A model fingerprint-based federated learning property tag labeling method
By generating adversarial examples as model fingerprints in federated learning and training detectors to achieve intellectual property verification, the problem of applying watermarking technology in federated learning is solved, and effective protection and robustness of model intellectual property are achieved.
Patent Information
- Application Number
- CN202211357805.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-01
- Publication Date
- 2026-01-23
- Estimated Expiration
- 2042-11-01
AI Technical Summary
Existing watermarking technologies cannot be directly applied to federated learning, cannot effectively protect model intellectual property rights, and have problems affecting training performance and robustness.
By generating adversarial examples as model fingerprints, and using the output distribution features unique to the global model input from the adversarial examples to train the detector, intellectual property verification is achieved.
While not affecting the training of the main federated learning task, it effectively protects the intellectual property rights of the model, prevents malicious theft, and improves the robustness of model intellectual property verification.
Smart Images
Figure CN115759247B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of federated learning, and particularly relates to a model fingerprint-based federated learning property right label calibration method and device. BACKGROUND
[0002] Federated learning is a new distributed learning, and its main innovation is to provide a distributed machine learning framework with privacy protection features, which can iteratively train a specific machine learning model in a distributed manner with thousands of participants. Participants only need to train local models on their own devices, and data does not need to leave the local area. Only the local model parameters need to be uploaded to the server, and the server will aggregate all the received model parameters through a specific algorithm to generate a new global model, and distribute the global model to the user. Repeat the above steps until the global model converges. This greatly protects the privacy and security of participants, and the training effect is better than centralized learning. Due to its efficient scalability and security, it is widely used in bank loans, medical diagnosis, recommendation systems and other fields.
[0003] However, the high value of the federated global model and the distributed multi-client training mechanism bring about the security problem of model ownership. The distributed training of federated learning makes the final trained global model better than the model trained by centralized learning, and in the process of joint training, the client is the data provider and can access the global model aggregated by the server. In this process, malicious clients may steal the global model and make profits through illegal channels. This brings great challenges to the security of federated learning. How to better protect the security of federated learning and declare and verify the property right of the model to protect the rights and interests of the participants is a new problem faced by federated learning.
[0004] As the main means of property protection, watermark technology is widely used in the ownership protection of DNN models in single-machine scenarios. The owner trains the model by designing a secret watermark to embed the watermark in the model. The watermark can then be used to prove ownership. However, due to the privacy protection and distributed nature of federated learning, existing watermark embedding schemes cannot be directly applied to federated learning. First, due to the non-sharing nature of data, the model owner may not be able to generate a watermark using training data; second, there may be malicious parties among the clients, and the clients cannot be fully trusted to perform watermark embedding. Although some "trusted clients" can join the watermark embedding stage, the training settings and aggregation rules must be changed; finally, watermark technology has some inherent defects, such as the process of embedding watermarks will inevitably affect the training performance and main task performance of federated learning, and must have strong robustness against various removal attacks. This increases the difficulty of migrating watermark technology from single-machine to federated learning mechanism. SUMMARY
[0005] The present application overcomes the shortcomings of the prior art and provides a model fingerprint-based federated learning property label calibration method. Compared with traditional federated learning, the method has the advantage of property protection. The server generates an adversarial example by adding the inherent characteristics of the global model through key samples, as a model fingerprint, and trains a detector using the output distribution characteristics of the global model inputted by the adversarial example. The detector can specify a label according to the unique distribution output of the adversarial example, thereby achieving the effect of property verification.
[0006] The purpose of the present application is achieved by the following technical solution: a model fingerprint-based federated learning property label calibration method, comprising the following steps:
[0007] S1: initializing a federated learning training environment.
[0008] S2: initializing a server detection model and key samples;
[0009] S3: a client participating in training uses local data for local training and uploads local model parameters to the server.
[0010] S4: the server uses an aggregation algorithm to aggregate the parameters uploaded by the client to generate a global model, and clones the current global model for property declaration.
[0011] Preferably, the step S1 specifically comprises:
[0012] Set the total training round E, local data D, and the total number of devices participating in federated learning k, and initialize the local model.
[0013] Preferably, the step S2 specifically comprises:
[0014] Initialize the detection model M and the key samples D key , which are deployed on the server side.
