Model training method and federated learning system based on federated learning

Abstract

A model training method and a federated learning system based on federated learning are disclosed. The method is applied to a federated learning system comprising a server and N nodes, N>1, and comprises: in the i-th operation of model training, performing: the server distributing a model parameter set to M i nodes, wherein M i ≤N, each of the M i nodes performing gradient calculation using local training samples to obtain original gradients, and jointly optimizing performance maintenance indicators and privacy protection indicators related to the original gradients to obtain transformed gradients; and the server obtaining the transformed gradients and updating the model parameter set. The performance maintenance indicators can measure the change of model performance, and the privacy protection indicators can measure the risk of privacy leakage. By jointly optimizing the two indicators, the invention can obtain a perturbation point that ensures the protection of data privacy and minimizes the degradation of model performance. The invention can also accelerate the convergence of joint optimization through an improved initialization strategy.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of machine learning, and in particular to a model training method based on federated learning and a federated learning system. BACKGROUND

[0002] In recent years, artificial intelligence has ushered in a new wave of development climax, and machine learning plays a core role in it. In order to train a well-performing machine learning model, a large amount of high-quality data needs to be collected. However, in a large number of application scenarios, privacy protection makes it impossible to collect private data from users to the server for centralized model training, which hinders the wide application of machine learning.

[0003] Therefore, multi-party joint modeling that enables participants to collaboratively train a model without revealing data is proposed to overcome the data privacy problem. An important and common scenario in multi-party joint modeling is federated learning (FL). Under federated learning, users use data locally to obtain the update value (i.e., gradient) of the model according to the established algorithm, and feed back the update value to the server, thereby avoiding the local training data from being known to the outside world. However, it has been found that the server can use the gradient uploaded by a specific user to recover the local training data of the user.

[0004] Therefore, a model training method is needed that can protect the security of the local training data of federated learning users. SUMMARY

[0005] One of the technical problems to be solved by the present disclosure is to provide a model training method based on federated training, which can achieve the properties of performance maintenance, privacy protection and practicability close to the "ideal" transformed gradient by skillfully constructing theoretically derived performance maintenance indicators and privacy protection indicators related to the gradient and jointly optimizing them.

[0006] According to a first aspect of the present disclosure, a model training method based on federated learning is provided, applied to a federated learning system including a server and N nodes, N>1, the method comprising: in the i-th operation of model training, performing: the server distributes a model parameter set to M i nodes, where M i ≤N, each of the M i nodes performs gradient calculation using local training samples to obtain an original gradient, and jointly optimizes a performance maintenance indicator and a privacy protection indicator related to the original gradient to obtain a transformed gradient δ * mi , where m=1,2,…,M i ; and the server obtains the transformed gradient δ * mi and updates the model parameter set.

[0007] Optionally, the performance maintenance indicator characterizes the transformation gradient δ * mi maintains the performance of model training convergence and is a function of the original gradient; and the privacy protection indicator characterizes the transformation gradient δ * mi pushes the difficulty of local training sample data and is a function of the original gradient;

[0008] Optionally, the performance maintenance indicator characterizes the transformation gradient δ * mi the distance from the original gradient.

[0009] Optionally, the privacy protection indicator limits the transformation gradient δ * mi pushed local training sample data x * mi the distance lower bound from the original local training sample data x mi .

[0010] Optionally, the distance lower bound is adjusted by adjusting the weights of the performance maintenance indicator and the privacy protection indicator in the joint optimization.

[0011] Optionally, the performance maintenance indicator and the privacy protection indicator related to the gradient are jointly optimized to obtain the transformation gradient δ * mi comprising: iterative calculation to obtain the optimization solution of the transformation gradient δ * mi satisfying the performance maintenance indicator and the privacy protection indicator limit condition.

[0012] Optionally, the iterative calculation to obtain the optimization solution of the transformation gradient δ * mi starts from the original gradient.

[0013] Optionally, the i-th operation of the model training comprises: the i-th batch data training operation of the model training.

[0014] According to a second aspect of the present disclosure, a federated learning system is provided, comprising a server and N nodes, N>1; the server, in the i-th operation of model training, distributes a model parameter set to M i nodes, wherein M i ≤N, the M i nodes each perform gradient calculation using local training samples to obtain an original gradient, and jointly optimize the performance maintenance indicator and the privacy protection indicator related to the original gradient to obtain a transformation gradient δ* mi wherein m = 1, 2, …, M i ; and the server further obtains a transformed gradient δ * mi and updates the model parameter set.

