Federated Learning Classification Model Training Method Based on Model Perturbation

Abstract

The present invention proposes a method for training a federated learning classification model based on model perturbation, and the implementation steps are as follows: constructing a federated learning classification system; the client initializes the local classification model and training parameters of the federated learning; the client performs iterative training on the local classification model and perturbs the local classification model; the central server obtains the training results of the federated learning system. According to the different types of features of the training data set extracted by each convolutional layer and the different influences of each fully connected layer on the model prediction classification effect, the client of the present invention assigns different privacy budget values to different model layers of the local classification model, which can control the perturbation degree of each model layer, avoid the influence of the perturbation degree of the model layer being too large or too small on the model, and thus improve the privacy protection ability and prediction classification accuracy of the federated learning classification model.

Description

Technical Field

[0001] The present invention belongs to the field of privacy computing, and relates to a method for training a federated learning classification model, in particular to a method for training a federated learning classification model based on model perturbation. Background Art

[0002] Image classification is a common machine learning task that accurately identifies the target category of an image based on the features present in the image. In machine learning, convolutional neural networks are often used to solve image classification tasks. To train an image classification model, a large amount of training data is required. However, this training data often exists in multiple data sources and contains sensitive information of individuals. With the awakening of people's privacy awareness, the requirements for personal privacy are becoming increasingly strict.

[0003] To address people's privacy concerns, McMahan et al. proposed the concept of federated learning in 2017, which balances efficiency and security. Nowadays, federated learning has gradually become a popular distributed machine learning paradigm. By sharing model updates (e.g., gradients, model parameters) instead of raw data, it reduces communication overhead and enhances privacy protection during the communication process. However, researchers have found that gradients and model parameters can be analyzed (e.g., model inversion attacks, membership inference attacks) to violate user privacy. The deployment of differential privacy technology in federated learning meets privacy requirements, but these methods often reduce the prediction classification effect of the model or the system efficiency. In federated learning based on differential privacy, how to improve the prediction classification effect of the model and reduce the risk of the model leaking privacy is an urgent problem to be solved for implementing an efficient and secure federated learning system.

[0004] For example, a patent application with the publication number CN113762525A and the title "A Federated Learning Model Training Method with Differential Privacy Protection" discloses a federated learning model training method with differential privacy protection. The main steps of this method are as follows: (1) Establish a connection between the model and the terminals, select a learning model, and establish a connection between the learning model and the terminal server; (2) Differentiation and distribution of the model, differentiate the model at the sample level and user level, and the terminal server selects the devices participating in the current round of federated learning according to the standard for the differentiated model; (3) Conduct local training, each device loads the current global model and trains it with its own training data to obtain a new local model; (4) Establish privacy protection, according to the differentiation of the model categories, use different methods to encrypt and protect information using differential privacy protection; (5) Update the global model, each device uploads the updated value of the model to the server, and the server aggregates the updated values after collection to obtain an aggregation result, and then updates the global model; (6) Monitor and feedback, monitor the updated values of the data, judge whether the trained model leaks that a specific sample or user has participated in the training, and feedback the obtained result to the terminal server; (7) Data backup record, back up and archive the updated global model data to avoid damage during data transmission affecting data acquisition. The deficiencies of this method are as follows: The differential privacy technology controls the perturbation degree of the federated learning model through the privacy budget value. The privacy budget value allocated to each model layer of the federated learning model is equal, and thus the perturbation degree of each model layer is the same. It does not consider the differences in the types of features of the training data sets extracted by each model layer with the function of feature extraction and the differences in the impact of each model layer with the function of prediction on the model prediction effect, resulting in an excessive perturbation degree for the model layer with a large impact on the model prediction effect, thereby reducing the model prediction effect, and an insufficient perturbation degree for the model layer that extracts more types of features of the training data sets, thereby reducing the privacy protection ability of the model. Summary of the Invention

[0005] The object of the present invention is to propose a federated learning classification model training method based on model perturbation for solving the technical problems of weak privacy protection ability and low prediction and classification accuracy existing in the prior art in view of the deficiencies of the above-mentioned existing technologies.

