Label exchange based federated learning generation adversarial network sensitive data training method

Abstract

This invention discloses a sensitive data training method for federated learning generative adversarial networks based on label swapping, addressing the problem of model parameters leaking local data information in federated learning technologies. The federated learning model consists of two parts: a global model aggregated by a parameter server and a local model trained on the client. This invention adds a generative adversarial network component to the original supervised learning task of the local model to assist in protecting data privacy during supervised learning. By using the fused features under the original labels and the recombined labels, the generated data output by the generative network is used as local model training data to replace the original dataset. This ensures that the model parameters record the features of the generated data under the recombined labels, thereby protecting the original dataset.

Description

Technical Field

[0001] This invention relates to a method for training sensitive data in federated learning generative adversarial networks based on label switching, belonging to the technical field of user privacy protection and artificial intelligence. Background Technology

[0002] With the rapid development of artificial intelligence, federated learning is widely applied in fields containing sensitive personal information, such as healthcare and personalized recommendation. Sensitive data, due to its privacy nature, cannot leave its local storage location. Federated learning aims to break down this barrier, making data usable but invisible, allowing local training to achieve the same results as centralized training. A federated learning system includes a parameter server and various data computing nodes. Without uploading local data, each computing node, with the participation of the parameter server, collaboratively trains the model. Data owners with the same training task train their data locally and upload model training parameters. The parameter server aggregates the local model training parameters from each node and then redistributes them to all training nodes, maintaining consistency in the global model parameters.

[0003] In federated learning, even if the data owner doesn't upload the data needed for model training, attackers can still deduce the training data used to train the model parameters based on the model parameters or the accuracy returned in each training iteration, thus recovering the privacy data of other parties. This data is mostly sensitive and cannot be disclosed. Currently, methods for protecting privacy data in federated learning environments can be broadly categorized into protecting model parameters and protecting training data. Methods for protecting model parameters include homomorphic encryption, secure multi-party encryption, and differential privacy. These techniques often incur additional computational or communication overhead, or sacrifice model accuracy for privacy. Since model parameters store the original data information, attackers can recover the model parameters through side-channel attacks, making the privacy data under federated learning training insecure. Therefore, while protecting model parameters, it's necessary to transform sensitive data to ensure that the parameters do not store the original data information, thus guaranteeing the security of the original data. The second type of method involves transforming the training data, such as adding differential privacy noise to the original data or performing multi-label training by fusing multiple images. The former introduces significant noise into the data, affecting the model's ability to distinguish the original data and reducing the accuracy of image classification. The latter, however, performs a linear combination based on the original image without truly altering it. Therefore, attackers can still recover the original data through complex computational guessing. This invention draws on the advantages of the first method by employing a generative adversarial network (GAN) approach during training to transform the local data, achieving an effect similar to encrypting model parameters. This prevents attackers from obtaining the local data by guessing and reconstructing labels. Summary of the Invention

[0004] The purpose of this invention is to address the problem that model parameters in federated learning contain raw data information by proposing a sensitive data training method for federated learning generative adversarial networks based on label switching, thereby solving the problem of model parameters leaking sensitive user data during federated learning training.

[0005] The technical solution of this invention lies in a generative adversarial network training method based on label swapping and a label restoration method during the testing phase. The detailed technical solution is as follows: The federated learning model consists of two parts: a global model aggregated by a parameter server and a local model trained on the client. The local model further includes a local model and a generative adversarial network (GAN). The GAN assists the local model in protecting data privacy during training. The detailed steps of the federated learning process for protecting the local training process on the user client are as follows: Step 1: Before the client participates in federated learning training, the original labels corresponding to the images are replaced with recombined labels. Referring to Specific Example 1, an orthogonal matrix H with all zeros on the main diagonal is randomly generated. Matrix H is used to convert the labels t in the original dataset into recombined labels t′, where t′ = t × H. The original images in the original dataset remain unchanged. The original labels are converted into recombined labels in the above manner to obtain the first recombined label dataset Data′.

[0006] Step 2: The client participates in federated learning. The detailed training steps for the local model are as follows. Step 2.1 Train the Generative Adversarial Network (GAN). The GAN consists of a generator network f. G (x;θ G ), discriminant network f D (x;θ D ) and auxiliary network f C (t′;θ C ), parameter θ G θ D and θ C Let represent the parameters of the generator network, the discriminator network, and the auxiliary network, respectively. Let x represent the images in the original training dataset, and t′ represent the recombined labels. In the first round of federated learning, the generator and discriminator network parameters are randomly initialized. In the second and subsequent rounds, the network parameter results calculated in the previous round are used as the initial training parameters for that round. The auxiliary network is a parameter-invariant module that uses the global model parameters as auxiliary network parameters and adds recombined label features to the entire network. Step 2.2: The first recombined label dataset, Data′, is used as the training dataset for the generative adversarial network (GAN). The recombined labels are used as input to the auxiliary network, and the original images are used as input to the discriminator and generator networks. The following optimization algorithm is used to update the parameters of the generator and discriminator networks. The GAN is continuously updated with each iteration of the federated learning process, ensuring that the generator network outputs an image containing both the recombined label features and the features of the original image after receiving the original image as input. Step 2.3 Use the generative network from Step 2.2 to generate multi-feature images under the recombined labels. Input the original image into the generative network, output the multi-feature image, replace the original image in the first recombined label dataset, and obtain the second recombined label dataset; Step 2.4 uses the second recombined label dataset as the training dataset for the local model, and the global model parameters as the initial parameters for the local model to train the local model. Finally, the trained model parameters are uploaded to the server, awaiting model parameter aggregation and re-distribution.