[0015] According to a third aspect of the present disclosure, there is provided 10. A model training method based on federated learning, applied to a node in a federated learning system comprising N nodes and a server, N > 1; the method comprises: in the i-th operation of model training, performing: obtaining a model parameter set issued by the server; performing gradient calculation using local training samples to obtain an original gradient; and jointly optimizing a performance maintenance indicator and a privacy protection indicator related to the original gradient to obtain a transformed gradient; and uploading the transformed gradient to the server for updating the model parameter set together with the transformed gradients uploaded by other nodes, wherein in the i-th operation, the server issues the model parameter set to M i nodes including the current node and the other nodes, wherein M i ≤ N.

[0016] According to a fourth aspect of the present disclosure, there is provided a computing device comprising: a processor; and a memory having stored thereon executable code that, when executed by the processor, causes the processor to perform the method of the third aspect described above.

[0017] According to a fifth aspect of the present disclosure, there is provided a non-transitory machine-readable storage medium having stored thereon executable code that, when executed by a processor of an electronic device, causes the processor to perform the method of the third aspect described above.

[0018] Thus, the performance maintenance indicator can measure the change in model performance, while the privacy protection indicator can measure the risk of privacy leakage. By jointly optimizing these two indicators, the present disclosure can evaluate the perturbation point at which the data privacy is safely protected and the model performance is least degraded. Considering that the additional overhead caused by defense is crucial in actual operation, the present disclosure can also accelerate the convergence of joint optimization through an improved initialization strategy. BRIEF DESCRIPTION OF DRAWINGS

[0019] The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings, in which like reference characters designate like elements in the several views.

[0020] Figure 1 A schematic diagram of a training process of federated learning is shown.

[0021] Figure 2 An example of a gradient leakage attack is shown.

[0022] Figure 3 A schematic diagram of a training process of federated learning when the client is under defense is shown.

[0023] Figure 4 A schematic flow chart of a federated learning based model training method according to an embodiment of the present application is shown.

[0024] Figure 5 A schematic diagram of a federated learning system for performing the model training method of the present application is shown.

[0025] Figure 6 A schematic diagram of a computing device according to an embodiment of the present application that can be used to implement the above-described federated learning based model training method is shown.

[0026] Figure 7 A schematic diagram of the principle of the present application is shown. DETAILED DESCRIPTION

[0027] Preferred embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms without being limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0028] Machine learning models need to be trained before they can make relatively accurate inferences. For example, before deploying a deep learning model such as a convolutional neural network (CNN) for inference (e.g., classifying input pictures), the network model first needs to be trained.

[0029] The training process of a network model does not change the existing structure of the neural network model, but updates the parameters of each layer of the neural network model. That is, through a large number of imports of training data, the parameters of each layer of the neural network model, such as weights and biases, are determined.

[0030] Training a model means learning (determining) the ideal values of all weights and biases through labeled samples. These determined weights and biases can make high-accuracy inferences on input feature values during the deployment phase of the neural network.

[0031] In supervised learning, a machine learning algorithm learns parameters by examining multiple samples and trying to find a model that can minimize the loss, which is called empirical risk minimization.

[0032] Loss is a penalty for bad prediction. That is, loss can be a numerical value that represents how accurate the model's prediction is for a single sample. If the model's prediction is completely accurate, the loss is zero, otherwise the loss is larger. The goal of training a model is to find a set of weights and biases that results in a "smaller" average loss from all samples.

[0033] In the training process of a neural network, in order to quantify whether the current weights and biases can make the network input fit all network inputs, a loss function needs to be defined. Thus, the purpose of training the network can be transformed into the process of minimizing the loss function of weights and biases. Usually, gradient descent algorithm (backpropagation algorithm in multilayer neural network training) is used to achieve the above-mentioned minimization process.

[0034] In the backpropagation algorithm, there is a repeated iteration process involving forward propagation and backpropagation. The forward propagation process is the process in which the stimulus (feature value) is transmitted from the previous layer to the next layer through the connection of the weight matrix between the neurons of the layers, and the excitation function of each layer is constantly transmitted. In backpropagation, the error of the current layer needs to be derived from the error of the next layer. Thus, through the iteration process of the above-mentioned forward and backpropagation, the weights and biases are constantly adjusted, so that the loss function gradually approaches the minimum value, thereby completing the training of the neural network.

