A semi-centralized adversarial training method for federated learning

Abstract

The present invention discloses a semi-centralized adversarial training method for federated learning, which belongs to the intersection of security and artificial intelligence. Specifically, the method comprises the following steps: first, for a federated learning framework, the features to be trained first are determined, and a sample data set with feature labels is obtained; and based on the sample attributes, an adversarial generative model is pre-trained so that the model can generate adversarial samples targeting these attributes; then, the adversarial generative model is split into an encoder and a decoder, the encoder is sent to a client, and a federation process is started; the client uses the received encoder to encode a small number of local random samples (5%-10%) and sends them to a server; after receiving the samples in each round, the server uses the adversarial samples to fine-tune the parameters of the federated learning framework and finally publishes them; the present invention realizes the application of adversarial training in a distributed federated learning framework to improve model performance.

Description

Technical Field

[0001] The present invention belongs to the intersection of security and artificial intelligence, and specifically is a semi-centralized adversarial training method for federated learning. Background Art

[0002] In 2016, Google first proposed federated learning in its AI predictions for input methods. Federated learning is a framework for joint model training by multiple users. It incorporates data privacy protection technologies and mechanisms based on traditional distributed machine learning. As privacy-sensitive data increasingly restricts the development of big data, federated learning has become one of the few machine learning technologies that can provide privacy protection solutions.

[0003] However, federated learning is not perfect. Due to the loss of model performance during the joint training process of multiple users, the model's performance on prediction tasks is expected to be lower than that of centralized machine learning. Therefore, it is necessary to propose corresponding optimization methods based on federated learning, a special distributed machine learning framework, so that the learning ability of the federated learning model can be improved to the point where it can participate in prediction tasks in commercial activities. Summary of the Invention

[0004] To address the above problems, the present invention proposes a semi-centralized adversarial training method for federated learning. While optimizing the performance of federated learning based on a special generative adversarial network, it reduces the leakage of user privacy and the consumption of communication resources, thereby achieving efficient and targeted performance optimization of federated learning.

[0005] The specific steps are as follows:

[0006] Step 1: During the federated learning process, for the feature items to be trained first, obtain a dataset with feature labels and divide it into a training set and a test set;

[0007] Step 2: According to the rules of federated learning, the server determines the number of clients and performs probabilistic sampling of the training set so that each client receives the same number of training sets.

[0008] Point the client's local data pointer to the assigned training set and attach the training set directory to each client;

[0009] The contents of the directory include: (1) the number of training set samples of this client; (2) the label distribution of the training set of this client; (3) the label distribution of the priority feature items of the training set of this client.

[0010] Step 3: For the horizontal federated learning architecture with a central server, use the training set to pre-train the adversarial generative model VAE;

[0011] The adversarial generation model VAE includes: encoder Encoder, decoder Decoder, mean vector mu of latent variables, logarithmic variance vector logvar of latent variables, and Reparameterization method of latent variable sampling.

[0012] In addition, the pre-training steps are as follows:

[0013] Step 301: Initialize the encoder, decoder, and fully connected neural network MLP;

[0014] Step 302: Input the image sample x to the encoder to obtain the latent variable z; the decoder decodes the latent variable z into an adversarial sample, and the MLP uses the partial variable z of the latent variable z as the adversarial sample. a As input, the prediction and discrimination result a of the optimized features is obtained;

[0015] Step 303: Substitute the input sample x, latent variable z, and predicted discrimination result a into the loss function to calculate the loss value of the current adversarial sample.

[0016] The loss function loss calculation formula is:

[0017] L(p,q)=E q ( z |x)[logp(x|z)]-KLD(q(z|x)||p(z))+E[a|z a ]

[0018] Among them, E represents the expected result, q (z|x) represents the output of the encoder, that is, the distribution of the latent variable; p(x|z) represents the output of the decoder, that is, the generated adversarial sample; p(z) represents the representation of z under the standard normal distribution, KLD represents the KL divergence distance between the latent variable distribution and the standard normal distribution, E[a|z a ] indicates that according to the variable z a Predict the expected results of the features to be optimized;

[0019] The loss function includes the following loss terms: the cross entropy between the original image sample and the adversarial sample pixel value distribution, the KL divergence distance between the latent variable distribution and the standard normal distribution, and the cross entropy between the predicted priority feature and the actual feature label.

