Federated Learning Training Method, Device, System and Equipment Based on Differential Privacy

Abstract

The present invention provides a federated learning training method, apparatus, system and device based on differential privacy, including: a client trains a local model based on model parameters, preset hyperparameters and local data sent by a server to obtain a first gradient value; obtains index information of some of the first gradient values, and adaptively clips some of the first gradient values to obtain a second gradient value; performs perturbation and noise addition processing on the second gradient value, encrypts the noise-added second gradient value and the index information to obtain a ciphertext; sends the ciphertext to a shuffler, and the shuffler sends it to the server after shuffling. The server decrypts the ciphertext and performs median filling to aggregate and restore the first gradient value, and updates the model parameters of the global model. It realizes the anonymization of client messages, effectively prevents gradient attacks, and generates a privacy amplification effect, reduces the local privacy budget and the added noise, enhances the utility of data, enhances the accuracy of the model, and reduces the communication volume of federated learning.

Description

Technical Field

[0001] The present invention relates to the technical field of artificial intelligence, and in particular, to a federated learning training method, device, system, and equipment based on differential privacy. Background Art

[0002] Machine Learning (ML) and Deep Learning (DL) are currently very popular artificial intelligence algorithm technologies. The model training related to these two technologies often requires a large amount of data support. These data usually come from many large institutions, such as banks, hospitals, or companies. However, there are usually certain barriers to data exchange between these institutions due to policies, privacy protocols, or data formats. Therefore, the Federated Learning (FL) technology that breaks data islands has emerged. Federated learning uses each participating client to train a model locally and aggregates the local gradient updates uploaded to the server to train a global model without sharing the privacy or sensitive data of each client.

[0003] Although the training process of federated learning ensures that the data participating in the training itself will not be leaked from the client, some studies have shown that the method of using only the federated learning architecture for privacy protection is no longer secure because the model gradient information itself can also leak the privacy data of the users participating in the training. Therefore, there is an urgent need to propose a federated learning scheme with privacy protection capabilities.

[0004] Differential Privacy (DP) is a powerful privacy model developed in the past 20 years. Compared with early privacy models, it can provide a better level of privacy guarantee. Among them, Local Differential Privacy (LDP) is to complete the encoding and perturbation of local data by each client, and then send it to the server, and the server completes the learning of the perturbed data, so as to achieve a higher level of fine-grained differential privacy guarantee at the record level. Therefore, even if the server is damaged, due to the existence of data perturbation, the privacy of users can still be guaranteed.

[0005] Although there have been many studies on local differential privacy technology, currently, local differential privacy still faces two major challenges: the utility of data and the security of the protocol. Since the method of adding noise in differential privacy will inevitably cause the deviation of data from the true value, and whether the federated learning training gradient is accurate directly determines the accuracy of the overall model. Summary of the Invention

[0006] The present invention provides a differential privacy-based federated learning training method, device, system, and equipment, which are used to solve the defect that the data deviates from the true value in the existing local differential privacy technology, resulting in a low model accuracy, and to improve the model accuracy while ensuring data privacy protection.

[0007] The present invention provides a differential privacy-based federated learning training method, which is applied to a client and includes:

[0008] Training a local model based on model parameters, preset hyperparameters, and local data to obtain a first gradient value, wherein the model parameters and the preset hyperparameters are sent by a server;

[0009] Obtaining index information of some of the first gradient values, and adaptively clipping some of the first gradient values to obtain a second gradient value;

[0010] Performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and the index information to obtain a ciphertext;

[0011] Sending the ciphertext to a shuffler, wherein the ciphertext is used to be shuffled by the shuffler for each client's ciphertext and then sent to the server, and the server decrypts and performs median filling aggregation processing on the shuffled ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value.

[0012] According to the differential privacy-based federated learning training method provided by the present invention, the preset hyperparameters include a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient value by using a Top-k mechanism, select some of the first gradient values, and obtain the index information of some of the first gradient values.

[0013] According to the differential privacy-based federated learning training method provided by the present invention, the step of performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and the index information to obtain a ciphertext includes:

[0014] Converting the second gradient value by using a conversion function to obtain a third gradient value within a preset conversion range;

[0015] Performing perturbation and noise addition processing on the third gradient value, and encrypting the noise-added third gradient value and the index information to obtain the ciphertext.

[0016] The present invention provides another differential privacy-based federated learning training method, which is applied to a shuffler and includes:

[0017] Receive the ciphertext sent by the client and perform a shuffling operation;

[0018] Send the ciphertext after the shuffling operation to the server so that the server can update the global model parameters;

[0019] Among them, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and index information; the second gradient value is adaptively cropped by the client from part of the first gradient values; the first gradient values are obtained by the client training the local model based on the model parameters, preset hyperparameters and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient values obtained by the client.

[0020] The present invention also provides another federated learning training method based on differential privacy, which is applied to a server and includes:

[0021] Receive the ciphertexts of each client after the shuffling operation sent by the shuffler;

[0022] Decrypt each ciphertext to obtain the second gradient value and index information;

[0023] Use the median filling aggregation algorithm and combine the index information to restore the second gradient value to the first gradient value;

[0024] Update the model parameters of the global model based on the first gradient values;

[0025] Among them, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and index information; the second gradient value is adaptively cropped by the client from part of the first gradient values; the first gradient values are obtained by the client training the local model based on the model parameters, preset hyperparameters and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient values obtained by the client.

[0026] The present invention also provides a federated learning training system based on differential privacy, including: a server, a shuffler and at least one client, and the server and the client are respectively communicatively connected to the shuffler;

[0027] The client is used to train a local model based on model parameters, preset hyperparameters, and local data to obtain a first gradient value, where the model parameters and the preset hyperparameters are sent by the server; obtain index information of some of the first gradient values, and perform adaptive clipping on some of the first gradient values to obtain a second gradient value; perform perturbation and noise addition processing on the second gradient value, and encrypt the second gradient value after the noise addition processing and the index information to obtain a ciphertext; send the ciphertext to the shuffler;

[0028] The shuffler is used to receive the ciphertext sent by the client and perform a shuffling operation; send the ciphertext after the shuffling operation to the server;

[0029] The server is used to decrypt the received ciphertext to obtain the second gradient value and the index information; use the median filling aggregation algorithm and combine the index information to restore the second gradient value to the first gradient value; update the model parameters of the global model based on the first gradient value.

[0030] The present invention also provides a federated learning training device based on differential privacy, including:

[0031] A first acquisition module, configured to train a local model based on model parameters, preset hyperparameters, and local data to obtain a first gradient value, where the model parameters and the preset hyperparameters are sent by the server;

[0032] A second acquisition module, configured to obtain index information of some of the first gradient values, and perform adaptive clipping on some of the first gradient values to obtain a second gradient value;

[0033] A third acquisition module, configured to perform perturbation and noise addition processing on the second gradient value, encrypt the second gradient value after the noise addition processing and the index information to obtain a ciphertext;

[0034] A sending module, configured to send the ciphertext to the shuffler, where the ciphertext is used to be sent to the server after being shuffled by the shuffler, and the server decrypts and performs median filling aggregation processing on the shuffled ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value.

