A cost-aware privacy-preserving federated learning method for imbalanced data

Abstract

The present invention discloses a cost-aware privacy-preserving federated learning method for imbalanced data, comprising: step 11, in which local users share the structure of a local model and set a raw gradient clipping threshold and a privacy budget; step 12, in which the local model is trained and updated using a joint cost-aware and differentially private model parameter optimization mechanism, and the perturbation gradients of the trained local model are uploaded to a server as shared parameters; step 13, in which the server aggregates the perturbation gradients uploaded by local users participating in the global model update and updates the global model; step 14, in which the local user downloads the updated global model from the server, and the server verifies whether the accuracy of the global model exceeds a preset threshold using an attached dataset. If so, step 15 is executed; if not, steps 12 and 13 are repeated; and step 15 completes the privacy-preserving federated learning training process. This method effectively balances the accuracy of the federated learning global model and the privacy protection of user data.

Description

Technical Field

[0001] The present invention relates to the field of federated learning, and in particular to a cost-aware privacy-preserving federated learning method for imbalanced data. Background Art

[0002] In federated learning, due to factors such as the heterogeneity of local user data collection environments, local user data often exhibits an unbalanced distribution, meaning that the number of data corresponding to each data category varies. Unbalanced data can reduce the accuracy of the global federated learning model. Furthermore, existing gradient reconstruction attack methods can reconstruct the original data in the local dataset with high quality by analyzing the local model gradients, which serve as shared parameters. In this unbalanced data scenario, federated learning faces the dual challenges of reduced global model accuracy and the leakage of local user data privacy.

[0003] In view of this, the present invention is proposed. Summary of the Invention

[0004] The purpose of this invention is to propose a cost-aware privacy-preserving federated learning method for unbalanced data, which achieves a good balance between the accuracy of the federated learning global model and the privacy protection performance of user data, thereby solving the technical problems existing in the prior art.

[0005] The purpose of the present invention is achieved through the following technical solutions:

[0006] A cost-aware privacy-preserving federated learning method for imbalanced data includes the following steps:

[0007] Step 11: Local users share the network structure of the local model and set the original gradient clipping threshold and privacy budget;

[0008] Step 12: The local user trains the local model using the joint cost-aware and differential privacy model parameter optimization mechanism, completes the local model update, and uploads the trained local model perturbation gradient as a shared parameter to the server.

[0009] Step 13: The server aggregates the perturbation gradients uploaded by local users participating in the global model update to complete the global model update.

[0010] Step 14: The local user communicates globally with the server and downloads the updated global model from the server. The server uses the attached dataset to verify whether the accuracy of the global model is greater than a preset threshold. If so, step 15 is executed. If not, steps 12 and 13 are repeated.

[0011] Step 15: Complete the privacy-preserving federated learning training process.

[0012] Compared with the existing technology, the cost-aware privacy-preserving federated learning method for imbalanced data proposed in this paper has the following beneficial effects:

[0013] Local users train local models by using joint cost perception and differential privacy model parameter optimization mechanisms, adaptively modulating the loss function and clipping the gradients based on adding random noise to the local model gradients, thereby achieving a good balance between the accuracy of the global model of federated learning and the privacy protection performance of user data, and effectively solving the problem of local user data privacy leakage during the federated learning training process. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1 A flowchart of a cost-aware privacy-preserving federated learning method for imbalanced data provided by an embodiment of the present invention.

[0016] Figure 2 Schematic diagram of the image privacy protection performance against gradient-based reconstruction attacks provided by an embodiment of the present invention; wherein (a) is the original image, which, from left to right, is the original image of a frog, the original image of a deer, the original image of a ship, the original image of a bird, the original image of a cat, and the original image of a car; (b) is the reconstructed image without using the privacy protection method, which, from left to right, are the reconstructed image of a frog, the reconstructed image of a deer, the reconstructed image of a ship, the reconstructed image of a bird, the reconstructed image of a cat, and the reconstructed image of a car; (c) is the reconstructed image of the method of the present invention when the privacy budget is 4, which, from left to right, are the reconstructed image of a frog, the reconstructed image of a deer, the reconstructed image of a ship, the reconstructed image of a bird, the reconstructed image of a cat, and the reconstructed image of a car; (d) is the reconstructed image of the method of the present invention when the privacy budget is 8, which, from left to right, are the reconstructed image of a frog, the reconstructed image of a deer, the reconstructed image of a ship, the reconstructed image of a bird, the reconstructed image of a cat, and the reconstructed image of a car. DETAILED DESCRIPTION

[0017] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the specific content of the present invention. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments, and do not constitute a limitation of the present invention. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0018] First, the following terms may be used in this article:

[0019] The term “and / or” means that either or both of them can be realized at the same time. For example, X and / or Y includes both “X” or “Y” and “X and Y”.

