstract

The embodiments of this specification provide a method and device for a joint training business model based on privacy protection. According to the method, the server determines a perturbation matrix for each network layer in the neural network that implements the business model, and uses it to perturb and encrypt the parameters of the network layer to obtain a perturbation encryption model, which is distributed to each terminal. The terminal uses the perturbation encryption model to process its local training samples to obtain a perturbation gradient. In addition, the terminal also superimposes noise on the perturbation gradient. By carefully designing the distribution of noise, the noise obtained after recovery by the perturbation matrix conforms to the Gaussian distribution, thereby meeting the requirements of differential privacy. Therefore, the server can perturb and recover and aggregate the noisy gradients sent by each terminal, thereby updating the parameters in the neural network model.

Description

[0001] This application is a divisional application of the invention patent application filed on December 6, 2020, with application number 202011409592.4, and entitled “Method and device for joint training business model based on privacy protection”. Technical Field

[0002] One or more embodiments of this specification relate to the field of machine learning, and in particular, to a method and apparatus for joint model training for protecting privacy in a distributed system. Background Art

[0003] The rapid development of machine learning has enabled various machine learning models to be applied in a variety of business scenarios. Since the prediction performance of the model depends on the richness and availability of training samples, in order to obtain a business prediction model with better performance, it is often necessary to comprehensively utilize training data from multiple platforms to jointly train the model.

[0004] Specifically, in scenarios where data is distributed vertically, multiple platforms can each have different feature data for the same batch of business objects. For example, in a merchant classification analysis scenario based on machine learning, the electronic payment platform has merchant transaction flow data, the e-commerce platform stores merchant sales data, and banking institutions have merchant loan data. In scenarios where data is distributed horizontally, multiple platforms can each have the same attribute characteristics of different business objects. For example, banking institutions in different regions each have loan data for locally registered merchants. Of course, there are also situations where vertical and horizontal distribution are combined.

[0005] The local training data of multiple platforms often contains the privacy of local business objects, especially user privacy. Furthermore, the local models trained based on local training data also have the risk of leaking local data characteristics. Therefore, in the scenario where multiple parties jointly train models, data security and data privacy issues are a huge challenge.

[0006] Therefore, we hope to provide an improved solution to ensure that the privacy data of each party is not leaked and data security is ensured when multiple parties jointly train a business model. Summary of the invention

[0007] One or more embodiments of this specification describe a method and device for jointly training a business model, which protects privacy data from leakage and ensures data security by perturbing and encrypting the model and adding noise to the gradient.

[0008] According to a first aspect, a method for jointly training a business model based on privacy protection is provided, wherein the business model is implemented by a neural network, and the method is executed by a server, comprising:

[0009] For multiple network layers in the neural network, determining corresponding random perturbation matrices;

[0010] Using the random perturbation matrix to perturb the current parameter matrix of the corresponding network layer to obtain a perturbed encryption parameter matrix of the network layer;

[0011] Sending a perturbation encryption model to multiple terminals, wherein the perturbation encryption model includes perturbation encryption parameter matrices corresponding to the multiple network layers;

[0012] Receiving, from any first terminal among the plurality of terminals, obfuscated gradient items respectively corresponding to the plurality of network layers, wherein the obfuscated gradient items are obtained by superimposing a second noise on a first noise gradient item, wherein the first noise gradient item is obtained by processing a first sample set local to the first terminal using the perturbation encryption model, and a combination result of the second noise and the random perturbation matrix of the corresponding network layer satisfies a Gaussian distribution;

[0013] Using the random perturbation matrices corresponding to the multiple network layers, the confused gradient items of the corresponding network layers are restored to obtain the gradient restoration results of the multiple network layers;

[0014] Aggregate the gradient recovery results corresponding to the multiple terminals, and update the current parameter matrices of the multiple network layers according to the aggregation results.

[0015] According to one embodiment, for multiple network layers in the neural network, corresponding random perturbation matrices are determined, specifically including: for each network layer of the neural network, a corresponding random vector is determined, the dimension of the random vector is the same as the number of neurons in the corresponding network layer; based on the random vector of the first network layer and the random vector of its adjacent network layer, the random perturbation matrix corresponding to the first network layer is determined, wherein the first network layer is an intermediate layer in the neural network.

[0016] In one embodiment, the neural network includes N actual network layers to be trained, and N-1 transition network layers inserted between adjacent actual network layers, and the transition network layer has a fixed unit matrix as its parameter matrix; in such a case, the above-mentioned determination of the corresponding random vector specifically includes: determining a first random vector for each intermediate layer in the actual network layer; determining a second random vector for each transition network layer; wherein the vector elements in the first random vector and the second random vector have different data distributions.

[0017] Furthermore, in an example, each vector element in the above-mentioned first random vector conforms to the ternary decomposition data distribution of the Gaussian distribution; the inverse of each vector element in the above-mentioned second random vector conforms to the ternary decomposition data distribution of the Gaussian distribution; the first network layer is the middle layer in the actual network layer; in this case, determining the random perturbation matrix corresponding to the first network layer specifically includes: combining each vector element in the first random vector corresponding to the first network layer and the inverse of each vector element in the second random vector corresponding to the previous transition network layer of the first network layer, and using the combination results as each matrix element in the random perturbation matrix corresponding to the first network layer.

[0018] In one embodiment, for each network layer of the neural network, a corresponding random vector is determined, which also includes: for the input layer in the actual network layer, a third random vector is determined, wherein each vector element conforms to the binary decomposition data distribution of the Gaussian distribution; and the step of determining the random perturbation matrix also includes: using the elements in the third random vector corresponding to the input layer as matrix elements to obtain the random perturbation matrix corresponding to the input layer.

