A model aggregation training method and apparatus

Abstract

This invention discloses a model aggregation training method and apparatus. The method comprises: distributing an initialized machine learning model to at least one collaborating device; obtaining model gradient update parameters sent by at least one collaborating device and constructing a model gradient update set; performing global model prediction for a federated learning training task using a preset test set to obtain the model accuracy for this round; reviewing the accuracy of this round; performing a global model update based on Bayesian differential privacy based on the review results and the model gradient update set to obtain the updated global model; tracking the training process of the global model for this round through a first privacy accountant to obtain the privacy cost for this round; summarizing the maximum privacy costs corresponding to all training rounds before this round to obtain the merged privacy cost; and determining the end of federated training and obtaining the target machine learning model if the merged privacy cost is greater than a first preset privacy budget.

Description

Technical Field

[0001] This invention relates to the field of data security, and in particular to a model aggregation training method and apparatus. Background Technology

[0002] Currently, the training of various big data-based models, including data identification models, data classification models, data operation behavior profiling models, data flow analysis models, data risk analysis models, and data interface risk analysis models, all require the construction of accurate and powerful models from massive amounts of data. However, these big data-based models rely on data distributed within their respective underlying scenarios, thus necessitating the collection of data from multiple sources.

[0003] When collecting data from multiple sources for model training, it is not advisable to collect all data onto a single server for centralized model training. This is because data providers do not want to expose data silos caused by the exposure of source data, and because data centralization can lead to single points of failure. It not only consumes a lot of computing and storage resources, but also makes the data vulnerable to external attacks that could result in the leakage of private data.

[0004] Therefore, how to reduce communication resource consumption and train the model while protecting privacy has become an urgent problem to be solved. Summary of the Invention

[0005] This invention provides a model aggregation training method and apparatus for reducing communication resource consumption and training models while protecting privacy.

[0006] Firstly, a model aggregation training method is provided, applied to a main training device, the method comprising:

[0007] The initialized machine learning model is sent to at least one collaborating device, and the model gradient update parameters sent by the at least one collaborating device are obtained respectively. A model gradient update set is constructed based on the obtained at least one model gradient update parameter. The model gradient update parameter is obtained by the collaborating device after training the initialized machine learning model based on local data.

[0008] Global model prediction for federated learning training task is performed using a preset test set to obtain the accuracy of the current round of model training. The accuracy of the current round of model training is reviewed, and based on the review results and the model gradient update set, a global model update based on Bayesian differential privacy is performed to obtain the updated global model. The global model includes all initialized machine learning models trained on the at least one collaborating device.

[0009] The current training process of the global model is tracked through the first privacy accounting method to obtain the privacy cost of this round; the maximum privacy cost corresponding to all training rounds before this round is summarized to obtain the combined privacy consumption;

[0010] If the privacy consumption of the merged model exceeds the first preset privacy budget, the federated training is terminated, and the target machine learning model is obtained.

[0011] In one possible implementation, the method further includes, before distributing the initialized machine learning model to at least one collaborating device:

[0012] Create the first privacy accountant using Bayesian differential privacy technology.

[0013] In one possible implementation, the method further includes, before distributing the initialized machine learning model to at least one collaborating device:

[0014] The packaged federated learning application and its dependencies are sent to a portable, lightweight container in the at least one collaborating device, enabling the at least one collaborating device to create a local training environment for the initialized machine learning model; and,

[0015] Based on the set of certified collaborators in the preset federated learning training parameters, at least one collaborator device is determined to distribute the initialized machine learning model.

[0016] In one possible implementation, based on the obtained review results and the model gradient update set, a global model update based on Bayesian differential privacy is performed to obtain the updated global model, including:

[0017] If it is determined that the prediction result of the model task is within the preset accuracy review range, a global model update based on Bayesian differential privacy is performed based on the mutual exclusion probability of the dynamic accuracy review random rate and the model gradient update set to obtain the updated global model.

[0018] In one possible implementation, a global model update based on Bayesian differential privacy is performed, including:

[0019] Using a subsampled Gaussian noise mechanism, combined with a preset sampling estimator, hierarchical noise perturbation based on a learning machine model is performed in the global model update to eliminate the non-independent and identically distributed characteristics of data from the at least one collaborating device.

[0020] Secondly, a model aggregation training method is applied to collaborating device, the method comprising:

[0021] In response to the initialized machine learning model sent by the main training device, the local data is preprocessed, a local training dataset is constructed based on the obtained preprocessed data, and a second privacy account is created.

[0022] Based on the local data training set, the initialized machine learning model is trained locally to obtain model gradient update data;

[0023] Based on the model gradient update data and the preset sending strategy, the model gradient update data is sent to the main training device; the preset sending strategy is used to determine whether to skip gradient checking and directly send the model gradient update data.

[0024] According to the second privacy accounting, a local privacy check is performed, and the result of the check determines whether to participate in federal training.

[0025] In one possible implementation, in response to the received initialized machine learning model sent by the main training device, local data preprocessing is performed, a local training dataset is constructed based on the obtained preprocessed data, and a second privacy account is created, including:

[0026] Unpack the federated learning application and its dependencies in a portable, lightweight container, and build a local training environment for the model based on the federated learning application and its dependencies.

[0027] The local source data is preprocessed to obtain a local training dataset; the data preprocessing includes one or more of the following: distinguishing feature matrix, processing missing data, encoding classification data, and feature scaling.

