A deep learning model privacy protection method based on differential privacy
Patent Information
- Application Number
- CN202310037325.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-01-10
- Publication Date
- 2026-08-21
- Estimated Expiration
- 2043-01-10
AI Technical Summary
由于噪声的添加，会带来模型准确性的损失，这使隐私性-准确性权衡成为一大关键问题
[0055] The beneficial effects of the present invention are: by adopting non-linear exponential decay for the gradient clipping threshold to achieve the limitation of the added noise amount and the improvement of the convergence speed; the gradient update part uses a learning rate control variable to achieve the adaptive update of the momentum hyperparameter, so that the momentum update has a larger momentum hyperparameter in the flat direction, further improving the convergence speed of model training, reducing the number of iterations of model optimization, and achieving higher accuracy of the deep learning model under the same privacy budget. The significant features of the present invention are mainly reflected in the following points:
Smart Images
Figure CN115935436B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of deep learning and privacy protection technology, specifically to a privacy protection method for deep learning models based on differential privacy. Background Technology
[0002] The term Deep Learning (DL) was first introduced into the concept of Machine Learning (ML) in 1986. As an important component of machine learning, its essential characteristic is representation learning. With the rapid development of deep learning, it has achieved groundbreaking results in many fields, including computer vision, speech recognition, natural language processing, and search recommendation. The success of deep learning technology relies heavily on massive amounts of data, which inevitably makes it susceptible to various privacy threats. These threats differ depending on the learning stage. During the training stage, data theft attacks are involved; during the prediction stage, model inversion attacks, member inference attacks, and model theft attacks are involved. These attacks can indirectly infer sensitive information in the training data, and their harm should not be underestimated.
[0003] To mitigate privacy breaches caused by privacy attacks, various privacy protection mechanisms have been proposed. Traditional privacy protection mechanisms can be broadly categorized into two types: perturbation-based and encryption-based. Perturbation-based mechanisms include k-anonymity, while encryption-based mechanisms include homomorphic encryption and secure multi-party computation. While these mechanisms can control privacy breaches to some extent, they still have many shortcomings. k-anonymity performs poorly on high-dimensional data and cannot provide quantitative proof of privacy protection. Homomorphic encryption involves extensive computation, resulting in high computational overhead and low processing speed. Although secure multi-party computation outperforms homomorphic encryption in terms of computational performance, it still incurs significant overhead compared to unencrypted mechanisms and requires all participants to be online, leading to high communication costs.
[0004] To address the shortcomings of traditional privacy protection mechanisms, researchers have proposed a privacy protection mechanism based on Differential Privacy (DP). Compared to traditional mechanisms, DP provides a privacy budget to quantify the degree of privacy protection, and it does not involve encryption operations, resulting in relatively low computational overhead. DP is a widely used privacy protection technique. Its main idea is to limit the sensitivity of query results in adjacent datasets to any single data point; that is, attackers cannot determine the existence of a particular data point in adjacent datasets by observing the query results. DP algorithms have rigorous mathematical proofs. Currently, the stochastic gradient descent algorithm for DP is widely used. It adds noise to the gradient of neural network training parameters to protect the privacy of the deep learning model training dataset. However, the addition of noise leads to a loss of model accuracy, making the privacy-accuracy trade-off a critical issue. Summary of the Invention
[0005] This invention provides a privacy protection method for deep learning models based on differential privacy. It aims to design a differential privacy algorithm that more effectively balances model privacy and accuracy, thereby reducing the number of optimization iterations and improving the convergence speed when training deep learning models using differential privacy algorithms, and achieving higher accuracy under the same privacy budget.
[0006] The technical solution adopted in this invention is a privacy protection method for deep learning models based on differential privacy, which is implemented according to the following steps:
[0007] Step 1: Build a deep learning model. Given a training dataset, input the learning rate, noise parameters, and gradient clipping threshold.