[0035] The present invention also provides a federated learning training device based on differential privacy, including:

[0036] A receiving module, configured to receive the ciphertext of the client after being shuffled by the shuffler sent by the shuffler;

[0037] A decrypting module, configured to decrypt the ciphertext to obtain a second gradient value and index information;

[0038] An aggregation module, configured to restore the second gradient value to a first gradient value by using a median filling aggregation algorithm and combining the index information;

[0039] An update module, configured to update model parameters of a global model based on the first gradient value;

[0040] Wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and index information; the second gradient value is obtained by the client adaptively clipping part of the first gradient value; the first gradient value is obtained by the client training a local model based on model parameters, preset hyperparameters, and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is index information of part of the first gradient value obtained by the client.

[0041] The present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the method for training federated learning based on differential privacy as described in any one of the above is implemented.

[0042] The present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method for training federated learning based on differential privacy as described in any one of the above is implemented.

[0043] The present invention further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the method for training federated learning based on differential privacy as described in any one of the above is implemented.

[0044] A method, device, system, and device for training federated learning based on differential privacy provided by the present invention obtain gradient values by training a local model on a client side, select some gradient values, obtain index information of some gradient values, and combine adaptive gradient clipping of some gradient values. The client performs perturbation, noise addition, and encryption processing on the clipped gradient values to form ciphertext, and the shuffler shuffles the ciphertext sent by the client and then sends it to the server. The server receives and decrypts the ciphertext, obtains the gradient values obtained by training each client, performs median filling aggregation processing, obtains the original gradient values, and updates the model parameters of the global model. In the entire process of training federated learning based on differential privacy, the anonymity of client messages is realized, gradient attacks can be effectively prevented, and a privacy amplification effect is generated, which can reduce the local privacy budget and the added noise, enhance the utility of data, thereby enhancing the accuracy of the model and reducing the communication volume of federated learning. Description of the Drawings

[0045] To more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0046] Figure 1 It is one of the schematic flowcharts of the federated learning training method based on differential privacy provided by the present invention;

[0047] Figure 2 It is another schematic flowchart of the federated learning training method based on differential privacy provided by the present invention;

[0048] Figure 3 It is yet another schematic flowchart of the federated learning training method based on differential privacy provided by the present invention;

[0049] Figure 4 It is a schematic diagram comparing the model accuracies of the median filling aggregation scheme and other filling aggregation schemes in the federated learning training method based on differential privacy provided by the present invention;

[0050] Figure 5 It is one of the schematic interaction flowcharts of the federated learning training system based on differential privacy provided by the present invention;

[0051] Figure 6 It is another schematic interaction flowchart of the federated learning training system based on differential privacy provided by the present invention;

[0052] Figure 7 It is a schematic diagram comparing the model accuracies of the federated learning training method based on differential privacy provided by the present invention and other federated learning training methods;

[0053] Figure 8 It is a schematic diagram comparing the gradient attack test results of the federated learning training method based on differential privacy provided by the present invention and other federated learning training methods;

[0054] Figure 9 It is one of the schematic structural diagrams of the federated learning training device based on differential privacy provided by the present invention;

[0055] Figure 10 It is another schematic structural diagram of the federated learning training device based on differential privacy provided by the present invention;

[0056] Figure 11 It is yet another schematic structural diagram of the federated learning training device based on differential privacy provided by the present invention;

[0057] Figure 12 It is a schematic structural diagram of the electronic device provided by the present invention. Specific embodiments

[0058] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings in the present invention. Obviously, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without making creative efforts shall fall within the protection scope of the present invention.

[0059] It should be noted that in the description of the embodiments of the present invention, the terms "include", "comprise" or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or device including a series of elements not only includes those elements but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the phrase "including a..." does not exclude the existence of additional identical elements in the process, method, article or device including the element. The orientation or positional relationship indicated by terms such as "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus cannot be construed as a limitation of the present invention. Unless otherwise expressly specified and limited, the terms "mounted", "connected" and "coupled" shall be construed broadly, e.g., it may be a fixed connection, a detachable connection or an integral connection; it may be a mechanical connection or an electrical connection; it may be a direct connection or an indirect connection through an intermediate medium, and it may be the internal communication of two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention may be understood according to specific circumstances.

[0060] The terms "first", "second", etc. in the present invention are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data may be interchanged under appropriate circumstances so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type and do not limit the number of objects. For example, the first object may be one or multiple. In addition, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates an "or" relationship between the associated objects before and after.

[0061] The following will be combined with Figures 1 - 7Describe the federated learning training method based on differential privacy provided by the present invention. The method involves three parties: clients, shufflers, and servers. Among them, there can be one or multiple clients. Each client has a large amount of data and is responsible for completing model training locally, thereby obtaining training data such as required gradient values, and performing operations such as encrypting and adding noise to the data. The shuffler is located between the clients and the server, receives the messages sent by each client, and is responsible for shuffling the messages, and then sends the shuffled messages to the server, thus anonymizing the client messages. The server is responsible for pushing training model parameters, hyperparameters, allocating encryption public keys and privacy budgets, etc. At the same time, it receives the shuffled messages uploaded by the shuffler and completes tasks such as decryption, aggregation, and model parameter update. The federated learning training method based on differential privacy of the present invention will be described in detail from the perspectives of different parties below.

[0062] Figure 1 One of the flow diagrams of a federated learning training method based on differential privacy provided by the present invention is as Figure 1 shown. The method is applied to the client and specifically includes:

[0063] Step 110, train the local model based on the initial model parameters, the preset hyperparameters, and the local data to obtain the first gradient value, where the model parameters and the preset hyperparameters are sent by the server.

[0064] Specifically, the client can optimize the loss function of the local model according to the model parameters and preset hyperparameters sent by the server, combined with the local data, to obtain the original gradient parameters of the loss function of this round of training, that is, the first gradient value, and complete one round of training of the local model.

[0065] Before the client conducts the first round of training on the local model, the server can initialize the model parameters of the global model, generate the initial model parameters, and distribute the initial model parameters and the preset hyperparameters to each client together.

[0066] In one embodiment, the preset hyperparameters include the public key Top-k parameter k, adaptive gradient clipping rate η, and the privacy budget ε for each dimension of the gradients of each client k . The server can distribute these parameters to each client together. Among them, the server can generate a public-private key pair and send the public key to each client, and the client can perform encryption according to the public key later.

[0067] In one embodiment, the Top-k parameter k and the adaptive gradient clipping rate η can be parameters specified by the user.

[0068] It should be understood that after the first round of training, in each round of training iteration, the server only needs to distribute the model parameters w updated in the last training to each client. t-1 The client completes each round of iterative training of the local model based on the updated model parameters, preset hyperparameters, and local data.