[0020] Step 304: Back propagation is performed using stochastic gradient descent according to the loss value to update the parameters of the encoder, decoder, and MLP.

[0021] Step 4: The central server sends the encoder parameters in the trained model VAE to each user end, and at the same time sends the number ratio parameters of the collected samples;

[0022] Specifically:

[0023] First, the central server generates a homomorphic encryption public key and private key, encrypts the encoder parameters using the public key, and encrypts a series of task parameters at the same time; including: (1) the proportion of training data selected locally by the client; (2) the name of the feature that is prioritized for training on the server side; and (3) the number and position of the hidden variables that need to be randomized.

[0024] Then, the central server sends the private key to each client through a secure channel, sends the encoder parameters and task parameters to each client through the public network, and waits for the client to respond with a receipt mark.

[0025] After receiving the encoder parameters and task parameters, the client uses the private key to decrypt them and performs legitimacy verification after decryption. If the data is verified to be legal, a received flag is sent to the server; otherwise, a retransmission flag is sent to the server.

[0026] Legitimacy verification includes: (1) whether the data format is correct; (2) whether the data content is within the normal range.

[0027] The server waits for the client message, and if there is a retransmission flag, it immediately retransmits the parameter information until all participants have sent the received flag.

[0028] Step 5: The central server applies the homomorphic encryption algorithm Pallier to regenerate the public and private keys, sends the model parameters and public keys of the federated learning architecture to each client, and keeps the private key locally on the server.

[0029] Step 6: The client uses the local training set to update the model parameters of the federated learning architecture and sends a local training completion signal to the server. At the same time, the client randomly selects local data, encodes it using the trained encoder, obtains a feature vector through reparameterized random sampling, and encapsulates it and sends it to the central server.

[0030] The method for generating the feature vector is as follows:

[0031] First, the client randomly selects 5%-10% of the local data and uses this data as the input of the encoder to obtain the mean and logarithmic variance of the latent variables;

[0032] Then, random sampling is performed through the reparameterization operation to assign values ​​to each latent variable;

[0033] Specifically, a value is randomly selected from the standard normal distribution, added to the mean, and then multiplied by the standard deviation to assign a value to each latent variable;

[0034] The standard deviation is obtained by raising the logarithmic variance to the power of the square root of e.

[0035] Finally, for the latent variable vector after assignment, the part corresponding to the priority feature is encapsulated after adding random noise.

[0036] Step 7: The server receives the updated model parameters of the federated learning architecture and performs weighted averaging on them. At the same time, the decoder is used to convert the feature vector sent by the client into an adversarial sample, and this is used as training data to further fine-tune the model parameters of the federated learning architecture after weighted averaging.

[0037] The specific steps are as follows:

[0038] First, the server collects a fixed number of model parameters, performs a weighted average of them with the parameters of the current federated learning model, and decodes them using the server's local private key.

[0039] Then, the server collects a fixed number of feature vectors and decodes them through a local decoder to obtain adversarial samples with added noise. It then uses local data samples and adversarial samples to retrain and fine-tune the model parameters of the federated learning architecture. After the parameter update is completed, it is sent down to complete this round of the federation process.

[0040] Step 8: The server publishes the fine-tuned federated learning architecture and checks whether the federation process is complete; if not, return to step 5.

[0041] The advantages of the present invention are:

[0042] 1) A semi-centralized adversarial training method for federated learning, which can significantly improve the performance of federated learning models, enabling them to meet the requirements of prediction tasks in commercial environments; at the same time, it can improve the federated learning model's ability to learn specific attributes.

[0043] 2) A semi-centralized adversarial training method for federated learning. Compared with previous technologies of the same type, it can better protect user privacy information, while reducing the amount of data transmitted during communication and improving the operating speed of the federated learning system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 Schematic diagram of the framework of the semi-centralized adversarial training of the present invention;

[0045] Figure 2 This is a flow chart of a semi-centralized adversarial training method for federated learning according to the present invention;

[0046] Figure 3 is a schematic diagram of the adversarial sample generated in the present invention;

[0047] Figure 4 Schematic diagram of the improvement of task prediction accuracy achieved by the adversarial learning method implemented in the present invention;

[0048] Figure 5 Schematic diagram of communication data consumption of the adversarial learning method implemented by the present invention compared with other optimization schemes; DETAILED DESCRIPTION

[0049] The present invention will be further described in detail below with reference to the accompanying drawings and implementation examples.