[0008] Step 2: Initialize the number of training iterations t=1 and initialize the model parameters;
[0009] Step 3: Randomly sample from the training dataset of size N with probability L / N, and use it as the training sample L for the t-th iteration. t ;
[0010] Step 4: Calculate the dynamically updated gradient clipping threshold C according to the nonlinear exponential decay formula. t ;
[0011] Step 5: For each sample, apply the loss function used by the deep learning model to optimize the model parameters θ for the t-th iteration. t Calculate the partial derivatives to obtain the sample gradient value for the t-th iteration;
[0012] Step 6: Update the optimization gradient value for each sample in the t-th iteration;
[0013] Step 7: Prune the optimized gradient values;
[0014] Step 8, for L t The optimized gradient values after pruning are summed, and a result is assumed to have a mean of 0 and a standard deviation of σ·C. t The Gaussian noise with a Gaussian distribution is averaged to obtain the noise gradient value.
[0015] Step 9: Update the model optimization parameters θ for the t-th iteration. t And use privacy accounting methods to calculate the cumulative privacy loss over t iterations;
[0016] Step 10: Update the number of training iterations and determine whether the predetermined number of training iterations has been completed.
[0017] The invention is further characterized in that,
[0018] Gradient clipping threshold C in step 4 t The calculation method is as follows:
[0019]
[0020] Where C is the initial value of the gradient clipping threshold, t is the current iteration number, and T is the predetermined number of training iterations;
[0021] The sample gradient value in step 5 for the t-th iteration is calculated as follows:
[0022]
[0023] Where, θ t Let x be the model optimization parameters for the t-th iteration. i Let i be the i-th sample.
[0024] Step 6 is implemented in the following steps:
[0025] Step 6.1, update the partial second moment estimate to obtain v. t The calculation method is as follows:
[0026]
[0027] Where β2 is the exponential decay rate estimated by the second moment;
[0028] Step 6.2, correct the second-order moment estimation bias, and obtain The calculation method is as follows:
[0029]
[0030] Step 6.3: Average the second-order moment estimates to obtain... The calculation method is as follows:
[0031]
[0032] Step 6.4: Update the exponential decay rate of the first moment estimate to obtain β. 1,t The calculation method is as follows:
[0033]
[0034] Here, β0 and a are pre-defined hyperparameters, and the second-order moment estimate is used to realize β. 1,t Adaptive updates, while avoiding excessively large inertia, for β 1,t Perform the trimming operation;
[0035] Step 6.5: Update the partial first moment estimate to obtain m. t The calculation method is as follows:
[0036] m t ←β 1,t ·m t-1 +(1-β 1,t )·g t (x i )
[0037] Step 6.6, correct the first-order moment estimation bias, and obtain The calculation method is as follows:
[0038]
[0039] Step 6.7: Update and optimize the gradient value to obtain g' t (x i )
[0040]
[0041] The optimization gradient pruning in step 7 is represented as follows:
[0042]
[0043] The specific steps are as follows:
[0044] Step 7.1, optimize the L2 norm of the gradient value and the gradient clipping threshold C. t Compare;
[0045] Step 7.2, if ||g' t (x i )||2≤C t Then the optimization gradient value g' in the t-th iteration t (x i () Remain unchanged;
[0046] Step 7.3, if ||g't (x i ) || 2 > C t , then update the optimized gradient value g' t (x i ) at the t-th iteration to the gradient clipping threshold C t , that is, g' t (x i ) = C t ;
[0047] Step 7.4, obtain the optimized gradient value after gradient clipping according to Step 7.1 and Step 7.2
[0048] In Step 8, add noise to the clipped optimized gradient value, which is expressed as:
[0049]
[0050] where represents Gaussian noise whose probability density function follows a Gaussian distribution with a mean of 0 and a standard deviation of σ·C t , σ is the noise parameter, C t is the gradient clipping threshold, and I is the identity matrix whose dimension is related to the number of samples and the number of gradients;
[0051] Step 10 is specifically implemented according to the following steps:
[0052] Step 10.1, let t = t + 1, and compare the current training iteration number t with the predetermined training iteration number T;
[0053] Step 10.2, if t < T, then go to Step 3 for the next iteration;
[0054] Step 10.3, if t ≥ T, then output the final model optimization parameter θ t and the overall privacy loss (ε, δ), and obtain the deep learning model trained using the differential privacy protection method;