[0019] In one embodiment, for the last transition network layer, a last second random vector is determined, wherein the reciprocals of the respective vector elements conform to the binary decomposition data distribution of the Gaussian distribution; and the step of determining the corresponding random perturbation matrix also includes: for the output layer in the actual network layer, the reciprocals of the respective elements in the last second random vector are used as matrix elements to obtain the random perturbation matrix corresponding to the output layer.

[0020] According to one embodiment, the aforementioned multiple network layers are the N actual network layers to be trained.

[0021] According to one implementation, the current parameter matrix of the corresponding network layer is perturbed using the random perturbation matrix to obtain a perturbation encryption parameter matrix of the network layer, specifically comprising: for each network layer except the output layer in the N actual network layers, the random perturbation matrix corresponding to the network layer is combined with its current parameter matrix at corresponding positions to obtain the perturbation encryption parameter matrix of the network layer; for the output layer, the random perturbation matrix corresponding to the output layer is combined with its current parameter matrix at corresponding positions, and an additional perturbation matrix for the output layer is superimposed to obtain the perturbation encryption parameter matrix of the output layer.

[0022] In various embodiments, the business model is used to make predictions for a business object, and the business object includes one of the following: a user, a merchant, a transaction, an image, a text, and an audio.

[0023] According to a second aspect, a method for jointly training a business model based on privacy protection is provided, where the business model is implemented by a neural network, and the method is executed by a first terminal, including:

[0024] Receiving a perturbation encryption model from a server, wherein the perturbation encryption parameter matrix corresponding to each of the plurality of network layers in the neural network is obtained by perturbing a current parameter matrix of the network layer using a random perturbation matrix of the corresponding network layer;

[0025] Processing a first sample set local to the first terminal using the perturbation encryption model to obtain a first noise gradient term for each network layer in the multiple network layers;

[0026] Superimposing a second noise on the first noise gradient term to obtain a confusion gradient term for each network layer; wherein a combination result of the second noise and the random perturbation matrix of the corresponding network layer satisfies a Gaussian distribution;

[0027] The confused gradient items are sent to the server, so that the server uses the random perturbation matrix to restore the confused gradient items of the corresponding network layer, and aggregates the restored gradients corresponding to multiple terminals, thereby updating the current parameter matrices of the multiple network layers.

[0028] In one embodiment, the neural network includes N actual network layers to be trained, and N-1 transition network layers inserted between adjacent actual network layers, wherein the transition network layer has a fixed unit matrix as its parameter matrix; the multiple network layers are the N actual network layers to be trained.

[0029] According to one embodiment, the first noise gradient term is obtained in the following manner: the feature data of each sample in the first sample set is input into the perturbation encryption model to obtain the perturbation output of each network layer; the first noise gradient term is obtained based on the perturbation output of each network layer, the label data of each sample and the preset loss function.

[0030] In one embodiment, superimposing a second noise on the first noise gradient term specifically includes: determining a noise matrix corresponding to each network layer; multiplying the noise matrix by a preset noise amplitude and variance as the second noise corresponding to each network layer, and superimposing it on the first noise gradient term, wherein the noise amplitude is not less than the norm of the gradient.

[0031] Furthermore, determining the noise matrix corresponding to each network layer may include: for the middle layer among the multiple network layers, determining a first noise matrix, wherein each matrix element satisfies the ternary decomposition data distribution of the Gaussian distribution; for the input layer and the output layer of the multiple network layers, determining a second noise matrix, wherein each matrix element satisfies the binary decomposition data distribution of the Gaussian distribution.

[0032] According to a third aspect, a device for a joint training business model based on privacy protection is provided, wherein the business model is implemented by a neural network, and the device is deployed in a server, comprising:

[0033] A perturbation matrix determination unit, configured to determine corresponding random perturbation matrices for a plurality of network layers in the neural network;

[0034] A perturbation encryption unit, configured to perform perturbation processing on a current parameter matrix of a corresponding network layer using the random perturbation matrix to obtain a perturbation encryption parameter matrix of the network layer;

[0035] A sending unit, configured to send a perturbation encryption model to a plurality of terminals, wherein the perturbation encryption model includes perturbation encryption parameter matrices corresponding to the plurality of network layers;

[0036] A receiving unit is configured to receive, from any first terminal among the plurality of terminals, obfuscated gradient items respectively corresponding to the plurality of network layers, wherein the obfuscated gradient item is obtained by superimposing a second noise on a first noise gradient item, wherein the first noise gradient item is obtained by processing a first sample set local to the first terminal using the perturbation encryption model, and a combination result of the second noise and the random perturbation matrix of the corresponding network layer satisfies a Gaussian distribution;

[0037] A disturbance recovery unit, configured to use the random perturbation matrices corresponding to the multiple network layers to perform recovery processing on the confused gradient items of the corresponding network layers, so as to obtain gradient recovery results of the multiple network layers;

[0038] The aggregation updating unit is configured to aggregate the gradient recovery results corresponding to the multiple terminals, and update the current parameter matrices of the multiple network layers according to the aggregation results.

[0039] According to a fourth aspect, a device for a joint training business model based on privacy protection is provided, where the business model is implemented by a neural network, and the device is deployed in a first terminal, including:

[0040] A receiving unit is configured to receive a perturbation encryption model from a server, wherein the perturbation encryption parameter matrices respectively corresponding to a plurality of network layers in the neural network are obtained by perturbing a current parameter matrix of the network layer using a random perturbation matrix of the corresponding network layer;

[0041] a gradient acquisition unit, configured to process a first sample set local to the first terminal using the perturbation encryption model to obtain a first noise gradient term for each network layer in the multiple network layers;

[0042] A noise adding unit, configured to superimpose a second noise on the first noise gradient term to obtain a confusion gradient term for each network layer; wherein a combination result of the second noise and the random perturbation matrix of the corresponding network layer satisfies a Gaussian distribution;

[0043] The sending unit is configured to send the confused gradient item to the server, so that it uses the random perturbation matrix to restore the confused gradient item of the corresponding network layer, and aggregate the restored gradients corresponding to multiple terminals, thereby updating the current parameter matrices of the multiple network layers.

