A differential privacy image classification method and device based on federated learning

Abstract

The present invention discloses a differential privacy image classification method and device based on federated learning. The method comprises: performing local model training using a local image set and an adaptive gradient descent algorithm and a stochastic gradient descent algorithm; setting a dynamic learning rate value range of [η l ,η u ]; where the upper bound η u =r+α * , take the lower bound η l =α * ; r is the standardized first-order momentum estimate, α * The final learning rate is obtained; based on the training results, the local parameter #imgabs0# and the difference between the local parameter and the global parameter from the previous round are obtained, and the sparsified parameter difference is sent to the server for aggregation to form the global parameter with differential privacy noise added; the global parameter is obtained to update the local model; the above process is repeated until the optimized local model is obtained, and the image to be classified is processed using it. This method ensures that the model converges to the global optimum and achieves good generalization ability, and effectively avoids model backpropagation by utilizing differential privacy noise.

Description

Technical Field

[0001] The present invention belongs to the technical field of image classification, and specifically relates to a differentially private image classification method and device based on federated learning. Background Art

[0002] For deep learning algorithms to ensure that intelligent agents can make judgments and outputs in accordance with human expectations, they must be trained through extensive interactions with the environment to enhance their decision-making capabilities. However, in some specialized fields, the peculiarities of data sources often prevent the provision of large amounts of accurate and reliable shared data for training. For example, in the medical field, when deep learning algorithms are used to classify medical images, the data cannot be shared because it contains private patient information, leading to data silos and data privacy issues.

[0003] To address these practical issues, federated learning algorithms based on distributed machine learning have emerged. In federated learning algorithms, users can train image classification models on their own clients using private data, and then send the trained image classification models to a central server to obtain a global model.

[0004] However, existing federated learning algorithms still suffer from the following drawbacks in practical use: The learning rate in most existing federated learning algorithms is fixed, resulting in significant impacts on small batches of data during image classification model training. While adaptive gradient descent algorithms exist to update the learning rate with each training update of image classification models, they often converge to local optima in actual computations, resulting in low generalization capabilities. Furthermore, the high communication costs associated with frequent parameter exchange between individual clients and the central processor in existing federated learning algorithms are a significant drawback in practical use. Furthermore, there is a lack of a viable privacy protection method to prevent model backpropagation. Summary of the Invention

[0005] The purpose of the present invention is to provide a differentially private image classification method and device based on federated learning, which is used to solve the technical problems that the existing federated learning algorithm is prone to converge to the local optimum when training the image classification model, has low model generalization ability, and has hidden dangers of model inversion.

[0006] To achieve the above objectives, the present invention proposes the following technical solutions:

[0007] A differentially private image classification method based on federated learning, including:

[0008] The local model is trained by the local image set and the adaptive gradient descent algorithm and the stochastic gradient descent algorithm; wherein, the dynamic learning rate is set in the adaptive gradient descent algorithm to have a value range of [η l ,η u ] to achieve automatic switching between the adaptive gradient descent algorithm and the stochastic gradient descent algorithm; wherein the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α * is the final learning rate;

[0009] Based on the above training results, the local parameters of this round and the parameter difference between the local parameters and the global parameters of the previous round are obtained; the local parameters of this round are Among them, w t-1 is the local parameter of the previous round, is the bias correction value of the first-order momentum estimation in this round, and η' is the clipping learning rate;

[0010] Sending the sparsified parameter differences to a server for aggregation and forming global parameters with differential privacy noise added;

[0011] Obtaining the global parameters to update the local model;

[0012] Repeat the above process until the optimal local model is obtained;

[0013] Image classification is performed on the image to be classified using the optimized local model.

