A Federal Learning Privacy Evaluation Method in a Cross-Domain Heterogeneous Scenario

Abstract

The present invention relates to the technical field of privacy evaluation of federated learning, and discloses a method for evaluating the privacy of federated learning in a cross-domain heterogeneous scenario, including: determining the tasks and data sets of federated learning in a cross-domain heterogeneous scenario, and determining potential attack risks according to algorithms; screening the relevance of data sets according to tasks; encrypting the data sent by the client to the federated learning central server by using a set privacy enhancement technology; calculating the privacy metrics of the client according to a representative attack model; determining the privacy leakage risk of the data uploaded by the client when participating in federated learning according to the set threshold. The method for evaluating the privacy of federated learning in a cross-domain heterogeneous scenario provided by the present invention judges the security level of privacy by simulating attacks on the client and calculating the attack results, has no requirements for the federated learning model and data, and is applicable to most actual situations.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning privacy evaluation, and particularly relates to a method for evaluating the privacy of federated learning in a cross-domain heterogeneous scenario. Background Art

[0002] Most of the existing federated learning privacy evaluation metrics are achieved by calculating the mutual information between the client's private original data and the model gradient. This method is not applicable to federated learning in a cross-domain heterogeneous scenario. First, non-IID data under heterogeneity cannot be dimensionally reduced in a statistical model, and mutual information calculation in multiple dimensions cannot be achieved. At the same time, the performance of the statistical model will directly affect the accuracy of mutual information calculation. For clients with different learning tasks, different datasets, and different computing powers in a cross-domain scenario, it is obviously unrealistic to train multiple statistical models for evaluation during the evaluation process. Finally, due to the differences in the local tasks of the clients and the corresponding datasets, it is impossible to evaluate the privacy of all datasets with only one metric. The complexity of the dataset will be directly related to the difficulty of attack. Summary of the Invention

[0003] The present invention provides a method for evaluating the privacy of federated learning in a cross-domain heterogeneous scenario. By simulating an attack on the client and calculating the attack result to judge the security level of privacy, there are no requirements for the federated learning model and data, and it is applicable to most actual situations.

[0004] The present invention provides a method for evaluating the privacy of federated learning in a cross-domain heterogeneous scenario, including:

[0005] Determine the tasks and datasets of federated learning in a cross-domain heterogeneous scenario, and determine the potential attack risks according to the algorithm;

[0006] Screen the datasets according to the correlation degree of the tasks;

[0007] Encrypt the data sent by the client to the federated learning central server using the set privacy enhancement technology;

[0008] Calculate the privacy metrics of the client according to the representative attack model;

[0009] Determine the privacy leakage risk of the data uploaded by the client when participating in federated learning according to the set threshold.

[0010] Further, the step of determining the tasks and datasets of federated learning in a cross-domain heterogeneous scenario, removing local data redundancy, and determining the potential attack risks according to the algorithm includes:

[0011] In a cross - domain heterogeneous scenario, the client performs local data pre - training based on a set dataset and global gradients and uploads it to the client aggregation, and continuously iterates to train the local model; among them, the set dataset includes the handwritten digit database MNIST, the small - scale color database CIFAR10 for identifying general objects, and the face database LFW.

[0012] Induce the class labels of each sample into a matrix to achieve the partitioning of the dataset, and for each partitioned client data, use the first set amount of data as training samples and the second set amount of data as test samples; where N is the number of clients participating in federated learning, K represents the number of classes of all sample labels, the row vectors in the matrix represent the proportion of each class partitioned to different clients, and the row vectors are sampled from the Dirichlet distribution; the probability density function of the Dirichlet distribution is:

[0013]

[0014]

[0015] α=(α1,α2,...,α K ),α i >0

[0016] where x is a random vector that meets the requirements, and α is the distribution parameter. The larger it is, the closer the distribution is to the uniform distribution, and the smaller it is, the more concentrated the distribution is.

[0017] Adopt the FedSGD algorithm, and the client and the central server perform iterative communication to optimize the global task model for task k under each corresponding dataset In the t - th iteration process, client i downloads the current global model parameters from the central server and calculates the parameter gradient where B is the batch size, is the amount of data screened by batch sampling and attention mechanism in the k - th dataset of the client, and sends the calculated parameter gradient to the central server;

[0018] It is determined that malicious eavesdroppers estimate and restore the original data of the client by obtaining the gradient parameters sent by the target client and the federated learning model, and their attack behaviors include membership inference attack, attribute inference attack, and data reconstruction attack.