[0020] The terms "include," "comprises," "contains," "has," or other similar expressions should be interpreted as non-exclusive. For example, "including certain technical features (such as raw materials, components, ingredients, carriers, dosage forms, materials, dimensions, parts, components, mechanisms, devices, steps, procedures, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products, or manufactured articles, etc.) should be interpreted as including not only the technical features explicitly listed, but also other technical features known in the art that are not explicitly listed.

[0021] The term "consisting of" excludes any technical features not explicitly listed. If used in a claim, this term renders the claim closed, excluding any technical features other than those explicitly listed, except for conventional impurities associated with them. If this term appears only in a clause of a claim, it limits only the elements explicitly listed in that clause; elements listed in other clauses are not excluded from the claim as a whole.

[0022] Unless otherwise specified or limited, the terms "mounted," "connected," "connect," and "fixed" should be interpreted broadly. For example, they can refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediary; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in this document based on specific circumstances.

[0023] The terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings and are only for the convenience and simplification of description, and do not explicitly or implicitly indicate that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore should not be understood as a limitation to this document.

[0024] The following describes in detail a cost-aware, privacy-preserving federated learning method for imbalanced data proposed in this invention. Any information not described in detail in the examples of this invention represents prior art known to those skilled in the art. For any conditions not specified in the examples of this invention, the procedures were performed according to conventional conditions in the art or the conditions recommended by the manufacturer. For any reagents or instruments used in the examples of this invention without manufacturer identification, all are commercially available, conventional products.

[0025] like Figure 1 As shown, an embodiment of the present invention provides a cost-aware privacy-preserving federated learning method for unbalanced data, including the following steps:

[0026] Step 11: Local users share the network structure of the local model and set the original gradient clipping threshold and privacy budget;

[0027] Step 12: The local user trains the local model using the joint cost-aware and differential privacy model parameter optimization mechanism, completes the local model update, and uploads the trained local model perturbation gradient as a shared parameter to the server.

[0028] Step 13: The server aggregates the perturbation gradients uploaded by local users participating in the global model update to complete the global model update.

[0029] Step 14: The local user communicates globally with the server and downloads the updated global model from the server. The server uses the attached dataset to verify whether the accuracy of the global model is greater than a preset threshold. If so, step 15 is executed. If not, steps 12 and 13 are repeated.

[0030] Step 15: Complete the privacy-preserving federated learning training process.

[0031] In step 11 of the method, the network structure of the local model is ResNet-20, the local user initializes the model parameters of the local model according to the Gaussian distribution, sets the original gradient clipping threshold to C, and sets the privacy budget to ε.

[0032] In step 12 of the method, the local user trains the local model using the joint cost-aware and differential privacy model parameter optimization mechanism in the following manner to complete the local model update, including:

[0033] Step 121: If there are K local users C in the federated learning k ,1≤k≤K, each local user C k Has n k A local dataset D of original images k ,1≤k≤K, the local user calculates the noise intensity σ according to the privacy budget ε;

[0034] Among them, (ε,δ)-differential privacy is expressed as:

[0035] Pr[M(D k )∈S]≤exp(ε)Pr[M(D k ')∈S]+δ (1)

[0036] In formula (1), ε≥0, δ≥0, M:X→R is a randomization mechanism with output S; D k ,D k '∈X are adjacent data sets with the same size but differing by only one element; the deterministic real-valued function S(D k ) sensitivity Expressed as:

[0037]

[0038] The differential privacy process based on the Gaussian mechanism is expressed as:

[0039]

[0040] In formula (3), has a mean of 0 and a standard deviation of Gaussian distribution, I is the identity matrix.

[0041] Step 122: During the qth local model update, the local user calculates the gradient clipping factor Expressed as:

[0042]

[0043] In formula (4), is the cost-aware loss function at the qth local model update; is the cost-aware loss function at the q-1th local model update; z k,i =(x k,i ,y k,i )∈D k From the data x k,i and class label y k,i constitute; is the parameter of the last fully connected layer in the local model during the qth local model update; is the parameter of the last fully connected layer in the local model at the q-1th local model update; α>0 is a control parameter; the last fully connected layer in the local model has M×L parameters;

[0044] Cost-aware loss function at the qth local model update By the imbalance factor And the original loss function Calculated, expressed as:

[0045]

[0046] In formula (5), the original loss function Expressed as:

[0047]

[0048] In formula (6), M is the number of data categories; y k,i (m) is the data x k,i Corresponding to the true category label of the mth category, For data x k,i The predicted class label corresponding to the mth class; imbalance factor Expressed as:

[0049]

[0050] In formula (7), h l is the input value of the last fully connected layer in the local model.