[0006] To achieve the above object, the technical solution adopted by the present invention includes the following steps:

[0007] (1) Construct a federated learning system:

[0008] Initialize a federated learning system including a central server and N clients C = {c1, c2,..., c n ,..., c N}, where N ≥ 2, c nDenote the nth client;

[0009] (2) The client initializes the local classification model and training parameters of federated learning:

[0010] Each client c n Initializes a local training dataset containing M images of L target categories and annotates the target of each image; initializes a local classification model X including I model layers composed of K composite layers and F fully connected layers stacked in sequence, n where each composite layer includes a convolutional layer, a ReLU layer, a Dropout layer, and a pooling layer stacked in sequence; initializes the aggregation round as t, the maximum aggregation round as T, T≥100, and the local classification model of the client c at the tth aggregation n is The weight parameter and privacy budget value of the ith model layer are respectively where, and let t = 0, where, L≥2, M≥50, K≥2, F≥2, I = K + F;

[0011] (3) The client iteratively trains the local classification model:

[0012] (3a) Each client c n Takes B training data randomly selected with replacement from the local training dataset as the input of the local classification model for forward propagation: The convolutional layer in the K composite layers extracts the features of each training data, the ReLU layer performs nonlinear processing on the extracted features, the Dropout layer probabilistically discards the features after nonlinear processing, the pooling layer compresses the probabilistically discarded features, for a total of K times, and the F fully connected layers predict the corresponding training data based on the features of each training data after the Kth compression, obtaining B predicted labels where, denotes the predicted label of the bth training data;

[0013] (3b) Each client c n Uses the cross-entropy loss function and calculates the loss value of the local classification model through the predicted label of each training data and its corresponding true label and uses the stochastic gradient descent algorithm to calculate the partial derivative of the weight parameter of the local classification model with respect to the weight parameter and updates it to obtain the weight parameter as Local classification model

[0014] (4) The client perturbs the local classification model:

[0015] (4a) Each client c n According to the local classification model The privacy budget value of each model layer Calculate the Gaussian noise scale value that satisfies the differential privacy guarantee And according to Calculate the noise value that satisfies the Gaussian distribution for each model layer

[0016] (4b) Each client c n Add the noise value To the weight parameters of each model layer To achieve perturbation of the local classification model To obtain the perturbed local classification model with weight parameters And upload To the central server; And upload

[0017] (5) The central server obtains the training results of the federated learning system:

[0018] The central server randomly selects V clients c v The uploaded local classification model The weight parameters of For aggregation to obtain the aggregation result ω t And judge whether t = T holds. If so, obtain the federated learning global classification model X with weight parameters ω T Otherwise, set t = t + 1, T And execute step (3). And execute step (3).

[0019] The present invention has the following advantages compared with the prior art:

[0020] In each client of the present invention, the Gaussian noise scale value satisfying differential privacy guarantee is calculated according to the privacy budget value of each model layer in the local classification model during each iteration process, and the noise value satisfying the Gaussian distribution is calculated according to the Gaussian noise scale value, and then the noise value is added to the weight parameters of each model layer to realize the perturbation of the local classification model. The client allocates different privacy budget values to different model layers of the local classification model according to the different feature types of the training data set extracted by each convolutional layer and the different influences of each fully connected layer on the model prediction classification effect. On the one hand, it can accurately control the noise added to each model layer, thereby controlling the perturbation degree of each model layer. On the other hand, it makes up for the defect that the perturbation degree of the model is low due to the too large privacy budget value of the model layer in the prior art, weakening the privacy protection ability of the model, and at the same time can avoid the high perturbation degree of the model due to the too small privacy budget value, which in turn leads to the low prediction classification accuracy of the model, effectively improving the privacy protection ability and prediction classification accuracy of the federated learning classification model. Description of the Drawings

[0021] Figure 1 It is a flowchart for implementing the present invention. Detailed Embodiments

[0022] The present invention will be further described in detail below in conjunction with the drawings and specific embodiments.

[0023] Refer to Figure 1 , the present invention includes the following steps:

[0024] Step 1) Construct a federated learning system:

[0025] Construct a federated learning system including a central server and N clients C = {c1, c2,..., c n ,..., c N}, where N ≥ 2, c n represents the nth client; in this embodiment, N = 100.

[0026] Step 2) The client initializes the federated learning local classification model and training parameters:

[0027] Each client c n initializes a local training data set containing M images of L target categories and annotates the targets of each image; initializes a local classification model X n including I model layers composed of K composite layers and F fully connected layers stacked in sequence, and each composite layer includes a convolutional layer, a ReLU layer, a Dropout layer, and a pooling layer stacked in sequence; initializes the aggregation round as t, the maximum aggregation round as T, T ≥ 100, and the local classification model of the client c n at the tth aggregation is The weight parameters and privacy budget values of the i-th model layer are respectively where t = 0 is set where L ≥ 2, M ≥ 500, K ≥ 2, F ≥ 2, and I = K + F;

[0028] The dataset used in this embodiment is the CIFAR-10 color image dataset of general objects. The number of target categories corresponding to this dataset is L = 10, which are: airplane, car, bird, cat, deer, dog, frog, horse, ship, and truck, and it contains a total of M = 60000 images. The pixel size of each image is 32×32, and each target category has 6000 images. In this embodiment, it is set that each client has 600 images, the number of composite layers in the local classification model is K = 2, the number of fully connected layers is F = 2. The convolutional kernel sizes of the convolutional layers in the two composite layers are both 3, and the numbers of convolutional kernels are 32 and 64 respectively. The dropout probabilities of the Dropout layers are both 0.25, the window shapes of the pooling layers are both 2×2, the input of the first fully connected layer is 4096, the output is 1024, the input of the second fully connected layer is 1024, the output is 10, and the maximum aggregation round is T = 300.

