A federated learning-oriented adaptive differential privacy protection method

Abstract

The application discloses a kind of adaptive differential privacy protection methods for federated learning.To overcome the information leakage problem existing when pumping storage power station relies on machine for information detection processing in prior art;The server of the present application selects pumping storage power station to participate in training based on random response mechanism, and establishes global model;Selected pumping storage power station uses the data information collected by local sensor to train global model, adds adaptive differential privacy technology to the gradient information obtained by training and uploads to server, and calculates the consumed privacy budget;The server uses model average method to aggregate the gradient information uploaded by different pumping storage power stations, and updates the global model parameters using the aggregated gradient information, and then transmits the global model parameters to the pumping storage power stations participating in training to update the local model, which improves the model test accuracy under the premise of providing the same privacy protection level as traditional differential privacy technology.

Description

Technical Field

[0001] This invention relates to the field of federated learning, and more particularly to an adaptive differential privacy protection method for federated learning. Background Technology

[0002] Pumped-storage hydroelectric power stations can convert potential energy and electrical energy into each other. During periods of low load, excess electrical energy is stored as the potential energy of water, and during peak load periods, the potential energy of water is converted back into electrical energy. They are an important energy storage power source in the construction of new power systems. Federated learning is an emerging machine learning paradigm in which many devices jointly train a model under the coordination of a central server, while maintaining the decentralization of training data. Only the parameters of the model training are uploaded, without uploading any data to the server, thus protecting information privacy to some extent. However, according to existing research, attackers can infer the privacy information of devices by analyzing the differences between the uploaded and trained parameters, such as model weights and gradients in neural networks.

[0003] Pumped storage power stations utilize numerous sensors to collect information. This information requires monitoring and processing, and relying on manual inspection data introduces uncertainty and increases operating costs. To improve the efficiency of information processing, machine learning is introduced to replace manual inspection data. Machine learning trains models using collected data, then processes future collected data using the trained models to generate inspection reports, thus enabling the inspection of pumped storage power stations. However, machine learning requires uploading the collected data to a server for centralized processing, and this information is vulnerable to interception and potential leaks during transmission.

[0004] For example, a "Data Privacy Protection Method for Federated Learning" disclosed in Chinese patent literature, publication number CN111935156B, includes two steps: autonomy and collaboration. The autonomy step involves two or more participating parties installing an initialized model on their respective terminals. Each participating party possesses the same model, and each party trains its model using local data to obtain different model parameters. The collaboration step involves the participating parties simultaneously uploading the different model parameters to the cloud. The cloud then aggregates and updates the model parameters and returns the updated parameters to each participating party's terminal. Each participating party's terminal then begins the next iteration, repeating the above steps until the entire training process converges. This invention achieves collaborative modeling without the data leaving the local machine, using the interaction of model parameters instead of direct data exchange. This achieves data interaction while also addressing data privacy and security issues. However, this scheme receives responses from the cloud and operates iteratively, which to some extent slows down data transmission efficiency and can also affect data accuracy during operation, thus having certain drawbacks. Summary of the Invention

[0005] This invention primarily addresses the information leakage problem inherent in existing pumped-storage power stations that rely on machines for information detection and processing. It provides an adaptive differential privacy protection method for federated learning, based on a random response mechanism-based pumped-storage power station selection strategy to protect pumped-storage power stations from inference attacks launched by servers. Simultaneously, considering the issue of noise reduction in model testing accuracy due to adaptive differential privacy techniques, an adaptive differential privacy technique is designed to improve model testing accuracy while providing the same level of privacy protection as traditional differential privacy techniques.