[0044] According to a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect or the second aspect.

[0045] According to a sixth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

[0046] According to the method and device provided in the embodiments of this specification, during the iterative update of the model, the server perturbs and encrypts the parameters of each network layer and sends them to the terminal. The terminal can directly process the sample data based on the perturbation-encrypted model to obtain the perturbation gradient. The perturbation encryption of the model parameters, on the one hand, ensures the security of the model parameters, and the perturbation encryption method allows the terminal to directly process the samples without decryption, which greatly saves the computing resources of the terminal. In addition, after obtaining the perturbation gradient, the terminal also adds noise to it, and makes the final noise after the perturbation recovery conform to the Gaussian distribution, thereby meeting the requirements of differential privacy. Therefore, the server and other parties have no way of obtaining the true value of the gradient, which further ensures the security of the privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0048] Figure 1An example scenario of business model training through federated learning is shown;

[0049] Figure 2 A flowchart showing a privacy-preserving business model training method according to one embodiment;

[0050] Figure 3 A schematic diagram showing multiple network layers in a neural network;

[0051] Figure 4 A schematic diagram showing an extended neural network;

[0052] Figure 5 A schematic diagram of a training device deployed in a server according to an embodiment is shown;

[0053] Figure 6 A schematic diagram of a training device deployed in a terminal according to an embodiment is shown. DETAILED DESCRIPTION

[0054] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0055] Figure 1 An example scenario of business model training through federated learning is shown. Figure 1 In the schematic scenario, the distributed system includes a server and N terminals, each of which has training samples for model training. The above terminals can be data platforms of large institutions, such as banks, hospitals, payment platforms, etc., or small devices, such as personal PCs, smartphones, IoT devices, etc. The device types of each terminal can be the same or different.

[0056] The business model to be trained is used to make predictions for business objects, which may be various objects such as users, merchants, transactions, images, texts, audios, etc. In order to train the model, each terminal has its own business object sample set, where each sample contains feature information of the business object as a sample feature, and also includes a label corresponding to the prediction target, which may be a classification label or a regression value label. For example, in a specific example, the business object is a user represented by an account. Accordingly, the sample features may include, for example, the registration duration of the account, registration information, frequency of use in the recent period, frequency of commenting, etc.; the label may be a user classification label, for example, used to show the group to which the user belongs, or to show whether the account is an abnormal account (junk account, water army account, stolen account, etc.). In another example, the business object is a transaction. Accordingly, the sample features may include, for example, transaction amount, transaction time, payment channel, attribute information of both parties to the transaction, etc. This specification does not limit the business object, and the situations of various business objects are not repeated one by one.

[0057] In a typical federated learning process, the server determines the structure and algorithm of the business model to be trained, initializes it, and then updates the model through multiple iterations. In each iteration, the server sends the current parameters W of the model to each terminal. Each terminal i trains the model with the current parameters W based on its local training samples and obtains the gradient G of the model parameters. i , i.e., the parameter change or update amount. Then, terminal i sends the gradient information of the model parameters to the server. The server obtains N pieces of gradient information from N terminals respectively, aggregates the N pieces of gradient information, obtains the comprehensive gradient of the model parameters of this round of iteration, and updates the model parameters according to the comprehensive gradient until the training end condition is reached. Thus, the server and N terminals collaborate to realize the joint training of the model.

[0058] However, there is a risk of privacy leakage if the above federated learning process is implemented without protection. On the one hand, the parameter gradients obtained based on local samples may carry information about local samples, and these local samples are often private data that the data platform needs to protect, such as user personal information, bank statements, medical records, etc. Malicious attackers may obtain information about training samples from the gradient information exchanged between the terminal and the server. Alternatively, a terminal may infer the gradient information of other terminals from the parameter information sent by the server, and then infer its training sample data. In addition, there is also the problem of model output privacy, that is, attackers may infer whether a training sample contains specific data records by querying the model during or after training.

[0059] In order to protect the privacy data of each terminal during the federated learning process, the inventor proposes that the server uses a perturbation encryption algorithm to perturb and encrypt the model parameters before distributing them to each terminal. The terminal uses the perturbation encrypted model to process its local training samples to obtain the perturbation gradient. In order to prevent the server from restoring the true gradient using the decryption method corresponding to the perturbation encryption algorithm, the terminal also superimposes noise on the perturbation gradient. By carefully designing the distribution of noise, the noise after perturbation decryption conforms to the Gaussian distribution, thereby meeting the requirements of differential privacy protection. In this way, during the federated learning process, the true plaintext values ​​of the model parameters and gradients will not be exposed, thereby ensuring the security of private data.

[0060] The specific implementation process of the above concept is described below.

[0061] Figure 2A flowchart of a business model training method for protecting privacy according to an embodiment is shown. The flowchart involves a server and a first terminal, and the server can be implemented by any device, equipment, or device cluster with computing and processing capabilities. The first terminal is any terminal among multiple terminals participating in federated learning and can have any device type. For the purpose of simplicity and clarity, only one terminal is shown in this figure. However, it should be understood that multiple terminals in the federated learning process can implement the training process in the same manner as the first terminal.

[0062] The above business model can be implemented as a neural network, such as a multi-layer fully connected deep neural network DNN (or multi-layer perceptron MLP), a convolutional neural network CNN, etc. The following is a specific description with the example of a multi-layer perceptron MLP.

[0063] Figure 3 A schematic diagram showing multiple network layers in a neural network. Assume that the neural network contains L network layers, where any l-th network layer is denoted as layer l. When l = 1, it indicates that it is the input layer, when l = L, it indicates that it is the output layer, and in other cases it is an intermediate layer. In the case of MLP, each neuron in each network layer except the output layer is connected to each neuron in the next network layer. Assume that layer l has n l neurons, and the previous layer l-1 has n l-1 There are n neurons from layer l-1 to layer l. l-1 ×n l There are n connections, each with a corresponding weight, which is used as a model parameter to be trained in the model. Therefore, layer l has n l-1 ×n l model parameters, forming n l-1 ×n l dimensional parameter matrix, denoted as W (l) .