[0029] Step 3) The client iteratively trains the local classification model:

[0030] Step 3a) Each client c n uses B training data randomly selected with replacement from the local training dataset as the input for the forward propagation of the local classification model : The convolutional layers in the K composite layers extract the features of each training data, the ReLU layer performs non-linear processing on the extracted features, the Dropout layer probabilistically discards the features after non-linear processing, the pooling layer compresses the probabilistically discarded features, and this is done K times. The F fully connected layers make predictions on the corresponding training data according to the features of each training data after the K-th compression, obtaining B predicted labels where represents the predicted label of the b-th training data;

[0031] In this example, B = 32. The convolutional layer of the first composite layer extracts 32 features of 32×32. The Dropout layer will discard each feature with a probability of 0.25, and the pooling layer compresses them to obtain 32 features of 16×16. The convolutional layer of the second composite layer extracts 64 features of 16×16. The Dropout layer will discard each feature with a probability of 0.25, and the pooling layer compresses them to obtain 64 features of 8×8. The 2 fully connected layers classify the results of the pooling layer to obtain 10 predicted labels.

[0032] Step 3b) Each client c n Using the cross entropy loss function, the predicted label of each training data The corresponding true label Compute local classification model The loss value And using the stochastic gradient descent algorithm, by Local classification model The weight parameter The partial derivative of right The weight parameter Update and get the weight parameter as Local classification model

[0033] In this step, the local classification model The loss value And weight parameters The calculation and update formulas are:

[0034]

[0035]

[0036] Where ∑ represents a summation operation, log represents a logarithmic operation, and η>0 represents a learning rate. In this example, η=0.01.

[0037] Step 4) The client perturbs the local classification model:

[0038] Step 4a) Each client c n Based on local classification model Privacy budget for each model layer Calculate the Gaussian noise scale value that meets differential privacy guarantees And according to Calculate the noise value of each model layer to satisfy the Gaussian distribution

[0039] In this step, the Gaussian noise scale value and noise values The calculation formulas are:

[0040]

[0041]

[0042] in, represents sensitivity, δ represents the local classification model The probability of not satisfying the differential privacy technology, where exp represents the exponential function with the natural constant e as the base, s represents a random number, μ represents the mathematical expectation, represents the standard deviation.

[0043] The differential privacy technology controls the perturbation degree by controlling the privacy budget value of each model layer, and further controls the privacy protection ability of the composite layer and the prediction classification effect of the fully connected layer. In step 2), the privacy budget values of the two composite layers are 10 and 8 respectively, and the privacy budget values of the two fully connected layers are 4 and 6 respectively. The smaller the privacy budget value of each composite layer, the larger the Gaussian noise scale value calculated according to the privacy budget value, and the larger the noise value calculated according to the Gaussian noise scale value. The larger the privacy budget value of each fully connected layer, the smaller the Gaussian noise scale value calculated according to the privacy budget value, and the smaller the noise value calculated according to the Gaussian noise scale value.

[0044] In this embodiment, μ = 0.

[0045] Step 4b) Each client c n Adds the noise value to the weight parameters of each model layer to achieve the perturbation of the local classification model and obtains the perturbed local classification model with the weight parameter of And uploads to the central server;

[0046] Adding the noise value calculated for each model layer in step 4a) to the corresponding composite layer and fully connected layer. The larger the noise value, the higher the perturbation degree of the composite layer, the better the privacy protection ability, and the lower the probability of leaking local training data, thus improving the privacy protection ability of the entire federated learning classification model; the smaller the noise value, the lower the perturbation degree of the fully connected layer, and the smaller the impact on the model prediction classification effect, thus improving the prediction classification accuracy of the entire federated learning classification model.

[0047] In this step, since each client c n uploads the local classification model with the weight parameter of after adding Gaussian noise the attacker obtains Due to the existence of Gaussian noise, it cannot pass to infer the local training data.

