Model training methods and federated learning systems based on federated learning

Abstract

A model training method and a federated learning system based on federated learning are disclosed. The method is applied to a federated learning system comprising a server and multiple nodes and includes: in t operations of model training, the server distributes a set of model parameters to n nodes; each of the n nodes performs gradient calculation using local training samples to obtain the original gradient, performs joint optimization using a utility metric and a privacy metric to obtain transformed samples, and generates uploaded data based on the transformed samples; and the server obtains the uploaded data and updates the set of model parameters. Thus, the transformed samples are implicitly extracted for generating perturbation gradients, thereby injecting utility and privacy information into the perturbation gradients. A utility metric for calculating gradient distance is designed in a weighted manner, with weights determined by element weights and layer weights of the parameters. Preferably, a trained evaluation network is used as a privacy metric, which learns how to evaluate differences in a manner consistent with human cognition.

Description

Technical Field

[0001] This disclosure relates to the field of machine learning, and more particularly to a model training method and a federated learning system based on federated learning. Background Technology

[0002] In recent years, artificial intelligence has ushered in a new wave of development, with machine learning playing a central role. Training a high-performing machine learning model requires collecting a large amount of high-quality data. However, in many application scenarios, privacy protection prevents the collection of private user data for centralized model training on servers, hindering the widespread adoption of machine learning.

[0003] To address this, multi-party collaborative modeling, which enables participants to collaboratively train a model without disclosing data, has been proposed to overcome data privacy issues. An important and common scenario in multi-party collaborative modeling is federated learning (FL). In federated learning, users locally use data to obtain updated values ​​(i.e., gradients) of the model according to a predetermined algorithm, and then feed these updated values ​​back to the server, thus preventing the local training data from being known to outsiders. However, it has been discovered that servers can use gradients uploaded by specific users to reverse and recover that user's local training data.

[0004] Therefore, a model training method is needed that can protect the security of local training data for federated learning users. Summary of the Invention

[0005] One technical problem this disclosure aims to solve is to provide a model training method based on federated training. This method departs from the conventional approach of directly perturbing the gradient to be uploaded in existing technologies. Instead, it creates transformed samples based on the training samples. These transformed samples contain minimal privacy information and produce utility closest to the original samples. Therefore, the difference between the transformed samples and the original training samples can be intuitively obtained to accurately estimate the privacy information contained in the uploaded data and avoids the difficulty of accurately deriving gradients to samples due to the nonlinear characteristics of neural networks.

[0006] According to a first aspect of this disclosure, a model training method based on federated learning is provided, applied to a federated learning system including a server and N nodes, where N > 1. The method includes: in the t-th operation of model training, performing: the server distributes a set of model parameters to the n nodes, where n ≤ N; each of the n nodes performs gradient calculation using local training samples to obtain the original gradient, and performs joint optimization using a utility metric and a privacy metric to obtain transformed samples. And based on transformed samples The process involves generating and uploading data, where i = 1, 2, ..., n, the utility metric representing the difference between the transformed gradient of the transformed sample and the original gradient, and the privacy metric representing the difference between the transformed sample and the training sample; and the server acquiring the uploaded data and updating the model parameter set.

[0007] Optionally, the uploaded data includes the transformed sample. Furthermore, the server trains on transformed samples from each of the n nodes to update the model parameter set; or the uploaded data includes data from transformed samples. Finding the gradient of the transformation Furthermore, the server acquires the transformation gradient. And update the model parameter set.

[0008] Optionally, the utility index is calculated using a weighted average, wherein the weights of the weighted average are associated with at least one of the following: the magnitude of the parameter value; the magnitude of the gradient corresponding to the parameter; and the layer in which the parameter resides.

[0009] Optionally, the privacy metric characterizes the distance of the transformed sample to the noise distribution. Optionally, a trained evaluation neural network is used to evaluate the distance of the transformed sample to the uniform noise distribution.

[0010] Optionally, the output of the evaluation neural network represents the distance from the transformed sample to the uniform noise distribution in a monotonically increasing or decreasing manner, and training data-label pairs are created for the evaluation neural network using interpolation to inject the aforementioned monotonically increasing or decreasing knowledge into the evaluation neural network.

[0011] Optionally, joint optimization using utility metrics and privacy metrics to obtain transformed samples includes: iterative calculation to obtain an optimized solution for the transformed samples that satisfies the target conditions of the utility metrics and the privacy metrics.

[0012] According to a second aspect of this disclosure, a federated learning system is provided, comprising a server and N nodes, where N > 1; the server, in the t-th operation of model training, distributes the model parameter set to M. i There are n nodes, where n ≤ N, and the M i Each node performs gradient calculation using its local training samples to obtain the original gradient, and performs joint optimization using utility and privacy metrics to obtain the transformed samples. And based on transformed samples The server generates and uploads data, where i = 1, 2, ..., n; the utility metric represents the difference between the transformed gradient of the transformed sample and the original gradient, and the privacy metric represents the difference between the transformed sample and the training sample; and the server also acquires the uploaded data and updates the model parameter set based on the uploaded data.