[0019] Furthermore, the step of screening the dataset according to the task for correlation includes:

[0020] Sample the dataset of each client with a batch size B, so that the data for the i - th client to train is

[0021] Introduce the query vector q, and through the scoring function calculate the correlation between each input vector and the query vector. Given a query vector q related to the task, given q and X B the probability α of selecting the i-th input vector i :

[0022]

[0023] where α i is the degree of attention of the i-th input data, and the information is integrated and summarized as X B =[x1α1, x2α1..., x B α B =[x1, x2,..., x B .

[0024] Furthermore, the step of calculating the privacy metric of the client according to the representative attack model includes:

[0025] Through calculate the accuracy rate of each client's model, that is, the proportion of correctly classified samples as the model accuracy rate index; where the denominator is the amount of test sample data of client k, and the numerator represents whether the test data x i,test is consistent with the original label after passing through the model classification. If it is consistent, it is counted by the count function;

[0026] According to the existing DLG model, randomly generate a virtual data x0 and label y0 of the same size as the real data, input the virtual samples and labels into the existing client model to obtain the virtual model gradient G', and continuously iterate and calculate to narrow the distance between the true and false gradients, and continuously update the original data of the client until it is completely approximated. Assume that the estimated original data is

[0027] Calculate the cross-domain weights of the datasets corresponding to different tasks;

[0028] Calculate the similarity between the original data obtained by the attack and the original samples to determine the privacy metric of the client.

[0029] Furthermore, the step of calculating the cross-domain weights of the datasets corresponding to different tasks includes:

[0030] In the DLG attack under different datasets of the client model, when the change value of the estimated gradient in the new iteration round is less than δ, it is determined that DLG has converged: |G' t+1 -G t'|| < δ; where t is the number of iterations for a successful DLG attack in a specific dataset and is also the computational cost that an eavesdropper needs to pay when attacking such a dataset;

[0031] The proportional value of the number of iterations under each dataset is used as the cross - domain weight, indicating the difficulty of the attack caused by the differences in the client's own datasets.

[0032] Furthermore, the step of calculating the similarity between the original data obtained by the computational attack and the original samples to determine the privacy metric of the client includes:

[0033] Assume that in the i - th dataset, the estimated data is The sample label is Then the root - mean - square error RMSE is used to measure the similarity between the data in the specific dataset and the original data. The formula is:

[0034] For the estimated values of the sample labels, a counting function is used to determine their consistency. The formula is: When the predicted label and the original label are consistent, the coun function is 1, otherwise it is 0;

[0035] According to the comprehensive metrics of RMSE, LC, and P, determine the total leakage of the federated learning data for the task corresponding to the k - th dataset. The formula is:

[0036] Furthermore, the step of determining the privacy leakage risk of the data uploaded by the client when participating in federated learning according to the set threshold includes:

[0037] Perform accuracy tests on the encrypted models under different client devices. When the classification accuracy of the test set is lower than the threshold, the model is not allowed to further determine its privacy;

[0038] Set the threshold M for different datasets k 0 , if the calculated root - mean - square error M k is less than the threshold, a danger warning is issued. If the calculated root - mean - square error M k is greater than or equal to the threshold, it indicates safety.

[0039] The present invention also provides a federated learning privacy evaluation device in a cross - domain heterogeneous scenario, including:

[0040] A determination module, configured to determine the tasks and datasets in the cross - domain heterogeneous scenario of federated learning and determine the potential attack risks according to the algorithm;

[0041] A screening module, configured to perform relevance screening on the datasets according to the tasks;

[0042] An encryption module, configured to encrypt the data sent by the client to the federated learning central server by using a set privacy enhancement technology;

[0043] A calculation module, configured to calculate the privacy metric of the client according to a representative attack model;

[0044] A determination module, configured to determine the privacy leakage risk of the data uploaded by the client when participating in federated learning according to a set threshold.

[0045] The present invention further provides a computer device, including a memory and a processor, where the memory stores a computer program, and when the processor executes the computer program, the steps of the above method are implemented.