[0007] In the iterative step 2, during the federated learning process, the parameters of the generative adversarial network (GAN) model and the local model in the protected user's local model are continuously updated as the global model changes. Training stops when the training or testing accuracy of the local model reaches a threshold. At this point, the generative network can generate images with recombined labels that possess the features of the original image. The local model continuously learns the features of the generated images with recombined labels, and these features are incorporated into the global model parameters when the server aggregates the local model parameters, enabling the global model to discriminate the features of the generated images.

[0008] During the federated learning training phase, the global model parameters learn the relationship between the generated images and the recombined labels. Therefore, during the model testing phase, the local model has a high accuracy rate in recognizing images generated by the generative network. To ensure the accuracy of the local model's discrimination during the testing phase, the test image is first input into the generative network to generate a new image; then, the generated image is input into the trained local model to obtain the corresponding recombined label; finally, the transpose of the orthogonal matrix H is used to restore the original label of the recombined image, thus obtaining the true label of the original image.

[0009] The beneficial effect of this invention lies in that, after training a generative adversarial network using a first recombined label dataset, the second recombined label dataset is used to replace the original data in the training of the local model, thereby changing the training parameters learned by the local model and achieving the purpose of protecting the local sensitive dataset. Furthermore, the restoration method in the testing phase effectively solves the problem of reduced classification accuracy after replacing the original data. Attached Figure Description

[0010] Figure 1 This is a diagram of the federated learning training architecture of the present invention.

[0011] Figure 2 This is a label reconstruction image from the verification or testing phase of this invention.

[0012] Figure 3 This is a flowchart of the training process for the label-swapping-based generative adversarial network of the present invention. Detailed Implementation

[0013] The main idea of ​​this invention is to exchange user-owned local labels, train a generative adversarial network to generate reconstructed data that retains the original features, and use the generated data to replace the original data in the training of the local model, thereby protecting the local model parameters from leaking the original local data information. To make the objectives, technical solutions, and advantages of this invention clearer, the following is in conjunction with the appendix... Figures 1 to 3 The present invention will be described in further detail below.

[0014] Example: Figure 1 As shown, the federated learning system consists of two parts: a server-side system and a local model. Assume that the N clients participating in the federated learning are c0, c1, ..., c... N-1 For ease of explanation, assume there is only one attacker and one protected user in the system, where c0 is the attacker, c1 is the protected user, and c2~c... N-1 These are normal users, and each client has a dataset named Data0, Data1, ..., Data. N-1 .

[0015] Each client has a different local model. The attacker's local model is divided into an attack model and a local model. The protected user's local model is divided into a generative adversarial network and a local model. Normal users c2~c N-1Only the local model is present. Generative Adversarial Networks (GANs) consist of three parts: a generator network, a discriminator network, and an auxiliary network. The local model and the auxiliary network of the GAN are structurally identical to the global model. Assume user c1 has labels t = [0, 1, 2], and the attacker has labels [3, 4, 5]. While participating in federated learning, the attacker trains the local model while simultaneously stealing data under label 0 from the protected user. The protected user protects their local data under label 0 using the following method.

[0016] like Figure 3 As shown, dashed boxes represent server-side operations, and solid boxes represent client-side operations. Taking the MNIST dataset as an example, the federated learning training process includes the following steps: Step 1: Swap the labels to obtain the first recombined label dataset Data′1. Before participating in federated learning, user c1 replaces the original labels in the original dataset with the recombined labels using an orthogonal matrix H. User c1 has labels [0,1,2], which are represented by one-hot encoding as [[1,0,0],[0,1,0],[0,0,1]]. An orthogonal matrix H with all zeros on the main diagonal is randomly obtained, and the rank of the matrix is ​​the same as the number of labels.