[0013] According to a third aspect of this disclosure, a model training method based on federated learning is provided, applied to nodes in a federated learning system, the federated learning system comprising N nodes and a server, where N > 1; the method includes: in the i-th operation of model training, performing: obtaining a set of model parameters issued by the server; performing gradient calculation using local training samples to obtain the original gradient; and performing joint optimization using utility metrics and privacy metrics to obtain transformed samples. And based on transformed samples The process involves generating and uploading data, where i = 1, 2, ..., n; the utility metric characterizes the difference between the transformed gradient of the transformed sample and the original gradient, and the privacy metric characterizes the difference between the transformed sample and the training sample; and sending the uploaded data to the server so that the server can update the model parameter set together with the uploaded data obtained from other nodes, wherein in the i-th operation, the server distributes the model parameter set to n nodes, including the current node and the other nodes, where n ≤ N.

[0014] According to a fourth aspect of this disclosure, a computing device is provided, comprising: a processor; and a memory having executable code stored thereon, which, when executed by the processor, causes the processor to perform the method described in the third aspect above.

[0015] According to a fifth aspect of this disclosure, a non-transitory machine-readable storage medium is provided, on which executable code is stored, which, when executed by a processor of an electronic device, causes the processor to perform the method described in the third aspect above.

[0016] Thus, transformed samples are implicitly used to generate perturbed gradients, greatly facilitating the injection of utility and privacy information into these perturbed gradients. A utility metric is designed as a utility measure, calculating gradient distances in a weighted manner, with weights determined by element weights and layer weights of parameters. Preferably, a trained evaluation network is used as a privacy measure. The evaluation network learns how to evaluate differences in a way consistent with human cognition. Attached Figure Description

[0017] The above and other objects, features and advantages of this disclosure will become more apparent from the more detailed description of exemplary embodiments thereof taken in conjunction with the accompanying drawings, wherein like reference numerals generally denote like parts.

[0018] Figure 1 A schematic diagram of the training process for federated learning is shown.

[0019] Figure 2 An example of a gradient leakage attack is shown.

[0020] Figure 3 This diagram illustrates the training process of federated learning when the client performs defense.

[0021] Figure 4 A schematic flowchart of a model training method based on federated learning according to an embodiment of the present invention is shown.

[0022] Figure 5 The diagram shows the effects of perturbing the original graphic using different methods.

[0023] Figure 6 A schematic diagram of the composition of a federated learning system that implements the model training method of the present invention is shown.

[0024] Figure 7 A schematic diagram of a computing device according to an embodiment of the present invention is shown, which can be used to implement the above-described federated learning-based model training method.

[0025] Figure 8 A schematic diagram illustrating the principle of executing the method of the present invention on the client side is shown. Detailed Implementation

[0026] Preferred embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0027] Deep neural networks typically consist of a series of stacked layers, each layer comprising a linear function and a simple non-linear activation function. A deep neural network can be represented as F(x,θ), where x is the input to the network and θ are learnable parameters. To improve the generalization ability of the neural network, a common practice is to train the network on a dataset D, which consists of pairs of data x and corresponding labels y, using a specific loss function. The algorithm is trained using the gradient descent optimization method (called the backpropagation algorithm). The optimization details in the t-th iteration can be concisely represented as follows:

[0028]

[0029] Here, the subscript of θ is used to represent the timestamp, η is the learning rate, and θ0 is a randomly initialized parameter. Used for the gradient obtained in the previous calculation.

[0030] The success of deep learning largely depends on a large amount of available data, and training models typically requires centralizing this data on a single machine or in a single data center. For privacy reasons, in applications such as mobile edge computing (MEC), servers cannot collect private data from users (various forms of clients, e.g., various IoT devices) for centralized model training. Therefore, to protect user privacy during deep learning model training, federated learning (FL), which enables coordinated model training across devices, can be used.

[0031] Figure 1 The diagram illustrates the training process of federated learning. In federated learning, all users share a single, complete machine learning model. As shown, the model structure is identical at the server and each client. The server can be, for example, an edge server in a MEC (Multi-access Edge Computing) system, or another server used to perform parameter aggregation tasks in federated learning. In different application scenarios, clients can take various forms, such as various IoT devices including smartphones, robotic devices, smart medical devices, gaming devices, etc., and may even function as servers themselves (although used as clients in the FL model). In a typical FL model, the server coordinates the clients to jointly train the globally shared model by alternately executing the following steps over a total of T rounds:

[0032] The server first selects a small subset of n clients from all N clients to participate in round t, while the other clients wait for the next round. F(·,θ) t-1 It is assigned to the selected client.

[0033] These clients train their models on their local data in a pre-specified manner to obtain the true gradients. The true gradient generated in the i-th selected client is... It means, and It was uploaded to the server.

[0034] Upon receiving Then, the server equally aggregates these gradients to update the global model, that is, to update the model's parameter set, and thereby obtains F(·,θ) for the next round of distribution and training. t ),Right now The server can then send the updated parameter set to the user to start the next round of training, and so on, until the predetermined number of iterations is reached or the model is judged to have converged.

[0035] In simple terms, federated learning breaks down each regular iteration (Equation 1) into multiple steps. The steps involving gradient calculation are handled by the client, while the server is only responsible for the model update steps. This approach creates a privacy-focused model training method because the client's private data is only used for local computation.