[0035] For privacy protection, in application scenarios such as mobile edge computing (MEC), the server cannot collect private data from users (e.g., various forms of clients) for centralized model training. Thus, in order to protect user privacy in deep learning model training, federated learning (FL) can be used, which can coordinate model training across devices.

[0036] Figure 1 The training process of federated learning is shown. Under federated learning, all users share a complete machine learning model. As shown in the figure, the model structure at the server and at each client is the same. The server can be, for example, an edge server of MEC, or other servers used to perform parameter aggregation tasks in federated learning. In different application scenarios, clients can have various forms, such as various personal computers, laptops, and even smart phones, and can themselves have the form of a server (although used as a client in the FL model).

[0037] The server first issues a parameter set. The first time it is issued is the initial parameter set, for example, a parameter set with random values. After the first update is completed, the subsequent parameter set issued is the parameter set after each round of update.

[0038] Subsequently, users (corresponding to the various clients in the diagram) use their respective data locally to obtain the updated values ​​of the model (i.e., the gradients representing the parameter updates) according to a predetermined algorithm. Users upload their respective gradients to the server. The server integrates the acquired gradients, for example, by using a specific aggregation method to fuse the gradients of all users, thereby obtaining the set of updated model parameters. This completes one round of training. The server can then distribute the updated parameter set to the users to begin the next round of training, and this process repeats until a predetermined number of iterations is reached or the model is deemed to have converged.

[0039] Under federated learning, users do not need to upload training data. Instead, they train the model locally and only upload the updated values ​​of the parameters (i.e., gradients). This process seems to protect the user's data privacy. However, it has been discovered that the server can use the updated values ​​uploaded by a specific user to reverse and recover that user's local training data. Moreover, the recovered data can be almost identical to the real data, resulting in indirect data leakage and raising questions about the security of federated learning.

[0040] Figure 2 This illustrates an example of a gradient leakage attack. When the server is a malicious server seeking to acquire the user's local data, it can be considered the attacker. The client can be seen as the defender. As shown on the left side of the dashed line, the user locally trains a model using the image on the left as training data and directly provides the obtained real gradients to the server. The user does not take any precautions against the attack when directly uploading the real gradients. Now, as shown on the right side of the dashed line, the attacker can fix the model's parameters, initialize dummy data, and optimize its gradients. This causes the parameter updates obtained from the dummy data to gradually approach the real gradients uploaded by the user, thus reversing the data used for the user's local training.

[0041] Specifically, in federated learning, the user (defender) will use local gradients Uploaded to the server (attacker), where L represents the loss function, F represents the training model, x represents, for example, a batch of training data, y represents the labels of that batch of training data, the batch size (e.g., the number of training images contained) and the number of labels are both n; and θ are the model parameters to be learned. The attacker reconstructs the user data by solving an optimization problem (i.e., gradient matching) using the following formula:

[0042]

[0043] Here, x′ represents the reconstructed data, y′ represents the reconstructed label, and ε represents the distance between the reconstructed data and the user's original data. Since attackers can usually obtain the real label through label inference techniques, data breach attacks always focus on data reconstruction, i.e., obtaining x′.

[0044] To defend against gradient leakage attacks, the uploaded gradient needs to be adjusted. Figure 3 The training process of federated learning when the client is defended is shown. Figure 3 The training process shown is similar to Figure 1 The difference is that after the client obtains the gradient by local training, it does not directly upload the gradient, but performs some transformation on the gradient to obtain a transformed gradient, and uses the transformed gradient to replace the original gradient for uploading, thereby increasing the difficulty for the server to reverse the local data based on the uploaded gradient when acting as an attacker.

[0045] A common defense method against gradient leakage attacks is differential privacy, which adds weak noise to disturb the gradient without affecting performance, thereby providing the attacker with inaccurate gradients to weaken the attack. This defense method can only target weak attackers and is easily broken by strong attackers, with limited applicability and effectiveness. In this case, a "strong attacker" is assumed to be able to obtain any desired information in addition to the user's own data. If the defense method still works in the "strong attacker" scenario, it can handle all attacks. Differential privacy can be easily attacked in this scenario. Differential privacy generally adds Gaussian (Laplacian) noise with a mean of 0. Since the attacker can obtain any information other than the data, the attacker can know the specific distribution of the noise added by the defender. That is, the attacker can still add the corresponding noise multiple times, and under this operation, the final gradient obtained is the true gradient due to the mean tending to 0.

