A method, device and medium for federated learning for privacy protection

Abstract

The present invention relates to a federated learning method for privacy protection, which combines compressed sensing technology with adaptive local differential privacy technology to securely protect data privacy. Compressed sensing is used to reduce the parameter scale of the model itself, while also reducing the amount of noise added to the model when differential privacy is applied to add noise. The adaptive method of adding noise can further reduce the added noise, making the final total communication volume lower than other methods that use differential privacy and compression or quantization simultaneously. In terms of data privacy protection, adaptive data perturbation is performed based on the differences in the range of weight values of each layer. This can further reduce the total amount of noise and improve data availability without compromising data privacy, thereby improving the accuracy of the model.

Description

Technical Field

[0001] The present disclosure relates to the technical field of data privacy protection, and in particular to a federated learning method, device, and medium for privacy protection. Background Art

[0002] Federated learning is an AI technology being widely researched and used. Its goal is to enable efficient machine learning across multiple participants or computing nodes while ensuring information security during big data exchange, protecting the privacy of end-user data and personal data, and ensuring legal compliance. Therefore, federated learning can protect the privacy of training sample data among collaborative participants and resolve the data silo problem.

[0003] Lichao Sun et al. proposed a method to improve the accuracy of the model by adaptively perturbing all weight values according to the difference in the range of weight values of each layer in the deep neural network when applying local differential privacy technology to protect data in the federated learning deep neural network model in their paper "LDP-FL: Practical Private Aggregation in Federated Learning with Local Differential Privacy" (arXiv preprint arXiv: 2007.15789(2020)). The method first randomly selects K clients to participate in the training at the beginning of each round of training t on the server side, and uses the latest global model w t-1 Distributed to these K clients, the clients start to perform local training in parallel; then client k trains the model on the local dataset Use stochastic gradient descent to train and get a new local model After that, client k is based on the model The weight value range of each weight w in its own layer (i.e., w∈(cr, c+r), where c is the center of the weight range and r is the radius of the weight range) is adaptively perturbed. Since multiple clients apply local differential privacy, when aggregated on the server side, the privacy budget of each local k Will be accumulated, resulting in the total privacy budget explosion, so the author also proposed a mechanism to split and shuffle the weights of the local model before uploading the model to the server to ensure data privacy. Specifically, the client k first uses a unique id to shuffle the perturbed local model. Mark the generation position of the weight w in (that is, the position of the layer where the weight w is located) and get w id , and then randomly sample from the uniform distribution U(0, T) to generate a delayed sending time t id, where T>0 is formed by negotiation between the server and all clients, w id Will wait for t id Then upload it to the server, such as Figure 1 As shown; Finally, the server collects all {id, w id}, after determining the id corresponding to w, perform average aggregation.

[0004] In the above method, adding noise to all weights results in a total noise that is proportional to the size of the model. Modern neural network models typically contain a large number of parameters, known as the curse of dimensionality. Applying differential privacy to protect data security on this basis can lead to excessive noise and an explosion in total communication traffic, ultimately significantly reducing data availability and severely impacting model performance. When adaptively perturbing data, the parameters of each layer are perturbed to only two fixed values, defeating the purpose of true adaptation. Summary of the Invention

[0005] In response to the above-mentioned existing technologies, the technical problem solved by the present invention is that when using deep neural networks for federated learning, the high dimensionality of the model causes excessive communication overhead, and the application of local differential privacy technology to protect data privacy introduces excessive noise, resulting in reduced model accuracy.

[0006] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0007] First, a privacy-preserving federated learning method is proposed, which includes the following steps:

[0008] On the server, after randomly initializing all weights of the first model, the server sends them to the randomly uniformly selected clients;

[0009] On the client, the first model is trained using the client's local data to obtain a second model, which is then compressed to obtain a third model. Based on the weight variation range of each layer of the third model, noise is added to the weights of each layer. After a randomly determined delay, the client sends the noisy weights to the server.