[0055] The beneficial effects of the present invention are: by adopting non-linear exponential decay for the gradient clipping threshold to achieve the limitation of the added noise amount and the improvement of the convergence speed; the gradient update part uses a learning rate control variable to achieve the adaptive update of the momentum hyperparameter, so that the momentum update has a larger momentum hyperparameter in the flat direction, further improving the convergence speed of model training, reducing the number of iterations of model optimization, and achieving higher accuracy of the deep learning model under the same privacy budget. The significant features of the present invention are mainly reflected in the following points:
[0056] (1) According to the Differential Privacy Stochastic Gradient Descent algorithm, Gaussian noise is used for the noise addition, i.e., the noise distribution conforms to Gaussian noise with a mean of 0 and a standard deviation of σ·C. The amount of noise added is proportional to the size of the gradient clipping threshold C. When C is too large, it will lead to an excessive amount of noise added; when C is too small, it will lead to a large deviation in gradient estimation, making it difficult to retain the effective gradient learning features and resulting in slow convergence. During training, the gradient norm shows a decay trend as the number of iterations increases. Therefore, this invention adopts a scheme of dynamically updating the gradient clipping threshold C, using nonlinear exponential decay for C, i.e. To alleviate problems caused by C being too large or too small;
[0057] (2) In the Differential Privacy Stochastic Gradient Descent algorithm, parameter updates depend only on the current gradient value, resulting in problems such as unstable and slow convergence. Therefore, this invention uses the method in step 6 to update and optimize the gradient value, employing an exponential moving average to estimate the first and second moments to increase stability. The first-moment estimate can be understood as controlling the direction of model updates, and the second-moment estimate can be understood as controlling the learning rate. This invention improves the exponential decay rate of the first-moment estimate from the usual scalar β1 to a vector β. 1,t Using the second moment estimate v t To achieve β 1,t The adaptive update, that is, using the learning rate control variable to achieve adaptive update of momentum hyperparameters, ultimately achieves a larger momentum hyperparameter in the flat direction, further accelerating model convergence. Attached Figure Description
[0058] Figure 1 This is a flowchart of the privacy protection method for deep learning models based on differential privacy, as described in this invention. Detailed Implementation
[0059] To better understand the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.
[0060] In existing methods using differential privacy gradient descent to train convolutional neural networks for privacy protection in classification and prediction tasks, an excessively large gradient pruning threshold leads to excessive noise, resulting in decreased model accuracy. Conversely, an excessively small threshold leads to significant bias in gradient estimation, making it difficult to retain effective gradient learning features and causing slow convergence. To address this issue, this invention employs a dynamically updated gradient pruning threshold using non-linear exponential decay. Furthermore, the gradient update method of the differential privacy algorithm differs from existing methods. First, an exponential moving average is used to calculate the second-order moment estimate, which is then biased and averaged. Next, the bias-corrected second-order moment estimate and its average value are used to adaptively update the exponential decay rate used in calculating the first-order moment estimate. Then, the updated exponential decay rate is used to calculate the first-order moment estimate, which is then bias-corrected again to obtain the final updated gradient value.
[0061] The flowchart of a privacy protection method for deep learning models based on differential privacy according to the present invention is as follows: Figure 1 As shown in the figure, this diagram illustrates the complete process of the method of the present invention, which specifically includes the following steps:
[0062] Step 1: Construct a deep learning model. The deep learning model used is a convolutional neural network (CNN) model. The model contains an input layer, two convolutional layers, two pooling layers, a fully connected layer, and an output layer. Given a training dataset, the training dataset is obtained from a public website and the data is normalized and standardized preprocessed. Input learning rate, noise parameters, and gradient clipping threshold.