[0046] The present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0047] The beneficial effects of the present invention are as follows:

[0048] The present invention first determines the tasks and data sets in the cross-domain heterogeneous scenario of federated learning, removes local data redundancy and determines potential attack risks according to an algorithm; secondly, the client launches a simulated attack on itself through a representative attack model DLG, and obtains an estimated value of the original data by reconstructing its own original data; then calculates the error distance between the estimated data and the original data and the cross-domain weight value of the data set under different tasks to calculate the privacy metric of the client itself; finally, compares whether the privacy metric is greater than the threshold under the corresponding attack model, and if it is greater than the threshold, it prompts security; there are no requirements for the federated learning model and data, and it is applicable to most actual situations. The present invention also uses the number of iterative convergences of the attack model under each data set as the cross-domain weight to represent the difficulty of being attacked by the data set under each task. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a schematic flowchart of the method according to an embodiment of the present invention.

[0050] Figure 2 It is a schematic architecture diagram of the FedSGD algorithm under the kth data set in the present invention.

[0051] Figure 3 It is a schematic structural diagram of the device according to an embodiment of the present invention.

[0052] Figure 4 It is a schematic internal structure diagram of the computer device according to an embodiment of the present invention.

[0053] The realization, functional features, and advantages of the present invention will be further described in conjunction with embodiments with reference to the accompanying drawings. Specific Embodiments

[0054] It should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention.

[0055] As Figure 1 shown, the present invention provides a method for evaluating the privacy of federated learning in a cross-domain heterogeneous scenario, including:

[0056] S1. Determine the tasks and data sets of federated learning in a cross-domain heterogeneous scenario, and determine the potential attack risks according to the algorithm;

[0057] Step S1 specifically includes:

[0058] S11. In a cross-domain heterogeneous scenario, the client performs local data pre-training based on the set data set and global gradient and uploads it to the client aggregation, and continuously iterates to achieve the training of the local model; wherein, the set data set includes the handwritten digit database MNIST, the small color database CIFAR10 for identifying general objects, and the face database LFW;

[0059] As described in the above step S11, determine the federated learning data set and tasks. Under the requirements of a cross-domain heterogeneous scenario, the client has different learning tasks corresponding to different data sets. Suppose various different image data sets are adopted, such as the handwritten digit database MNIST, the small color database CIFAR10 for identifying general objects, and the face database LFW, etc., a total of M types. The task of federated learning is to enable the client to perform local data pre-training based on the above data set and global gradient and upload it to the client aggregation, and continuously iterate this process to achieve the training of the local model and achieve high-quality completion of the local intelligent recognition task.

[0060] S12. Partition of the data set. In order to realize the heterogeneous characteristics of the data and evenly partition the samples with different labels to each client to achieve a comprehensive non-independent and identically distributed (Non-IID) scenario, the class labels of each sample are summarized in a matrix to realize the partition of the data set, and in each client data after partitioning, the first set amount (70%) of the data is used as training samples, and the second set amount (30%) of the data is used as test samples; wherein, N is the number of clients participating in federated learning, K represents the number of categories of all sample labels, the row vector in the matrix represents the proportion of each category partitioned to different clients, and the row vector sampling comes from the Dirichlet distribution; the probability density function of the Dirichlet distribution is:

[0061]

[0062]

[0063] α = (α1, α2,..., α K ), α i > 0

[0064] where x is a random vector that meets the requirements, and α is a distribution parameter. The larger it is, the closer the distribution is to a uniform distribution, and the smaller it is, the more concentrated the distribution is.

[0065] S13. Determine the federated learning algorithm and potential inference attacks. The FedSGD algorithm is adopted. As Figure 2 shown, the client and the central server perform iterative communication to optimize the global task model for task k under each corresponding dataset During the t-th iteration, client i downloads the current global model parameters from the central server and calculates the parameter gradients where B is the batch size, is the amount of data screened by the client through batch sampling and attention mechanism in the k-th dataset, and the calculated parameter gradients are sent to the central server;

[0066] S14. At this time, it is determined that the malicious eavesdropper estimates and restores the original data of the client by obtaining the gradient parameters sent by the target client and the federated learning model. Its attack behaviors include membership inference attack, attribute inference attack, and data reconstruction attack; by launching membership inference attack, attribute inference attack or data reconstruction attack, etc., the privacy of the target client is leaked, threatening the security of the client.

[0067] S2. Screen the correlation degree of the dataset according to the task;

[0068] Step S2 specifically includes:

[0069] S21. Sample the dataset of each client with a batch size B, so that the data for the i-th client to train is

[0070] S22. Not all data points in the dataset can contribute to the classification task. In the process of preventing and evaluating privacy leakage, this patent inserts an attention mechanism into the neural network to enable the neural network to have the ability to focus attention on a part of the input (or features).