[0006] The above-mentioned technical problems of the present invention are mainly solved by the following technical solutions: This invention includes S1: The server selects pumped storage power stations (PSGs) for training using a random response mechanism-based selection strategy and distributes the global model; S2: The selected PSGs use data collected by local sensors to train the global model, add adaptive differential privacy technology to the gradient information obtained during training, upload it to the server, and calculate the consumed privacy budget; S3: The server aggregates the gradient information uploaded by different PSGs using a model averaging method, updates the global model parameters with the aggregated gradient information, and then distributes the global model parameters to the participating PSGs to update their local models. The random response mechanism-based PSG selection strategy prevents the server from knowing whether a particular PSG is participating in the federated learning training process, further enhancing privacy protection for the PSGs. Simultaneously, by adding noise with different distributions based on the magnitude of different dimensions of the gradient vector, compared with traditional differential privacy technology, the accuracy loss caused by adding noise to the gradient is further reduced while maintaining the same level of privacy protection. Therefore, the proposed method is safer and has higher model testing accuracy compared to traditional methods.

[0007] Preferably, S1 includes: S1-1: Setting a state parameter α for each pumped-storage power station participating in federated learning training, where α = 1 represents that the pumped-storage power station participates in training, and α = 0 represents that the pumped-storage power station does not participate. The initial state parameter α of all pumped-storage power stations is set to 0; S1-2: The server randomly selects pumped-storage power stations to participate in training according to the quantity requirements, setting the state parameter α of the selected pumped-storage power stations to 1, and setting the state parameter α of the unselected pumped-storage power stations to 0.

[0008] Preferably, S1 further includes: S1-3: All pumped storage power stations perform a random response, i.e., maintaining the current state parameter unchanged with probability p, and changing the current state parameter with probability 1-p. After the random response, only pumped storage power stations with a state parameter α of 1 participate in the training; S1-4: If the number of pumped storage power stations participating in the training does not meet the server quantity requirement, the server will re-adopt the pumped storage power station selection strategy based on the random response mechanism. If the number of pumped storage power stations participating in the training exceeds the server quantity requirement, the server will only accept parameters uploaded by pumped storage power stations within the specified quantity range; the server will not accept parameters uploaded by pumped storage power stations exceeding the quantity requirement.

[0009] Preferably, S2 includes: S2-1: The pumped storage power station participating in the training uses data collected by local sensors to train the global model issued by the server, and calculates the gradient information g of the training data, g = (w0 - w t ) / η, where w0 represents the network model parameters at the initial time, w t S2-2: Calculate the local sensitivity S of each dimension of the gradient vector. (Note: The original text contains some inconsistencies and unclear grammatical structures. A more accurate translation would require the full context.) i : Where β represents the clipping factor. S2-3: The cumulative squared gradient value of the i-th dimension of the gradient vector at time t-1; S2-3: The standard deviation σ of the noise required to be added to each dimension of the gradient vector. i : Where σ * denoted by , where m represents the noise standard deviation and m represents the dimension of the gradient vector.

[0010] Preferably, S2 further includes S2-4: adding adaptive noise to each dimension of the gradient vector, the gradient vector after adding adaptive noise is... in This indicates that the expected value is 0 and the variance is . The gradient information follows a normal distribution; S2-5: Finally, the gradient information after adding adaptive noise will be added. The data is uploaded to the server, and the privacy budget ε consumed by each pumped storage power station is calculated. The privacy budget represents the level of privacy protection provided for each pumped storage power station; the smaller the privacy budget value, the higher the level of privacy protection. And ε < C1q 2 T Where C1 and C2 are constants, q is the sampling probability, T is the number of iterations, and δ is the probability of differential privacy failure.

[0011] Preferably, S3 includes: S3-1: The server uses a federated averaging algorithm to process the gradient information uploaded by the pumped storage power station with added adaptive noise. Perform aggregation. M k Let M represent the number of samples for the k-th pumped storage power station, and M represent the total number of samples for all pumped storage power stations participating in the training.

[0012] Preferably, S3 further includes: S3-2: The server updates the global model parameters w using the aggregated gradient information via the FedAdam algorithm (Federated Learning Adam algorithm). t , t represents time. This indicates the cumulative gradient bias correction. This represents the cumulative squared gradient bias correction, and γ represents a constant. The updated global model is then distributed to the pumped storage power stations participating in the training to update their local models; S3-3: Repeat steps S2-S3 until the federated learning communication rounds reach the preset value.