[0063] Step 2: Initialize the number of training iterations t=1 and initialize the model parameters;
[0064] Step 3: Randomly sample from the training dataset of size N with probability L / N, and use it as the training sample L for the t-th iteration. t ;
[0065] Step 4: Calculate the dynamically updated gradient clipping threshold C according to the nonlinear exponential decay formula. t C t The calculation method is as follows: Where C is the initial value of the gradient clipping threshold, t is the current iteration number, and T is the predetermined number of training iterations;
[0066] Step 5: For each sample, optimize the model parameters θ for the t-th iteration using the cross-entropy loss function. t Calculate the partial derivative to obtain the sample gradient value for the t-th iteration. The sample gradient value for the t-th iteration is calculated as follows: Where, θ tLet x be the model optimization parameters for the t-th iteration. i For the i-th sample;
[0067] Step 6: Update the optimization gradient value for each sample in the t-th iteration, specifically by following these steps:
[0068] Step 6.1, update the partial second moment estimate to obtain v. t The calculation method is: v t ←β2· Where β2 is the exponential decay rate estimated by the second moment;
[0069] Step 6.2, correct the second-order moment estimation bias, and obtain The calculation method is as follows:
[0070] Step 6.3: Average the second-order moment estimates to obtain... The calculation method is as follows:
[0071] Step 6.4: Update the exponential decay rate of the first moment estimate to obtain β. 1,t The calculation method is as follows: Here, β0 and a are pre-defined hyperparameters, and the second-order moment estimate is used to realize β. 1,t Adaptive updates, while avoiding excessively large inertia, for β 1,t Perform the cutting operation;
[0072] Step 6.5: Update the partial first moment estimate to obtain m. t The calculation method is as follows: m t ←β 1,t ·m t-1 +(1-β 1,t )·g t (x i );
[0073] Step 6.6, correct the first-order moment estimation bias, and obtain The calculation method is as follows:
[0074] Step 6.7: Update and optimize the gradient value to obtain g' t (x i );
[0075] Step 7, prune the optimization gradient values, as shown below: The specific steps are as follows:
[0076] Step 7.1, optimize the L2 norm of the gradient value and the gradient clipping threshold C.t Compare;
[0077] Step 7.2, if ||g' t (x i )||2 ≤ C t , then the optimized gradient value g' t (x i ) remains unchanged;
[0078] Step 7.3, if ||g' t (x i )||2 > C t , then update the optimized gradient value g' t (x i ) of the t-th iteration to the gradient clipping threshold C t , that is, g' t (x i ) = C t ;
[0079] Step 7.4, obtain the optimized gradient value after gradient clipping operation according to Step 7.1 and Step 7.2
[0080] Step 8, sum the optimized gradient values after clipping in L t , add Gaussian noise that conforms to a Gaussian distribution with a mean of 0 and a standard deviation of σ·C t , and then take the average value to obtain the noise-added gradient value Denoted as: Wherein, represents Gaussian noise whose probability density function follows a Gaussian distribution with a mean of 0 and a standard deviation of σ·C t , σ is the noise parameter, C t is the gradient clipping threshold, and I is the identity matrix whose dimension is related to the number of samples and the number of gradients;
[0081] Step 9, update the model optimization parameter θ t of the t-th iteration, and calculate the cumulative privacy loss of the t-th iteration using the privacy accounting method;
[0082] Step 10, update the training iteration number, and determine whether the predetermined number of training iterations is completed. The specific implementation is as follows:
[0083] Step 10.1, let t = t + 1, and compare the current training iteration number t with the predetermined number of training iterations T;
[0084] Step 10.2, if t < T, then go to Step 3 for the next iteration;
[0085] Step 10.3, if t ≥ T, then output the final model optimization parameter θt The overall privacy loss (ε,δ) is used to obtain the deep learning model trained using the differential privacy protection method.