[0071] First, a task-related representation needs to be introduced, called the query vector q. Through the scoring function calculate the correlation between each input vector and the query vector. Given a task-related query vector q, given q and XB Under the following conditions, the probability α of selecting the i-th input vector i :

[0072]

[0073] where α i is the degree of attention received by the i-th input data, and the information is integrated and summarized as X B =[x1α1, x2α1..., x B α B =[x1, x2,..., x B .

[0074] S3. Encrypt the data sent by the client to the federated learning central server using the set privacy enhancement technology.

[0075] As described in step S3 above, the currently existing privacy enhancement technologies include differential privacy, synthetic data, Secure Multiparty Computation (SMPC), and homomorphic encryption, etc. Suppose the homomorphic encryption technology is used to encrypt the gradient information of the model. This method requires high computational and communication costs. For clients with different computing powers, this encryption method will result in different model performances and abilities to resist inference attacks.

[0076] S4. Calculate the privacy metric of the client according to the representative attack model;

[0077] Step S4 specifically includes:

[0078] S41. To ensure the basic performance of the model, so as to avoid the situation where the model has high data privacy but is not applicable to the actual federated learning task. At the same time, to prevent some clients from sacrificing the accuracy of their models in exchange for privacy, the present invention proposes to incorporate the federated learning accuracy into the measurement of model privacy.

[0079] Due to the different datasets, tasks, and computing powers of clients in the cross-domain heterogeneous scenario, especially under the limitation of computing power, clients will choose some encryption methods such as partial homomorphic, approximate homomorphic, finite series fully homomorphic, and fully homomorphic. The accuracies of clients under these encryption methods are different. By calculating the accuracy rate of the model of each client, that is, the proportion of correctly classified samples as the model accuracy rate index; where the denominator is the amount of test sample data of client k, and the numerator represents whether the test data x i,test is consistent with the original label after being classified by the model. If it is consistent, the count function is used for counting;

[0080] S42. Calculate the privacy metric according to the potentially possible inference attack model. Try to use a representative attack model to attack the above-mentioned federated learning process and try to improve the gradient stealing to restore the original data of each client.

[0081] Currently, the attack models for gradient data leakage can be roughly divided into two types. One is partial leakage, and the other is complete leakage. The characteristics of various attack models are listed in the following table:

[0082]

[0083] In the existing attack models, the DGL model has the ability to infer the private data of the client from the exchanged gradient data, posing a great privacy threat. According to the existing DLG model, before sending the gradient to the central server, the client uses the attack model to conduct a simulated attack: randomly generate a virtual data x0 and label y0 of the same size as the real data, input the virtual sample and label into the existing client model to obtain the virtual model gradient G', and continuously iterate and calculate to narrow the distance between the true and false gradients, and continuously update the original data of the client until it is completely approximated. Assume that the estimated original data is

[0084] S43. Calculate the cross-domain weights for the datasets corresponding to different tasks;

[0085] Step S43 specifically includes:

[0086] S431. In the cross-domain scenario, the local tasks of the client are different, and the corresponding datasets are also different. The DLG attack model also performs differently in different

[0087] data. Specifically, the more complex the dataset, the more times the model needs to iterate for the attack, the more difficult it is for the estimated gradient and the original gradient to converge, and the more computing costs are required.

[0088] In the DLG attack under different datasets of the client model, when the change value of the estimated gradient in the new iteration round is less than δ, it is determined that the DLG reaches convergence: |G t ' +1 -G t '|| < δ; where t is the number of iterations for the successful DLG attack in a specific dataset and is also the computing cost that the eavesdropper needs to pay when attacking such a dataset;

[0089] S432. Take the proportional value of the number of iterations under each dataset as the cross-domain weight, indicating the difficulty of the attack caused by the different datasets of the client.

[0090] S44. Calculate the similarity between the original data obtained by the attack and the original samples to determine the privacy metric of the client.

[0091] Step S44 specifically includes:

[0092] S441. Assume that in the i-th dataset, the estimated data is The sample label is Then, the root mean square error (RMSE) is used to measure the similarity between the data in the specific dataset and the original data. The formula is:

[0093] S442. For the estimated values of the sample labels, a counting function is used to determine their consistency. The formula is: When the predicted label is the same as the original label, the coun function is 1; otherwise, it is 0.

[0094] S443. Based on the comprehensive metrics of RMSE, LC, and P, determine the overall leakage of the federated learning data for the task corresponding to the k-th dataset. The formula is:

[0095] S5. Determine the privacy leakage risk of the data uploaded by the client when participating in federated learning according to the set threshold.