[0069] In one embodiment, the preset hyperparameters also include a preset momentum correction coefficient, and the momentum correction coefficient is used to perform momentum correction on the gradient value obtained through training to obtain the first gradient value.

[0070] In machine learning algorithms, the gradient descent algorithm often shows an oscillating descent due to factors such as training data and batch size. Therefore, in order to maintain the consistency of the gradient descent direction as much as possible, or to avoid the sudden gradient explosion phenomenon, this embodiment introduces a momentum correction mechanism. Represented by the Momentum algorithm, on the basis of maintaining the original gradient descent direction, the gradient descent direction obtained by training is fine-tuned to achieve gradient update.

[0071] Specifically, the formal formula of the momentum correction mechanism can be shown as follows:

[0072]

[0073] Among them, g t is the gradient descent value of the tth round of training, β is the momentum correction coefficient, and w t is the model parameter of the tth round of training, x and y are the training data and labels, and the function is the loss function.

[0074] The advantage of introducing the momentum correction algorithm in this embodiment is that: in the early stage of training, the model parameters change dramatically, and the gradient descent direction of each iteration is relatively consistent. The momentum correction algorithm will accelerate this process, making the model converge faster. At the end of training, the model parameters gradually enter the plateau period, and small data differences may cause huge differences in the direction of gradient descent, resulting in the oscillation of model parameters. At this time, the momentum correction algorithm is conducive to constraining the direction of gradient descent, thereby increasing the stability of training and avoiding the occurrence of gradient explosion.

[0075] In one embodiment, the preset momentum correction factor may be a parameter specified by a user.

[0076] Step 120: Obtain index information of part of the first gradient values, and adaptively clip part of the first gradient values to obtain second gradient values.

[0077] Specifically, since the number of first gradient values is large, only representative first gradient values can be uploaded to the server for the server to train the global model. Therefore, the client can select some first gradient values and obtain the index information of these first gradient values.

[0078] In one embodiment, the preset hyperparameter includes a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient values by using the Top-k mechanism, select some of the first gradient values, and obtain the index information of some of the first gradient values.

[0079] Specifically, the preset hyperparameter sent by the server may include a preset Top-k parameter k. The client can perform Top-k sampling on the first gradient values obtained by training according to the Top-k parameter k sent by the server, select k first gradient values for uploading to the server, and obtain the index information of this part of the first gradient values.

[0080] In one embodiment, the Top-k mechanism is used to perform Top-k sampling on the first gradient values in descending order of absolute value to obtain k first gradient values for uploading to the server. For example, the first k first gradient values in the descending order of absolute value are selected, and these first gradient values usually have high representativeness.

[0081] It should be understood that traditional local differential privacy schemes often choose to add noise to each dimension data in the gradient. However, according to the composition principle of differential privacy, it can be seen that as the amount of data increases, the privacy budget will gradually accumulate, and ultimately may lead to the explosion of the privacy budget (i.e., a large privacy budget and a low privacy protection level). In each round of training of federated learning, the process of the server obtaining the gradient update value from the client can be regarded as the server querying the client's data, and the dimension size of the model gradient can be regarded as a reflection of the amount of data size. Therefore, intuitively analyzed, as the complexity of the training model parameters increases, the privacy budget of the traditional differential privacy scheme will also surge under the composition principle, ultimately leading to the explosion of the privacy budget and the failure of differential privacy. In other words, as the dimension of the federated learning model parameters increases, the noise of the model will also increase sharply, which not only reduces the differential privacy protection level but also leads to a serious reduction in data utility. Therefore, randomly sampling the gradient values to reduce the amount of data with added noise becomes an intuitive solution.

[0082] However, considering the special significance and important role of the gradient descent value in federated learning for model training accuracy, the random sampling method may cause the parameter update to deviate seriously from the optimal gradient descent direction, thus greatly slowing down the model convergence speed or even causing the model to fail. Therefore, this solution selects the k gradient values with the largest absolute value for model update.

[0083] On the other hand, in the distributed stochastic gradient descent algorithm (the federated learning algorithm can also be regarded as a special distributed stochastic gradient descent algorithm), 99.9% of the gradient exchanges are redundant, and on some special benchmark datasets and algorithms, the Top-1 loss of sparse gradient training even drops faster than that of the benchmark with the same training loss.

[0084] In summary, the present invention introduces a Top-k mechanism, which samples the gradient values obtained from local training of the client according to the absolute value from high to low to obtain the index information of the gradient values to be uploaded.

[0085] Specifically, the advantages of the Top-k mechanism include: First, it greatly reduces the accumulation of privacy budgets and avoids the explosion of privacy budgets as the dimension of model parameters increases. Second, while reducing the privacy budget, it ensures the "representativeness" of model gradient selection. Third, it reduces the added noise, enhances the utility of data, and is beneficial to further enhancing the accuracy of the model. Fourth, the reduction of the uploaded gradient information effectively reduces the communication volume of federated learning, achieving the same effect as data compression.

[0086] After selecting the k first gradient values to be uploaded to the server, the client also adaptively clips the selected k first gradient values according to the received adaptive gradient clipping rate to obtain the second gradient values.

[0087] It should be understood that the number of the second gradient values is also k. The process of adaptive gradient clipping is to clip the k first gradient values to a suitable clipping range according to the adaptive clipping rate to obtain the second gradient values. Each second gradient value is within the clipping range, and the output number of the second gradient values remains unchanged. Thus, the clipping upper and lower bound information can also be obtained.

[0088] Specifically, gradient clipping is a commonly used technique in machine learning algorithms, and its purpose is to solve the problems of gradient explosion and gradient vanishing, that is, if the gradient suddenly becomes abnormally deviated from the original gradient direction due to training (for example, there is a region with a large slope like a cliff in the loss function of the model), gradient clipping will effectively avoid the occurrence of gradient explosion and gradient vanishing. Currently, there are two commonly used gradient clipping methods in the field of machine learning: One is to clip the gradient exceeding the threshold according to the clipping threshold set by the model, and limit the gradient within a certain range. The other is to clip according to the L2 norm of the model gradient vector.

[0089] However, gradient clipping in a federated learning model with differential privacy has another important role - to provide an appropriate sensitivity. Taking the Laplace mechanism commonly used in local differential privacy as an example, in order for a function with sensitivity Δf to satisfy ε-differential privacy, Laplace noise satisfying Lap(Δf / ε) needs to be added. Therefore, in order to use Laplace noise to achieve local differential privacy protection, an appropriate gradient clipping range needs to be selected for the training model to limit the sensitivity.