[0014] Furthermore, the training of the local model using the local image set and the adaptive gradient descent algorithm includes:

[0015] Calculate the gradient g of the objective function of the tth round of iteration t =▽ w f t (w t-1 ); where w t-1 is the weight matrix of the t-1th round, f t is the objective function;

[0016] Calculate the first-order momentum estimate m of the tth round based on the gradient gt t =β1m t-1 +(1-β1)g t , and the second-order momentum estimate V t =β2V t-1 +(1-β2)g t 2 ; Among them, β1 and β2 are hyper parameters, mt-1 is the first-order momentum estimate for the t-1th round, V t-1 is the second-order momentum estimate for round t-1;

[0017] pass Compute the first-order momentum estimate bias correction value by Calculate the second-order momentum estimate bias correction value; and pass Compute the normalized first-order momentum estimate;

[0018] By η u =r+α * Get the upper bound η u , and by η l =α * Get the lower bound η l .

[0019] Furthermore, the clipping learning rate is Among them, α t is the initial learning rate of the tth round.

[0020] Furthermore, before the local model is trained using the local image set and the adaptive gradient descent algorithm, the following steps are included:

[0021] Get the binary message corresponding to the encoded global model;

[0022] The binary message is decoded into a tensor form to construct the local model.

[0023] Furthermore, sending the parameter difference value subjected to the sparse processing to the server includes:

[0024] Obtain non-zero elements in parameter differences based on the top-k sparsification algorithm;

[0025] quantizing the non-zero elements into a ternary tensor based on a sign function;

[0026] A binary message corresponding to the ternary tensor is sent to the server.

[0027] Furthermore, obtaining the global parameters to update the local model includes:

[0028] Obtain the global parameters after sparse processing and encoding;

[0029] The global parameters are decoded to update the local model.

[0030] Furthermore, the encoding is performed using Golomb encoding.

[0031] Furthermore, the global parameters are based on Obtain; Among them, Mt+1 is the global model of the t+1th round, M t is the global model of round t, K is the number of clients, N GS (σ 2 S 2 ) is the differential privacy noise, is the scaled parameter difference, where m k is the local model of the k-th client, ||·||2 is the Euclidean distance, and S is each set of outputs of the random algorithm.

[0032] A differentially private image classification device based on federated learning, comprising:

[0033] The model training module is used to train the local model using the local image set and the adaptive gradient descent algorithm; wherein the dynamic learning rate in the adaptive gradient descent algorithm has a value range of [η l ,η u ], where the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α * is the final learning rate;

[0034] The parameter updating module is used to obtain the local parameters of this round and the parameter difference between the local parameters and the global parameters of the previous round based on the above training results; the local parameters of this round are Among them, w t-1 is the local parameter of the previous round, is the bias correction value of the first-order momentum estimation in this round, and η' is the clipping learning rate;

[0035] A parameter sending module sends the sparsified parameter differences to a server for aggregation and formation of global parameters with differential privacy noise added;

[0036] A parameter acquisition module, configured to acquire the global parameters to update the local model;

[0037] A loop module is used to repeatedly call the above modules in sequence until the optimized local model is obtained;

[0038] The image classification module is used to perform image classification processing on the image to be classified through the optimized local model.

[0039] Further, including:

[0040] The model construction module is used to first obtain a binary message corresponding to the encoded global model and then decode the binary message into a tensor form to construct the local model.

[0041] Beneficial effects:

[0042] It can be seen from the above technical solutions that the technical solution of the present invention provides a differential privacy image classification method based on federated learning.

[0043] The method comprises: first, training a local model by using a local image set and an adaptive gradient descent algorithm and a stochastic gradient descent algorithm; and setting a dynamic learning rate in the adaptive gradient descent algorithm to have a value range of [η l ,η u ] to realize the automatic switching between the adaptive gradient descent algorithm and the stochastic gradient descent algorithm; where the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α * is the final learning rate. Secondly, local parameters are obtained based on the above training results Among them, w t-1 is the local parameter of the previous round, is the first-order momentum estimation bias correction value, η' is the clipping learning rate; and the parameter difference between the local parameters and the global parameters from the previous round is sent to the server for aggregation and formation of global parameters with differential privacy noise added. Furthermore, the global parameters are obtained to update the local model. The above process is repeated until the optimized local model is obtained. Finally, the image to be classified is processed using the optimized local model.