[0096] Step S5 specifically includes:

[0097] S51. Conduct an accuracy test on the encrypted models under different client devices. When the classification accuracy of the test set is lower than the threshold, the model is not allowed to further determine its privacy.

[0098] As described in step S51 above, first, conduct an accuracy test on the encrypted models under different client devices. When the classification accuracy of the test set is lower than the threshold, the model is not allowed to further determine its privacy because its encryption scheme affects the performance of the model, and even if the privacy performance meets the conditions, it cannot be applied in real scenarios.

[0099] S52. Set the thresholds for different datasets That is, under this degree of information leakage, the client data will not be threatened by security. If the calculated root mean square error M k is less than the threshold, a danger warning is issued. If the calculated root mean square error M k is greater than or equal to the threshold, it indicates security.

[0100] The current privacy evaluation of federated learning does not take into account the evaluation difficulties brought about by different client datasets, different tasks, and even different computing powers in cross-domain heterogeneous scenarios. The present invention first determines the tasks and datasets of federated learning in cross-domain heterogeneous scenarios, removes local data redundancy, and determines potential attack risks according to algorithms. Secondly, the client initiates a simulated attack on itself through a representative attack model DLG, and obtains an estimated value of the original data by reconstructing its own original data. Then, the error distance between the estimated data and the original data and the cross-domain weight values of the datasets under different tasks are calculated to calculate the privacy index of the client itself. Finally, it is compared whether the privacy index is greater than the threshold under the corresponding attack model. If it is greater than the threshold, security is prompted. According to this privacy evaluation method, the client determines whether to pay additional computing and communication costs to encrypt or improve the encryption of its own data.

[0101] As Figure 3 shown, the present invention also provides a federated learning privacy evaluation device in a cross-domain heterogeneous scenario, including:

[0102] A determination module 1, configured to determine the tasks and datasets of federated learning in a cross-domain heterogeneous scenario, and determine potential attack risks according to algorithms;

[0103] A screening module 2, configured to perform correlation screening on the datasets according to tasks;

[0104] An encryption module 3, configured to encrypt the data sent by the client to the federated learning central server by using a set privacy enhancement technology;

[0105] A calculation module 4, configured to calculate the privacy index of the client according to a representative attack model;

[0106] A determination module 5, configured to determine the privacy leakage risk of the data uploaded by the client when participating in federated learning according to a set threshold.

[0107] In an embodiment, the determination module 1 includes:

[0108] A pre-training unit, configured to perform local data pre-training on the basis of a set dataset and global gradients by the client in a cross-domain heterogeneous scenario and upload it to the client aggregation, and continuously iterate to implement the training of the local model; wherein, the set dataset includes the handwritten digit database MNIST, the small color database CIFAR10 for identifying general objects, and the face database LFW;

[0109] A data partitioning unit, configured to summarize the class labels of each sample in a matrix It can be used to divide the dataset, and for each partitioned client data, the first set amount of data is used as training samples, and the second set amount of data is used as test samples; where N is the number of clients participating in federated learning, K represents the number of categories of all sample labels, the row vectors in the matrix represent the proportions of each category assigned to different clients, and the row vectors are sampled from the Dirichlet distribution; the probability density function of the Dirichlet distribution is:

[0110]

[0111]

[0112] α = (α1, α2,..., α K ), α i > 0

[0113] where x is a random vector that meets the requirements, and α is the distribution parameter. The larger it is, the closer the distribution is to the uniform distribution, and the smaller it is, the more concentrated the distribution is.

[0114] The first calculation unit is used to adopt the FedSGD algorithm for the client and the central server to perform iterative communication to optimize the global task model of task k under each corresponding dataset In the t-th iteration process, client i downloads the current global model parameters from the central server and calculates the parameter gradient where B is the batch size, is the amount of data screened by batch sampling and attention mechanism in the k-th dataset of the client, and sends the calculated parameter gradient to the central server;

[0115] The determination unit is used to determine that the malicious eavesdropper estimates and restores the client's original data by obtaining the gradient parameters sent by the target client and the federated learning model, and its attack behaviors include membership inference attack, attribute inference attack, and data reconstruction attack.