[0036] Under federated learning, users do not need to upload training data. Instead, they train the model locally and only upload the updated values ​​of the parameters (i.e., gradients). This process seems to protect the user's data privacy. However, it has been discovered that the server can use the updated values ​​uploaded by a specific user to reverse and recover that user's local training data. Moreover, the recovered data can be almost identical to the real data, resulting in indirect data leakage and raising questions about the security of federated learning.

[0037] Figure 2 This illustrates an example of a gradient leakage attack. When a server expects to access a user's local data, the server can be considered the attacker. The client can be seen as the defender. As shown on the left side of the dashed line, the user locally trains a model using the image on the left as training data and directly provides the obtained real gradients to the server. When directly uploading the real gradients, the user takes no precautions against the attack. Now, as shown on the right side of the dashed line, the attacker can fix the model's parameters, initialize dummy data, and optimize its gradients. This causes the parameter updates derived from the dummy data to gradually approach the real gradients uploaded by the user, thus reversing the data used for the user's local training.

[0038] Gradient leakage attacks refer to attacks where data can be reconstructed by solving a gradient matching problem. Specifically, in federated learning, the user (defender) uploads their local gradients to the server (attacker). Through some optimization method, the server reconstructs the client's data by forcing the gradient of randomly initialized seed data x' with labels y' to be as close as possible to the uploaded gradient.

[0039]

[0040] in y' represents the uploaded gradient, and x' represents the reconstructed data. Research has found that labels can be explicitly recovered by observing the gradients of fully connected layers, and that attack efficiency can be significantly improved by replacing y' with the real labels. Furthermore, attack efficiency can be further improved by narrowing the search space through restarting, improved initialization, or collecting data similar to that of the client.

[0041] Suppose that clients are warned of potential privacy breaches, and as a remedy, they are allowed to send perturbed gradients instead of the true gradients. In round t, the perturbed gradient of the i-th selected client is... The superscript and subscript are omitted for simplicity in the remainder of this text, except for a few necessary statements.

[0042] To defend against gradient leakage attacks, the client needs to adjust the uploaded gradients. Figure 3This diagram illustrates the training process of federated learning when the client performs defense. Figure 3 The training process shown is the same as Figure 1 Similarly, the difference is that after the client obtains the gradients through local training, it does not directly upload the gradients. Instead, it transforms the gradients to obtain transformed gradients and uses the transformed gradients instead of the original gradients for uploading. This increases the difficulty for the server to reverse the local data based on the uploaded gradients when acting as an attacker.

[0043] A common defense against gradient leakage attacks is differential privacy. Differential privacy introduces noise to perturb the gradient without affecting performance, thus providing the attacker with an inaccurate gradient and mitigating the attack. However, because this type of defense relies on the unrealistic assumption of simplifying deep neural networks into linear models, its effectiveness against threatening attacks is limited.

[0044] In view of this, this invention proposes a novel defense method that does not require simplifying deep neural networks into linear models for computation. In the gradient attack defense scheme of this invention, instead of perturbing the gradient, the training samples (i.e., real training data) are refined to create sufficiently effective but privacy-minimizing robust data (i.e., transformed samples, hereinafter referred to as "transformed samples" or "robust data"), and then the gradient of the robust data is uploaded, or the robust data itself is uploaded directly. This invention enhances the gradients of key parameters related to robust data to approximate real data, while simultaneously making larger transformations of the gradients of trivial parameters to protect privacy. Furthermore, to utilize the gradients of trivial parameters, the evaluation network designed in this invention guides the robust data away from real data, thereby mitigating the risk of privacy leakage.

[0045] Figure 4 A schematic flowchart illustrating a federated learning-based model training method according to an embodiment of the present invention is shown. This method is applied to a federated learning system comprising a server and N nodes, where N > 1, for example as follows: Figure 5 As shown.

[0046] From the above Figure 1 and Figure 3 As shown, federated learning completes model training through repeated rounds of training. Figure 4The steps S410-S430 shown below can be considered as being executed in the t-th operation of model training. The model can be trained a total of T times. In one embodiment, each round of training can correspond to a batch of training. That is, the above-described loop of distribution, update, transformation, upload, and integration is based on batches, and the t-th operation can be the t-th batch of data training operation for the model training. According to machine learning background knowledge, model training usually requires multiple epochs, and each epoch includes multiple batches of data computation. Assuming that model training requires 10 iterations, and each iteration uses 6 batches of data for training, then completing the model training requires 60 batches of data training operations, that is, T = 60, t = 1, 2, ..., 60. In other embodiments, each round of training can also be performed in units other than batches.

[0047] In step S410, the server distributes the model parameter set to n nodes, where n ≤ N. In federated learning, the server can distribute the model parameter set to all nodes in the system each time, or it can select a subset of these N nodes for model training based on certain conditions. In each operation, the selected nodes can be the same or different.

[0048] In step S420, each of the n nodes performs gradient calculation using its local training samples to obtain the original gradient, and performs joint optimization using utility and privacy metrics to obtain the transformed samples. And based on transformed samples Create and upload data, where i = 1, 2, ..., n.

[0049] The utility metric (UM) represents the transformed sample x. * The effectiveness of a gradient is defined as the extent to which the transformed gradient obtained from the transformed sample contains valid information about the original gradient. Therefore, a utility index can characterize the difference between the transformed gradient of the transformed sample and the original gradient.