[0050] The present invention provides a semi-centralized adversarial training method for federated learning, such as Figure 1 As shown, first, for the federated learning framework, the features to be trained first are determined, and a sample data set with feature labels is obtained; and according to the sample attributes, a customized adversarial generation model is pre-trained so that this model can generate adversarial samples for each attribute; then, the adversarial generation model is split into an encoder and a decoder, the encoder is sent to the client, and the federation process is started; the client uses the received encoder to encode a small number of local random samples of 5%-10% and sends them to the server; after receiving the samples in each round, the server uses these adversarial samples to fine-tune the parameters of the federated learning framework and publish them; the present invention realizes the application of adversarial training in a distributed federated learning framework to improve the performance of the model.

[0051] like Figure 2 The specific steps are as follows:

[0052] Step 1: For the horizontal federated learning architecture with a central server, determine the features that need to be trained first, obtain a dataset with these feature labels, and divide it into a training set and a test set;

[0053] Features are labels that are different from the prediction task and are generally important and sensitive information. This type of information often has a significant impact on the model's predictive performance, so it is necessary to explicitly utilize this important information in the prediction task to improve model performance.

[0054] In the standard training and testing processes of machine learning, the data set needs to be divided, generally into 90% training set and 10% test set; in the present invention, the pre-training data set also needs to be divided according to a certain ratio.

[0055] Pretraining is a method of initializing parameters during the training process. When the model's predictive performance is sufficiently good, the trained model's parameters are saved so that the trained model can achieve better results the next time it performs a similar task. The final federated learning model in this invention is somewhat dependent on the quality of pretraining, so it is necessary to determine whether pretraining is complete by observing the performance of the pretraining task.

[0056] Step 2: According to the rules of federated learning, the training set is distributed to each client so that each client has a roughly equal number of samples;

[0057] All users in federated learning have equal status. In the actual operation of the federated learning system, the probability weight of each participant is generally determined based on the number of samples contributed by each participant. Before the federated learning process begins, the specific process is as follows:

[0058] First, the server determines the number of clients and probabilistically samples the training set based on the number of clients, so that the probability of each client being sampled is roughly the same;

[0059] Then, point the client's local data pointer to the assigned training set;

[0060] Finally, attach the training set directory to each client;

[0061] The contents of the directory include: (1) the number of training set samples of this client; (2) the label distribution of the training set of this client; (3) the label distribution of the priority feature items of the training set of this client.

[0062] The reason for adding a data directory is to enable the client to quickly check and send some label information about the data locally without having to perform statistics every time, thereby speeding up the execution and interaction efficiency of federated learning.

[0063] Step 3: Initialize the federated learning architecture on the central server and use the training set to pre-train the adversarial generative model VAE (Variational Autoencoder);

[0064] Variational Auto-Encoders (VAE), a form of deep generative model, are a generative network structure based on variational Bayesian (VB) inference. Unlike traditional autoencoders that describe the latent space numerically, VAE describes the observation of the latent space probabilistically, showing great application value in data generation and adversarial training. The structure and method of the VAE adversarial generative model are as follows:

[0065] Encoder: Encoder, a neural network that maps high-dimensional input to low-dimensional output, generally using a multi-layer fully connected neural network or a convolutional network;

[0066] Decoder: A neural network that maps low-dimensional input to high-dimensional output, typically using a multi-layer fully connected neural network or a deconvolutional network.

[0067] mu: the mean vector of the latent variable, obtained through encoder learning;

[0068] logvar: the logarithmic variance vector of the latent variable, obtained through encoder learning;

[0069] Reparameterization: A latent variable sampling method, typically by randomly selecting a value from a standard normal distribution, adding the mean, and multiplying it by the standard deviation.

[0070] In addition, the steps for pre-training VAE are as follows:

[0071] Step 301: Split the variational autoencoder into an encoder and a decoder, and initialize the encoder, decoder, and fully connected neural network MLP.

