A federated learning method with efficient communication, privacy protection and attack resistance

Abstract

The application discloses a kind of communication efficient, privacy protection and attack-resistant federated learning methods, steps are as follows: each user node obtains the latest model parameter from server, calculates gradient, uploads the index set of several components with the largest absolute value in gradient to server node;Server receives the index set sent by all user nodes, calculates the union of all user node index sets and broadcasts to user node;Each user node calculates compressed gradient according to the index set broadcasted by server, applies security aggregation technology to protect the privacy of compressed gradient, and then uploads to server node;Server node calculates the final gradient according to the compressed gradient and index set sent by each user node through aggregation function and sends to user node;Repeat the above training steps until the stop condition is met;Finally, server informs each user node to stop.The application has communication efficiency, privacy protection and robustness to attack, and is widely applicable to various federated learning applications.

Description

TECHNICAL FIELD

[0001] The present application relates to machine learning technology, in particular, a communication efficient, privacy preserving and attack resistant federated learning method. BACKGROUND

[0002] Federated learning is a distributed machine learning technique, whose core idea is to exchange intermediate results such as model gradient updates among users, so as to train a joint model using local data from multiple users without revealing the local data of users. Considering a traditional federated learning setting with m users and a central server, the goal of federated learning is to solve the following finite and optimization problem:

[0003]

[0004] where w is the model parameter, d is the parameter dimension, f i (w) is the empirical loss of parameter w on the i-th training sample. Dkrepresents the local training data set on the k-th user. F k (w) is the local loss function of the k-th user. p k is the weight of the k-th user, satisfying p k > 0 and Many federated learning methods are based on distributed stochastic gradient descent and its variants, where users update the model parameters locally according to their own training data, and then communicate with the server at each iteration to aggregate the model.

[0005] Byzantine robustness is an important problem in federated learning. In federated learning, faults occurring at the user end or in network transmission may not be discovered and resolved in time, and at the same time, some user ends may be maliciously invaded, intentionally sending incorrect or even harmful information, thus causing some user nodes to be untrustworthy. To solve this problem, there are three different techniques, which are redundant computation, server verification and robust aggregation. Redundant computation requires different users to compute gradients according to the same training samples, which is mainly used in traditional data center based distributed learning, but due to privacy principles, it is not applicable in federated learning. In the server verification method, the server verifies the updates of the clients according to a public clean data set. However, in many cases, it is difficult to obtain a large-scale high-quality public data set. Compared with the above two methods, the method based on robust aggregation has a wider range of applications.

[0006] In many real-world applications, the server and users of federated learning are connected through a wide area network. Compared with the network in a data center, the wide area network has the characteristics of poor stability and small bandwidth. In addition, many machine learning models are large in size, resulting in huge communication overhead in the training process. Therefore, communication efficiency is an important problem in federated learning. In federated learning, the methods for reducing communication overhead mainly include local update techniques and communication compression techniques such as quantization and sparsification.

[0007] In addition, federated learning also faces the problem of privacy security. Although federated learning can ensure that the original training data of users is not leaked, many research works have pointed out that through intermediate results such as model gradient updates, malicious attackers can still infer the privacy information in the original training data of users. To solve the problem of privacy attacks by malicious servers through model updates uploaded by users in federated learning, existing privacy protection methods mainly adopt the technical routes of differential privacy, homomorphic encryption, and secure multi-party computation. Among them, the secure aggregation technology based on secure multi-party computation and Shamir secret sharing can ensure that the server only obtains the average value of the global model update, and cannot obtain the local model parameters (or gradients) of a single client.

[0008] In summary, communication efficiency, privacy protection, and robustness to attacks are three important aspects of federated learning. In practical applications, all three aspects of performance of federated learning methods need to be considered. However, in the existing public content, there are almost no federated learning methods that consider all three aspects at the same time. SUMMARY

[0009] Objectives: The purpose of the present application is to provide a federated learning method that is communication-efficient, privacy-protecting, and attack-resistant, so as to achieve communication optimization while ensuring the robustness of the Byzantine learning algorithm, and to enable the direct application of secure aggregation technology to sparse vectors without obstacles under the condition of consensus on sparse index at each user node, thereby realizing the function of privacy protection.

[0010] Technical solutions: The federated learning method according to the present application is communication-efficient, privacy-protecting, and attack-resistant, and comprises the following steps:

[0011] (1) Each user node obtains the latest model parameters from the server, calculates the gradient according to the locally stored training data, and uploads the index set of the largest absolute value components in the gradient to the server node;

[0012] (2) The server receives the index sets sent by all user nodes, calculates the union of all user node index sets, and broadcasts to the user nodes;

[0013] (3) Each user node calculates the compressed gradient according to the index set broadcasted by the server, applies secure aggregation to the compressed gradient for privacy protection, and then uploads to the server node;

[0014] (4) The server node calculates the final gradient according to the compressed gradient and the index set sent by each user node through the aggregation function, and then sends the final gradient to the user node;

[0015] (5) The above training steps are repeatedly performed until the stopping condition is met, and the server notifies each user node to stop.