[0046] To better evaluate the effectiveness of the defense method of the present application, it can be assumed that the attacker is a strong attacker, and the "strong attacker" is assumed to be able to obtain any desired information in addition to the user's own data. The strong attacker knows all the information of the target model (e.g., loss function and hyperparameters, etc.) and the defense strategy of the defender. In addition, the attacker as the server can actively choose "weak" hyperparameters to facilitate its attack, such as setting the batch size n to 1.

[0047] The defender wants to reduce the risk of the server deriving the user's private data from the gradient uploaded by it. To this end, the defender searches for a perturbation to confuse the mapping between the gradient and the original data. Here, the perturbed gradient is referred to as the "transformed gradient". The ideal transformed gradient should at least have the following properties:

[0048] · Performance maintenance. The transformed gradient should have the same information efficacy as the original gradient for improving the performance of the target model in federated learning

[0049] • Privacy protection. The transformed gradient should ensure that the attacker cannot reconstruct the data, i.e., the reconstructed data is at least a distance of a given threshold e0from the original data.

[0050] • Utility. The transformed gradient should consume as few computational resources of the defender as possible.

[0051] The present invention proposes a federated learning model training method that can protect privacy in the worst case of attacks by strong attackers as above. The present invention starts from the observation of the core of gradient leakage: the reason why the original data can be reconstructed from its corresponding gradient is that the specific mapping relationship between the original data and its gradient can be easily reversed by solving an optimization problem. Based on the above observation, an effective attack defense method is to add disturbance to confuse this mapping relationship. However, in practical scenarios, how to add interference is faced with a dilemma: too much interference can easily make the model unable to converge; too little interference is not enough to provide sufficient defense. In order to solve the above problem, the present invention ingeniously designs two indicators: performance maintenance indicator (Performance Maintenance Metric, PMM) and privacy protection indicator (Privacy Protection Metric, PPM).

[0052] Intuitively, there is a trade-off between performance maintenance and privacy protection. If the defender requires the maximum performance maintenance, then it is enough to upload the real gradient, on the contrary, if the defender needs the maximum privacy protection, then it is enough to upload the random gradient. The two are at least intuitively contradictory to each other, because the closer to the real gradient, the better the performance maintenance, but also contains more information about the data, which can be used by the attacker to reverse the data. Therefore, the defense of the present invention needs to find a gradient, through which the difference between the restored data obtained by the attacker and the real data is the largest, and the given performance loss is within an acceptable range.

[0053] Specifically, the present invention proposes a model training method based on federated training, which generates a transformed gradient by jointly optimizing two theoretically derived performance maintenance and privacy protection indicators related to the gradient, and can have the properties of performance maintenance, privacy protection and utility close to the "ideal" transformed gradient as described above.

[0054] Figure 4 A schematic flowchart of a model training method based on federated learning according to an embodiment of the present invention is shown. The method is applied to a federated learning system including a server and N nodes, N > 1, for example Figure 5 as shown.

[0055] From the above Figure 1 and Figure 3As shown, the federated learning completes the model training through multiple rounds of training. Figure 4 The steps S410-S430 shown can be regarded as being performed in the i-th operation of the model training. In one embodiment, each round of training can correspond to a batch of training. That is, the above-mentioned circulation of issuing, updating, transforming, uploading, and integrating is in units of batches, and the i-th operation can be the i-th batch of data training operation of the model training. According to the background knowledge of machine learning, one model training usually needs multiple epochs, and each epoch includes multiple batch data calculations. Assuming that one model training needs 10 iterations, and 6 batches of data are used for training in each iteration, 60 batch data training operations are needed to complete the model training, that is, i = 1, 2, …, 60. In other embodiments, each round of training can also be performed in units other than batches.

[0056] In step S410, the server issues a model parameter set to M i nodes, where M i ≤ N. In federated learning, the server can issue a model parameter set to all nodes in the system each time, or can select a part of the N nodes based on certain conditions for model training. In each operation, the selected nodes can be the same or different.

[0057] In step S420, the M i nodes each perform gradient calculation using local training samples to obtain original gradients, and jointly optimize performance maintenance indicators and privacy protection indicators related to the original gradients to obtain transformed gradients δ * mi , where m = 1, 2, …, M i .