[0072] The encoder encodes the image data into latent variables, and the decoder decodes the latent variables into image data;

[0073] Step 302: Input the image data x to the encoder to obtain the latent variable z; the decoder decodes the latent variable z into an adversarial sample, and the MLP uses the partial variable z of the latent variable z as the adversarial sample. a As input, the prediction and discrimination result a of the optimized features is obtained;

[0074] Step 303: Substitute the input data x, latent variable z, and predicted discrimination result a into the loss function to calculate the loss value of the current adversarial example.

[0075] The loss function loss calculation formula is:

[0076] L(p,q)=E q ( z |x)[logp(x|z)]-KLD(q(z|x)||p(z))+E[a|z a ]

[0077] Among them, E represents the expected result, q (z|x) represents the output of the encoder, that is, the distribution of the latent variable; p(x|z) represents the output of the decoder, that is, the generated sample; p(z) represents the representation of z under the standard normal distribution, KLD represents the KL divergence distance between the latent variable distribution and the standard normal distribution, E[a|z a ] indicates that according to the variable z a Predict the expected results of the features to be optimized;

[0078] The loss function includes the following loss terms:

[0079] Cross entropy of the pixel value distribution of the original sample and the adversarial sample: Cross entropy is mainly used to determine the closeness between the actual output and the expected output, and measures the degree of difference between the generated adversarial sample and the original sample;

[0080] KL divergence between the latent variable distribution and the standard normal distribution: KL divergence, also known as relative entropy, is a measure of the asymmetry between two probability distributions. In information theory, relative entropy is equivalent to the difference in the Shannon entropy of the two probability distributions. To improve the generalization ability of the model, this regularization term is designed as a pre-training regularization term to measure the degree of difference between the current distribution of the latent variable and the standard normal distribution.

[0081] Cross entropy between the predicted priority features and the actual feature labels: measures the correlation between the original latent variables and the priority features.

[0082] Step 304: Back propagation is performed using stochastic gradient descent according to the loss value to update the parameters of the encoder, decoder, and MLP.

[0083] Step 4: The central server sends the encoder parameters in the trained model VAE to each user end, and at the same time sends the number ratio parameters of the collected samples;

[0084] Specifically:

[0085] First, the central server generates a homomorphic encryption public key and private key, encrypts the encoder parameters using the public key, and encrypts a series of task parameters at the same time; including: (1) the proportion of training data selected locally by the client; (2) the name of the feature that is prioritized for training on the server side; and (3) the number and position of the hidden variables that need to be randomized.

[0086] Homomorphic encryption is a cryptographic technique based on computational complexity theory, a mathematical puzzle. Homomorphic encryption involves processing homomorphically encrypted data to produce an output that, when decrypted, is identical to the output obtained by processing the original, unencrypted data using the same method.

[0087] Then, the central server sends the private key to each client through a secure channel, sends the encoder parameters and task parameters to each client through the public network, and waits for the client to respond with a receipt mark.

[0088] After receiving the encoder parameters and task parameters, the client uses the private key to decrypt them and performs legitimacy verification after decryption. If the data is verified to be legal, a received flag is sent to the server; otherwise, a retransmission flag is sent to the server.

[0089] Legitimacy verification includes: (1) whether the data format is correct; (2) whether the data content is within the normal range.

[0090] The server waits for the client message, and if there is a retransmission flag, it immediately retransmits the parameter information until all participants have sent the received flag.

[0091] Step 5: The central server starts the federated training process, sends the parameters of the current federated model to each client, determines the number of clients to be sampled in this round, and waits for the client to send a local training completion signal;

[0092] The specific sending method is that the server applies the homomorphic encryption algorithm Pallier, regenerates the public key and private key, sends the model parameters and public key of the federated learning architecture to each client, and keeps the private key locally on the server.

[0093] Keeping the private key locally on the server can prevent attacks from third parties on the public network.

[0094] Step 6: The client receives the model parameters of the federated learning architecture and uses the local training set to train and update the federated learning architecture parameters. At the same time, the client randomly selects 5%-10% of local data, encodes it into latent variables using the trained encoder, randomly samples the latent variables to obtain feature vectors and encapsulates them, and finally sends a local training completion signal to the server.