[0013] The beneficial effects of this invention are: 1. This solution adopts a pumped storage power station selection strategy based on a random response mechanism to prevent the server from knowing whether a particular pumped storage power station has participated in the federated learning training process, thereby further enhancing the privacy protection of pumped storage power stations. 2. The differential privacy technique used in this scheme reduces the accuracy of model testing. Therefore, an adaptive differential privacy technique is proposed. This technique adds noise with different distributions according to the magnitude of different dimensions of the gradient vector. Compared with the traditional differential privacy technique, it further reduces the accuracy loss caused by adding noise to the gradient without changing the privacy protection level. Therefore, the proposed method is safer and has higher model testing accuracy than the traditional method. Attached Figure Description

[0014] Figure 1 This is a system model diagram of the adaptive differential privacy protection method for federated learning according to the present invention; Figure 2 The flowchart shows the adaptive differential privacy algorithm for federated learning of this invention. Figure 3 This is a comparison chart of the adaptive differential privacy of the present invention with traditional differential privacy and no differential privacy technology. Detailed Implementation

[0015] The technical solution of the present invention will be further described in detail below through embodiments and in conjunction with the accompanying drawings.

[0016] Example: This embodiment presents an adaptive differential privacy protection method for federated learning, such as... Figure 2 As shown, it includes: S1: The server uses a pumped storage power station selection strategy based on a random response mechanism to select pumped storage power stations to participate in training and distribute the global model. S2: The selected pumped storage power station uses data collected by local sensors to train a global model, adds adaptive differential privacy technology to the gradient information obtained from the training and uploads it to the server, and calculates the privacy budget consumed. S3: The server uses the model averaging method to aggregate the model parameter information uploaded by different pumped storage power stations, and then sends the aggregated model parameters back to the pumped storage power stations participating in the training to update their local models.

[0017] Furthermore, step S1 specifically includes the following steps: S1-1: A state parameter α is set for each pumped storage power station participating in the federated learning training. α = 1 represents that the pumped storage power station is participating in the training, and α = 0 represents that the pumped storage power station is not participating. The initial state parameter α of the pumped storage power station is set to 0.

[0018] S1-2: The server randomly selects pumped storage power stations to participate in the training according to the quantity requirements. The state parameter α of the selected pumped storage power stations is set to 1, and the state parameter α of the unselected pumped storage power stations is set to 0.

[0019] S1-3: All pumped storage power stations undergo random response, meaning they maintain their current state parameters with probability p and change them with probability 1-p. After the random response, only pumped storage power stations with a state parameter α of 1 participate in the training. S1-4: If the number of pumped storage power stations participating in the training does not meet the server quantity requirement, the server will re-adopt the pumped storage power station selection strategy based on the random response mechanism. If the number of pumped storage power stations participating in the training exceeds the server quantity requirement, the server will only accept parameters uploaded by pumped storage power stations within the specified quantity range; parameters uploaded by pumped storage power stations exceeding the quantity requirement will not be accepted by the server.

[0020] Furthermore, step S2 specifically includes the following steps: S2-1: The pumped storage power station participating in the training will use data collected by local sensors to train the global model issued by the server, and calculate the gradient information g of the training data, g = (w0 - w t ) / η, where w0 represents the network model parameters at the initial time, w t η represents the network model parameters at the end of training, and η represents the learning rate.

[0021] S2-2: Calculate the local sensitivity S of each dimension of the gradient vector.i : Where β represents the clipping factor. Let represent the i-th dimension of the cumulative squared gradient value of the gradient vector at time t-1.

[0022] S2-3: Calculate the standard deviation σ of the noise required to be added to each dimension of the gradient vector. i : Where σ * denoted by , where m represents the noise standard deviation and m represents the dimension of the gradient vector.