[0017] Assume a random matrix: The orthogonal matrix represents the correspondence between the original image labels and the recombined labels, and is randomly generated by the local user. The recombined label t' is the product of the original label t and the orthogonal matrix H, i.e., recombined label t' = t × H = [0,1,0; 0,0,1; 1,0,0]. Using the orthogonal matrix H, all original image labels [0,1,2] are converted to their corresponding recombined labels [1,2,0]. That is, images with original label 0 correspond to recombined label 1, images with original label 1 correspond to recombined label 2, and so on. Converting all original image labels to recombined labels yields the first recombined label dataset D1', consisting of the original images and the recombined labels t'.

[0018] Step 2: The parameter server randomly initializes the global model and sends the initial model parameters W0 to the clients selected to participate in training in this round.

[0019] Step 3: The client receives the initialization parameter W0 and trains the local model. Both legitimate users and attackers use the initialization parameter W0 as local model parameters to train the local dataset and update the local model parameters.

[0020] Step 3.1: Initialize the Generative Adversarial Network (GAN) parameters. The GAN consists of a generator network, a discriminator network, and an auxiliary network. During training, the auxiliary network is a module with unchanged parameters. Before each training iteration, the global model parameters from this round are used as the auxiliary network parameters, and recombined label features expressed by the global model parameters are added. In the first round of federated learning, the generator and discriminator networks use random initialization as their initial training parameters. In the second and subsequent rounds, the network parameter results calculated in the previous round are used as the initial training parameters for this round.

[0021] Step 3.2: Train the generative adversarial network using the following optimization algorithm: like Figure 1 As shown in the block diagram for user c1, a generative adversarial network is trained using the first recombined label dataset Data′1. The original image x is input into the generative network, and the generated image x is output. g The generated image and the original image are then input into the discriminator network, and the generated image and the recombined label are input into the auxiliary network. The following optimization algorithm is used to train the generator network N times and the discriminator network M times to obtain a generator capable of generating images with recombined label features. N and M are adjustable parameter constants; their values ​​should be as large as possible within the longest federated learning timeframe.

[0022] The optimization algorithm includes the following three loss functions to determine network adversarial loss. Auxiliary combat loss and difference control loss Among them, f G (x;θ G ), f D (x;θ D ) and f C (t′;θ C The symbols ) represent the generator network, discriminator network, and auxiliary network in a generative adversarial network (GAN). The generated image x g =f G (x;θ G ), where x represents the original image, t′ represents the recombined label, and the parameter θ G θ D and θ C These represent the generated network parameters, the discriminant network parameters, and the auxiliary network parameters, respectively. C This represents the cross-entropy loss function, where α, β, and h are adjustable constant parameters used for model tuning. GANCalculate the difference between the generated image's output in the discriminant network and the original label. Calculate the difference loss between the generated image and the output of the auxiliary network and the reconstructed label. Difference control loss. Calculate the L2 norm distance between the generated image and the original image, and control the distance difference within a certain range to ensure the stability of the generated image and the entire generative adversarial network.

[0023] During training, the auxiliary network parameters remain unchanged, and the recombined label feature representation from the global model parameters is added to the entire network to reduce the classification loss of the generated image in the recombined label, while using this feature to confuse attackers; the discriminator network distinguishes the differences between the generated image and the original image, preserving the original information of the image; the generator network generates images that the discriminator network cannot distinguish, reducing the difference between the generated image and the original image.

[0024] Step 3.3: Use the generative network from Step 3.2 to generate the second recombined label dataset Data″1 to train a local model. Input the original image x into the generative network trained in Step 3.2, and output an image x with recombined label features and original image features. g x g Together with the recombined label L', they form the second recombined label dataset Data″1. At this point, the model parameters no longer remember the original image and original label, but rather the generated image after recombining the labels. When an attacker uses the leaked parameters to launch an attack on a protected user, the dataset obtained is the generated image under the recombined label. Even if the attacker successfully guesses the recombined label, the image recovered using the attack model is no longer the original image, but a generated image x that possesses some features of the original image. g .

[0025] Step 4: Each client uploads the trained local model parameters to the server. The server updates the global model parameters using an aggregation method after receiving the model parameters, and then sends the parameters down again.

[0026] Steps 2 through 4 are repeated to train the local models on each client. Training ends when the training accuracy exceeds a threshold or the number of communication rounds reaches its maximum, and the server sends the final aggregated global model parameters to the clients. During the training of the Generative Adversarial Network (GAN), the GAN is continuously updated with the iterations of the global model. The data features under the original labels and the recombined labels are fused within the GAN, resulting in indistinguishable features in the generated images, thus ensuring the security of the original images. The auxiliary network component of the GAN is always derived from the continuously updated global model parameters; therefore, the generated images also update with changes in the global model. Its advantage is that the generated images are highly correlated with the global model, having a relatively small impact on the accuracy of the global model. Furthermore, because the generated images are constantly changing, attackers cannot obtain the original dataset images by guessing the recombined labels.