[0051] Step 123, when the local model is updated for the qth time, the local user calculates the original gradient of the local model Expressed as:

[0052]

[0053] In formula (8), z k,i is the local dataset D k The data in the randomly sampled data set B.

[0054] Step 124: During the qth local model update, the local user calculates the original gradient of the clipped local model That is, the clipped gradient is expressed as:

[0055]

[0056] In formula (9), C q is the adaptive gradient clipping threshold at the qth local model update, expressed as:

[0057]

[0058] In formula (10), η C ≥1 is the gradient clipping learning rate.

[0059] Step 125, when the local model is updated for the qth time, the local user clips the gradient Add noise to get perturbed gradient To achieve differential privacy, it is expressed as:

[0060]

[0061] Step 126: The local user updates the local model, which is expressed as:

[0062]

[0063] Step 127: The local user repeats steps 122, 123, 124, 125, and 126 until the number of local model update rounds reaches a preset threshold value T. L The local model update is completed.

[0064] In step 13 of the method, the global model update is expressed as:

[0065]

[0066] In formula (13), w (t) is the global model parameter at the tth global communication; w (t+1) is the global model parameter at the t+1th global communication; η is the global model update learning rate; is the number of original images in the local dataset of all local users; is the kth local model perturbation gradient when the local user performs the tth global communication with the server.

[0067] In step 14 of the method, when all local users perform the t+1th global communication with the server, all local users download the updated global model w from the server. (t+1) , the server uses an auxiliary dataset that is independent and identically distributed with the local dataset to verify whether the accuracy of the global model is greater than a preset threshold. If so, step 15 is executed. If not, steps 12 and 13 are repeated.

[0068] In summary, the federated learning method of the embodiment of the present invention proposes a joint cost perception and model parameter optimization mechanism for unbalanced local user training data. It adaptively modulates the loss function and clips the gradient based on adding random noise to the local model gradient, thereby achieving a good balance between the accuracy of the global model of federated learning and the privacy protection performance of user data.

[0069] In order to more clearly demonstrate the technical solution proposed by the present invention and the technical effects produced, the following describes in detail a cost-aware privacy-preserving federated learning method for unbalanced data provided by an embodiment of the present invention using a specific embodiment.

[0070] Example 1

[0071] like Figure 1As shown, an embodiment of the present invention provides a cost-aware privacy-preserving federated learning method for unbalanced data, which mainly includes the following steps:

[0072] Step 11: Local users share the network structure of the local model and set the original gradient clipping threshold and privacy budget;

[0073] Among them, the network structure of the local model is ResNet-20, the local user initializes the parameters of the local model according to the Gaussian distribution, sets the original gradient clipping threshold to C, and sets the privacy budget to ε.

[0074] Step 12: The local user trains the local model using the joint cost-aware and differential privacy model parameter optimization mechanism, completes the local model update, and uploads the trained local model perturbation gradient as a shared parameter to the server.

[0075] The preferred implementation of this step 12 is as follows:

[0076] Step 121: If there are K local users C in the federated learning k ,1≤k≤K, each local user C k Has n k A local dataset D of original images k ,1≤k≤K, the local user calculates the noise intensity σ according to the privacy budget ε;

[0077] Among them, (ε,δ)-differential privacy is expressed as:

[0078] Pr[M(D k )∈S]≤exp(ε)Pr[M(D k ')∈S]+δ (1)

[0079] In formula (1), ε≥0, δ≥0, M:X→R is a randomization mechanism with output S, and D k ,D k '∈X are adjacent data sets with the same size but differing by only one element. The deterministic real-valued function S(D k ) sensitivity Expressed as:

[0080]

[0081] The differential privacy process based on the Gaussian mechanism is expressed as:

[0082]

[0083] In formula (3), has a mean of 0 and a standard deviation of Gaussian distribution, I is the identity matrix.

[0084] Step 122: During the qth local model update, the local user calculates the gradient clipping factor Expressed as:

[0085]

[0086] In formula (4), is the cost-aware loss function at the qth local model update, is the cost-aware loss function at the q-1th local model update, z k,i =(x k,i ,y k,i )∈D k From the data x k,i and class label y k,i constitute; is the parameter of the last fully connected layer in the local model during the qth local model update, is the parameter of the last fully connected layer in the local model at the q-1th local model update, and α>0 is a control parameter. The last fully connected layer in the local model has M×L parameters.