[0090] The advantage of adaptive gradient clipping is that machine learning models usually consist of multiple layers, and the parameter ranges of each layer usually vary significantly. Therefore, choosing a single gradient clipping threshold will affect the accuracy and precision of the model. At this time, an intuitive solution is to set independent gradient clipping thresholds for each layer or implement gradient clipping of the L2 norm separately for each layer. However, the method of specifying the gradient clipping thresholds for each layer by the user is not suitable for large models, resulting in the model accuracy being highly correlated with the user's choice; while the gradient clipping scheme that independently uses the L2 norm for each layer causes the model to be overly dependent on the data and cannot be corrected manually, which is also not conducive to the generalization of model training. The adaptive gradient clipping scheme combines the advantages of the above two solutions and abandons their disadvantages, and jointly performs gradient clipping according to the data itself range and the adaptive gradient clipping rate specified by the user, so as to achieve the combination of data-driven and human-driven.

[0091] Step 130, perform perturbation and noise addition processing on the second gradient value, and encrypt the noise-added second gradient value and the index information to obtain a ciphertext.

[0092] Specifically, according to the received privacy budget ε k Use the Laplace mechanism satisfying Lap(1 / ε k ) to perform perturbation and noise addition processing, so that each dimension of the gradient satisfies ε k -differential privacy. Then use the public key to encrypt the processed gradient value and index information, and generate a ciphertext to be sent to the shuffler.

[0093] In one embodiment, the step of performing perturbation and noise addition processing on the second gradient value, encrypting the noise-added second gradient value and the index information to obtain a ciphertext includes: using a conversion function to convert the second gradient value to obtain a third gradient value within a preset conversion range; performing perturbation and noise addition processing on the third gradient value, and encrypting the noise-added third gradient value and the index information to obtain the ciphertext.

[0094] Before perturbing and adding noise to the second gradient value, this embodiment uses a transfer function (Trans(·) function) to transfer the second gradient value. For example, the second gradient value is transferred to the interval [0,1] to obtain a third gradient value. In this way, the adaptive gradient clipping combined with the range transfer of the transfer function limits the gradient value within the interval [0,1], which can provide reasonable sensitivity and also reduce the communication overhead among the client, the shuffler, and the server.

[0095] In one embodiment, encryption processing can be performed using encryption algorithms such as RC4, AES, TEA, RC2, IDEA, RSA, etc.

[0096] In one embodiment, the RSA encryption algorithm is used to encrypt the third gradient value after adding noise and the index information. The ciphertext encrypted using the RSA encryption algorithm has a smaller length, which can further reduce the computational amount and communication overhead.

[0097] In one embodiment, the ciphertext further includes clipping upper and lower bound information. In this way, the subsequent server can restore the original first gradient value according to the clipping upper and lower bound information.

[0098] Step 140: Send the ciphertext to the shuffler, where the ciphertext is used to be shuffled by the shuffler and then sent to the server. The server decrypts and performs median filling aggregation processing on the shuffled ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value.

[0099] The federated learning training method based on differential privacy provided by the present invention obtains gradient values by the client training the local model, uses the Top-k mechanism to perform Top-k sampling on the gradient values to obtain index information, and combines adaptive gradient clipping on the gradient values. The client perturbs, adds noise, and encrypts the clipped gradient values to form a ciphertext. The shuffler shuffles the ciphertext sent by the client and then sends it to the server. The server receives and decrypts the ciphertext, obtains the gradient values obtained by the training of each client, performs median filling aggregation processing, obtains the original gradient value to update the model parameters of the global model, and then distributes the updated model parameters to the client. The client retrains the local model according to the updated model parameters and local data. Thus, the client can complete multiple rounds of iterative training on the local model, and the server updates the model parameters of the global model until the model parameters converge to a specified range and then the training can be stopped, thereby completing the training of the global model. Throughout the federated learning training process based on differential privacy, the anonymity of the client messages is realized, gradient attacks can be effectively prevented, and a privacy amplification effect can be generated, which can reduce the local privacy budget and the added noise, enhance the utility of the data, thereby enhancing the accuracy of the model, and also reduce the communication volume of federated learning.

[0100] Figure 2 This is the second flowchart diagram of a federated learning training method based on differential privacy provided by the present invention. As Figure 2 shown, the method is applied to a shuffler and includes:

[0101] Step 210, receiving the ciphertext sent by the client and performing a shuffling operation.

[0102] Step 220, sending the ciphertext after the shuffling operation to the server so that the server updates the model parameters of the global model.

[0103] Among them, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and index information; the second gradient value is obtained by the client adaptively clipping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient values obtained by the client.

[0104] Specifically, the present invention introduces a shuffler with the following advantages: First, introducing a shuffler into the local differential privacy model of federated learning can produce a privacy amplification effect, so that under the same global differential privacy budget, a smaller local privacy budget can be allocated to the local, so as to reduce noise addition and enhance data utility. Second, the shuffling process of the shuffler makes the client anonymous to the server, thus avoiding the accumulation of the data of a single client by the server and further avoiding the problem of privacy budget explosion. Third, the shuffler can provide user anonymity, which further promotes the separation of the server and the sampling function.

[0105] On the other hand, it is also necessary to combine the encryption and decryption processes of the shuffler with the client and the server: First, a shuffler that clearly knows the client identity information is not suitable for simultaneously mastering the client's data, otherwise the shuffler is equivalent to the server role in traditional local differential privacy, resulting in the failure of the introduction of the shuffler. In other words, the introduction of the encryption and decryption processes between the server and the client ensures that even if the shuffler knows the identities of each client, it cannot obtain the plaintext data of each client, thus protecting the privacy of users. Second, the introduction of the encryption and decryption processes enables the shuffler to maintain a secure assumption of being honest but curious and does not need to be fully trusted, thus avoiding the degradation of the present invention to the local differential privacy level.

[0106] Figure 3This is the third flowchart of a federated learning training method based on differential privacy provided by the present invention. As Figure 3 shown, the method is applied to a server and includes:

[0107] Step 310, receiving the ciphertext of the client after shuffling operation sent by the shuffler.

[0108] Step 320, decrypting the ciphertext to obtain the second gradient value and index information.

[0109] Step 330, using the median filling aggregation algorithm and combining the index information to restore the second gradient value to the first gradient value.

[0110] Step 340, updating the model parameters of the global model based on the first gradient value.

[0111] Among them, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value and encrypting the noise-added second gradient value and index information; the second gradient value is obtained by the client adaptively cropping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient value obtained by the client.

[0112] Specifically, considering that the data after cropping and conversion is within the interval [0,1], except for the gradient values sampled by Top-k, the remaining gradient values are not uploaded. Therefore, in order to better complete the aggregation on the server, it is necessary to fill the remaining gradients. The server of the present invention uses the median filling aggregation algorithm, that is, all the remaining unselected gradient values are filled with the median 0.5 and the aggregation of multiple clients is completed. Subsequently, the average upper and lower bounds of cropping can be calculated in combination with the cropping upper and lower bound information, and the median-filled and aggregated gradient values can be converted back to the original first gradient value using the Trans(·) function.