[0116] In one embodiment, the screening module 2 includes:

[0117] The sampling unit is used to sample each client's dataset with a batch size B, so that the data for the i-th client to train is

[0118] The introduction unit is used to introduce the query vector q, and calculate the correlation between each input vector and the query vector through the scoring function Given a query vector q related to the task, and given q and X B under which the probability α of selecting the i-th input vector is i :

[0119]

[0120] Among them, α i is the degree of attention received by the i-th input data, and the information is integrated and summarized as X B = [x1α1, x2α1..., x B α B = [x1, x2,..., x B .

[0121] In one embodiment, the calculation module 4 includes:

[0122] A second calculation unit for calculating the accuracy rate of the model of each client, that is, the proportion of correctly classified samples as the model accuracy rate index; among them, the denominator is the amount of test sample data of client k, and the numerator represents whether the test data x i,test is consistent with the original label after passing through the model classification. If it is consistent, it is counted by the count function;

[0123] A generation unit for randomly generating a virtual data x0 and a label y0 of the same size as the real data according to the existing DLG model, inputting the virtual sample and the label into the existing client model to obtain a virtual model gradient G', and continuously iterating and calculating to narrow the distance between the true and false gradients, and continuously updating the original data of the client until it is completely approximated. Assuming that the estimated original data is

[0124] A third calculation unit for calculating the cross-domain weights of the data sets corresponding to different tasks;

[0125] A fourth calculation unit for calculating the similarity between the original data obtained by the attack and the original sample to determine the privacy index of the client.

[0126] In one embodiment, the third calculation unit includes:

[0127] A judgment subunit for determining that DLG reaches convergence when the change value of the estimated gradient in the new iteration round is less than δ in the DLG attack under different data sets of the client model: |G' t+1 -G t '|| < δ; where t is the number of iterations when the DLG attack is successful in a specific data set and is also the computational cost that the eavesdropper needs to pay when attacking such a data set;

[0128] A ratio subunit for using the ratio value of the number of iterations under each data set as the cross-domain weight, indicating the difficulty of the attack caused by the difference in the client's own data set.

[0129] In one embodiment, a fourth computing unit includes:

[0130] A speculation subunit for assuming that in the i-th dataset, the estimated data obtained by speculation is The sample label is Then, the root mean square error (RMSE) is used to measure the similarity between the data in the specific dataset obtained by speculation and the original data. The formula is:

[0131] A first determination subunit for using a counting function to determine the consistency of the estimated values of the sample labels. The formula is: When the predicted label is the same as the original label, the coun function is 1; otherwise, it is 0.

[0132] A second determination subunit for determining the overall leakage of the federated learning data corresponding to the k-th dataset according to the comprehensive indicators of RMSE, LC, and P. The formula is:

[0133] In one embodiment, a determination module 5 includes:

[0134] A testing unit for testing the accuracy of the encrypted model under different client devices. When the classification accuracy of the test set is lower than the threshold, the model is not allowed to further determine its privacy.

[0135] A setting unit for setting the threshold under different datasets , if the calculated root mean square error M k is less than the threshold, a danger warning is issued; if the calculated root mean square error M k is greater than or equal to the threshold, safety is prompted.

[0136] Each of the above modules, units, and subunits is used to respectively execute the steps in the federated learning privacy evaluation method in the above cross-domain heterogeneous scenario. The specific implementation manner refers to the method embodiments described above and will not be elaborated here.

[0137] As Figure 4 shown, the present invention also provides a computer device, which may be a server, and its internal structure may be as Figure 4As shown in the figure. The computer device includes a processor, a memory, a network interface, and a database connected via a system bus. Among them, the processor of the computer design is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store all the data required for the process of the federated learning privacy evaluation method in a cross-domain heterogeneous scenario. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it realizes the federated learning privacy evaluation method in a cross-domain heterogeneous scenario.

[0138] Those skilled in the art can understand that Figure 4 the structure shown in the figure is only a block diagram of some structures related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied.

[0139] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it realizes any one of the above-mentioned federated learning privacy evaluation methods in a cross-domain heterogeneous scenario.

[0140] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium provided in the present application and used in the embodiments can include non-volatile and / or volatile memories. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or an external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0141] It should be noted that, in this document, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article or method comprising a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, apparatus, article or method. Without further limitation, an element defined by the phrase "comprising an..." does not exclude the presence of additional identical elements in the process, apparatus, article or method comprising such element.

[0142] The above are only the preferred embodiments of the present invention, and do not limit the patent scope of the present invention accordingly. Any equivalent structure or equivalent process transformation made by using the content of the specification and drawings of the present invention, or directly or indirectly applied in other related technical fields, shall similarly be included in the patent protection scope of the present invention.