[0064] For a neural network that uses the Relu function as the neuron activation function, the output of each network layer l can be expressed as y (l) , and is calculated by the following formula:

[0065]

[0066] During the model training process, the parameter matrix W of each layer needs to be adjusted through multiple iterations. (l) to update. Figure 2 The process of any iterative update is shown below. The specific implementation process is described below.

[0067] First, in step 21, the server determines the corresponding random perturbation matrix for multiple network layers in the neural network. For network layer l, the server determines the corresponding random perturbation matrix R(l) , the random perturbation matrix R (l) As the key, it is used to compare the corresponding parameter matrix W (l) Perform perturbation encryption. Generally, perturbation encryption is to cover up the true value of the encrypted object by perturbation transformation. The corresponding inverse transformation can be used later to eliminate the influence of perturbation transformation. Here, in order to perform perturbation encryption on the parameter matrix, generally, the random perturbation matrix R is required. (l) With the parameter matrix W (l) have the same dimensions.

[0068] According to the specific method of perturbation transformation, different algorithms can be used to determine the perturbation matrix. In one embodiment, the corresponding random perturbation matrix can be independently and randomly generated for each network layer. Specifically, for network layer l, a corresponding number of matrix elements can be randomly generated according to the dimension of the parameter matrix of this layer as the corresponding random perturbation matrix R (l) .

[0069] In another embodiment, a corresponding random vector may be determined for each network layer of the neural network, and a perturbation matrix of each network layer may be further generated based on the random vector of each network layer. Specifically, for network layer l, a random vector r may be generated accordingly. (l) , so that the random vector r (l) The dimension of is related to the number of neurons n in layer l l In this way, the corresponding random perturbation matrix can be obtained by combining the elements in the random vectors of adjacent network layers.

[0070] For example, suppose network layer l has n l A random vector of dimension r (l) , whose previous network layer l-1 has n l-1 A random vector of dimension r (l-1) , then we can combine r (l) and r (l-1) elements in n l-1 ×n l The random perturbation matrix of dimension is used as the random perturbation matrix of layer l. For the input layer and output layer, special settings can be made to generate the corresponding random perturbation matrix.

[0071] In a specific example, for any network layer l, the random perturbation matrix R is generated based on the random vector in the following way (l) :

[0072]

[0073] That is, for the input layer l = 1, the corresponding random vector r (1)The elements in are used as matrix elements to obtain the random perturbation matrix R corresponding to the input layer. (1) ;

[0074] For the middle layer 2<=l<=L-1, the random vector r corresponding to the middle layer l is (l) Each vector element in The random vector r corresponding to the previous network layer l-1 (l-1) Each vector element in The reciprocal of is combined respectively, and the combined result is used as the random perturbation matrix R corresponding to the network layer l (l) Each matrix element in

[0075] For the output layer l = L, the random vector r corresponding to the previous layer L-1 is (L-1) The reciprocals of the elements in are used as matrix elements to obtain the random perturbation matrix R corresponding to the output layer. (L) .

[0076] The above example illustrates a method for determining a random perturbation matrix with good effects. In other examples, other random vector element combination methods can also be used. For example, for the middle layer, the elements in the random vectors of two adjacent layers are multiplied and combined to obtain the corresponding random perturbation matrix.

[0077] In one embodiment, a special random vector may be generated for the output layer l=L, so as to construct an additional perturbation matrix based on the above random perturbation matrix for subsequent perturbation encryption.

[0078] Specifically, for the L The output layer of neurons can generate n L dimensional random vectors γ and r a , where r a With pairs of different elements, the elements in γ can be divided into several non-overlapping groups, and the elements in each group are the same. i In this way, based on the above random vectors γ and r a , construct an additional perturbation matrix R for the output layer a :

[0079]

[0080] It should be understood that the random perturbation matrix of each network layer can be predetermined before each round of iteration and remain unchanged in multiple rounds of iterations; or it can be temporarily generated in each iteration. In order to better ensure privacy and security effects, it is preferred to regenerate the random perturbation matrix in each round of iteration.

[0081] On the basis of determining the random perturbation matrix of each network layer, the random perturbation matrix can be used as a perturbation encryption key to perform perturbation encryption processing on the parameter matrix of each network layer. Therefore, in step 22, the current parameter matrix of the corresponding network layer is perturbed using the random perturbation matrix to obtain the perturbation encryption parameter matrix of the network layer.

[0082] According to one embodiment, in this step, for each network layer l, the random perturbation matrix R corresponding to the network layer l is (l) With its current parameter matrix W (l) Combine the elements at the corresponding positions, for example, multiply and add, and use the combination result matrix as the perturbation encryption parameter matrix of the network layer. In the following text, the “^” symbol above a variable indicates that the variable is a perturbed variable.

[0083] In one embodiment, a special setting is made for the output layer. For the output layer L, the random perturbation matrix R corresponding to the output layer is (L) With its current parameter matrix W (L) Combine the elements at the corresponding positions and superimpose the additional perturbation matrix R for the output layer a , and obtain the perturbed encryption parameter matrix of the output layer.

[0084] In a specific example, the process of perturbing and encrypting the parameter matrices of each layer using a random perturbation matrix can be expressed as:

[0085]

[0086] Among them, the operator It is the Hadamard operation, which means multiplication of elements at corresponding positions.

[0087] Therefore, according to the example of formula (4), for the first L-1 network layers, their parameter matrices are bitwise multiplied by their random perturbation matrices to serve as the perturbed encrypted parameter matrix; for the output layer L, an additional perturbation matrix R is superimposed on the bitwise multiplication combination matrix a , and obtain its perturbed encryption parameter matrix.