[0058] Here, the "original gradient" refers to the gradient obtained by the node using the local training sample for the current i-th operation (for example, the i-th batch of data training operation) to characterize the parameter update value, that is, the true gradient. Here, "original" is in relation to the subsequent "transformed" gradient. As mentioned earlier, the "original gradient" (or "true gradient") can be represented as

[0059] Here, each of the M i nodes can use its own local training sample (that is, local training data) to obtain its own true gradient, and each can jointly optimize its own performance maintenance indicators and privacy protection indicators to obtain the transformed gradient δ *. Here, both the performance maintenance indicator and the privacy protection indicator are related to the sought true gradient, e.g., are functions of the sought true gradient. By jointly optimizing the function characterizing the model performance maintenance and the function characterizing the privacy protection, the transformation gradient δ * .

[0060] Then at step S430, the server collects the transformation gradient uploaded by each of the M i nodes, i.e., the transformation gradient δ * mi and updates the model parameter set accordingly.

[0061] Thus, in the present application, when uploading the gradient, the client node does not directly upload the true original gradient, but solves the transformation gradient based on the joint optimization of the performance maintenance indicator (PMM) and the privacy protection indicator (PPM). The performance maintenance indicator can measure the change in model performance, while the privacy protection indicator can measure the risk of privacy leakage. By jointly optimizing these two indicators, the present application can evaluate the most optimized perturbation point (i.e., the transformation gradient δ * corresponding to the most optimized perturbation point) at which the data privacy is securely protected and the model performance is least degraded.

[0062] As mentioned before, in order to find the optimized perturbation point between performance maintenance and privacy protection, it is necessary to reasonably construct the performance maintenance indicator and the privacy protection indicator. In the present application, the performance maintenance indicator can be constructed to characterize the transformation gradient δ * mi maintains the performance of model training convergence and is a function of the original gradient (i.e., ). Similarly, the privacy protection indicator can be constructed to characterize the local training sample data x * mi pushed out from the sought transformation gradient δ

[0063] In one embodiment, the performance maintenance indicator can be used to characterize the distance of the transformation gradient δ * mi from the original gradient. That is, the PMM characterizes the distance of the transformation gradient and the original gradient.

[0064] Correspondingly, in one embodiment, the privacy protection indicator can be used to limit the local training sample data x * mi pushed out from the sought transformation gradient δ * mi from the original local training sample data x midistance. As described below with reference to application examples, since the distance is difficult to be accurately described by a function, in a preferred embodiment, the privacy protection indicator PPM can be used to limit the local training sample data x * mi distance from the original local training sample data x mi . That is, PPM is used to limit the lower bound of the distance of the inverse data x * from the original sample x.

[0065] Obviously, the distance is closest when the transformed gradient is equal to the original gradient, and the value of PPM is the smallest. However, since PPM needs to be optimized jointly with PPM, in the present application, the transformed gradient that is closest to the original gradient when the distance lower bound limited by PPM is required to be calculated. In actual applications, in order to meet different privacy protection requirements, the distance lower bound can also be adjusted by adjusting the weights of the performance maintenance indicator and the privacy protection indicator in the joint optimization. For example, in the joint optimization formula 3 described below with reference to application examples, the degree of privacy protection can be adjusted by adjusting the value of the weight β of PPM.

[0066] For the joint optimization problem, iterative calculation is required. Therefore, the performance maintenance indicator and the privacy protection indicator related to the gradient are jointly optimized to obtain the transformed gradient δ * mi , which includes iterative calculation to obtain the optimized solution (the most optimized solution) of the transformed gradient δ * mi under the limit conditions of the performance maintenance indicator and the privacy protection indicator.

[0067] Considering that the additional overhead caused by defense is crucial in actual operations, when performing iterative calculation, the present application can also accelerate the convergence of joint optimization by using an improved initialization strategy. To this end, the starting point of the iterative calculation to obtain the optimized solution of the transformed gradient δ * mi may be the original gradient. In other words, the iterative starting point of the optimization calculation is not a random starting point, but can be the transformed gradient δ , thereby accelerating the iterative convergence.

[0068] The present application can also be implemented as a federated learning system. Figure 5 A composition diagram of a federated learning system that performs the model training method of the present application is shown. As shown in the figure, the system 500 includes a server 510 and N nodes 520 1-N .

[0069] The server 510 distributes a set of model parameters to M i nodes in the i-th operation of model training, where Mi ≤N. The M i Each node performs gradient calculation using its local training samples to obtain the original gradient, and jointly optimizes the performance preservation and privacy protection metrics associated with the original gradient to obtain the transformed gradient δ. * mi Where m = 1, 2, ..., M i The server also acquires the transformation gradient δ. * mi And update the model parameter set.