[0095] The method for generating the feature vector is as follows:

[0096] First, the client randomly selects 5%-10% of the local data and uses this data as the input of the encoder to obtain the mean and logarithmic variance of the latent variables;

[0097] Then, sampling is performed through reparameterization. Reparameterization is a technique to avoid the non-differentiability of random values ​​in neural networks. The specific method is to randomly select a value from the standard normal distribution, add the mean, and then multiply it by the standard deviation. The standard deviation is obtained by raising the logarithmic variance to the power of the square root of e. This can be used to assign a value to each latent variable.

[0098] After assigning values ​​to the latent variable vector, random noise is added to the portion corresponding to the priority feature. This noise is generally a random value from a standard normal distribution. The client encapsulates this latent variable vector and finally encapsulates all vectors again.

[0099] Step 7: The server receives the model parameters of the federated learning architecture updated by the client, performs weighted averaging on them, and updates the federated model parameters. At the same time, the server receives the feature vector sent by the client, converts it into an adversarial sample using a decoder, and uses it as training data to fine-tune the federated model parameters.

[0100] The specific steps are as follows:

[0101] First, the server collects a fixed number of model parameters, weights them and averages them with the current federated learning model parameters, and decodes the model parameters using the local private key after the calculation is complete.

[0102] Then, the server collects a fixed number of feature vectors and decodes them through the local decoder to obtain adversarial samples with added noise. It uses local data samples and adversarial samples to retrain and fine-tune the parameters of the state learning model. After the parameter update is completed, it is sent down to complete this round of federation process.

[0103] Adversarial examples such as Figure 3 As shown in the figure, in the first set of two images, the left one is the original sample, and the right one is the adversarial sample. The adversarial sample changes the "skin color" of the original sample, so "skin color" is the feature that is expected to be prioritized for training. In the second set of two images, the left one is the original sample, and the right one is the adversarial sample. The adversarial sample changes the "color" of the original sample, so "color" is the feature that is expected to be prioritized for training.

[0104] Step 8: The server publishes the federated model of the federated learning architecture and checks whether the federation process is complete; if not, return to step 5.

[0105] The termination of the federated process depends on the termination command. If no termination command is issued, the process will continue. Each time the server publishes a model, it can be considered as one round of the federated process.

[0106] Specific examples:

[0107] The method described in this invention is used to optimize adversarial training for federated learning. The federated learning simulation platform PySyft in Python is used to simulate the federated framework. In the simulation, 5 groups of users and 1 central server are instantiated. The CelebA public dataset is used. Figure 4 Figure 2 shows the change in prediction accuracy of the federated learning model before and after adversarial optimization for five user groups. Comparing the experimental results, we can see that while the accuracy improvements across the five user groups are not exactly the same, they all show some improvement, with the maximum improvement reaching 13.3%. This fully demonstrates the superiority of the proposed method over the original federated learning framework in prediction tasks.

[0108] The communication consumption of the method described in the present invention is compared with that of another federated learning optimization solution widely used in the commercial market, such as Figure 5 As shown in the figure, communication volume consumption can measure the communication cost and communication efficiency of the federated learning system. It can be seen that as the federation process proceeds, the reduction in communication volume by the method described in the present invention will gradually increase, effectively reducing the communication cost, improving the communication efficiency and the overall operating efficiency of the federated learning system.

Claims

1. A semi-centralized adversarial training method for federated learning, characterized by: The specific steps are as follows: First, during the federated learning process, a dataset with feature labels is obtained for the feature items to be trained first, and then divided into a training set and a test set. According to the rules of federated learning, the server performs probabilistic sampling on the training set based on the number of clients. The data set is an image sample; Then, for the horizontal federated learning architecture with a central server, the training set is used to pre-train the adversarial generative model VAE; The central server sends the encoder parameters of the trained VAE model to each client, along with the number of collected samples. Simultaneously, the central server applies the homomorphic encryption algorithm Pallier to regenerate the public and private keys, and sends the model parameters and public key of the federated learning architecture to each client, while keeping the private key locally on the server. The client uses the training set to update the model parameters of the federated learning architecture and sends it to the server. At the same time, it randomly selects 5%-10% of local data, encodes it into latent variables using the trained encoder, obtains feature vectors through reparameterized random sampling, and encapsulates them and sends them to the central server. Finally, the server receives the updated model parameters of the federated learning architecture and performs weighted averaging on them. At the same time, the decoder is used to convert the feature vector sent by the client into an adversarial sample, and the sample is used as training data to fine-tune the model parameters of the federated learning architecture after weighted averaging for final release.