[0048] Step 5) The central server obtains the training results of the federated learning system:

[0049] The central server randomly selects V clients c v ​The uploaded local classification model of weight parameters are aggregated to obtain the aggregation result ω t , and it is judged whether t = T holds. If so, the weight parameter is ω T of the federated learning global classification model X T , otherwise let t = t + 1, and execute step 3).

[0050] In this step, the central server selects V t client c v of the uploaded local classification model of weight parameters for aggregation. The aggregation formula is as follows:

[0051]

[0052] where 1 ≤ V t ≤ N. In this embodiment, V t = 10.

Claims

1. A method for training a federated learning classification model based on model perturbation, characterized in that It includes the following steps: (1) Construct a federated learning system: Initialize a federated learning system including a central server and N clients C = {c1, c2, …, c n , …, c N}, where N ≥ 2, and c n represents the nth client; (2) The client initializes the local classification model and training parameters of federated learning: Each client c n Initialize a local training dataset containing M images of L target categories, and label the targets of each image; Initialize a local classification model X including I model layers composed of K composite layers and F fully connected layers stacked in sequence n , each composite layer includes a convolutional layer, a ReLU layer, a Dropout layer, and a pooling layer stacked in sequence; Initialize the aggregation round as t, the maximum aggregation round as T, T≥100, and the local classification model of client c at the t-th aggregation n is The weight parameter and privacy budget value of the i-th model layer are respectively where, and let t = 0, where, L≥2, M≥500, K≥2, F≥2, I = K + F; (3) The client iteratively trains the local classification model: (3a) Each client c n uses B training data randomly selected with replacement from the local training dataset as the input for the forward propagation of the local classification model : The convolutional layers in the K composite layers extract the features of each training data. The ReLU layer performs non-linear processing on the extracted features. The Dropout layer probabilistically discards the non-linearly processed features. The pooling layer compresses the probabilistically discarded features, and this is done K times. The F fully connected layers make predictions for the corresponding training data based on the features of each training data after the Kth compression, obtaining B predicted labels Among them, represents the predicted label of the bth training data; (3b) Each client c n uses the cross-entropy loss function to calculate the loss value of the local classification model through the predicted label of each training data and its corresponding true label and uses the stochastic gradient descent algorithm to update the weight parameters of the local classification model by taking the partial derivative of the weight parameters of the local classification model to obtain the local classification model with the weight parameters and uses the stochastic gradient descent algorithm through the local classification model of the weight parameters of the partial derivative for the weight parameters to update and obtain the local classification model with the weight parameters as (4) The client perturbs the local classification model: (4a) Each client c n According to the local classification model The privacy budget value of each model layer Calculate the Gaussian noise scale value that satisfies the differential privacy guarantee And according to Calculate the noise value that satisfies the Gaussian distribution for each model layer (4b) Each client c n adds the noise value to the weight parameters of each model layer to implement the perturbation of the local classification model and obtains the perturbed local classification model with the weight parameters and uploads it to the central server; (5) The central server obtains the training results of the federated learning system: The central server randomly selects V clients c v The locally classified models uploaded Of the weight parameters Are aggregated to obtain an aggregation result ω t , and determine whether t = T holds. If so, obtain the weight parameter as ω T Of the federated learning global classification model X T , otherwise set t = t + 1, And execute step (3).

2. The method for training a federated learning classification model based on model perturbation according to claim 1, wherein The local classification model X described in step (2) n , the number of composite layers it contains K = 2, the number of fully connected layers F = 2, the convolutional kernel sizes of the convolutional layers in the two composite layers are both 3, the numbers of convolutional kernels are 32 and 64 respectively, the dropout probabilities of Dropout are both 0.25, and the window shapes of the pooling layers are both 2×2.

3. The method for training a federated learning classification model based on model perturbation according to claim 1, wherein The local classification model described in step (3b) of the loss value and the weight parameter The update formulas are respectively as follows: Where, ∑ represents the summation operation, log represents the logarithmic operation, and η > 0 represents the learning rate.

4. The method for training a federated learning classification model based on model perturbation according to claim 1, wherein: The Gaussian noise scale value described in step (4a) and the noise value The calculation formulas are respectively as follows: Among them, represents sensitivity, and δ represents the local classification model is the probability of not satisfying the differential privacy technology, exp represents the exponential function with the natural constant e as the base, s represents a random number, μ represents the mathematical expectation, represents the standard deviation.

5. The method for training a federated learning classification model based on model perturbation according to claim 1, wherein: The central server described in step (5) selects V t client c v The locally classified model uploaded Weight parameters of For aggregation, the aggregation formula is as follows: Among them, 1 ≤ V t ≤ N.

Images