[0010] After the server receives the weights uploaded by all clients, it updates the first model.

[0011] In this technical solution, compressed sensing technology is used to reduce the size of the model's parameters. This reduces the amount of noise added to the model when differential privacy is applied, thereby reducing communication overhead. Regarding data privacy, this method considers the variability of weight changes within each layer of the neural network. Perturbing data based on the range of these changes can further reduce the overall amount of noise. Most importantly, this improves data availability and model accuracy without compromising data privacy.

[0012] As a further improvement of the present invention, the training method adopted by the second model includes: stochastic gradient descent method, full gradient descent method, small batch gradient descent method, Momentum gradient descent method, NAG gradient descent method or other gradient descent methods to accelerate model convergence.

[0013] As a further improvement of the present invention, the noise is added using an adaptive method, and the added noise is reduced in an adaptive manner, so that the final total communication volume is lower than other methods that use differential privacy and compression or quantization at the same time. When performing self-use perturbation, it is performed according to the range of weight values of each layer in the model. The range of weight values of each layer is different, and the differences between layers are obvious, thereby improving the accuracy of the model. The present invention includes the following steps by adding all noise:

[0014] Select a weight value w without adding noise from layer l, and the weight range of this layer is [c l -r l , c l +r l ], c l Indicates the center of the weight change range, r l Indicates the radius of the weight change range;

[0015] Calculate the probability as follows:

[0016]

[0017] Where: ε is the privacy budget;

[0018] Perform random sampling according to the above probability to obtain the value of variable u;

[0019] If the variable u is equal to 1, the weight value after adding noise is:

[0020]

[0021] otherwise:

[0022]

[0023] Where: μ is the weight value w relative to cl The offset of .

[0024] As a further improvement of the present invention, updating the first model includes the following steps:

[0025] For each received weight, determine the structural position of the weight, average and aggregate all weights at the same structural position to obtain the current fourth model, denoted as y t ;

[0026] Based on the fourth model, the following formula is used to reduce the error and obtain the error correction model, which is denoted as e t :

[0027]

[0028] Where ρ and η are hyperparameters; u0 is the initial momentum, e0 is the initial error correction; t is the current communication round; u t is the momentum in the current iteration; u t-1 is the momentum in the previous iteration; e t is the current error correction model; e t-1 is the last accumulated error;

[0029] Decompression is performed on the error correction model to obtain an updated first model.

[0030] Secondly, a federated learning device for privacy protection is proposed, including a server and a client. The server randomly initializes all weights of a first model and sends them to randomly uniformly selected clients. After receiving the weights uploaded by all clients, the first model is updated.

[0031] The client trains the first model using local data to obtain the second model; compresses the second model to obtain the third model; adds noise to the weights of each layer based on the weight variation range of each layer of the third model; and after waiting for a delay period determined by a random method, the client sends the noisy weights to the server.

[0032] As an improvement to the above technical solution, the client adds noise through an adaptive method, including:

[0033] Select a weight value w without adding noise from layer l, and the weight range of this layer is [c l -r l , c l +r l ], c l Represents the center of the weight change range, r l Indicates the radius of the weight change range;

[0034] Assign a random value to the variable u so that its value follows the Bernoulli distribution and calculate the probability according to the following formula:

[0035]

[0036] Where: ε is the privacy budget;

[0037] Perform random sampling according to the above probability to obtain the value of variable u;

[0038] If the variable u is equal to 1, the weight value after adding noise is:

[0039]

[0040] otherwise:

[0041]

[0042] Where: μ is the weight value w relative to c l The offset of .

[0043] As an improvement to the above technical solution, the server determines the structural position of each received weight, averages and aggregates all weights at the same structural position, and obtains the current fourth model, which is recorded as y t Based on the fourth model, the following formula is used to reduce the error and obtain the error correction model, which is recorded as e t :

[0044]

[0045] Where ρ and η are hyperparameters; u0 is the initial momentum, e0 is the initial error correction; t is the current communication round; u t is the momentum in the current iteration; u t-1 is the momentum in the previous iteration; e t is the current error correction model; e t-1 is the last accumulated error; the error correction model is decompressed to obtain an updated first model; the accumulated error is the difference between the error correction model corresponding to the updated first model and the model obtained by compressed sensing of the updated first model.