[0027] Step 5: In the model validation or testing phase, to obtain the true labels of the original images, the transpose of an orthogonal matrix is ​​used to recover the original labels of the reconstructed images. Obtaining the original labels of the original images is the inverse process of generating reconstructed labels, transforming the output label class of the local model into the original label class. For example... Figure 2 As shown, the original images from the validation or test dataset are input into the generator network, which outputs generated images. These generated images are then input into the local model. Since the local model is trained on the second recombined label dataset Data″1, the classifier outputs the recombined label t′ corresponding to the generated image. An orthogonal matrix records the recombined label features and the original label features. The original label is obtained using the transpose of the orthogonal matrix: original label t = t′ × H. T .

[0028] Suppose that the label output by a generative network and a local model for an original image is 1, and its one-hot encoding is [0,1,0]. The transpose of the orthogonal matrix H is H'. T = [0,0,1; 1,0,0; 0,1,0], then the original label t = t′ × H T = [1,0,0], meaning the original label of the generated image under recombined label 1 is label 0, and therefore the true label of the original image is label 0. Looking at the transformation process of the recombined labels, the recombined label after the original label 0 is transformed is 1. There is no precision error loss in the matrix transformation process; therefore, the precision error in the validation or testing phase mainly depends on the original local model. The model testing phase is the same as the model validation phase, except that model validation occurs during training, while the testing phase occurs after model training is completed.

[0029] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A method for training sensitive data in federated learning generative adversarial networks based on label switching, characterized in that: The federated learning system consists of a local model and a global model. The local model comprises two parts: a local model and a generative adversarial network (GAN). The GAN assists the local model in protecting data privacy during training, and the local model is used for supervised learning tasks. The global model is obtained by aggregating the local models from each client using a parameter server. The steps for protecting the training process of the user client in the federated learning model are as follows: Step 1, Data Preprocessing: Before the client participates in federated learning training, data preprocessing is performed to replace the original labels corresponding to the images with recombined labels; Randomly generate an orthogonal matrix whose main diagonal is all 0. Labels of the original dataset Convert to recombinant tag , The original images in the original dataset remain unchanged and are combined with the recombined labels to form the first recombined label dataset. ; Step 2: The client participates in federated learning to train the local model, including the following steps: Step 21: Initialize and generate adversarial network parameters; Generative adversarial networks include generative networks Distinguishing Networks and auxiliary network ; parameter , and These represent the generating network parameters, the discriminant network parameters, and the auxiliary network parameters, respectively. This represents the images in the original training dataset. Indicates a recombinant label; In the first round of federated learning, the generative adversarial network (GAN) randomly initializes the parameters of the generative network and the discriminative network. In the second round and thereafter, the training parameters from the previous round are used as the initial training parameters for the current round. The auxiliary network parameters are derived from the continuously updated global model parameters and are used to add recombinant label features to the network. Step 22: Train the generative adversarial network; Recombination Label Dataset The dataset used to train the generative adversarial network (GAN) is trained using the following loss function, and the parameters of the generative network and the discriminative network are updated. The GAN is gradually updated with each iteration of the federated learning process, and outputs images containing recombined label features and original image features based on the distribution of the original images. (1) (2) (3) (4) , , Let represent the auxiliary network loss, the generator network loss, and the difference control loss function, respectively; in formulas (2) and (3), Represents the cross-entropy loss function. It is the original tag Recombined tags after orthogonal matrix transformation It is a variable constant and is part of model tuning; in formula (4) Represents the total loss function. and This represents the proportion of each loss and is an adjustable parameter constant used for model performance tuning. Step 23: Generate the second recombinant label dataset; The network takes the original image as input and outputs a multi-feature image. The original image in the first recombined label dataset is replaced with the multi-feature image to obtain the second recombined label dataset. Step 24: Train the local model; The global model parameters are used as the initial parameters of the local model, and the second recombined label dataset is used as its training dataset to update the local model parameters. Step 25: Upload local model parameters. At the end of training, upload the trained local model parameters to the server and wait for the global model parameters to be aggregated. Step 3: During the federated learning process, the protected user iterates through Step 2. The generative adversarial network and local model in the local model are gradually updated as the global model is trained. The local model continuously learns the features of the generated images under the recombined labels and incorporates them into the parameters of the global model when the server aggregates the parameters, enabling the global model to distinguish the features of the generated images. Training stops when the training accuracy or testing accuracy of the local model reaches a threshold. At this point, after the generative network generates images with features of the original image and the recombined labels, the local model accurately classifies the generated images into the recombined label class. Step 4, independent of the previous steps, can be used to validate the validation set during the training phase and to test the model during the testing phase, improving the classification accuracy of the original image in the local model. First, the test image is input into the generator network to generate a new image; then, the generated image is input into the local model to obtain the corresponding recombined label. Finally, the transpose of the orthogonal matrix H is used to restore the generated image to its original label, i.e. .

Images