[0088] It should be noted that formula (4) shows a perturbation encryption method with better effect. In other examples, other perturbation encryption algorithms can also be used.

[0089] Thus, through the above process, the perturbation encryption parameter matrix of each network layer is obtained This achieves perturbation encryption of the neural network.

[0090] Then, in step 23, the server sends the perturbation encryption model to multiple terminals, wherein the perturbation encryption model includes perturbation encryption parameter matrices corresponding to multiple network layers. The multiple terminals may be terminals participating in this round of iterative training, and the first terminal is any one of them.

[0091] The following takes the first terminal as an example to describe the processing process after the terminal side receives the perturbation encryption model.

[0092] As described above, the first terminal receives the perturbed encryption model through step 23. Then, in step 24, the first terminal processes its local first sample set using the perturbed encryption model to obtain a first noise gradient term for each network layer in the plurality of network layers.

[0093] Specifically, the first terminal can input the characteristic data of each sample in the first sample set into the perturbation encryption model, and obtain the perturbation output of each network layer l through forward propagation.

[0094] Continuing the MLP example using the Relu function shown in formula (1), the perturbation output of each network layer l is It can be expressed as:

[0095]

[0096] When the perturbed encryption parameter matrix is ​​obtained by using formula (4), by comparing the true output of each network layer in formula (1) with the perturbed output in formula (5), it can be deduced that the true output and the perturbed output satisfy the following relationship:

[0097]

[0098] In formula (6), γ and r a It is a special random vector generated for the output layer and used in the above formula (3).

[0099] After obtaining the perturbation output, back propagation is performed according to the perturbation output of each network layer using the label data of each sample and the preset loss function to obtain the first noise gradient term about the gradient corresponding to each network layer.

[0100] In one embodiment, the loss function uses the mean square error (MSE) loss function. As shown below:

[0101]

[0102] in, Represents label data.

[0103] From this, the true gradient can be derived and the perturbation gradient The relationship between:

[0104]

[0105] Where: v = r T And:

[0106]

[0107]

[0108] The α in (9) and (10) is the same as that defined in formula (6):

[0109] Therefore, in the case of the MSE loss function, in order to enable the server to perform perturbation recovery on the gradient, the first noise gradient term determined by the first terminal may include the perturbation gradient The disturbance term σ shown in formula (9) is (l) , and the disturbance term β shown in formula (10) (l) .

[0110] Similarly but slightly different, when the loss function takes the form of cross entropy CE loss, it can be proved that the following relationship is satisfied between the true gradient and the perturbation gradient:

[0111]

[0112] in,

[0113] β (l) The same as defined in formula (10), and the other parameter items are the same as those defined in formula (8).

[0114] Therefore, in the case of the cross entropy CE loss function, in order to enable the server to perform perturbation recovery on the gradient, the first noise gradient term determined by the first terminal may include the perturbation gradient The disturbance term ψ shown in formula (12) (l) , and the disturbance term β shown in formula (10) (l) .

[0115] However, as mentioned above, in order to protect data privacy, it is not desirable for the server to be able to fully recover the true value of the gradient. Therefore, next, in step 25, the second noise is superimposed on the first noise gradient term above to obtain the obfuscated gradient term for each network layer; wherein, in order to meet the requirements of differential privacy, the combination of the second noise and the random perturbation matrix of the corresponding network layer should satisfy the Gaussian distribution.

[0116] Here, we briefly introduce the Gaussian mechanism of differential privacy. Gaussian noise algorithm that satisfies differential privacy Has the following form:

[0117]

[0118] Among them, f is the query function, d is the input data, is the added Gaussian noise, which has a mean of 0 and a value of S f σ is the normal distribution (or Gaussian distribution) with standard deviation, where S f The sensitivity of the query function f is defined as the maximum difference in results that can be obtained when adjacent data d and d' are input into the function f.

[0119] We take the first noise gradient term in the form of cross entropy CE as an example to illustrate the addition of the second noise. Assume that for layer l, according to the Gaussian mechanism, in the first noise gradient term, especially the perturbation gradient The addition amplitude is S app The noise ∈ (l) , then the result of disturbance recovery on the server side will be:

[0120]

[0121] That is, multiply the noise amplitude and variance by the noise matrix ∈ (l) , as the second noise added to the first noise gradient term, the server side uses the random perturbation matrix R (l) The final noise after disturbance recovery is The final noise is the sum of the second noise and the corresponding random perturbation matrix R (l) In order to make the final noise conform to the Gaussian distribution Or to provide stronger privacy protection, the following conditions need to be met.

[0122] First, the upper bound of the sensitivity is S app , therefore, it is necessary to make That is, the noise amplitude is not less than the (infinite order) norm of the gradient.

[0123] In addition, it should also be possible to Satisfies Gaussian distribution, that is, the random perturbation matrix R (l)The matrix elements in are related to the noise matrix ∈ (l) The combination of matrix elements in Satisfies Gaussian distribution. To this end, it is necessary to use the decomposition principle of Gaussian distribution.

[0124] It can be proved mathematically (for example, see Losif Pinelis.2018.The exp-normal distribution is infinitely divisible.CoRR(2018)), assuming that Z is a Gaussian distributed variable and k is a natural number, then Z can be decomposed into k independent and identically distributed variables W1,...,W k The product of:

[0125]

[0126] Specific:

[0127] Among them, G 1 / k，0 , G 1 / k，1 ...are independent and identically distributed variables, each having a Gamma distribution Gamma(1 / k, 1) with shape parameter 1 / k and scale parameter 1.

[0128] In the following text, the case where a Gaussian distribution is decomposed into k variables is called k-ary decomposition, and the distribution of the decomposed variables is called the k-ary decomposition data distribution of the Gaussian distribution, denoted by DN(k).

[0129] The above principle can be used to solve Gaussian distribution problem.