[0016] The specific steps of the method in the training process on the server node are:

[0017] S101, input the number of user nodes m, the iteration round T, and the aggregation function Aggr(·);

[0018] S102, let t = 0, initialize the model parameter w0, and send it to all user nodes;

[0019] S103, wait to receive the index set from any user node k

[0020] S104, judge whether the number of received index sets is equal to m; if not, return to step S103; if yes, calculate and broadcast to all user nodes;

[0021] S105, coordinate the communication between each user to complete secure aggregation;

[0022] S106, receive the local compressed gradient from any user node k

[0023] S107, judge whether the number of received sparse gradients is equal to m; if not, return to step S106; if yes, use S t and restore all sparse gradients

[0024] S108, calculate the final gradient update

[0025] S109, broadcast the compressed gradient update to all user nodes;

[0026] S110, judge whether t = T is met at this time, if not, let t = t + 1, return to step S103 to continue training; if yes, notify each user node to stop working.

[0027] The specific steps of the training process at the k-th user node are as follows:

[0028] S201, A subset of the input training sample set And the batch size l and learning rate η for each sampling t Number of user nodes m, sparsity factor κ;

[0029] S202. Let t = 0, receive the model parameters w0 sent by the server node, and simultaneously initialize the local error accumulation vector.

[0030] S203, From local dataset Randomly selected samples

[0031] S204. Based on the selected samples Calculate the stochastic gradient Then it means The corresponding loss function in the current model parameters w t The gradient below;

[0032] S205, Calculation

[0033] S206, Calculation by The largest absolute value A set consisting of the indices of each component

[0034] S207, will Send to the server node;

[0035] S208. Receive the index set S from the server node. t ;

[0036] S209, according to S t calculate For each j∈S t ,make For each of the remaining dimensions j, let in(·) j This represents the value of the j-th component of the vector;

[0037] S210, through secure aggregation technology, To protect privacy;

[0038] S211. Send the compressed gradient, protected by secure aggregation, to the server node.

[0039] S212. Receive compressed gradient updates from the server node.

[0040] S213, using and S t recovery

[0041] S214, updating model parameters updating

[0042] S215, determining whether a stop working message sent by the server node is received, if not, returning to step S203 and continuing training, if yes, ending training.

[0043] In the steps S103-S104, the server calculates the union set of the gradient indexes sent by each user node, and broadcasts to all user nodes, so as to reach a consensus on the index information on each user node.

[0044] In the steps S204-S211, the user node sends the indexes of the components with the largest absolute values in the random gradient to the server, and calculates the sparse gradient vector according to the consensus index information returned by the server, and sends it to the server after privacy protection by the secure aggregation technology.

[0045] A computer storage medium, having a computer program stored thereon, the computer program being executed by a processor to implement the above-mentioned federated learning method with efficient communication, privacy protection and attack resistance.

[0046] A computer device, comprising a storage, a processor and a computer program stored on the storage and executable on the processor, wherein the processor implements the above-mentioned federated learning method with efficient communication, privacy protection and attack resistance when executing the computer program.

[0047] Advantages: Compared with the prior art, the present application has the following advantages: the present application uses the server to reach a consensus on the sparse indexes among the user nodes, which can effectively prevent the robustness of the Byzantine learning algorithm from being affected by the sparse technology, and at the same time, the secure aggregation technology is applied for privacy protection, so that the distributed learning algorithm can be prevented from being negatively affected by the untrusted nodes, and the communication cost of the distributed machine learning can be effectively reduced. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 The step flow chart of the method of the present application;

[0049] Figure 2 The working flow chart of the method of the present application on the server node;

[0050] Figure 3 The working flow chart of the method of the present application on the user node. DETAILED DESCRIPTION

[0051] The technical solutions of the present application are further described below in combination with the drawings.

[0052] As Figures 1-2 indicated, the present application provides a communication-efficient, privacy-protecting and attack-resistant federated learning method, mainly applied to distributed machine learning with cross-institutional and multi-party cooperation, suitable for scenarios with large model parameter scale and high communication cost. In addition, the present application can be applied to scenarios requiring strong robustness and strong privacy protection, such as cooperation tasks between different hospitals, different banks or different enterprises. Taking medical image analysis under cooperation of different hospitals as an example, in the present application, the training data is stored locally at each user node, and a central server node is used to coordinate each institution to complete model training. An embodiment of the present application is as follows:

[0053] Workflow on the server node:

[0054] S101, input the number of user nodes m, the number of iterations T, and the aggregation function Aggr(·);

[0055] S102, let t = 0, initialize the model parameter w0, and send it to all user nodes;

[0056] S103, wait to receive an index set

[0057] S104, determine whether the number of received index sets is equal to m; if not, return to step S103; if yes, calculate and broadcast to all user nodes;

[0058] S105, coordinate communication between user nodes to complete secure aggregation;

[0059] S106, receive local compressed gradients

[0060] S107, determine whether the number of received sparse gradients is equal to m; if not, return to step S106; if yes, use S t and restore all sparse gradients

[0061] S108, calculate the final gradient update

[0062] S109, broadcast the compressed gradient update to all user nodes;

[0063] S110. Determine whether t = T is satisfied at this time. If not, let t = t + 1 and return to step S103 to continue training. If yes, notify each user node to stop working.