[0015] Preferably, the step S3 specifically comprises:
[0016] The client p participating in training i preprocesses the local data, starts training the initialized local model, and after the set local training round, uploads the local model parameters to the server.
[0017] Preferably, the step S4 specifically comprises:
[0018] S4.1: the server uses an aggregation algorithm to aggregate the parameters uploaded by the client to generate a global model, and distributes it to each client. The aggregation process is as follows:
[0019]
[0020] S4.2 Based on the global model of step S4.1, the server will clone a copy of the global model for the ownership declaration. The server uses the detection model M to extract the inherent characteristics of each round of cloned global model, and uses the key sample D key Adversarial examples D adv are generated as model fingerprints F. The generation process is as follows:
[0021]
[0022] Where x is the key sample input, y t is the target label, ε is the hyperparameter, θ is the global model parameter, and L() is the loss function.
[0023] At the same time, since the global model is constantly being trained, the target label of the adversarial example generated in the last round may be offset when the adversarial example is input into the global model in the next round. In order to ensure the stability of the output label of the adversarial example input into the global model, we use the technology of dynamically generating adversarial examples to judge whether the adversarial example of the last round is invalid. If it is invalid, the inherent characteristics of the global model in the next round are added to enhance the effect of the model fingerprint.
[0024]
[0025] Where the Detector() function judges whether the D adv label is offset, ↓ indicates offset, and indicates the enhanced model fingerprint.
[0026] S4.3: Adversarial examples D adv generated in step S4.2 are used as model fingerprints F. Different adversarial examples D adv input into the global model will get a specific output vector H:
[0027] H = G(D adv ) (4)
[0028] The distribution characteristics of the output vector H and the label H y marked by humans are used to train the detection model M. In the subsequent ownership verification process, it can effectively prevent malicious parties from using ambiguity attacks, and the occurrence of occasional consistency between the output label of non-key samples and the output label of key samples. In order to improve the verification ability of the detector model, different classes of adversarial examples D adv can be generated by increasing the number of key sample categories C, which can better train the detector M.
[0029] Train((H, H y )→M(θ, C)) (5)
[0030] wherein the Train() function represents the training process of the model, and theta is the parameter of the model M.
[0031] Repeat steps S3 and S4 until the global model converges, complete the main task training and the property declaration.
[0032] The application further provides a computer readable storage medium, which stores a program, and the program is executed by a processor to implement the model fingerprint-based federated learning property label calibration method.
[0033] The application has the following beneficial effects:
[0034] Compared with the prior art, the model property protection is realized without affecting the federated main task training, and the global model prediction accuracy is not affected. BRIEF DESCRIPTION OF DRAWINGS
[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced below. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.
[0036] Figure 1 is a structural schematic diagram of the method of the present application;
[0037] Figure 2 is a working process of the method of the present application;
[0038] Figure 3 is a schematic diagram of the device for implementing the method of the present application. DETAILED DESCRIPTION
[0039] The various exemplary embodiments of the present application will now be described in detail, which should not be considered as limiting the present application, but should be understood as a more detailed description of certain aspects, characteristics and embodiments of the present application.
[0040] It should be understood that the terms described in the present application are only for describing the specific embodiments, and are not used to limit the present application. In addition, for the numerical range in the present application, it should be understood that each intermediate value between the upper limit and the lower limit of the range is also specifically disclosed. Each smaller range between any stated value or intermediate value within the range and any other stated value or intermediate value within the range is also included in the present application. The upper limit and the lower limit of these smaller ranges can be independently included or excluded from the range.
[0041] Unless otherwise stated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art. While only preferred methods and materials have been described herein, any methods and materials similar or equivalent to those described herein may be used in the implementation or testing of this invention. All references to this specification are incorporated by way of citation to disclose and describe methods and / or materials associated with those references. In the event of any conflict with any incorporated reference, the content of this specification shall prevail.
[0042] Various modifications and variations can be made to the specific embodiments described in this specification without departing from the scope or spirit of the invention, as will be apparent to those skilled in the art. Other embodiments derived from this specification will also be readily apparent to those skilled in the art. This application specification and embodiments are merely exemplary.