[0046] In the above technical solution, the delay time is subject to (0, T s ) is evenly distributed, T s is a hyperparameter.

[0047] In a third aspect, a computer-readable storage medium is proposed, wherein the memory stores a computer program that can be loaded by a processor and execute any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0049] Figure 1 , Schematic diagram of the shuffling mechanism;

[0050] In the figure: M1, M2, M3, M4, M5 represent models; a i , b i , c i It is model M i Parameters;

[0051] Figure 2 , a flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The terms "first", "second", "third" and "fourth" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first", "second", "third" and "fourth" may explicitly or implicitly include one or more of the features. The models involved in the present invention can be general neural network models, deep neural network models, and convolutional neural network models. The operations of the flowchart may not be implemented in sequence. On the contrary, the operations may be implemented in reverse order or simultaneously. In addition, one or more other operations may be added to the flowchart. One or more operations may be removed from the flowchart.

[0053] In one embodiment, using Figure 2 The flowchart shown implements a training method in a federated learning environment for privacy protection, and the model to be trained is a deep neural network model.

[0054] (1) Server initialization

[0055] (1a) The server and all clients jointly negotiate an initial identical weight variation range (C0, R0) based on prior knowledge, where C0 represents the center of the weight variation range and R0 represents the radius of the weight variation range, i.e., all weights w in the model vary within the range [C0-R0, C0+R0]. The joint negotiation is used to assign initial values to the model weights, hyperparameters required for training, etc. during the initialization phase to accelerate model convergence. The present invention is not limited to a specific initialization implementation method, i.e., there can be no joint negotiation, and the server can start training after random initialization.

[0056] When the server initializes the first model, the weight range of each layer of the first model is set to be the same to facilitate program initialization, but the weight range of each layer can also be negotiated separately. The present invention is not limited to a specific implementation. The first model is a global model.

[0057] (1b) The server randomly initializes all weights in the first model w0 according to the weight variation range (C0, R0). After the client trains the first model, the server receives the relevant parameters of the trained model for aggregation. A preferred method is to mark the structural position of the model where the weight is located with a unique ID during initialization. When the structural position is uniquely marked, the first model w0 can be expressed as follows:

[0058]

[0059] Where n is the number of weights in the model.

[0060] (1c) Initialize the hyperparameters ρ and η. Specifically, ρ = 0.9 and η = 0.01. η can be adjusted dynamically during iterations, for example, increasing by 0.005 each iteration. It can also be set to a maximum value, such as 0.5, where it is no longer adjusted. Initial momentum u0 = 0, and initial error correction e0 = 0. Set the total number of communication rounds between the server and the client to T, and the communication round variable to t, where t = 1, 2, …, T.

[0061] (2) Server selects client

[0062] (2a) For each round of communication t, the server randomly and uniformly selects some clients from all clients to participate in training. The set of clients selected for training is denoted as K, and a single client is denoted by k.

[0063] (2b) The server sends the latest first model w t-1 Distributed to all clients in the client set K, after which the clients begin to perform local training in parallel and synchronously.

[0064] (3) Client local training

[0065] (3a) Client k receives the latest global model w t-1 Then, use it as a local model Client k uses the local dataset D k , for the local model Apply stochastic gradient descent SGD training to obtain a new local model This is referred to as the second model and can be expressed as follows:

[0066]

[0067] Where: T k Represents the total number of local update iterations when training the model using stochastic gradient descent (SGD).

[0068] The stochastic gradient descent method in this step can also be replaced by the full gradient descent method, the mini-batch gradient descent method, the momentum gradient descent method, the NAG gradient descent method, or other gradient descent methods.