[0064] Workflow on the k-th user node:

[0065] S201, A subset of the input training sample set And the batch size l and learning rate η for each sampling t Number of user nodes m, sparsity factor κ;

[0066] S202. Let t = 0, receive the model parameters w0 sent by the server node, and simultaneously initialize the local error accumulation vector.

[0067] S203, From local dataset Randomly selected samples

[0068] S204. Based on the selected samples Calculate the stochastic gradient Then it means The corresponding loss function in the current model parameters w t The gradient below;

[0069] S205, Calculation

[0070] S206, Calculation by The largest absolute value A set consisting of the indices of each component

[0071] S207, will Send to the server node;

[0072] S208. Receive the index set S from the server node. t ;

[0073] S209, according to S t calculate For each j∈S t ,make For each of the remaining dimensions j, let in(·) j This represents the value of the j-th component of the vector;

[0074] S210, through secure aggregation technology, To protect privacy;

[0075] S211. Send the compressed gradient, protected by secure aggregation, to the server node.

[0076] S212, receiving the compressed gradient update from the server node

[0077] S213, using and S t recovery

[0078] S214, updating the model parameters updating

[0079] S215, judging whether a stop working message sent by the server node is received, if not, returning to step S203 and continuing training, and if yes, ending training.

Claims

1. A federated learning method with communication efficiency, privacy protection and attack resistance, characterized in that, The method comprises the following steps: (1) Each user node obtains the latest model parameters from the server, calculates the gradient according to the locally stored training data, and uploads the index set of the largest absolute value components of the gradient to the server node; (2) The server receives the index set sent by all user nodes, calculates the union set of the index sets of all user nodes, and broadcasts to the user nodes; (3) Each user node calculates the compressed gradient according to the index set broadcasted by the server, applies the secure aggregation technology to protect the privacy of the compressed gradient, and then uploads it to the server node; (4) The server node calculates the final gradient according to the compressed gradient and the index set sent by each user node through the aggregation function, and sends the final gradient to the user node; (5) The above training steps are repeatedly performed until the stopping condition is met, and the server notifies each user node to stop; The specific steps of the training process on the server node are: S101、input the number of user nodes , iteration rounds , and aggregation function ; S102, Order Initialize model parameters And send it to all user nodes; S103, waiting for receiving an index set from any user node ;​ S104, judging whether the number of received index sets is equal to ; if not, returning to step S103; if yes, calculating , and broadcasting to all user nodes; S105, coordinate the communication between each user to complete the secure aggregation; S106, receiving local compressed gradients from any user node of the user nodes ; S107, judging whether the number of received sparse gradients is equal to ; if not, returning to step S106; if yes, using and all sparse gradients are recovered; S108, calculating a final gradient update ; S109, updating the compression gradient broadcast to all user nodes; S110, judging whether the condition is met at this time , if not, allowing , returning to step S103 to continue training; if yes, notifying each user node to stop working; The method is in the first The specific steps of the user node training process are: S201、input a subset of the training sample set and the batch size of each sampling , learning rate , the number of user nodes , sparse factor ; S202、Let , receive the model parameters sent by the server node , initialize the local error accumulation vector ; S203, randomly selecting a sample from the local dataset ;​ S204. Based on the selected samples Calculate the stochastic gradient , Then it means The corresponding loss function in the current model parameters The gradient below; S205, calculating ; S206、calculating the set consisting of indexes of components with the largest absolute values ;​​ S207、to to a server node; S208. Receiving the set of indexes from the server node ; S209、According to Computing , for each , let , for each remaining dimension , let where denotes the value on the th component of the vector; S210, performing privacy protection on the data collected by the security aggregation technology; S210, performing privacy protection on the data collected by the security aggregation technology; S211, send the compressed gradient protected by the secure aggregation to the server node; S212, receiving the compressed gradient update from the server node ; S213、using and recovery ; S214, updating the model parameters , updating ; S215, determine whether a stop working message sent by the server node is received, if not, return to step S203 and continue training; if yes, end the training.

2. The federated learning method with communication efficiency, privacy protection and attack resistance according to claim 1, characterized in that, In steps S103-S104, the server calculates the union set of the gradient indexes sent by each user node and broadcasts to all user nodes, so as to reach a consensus on the index information on each user node.

3. The federated learning method with communication efficiency, privacy protection and attack resistance according to claim 1, characterized in that, In steps S204-S211, the user node sends the index to the server by calculating the index of the largest absolute value components in the random gradient, calculates the sparse gradient vector according to the consensus index information returned by the server, and sends it to the server after privacy protection by the secure aggregation technology.

4. A computer storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the federated learning method with efficient communication, privacy protection and attack resistance according to any one of claims 1-3.

5. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the federated learning method with efficient communication, privacy protection and attack resistance according to any one of claims 1-3.

Images