[0130] In one embodiment, in the aforementioned step 21, the server independently and randomly generates a random perturbation matrix R for each network layer. (l) Elements of In such cases, the generated elements can be further restricted The process makes each element conform to the binary decomposition data distribution of Gaussian distribution, that is, DN(2); at the same time, the noise matrix ∈ generated by the first terminal (l) Each element in It should also comply with DN(2). It can satisfy Gaussian distribution.

[0131] In another embodiment, in the aforementioned step 21, the server generates a corresponding random perturbation matrix based on the combination of random vectors of each layer. For example, when the server uses formula (2) to determine the random perturbation matrix R (l) When It is expressed as follows:

[0132]

[0133] It can be seen that due to the random perturbation matrix R (l) The elements in come from different combinations of vector elements in the random vector. In order to meet the requirements of Gaussian distribution, contradictory requirements may be put forward for the vector elements in the random vector. For example, for the middle layer with 2≤l≤L-1, Decomposed into the product of 3 elements, each element should conform to DN(3). Then, for network layer l, when it is used as the current layer, it is necessary to require that each vector element in the random vector Satisfies DN(3); when analyzing layer l+1, taking layer l as the previous layer, it is required This is consistent with DN(3). This means that for the vector elements The data distribution poses contradictory requirements.

[0134] In order to resolve such conflicting requirements, in one embodiment, the original neural network is expanded. Figure 4 A schematic diagram of an extended neural network is shown. Assuming that the original neural network includes N actual network layers, a transition network layer is inserted between adjacent actual network layers to form N-1 transition network layers. Figure 4 In the figure, the actual network layer is shown in a thick solid frame, and the transition network layer is shown in a dotted frame. Thus, in the extended L-layer neural network, the odd-numbered layers are the actual network layers, and the even-numbered layers are the transition network layers.

[0135] The actual network layer has the parameter matrix W to be trained as mentioned above (l) , while the transition network layer has the unit matrix I as its parameter matrix, which is fixed and does not need to be trained. It only plays the role of passing the output of the previous actual network layer to the next actual network layer as it is. Therefore, the transition network layer has no effect on the processing of the actual sample data, but is only used to assist in generating the required random vectors.

[0136] Thus, based on the extended neural network, when the server uses formula (2) to determine the random perturbation matrix according to the random vector, the elements in the random vector of layer l are The following data distribution should be followed:

[0137]

[0138] That is to say, if network layer l is the middle layer (odd-numbered layer) in the actual network layer, the vector elements in its random vector conform to the Gaussian distribution of ternary decomposition data distribution DN(3). If network layer l is the middle layer in the transition network layer (even-numbered layer), the reciprocals of the vector elements in its random vector conform to DN(3). For the last transition network layer (L-1 layer), the reciprocals of the vector elements in its random vector conform to DN(2). In addition, for the input layer, the vector elements of its random vector conform to the Gaussian distribution of binary decomposition data distribution DN(2).

[0139] When an extended neural network is used, in one embodiment, the server generates random vectors according to the data distribution shown in formula (18) for all network layers, but only determines the random perturbation matrix R for the actual network layer. (l) , and calculate the perturbation encryption parameter matrix accordingly Accordingly, in step 23, the server only sends the perturbed encryption parameter matrix of the actual network layer to the first terminal.

[0140] In another embodiment, the server may also determine a random perturbation matrix for all network layers, calculate a perturbation encryption parameter matrix, and send the perturbation encryption parameter matrix of all network layers as a perturbation encryption model to the first terminal.

[0141] Accordingly, if the first terminal receives the actual network layer, it performs normal neural network forward propagation and backward propagation in step 24. If the first terminal receives the full network layer, in step 24, the network layer of the even-numbered layers can be ignored, and only the forward propagation and backward propagation are performed on the actual network layer.

[0142] And in step 25 the noise matrix ∈ for layer l is determined (l) When , the matrix elements satisfy the following constraints:

[0143]

[0144] That is, for the middle layer in the actual network layer (odd layer), each matrix element satisfies the ternary decomposition data distribution DN(3) of the Gaussian distribution; for the input layer and the output layer, each matrix element satisfies the binary decomposition data distribution DN(2) of the Gaussian distribution.

[0145] Combining the above formulas (17), (18) and (19), it can be proved that the combination Satisfies Gaussian distribution.

[0146] Specifically, for the input layer, since and All satisfy DN(2), and their product conforms to Gaussian distribution;

[0147] For the middle odd-numbered layers, i.e. the middle layers in the actual network layer, and All satisfy DN(3), and their product conforms to Gaussian distribution;

[0148] For the output layer, and They all satisfy DN(2) and their product conforms to the Gaussian distribution.

[0149] Next, in step 26, the first terminal sends the obfuscated gradient term superimposed with the second noise to the server. For example, in the case of cross entropy loss, the perturbed gradient superimposed with the noise and the disturbance term ψ (l) and β (l) , sent to the server. In the case of MSE loss, the perturbed gradient with noise is superimposed and the disturbance term σ (l) and β (l) , sent to the server.

[0150] Then, in step 27, the server uses the random perturbation matrix R corresponding to each network layer (l) , the confused gradient items of the corresponding network layers are restored to obtain the restored gradients of multiple network layers.

[0151] For example, in the case of cross entropy loss, the server can use the matrix R according to formula (14) (l) Perform restoration processing. In the case of MSE loss, a similar restoration process can be performed according to formula (8). The result of the restoration process is to superimpose the final noise on the true gradient As a result, Satisfying Gaussian distribution, the final noise can meet the requirements of differential privacy.

[0152] Therefore, in step 28, the server may aggregate the gradient recovery results obtained from each terminal, and update the current parameter matrix of each network layer according to the aggregation results, thereby realizing an iterative update of the model parameters.