[0069] For the second model obtained by training, the maximum value max and minimum value min of each layer weight are obtained, and the center c of each layer can be calculated l With radius r l :

[0070] r l =max-c l .

[0071] (3b) Client k pairs of the second model Apply compressed sensing C to compress the original n weights into m weights, where m < n, and obtain the compressed local model, which is recorded as the third model Right now:

[0072]

[0073] Compressed sensing technology compresses the weights of neural network models to reduce communication overhead. This step can be replaced by model pruning techniques to reduce the number of model weights. This method selects unimportant parameters in the model and removes them without significantly affecting the model's performance. The most common model pruning technique directly changes the structure of the model network, that is, deleting some layers in the network. Alternatively, regularization terms can be used to constrain weight updates, making them more sparse and most weights equal to 0. This step can also be replaced by model quantization techniques to reduce communication overhead. This method compresses the original network by reducing the number of bits required to represent each weight.

[0074] (3c) For the third model For each layer in the , the corresponding weight change range is recorded as (c l , r l ), where the subscript l represents the layer. Client k sequentially Each layer weight w∈(c l , r l ) to adaptively add noise. Adaptive data perturbation is performed based on the weight variation range of each layer, allowing parameters to be perturbed to multiple values. Furthermore, due to the significant differences between layers, data availability and model accuracy can be improved without compromising data privacy.

[0075] The method of adaptively adding noise is as follows:

[0076] (3c.1): Calculate the weight value w from the center of change c l Offset:

[0077] μ←wc l

[0078] (3c.2): According to the privacy budget ε, weight value w and its corresponding c l and r l , calculate the probability Pr according to the following formula:

[0079]

[0080] Random sampling is performed according to the above probability to obtain the value of the variable u; in a preferred embodiment, the randomly sampled variable u obeys the Bernoulli distribution.

[0081] (3c.3): If the variable u is equal to 1, then the weight value after perturbation is:

[0082]

[0083] Otherwise, the perturbed weight value is:

[0084]

[0085] Where: μ is the weight value w relative to c l The offset of .

[0086] (3c.4): Use w * Replace the weight w, that is:

[0087] w←w *

[0088] And the local model after perturbation is recorded as

[0089] The amount of noise added by the above method is less than that of the existing technology, which is beneficial to reducing communication overhead.

[0090] (3d) For For each weight w in the structure, client k marks its structural position with a unique id to obtain w id ; Then from the uniform distribution U(0, T s ) randomly samples a s The delay time t id , client k is waiting for t id After a certain time, w id Upload to the server to avoid the total privacy budget explosion and ensure data privacy. s is a hyperparameter that can be negotiated by all clients before the start of federated learning. For example, each client k proposes its own T s，k , then calculate The median value of T s , you can also use T s Choosing not the average, but the median protects against attacks from a single dishonest client.

[0091] (4) Server Update

[0092] (4a) The server receives the model weights w uploaded by all clients id After that, first determine the position id of the weight, and then average all weights with the same structural position. The only model obtained after the average aggregation is recorded as the fourth model, which is recorded as y t ,Right now:

[0093]

[0094] (4b) The server reduces the negative impact of the error in the fourth model to avoid model divergence caused by the error caused by compression, which is conducive to model convergence. The steps include:

[0095] (4b.1) Calculate the momentum:

[0096] u t ←ρu t-1 +y t

[0097] (4b.2) Calculate the error feedback:

[0098] e t ←ηu t +e t-1

[0099] This is equivalent to the fourth model y t Perform error correction and transform into error correction model e t .

[0100] (4c) Server Error Correction Model e t A decompression operation D is performed to restore it from m weights to n weights, where m < n.

[0101] The decompressed model is as follows:

[0102] w t ←D(e t ,n)

[0103] At this time, the decompressed model w t It is the latest global model after this round of optimization, that is, the first model after update.