Claims

1. A method for evaluating the privacy of federated learning in a cross - domain heterogeneous scenario, characterized in that, Including: Determine the tasks and datasets in the cross - domain heterogeneous scenario for federated learning, and determine potential attack risks according to the algorithm; specifically including: In the cross - domain heterogeneous scenario, the client performs local data pre - training based on the set dataset and global gradient and uploads it to the client aggregation, and realizes the training of the local model through continuous iteration; wherein, the set dataset includes the handwritten digit database MNIST, the small - scale color database CIFAR10 for identifying general objects, and the face database LFW; Summarize the class labels of each sample in a matrix to achieve the partitioning of the dataset, and in each partitioned client data, use a first set amount of data as training samples and a second set amount of data as test samples; where N is the number of clients participating in federated learning, K represents the number of classes of all sample labels, the row vectors in the matrix represent the proportion of each class partitioned to different clients, and the row vectors are sampled from the Dirichlet distribution; The probability density function of the Dirichlet distribution is: α＝(α1,α2,...,α K ),α i ＞0 Wherein, x is a random vector that meets the requirements, and α is the distribution parameter. The larger it is, the closer the distribution is to the uniform distribution, and the smaller it is, the more concentrated the distribution is; Using the FedSGD algorithm, the client and the central server perform iterative communication to optimize the global task model for task k under each corresponding dataset During the t-th iteration, client i downloads the current global model parameters from the central server and calculates the parameter gradients where B is the batch size, is the amount of data sampled in batches and screened by the attention mechanism in the k-th dataset of the client, and sends the calculated parameter gradients to the central server; Determine that the malicious eavesdropper estimates and restores the original data of the client by obtaining the gradient parameters sent by the target client and the federated learning model, and its attack behaviors include membership inference attack, attribute inference attack, and data reconstruction attack; Screen the relevance of the dataset according to the task; specifically including: Sample the dataset of each client with a batch size B such that the data for the i-th client to train is Introduce the query vector q, and through the scoring function calculate the correlation between each input vector and the query vector. Given a query vector q related to the task, given q and X B the probability α of selecting the i-th input vector i is Among them, α i is the degree of attention received by the i-th input data, and the information is integrated and summarized as X B =[x1α1, x2α1..., x B α B =[x1, x2,..., x B ; Encrypt the data sent by the client to the federated learning central server using the set privacy - enhancing technology; Calculate the privacy metrics of the client according to the representative attack model; specifically including: By Calculating the accuracy rate of the model for each client, that is, the proportion of correctly classified samples is used as the model accuracy rate index; where the denominator is the amount of test sample data of client k, and the numerator represents the test data x i,test Whether it is consistent with the original label after model classification. If it is consistent, the count function is used for counting; According to the existing DLG model, randomly generate a piece of virtual data x0 and label y0 of the same size as the real data. Input the virtual samples and labels into the existing client model to obtain the virtual model gradient G'. By continuously iterating and calculating, narrow the distance between the true and false gradients, and continuously update the original data of the client until it is completely approximated. Assume that the estimated original data is Calculate the cross - domain weights of the datasets corresponding to different tasks; Calculate the similarity between the original data obtained by the attack and the original samples to determine the privacy metrics of the client; Determine the privacy leakage risk of the data uploaded by the client when participating in federated learning according to the set threshold.

2. The method for evaluating the privacy of federated learning in a cross-domain heterogeneous scenario according to claim 1, characterized in that, The step of calculating the cross - domain weights of the datasets corresponding to different tasks includes: In the DLG attack under different datasets of the client model, the DLG is determined to converge when the change value of the estimated gradient in the new iteration round is less than δ: |G t ' +1 -G t '|| < δ; where t is the number of iterations when the DLG attack is successful in the preset dataset and is also the computational cost that the eavesdropper needs to pay when attacking such a dataset; The proportional value of the number of iterations under each dataset is used as a cross-domain weight, indicating the difficulty of attacks caused by differences in the client's own datasets.