[0153] Looking back at the above process, we can see that during the iterative update of the model, the server perturbs and encrypts the parameters of each network layer and sends them to the terminal. The terminal can directly process the sample data based on the perturbation encrypted model to obtain the perturbation gradient. The perturbation encryption of the model parameters ensures the security of the model parameters, and the perturbation encryption method allows the terminal to directly process the samples without decryption, which greatly saves the terminal's computing resources. Especially for small terminals with limited computing power, this method has obvious advantages. In addition, after obtaining the perturbation gradient, the terminal also adds noise to it, and makes the final noise after the perturbation is restored conform to the Gaussian distribution, thereby meeting the requirements of differential privacy. Therefore, the server and other parties have no way of obtaining the true value of the gradient, which further ensures the security of private data.

[0154] According to an embodiment of another aspect, a device for a joint training business model based on privacy protection is also provided. The device is deployed in a server, and the server can be implemented as any device or device cluster with computing and processing capabilities. Figure 5 FIG. 1 is a schematic diagram of a training device deployed in a server according to an embodiment. Figure 5 As shown, the training device 500 includes:

[0155] A perturbation matrix determination unit 51 is configured to determine corresponding random perturbation matrices for a plurality of network layers in the neural network;

[0156] The perturbation encryption unit 52 is configured to perform perturbation processing on the current parameter matrix of the corresponding network layer using the random perturbation matrix to obtain the perturbation encryption parameter matrix of the network layer;

[0157] A sending unit 53 is configured to send a perturbation encryption model to multiple terminals, wherein the perturbation encryption model includes perturbation encryption parameter matrices corresponding to the multiple network layers;

[0158] The receiving unit 54 is configured to receive, from any first terminal among the multiple terminals, the obfuscated gradient terms respectively corresponding to the multiple network layers, wherein the obfuscated gradient term is obtained by superimposing a second noise on a first noise gradient term, wherein the first noise gradient term is obtained by processing a first sample set local to the first terminal using the perturbation encryption model, and a combination result of the second noise and the random perturbation matrix of the corresponding network layer satisfies a Gaussian distribution;

[0159] A disturbance recovery unit 55 is configured to use the random perturbation matrices corresponding to the multiple network layers to perform recovery processing on the confusion gradient items of the corresponding network layers to obtain gradient recovery results of the multiple network layers;

[0160] The aggregation updating unit 56 is configured to aggregate the gradient recovery results corresponding to the multiple terminals, and update the current parameter matrices of the multiple network layers according to the aggregation results.

[0161] According to one embodiment, the perturbation matrix determination unit 51 includes (not shown): a random vector determination module, configured to determine the corresponding random vector for each network layer of the neural network, wherein the dimension of the random vector is the same as the number of neurons in the corresponding network layer; a matrix determination module, configured to determine the random perturbation matrix corresponding to the first network layer based on the random vector of the first network layer and the random vectors of its adjacent network layers, wherein the first network layer is an intermediate layer in the neural network.

[0162] In one embodiment, the neural network includes N actual network layers to be trained, and N-1 transition network layers inserted between adjacent actual network layers, and the transition network layer has a fixed unit matrix as its parameter matrix; in this case, the random vector determination module is specifically configured as follows: for each intermediate layer in the actual network layer, a first random vector is determined; for each transition network layer, a second random vector is determined; wherein the vector elements in the first random vector and the second random vector have different data distributions.

[0163] Furthermore, in an example, each vector element in the above-mentioned first random vector conforms to the ternary decomposition data distribution of the Gaussian distribution; the reciprocal of each vector element in the above-mentioned second random vector conforms to the ternary decomposition data distribution of the Gaussian distribution; the first network layer is the middle layer in the actual network layer; in this case, the above-mentioned matrix determination module is specifically configured as: each vector element in the first random vector corresponding to the first network layer and the reciprocal of each vector element in the second random vector corresponding to the previous transition network layer of the first network layer are respectively combined, and the combination results are used as the matrix elements in the random perturbation matrix corresponding to the first network layer.

[0164] In one embodiment, the random vector determination module is further configured to: determine a third random vector for the input layer in the actual network layer, wherein each vector element conforms to the binary decomposition data distribution of the Gaussian distribution; and the matrix determination module is further configured to: use the elements in the third random vector corresponding to the input layer as matrix elements to obtain a random perturbation matrix corresponding to the input layer.

[0165] In one embodiment, the random vector determination module is further configured to determine, for the last transition network layer, a last second random vector, wherein the reciprocals of the respective vector elements conform to the binary decomposition data distribution of the Gaussian distribution; and the matrix determination module is further configured to: for the output layer in the actual network layer, use the reciprocals of the respective elements in the last second random vector as matrix elements to obtain a random perturbation matrix corresponding to the output layer.

[0166] According to one embodiment, the aforementioned multiple network layers are the N actual network layers to be trained.

[0167] According to one embodiment, the perturbation encryption unit 52 is specifically configured as follows: for each network layer other than the output layer in the N actual network layers, the random perturbation matrix corresponding to the network layer is combined with its current parameter matrix at corresponding positions to obtain the perturbation encryption parameter matrix of the network layer; for the output layer, the random perturbation matrix corresponding to the output layer is combined with its current parameter matrix at corresponding positions, and an additional perturbation matrix for the output layer is superimposed to obtain the perturbation encryption parameter matrix of the output layer.

[0168] In various embodiments, the business model is used to make predictions for a business object, and the business object includes one of the following: a user, a merchant, a transaction, an image, a text, and an audio.