[0023] S2-4: Add adaptive noise to each dimension of the gradient vector. The gradient vector after adding adaptive noise is... in This indicates that the expected value is 0 and the variance is . It follows a normal distribution.

[0024] S2-5: Finally, add the gradient information after adaptive noise. The data is uploaded to the server, and the privacy budget ε consumed by each pumped storage power station is calculated. The privacy budget represents the level of privacy protection provided for each pumped storage power station; the smaller the privacy budget value, the higher the level of privacy protection. And ε < C1q 2 T Where C1 and C2 are constants, q is the sampling probability, T is the number of iterations, and δ is the probability of differential privacy failure.

[0025] Furthermore, step S3 specifically includes the following steps: S3-1: The server uses a federated averaging algorithm to process the gradient information uploaded by the pumped storage power station with added adaptive noise. Perform aggregation. M k Let M represent the number of samples from the k-th pumped storage power station, and M represent the total number of samples from all pumped storage power stations participating in the training.

[0026] S3-2: The server uses the aggregated gradient information to update the global model parameters w using the FedAdam algorithm (Federated Learning Adam algorithm). t , t represents time. This indicates the cumulative gradient bias correction. This represents the cumulative squared gradient bias correction, where γ is a constant. The updated global model is then distributed to the pumped-storage hydroelectric systems participating in the training to update their local models.

[0027] S3-3: Repeat steps S2-S3 until the number of federated learning communication rounds reaches the preset value.

[0028] Figure 1 The system model diagram for an adaptive differential privacy-preserving method for federated learning mainly consists of two parts: a server and a pumped storage power station. The server sends a global model to the pumped storage power station, which trains the global model using local data, adds noise to the gradient information, and uploads it to the server. The server then aggregates the uploaded gradient information, updates the global model parameters with the aggregated gradient information, and sends the updated global model parameters back to the pumped storage power station. This process is repeated until the number of federated learning communication rounds reaches a preset value.

[0029] from Figure 3 It can be seen that, under different privacy budgets, the ADP (Adaptive Differential Privacy) model, after training, achieves a higher test accuracy than the DP (Differential Differential Privacy) model, and is close to the NODP (NoDual Differential Privacy) model. This is because Adaptive Differential Privacy adds noise with different distributions based on the values ​​of different dimensions of the gradient vector, while traditional Differential Privacy adds noise with the same distribution based on the gradient vector. Adaptive Differential Privacy reduces the loss of gradient parameter accuracy due to noise, thus the model trained with Adaptive Differential Privacy achieves a higher test accuracy than traditional Differential Privacy.

[0030] The figure also shows that as the privacy budget gradually increases, the accuracy of the pumped storage power station model test also gradually increases. This is consistent with the characteristics of differential privacy technology, that is, the larger the privacy budget, the less noise is added and the smaller the loss to model performance.

[0031] It should be understood that the embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

Claims

1. An adaptive differential privacy protection method for federated learning, characterized in that, Includes the following steps: S1: The server selects pumped storage power stations to participate in training based on a random response mechanism and establishes a global model; state parameters are set for each pumped storage power station participating in federated learning training. , Pumped storage power stations participated in the training. Pumped storage power stations do not participate. During random response, the current state parameters remain unchanged with probability p, and the current state parameters change with probability 1-p. S2: The selected pumped storage power station uses data collected by local sensors to train a global model, calculates the gradient information of the training data, calculates the local sensitivity of each dimension of the gradient vector based on the pruning factor and the cumulative squared gradient value of each dimension of the gradient vector at the previous time step, calculates the required adaptive noise standard deviation for each dimension based on the local sensitivity of each dimension and the dimension of the gradient vector, adds adaptive noise to each dimension of the gradient vector based on the adaptive noise standard deviation of each dimension, uploads it to the server, and calculates the privacy budget consumed by each pumped storage power station. , ,and ; in , Let q be a constant, q be the sampling probability, and T be the number of iterations. Let σ be the probability of differential privacy failure, and σ be the noise standard deviation. S3: The server uses the model averaging method to aggregate the gradient information uploaded by different pumped storage power stations, updates the global model parameters with the aggregated gradient information, and then transmits the global model parameters to the pumped storage power stations participating in the training to update their local models.