3. The federated learning privacy evaluation method in a cross-domain heterogeneous scenario according to claim 2, characterized in that, The step of calculating the similarity between the original data obtained by the attack and the original samples to determine the privacy metrics of the client includes: Suppose that in the $i$-th dataset, the estimated data inferred is The sample label is Then, the root mean square error (RMSE) is used to measure the similarity between the data in a specific dataset and the original data, and its formula is: The estimated values of the sample labels are judged for their consistency using a counting function, and the formula is as follows: When the predicted label is consistent with the original label, the coun function is 1, otherwise it is 0; Determine the overall leakage of the federated learning data for the task corresponding to the k-th dataset according to the comprehensive indicators of RMSE, LC, and P. The formula is as follows:

4. The federated learning privacy evaluation method in a cross-domain heterogeneous scenario according to claim 3, characterized in that The step of determining the privacy leakage risk of the data uploaded by the client when participating in federated learning according to the set threshold includes: Test the accuracy of the encrypted model under different client devices. When the classification accuracy of the test set is lower than the threshold, the privacy of the model is not allowed to be further determined; Set the threshold for different data sets If the calculated root mean square error M k is less than the threshold, a danger warning is issued. If the calculated root mean square error M k is greater than or equal to the threshold, safety is prompted.

5. A federated learning privacy evaluation device in a cross - domain heterogeneous scenario, characterized in that, Including: A determination module, used to determine the tasks and datasets in the cross - domain heterogeneous scenario for federated learning, and determine potential attack risks according to the algorithm; specifically including: A pre - training unit, used to perform local data pre - training on the client based on the set dataset and global gradient in the cross - domain heterogeneous scenario and upload it to the client aggregation, and realize the training of the local model through continuous iteration; wherein, the set dataset includes the handwritten digit database MNIST, the small - scale color database CIFAR10 for identifying general objects, and the face database LFW; A data partitioning unit for summarizing the class labels of each sample in a matrix to achieve the partitioning of the dataset, and in each partitioned client data, using a first set amount of data as training samples and a second set amount of data as test samples; where N is the number of clients participating in federated learning, K represents the number of classes of all sample labels, the row vectors in the matrix represent the proportion of each class partitioned to different clients, and the row vectors are sampled from the Dirichlet distribution; the probability density function of the Dirichlet distribution is: α＝(α1,α2,...,α K ),α i ＞0 Wherein, x is a random vector that meets the requirements, and α is the distribution parameter. The larger it is, the closer the distribution is to the uniform distribution, and the smaller it is, the more concentrated the distribution is; The first computing unit is used to optimize the global task model of task k under each corresponding dataset through iterative communication between the client and the central server using the FedSGD algorithm In the t-th iteration process, client i downloads the current global model parameters from the central server and calculates the parameter gradient where B is the batch size, is the amount of data screened by batch sampling and the attention mechanism in the k-th dataset of the client, and sends the calculated parameter gradient to the central server; A determination unit, used to determine that the malicious eavesdropper estimates and restores the original data of the client by obtaining the gradient parameters sent by the target client and the federated learning model, and its attack behaviors include membership inference attack, attribute inference attack, and data reconstruction attack; A screening module, used to screen the relevance of the dataset according to the task; specifically including: A sampling unit for sampling the dataset of each client with a batch size B, such that the data for training by the i-th client is An introduction unit for introducing a query vector q, through a scoring function to calculate the correlation between each input vector and the query vector. Given a query vector q related to a task, given q and X B the probability α of selecting the i-th input vector i is Among them, α i is the degree of attention received by the i-th input data, and the information is integrated and summarized as X B =[x1α1, x2α1..., x B α B =[x1, x2,..., x B ; An encryption module, configured to encrypt the data sent by the client to the federated learning central server by using a set privacy enhancement technology; A calculation module, configured to calculate the privacy metric of the client according to a representative attack model; specifically including: A second computing unit, configured to calculate the accuracy rate of the model for each client, that is, the proportion of correctly classified samples as the model accuracy rate index; where the denominator is the amount of test sample data of client k, and the numerator represents whether the test data x i,test is consistent with the original label after being classified by the model, and if it is consistent, the count function is used for counting; A generation unit is used to randomly generate a piece of virtual data x0 and a label y0 of the same size as the real data according to the existing DLG model, input the virtual samples and labels into the existing client model to obtain the virtual model gradient G', continuously iterate and calculate to narrow the distance between the true and false gradients, and continuously update the original data of the client until it is completely approximated. Assume that the estimated original data is A third calculation unit, configured to calculate the cross-domain weights of the datasets corresponding to different tasks; A fourth calculation unit, configured to calculate the similarity between the original data obtained by the attack and the original samples to determine the privacy metric of the client; A determination module, configured to determine the privacy leakage risk of the data uploaded by the client when participating in federated learning according to a set threshold.

6. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images