[0070] This invention can also be implemented as a model training method based on federated learning, applied to nodes in a federated learning system, wherein the federated learning system includes N nodes and a server, N > 1; the method includes: in the i-th operation of model training, performing: obtaining the model parameter set issued by the server; performing gradient calculation using local training samples to obtain the original gradient; and jointly optimizing the performance maintenance index and privacy protection index related to the original gradient to obtain the transformed gradient; and uploading the transformed gradient to the server so that the server, together with the transformed gradients uploaded by other nodes, can update the model parameter set, wherein, in this i-th operation, the server issues the model parameter set to M nodes including the current node and the other nodes. i There are 10 nodes, of which M i ≤N.

[0071] Figure 6 A schematic diagram of a computing device according to an embodiment of the present invention is shown, which can be used to implement the above-described federated learning-based model training method. This computing device can, in particular, serve as a node in a federated learning system, for acquiring the original gradient and jointly optimizing performance preservation metrics and privacy protection metrics associated with the original gradient to obtain the transformed gradient.

[0072] See Figure 6 The computing device 600 includes a memory 610 and a processor 620.

[0073] Processor 620 may be a multi-core processor or may contain multiple processors. In some embodiments, processor 620 may include a general-purpose main processor and one or more special-purpose coprocessors, such as a graphics processing unit (GPU), a digital signal processor (DSP), etc. In some embodiments, processor 620 may be implemented using custom circuitry, such as an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA).

[0074] Memory 610 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. ROM may store static data or instructions required by the processor 620 or other modules of the computer. Permanent storage devices may be read-write storage devices. Permanent storage devices may be non-volatile storage devices that retain stored instructions and data even when the computer is powered off. In some embodiments, permanent storage devices use mass storage devices (e.g., magnetic or optical disks, flash memory) as permanent storage devices. In other embodiments, permanent storage devices may be removable storage devices (e.g., floppy disks, optical drives). System memory may be a read-write storage device or a volatile read-write storage device, such as dynamic random access memory. System memory may store some or all of the instructions and data required by the processor during operation. Furthermore, memory 610 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and disks and / or optical disks may also be used. In some embodiments, memory 610 may include a removable storage device that is readable and / or writable, such as a laser disc (CD), a read-only digital multifunction optical disc (e.g., DVD-ROM, dual-layer DVD-ROM), a read-only Blu-ray disc, an ultra-high-density optical disc, a flash memory card (e.g., SD card, mini SD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not contain carrier waves or transient electronic signals transmitted wirelessly or via wired connections.

[0075] The memory 610 stores executable code, which, when processed by the processor 620, enables the processor 620 to execute the federated learning-based model training method described above.

[0076] Application Example

[0077] The following will combine Figure 7 This describes specific implementation examples of the PMM and PPM of the present invention. Figure 7 A schematic diagram illustrating the principle of this invention is shown. As illustrated, PMM makes the transformed gradient as close as possible to the original gradient, while PPM makes the transformed gradient orthogonal to the original gradient to reduce the possibility of the server reconstructing the original data. This invention finds the optimized perturbation point as shown in the figure through joint optimization of PMM and PPM, and uploads the resulting transformed gradient to the server, preventing the server from reconstructing the original data from its virtual data, thereby achieving a robust defense.

[0078] To achieve the defender's goals regarding performance maintenance, privacy protection, and usability, this invention designs a loss function comprising two metrics: the effectiveness of the gradient and the risk of privacy leakage. By optimizing this loss function, the defender can effectively construct a series of perturbations to obfuscate gradients with minimal model performance degradation.

[0079] 1. PMM: A metric for performance improvement

[0080] First, we present a metric to measure how much a perturbed gradient contributes to performance improvement. This metric is used to limit the generated perturbation to a range that doesn't deviate too much from the desired convergence direction. The derivation of this metric is based on an extension of gradient descent-based optimization methods. Given the parameter update δ, a first-order Taylor expansion yields the following:

[0081]

[0082] Here, it is assumed that F(·) is differentiable. For the sake of simplicity, L(x,θ) is used to denote L(F(x),y,θ). Typically, if the goal is to minimize L, the optimization δ is set to... Furthermore, ∈ is a specific small positive constant to avoid errors introduced by neglecting the remainder O(||δ||). As shown in equation (2), the reduction in loss before and after the parameter update can be accurately estimated as Similarly, if we set δ to be equal to the transformation gradient -∈δ * Then with δ * The associated reduction in loss is therefore, Defined as the performance preservation metric (PMM), this metric can be used to estimate the change in performance contribution after gradient transformation. In other words, the smaller the PMM value, the lower the δ... * The greater the contribution to model performance.