2. The adaptive differential privacy protection method for federated learning according to claim 1, characterized in that, Step S1 specifically includes the following steps: S1-1: Set state parameters for each pumped storage power station participating in the federal learning training. , Representing pumped storage power stations in training. This indicates that the pumped storage power station does not participate; the initial state parameters of the pumped storage power station. All are set to 0; S1-2: The random response mechanism includes: the server randomly selects pumped storage power stations to participate in the training according to the quantity requirements, and transmits the state parameters of the selected pumped storage power stations. Setting it to 1 indicates that no pumped storage power station state parameters are selected. Set to 0.

3. The adaptive differential privacy protection method for federated learning according to claim 2, characterized in that, Step S1 also includes the following steps: S1-3: All pumped storage power stations undergo random response, meaning they maintain the current state parameters with probability p and change them with probability 1-p. After the random response, the state parameters... Only pumped storage power stations with a rating of 1 participated in the training. S1-4: If the number of pumped storage power stations participating in the training does not meet the server quantity requirement, the server will re-select pumped storage power stations using a random response mechanism; if the number of pumped storage power stations participating in the training exceeds the server quantity requirement, the server will only accept parameters uploaded by pumped storage power stations within the specified quantity range, and the server will not accept parameters uploaded by pumped storage power stations exceeding the quantity requirement.

4. The adaptive differential privacy protection method for federated learning according to claim 3, characterized in that, Step S2 specifically includes the following steps: S2-1: The pumped storage power station participating in the training will use data collected by local sensors to train the global model issued by the server and calculate the gradient information of the training data. , ,in This represents the network model parameters at the initial moment. This represents the network model parameters at the end of training. Indicates the learning rate; S2-2: Calculate the local sensitivity of each dimension of the gradient vector : ； in Indicates the clipping factor. This represents the i-th dimension of the cumulative squared gradient value of the gradient vector at time t-1; S2-3: Calculate the standard deviation of the adaptive noise to be added to each dimension of the gradient vector. : ； in denoted by , where m represents the noise standard deviation and m represents the dimension of the gradient vector.

5. The adaptive differential privacy protection method for federated learning according to claim 4, characterized in that, Step S2 also includes the following steps: S2-4: Add adaptive noise to each dimension of the gradient vector. The gradient vector after adding adaptive noise is... : ;in This indicates that the expected value is 0 and the variance is . The normal distribution; S2-5: Finally, add the gradient information after adaptive noise. , Uploaded to the server, and the privacy budget consumed by each pumped storage power station is calculated. Privacy budget represents the level of privacy protection provided for each pumped storage power station; the smaller the privacy budget value, the higher the level of privacy protection.

6. The adaptive differential privacy protection method for federated learning according to claim 5, characterized in that, Step S3 specifically includes the following steps: S3-1: The server uses a federated averaging algorithm to process the gradient information uploaded by the pumped storage power station with added adaptive noise. Perform aggregation. , This represents the number of samples for the k-th pumped storage power station. This represents the total number of samples from all pumped storage power stations participating in the training.

7. The adaptive differential privacy protection method for federated learning according to claim 6, characterized in that, Step S3 also includes the following steps: S3-2: The server updates the global model parameters based on the aggregated gradient information using a federated learning algorithm. , t represents time. This indicates the cumulative gradient bias correction. This indicates the cumulative squared gradient bias correction. This represents a constant; and the updated global model is transmitted to the pumped storage power stations participating in the training to update their local models; S3-3: Repeat steps S2-S3 until the number of federated learning communication rounds reaches the preset threshold.

Images