[0050] A privacy metric (PM) characterizes the privacy protection of a transformed sample, i.e., the extent to which the transformed sample deviates from the training sample. Therefore, the privacy metric can characterize the difference between the transformed sample and the original training sample.

[0051] Here, "original gradient" refers to the gradient used to characterize the parameter update values, obtained from the local training samples for that batch of model parameters issued by the node for the current t-th operation (e.g., the t-th batch of data training operation); that is, the true gradient. Here, "original" is in relation to the subsequent "transformed" gradient. As mentioned earlier, the "original gradient" (or "true gradient") can be...

[0052] Here, each of the n nodes can independently calculate its own true gradient using its own local training samples (i.e., local training data), and jointly optimize its own utility metric and privacy metric to obtain the transformed sample. Here, the utility metric is related to the calculated true gradient, for example, it is a function of the calculated true gradient. The privacy metric characterizes the difference between the transformed sample and the original training sample.

[0053] Subsequently, in step S430, the server collects the upload data uploaded by each of the n nodes and updates the model parameter set accordingly.

[0054] In this invention, after obtaining the transformed samples... Then, based on the transformed samples Prepare upload data for uploading to the server. In one embodiment, the upload data includes data from transformed samples. Finding the gradient of the transformation Furthermore, the server acquires the transformation gradient. The model parameter set is updated by, for example, directly calculating the mean of the n transformation gradients from n clients. This is also the common canonical form used in federated learning.

[0055] In another embodiment, due to the transformed sample of the present invention The data itself is sufficiently effective and sufficiently different from the client's original training data, therefore the uploaded data includes the transformed samples. And the server processes the transformed samples from each of the n nodes. Training is then performed to update the model parameter set. At this point, since the server directly obtains samples uploaded by the client (processed samples that are privacy-protected but still contain sufficient effective gradient information), training can be performed on the server side. However, this differs from the classic federated learning scenario where only gradients are uploaded.

[0056] Therefore, when uploading data, the client node of this invention does not directly upload the actual original gradients, but instead uploads data obtained from transformed samples calculated through joint optimization using the utility metric (UM) and the privacy metric (PM). The utility metric measures the effectiveness of the transformed samples, while the privacy metric measures the risk of privacy leakage. By jointly optimizing these two metrics, this invention can identify optimized transformed samples (e.g., the most optimized transformed samples), thereby improving training performance while protecting the privacy of local client data.

[0057] To find the optimal balance between maintaining utility and protecting privacy, it is necessary to construct appropriate utility and privacy metrics.

[0058] It is hoped that the utility index can accurately assess the transformed sample x of the model. * The utility gap between robust data (i.e., the training sample x) and the original data (i.e., the training sample x). Similar to identifying the mapping from gradients to data, the relationship of the utility gap is also complex. The inventors noticed that the model's parameters are updated by the gradient of the loss function associated with the specific data. Based on this, x * The distance between the gradient of the loss function of x and x can serve as a suitable surrogate metric for the true utility measure. Therefore, in this invention, the utility index characterizes the transformed sample x. * The difference between the gradient of the transformed sample and the original gradient. It should be understood that the gradient corresponding to the training sample is actually the Δ value of the parameters of each layer of the deep model after backpropagation tuning based on the loss value of the model output after that sample is input into the model. Therefore, the difference between the gradient of the transformed sample and the original gradient corresponds to the difference in Δ values ​​between the parameters of each layer of the model under the original training sample and the transformed sample.

[0059] The most commonly used distance metric is probably Mean Squared Error (MSE). While the utility metric can be calculated directly using the regular MSE (i.e., unweighted MSE), the regular MSE treats all gradient elements involved equally, meaning that perturbing any gradient element by the same magnitude will result in the same level of loss. However, even perturbing different gradient elements by the same magnitude will produce gradients with different utilities. This is because the parameters corresponding to different gradient elements have significantly different effects on model performance. More specifically, perturbing the gradient elements of critical parameters leads to higher loss than perturbed parameters. In view of this, in one embodiment, the present invention uses weighted MSE as a utility metric to better approximate true utility. Higher weights can be assigned to the gradients of important parameters to reduce the loss in model performance.

[0060] The importance of a parameter is highly correlated with its value and gradient. Intuitively, parameters with high amplitude values ​​are more critical because they significantly enhance their inputs compared to parameters with low amplitude values, and higher outputs may have a greater impact on model predictions. Furthermore, the essence of a gradient is to estimate the effect of small changes in a parameter on the final output; therefore, parameters with high gradients also play a more crucial role in model predictions. To this end, the utility index characterizing the difference between the gradient of the transformed sample and the original gradient includes: calculating the mean squared error between each gradient element of the transformed sample and its corresponding original gradient element, and assigning weights to each mean squared error value to calculate the utility index in a weighted manner, whereby the weights are related to the magnitude of the parameter value and / or the magnitude of the gradient corresponding to the parameter.