[0113] It should be understood that in the present invention, the second gradient values of each client are first aggregated, and then the second gradient values are uniformly restored to the first gradient values. In this way, firstly, it is possible to avoid converting each gradient value of each client, which greatly improves the aggregation speed in the case of a large number of clients participating in the training. Secondly, the experimental results show that the method of first aggregating and then using the clipping average upper and lower bounds to convert the gradient values can obtain a higher model accuracy. The intuitive explanation for this is that the method of first median filling and then using the mean conversion avoids a great deviation impact on the overall gradient caused by individual abnormal gradient data being first converted back to the original range, thereby effectively correcting the model instability and further increasing the model accuracy.

[0114] It should be understood that the first gradient values restored by the server are all the original first gradient values obtained by the client during local training of the local model. That is, by using the median filling aggregation algorithm and combining the index information of some first gradient values, all the first gradient values obtained by the client in this round of training can be restored from the second gradient values.

[0115] In one embodiment, in the case where multiple clients send ciphertexts, the server can calculate the mean of the restored first gradient values of each client to obtain the average first gradient value; and update the model parameters of the global model based on the average first gradient value.

[0116] To prove that the median filling aggregation scheme adopted by the present invention can provide a higher accuracy for the model compared with the no-filling first-conversion-then-mean-aggregation scheme, the median-filling first-conversion-then-mean-aggregation scheme, the random filling near the median in the [0,1] interval first-mean-aggregation-then-conversion scheme, the random filling in the [0,1] interval first-mean-aggregation-then-conversion scheme, etc., on the benchmark dataset MNIST, while keeping other hyperparameters of the training model (momentum correction coefficient β, Top-k parameter k, adaptive gradient clipping rate η, and privacy budget ε k ) consistent, the accuracy of the present invention scheme and the above several schemes was tested.

[0117] Specifically, in the preparation and division of the dataset, 60,000 data samples of MNIST were classified, with 80% used for training and 20% used for testing. The federated learning model consists of 6,000 clients, and each client has 10 data samples. In the setting of local training of the model on the client side, a single-layer neural network structure was adopted. The input of the model is a 784-dimensional matrix; the output is one of the numbers from 0 to 9; the parameters are the 784-dimensional weight matrix corresponding to the 784-dimensional vector and the mapping of 1 correction offset weight (bias) to 10 outputs, that is, the fully connected layer parameter matrix of d=(784 + 1)×10 = 7850 dimensions. In each round of global iteration of the model, 1,000 clients participate, and the training batch size within the client is set to 8.

[0118] The comparison results obtained in this test are as Figure 4 shown, where the curve of the diamond nodes is the accuracy curve of the median filling aggregation scheme in the present invention. It can be seen from Figure 4 this that the accuracy of the median filling aggregation scheme of the present invention is the highest.

[0119] The main reason for obtaining the comparison results as Figure 4 follows: The scheme of filling with random values may lead to gradient explosion after the gradient is restored to the original range, thus affecting the convergence speed and accuracy of the training model. And the scheme of directly aggregating without filling will obviously cause the gradients of some dimensions to deviate seriously from the original values. Although the importance of these gradient information is relatively low, it will still inevitably affect the convergence speed and accuracy of the model.

[0120] The present invention also provides a federated learning training system based on differential privacy. The system includes: a server, a shuffler, and at least one client. The server and the client are respectively communicatively connected to the shuffler.

[0121] Specifically, the client is used to train the local model based on the model parameters, preset hyperparameters, and local data to obtain the first gradient value, where the model parameters and the preset hyperparameters are sent by the server; obtain the index information of some of the first gradient values, and adaptively clip some of the first gradient values to obtain the second gradient value; perform perturbation and noise addition processing on the second gradient value, and encrypt the second gradient value after the noise addition processing and the index information to obtain the ciphertext; send the ciphertext to the shuffler;

[0122] The shuffler is used to receive the ciphertext sent by the client and perform a shuffling operation; send the ciphertext after the shuffling operation to the server;

[0123] The server is used to decrypt the received ciphertext to obtain the second gradient value and the index information; use the median filling aggregation algorithm and combine the index information to restore the second gradient value to the first gradient value; update the model parameters of the global model based on the first gradient value.

[0124] Figure 5 is one of the interaction process diagrams of the federated learning training system based on differential privacy provided by the present invention. As Figure 5 shown:

[0125] The server is used to distribute the initial model parameters and preset hyperparameters to the client;

[0126] The client is used to train the local model based on the received initial model parameters, the preset hyperparameters and local data to obtain the first gradient value; use the Top-k mechanism to obtain the index information of some of the first gradient values, and adaptively clip some of the first gradient values to obtain the second gradient value; perform perturbation and noise addition processing on the second gradient value, and encrypt the second gradient value and the index information after the noise addition processing to obtain the ciphertext; send the ciphertext to the shuffler;

[0127] The shuffler is used to receive the ciphertexts sent by each client and perform a shuffling operation; send the ciphertexts after the shuffling operation to the server;

[0128] The server is also used to decrypt each received ciphertext to obtain the second gradient value and the index information; use the median filling aggregation algorithm and combine the index information to restore each second gradient value to the first gradient value; update the initial model parameters of the global model according to each first gradient value.

[0129] Figure 5 Shows the interaction process between the client, the shuffler and the server during the first round of training of the local model.

[0130] Figure 6 is the second of the interaction process diagrams of the federated learning training system based on differential privacy provided by the present invention. As Figure 6As shown, after the server distributes the initial model parameters and preset hyperparameters, each client locally uses the data in the local database and applies the momentum correction algorithm to complete the training of the local model. After obtaining the initial local training gradient values, the Top-k algorithm is applied to select the most representative gradient values and complete the adaptive gradient clipping. Subsequently, noise is added to the selected and clipped gradient values and encrypted and sent to the shuffler to complete the shuffling operation. Then the server completes the decryption and median filling aggregation operation, updates the model parameters of the global model, and distributes the updated model parameters to each client, thus completing multiple rounds of training iterations.

[0131] It can be understood that in each subsequent round of iterative training, the server only needs to send the updated model parameters to the client, and the client trains the local model based on the updated model parameters, preset hyperparameters, and local data, and so on. This will not be elaborated in this article.

[0132] The federated learning training method based on differential privacy provided by the present invention can evaluate its technical advantages from three aspects: privacy protection level, accuracy, and security.

[0133] 1. Evaluation advantages of privacy protection level:

[0134] The present invention adds noise to the k gradient values selected by the client, and the noise distribution satisfies the Laplace mechanism of differential privacy. To evaluate the privacy protection level it satisfies, the present invention uses the global differential privacy level as the evaluation standard, and abstracts the central differential privacy level of the present invention from the k-dimensional gradient data selected by each client and the number of participating clients n.

[0135] First, according to the naive combination principle of differential privacy (the ε-differential privacy mechanism class satisfies kε-differential privacy under k-fold adaptive combination), the following Corollary 1 can be obtained.