[0044] In the above method, bounds are set on the dynamic learning rate in the adaptive gradient descent algorithm. The upper bound is a dynamic parameter constructed from the standardized first-order momentum estimate and the final learning rate, while the lower bound is a fixed parameter constructed from the final learning rate. Since the first-order momentum estimate is a parameter related to the number of iterations when using the adaptive gradient descent algorithm, the bounds on the dynamic learning rate are also related to the number of iterations. Based on the bounds on the dynamic learning rate, the adaptive gradient descent algorithm can automatically switch to the stochastic gradient descent algorithm for iterative model training. Therefore, on the one hand, faster learning speed can be achieved in the early stages of local model training; on the other hand, better generalization ability can be achieved in the later stages of local model training, thereby ensuring convergence to the global optimum. Furthermore, the standardized first-order momentum estimate and the final learning rate are both process parameters in the adaptive gradient descent algorithm and do not affect the normal operation of the entire algorithm. Furthermore, since the client only uploads the parameter differences, which are then sparsely compressed, communication costs are reduced to a certain extent. Furthermore, since the aggregated global parameters contain differential privacy noise, the model can be effectively prevented from being reversed. This is more practical than privacy protection methods under encryption mechanisms.

[0045] This technical solution also provides a differentially private image classification device based on federated learning. The device sequentially includes a model training module, a parameter update module, a parameter acquisition module, a loop module, and an image classification module.

[0046] The model training module is used to train the local model through the local image set and the adaptive gradient descent algorithm; wherein the value range of the dynamic learning rate in the adaptive gradient descent algorithm is [η l ,η u ], where the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α * is the final learning rate. Therefore, the device also has the advantages of fast convergence speed and strong generalization ability during model training, and can always converge to the global optimum. The parameter transmission module only uploads parameter differences, thereby effectively reducing communication costs. Furthermore, the global parameters obtained by the parameter acquisition module are added with differential privacy noise, thereby further improving the confidentiality of the parameters.

[0047] It should be appreciated that all combinations of the foregoing concepts, as well as additional concepts described in greater detail below, to the extent such concepts are not mutually inconsistent, can be considered to be part of the inventive subject matter of this disclosure.

[0048] The foregoing and other aspects, embodiments, and features of the present invention will be more fully understood from the following description in conjunction with the accompanying drawings. Other additional aspects of the present invention, such as features and / or beneficial effects of the exemplary embodiments, will become apparent from the following description or through practice of specific embodiments according to the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings are not intended to be drawn to scale. In the drawings, each identical or nearly identical component shown in various figures may be represented by the same reference numeral. For the sake of clarity, not every component is labeled in every figure. Embodiments of various aspects of the present invention will now be described by way of example and with reference to the accompanying drawings, in which:

[0050] Figure 1 This is a flow chart of the differentially private image classification method based on federated learning described in this embodiment;

[0051] Figure 2 for Figure 1 Flowchart for creating local models;

[0052] Figure 3 for Figure 1 Flowchart of training according to the adaptive gradient descent algorithm;

[0053] Figure 4 for Figure 1 A flowchart of sending the updated parameters after the sparse processing to the server;

[0054] Figure 5 for Figure 1 Flowchart of obtaining global parameters to update local models. DETAILED DESCRIPTION

[0055] To further clarify the objectives, technical solutions, and advantages of the embodiments of the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only a portion of the embodiments of the present invention, not all of them. Based on the described embodiments of the present invention, all other embodiments derived by persons of ordinary skill in the art without requiring creative effort are within the scope of protection of the present invention. Unless otherwise defined, technical or scientific terms used herein shall have the ordinary meanings understood by persons of ordinary skill in the field to which the present invention pertains.