[0169] According to yet another embodiment, a device for a joint training business model based on privacy protection is also provided. The device is deployed in a first terminal, and the first terminal can be any type of terminal computing device. Figure 6 FIG. 1 is a schematic diagram of a training device deployed in a terminal according to an embodiment. Figure 6 As shown, the training device 600 includes:

[0170] The receiving unit 61 is configured to receive a perturbation encryption model from a server, wherein the perturbation encryption parameter matrix corresponding to each of the plurality of network layers in the neural network is obtained by perturbing a current parameter matrix of the network layer using a random perturbation matrix of the corresponding network layer;

[0171] A gradient acquisition unit 62 is configured to process a first sample set local to the first terminal using the perturbation encryption model to obtain a first noise gradient term for each network layer in the multiple network layers;

[0172] A noise adding unit 63 is configured to superimpose a second noise on the first noise gradient term to obtain a confusion gradient term for each network layer; wherein a combination result of the second noise and the random perturbation matrix of the corresponding network layer satisfies a Gaussian distribution;

[0173] The sending unit 64 is configured to send the confused gradient item to the server, so that it uses the random perturbation matrix to restore the confused gradient item of the corresponding network layer, and aggregate the restored gradients corresponding to multiple terminals, thereby updating the current parameter matrices of the multiple network layers.

[0174] In one embodiment, the neural network includes N actual network layers to be trained, and N-1 transition network layers inserted between adjacent actual network layers, wherein the transition network layer has a fixed unit matrix as its parameter matrix; the multiple network layers are the N actual network layers to be trained.

[0175] According to one embodiment, the gradient acquisition unit 62 is specifically configured as follows: inputting the feature data of each sample in the first sample set into the perturbation encryption model to obtain the perturbation output of each network layer; and obtaining the first noise gradient term based on the perturbation output of each network layer, the label data of each sample and the preset loss function.

[0176] In one embodiment, the noise adding unit 63 is specifically configured to: determine the noise matrix corresponding to each network layer; multiply the noise matrix by a preset noise amplitude and variance as the second noise corresponding to each network layer, and superimpose it on the first noise gradient term, wherein the noise amplitude is not less than the norm of the gradient.

[0177] Furthermore, the noise adding unit 63 determines the noise matrix corresponding to each network layer, which may include: for the middle layer among the multiple network layers, determining a first noise matrix, wherein each matrix element satisfies the ternary decomposition data distribution of the Gaussian distribution; for the input layer and the output layer of the multiple network layers, determining a second noise matrix, wherein each matrix element satisfies the binary decomposition data distribution of the Gaussian distribution.

[0178] Through the above devices, the perturbation encryption of the model and the differential privacy processing of gradient noise can be used to protect the model parameters and gradient data from being leaked, thereby ensuring the security of private data.

[0179] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described.

[0180] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 2 The method described.

[0181] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0182] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for jointly training a business model based on privacy protection, comprising: The server uses a perturbation encryption algorithm to perturb and encrypt the model parameters of the business model, and then distributes the perturbation to multiple terminals; Each terminal processes its local training samples using the perturbation encrypted model to obtain the perturbation gradient; Each terminal superimposes noise on the disturbance gradient so that the final noise after disturbance decryption conforms to Gaussian distribution; The server updates the service model according to the gradient after disturbance decryption.

2. A method for jointly training a business model based on privacy protection, executed by a server, comprising: The model parameters of the business model are perturbed and encrypted using a perturbation encryption algorithm, and then distributed to multiple terminals; Receive a perturbation gradient after superimposing noise from each terminal, where the perturbation gradient is obtained by the corresponding terminal processing its local training sample using a perturbation encrypted model, and the perturbation gradient after superimposing noise makes the final noise after perturbation decryption conform to a Gaussian distribution; The business model is updated according to the gradient after disturbance decryption.

3. The method according to claim 2, wherein: The business model is implemented by a neural network, and a perturbation encryption algorithm is used to perturb and encrypt model parameters of the business model, including: For each network layer l in the neural network, determining a corresponding random perturbation matrix; The original parameter matrix of the network layer 1 is multiplied by the corresponding random perturbation matrix at the corresponding positions, and the perturbation encryption parameter matrix of the network layer is obtained based on the multiplication result.

4. The method according to claim 3, wherein: The network layer l is the middle layer of the neural network; for each network layer l in the neural network, the corresponding random perturbation matrix is ​​determined, including: Each vector element in the random vector corresponding to the intermediate layer and the reciprocal of each vector element in the random vector corresponding to the previous network layer are combined respectively, and the combination results are used as each matrix element in the random perturbation matrix corresponding to network layer l.

5. A method for jointly training a business model based on privacy protection, performed by a first terminal among multiple terminals, comprising: Receive from the server a model obtained by perturbing and encrypting the model parameters of the business model using a perturbation encryption algorithm; Use the perturbation encrypted model to process local training samples and obtain the perturbation gradient; Superimposing noise on the perturbation gradient so that the final noise after perturbation decryption conforms to Gaussian distribution; The disturbance gradient of the superimposed noise is sent to the server, so that it updates the business model according to the gradient after the disturbance decryption.

6. The method according to claim 5, wherein: The business model is implemented by a neural network, and noise is superimposed on the disturbance gradient, including: Determine the noise matrix corresponding to each network layer; The noise matrix is ​​multiplied by the preset noise amplitude and variance as the noise corresponding to each network layer, and is superimposed on the disturbance gradient.

7. The method according to claim 5, wherein: The business model is used to make predictions for users, and the local training samples include sample features and user classification labels; the sample features include at least one of the following: registration duration, registration information, frequency of use in recent period, and frequency of commenting.

8. The method according to claim 5, wherein: The business model is used to predict transactions, and the local training samples include sample features and transaction category labels; the sample features include at least one of the following: transaction amount, transaction time, payment channel, and attribute information of both parties to the transaction.

9. A system for a joint training business model based on privacy protection, comprising a server and a plurality of terminals, wherein: The server is used to use a perturbation encryption algorithm to perturb and encrypt the model parameters of the business model and then distribute them to multiple terminals; Each terminal is used to process its local training sample using the perturbation encrypted model to obtain a perturbation gradient; and superimpose noise on the perturbation gradient so that the final noise after perturbation decryption conforms to a Gaussian distribution; The server is further used to update the service model according to the gradient after disturbance decryption.

Images