[0087] Cost-aware loss function at the qth local model update By the imbalance factor And the original loss function Calculated, expressed as:

[0088]

[0089] In formula (5), the original loss function Expressed as:

[0090]

[0091] In formula (6), M is the number of data categories, y k,i (m) is the data x k,i Corresponding to the true category label of the mth category, For data x k,i The predicted class label corresponding to the mth class. Unbalanced factor Expressed as:

[0092]

[0093] In formula (7), h l is the input value of the last fully connected layer in the local model.

[0094] Step 123, when the local model is updated for the qth time, the local user calculates the original gradient of the local model Expressed as:

[0095]

[0096] In formula (8), z k,i is the local dataset D k The data in the randomly sampled data set B.

[0097] Step 124: During the qth local model update, the local user calculates the original gradient of the clipped local model That is, the clipped gradient is expressed as:

[0098]

[0099] In formula (9), C q is the adaptive gradient clipping threshold at the qth local model update, expressed as:

[0100]

[0101] In formula (10), η C ≥1 is the gradient clipping learning rate.

[0102] Step 125, when the local model is updated for the qth time, the local user clips the gradient Add noise to get perturbed gradient To achieve differential privacy, it is expressed as:

[0103]

[0104] Step 126: The local user updates the local model, which is expressed as:

[0105]

[0106] Step 127: The local user repeats steps 122, 123, 124, 125, and 126 until the number of local model update rounds reaches a threshold value T. L The local model is updated as of now.

[0107] Step 13: The server aggregates the perturbation gradients uploaded by local users participating in the global model update to complete the global model update.

[0108] In step 13, the global model update is expressed as:

[0109]

[0110] In formula (13), w (t) is the global model parameter at the tth global communication, w (t+1)is the global model parameter at the t+1th global communication, η is the global model update learning rate, is the number of original images in the local dataset of all local users, is the kth local model perturbation gradient at the tth global communication.

[0111] Step 14: The local user communicates globally with the server and downloads the updated global model from the server. The server uses the attached dataset to verify whether the accuracy of the global model is greater than a preset threshold. If so, step 15 is executed. If not, steps 12 and 13 are repeated.

[0112] In step 14, all local users download the updated global model w from the server during the t+1th global communication (t+1) , the server uses an auxiliary dataset that is independent and identically distributed with the local dataset to verify whether the accuracy of the global model is greater than a preset threshold. If so, step 15 is executed. If not, steps 12 and 13 are repeated.

[0113] Step 15: Complete the privacy-preserving federated learning training process.

[0114] An embodiment of the present invention provides a cost-aware privacy-preserving federated learning method for unbalanced data. It proposes a joint cost-aware and model parameter optimization mechanism for unbalanced local user training data. It adaptively modulates the loss function and clips the gradient based on adding random noise to the local model gradient, thereby achieving a good balance between the accuracy of the global model of federated learning and the privacy protection performance of user data.

[0115] To test the global model accuracy and privacy protection performance of our proposed cost-aware privacy-preserving federated learning method for imbalanced data, we compared it with three other privacy-preserving federated learning methods, labeled A, B, and C. A is a privacy-preserving federated learning method based on stochastic gradient descent and Gaussian differential privacy, B is a privacy-preserving federated learning method based on Gaussian differential privacy and gradient clipping threshold descent, and C is a privacy-preserving federated learning method based on Gaussian differential privacy and an imbalanced loss function.

[0116] When testing global model accuracy and privacy protection performance, the datasets used were MNIST, Fashion-MNIST, and CIFAR-10, with stochastic gradient descent as the basic model optimization algorithm. The number of local users was set to 5, the number of global communication rounds was set to 3, the number of local model update rounds was set to 10, the size of the randomly sampled data set was set to 64, the learning rate was set to 0.01, the raw gradient clipping threshold was set to 5, and the privacy budgets used were 4 and 8, respectively. The data imbalance ratio was defined as the ratio of the number of data corresponding to the minority class to the number of data corresponding to the majority class and was set to 0.5. To test the privacy protection performance, the server used a gradient-based reconstruction attack to steal local user data. The privacy protection performance of the corresponding method was measured using the peak signal-to-noise ratio of the reconstructed image calculated with reference to the original image.