[0056] The words "first", "second" and similar terms used in the patent application specification and claims of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, unless the context clearly indicates otherwise, the singular forms of "a", "an" or "the" and similar terms do not indicate a quantitative limitation, but rather indicate the presence of at least one. Words such as "include" or "comprise" mean that the elements or objects appearing before "include" or "comprise" include the features, wholes, steps, operations, elements and / or components listed after "include" or "comprise", and do not exclude the existence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0057] In the differentially private image classification process based on federated learning, existing gradient descent algorithms are prone to convergence to local optima and have low model generalization capabilities. Furthermore, the communication cost between the client and the server is high, and there is also the risk of model backpropagation. Therefore, they cannot fully meet the training requirements of existing image classification models. The present invention aims to provide a differentially private image classification method and apparatus based on federated learning. By improving the local model training process through relevant improvements in the learning rate, it ultimately achieves the goal of simultaneously solving each of the above technical problems.

[0058] like Figure 1 As shown, the method includes:

[0059] Step S102: training the local model using the local image set and the adaptive gradient descent algorithm and the stochastic gradient descent algorithm; wherein, in the adaptive gradient descent algorithm, the dynamic learning rate is set to a value range of [η l ,η u ] to achieve automatic switching between the adaptive gradient descent algorithm and the stochastic gradient descent algorithm; wherein the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α * is the final learning rate.

[0060] In the specific implementation, a boundary constraint is set for the dynamic learning rate in the adaptive gradient descent algorithm. The upper limit of the value is a dynamic parameter constructed by the standardized first-order momentum estimate and the final learning rate, and the lower limit of the value is a fixed parameter constructed by the final learning rate. Since the first-order momentum estimate is a parameter related to the number of iterations when using the adaptive gradient descent algorithm, the boundary constraint of the dynamic learning rate is also related to the number of iterations. At this time, based on the boundary constraint of the dynamic learning rate, the adaptive gradient descent algorithm can be automatically switched to the stochastic gradient descent algorithm for iterative training of the model. Therefore, on the one hand, a faster learning speed can be obtained in the early stage of training the local model; on the other hand, in the later stage of training the local model, the model can obtain better generalization ability, thereby ensuring convergence to the global optimum. Moreover, the standardized first-order momentum estimate and the final learning rate are both process parameters in the adaptive gradient descent algorithm and will not affect the normal progress of the entire algorithm.

[0061] The local model in this step comes from the server, such as Figure 2 As shown, as a specific implementation method, its construction is carried out through the following steps:

[0062] Step S100.2: Obtain a binary message corresponding to the encoded global model.

[0063] In this step, the encoding is performed using Golomb encoding, a lossless data processing method that effectively prevents anomalies in the original data related to the global model during the encoding process.

[0064] Step S100.2: Decode the binary message into a tensor form to construct the local model.

[0065] like Figure 3 As shown in FIG. 1 , as a specific implementation, the training of the local model using the local image set and the adaptive gradient descent algorithm is performed through the following steps:

[0066] S102.2. Calculate the gradient g of the objective function for the tth iteration t =▽ w f t (w t-1 ); where w t-1 is the weight matrix of the t-1th round, f t is the objective function;

[0067] S102.4. Calculate the first-order momentum estimate m for the tth round based on the gradient gt t =β1m t-1 +(1-β1)g t , and the second-order momentum estimate V t =β2Vt-1 +(1-β2)g t 2 ; Among them, β1 and β2 are hyper parameters, m t-1 is the first-order momentum estimate for the t-1th round, V t-1 is the second-order momentum estimate for round t-1;

[0068] S102.6, pass Compute the first-order momentum estimate bias correction value by Calculate the second-order momentum estimate bias correction value; and pass Compute the normalized first-order momentum estimate;

[0069] S102.8, through η u =r+α * Get the upper bound η u , and by η l =α * Get the lower bound η l .