[0043] The terms “include,” “including,” “have,” “contain,” etc., used in this article are all open-ended terms, meaning that they include but are not limited to.
[0044] Unless otherwise specified, the term "parts" in this invention refers to parts by weight.
[0045] Example 1
[0046] like Figure 1 and Figure 2 As shown, this invention provides a property labeling method for a news recommendation system based on a federated learning property labeling method using model fingerprints. Specifically, in an application scenario of a news recommendation system, taking the news dataset Adressa as an example, it enables better news recommendations for target users and simultaneously performs property labeling on the recommendation model.
[0047] Includes the following steps:
[0048] Step S1: Initialize the federated learning training environment: Set the overall training rounds E, local data D, and the total number of devices participating in federated learning k, and initialize the local model.
[0049] S1.1: Partition of local data D. The public news recommendation dataset collected from a Norwegian news website, named Adressa. It has 48486 news articles, 308w users and 2722w click events. For the Adressa dataset, we use the user logs of the first five days to build the click history of users, use the logs of the sixth day for model training, and use the logs of the seventh day for model evaluation. Ten clients with a certain amount of data are selected to participate in federated learning, and there are 15 types of labels in each of the ten clients, with 200 data for each type of label, as shown in the following table:
[0050]
[0051]
[0052] Step S2: Deploy the initialized detection model M and the key samples D on the server. key .
[0053] Step S3: Client p i uses local data to train the local model L i , and then uploads the local model parameters to the server.
[0054] Step S4: The server first aggregates the model parameters uploaded by each client to generate a global model. The aggregation process is as follows:
[0055]
[0056] The server immediately distributes the aggregated global model to each client, and also clones a copy of the global model for training the detection model. The server uses the key samples D key previously deployed for the training task to generate the adversarial examples D adv . The adversarial examples are generated by extracting the features unique to each round of the global model through targeted attacks, serving as the model fingerprint F. The generation process is as follows:
[0057]
[0058] where x is the key sample input, y_t is the target label, ε is a hyperparameter, θ is the global model parameter, and L() is the loss function.
[0059] At the same time, the dynamic generation of adversarial examples is adopted to determine whether the adversarial examples of the previous round are invalid. If they are invalid, the inherent features of the next round of global model are added to enhance the effect of the model fingerprint.
[0060]
[0061] Where the Detector() function determines whether D adv whether the label is shifted, and representing an enhanced model fingerprint.
[0062] Different adversarial examples input to the global model will obtain a specific output vector H:
[0063] H = G(D adv ) (4)
[0064] The distribution characteristics of the output vector H and the manually labeled H y are used to train a detector. This example increases the number of key sample categories C = 10, generates adversarial examples of different categories, and improves the verification ability of the detection model M. The training process is as follows:
[0065] Train((H, H y )-→M(θ, C)) (5)
[0066] Where the Train() function represents the training process of the detection model M, and θ is the parameter of the model M.
[0067] Repeat steps S3 and S4 until the global model converges to end federated learning. The news recommendation model trained by federated learning is evaluated for classification accuracy and property label calibration. As shown in the following table:
[0068] Dataset Global model accuracy Property label calibration validation accuracy Adressa 98.12％ 100％
[0069] As can be seen from the results, the global model obtained by the above training can more accurately recommend news to users, and can effectively calibrate the property label of the model.
[0070] Corresponding to the foregoing embodiments of the federated learning property label calibration method based on model fingerprints, the present application also provides embodiments of a federated learning property label calibration method device based on model fingerprints.
[0071] Referring to Figure 3 , the embodiment of the present application provides a federated learning property label calibration method device based on model fingerprints, which comprises one or more processors for implementing the federated learning property label calibration method based on model fingerprints in the above embodiments.
[0072] The model fingerprint-based federated learning property label calibration method and device can be applied to any device with data processing capability, which can be a device such as a computer or the like. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory for execution by the processor of the device with data processing capability. From the hardware level, as shown in Figure 3 Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the device in the embodiment can also include other hardware according to the actual functions of the device with data processing capability, which will not be described here.
[0073] The implementation process of the functions and roles of each unit in the above device is specifically described in the implementation process of the corresponding steps in the above method, which will not be described here.