[0117] Table 1 Global model accuracy of different privacy-preserving federated learning methods

[0118]

[0119] Table 1 shows the global model accuracy of different privacy-preserving federated learning methods. The cost-aware privacy-preserving federated learning method for imbalanced data proposed in this paper can achieve the highest global model accuracy. Figure 2 A diagram shows the image privacy protection performance against gradient-based reconstruction attacks. Compared to images reconstructed without privacy protection, the proposed cost-aware privacy-preserving federated learning method for imbalanced data significantly reduces the peak signal-to-noise ratio of the reconstructed image, demonstrating the strong privacy protection performance of our method.

[0120] Those skilled in the art will appreciate that all or part of the processes in the method embodiments described above can be implemented by instructing related hardware through a program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the method embodiments described above. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0121] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or any form of implication that the information constitutes prior art already known to those skilled in the art.

Claims

1. A cost-aware privacy-preserving federated learning method for imbalanced data, characterized by: The steps include: Step 11: Local users share the network structure of the local model and set the original gradient clipping threshold and privacy budget; In step 12, the local user trains the local model using the joint cost-aware and differential privacy model parameter optimization mechanism, completes the local model update, and uploads the trained local model perturbation gradient as a shared parameter to the server, including: Step 121: If there are local users , each local user Possession includes A local dataset of raw images , local users according to their privacy budget Calculating noise intensity ; in, -Differential privacy is expressed as: (1)； In formula (1), , , The output is Randomization mechanism; are contiguous data sets of the same size that differ by only one element; deterministic real-valued function Sensitivity Expressed as: (2)； The differential privacy process based on the Gaussian mechanism is expressed as: (3)； In formula (3), has a mean of 0 and a standard deviation of Gaussian distribution, is the identity matrix; Step 122, in the When the local model is updated, the local user calculates the gradient clipping factor , expressed as: (4)； In formula (4), It is in Cost-aware loss function for sub-local model updates; It is in Cost-aware loss function for sub-local model updates; By data and category labels constitute; It is in The parameters of the last fully connected layer in the local model during the local model update; It is in The parameters of the last fully connected layer in the local model during the local model update; is the control parameter; the last fully connected layer in the local model has parameters; In the Cost-aware loss function for sub-local model update By the imbalance factor And the original loss function Calculated, expressed as: (5)； In formula (5), the original loss function Expressed as: (6)； In formula (6), is the number of data categories; For data Corresponding to The true category label of the class, For data Corresponding to The predicted class label of the class; imbalance factor Expressed as: (7) In formula (7), is the input value of the last fully connected layer in the local model; Step 123, in When the local model is updated, the local user calculates the original gradient of the local model , expressed as: (8)； In formula (8), Is a local dataset A randomly sampled data set Data in Step 124, in When the local model is updated, the local user calculates the original gradient of the clipped local model , that is, the clipped gradient, expressed as: (9)； In formula (9), For the The adaptive gradient clipping threshold during the local model update is expressed as: (10)； In formula (10), Clipping learning rates for gradients; Step 125, in When the local model is updated, the local user clips the gradient Add noise to get perturbed gradient To achieve differential privacy, it is expressed as: (11)； Step 126: The local user updates the local model, which is expressed as: (12)； Step 127: The local user repeats steps 122, 123, 124, 125, and 126 until the number of local model update rounds reaches a preset threshold. The local model update is completed until Step 13: The server aggregates the perturbation gradients uploaded by local users participating in the global model update to complete the global model update. Step 14: The local user communicates globally with the server and downloads the updated global model from the server. The server uses the attached dataset to verify whether the accuracy of the global model is greater than a preset threshold. If so, step 15 is executed. If not, steps 12 and 13 are repeated. Step 15: Complete the privacy-preserving federated learning training process.

2. The cost-aware privacy-preserving federated learning method for imbalanced data according to claim 1, characterized in that: In step 11, the network structure of the local model is ResNet-20, and the local user initializes the model parameters of the local model according to the Gaussian distribution, and sets the original gradient clipping threshold to , setting the privacy budget to .

3. A cost-aware privacy-preserving federated learning method for unbalanced data according to claim 1 or 2, characterized in that: In step 13, the global model update is expressed as: (13)； In formula (13), It is in Global model parameters during sub-global communication; It is in Global model parameters during sub-global communication; is the global model update learning rate; is the number of original images in the local dataset of all local users; It is the first time that the local user communicates with the server. The first global communication local model perturbation gradient.

4. A cost-aware privacy-preserving federated learning method for imbalanced data according to claim 1 or 2, characterized in that: In step 14, all local users and the server perform the first During the first global communication, all local users download the updated global model from the server , the server uses an auxiliary dataset that is independent and identically distributed with the local dataset to verify whether the accuracy of the global model is greater than a preset threshold. If so, step 15 is executed. If not, steps 12 and 13 are repeated.

Images