[0070] Step S104: Based on the above training results, obtain the local parameters of this round and the parameter difference between the local parameters and the global parameters of the previous round; the local parameters of this round are Among them, w t-1 is the local parameter of the previous round, is the bias correction value of the first-order momentum estimation in this round, and η' is the clipping learning rate.

[0071] Specifically, the clipping learning rate Among them, α t is the initial learning rate of the tth round.

[0072] Step S106: Send the sparsified parameter differences to the server for aggregation and forming global parameters with differential privacy noise added.

[0073] As a specific implementation method, Figure 4 The sending of the parameter difference value subjected to the sparse processing to the server includes:

[0074] Step S106.2: Obtain non-zero elements in the parameter difference based on the top-k sparsification algorithm.

[0075] Step S106.4: quantize the non-zero elements into a ternary tensor based on a sign function.

[0076] Step S106.8: Send a binary message corresponding to the ternary tensor to the server; wherein the binary message is encoded using Golomb encoding.

[0077] In this step, since the client only uploads the parameter differences, communication costs are reduced to a certain extent. Furthermore, since differential privacy noise is added to the global parameters, the risk of model inversion is prevented, improving the confidentiality of relevant personal privacy data.

[0078] The differential privacy is defined as follows:

[0079] Suppose there are two adjacent datasets D1 and D2 (the two datasets differ in one and only one record), and M is a random algorithm that accesses the database and implements some function. In any adjacent datasets D1 and D2, each set of outputs S of random algorithm M is obtained if algorithm M satisfies the following conditions:

[0080] P r [M(D1)∈S]≤e ε P r [M(D2)∈S];

[0081] Then the random algorithm M is said to provide ε-differential privacy. r represents the possibility of privacy leakage, e represents the exponential function, and ε is the privacy protection parameter that controls the degree of difference caused by two adjacent data sets.

[0082] The differential privacy noise is specifically Gaussian noise, which provides a relaxed (ε, δ)-DP mechanism, defined as follows:

[0083] For any δ∈(0,1), Noisy Y~N(0,σ 2 ) satisfies (ε,δ)-differential privacy. The following formula holds:

[0084] P r [M(D1)∈S]≤e ε P r [M(D2)∈S]+δ;

[0085] Where M(D1) = f'(D1) + Y. f' represents the query function, ε represents the privacy budget, which is negatively correlated with the noise. Δf' represents the sensitivity, σ is the standard deviation of the Gaussian distribution, which determines the noise scale, and δ represents the relaxation term.

[0086] Based on this, the global parameters are based on Obtain; Among them, M t+1 is the global model of the t+1th round, M t is the global model of round t, K is the number of clients, N GS (σ 2 S 2 ) is the differential privacy noise, is the scaled parameter difference, where m kis the local model of the k-th client, ||·||2 is the Euclidean distance, and S is each set of outputs of the random algorithm.

[0087] Step S108: Acquire the global parameters to update the local model.

[0088] In order to further reduce the communication cost between the client and the server, the server also performs sparse processing when sending global parameters to the client. Figure 5 As shown, step S108 is specifically performed as follows:

[0089] Step S108.2: Obtain the global parameters after the sparse processing and encoding; the encoding is performed using the Golomb encoding method.

[0090] Step S108.4: Decode the global parameters to update the local model.

[0091] Step S110, repeat the above process until the optimized local model is obtained;

[0092] Step S112: performing image classification processing on the image to be classified using the optimized local model.

[0093] The above method process can be executed in a processor or stored in a memory (or computer-readable medium). Computer-readable media includes permanent and non-permanent, removable and non-removable media that can implement information storage by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0094] These computer programs can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps of the functions specified in one or more blocks can be implemented by different modules corresponding to different steps.