[0083] 2. PPM: A metric for privacy breaches

[0084] Make x * This means that by solving equation (1) above, the gradient δ is obtained from the transformation. * The data is reconstructed in the middle. To include user privacy, the defender needs to maximize x and x'. * The distance between them, i.e., maximizing ||xx * ||2. Therefore, an intuitive way to measure the risk of privacy breaches is to find a way to assess ||xx * ||2 with δ * A general function of change. However, given that deep neural networks are inherently highly nonlinear and nonconvex, it is difficult to find a function that can precisely describe ||xx.* ||2 and δ * The function relating these relationships, especially when the neural network is constantly changing during training. Therefore, to circumvent this problem, we can instead construct ||xx * ||2 and δ * The relevant lower bound. Therefore, as the lower bound increases, the risk of privacy breach decreases, and vice versa. A commonly used mathematical tool for tight binding is the Lipschitz coefficient, which states that the difference between the function values ​​at any two points in the domain and the difference between their independent variables is bounded. In practical applications, the vast majority of neural networks satisfy the Lipschitz assumption.

[0085] Although in the Lipschitz hypothesis, ||xx * The lower bound of ||2 is not the same as δ. * Related, but can be proven ||xx * ||2 and Proportional. Because in equation (2) if Then the loss function increases, and according to the derivation, it is necessary to make... To ensure model convergence. Therefore, Defined as a privacy protection metric (PPM).

[0086] 3. Joint optimization

[0087] After defining PMM and PPM, the final optimization task can be constructed. First, to maintain model performance, the corresponding metric PMM should be minimized. Then, the gradient leakage attack risk metric PPM needs to be minimized. Therefore, the final optimization loss function can be constructed as follows:

[0088]

[0089] Where β is used as the loss balance factor. In equation (3), the left-hand side is... Minimizes the time, meaning no perturbation is made to the gradient. The right-hand side is then optimized to make δ... * and orthogonal to increase δ * and The cosine distance between them. Note that Equation (3) determines that privacy protection requires sacrificing some model performance. However, compared with the prior art, the method of the present invention allows defenders to evaluate losses and gains simultaneously at minimal cost by utilizing more accurate metrics. Furthermore, Equation (3) is a typical convex optimization task that can be well solved by conventional optimization methods.

[0090] In addition to effectiveness, convergence speed needs to be considered in the application of gradient leakage defense. Too slow convergence speed (resulting in too long running time) will reduce the significance of defense in practical applications. Generally, an optimization task starting from the vicinity of the most optimized point can significantly reduce the number of iterations required for convergence. In the case of gradient leakage defense, the defender hopes that the perturbation added can affect the effectiveness of the original gradient as little as possible. Therefore, the convergence point of optimization should be located near the original gradient with a high probability. Therefore, in the present application, instead of using random noise to start initialization, the original gradient is directly selected as the initial optimization point. Compared with a random initial point, such a selection can significantly increase the convergence speed.

[0091] The federated learning-based model training method and the federated learning system according to the present application have been described in detail above with reference to the accompanying drawings.

[0092] The model method proposed in the present application can cover any attacker under the most stringent environment that assumes that the attacker has sufficient computing power, knowledge, information, etc., and is not only effective against weak attackers. The method has theoretical guarantees, good interpretability, and the assumptions made when demonstrating are generally valid in various practical scenarios.

[0093] Further, the joint optimization in the application example requires less computation, and is suitable for clients in the form of terminals and edge devices. The proposed algorithm has good privacy protection capability, and users can adjust the algorithm according to their own preference for privacy protection.

[0094] In addition, the method according to the present application can also be implemented as a computer program or computer program product, which comprises computer program code instructions for performing the above steps defined in the above method of the present application.

[0095] Alternatively, the present application can also be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) having stored executable code (or computer program, or computer instruction code) which, when executed by a processor of an electronic device (or computing device, server, etc.), causes the processor to perform the steps of the above method according to the present application.

[0096] Those skilled in the art will also appreciate that the various example logical blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein can be implemented as electronic hardware, computer software, or a combination of the two.