[0136] Corollary 1 For each client, when allocating ε k -differential privacy to the data of each dimension of the gradient value, the overall client satisfies k·ε k -local differential privacy.

[0137] Secondly, considering that the present invention introduces a shuffler, which thus produces a privacy amplification effect, the shuffling model privacy amplification theory is introduced here, as shown in Theorem 1.

[0138] Theorem 1 (Privacy Amplification Theory) In the shuffling model, if the random algorithm satisfies ε l -local differential privacy, where ε l ≤log(n / log(1 / δ c )) / 2, then the shuffling mechanism Satisfying (ε c , δ c )-differential privacy, there is:

[0139]

[0140] where (a ∧ b) = min(a, b).

[0141] Therefore, according to Corollary 1 and Theorem 1, the global differential privacy protection level of the present invention can be obtained, as shown in Corollary 2.

[0142] Corollary 2 (Global differential privacy level of the present invention) For the present invention, if the random algorithm satisfies k·ε k -local differential privacy, where then the shuffling mechanism satisfies (ε c , δ c )-differential privacy, there is:

[0143]

[0144] In summary, the theoretical evaluation results of the global differential privacy level of the present invention show that when k gradient values are selected from each of the n clients and the local differential privacy budget ε k and the global error rate δ c are allocated, the present invention can provide the privacy protection level of differential privacy.

[0145] 2. Advantages in accuracy evaluation

[0146] (1) Setting

[0147] The present invention uses the benchmark dataset MNIST and the logistic regression model to test the accuracy of the solution of the present invention. In the preparation and division of the dataset, 60,000 data samples of MNIST are classified, with 80% for training and 20% for testing. The federated learning model contains 6,000 clients, and each client has 10 data samples. In the setting of training the model locally on the client side, a single-layer neural network structure is adopted. The model input is a 784-dimensional matrix; the output is one of the numbers from 0 to 9; the parameters are the 784-dimensional weight matrix corresponding to the 784-dimensional vector and the mapping of 1 correction offset weight (bias) to 10 outputs, that is, a fully connected layer parameter matrix of d = (784 + 1) × 10 = 7850 dimensions. In each round of global iteration of the model, 1,000 clients participate, and the training batch size within the client is set to 8.

[0148] (2) Comparison with the same type of solutions

[0149] To compare with other related advanced solutions, the present invention first determines some benchmark algorithms: a noise-free federated learning model (NP-FL), a deep learning differential privacy solution using the Gaussian mechanism (DP-FL), and a traditional differential privacy solution applying the Gaussian mechanism (LDP-FL). The momentum correction technique is used in the local training of the benchmark algorithms. Secondly, the present invention also makes comparisons with the SS-Simple, SS-Double, and SS-Topk solutions.

[0150] The above comparisons are completed under the same dataset partitioning and settings: the momentum correction coefficient in the local training models of the benchmark algorithms and the present invention is selected as β = 0.9; in the algorithms that require gradient sampling, the number of samples (or Topk value) is selected as k = 157; DP-FL adopts the method of L2 norm gradient clipping, and the gradient clipping range of LDP-FL, SS-Simple, SS-Double, and SS-Topk is [-0.01, 0.01], and the adaptive gradient clipping rate η of the present invention is 0.1; the algorithms that need to allocate privacy budgets all adopt the local privacy budget of ε k = 0.5. The results are specifically as Figure 7 shown. In Figure 7 , the curve of the triangular nodes is the accuracy curve of the solution of the present invention.

[0151] From Figure 7 it can be clearly observed that:

[0152] First, although a relatively large privacy budget is allocated to the solution of the present invention, resulting in a relatively large amount of data noise added to the solution of the present invention, compared with the accuracy of 89.28% of the benchmark algorithm without added noise (NP-FL), the solution of the present invention has an accuracy with a very small gap of 85.28%, and this accuracy is much higher than the accuracy of 68.38% of SS-Topk.

[0153] Second, the accuracy curve of the solution of the present invention still shows an upward trend as the number of iterations increases, and this characteristic is basically the same as that of the NP-FL algorithm without added noise. However, the curve of the SS-Topk algorithm shows obvious oscillation phenomena as the number of iteration rounds increases, and even obvious problems of accuracy decline occur. The intuitive explanation of this phenomenon is that the SS-Topk solution does not correct the gradient values, the gradient clipping threshold is not properly adapted to the data, and due to the filling scheme in the aggregation process that reallocates the privacy budget, resulting in a large deviation of the aggregated data. In addition, the accuracies of the DP-FL, LDP-FL, SS-Simple, and SS-Double algorithms all show an obvious downward trend as the number of iteration rounds increases. This phenomenon indicates that the addition of noise has seriously affected the original data of the model gradient.

[0154] The above results intuitively illustrate the importance of the momentum correction algorithm, adaptive gradient clipping, and median filling aggregation scheme introduced in the solution of the present invention. The momentum correction algorithm enables the model to converge rapidly and always maintain the stability of accuracy, avoiding model fluctuations. Adaptive gradient clipping allows the clipping range to be adjusted according to the data, avoiding rigid numerical selection. The median filling aggregation algorithm fills in the missing gradient information that has not been uploaded, making the gradient update value closer to the original gradient. The above three complement each other, enabling this solution to achieve extremely excellent accuracy.

[0155] 3. Security evaluation advantages

[0156] The most significant security challenge currently faced by federated learning is the gradient leakage problem, and the main attack method against gradient leakage is gradient attack. Gradient attack constructs initial random training data based on a single gradient value and uses a neural network to continuously adjust the training data so that the constructed data can obtain or approach the original gradient value after passing through the original gradient model, thereby realizing the recovery of user training data.

[0157] To test whether the gradients after noise addition in the solution of the present invention are secure against gradient attacks, this time, DLG attack, R-GAP attack, IG attack, and BICR attack were used to systematically test the security of the solution of the present invention.

[0158] (1) Settings

[0159] This security test used the Breaching framework and completed the gradient attack test on the benchmark dataset CIFAR-10. In the overall test of each attack, the "unique-class" mode was adopted for the division of the dataset.

[0160] (2) Overall security evaluation

[0161] This time, DLG, R-GAP, IG, and BICR algorithms were respectively used to complete the attack on the solution of the present invention. Figure 8 The attack results are detailedly shown, including: the original pictures participating in the training, the gradient attack results without adding noise (i.e., the images participating in the training recovered by the gradient attack), and the results of attacking the gradients uploaded by the solution of the present invention.

[0162] According to Figure 8 the attack results, it can be clearly seen that when there is no noise, all four gradient attacks are very effective and can almost recover the image information exactly the same as the original image; but when performing gradient attacks on the gradient values generated by the solution of the present invention, the above current state-of-the-art gradient attacks all fail, indicating that the solution of the present invention has higher security in resisting existing gradient attacks.