[0095] This embodiment also provides a differentially private image classification device based on federated learning. The device includes:

[0096] The model training module is used to train the local model using the local image set and the adaptive gradient descent algorithm; wherein the dynamic learning rate in the adaptive gradient descent algorithm has a value range of [η l ,η u ], where the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α * is the final learning rate;

[0097] The parameter updating module is used to obtain the local parameters of this round and the parameter difference between the local parameters and the global parameters of the previous round based on the above training results; the local parameters of this round are Among them, w t-1 is the local parameter of the previous round, is the bias correction value of the first-order momentum estimation in this round, and η' is the clipping learning rate;

[0098] A parameter sending module sends the sparsified parameter differences to a server for aggregation and formation of global parameters with differential privacy noise added;

[0099] A parameter acquisition module, configured to acquire the global parameters to update the local model;

[0100] A loop module is used to repeatedly call the above modules in sequence until the optimized local model is obtained;

[0101] The image classification module is used to perform image classification processing on the image to be classified through the optimized local model.

[0102] In a specific implementation, the model training module is used to train the local model through the local image set and the adaptive gradient descent algorithm; wherein, the value range of the dynamic learning rate in the adaptive gradient descent algorithm is [η l ,η u ], where the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α *is the final learning rate. Therefore, the device also has the advantages of fast convergence speed and strong generalization ability during model training, and can always converge to the global optimum. The parameter transmission module only uploads parameter differences, thereby effectively reducing communication costs. Furthermore, the global parameters obtained by the parameter acquisition module are added with differential privacy noise, thereby further improving the confidentiality of the parameters.

[0103] Specifically, a model construction module is provided for first obtaining a binary message corresponding to the encoded global model, and then decoding the binary message into a tensor form to construct the local model.

[0104] While the present invention has been disclosed above with reference to preferred embodiments, this is not intended to limit the present invention. Persons skilled in the art will readily appreciate that various modifications and variations can be made without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the claims.

Claims

1. A differentially private image classification method based on federated learning, characterized by: include: Step S102, training the local model using the local image set and the adaptive gradient descent algorithm and the stochastic gradient descent algorithm; wherein, in the adaptive gradient descent algorithm, the dynamic learning rate is set to a value range of [η l ,η u ] to achieve automatic switching between the adaptive gradient descent algorithm and the stochastic gradient descent algorithm; The training of the local model includes the following steps: Calculate the gradient of the objective function for the tth iteration Among them, w t-1 is the weight matrix of the t-1th round, f t is the objective function, w is the weight matrix; Based on the gradient g t Calculate the first-order momentum estimate m for round t t =β1m t-1 +(1-β1)g t , and the second-order momentum estimate V t =β2V t-1 +(1-β2)g t 2 ; Among them, β1 and β2 are hyper parameters, m t-1 is the first-order momentum estimate for the t-1th round, V t-1 is the second-order momentum estimate for round t-1; pass Compute the first-order momentum estimate bias correction value by Calculate the second-order momentum estimate bias correction value; and pass Computes the normalized first-order momentum estimate; where, and is a hyperparameter; By η u =r+α * Get the upper bound η u , and by η l =α * Get the lower bound η l ; where r is the standardized first-order momentum estimate, α * is the final learning rate; Step S104, based on the training results of the local model, obtain the local parameters of this round and the parameter difference between the local parameters of this round and the global parameters of the previous round; the local parameters of this round are Among them, w t-1 is the local parameter of the previous round, is the bias correction value of the first-order momentum estimation in this round, and η' is the clipping learning rate; Step S106: Send the sparsified parameter differences to the server for aggregation and forming global parameters with differential privacy noise added. Sending the sparsified parameter differences to the server includes: first, obtaining non-zero elements in the parameter differences based on a top-k sparsification algorithm; second, quantizing the non-zero elements into a ternary tensor based on a sign function; and then, sending a binary message corresponding to the ternary tensor to the server. Step S108, obtaining the global parameters to update the local model; wherein the global parameters are based on Obtain; Among them, M t+1 is the global model of the t+1th round, M t is the global model of round t, K is the number of clients, N GS (σ 2 S 2 ) is the differential privacy noise, is the scaled parameter difference, where m k is the local model of the kth client, ||·||2 is the Euclidean distance, and S is each set of outputs of the random algorithm; Step S110, repeating steps S102 to S108 in sequence until the optimized local model is obtained; Step S112: performing image classification processing on the image to be classified using the optimized local model.