[0061] Furthermore, since a neural network consists of many layers, each layer receives input from its adjacent upstream layer (except the input layer) and passes its output to its adjacent downstream layer (except the output layer). Therefore, earlier layers (i.e., layers closer to the input layer) may be more important than later layers. On the one hand, errors caused by interfering with the learning process of early layers are likely to be strongly amplified with forward propagation. On the other hand, early layers typically focus on recognizing bottom features shared by various samples, so disrupting the learning process of early layers will lead to a significant drop in model performance. For this reason, the weights are also associated with the layer in which the parameters reside.

[0062] Privacy metrics are a distance measure used to quantify x * How much of X's privacy was exposed, or X and X's privacy? * The degree of difference between them. The conventional distance metric MSE is not suitable as a privacy metric for this invention because it can only guarantee high similarity between two inputs when the metric associated with the two inputs falls within a low range. Otherwise, it does not hold true, meaning that two highly similar images may be considered different by the MSE metric. Figure 5 The images show the effects of perturbing the original image using different methods. Specifically, corresponding to the original image (a), (b) the original image is shifted one unit to the upper left, (c) the original image is scaled by one pixel, and (d) random noise is added to the original image. The MSEs of the three methods are 0.025, 0.106, and 0.004, respectively. Compared to adding noise, shifting and scaling have higher MSEs, but they are indistinguishable from the original image to the human eye; that is, the privacy protection effect is negligible.

[0063] Therefore, the present invention instead seeks the transformed sample x. * The distance to the noise distribution is used as a privacy metric. This is because the noise distribution can be considered to contain no information from the original training samples, thus greatly simplifying the selection of the transformed sample. In a preferred embodiment, instead of selecting a fixed noise sample and making the transformed sample x... * Moving toward that fixed noise sample, a better approach is to move x * The distance to the noise distribution (i.e., distribution distance) is defined as a privacy metric. Distribution distance can be viewed as increasing the number of available reference samples during the optimization process and can automatically guide x. * Proceeding towards a reference sample containing more information. In one embodiment, a trained evaluation neural network can be used to evaluate the transformed sample x. * The distance to a uniformly distributed noise distribution. The output of the evaluation neural network characterizes the transformed sample x in a monotonically increasing or decreasing manner. *The distance to the uniformly distributed noise is determined, and training data-label pairs are created for the evaluation neural network using interpolation to inject the aforementioned monotonically increasing or decreasing knowledge into the evaluation neural network.

[0064] Transformed sample x * The solution corresponds to a joint optimization problem, which requires iterative computation. Therefore, iterative computation is needed to obtain the transformed sample x that satisfies the constraints of the utility index and the privacy index. * The optimal solution (e.g., the most optimal solution).

[0065] Alternatively, a mixture of training samples and random noise can be used to initialize the transformed sample x. * This avoids optimizing for adversarial examples.

[0066] This invention can also be implemented as a federated learning system. Figure 6 A schematic diagram of the composition of a federated learning system implementing the model training method of the present invention is shown. As shown, system 600 includes a server 610 and N nodes 620. 1-N .

[0067] In the t-th operation of model training, the server 610 distributes the model parameter set to n nodes, where n ≤ N. Each of the n nodes uses its local training samples to perform gradient calculation to obtain the original gradient, and uses utility and privacy metrics for joint optimization to obtain the transformed samples. And based on transformed samples The server generates upload data, where i = 1, 2, ..., n; and collects the upload data from each of the n nodes and updates the model parameter set accordingly.

[0068] This invention can also be implemented as a model training method based on federated learning, applied to nodes in a federated learning system, the federated learning system including N nodes and a server, where N > 1; the method includes: in the t-th operation of model training, performing: obtaining the model parameter set issued by the server; performing gradient calculation using local training samples to obtain the original gradient, performing joint optimization using utility metrics and privacy metrics to obtain transformed samples, and creating upload data based on the transformed samples; and sending the upload data to the server so that the server, together with the data uploaded by other nodes, can update the model parameter set, wherein, in the t-th operation, the server issues the model parameter set to n nodes including the current node and the other nodes, where n ≤ N.

[0069] Figure 7A schematic diagram of a computing device according to an embodiment of the present invention is shown, which can be used to implement the above-described federated learning-based model training method. This computing device can, in particular, serve as a node in a federated learning system, for acquiring the original gradients and jointly optimizing utility and privacy metrics to obtain transformed samples.

[0070] See Figure 7 The computing device 700 includes a memory 710 and a processor 720.

[0071] Processor 720 may be a multi-core processor or may contain multiple processors. In some embodiments, processor 720 may include a general-purpose main processor and one or more special-purpose coprocessors, such as a graphics processing unit (GPU), a digital signal processor (DSP), etc. In some embodiments, processor 720 may be implemented using custom circuitry, such as an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA).

[0072] Memory 710 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. ROM may store static data or instructions required by the processor 720 or other modules of the computer. Permanent storage devices may be read-write storage devices. Permanent storage devices may be non-volatile storage devices that retain stored instructions and data even when the computer is powered off. In some embodiments, permanent storage devices use mass storage devices (e.g., magnetic or optical disks, flash memory) as permanent storage devices. In other embodiments, permanent storage devices may be removable storage devices (e.g., floppy disks, optical drives). System memory may be a read-write storage device or a volatile read-write storage device, such as dynamic random access memory. System memory may store some or all of the instructions and data required by the processor during operation. Furthermore, memory 710 may include any combination of computer-readable storage media, including various types of semiconductor memory chips (DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and disks and / or optical disks may also be used. In some embodiments, memory 710 may include a removable storage device that is readable and / or writable, such as a laser disc (CD), a read-only digital multifunction optical disc (e.g., DVD-ROM, dual-layer DVD-ROM), a read-only Blu-ray disc, an ultra-high-density optical disc, a flash memory card (e.g., SD card, minSD card, Micro-SD card, etc.), a magnetic floppy disk, etc. Computer-readable storage media do not contain carrier waves or transient electronic signals transmitted wirelessly or via wired connections.