Claims
1. A privacy protection method for deep learning models based on differential privacy, characterized in that, The method includes the following steps: Step 1: Build a deep learning model. Given a training dataset, input the learning rate, noise parameters, and gradient clipping threshold. Step 2: Initialize the number of training iterations Initialize model parameters; Step 3, with The probability of being from the size of Random sampling from the training dataset, as the first Training samples for the next iteration ; Step 4: Calculate the dynamically updated gradient clipping threshold based on the nonlinear exponential decay formula. ; Gradient clipping threshold The calculation method is as follows: in, This is the initial value for the gradient clipping threshold. This represents the current iteration number. The predetermined number of training iterations; Step 5: For each sample, apply the loss function used by the deep learning model to the first... Model optimization parameters in the next iteration Find the partial derivative to obtain the first... The sample gradient values of the next iteration; Step 6, Update the The optimized gradient value for each sample in each iteration; The specific steps are as follows: Step 6.1: Update the partial second moment estimate to obtain... The calculation method is as follows: in, The exponential decay rate is estimated by the second moment; Step 6.2: Correct the second-order moment estimation bias to obtain... The calculation method is as follows: Step 6.3: Average the second-order moment estimates to obtain... The calculation method is as follows: Step 6.4: Update the exponential decay rate of the first moment estimate to obtain... The calculation method is as follows: in, Both and 'a' are pre-defined hyperparameters, and the second-order moment estimates are used to achieve this. Adaptive updates, while avoiding excessive inertia, for Perform the cutting operation; Step 6.5: Update the partial first moment estimate to obtain... The calculation method is as follows: Step 6.6: Correct the first-order moment estimation bias to obtain... The calculation method is as follows: Step 6.7: Update and optimize the gradient value to obtain... ； Step 7: Prune the optimized gradient values; Step 8, for The optimized gradient values after pruning are summed, and a result is assumed to have a mean of 0 and a standard deviation of 0. The Gaussian noise with a Gaussian distribution is averaged to obtain the noise gradient value. ; Step 9, Update the first Model optimization parameters in the next iteration And calculate using privacy accounting methods The cumulative privacy loss across iterations; Step 10: Update the number of training iterations and determine whether the predetermined number of training iterations has been completed.
2. The privacy protection method for deep learning models based on differential privacy according to claim 1, characterized in that, In step 5, the first The sample gradient value of the next iteration is calculated as follows: in, For the first The model optimization parameters for the next iteration. For the first One sample.
3. The privacy protection method for deep learning models based on differential privacy according to claim 1, characterized in that, In step 7, the optimization gradient value is pruned as follows: 。 4. The privacy protection method for deep learning models based on differential privacy according to claim 3, characterized in that, Step 7 is specifically implemented according to the following steps: Step 7.1: Combine the L2 norm of the optimized gradient value with the gradient clipping threshold. Compare; Step 7.2, if Then the first The optimization gradient value of the next iteration Remain unchanged; Step 7.3, if Then the first The optimization gradient value of the next iteration Update to gradient clipping threshold ,Right now ; Step 7.4: Obtain the optimized gradient value after the gradient clipping operation based on steps 7.1 and 7.
2. .
5. The privacy protection method for deep learning models based on differential privacy according to claim 1, characterized in that, In step 8, noise is added to the trimmed optimized gradient value, which is represented as follows: in, This indicates that the probability density function follows a mean of 0 and a standard deviation of . Gaussian noise with a Gaussian distribution For noise parameters, The gradient clipping threshold, It is an identity matrix whose dimension is related to the number of samples and the number of gradients.
6. The privacy protection method for deep learning models based on differential privacy according to claim 1, characterized in that, Step 10 is implemented in the following steps: Step 10.1, let The current number of training iterations With the predetermined number of training iterations Compare; Step 10.2, if If so, proceed to step 3 for the next iteration; Step 10.3, if Then the final model optimization parameters will be output. and overall privacy loss This yields a deep learning model trained using a differential privacy protection method.