2. A semi-centralized adversarial training method for federated learning according to claim 1, characterized in that: The local data pointer of each client points to the allocated training set, and a training set directory is attached to each client; The contents of the directory include: (1) the number of training set samples of this client; (2) the label distribution of the training set of this client; (3) the label distribution of the priority feature items of the training set of this client.

3. A semi-centralized adversarial training method for federated learning according to claim 1, characterized in that: The adversarial generation model VAE includes: an encoder, a decoder, a mean vector mu of latent variables, a logarithmic variance vector logvar of latent variables, and a sampling method Reparameterization of latent variables; The steps for pre-training the adversarial generative model VAE are as follows: Step 301: Initialize the encoder, decoder, and fully connected neural network MLP; Step 302: Input the image sample x to the encoder to obtain the latent variable z; the decoder decodes the latent variable z into an adversarial sample, and the MLP uses the partial variable z of the latent variable z as the adversarial sample. a As input, the prediction and discrimination result a of the optimized features is obtained; Step 303: Substitute the input sample x, latent variable z, and predicted discrimination result a into the loss function to calculate the loss value of the current adversarial sample. The loss function loss calculation formula is: L(p,q)=E q(z|x) [logp(x|z)]-KLD(q(z|x)||p(z))+E[a|z a ] Where E represents the expected result, q(z|x) represents the output of the encoder, that is, the distribution of the latent variable; p(x|z) represents the output of the decoder, that is, the generated adversarial sample; p(z) represents the representation of z under the standard normal distribution, KLD represents the KL divergence distance between the latent variable distribution and the standard normal distribution, E[a|z a ] indicates that according to the variable z a Predict the expected results of the features to be optimized; Step 304: Perform back propagation using stochastic gradient descent based on the loss value to update the parameters of the encoder, decoder, and MLP.

4. A semi-centralized adversarial training method for federated learning according to claim 1, characterized in that: The central server sends the encoder parameters in the trained model VAE to each user terminal, and at the same time sends the number ratio parameters of the collected samples, specifically: First, the central server generates a homomorphic encryption public key and private key, encrypts the encoder parameters using the public key, and encrypts a series of task parameters at the same time; including: (1) the proportion of training data selected locally by the client; (2) the name of the feature that the server prioritizes for training; (3) the number and position of the latent variables that need to be randomized; Then, the central server sends the private key to each client through a secure channel, sends the encoder parameters and task parameters to each client through the public network, and waits for the client to respond with a receipt mark; After receiving the encoder parameters and task parameters, the client uses the private key to decrypt them and performs a legitimacy verification after decryption. If the data is verified to be legal, a received flag is sent to the server; otherwise, a retransmission flag is sent to the server. Legality verification includes: (1) whether the data format is correct; (2) whether the data content is within the normal range; The server waits for the client message, and if there is a retransmission flag, it immediately retransmits the parameter information until all participants have sent the received flag.

5. A semi-centralized adversarial training method for federated learning according to claim 1, characterized in that: The method for generating the feature vector is specifically as follows: First, the client randomly selects 5%-10% of the local data and uses this data as the input of the encoder to obtain the mean and logarithmic variance of the latent variables; Then, random sampling is performed through the reparameterization operation to assign values ​​to each latent variable; Specifically, a value is randomly selected from the standard normal distribution, added to the mean, and then multiplied by the standard deviation to assign a value to each latent variable; The standard deviation is obtained by raising the logarithmic variance to the power of the square root of e; Finally, for the latent variable vector after assignment, the part corresponding to the priority feature is encapsulated after adding random noise.

6. A semi-centralized adversarial training method for federated learning according to claim 1, characterized in that: The server-side fine-tunes the model parameters of the federated learning architecture. The specific steps are as follows: First, the server collects a fixed number of model parameters, performs a weighted average of them with the parameters of the current federated learning model, and decodes them using the server's local private key. Then, the server collects a fixed number of feature vectors and decodes them through a local decoder to obtain adversarial samples with added noise. It then uses local data samples and adversarial samples to retrain and fine-tune the model parameters of the federated learning architecture. After the parameter update is completed, it is sent down to complete this round of the federation process.

Images