[0073] The memory 710 stores executable code, which, when processed by the processor 720, enables the processor 720 to execute the federated learning-based model training method described above.

[0074] Application examples

[0075] Figure 8 A schematic diagram illustrating the principle of executing the method of the present invention on the client side is shown. The following will be combined with... Figure 8 This describes a specific implementation example of the present invention. For example... Figure 8 As shown above, real data (i.e., the original training samples) can be fed into the model. The model makes predictions, calculates the loss based on the corresponding labels, and obtains the true gradient (i.e., the original gradient) through backpropagation. Subsequently, robust data is initialized (e.g., using a mixture of training samples and random noise), and the final robust data is obtained as transformed samples through joint optimization of performance and privacy metrics. These transformed samples can also be fed into the model, which makes predictions, calculates the loss based on the corresponding labels, obtains the transformed gradient through backpropagation, and uploads it as the uploaded data.

[0076] As shown in the figure, the optimization of performance metrics can actually be seen as a process in gradient space where the transformed gradient gradually approaches the original gradient; while the optimization of privacy metrics can be seen as a process in data space where robust data gradually moves away from the original data, and this process can be carried out with the participation of the evaluation.

[0077] In one specific implementation, the overall goal of this invention is to find an appropriate upload gradient. It can obfuscate the server while maintaining good utility. However, without simplifying the DNN, it is very difficult to directly derive the analytical mapping from the perturbation gradient to the corresponding reconstructed data due to the inherently highly nonlinear and nonconvex nature of DNNs. Furthermore, without a clear gradient-to-data mapping, it is unclear how much privacy protection the generated perturbation can provide; that is, the optimal perturbation direction is unknown. In other words, the inventors of this invention found that directly optimizing the gradient in the prior art is impractical in practice because it is difficult to derive an analyzable gradient-to-data mapping. To address this, this invention instead modifies the real data to create robust data and uses the gradient of the robust data instead of the real gradient for uploading. If there is a significant difference between the robust data and the original data, the server certainly cannot reveal the original data. Therefore, given a privacy preference level β and real data x labeled y, the problem can be expressed as follows:

[0078]

[0079] Where x* These are robust data points, where UM(·) and PM(·) represent the utility metric and privacy metric of this invention, respectively. The utility metric is used to evaluate utility x. * How much has it decreased compared to x (the expected UM should be as small as possible, i.e., x)? * The utility of x is as close as possible to x, and the privacy metric indicates that x * How much privacy information about x is reduced (assuming PM is as large as possible, i.e., x)? * The privacy contained is as little as possible compared to x. Guided by these two metrics, the final x is obtained. * The gradient is not only meaningful (i.e., can be effectively used for model training), but it can also effectively confuse the server. These two metrics will be explained in detail below.

[0080] A. Utility Index (UM)

[0081] It is hoped that UM can accurately evaluate the x of the model. * The utility gap between x and y. Similar to identifying the mapping relationship from gradients to data, the relationship of the utility gap is also complex. The inventors noticed that the parameters of the model are updated by the gradient of the loss function associated with specific data. Based on this, x * The distance between the gradient of the loss function of x and x can serve as an appropriate surrogate metric for the true utility measure.

[0082] Because perturbation gradient elements of critical parameters lead to higher loss than those of trivial parameters, it is unsuitable to define UM using conventional MSE. Therefore, a weighted MSE can be specified as the utility metric, and the general idea behind weighted MSE is to assign higher weights to the gradients of important parameters to reduce the loss in model performance. Two factors are considered in determining the weights: the statistical indicators of the parameters, such as the gradients, and the positional information of the parameters. More specifically, this invention can define element-level weights by fusing the statistical indicators of the parameters and layer-level weights by using positional information. The product of the element-level weights and the layer-level weights serves as the final weight for the corresponding gradient element.

[0083] The importance of a parameter is highly correlated with its value and gradient. Parameters with high amplitude values ​​are more critical, and parameters with high gradients play a more crucial role in model prediction. Here, element-wise weights can be defined as the absolute value of the product of the parameter value and its gradient. In fact, the parameter value reflects its importance to the upstream layer, while the parameter gradient indicates its importance to the downstream layer; neither should be omitted when evaluating weights.

[0084] To further understand element-level weights, some mathematical explanations are provided here. We can let... Then there is Please note that when When θ is at its optimal value, it is usually reached. Setting μ to 1, therefore, If θ is optimal, Q′(1) = 0. Therefore, the optimality can be determined by checking the value of Q′(1). In other words, if the magnitude and gradient of a parameter are small, it does not affect the attainment of optimality. Here, Q(μ) is a common mathematical practice for analyzing the optimality conditions of nonlinear nonconvex functions in high-dimensional space, which can provide a more intuitive understanding of the optimality conditions of complex functions. Note that Q′(1) is only a sufficient condition for the optimal solution, not a necessary condition, but this does not affect its use here.