[0104] (4d) If the communication round is not completed, calculate the next error accumulation, and the server calculates the latest global model w t Perform compressed sensing operation, namely C(w t , m), and then with the error e t Do the difference and get the new cumulative error, which is:

[0105] e t ←e t -C(w t ,m)

[0106] (5) Loop iteration optimization:

[0107] After that, the server and the client repeat steps (2), (3) and (4) until the number of cycles reaches the predetermined total number of communication rounds T, and the final global model w is obtained. T .

[0108] During implementation, the present invention can be realized as a device according to the method, including a server and a client. The server randomly initializes all weights of the first model and sends them to the randomly uniformly selected clients; after receiving the weights uploaded by all the clients, the first model is updated;

[0109] The client trains the first model using local data to obtain the second model; compresses the second model to obtain the third model; adds noise to the weights of each layer based on the weight variation range of each layer of the third model; and after waiting for a delay period determined by a random method, the client sends the noisy weights to the server.

[0110] In the above device, the client adds noise by an adaptive method, including:

[0111] Select a weight value w without adding noise from layer l, and the weight range of this layer is [c l -r l , c l+r l ], c l Represents the center of the weight change range, r l Indicates the radius of the weight change range;

[0112] Assign a random value to the variable u so that its value follows the Bernoulli distribution and calculate the probability according to the following formula:

[0113]

[0114] Where: ε is the privacy budget;

[0115] Perform random sampling according to the above probability to obtain the value of variable u;

[0116] If the variable u is equal to 1, the weight value after adding noise is:

[0117]

[0118] otherwise:

[0119]

[0120] Where: μ is the weight value w relative to c l The offset of .

[0121] In the above device, the server determines the structural position of each received weight, averages and aggregates all weights at the same structural position, and obtains the current fourth model, which is recorded as y t Based on the fourth model, the following formula is used to reduce the error and obtain the error correction model, which is recorded as e t :

[0122]

[0123] Where ρ and η are hyperparameters; u0 is the initial momentum, e0 is the initial error correction; t is the current communication round; u t is the momentum in the current iteration; u t-1 is the momentum in the previous iteration; e t is the current error correction model; e t-1 is the last accumulated error; the error correction model is decompressed to obtain an updated first model; the accumulated error is the difference between the error correction model corresponding to the updated first model and the model obtained by compressed sensing of the updated first model.

[0124] To sum up, the overall idea of the present invention is: after the local model is trained, compressed sensing technology is applied to the model to compress it from the original n parameters to m parameters, where m<n; adaptive differential privacy, according to the weight value range of the layer where the model parameters are located, the m parameters are adaptively perturbed in turn; parameter shuffling, the parameters of the local model are first split into separate weights and then shuffled, and each weight is uploaded to the server after a random delay time; the server performs model aggregation and decompression operations to restore it to a complete model, and performs error accumulation calculation to reduce the error impact caused by compressed sensing.

[0125] Through the above description of the embodiments, those skilled in the art will clearly understand that the disclosed method or apparatus can be implemented by means of software plus necessary general-purpose hardware, or can also be implemented by means of dedicated hardware, including application-specific integrated circuits, dedicated CPUs, dedicated memories, dedicated components, etc. Generally speaking, any function performed by a computer program can be easily implemented by corresponding hardware. Moreover, the specific hardware structures used to implement the same function can also be diverse, such as analog circuits, digital circuits, or dedicated circuits. However, for the present disclosure, software program implementation is often the preferred embodiment.

[0126] Although the embodiments of the present invention have been described above with reference to the accompanying drawings, the present invention is not limited to the above-mentioned specific embodiments and application fields. The above-mentioned specific embodiments are merely illustrative and instructive, and are not restrictive. A person skilled in the art, guided by this specification and without departing from the scope of protection of the claims of the present invention, may also devise various forms, all of which fall within the scope of protection of the present invention.