[0074] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can be referred to the part of the method embodiment. The above described device embodiment is only schematic, and the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. According to actual needs, part or all of the modules can be selected to achieve the purpose of the present application. Those skilled in the art can understand and implement without creative labor.
[0075] The embodiment of the present application also provides a computer readable storage medium, which stores a program, and the program is executed by a processor to realize the model fingerprint-based federated learning property label calibration method in the above embodiment.
[0076] The computer readable storage medium can be an internal storage unit of any of the aforementioned data processing capable devices, such as a hard disk or a memory. The computer readable storage medium can also be any of the aforementioned data processing capable devices, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. Further, the computer readable storage medium can also include both an internal storage unit of any of the aforementioned data processing capable devices and an external storage device. The computer readable storage medium is used to store the computer program and other programs and data required by any of the aforementioned data processing capable devices, and can also be used to temporarily store data that has been output or is to be output.
[0077] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.
Claims
1. A federated learning property tagging method based on model fingerprints, characterized in that, Includes the following steps: (1) Initialize the federated learning training environment; (2) Initialize the server detection model and key samples; (3) The client participating in the training performs the training in round t, obtains the trained local model parameters and uploads them to the server; The server uses the aggregation algorithm to aggregate the parameters uploaded by the client and distributes them to each client, and at the same time clones a global model for property rights declaration. (4) The server uses the detection model to extract inherent features from the global model cloned in each round, and uses key samples to generate adversarial examples as model fingerprints; (5) Repeat steps (3)-(4) until the global model converges, completing the main task training and property rights declaration; Step (1) specifically includes: setting the overall training rounds E, local data D, setting the local model and global model, and the total number of clients participating in federated learning k; In step (2), the detection model and key samples are deployed on the server; Step (3) specifically includes: (3.1) Clients participating in training Without data sharing, local model training is performed on the distributed global model weights: (3.2) For the t-th round of training, the parameters of the trained local model matrix are obtained. The local model parameters are then uploaded to the server, which aggregates them and clones a global model for property rights declaration. Step (4) specifically includes: S4.1: The server uses an aggregation algorithm to process the parameters uploaded by the client. The aggregation process generates a global model, which is then distributed to each client. The aggregation process is as follows: （1） S4.2 Based on the global model in step S4.1, the server clones a copy of the global model for property rights declaration; the server uses the detection model M to extract inherent features from the cloned global model in each round, and uses key samples... Generate adversarial examples , as the model fingerprint F; the generation process is as follows: = + εsign(▽x L(θ, x, )) (2) Where x is the key sample input. ε is the target label, θ is the hyperparameter, θ is the global model parameter, and L() is the loss function; Meanwhile, as the global model is constantly being trained, the target label of the adversarial example generated in the previous round may shift when it is input into the global model in the next round of training. In order to ensure the stability of the output label after the adversarial example is input into the global model, a technique of dynamically generating adversarial examples is adopted to determine whether the adversarial example in the previous round is invalid. If it is invalid, the inherent features of the global model in the next round are added to enhance the effect of the model fingerprint. Detector( ) ↓ ⇒ = + εsign(▽xL(θ, x, y)) (3) The Detector() function determines... Whether the label is offset, ↓ indicates offset. This indicates an enhanced model fingerprint; S4.3: Adversarial example generated in step S4.2 As the model fingerprint F, different adversarial examples The input to the global model will yield a specific output vector H: H = G( ) (4) Utilizing the distribution characteristics of the output vector H and manually assigned labels The detection model M is trained; in the subsequent intellectual property verification process, it can effectively prevent malicious parties from using ambiguity attacks to prevent sporadic instances where the output labels of non-critical samples are consistent with those of critical samples; to improve the verification capability of the detector model, the number of critical sample categories C can be increased to generate adversarial examples of different classes. Better training of detector M; Train((H, ) -→ M (θ, C)) (5) The Train() function represents the training process of the model, and θ is the parameter of the model M.
2. An apparatus for implementing the model fingerprint-based federated learning intellectual property tagging method as described in claim 1, characterized in that, It includes one or more processors for implementing the model fingerprint-based federated learning property labeling method of claim 1.
3. A computer-readable storage medium having a program stored thereon, characterized in that, When executed by the processor, the program is used to implement the model fingerprint-based federated learning property labeling method as described in claim 1.