[0163] The following describes the federated learning training device based on differential privacy provided by the present invention. The federated learning training device based on differential privacy described below can be correspondingly referred to the federated learning training method based on differential privacy described above.

[0164] Figure 9 As shown in the structural schematic diagram of a federated learning training device based on differential privacy provided by the present invention, Figure 9 as shown, the device includes:

[0165] A first acquisition module 910, configured to train a local model with local data to obtain a first gradient value, wherein the model parameters and the preset hyperparameters are sent by a server;

[0166] A second acquisition module 920, configured to acquire index information of some of the first gradient values, and perform adaptive clipping on some of the first gradient values to obtain a second gradient value;

[0167] A third acquisition module 930, configured to perform perturbation and noise addition processing on the second gradient value, and perform encryption processing on the noise-added second gradient value and the index information to obtain a ciphertext;

[0168] A sending module 940, configured to send the ciphertext to a shuffler, wherein the ciphertext is used to be shuffled by the shuffler and then sent to the server, and the server decrypts and performs median filling and aggregation processing on the shuffled ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value.

[0169] Figure 10 As shown in the structural schematic diagram of another federated learning training device based on differential privacy provided by the present invention, Figure 10 as shown, the device includes:

[0170] A shuffling module 1010, configured to receive the ciphertext sent by a client and perform a shuffling operation;

[0171] A sending module 1020, configured to send the ciphertext after the shuffling operation to the server, so that the server updates the model parameters of the global model.

[0172] Wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value, and encrypting the second gradient value and index information after the noise addition processing; the second gradient value is obtained by the client adaptively cropping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient values obtained by the client.

[0173] Figure 11 FIG. is a schematic structural diagram of another federated learning training device based on differential privacy provided by the present invention, as Figure 11 shown, the device includes:

[0174] A receiving module 1110, configured to receive the ciphertext of the client after the shuffling operation sent by the shuffler;

[0175] A decryption module 1120, configured to decrypt the ciphertext to obtain a second gradient value and index information;

[0176] An aggregation module 1130, configured to use the median filling aggregation algorithm and combine the index information to restore the second gradient value to the first gradient value;

[0177] An update module 1140, configured to update the model parameters of the global model based on the first gradient value;

[0178] Wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value, and encrypting the second gradient value and index information after the noise addition processing; the second gradient value is obtained by the client adaptively cropping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient values obtained by the client.

[0179] Figure 12 FIG. is a schematic structural diagram of an entity of an electronic device, as Figure 12As shown in the figure, the electronic device may include: a processor 1210, a communications interface 1220, a memory 1230, and a communication bus 1240. Among them, the processor 1210, the communications interface 1220, and the memory 1230 communicate with each other through the communication bus 1240. The processor 1210 may call logic instructions in the memory 1230 to execute a federated learning training method based on differential privacy. The method includes: training a local model based on model parameters, preset hyperparameters, and local data to obtain a first gradient value, where the model parameters and the preset hyperparameters are sent by the server; obtaining index information of some of the first gradient values, and adaptively pruning some of the first gradient values to obtain a second gradient value; performing perturbation and noise addition processing on the second gradient value, encrypting the noise-added second gradient value with the index information to obtain a ciphertext; sending the ciphertext to a shuffler, where the ciphertext is used to be shuffled by the shuffler and then sent to the server. The server decrypts and performs median filling and aggregation processing on the shuffled ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value.

[0180] In addition, when the logic instructions in the above-mentioned memory 1230 are implemented in the form of software functional units and sold or used as an independent product, they may be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0181] The present invention also provides another electronic device, which may include: a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete communication with each other through the communication bus. The processor can call the logical instructions in the memory to execute a federated learning training method based on differential privacy. The method includes: receiving the ciphertext sent by the client and performing a shuffling operation; sending the shuffled ciphertext to the server so that the server can update the model parameters of the global model; where the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value and encrypting the noise-added second gradient value and the index information; the second gradient value is obtained by the client adaptively cropping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient values obtained by the client.

[0182] The present invention also provides another electronic device, which may include: a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete communication with each other through the communication bus. The processor can call the logical instructions in the memory to execute a federated learning training method based on differential privacy. The method includes: receiving the shuffled ciphertext of the client sent by the shuffler; decrypting the ciphertext to obtain the second gradient value and the index information; using the median filling aggregation algorithm and combining the index information to restore the second gradient value to the first gradient value; updating the model parameters of the global model based on the first gradient value; where the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value and encrypting the noise-added second gradient value and the index information; the second gradient value is obtained by the client adaptively cropping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient values obtained by the client.

[0183] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the differential privacy-based federated learning training method provided by the above-mentioned various methods. The method includes: training a local model based on model parameters, preset hyperparameters, and local data to obtain a first gradient value, wherein the model parameters and the preset hyperparameters are sent by a server; obtaining index information of some of the first gradient values, and adaptively clipping some of the first gradient values to obtain a second gradient value; performing perturbation and noise addition processing on the second gradient value, and encrypting the second gradient value after the noise addition processing and the index information to obtain a ciphertext; sending the ciphertext to a shuffler, where the ciphertext is used to be sent to the server after being shuffled by the shuffler, and the server decrypts and performs median filling aggregation processing on the ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value.

[0184] The present invention also provides another computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the differential privacy-based federated learning training method provided by the above-mentioned various methods. The method includes: receiving the ciphertext sent by a client and performing a shuffling operation; sending the ciphertext after the shuffling operation to the server so that the server can update the model parameters of the global model; wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on a second gradient value, and encrypting the second gradient value after the noise addition processing and index information; the second gradient value is obtained by the client adaptively clipping some of the first gradient values; the first gradient value is obtained by the client training a local model based on the model parameters, preset hyperparameters, and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of some of the first gradient values obtained by the client.

[0185] The present invention also provides another computer program product. The computer program product includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the federated learning training method based on differential privacy provided by the above-mentioned various methods. The method includes: receiving the ciphertext of the client after shuffling operation sent by a shuffler; decrypting the ciphertext to obtain a second gradient value and index information; using the median filling aggregation algorithm and combining the index information to restore the second gradient value to a first gradient value; updating the model parameters of the global model based on the first gradient value; wherein, the ciphertext is obtained by the client performing perturbation noise addition processing on the second gradient value and encrypting the noise-added second gradient value and the index information; the second gradient value is obtained by the client adaptively cropping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient value obtained by the client.

[0186] In another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is configured to execute the federated learning training method based on differential privacy provided by the above-mentioned various methods. The method includes: training a local model based on model parameters, preset hyperparameters and local data to obtain a first gradient value, wherein the model parameters and the preset hyperparameters are sent by the server; obtaining index information of part of the first gradient value, and adaptively cropping part of the first gradient value to obtain a second gradient value; performing perturbation noise addition processing on the second gradient value, encrypting the noise-added second gradient value and the index information to obtain a ciphertext; sending the ciphertext to a shuffler, and the ciphertext is used to be sent to the server after being shuffled by the shuffler. The server decrypts and performs median filling aggregation processing on the ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value.