[0085] A neural network consists of many layers, each receiving input from its neighboring upstream layers (except the input layer) and passing its output to its neighboring downstream layers (except the output layer). Therefore, earlier layers (i.e., layers closer to the input layer) may be more important than later layers. On the one hand, errors caused by disrupting the learning process of early layers are likely to be strongly amplified during forward propagation. On the other hand, early layers typically focus on recognizing bottom features shared by various samples, so disrupting the learning process of early layers will lead to a significant drop in model performance.

[0086] Therefore, by amplifying the penalty for gradient perturbations belonging to earlier layers through layer weights, more attention is allocated to preserving the gradients in earlier layers. Suppose that F(x,θ) has K layers, and the i-th layer of F(x,θ) is parameterized as θ[i] (θ={θ[1],θ[2],···,θ[K]}). The layer weight θ[k] of the gradient element of the i-th layer is defined as power(τ,i), where τ is the decay factor (0≤τ≤1), and power(·,·) is a power function.

[0087] The final weight of θ[i] can be expressed by the formula: It is the product of the element-level weight and the hierarchical weight.

[0088] weight(θ|i|)=|grad(θ|i|)·value(θ|i|)·power(τ,i)|, (4)

[0089] Where grad(θ[i]) and value(θ[i]) represent the gradient and value extracted from the input parameters, respectively. UM can now be defined as follows:

[0090]

[0091] B. Privacy Metrics (PM)

[0092] Privacy metrics are a distance measure used to quantify x * How much of x's privacy was exposed, or what about x? *The degree of difference between them. PM should have the following attributes: as the PM value increases, it includes x * The amount of privacy information in x should be reduced incrementally. The intuitive idea for the design PM is to create a reference sample for x, and this reference sample does not contain any privacy information about x. Subsequently, the reference sample is compared with x. * The distance between x and the reference sample can be used as PM. The smaller the distance between x and the reference sample, the better x * The less privacy is contained in x, the less privacy is protected. However, searching for a reference sample for each data point is very cumbersome. A better option is to create a reference sample suitable for all data, and clearly, noisy data is a suitable choice. Specifically, noisy data can be sampled from a uniform distribution as a general reference sample.

[0093] While the above method is feasible, the search space is limited to the path from x to the extracted fixed reference sample. Therefore, the obtained x* may be close to the extracted reference sample, while better solutions may exist around other noise. In other words, it doesn't matter which random noise is extracted as the reference sample, because all random noise does not involve the privacy information of x. Therefore, a better approach is to use x... * The distance to the noise distribution (i.e., the distribution distance) is defined as PM. The distribution distance can be viewed as increasing the number of available reference samples during the optimization process and can automatically guide x. * Move towards a reference sample with more information.

[0094] In practice, an evaluation network is used to assess how closely x* approximates a noise distribution. The evaluation network is a neural network whose output ranges from 0 to 1. Furthermore, an output of 1 indicates that the input perfectly fits the noise distribution, and vice versa. The theory behind the network is the Maximum Mean Difference (MMD), a statistical concept commonly used to test whether two samples come from the same distribution. Formally, MMD is as follows:

[0095]

[0096] Where f is the evaluation network, q(x) is the noise (uniform) distribution (uniform distribution is the informationless distribution in information theory), and p(x) is the data distribution of IoT devices. This indicates that we need to train the network f to maximize the expected output difference between p(x) and q(x). Furthermore, since the network output is constrained to 0-1, maximizing the expected output difference is essentially equivalent to encouraging the network to output 0 for real data x and 1 for noise, respectively.

[0097] Furthermore, during network training, training data-label pairs can be created for the network using interpolation, i.e., ((1-r)·t1+r·t2,r), r~U(0,1), t1~p, t2~q. These data-label pairs are provided as supervision signals to the evaluation network, thus explicitly incorporating the monotonicity principle into the training process, as the knowledge that the output should increase with the increase of r (the proportion of noise) is injected into the evaluation network. Additionally, gradient penalty can be added during the training of the evaluation network to establish ||f||H≤1. Finally, the trained evaluation network can be compared with x. * The output is taken as PM, i.e., PM(x) * ,x)=f(x * ).

[0098] C. Solve optimization tasks

[0099] After determining the specific forms of UM and PM, the gradient descent algorithm can be used to iteratively solve equation 3, with a total of T iterations. However, due to the adversarial vulnerability of neural networks, directly applying the gradient descent algorithm is problematic. The term "adversarial vulnerability" refers to the ease with which neural networks are affected by adversarial examples; by adding subtle noise, imperceptible to humans, to the original samples, the model's predictions can change drastically. Directly using the conventional gradient descent algorithm to obtain x... * Semantically very similar to x, i.e., x * This evaluates adversarial examples for network f. Adversarial examples can be viewed as local extrema around x, and one approach to this is to perturb the initialization point to avoid regions with local extrema. Therefore, x can be initialized using a mixture of x and random noise. * , that is, x * = (1-α)x + αv, v ~ q(x), α ∈ [0, 1] where α is a mixing factor. If α is set very large, x is initialized around the noise-prone region. * And closest to x * The extreme point is still noise, thus avoiding adversarial vulnerability.