2. The differentially private image classification method based on federated learning according to claim 1, characterized in that The expression of the clipping learning rate is: Among them, α t is the initial learning rate of the tth round.

3. The differentially private image classification method based on federated learning according to claim 1, characterized in that: Before the local model is trained using the local image set and the adaptive gradient descent algorithm, the following steps are included: Get the binary message corresponding to the encoded global model; The binary message is decoded into a tensor form to construct the local model.

4. The differentially private image classification method based on federated learning according to claim 1, characterized in that Obtaining the global parameter to update the local model includes: Obtain the global parameters after sparse processing and encoding; The global parameters are decoded to update the local model.

5. The differentially private image classification method based on federated learning according to any one of claims 3-4, characterized in that: The encoding is performed by Golomb encoding.

6. A differentially private image classification device based on federated learning, characterized in that: include: The model training module is used to train the local model using the local image set and the adaptive gradient descent algorithm; wherein the dynamic learning rate in the adaptive gradient descent algorithm has a value range of [η l ,η u ], where the upper bound η u =r+α * , take the lower bound η l =α * ; where r is the standardized first-order momentum estimate, α * is the final learning rate; The training of the local model includes the following steps: Calculate the gradient of the objective function for the tth iteration Among them, w t-1 is the weight matrix of the t-1th round, f t is the objective function, w is the weight matrix; Based on the gradient g t Calculate the first-order momentum estimate m for round t t =β1m t-1 +(1-β1)g t , and the second-order momentum estimate V t =β2V t-1 +(1-β2)g t 2 ; Among them, β1 and β2 are hyper parameters, m t-1 is the first-order momentum estimate for the t-1th round, V t-1 is the second-order momentum estimate for round t-1; pass Compute the first-order momentum estimate bias correction value by Calculate the second-order momentum estimate bias correction value; and pass Computes the normalized first-order momentum estimate; where, and is a hyperparameter; By η u =r+α * Get the upper bound η u , and by η l =α * Get the lower bound η l ; The parameter update module is used to obtain the local parameters of this round and the parameter difference between the local parameters and the global parameters of the previous round based on the training results of the local model; the local parameters of this round are Among them, w t-1 is the local parameter of the previous round, is the bias correction value of the first-order momentum estimation in this round, and η' is the clipping learning rate; A parameter sending module sends the sparsified parameter differences to a server for aggregation and formation of global parameters with differential privacy noise added. The sending of the sparsified parameter differences to the server includes: first, obtaining non-zero elements in the parameter differences based on a top-k sparsification algorithm; second, quantizing the non-zero elements into a ternary tensor based on a sign function; and then, sending a binary message corresponding to the ternary tensor to the server. A parameter acquisition module is used to acquire the global parameters to update the local model; wherein the global parameters are based on Obtain; Among them, M t+1 is the global model of the t+1th round, M t is the global model of round t, K is the number of clients, N GS (σ 2 S 2 ) is the differential privacy noise, is the scaled parameter difference, where m k is the local model of the kth client, ||·||2 is the Euclidean distance, and S is each set of outputs of the random algorithm; A loop module is used to repeatedly call the model training module, parameter updating module, parameter sending module and parameter acquisition module in sequence until the optimized local model is obtained; The image classification module is used to perform image classification processing on the image to be classified through the optimized local model.

7. The differentially private image classification device based on federated learning according to claim 6, characterized in that include: The model construction module is used to first obtain a binary message corresponding to the encoded global model and then decode the binary message into a tensor form to construct the local model.

Images