[0097] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0098] Embodiments of the application have been described above with the understanding that such embodiments are exemplary, but are not exhaustive, and are not limited to the embodiments disclosed. Many modifications and variations of the described embodiments are possible in light of the above teachings. The choice of terms to be used in the description is intended to best describe the principles of the embodiments, practical application, or improvement over the technology in the art, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A model training method based on federated learning, applied to a federated learning system including a server and N nodes, where N > 1, the method comprising: In the i-th operation of model training, execute: The server sends the model parameter set to M. i There are 10 nodes, of which M i ≤N, M i Each node performs gradient calculation using its local training samples to obtain the original gradient, and jointly optimizes the performance preservation and privacy protection metrics associated with the original gradient to obtain the transformed gradient. Where m = 1, 2, …, M i The performance maintenance metric characterizes the transformation gradient. To maintain the performance of model training convergence and be a function of the original gradient, the privacy-preserving metric characterizes the transformed gradient obtained from the training. The difficulty of deriving the local training sample data is a function of the original gradient; The server obtains the transformation gradient. And update the model parameter set; Specifically, the joint optimization of performance maintenance metrics and privacy protection metrics related to the original gradient is performed to obtain the transformed gradient. include: Iterative calculations are performed to obtain the transformation gradient that satisfies the performance maintenance metric and the privacy protection metric constraints. The optimized solution.

2. The method as described in claim 1, wherein, The performance maintenance metric is used to characterize the transformation gradient. The distance from the original gradient.

3. The method as described in claim 1, wherein, The privacy-preserving metric is used to limit the transformation gradient obtained from the solution. Local training sample data launched Distance from the original local training sample data x mi The lower bound of the distance.

4. The method of claim 3, wherein, The lower bound of the distance is adjusted by regulating the weights of the performance maintenance metric and the privacy protection metric in the joint optimization.

5. The method of claim 1, wherein, Find the gradient of the transformation The starting point for iterative calculation of the optimized solution is the original gradient.

6. The method of claim 1, wherein, The i-th operation of the model training includes: The model training operation is performed on the i-th batch of data.

7. A federated learning system, comprising a server and N nodes, where N > 1; The server sends the model parameter set to M during the i-th operation of model training. i There are 10 nodes, of which 10 are nodes. M i ≤N, The M i Each node performs gradient calculation using its local training samples to obtain the original gradient, and jointly optimizes the performance maintenance metrics and privacy protection metrics associated with the original gradient to obtain the transformed gradient. Where m = 1, 2, …, M i The performance maintenance metric characterizes the transformation gradient. To maintain the performance of model training convergence and be a function of the original gradient, the privacy-preserving metric characterizes the transformed gradient obtained from the training. The difficulty of deriving the local training sample data is a function of the original gradient; The server also acquires the transformation gradient. And update the model parameter set; Specifically, the joint optimization of performance maintenance metrics and privacy protection metrics related to the original gradient is performed to obtain the transformed gradient. include: Iterative calculations are performed to obtain the transformation gradient that satisfies the performance maintenance metric and the privacy protection metric constraints. The optimized solution.

8. A model training method based on federated learning, applied to nodes in a federated learning system, wherein the federated learning system includes N nodes and a server, where N > 1; The method includes: In the i-th operation of model training, execute: Obtain the set of model parameters issued by the server; Perform gradient computation using local training samples to obtain the original gradient; and The performance preservation metric and the privacy protection metric associated with the original gradient are jointly optimized to obtain the transformed gradient; wherein the performance preservation metric characterizes the performance of the transformed gradient in maintaining model training convergence and is a function of the original gradient, and the privacy protection metric characterizes the ease with which the local training sample data is derived from the obtained transformed gradient and is a function of the original gradient. The transformation gradient is uploaded to the server so that the server, along with transformation gradients uploaded by other nodes, can update the model parameter set. In this i-th operation, the server distributes the model parameter set to M, including the current node and the other nodes. i There are 10 nodes, of which M i ≤N; The step of jointly optimizing the performance preservation metric and privacy protection metric associated with the original gradient to obtain the transformed gradient includes: Iterative calculations are performed to obtain an optimized solution for the transformation gradient that satisfies the constraints of the performance maintenance metric and the privacy protection metric.

9. A computing device, comprising: processor; as well as A memory having executable code stored thereon, which, when executed by the processor, causes the processor to perform the method as described in claim 8.

10. A non-transitory machine-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to perform the method of claim 8.

Images