[0100] The above describes a federated learning-based model training method and federated learning system according to the present invention. The present invention proposes a novel method for creating perturbed gradients. Compared to existing methods that directly process the true gradient, robust data is implicitly extracted for generating perturbed gradients, thereby greatly facilitating the injection of utility and privacy information into the perturbed gradients. Specifically, an effective utility metric is designed to calculate gradient distance in a weighted manner, with weights determined by element weights and layer weights of parameters. Due to the observed deficiencies in common metrics for quantifying differences between two images, the present invention proposes using an evaluation network as a privacy metric, which learns how to evaluate differences in a manner consistent with human cognition.

[0101] Furthermore, the method according to the present invention can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing the steps defined in the above-described method of the present invention.

[0102] Alternatively, the present invention can also be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) storing executable code (or computer program, or computer instruction code) thereon, which, when executed by a processor of an electronic device (or computing device, server, etc.), causes the processor to perform the various steps of the method described above according to the present invention.

[0103] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein can be implemented as electronic hardware, computer software, or a combination of both.

[0104] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems and methods according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0105] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A model training method based on federated learning, applied to a federated learning system including a server and N nodes, where N > 1, the method comprising: In the t-th operation of model training, the following is executed: The server distributes the model parameter set to n nodes, where n ≤ N; Each of the n nodes performs gradient calculation using its local training samples to obtain the original gradient, and iteratively calculates to obtain transformed samples that satisfy the utility and privacy objectives. The optimal solution is obtained, and based on the transformed samples. The uploaded data is generated, where i = 1, 2, …, n. The utility index is obtained by calculating the mean squared error between each gradient element of the transformed sample and the corresponding original gradient element, and assigning weights to each mean squared error value for weighted calculation. The weights are associated with at least one of the following: the value of the learnable parameter; the magnitude of the gradient corresponding to the learnable parameter; and the layer in which the learnable parameter is located. The privacy index characterizes the distance of the transformed sample to the noise distribution. The server acquires the uploaded data and updates the model parameter set based on the uploaded data.

2. The method as described in claim 1, wherein, The uploaded data includes the transformed sample. And the server processes the transformed samples from each of the n nodes. Train to update the model parameter set; or The uploaded data includes data from transformed samples. Finding the gradient of the transformation Furthermore, the server acquires the transformation gradient. And update the model parameter set.

3. The method as described in claim 1, wherein, The distance of the transformed sample to the noise distribution is evaluated using a trained evaluation neural network.

4. The method of claim 3, wherein, The output of the evaluation neural network represents the distance from the transformed sample to the noise distribution in a monotonically increasing or decreasing manner, and training data-label pairs are created for the evaluation neural network by interpolation to inject the aforementioned monotonically increasing or decreasing knowledge into the evaluation neural network.

5. The method of claim 1, wherein, The transformed sample is initialized using a mixture of training samples and random noise.

6. A federated learning system, comprising a server and N nodes, where N > 1; In the i-th operation of model training, the server distributes the model parameter set to n nodes, where... n ≤ N, Each of the n nodes uses its local training samples to perform gradient calculations to obtain the original gradient, and iteratively calculates to obtain transformed samples that satisfy the utility and privacy objectives. The optimal solution is obtained, and based on the transformed samples. The uploaded data is generated, where i = 1, 2, …, n; the utility metric is obtained by calculating the mean squared error between each gradient element of the transformed sample and its corresponding original gradient element, and assigning weights to each mean squared error value for weighted calculation. The weights are associated with at least one of the following: the value of the learnable parameter; the magnitude of the gradient corresponding to the learnable parameter; and the layer in which the learnable parameter resides; the privacy metric characterizes the distance of the transformed sample to the noise distribution; and The server also acquires uploaded data and updates the model parameter set based on the uploaded data.

7. A model training method based on federated learning, applied to nodes in a federated learning system, wherein the federated learning system includes N nodes and a server, where N > 1; The method includes: In the i-th operation of model training, execute: Obtain the set of model parameters issued by the server; Perform gradient calculations using local training samples to obtain the original gradients; Iterative calculations are performed to obtain an optimized solution for the transformed sample that satisfies the objectives of utility and privacy metrics. Uploaded data is then generated based on the transformed sample. The utility metric is obtained by calculating the mean squared error between each gradient element of the transformed sample and its corresponding original gradient element, and by assigning weights to each mean squared error value for weighted calculation. These weights are associated with at least one of the following: the value of the learnable parameter; the magnitude of the gradient corresponding to the learnable parameter; and the layer in which the learnable parameter resides. The privacy metric characterizes the distance from the transformed sample to the noise distribution. as well as The uploaded data is sent to the server so that the server can update the model parameter set together with the uploaded data obtained from other nodes. In the i-th operation, the server distributes the model parameter set to n nodes, including the current node and the other nodes, where n ≤ N.

8. A computing device, comprising: processor; as well as A memory having executable code stored thereon, which, when executed by the processor, causes the processor to perform the method as described in claim 7.

9. A non-transitory machine-readable storage medium having executable code stored thereon, which, when executed by a processor of an electronic device, causes the processor to perform the method of claim 7.

Images