Claims

1. A federated learning method for privacy protection, characterized in that: The method comprises the following steps: On the server, after randomly initializing all weights of the first model according to the weight variation range, the server sends the latest first model to the randomly uniformly selected client; wherein, during the initialization, the structural position where the weight is located is marked with a unique ID; On the client, the first model received is trained using the client's local data to obtain the second model, and the maximum value (max) and minimum value (min) of each layer's weight are obtained to calculate the second model. Center of layer ,radius ; Compress the original n weights of the second model into m weights to obtain the third model; Based on the weight range of each layer of the third model Subscript Representation layer, adding noise to each layer weight, including: calculating the offset μ of each layer weight w from the center of change, according to the privacy budget , weight w and its corresponding and , calculate the probability, randomly sample a Bernoulli variable ,if is equal to 1, then the weight after perturbation is , otherwise, the weight value after perturbation is And mark the structural position of the weight with a unique id. After waiting for a delay time determined by a random method, the client sends the weight with noise to the server; After the server receives the weights uploaded by all clients, it determines the structural position of the weights and averages all weights with the same structural position. After average aggregation, the fourth model is obtained. , based on the fourth model Perform error correction to obtain the error correction model, denoted as : Where, 、 is a hyperparameter; is the initial momentum, is the initial error correction; is the current communication round; is the momentum in the current iteration; is the momentum in the previous iteration; is the last accumulated error, where the accumulated error is the difference between the error correction model corresponding to the updated first model and the model obtained by performing compressed sensing on the updated first model; decompressing the error correction model to obtain the updated first model; The server and the client repeat the above process until the number of cycles reaches the predetermined total number of communication rounds T, and the final first model is obtained; Here, m is less than n.

2. The method according to claim 1, characterized in that The training methods used by the second model include: stochastic gradient descent, full gradient descent, mini-batch gradient descent, momentum gradient descent, NAG gradient descent or other gradient descent methods.

3. The method according to claim 1, characterized in that According to the privacy budget , weight w and its corresponding and Calculate the probability according to the following formula : 。 4. The method according to claim 1, wherein The delay duration is subject to evenly distributed, It is a hyperparameter that is negotiated and determined by all clients before federated learning.

5. A federated learning device for privacy protection, comprising a server and a client, characterized in that: The server randomly initializes all weights of the first model according to the weight variation range, and then sends the latest first model to the randomly uniformly selected clients; after receiving the weights uploaded by all clients, the server updates the first model; wherein, during the initialization, the structural position where the weight is located is marked with a unique ID; The client uses the client's local data to train the received first model to obtain the second model, and obtains the maximum value max and minimum value min of each layer weight, and calculates the first Center of layer ,radius ; Compress the original n weights of the second model into m weights to obtain the third model; Based on the weight range of each layer of the third model , subscript Representation layer, adding noise to each layer weight, including: calculating the offset μ of each layer weight w from the center of change, according to the privacy budget , weight w and its corresponding and , calculate the probability, randomly sample a Bernoulli variable ,if is equal to 1, then the weight after perturbation is , otherwise, the weight value after perturbation is and mark the structural position of the weight with a unique id; after waiting for a delay period determined by a random method, the client sends the weight with noise to the server; After the server receives the weights uploaded by all clients, it determines the structural position of the weights and averages all weights with the same structural position. After average aggregation, the fourth model is obtained. , based on the fourth model Perform error correction to obtain the error correction model, denoted as : Where, 、 is a hyperparameter; is the initial momentum, is the initial error correction; is the current communication round; is the momentum in the current iteration; is the momentum in the previous iteration; is the last accumulated error, where the accumulated error is the difference between the error correction model corresponding to the updated first model and the model obtained by performing compressed sensing on the updated first model; decompressing the error correction model to obtain the updated first model; The server and the client repeat the above process until the number of cycles reaches the predetermined total number of communication rounds T, and the final first model is obtained; Here, m is less than n.

6. The device according to claim 5, characterized in that According to the privacy budget , weight w and its corresponding and Calculate the probability according to the following formula : 。 7. The device according to claim 5, characterized in that The delay duration is subject to evenly distributed, is a hyperparameter.

8. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method according to any one of claims 1 to 4.

Images