[0187] The present invention also provides another non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the differential privacy-based federated learning training method provided by the above-mentioned various methods. The method includes receiving the ciphertext sent by a client and performing a shuffling operation; sending the ciphertext after the shuffling operation to a server so that the server updates the model parameters of a global model; wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on a second gradient value and encrypting the noise-added second gradient value and index information; the second gradient value is obtained by the client adaptively clipping part of a first gradient value; the first gradient value is obtained by the client training a local model based on the model parameters, preset hyperparameters, and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient value obtained by the client.

[0188] The present invention also provides another non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the differential privacy-based federated learning training method provided by the above-mentioned various methods. The method includes: receiving the ciphertext of the client after the shuffling operation sent by a shuffler; decrypting the ciphertext to obtain a second gradient value and index information; using the median filling aggregation algorithm and combining the index information to restore the second gradient value to a first gradient value; updating the model parameters of the global model based on the first gradient value; wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value and encrypting the noise-added second gradient value and index information; the second gradient value is obtained by the client adaptively clipping part of the first gradient value; the first gradient value is obtained by the client training a local model based on the model parameters, preset hyperparameters, and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient value obtained by the client.

[0189] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative labor.

[0190] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0191] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A federated learning training method based on differential privacy, characterized in that, Applied to the client, including: Training the local model based on the model parameters, preset hyperparameters, and local data to obtain the first gradient value, where the model parameters and the preset hyperparameters are sent by the server; Obtaining the index information of some of the first gradient values, and adaptively pruning some of the first gradient values to obtain the second gradient value; Performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and the index information to obtain the ciphertext; Sending the ciphertext to the shuffler, where the ciphertext is used to be shuffled by the shuffler and then sent to the server. The server decrypts and performs median filling and aggregation processing on the shuffled ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value; The preset hyperparameters include a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient value using the Top-k mechanism, select some of the first gradient values, and obtain the index information of some of the first gradient values.

2. The federated learning training method based on differential privacy according to claim 1, wherein The step of performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and the index information to obtain the ciphertext includes: Converting the second gradient value using a conversion function to obtain a third gradient value within a preset conversion range; Performing perturbation and noise addition processing on the third gradient value, and encrypting the noise-added third gradient value and the index information to obtain the ciphertext.

3. A federated learning training method based on differential privacy, characterized in that, Applied to the shuffler, including: Receiving the ciphertext sent by the client and performing a shuffling operation; Sending the shuffled ciphertext to the server so that the server can update the model parameters of the global model; Wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value and encrypting the noise-added second gradient value and the index information; the second gradient value is obtained by the client adaptively pruning some of the first gradient values; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of some of the first gradient values obtained by the client; The preset hyperparameters include a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient value using the Top-k mechanism, select some of the first gradient values, and obtain the index information of some of the first gradient values.

4. A federated learning training method based on differential privacy, characterized in that, Applied to the server, including: Receiving the ciphertext of the client after the shuffling operation sent by the shuffler; Decrypting the ciphertext to obtain the second gradient value and the index information; Restoring the second gradient value to the first gradient value using the median filling aggregation algorithm in combination with the index information; Updating the model parameters of the global model based on the first gradient value; The ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value, and encrypting the noise-added second gradient value and the index information; the second gradient value is obtained by the client adaptively clipping part of the first gradient value; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters, and local data, where the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of part of the first gradient value obtained by the client; The preset hyperparameters include a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient value using the Top-k mechanism, select part of the first gradient value, and obtain the index information of part of the first gradient value.

5. A federated learning training system based on differential privacy, characterized in that It includes: A server, a shuffler, and at least one client, where the server and the client are respectively communicatively connected to the shuffler; The client is used to train the local model based on the model parameters, preset hyperparameters, and local data to obtain the first gradient value, where the model parameters and the preset hyperparameters are sent by the server; obtain the index information of part of the first gradient value, and perform adaptive clipping on part of the first gradient value to obtain the second gradient value; perform perturbation and noise addition processing on the second gradient value, and encrypt the noise-added second gradient value and the index information to obtain the ciphertext; send the ciphertext to the shuffler; The shuffler is used to receive the ciphertext sent by the client and perform a shuffling operation; send the ciphertext after the shuffling operation to the server; The server is used to decrypt the received ciphertext to obtain the second gradient value and the index information; use the median filling aggregation algorithm and combine the index information to restore the second gradient value to the first gradient value; update the model parameters of the global model based on the first gradient value; The preset hyperparameters include a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient value using the Top-k mechanism, select part of the first gradient value, and obtain the index information of part of the first gradient value.

6. A federated learning training device based on differential privacy, characterized in that, It includes: A first acquisition module, which is used to train the local model based on the model parameters, preset hyperparameters, and local data to obtain the first gradient value, where the model parameters and the preset hyperparameters are sent by the server; A second acquisition module, which is used to obtain the index information of part of the first gradient value, and perform adaptive clipping on part of the first gradient value to obtain the second gradient value; A third acquisition module, which is used to perform perturbation and noise addition processing on the second gradient value, and encrypt the noise-added second gradient value and the index information to obtain the ciphertext; A sending module, configured to send the ciphertext to a shuffler, where the ciphertext is used to be shuffled by the shuffler and then sent to the server, and the server decrypts and performs median filling aggregation processing on the shuffled ciphertext to restore the first gradient value, and updates the model parameters of the global model based on the first gradient value; The preset hyperparameters include a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient value by using the Top-k mechanism, select some of the first gradient values, and obtain the index information of some of the first gradient values.

7. A federated learning training device based on differential privacy, characterized in that, It includes: A receiving module, configured to receive the ciphertext of the client after the shuffling operation sent by the shuffler; A decryption module, configured to decrypt the ciphertext to obtain a second gradient value and index information; An aggregation module, configured to restore the second gradient value to a first gradient value by using the median filling aggregation algorithm and combining the index information; An update module, configured to update the model parameters of the global model based on the first gradient value; Wherein, the ciphertext is obtained by the client performing perturbation and noise addition processing on the second gradient value and encrypting the noise-added second gradient value and index information; the second gradient value is adaptively cropped from some of the first gradient values of the client; the first gradient value is obtained by the client training the local model based on the model parameters, preset hyperparameters and local data, wherein the model parameters and the preset hyperparameters are sent by the server; the index information is the index information of some of the first gradient values obtained by the client; The preset hyperparameters include a preset Top-k parameter, and the Top-k parameter is used to sample the first gradient value by using the Top-k mechanism, select some of the first gradient values, and obtain the index information of some of the first gradient values.

8. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the differential privacy-based federated learning training method according to any one of claims 1 to 4.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the differential privacy-based federated learning training method according to any one of claims 1 to 4.

Images