[0028] Privacy amplification is performed on preset privacy data using slice sampling or random sampling to obtain an initialized second privacy accountant.

[0029] In one possible implementation, sending the model gradient update data to the main training device according to the model gradient update data and a preset sending strategy includes:

[0030] Data quality analysis is performed on the gradient update data of the model to obtain the inspection-free weights;

[0031] If the exempt weights meet the preset range, then skip the gradient check and upload the model gradient update data to the main training device;

[0032] If the exemption weight does not meet the preset range, the gradient check is not skipped, and the first contribution value generated after this round of training is obtained based on the global model parameter value before this round, the average model parameter value corresponding to all collaborating devices in this round, and the differential correction function; when the first contribution value is not less than the average contribution value, the model gradient update data is transmitted to the main training device.

[0033] In one possible implementation, a local privacy check is performed according to the second privacy accounting, and based on the check result, it is determined whether to participate in federal training, including:

[0034] The local privacy cost is updated using the second privacy accounting method, and privacy merging is performed using the central limit theorem to obtain the target privacy cost.

[0035] If the target privacy cost exceeds the second preset privacy cost, it is determined that the organization will not participate in federated training.

[0036] Thirdly, a model aggregation training device is provided for use on a main training device, the device comprising:

[0037] The first processing unit is configured to send the initialized machine learning model to at least one collaborating device, obtain the model gradient update parameters sent by the at least one collaborating device, and construct a model gradient update set based on the obtained at least one model gradient update parameter; wherein, the model gradient update parameter is obtained by the collaborating device after training the initialized machine learning model based on local data;

[0038] The second processing unit is used to perform global model prediction for federated learning training tasks using a preset test set, obtain the accuracy of the current round of model training, review the accuracy of the current round of model training, and perform global model update based on Bayesian differential privacy according to the obtained review results and the model gradient update set to obtain the updated global model. The global model includes all initialized machine learning models trained on the at least one collaborating device.

[0039] The first obtaining unit is used to track the current training process of the global model through the first privacy accounting to obtain the privacy cost of the current round; and to summarize the maximum privacy cost corresponding to all training rounds before the current round to obtain the merged privacy consumption.

[0040] The second obtaining unit is used to determine to end federated training and obtain the target machine learning model if the merged privacy consumption is greater than the first preset privacy budget.

[0041] In one possible implementation, before distributing the initialized machine learning model to at least one collaborating device, the first processing unit is further configured to:

[0042] Create the first privacy accountant using Bayesian differential privacy technology.

[0043] In one possible implementation, before distributing the initialized machine learning model to at least one collaborating device, the first processing unit is further configured to:

[0044] The packaged federated learning application and its dependencies are sent to a portable, lightweight container in the at least one collaborating device, enabling the at least one collaborating device to create a local training environment for the initialized machine learning model; and,

[0045] Based on the set of certified collaborators in the preset federated learning training parameters, at least one collaborator device is determined to distribute the initialized machine learning model.

[0046] In one possible implementation, the second processing unit is configured to:

[0047] If it is determined that the prediction result of the model task is within the preset accuracy review range, a global model update based on Bayesian differential privacy is performed based on the mutual exclusion probability of the dynamic accuracy review random rate and the model gradient update set to obtain the updated global model.

[0048] In one possible implementation, the second processing unit is configured to:

[0049] Using a subsampled Gaussian noise mechanism, combined with a preset sampling estimator, hierarchical noise perturbation based on a learning machine model is performed in the global model update to eliminate the non-independent and identically distributed characteristics of data from the at least one collaborating device.

[0050] Fourthly, a model aggregation training device is provided for use with collaborating devices, the device comprising:

[0051] The response unit is used to respond to the initialized machine learning model sent by the main training device, perform data preprocessing on the local data, construct a local training dataset based on the obtained preprocessed data, and create a second privacy account.

[0052] The obtaining unit is used to perform local model training on the initialized machine learning model based on the local data training set to obtain model gradient update data.

[0053] The sending unit is used to send the model gradient update data to the main training device according to the model gradient update data and the preset sending strategy; the preset sending strategy is used to determine whether to skip gradient checking and send the model gradient update data directly.

[0054] The processing unit is configured to perform a local privacy check based on the second privacy accounting, and determine whether to participate in federal training based on the check results.

[0055] In one possible implementation, the response unit is specifically used for:

[0056] Unpack the federated learning application and its dependencies in a portable, lightweight container, and build a local training environment for the model based on the federated learning application and its dependencies.

[0057] The local source data is preprocessed to obtain a local training dataset; the data preprocessing includes one or more of the following: distinguishing feature matrix, processing missing data, encoding classification data, and feature scaling.

[0058] Privacy amplification is performed on preset privacy data using slice sampling or random sampling to obtain an initialized second privacy accountant.

[0059] In one possible implementation, the transmitting unit is configured to:

[0060] Data quality analysis is performed on the gradient update data of the model to obtain the inspection-free weights;

[0061] If the exempt weights meet the preset range, then skip the gradient check and upload the model gradient update data to the main training device;

[0062] If the exemption weight does not meet the preset range, the gradient check is not skipped, and the first contribution value generated after this round of training is obtained based on the global model parameter value before this round, the average model parameter value corresponding to all collaborating devices in this round, and the differential correction function; when the first contribution value is not less than the average contribution value, the model gradient update data is transmitted to the main training device.

[0063] In one possible implementation, the processing unit is configured to:

[0064] The local privacy cost is updated using the second privacy accounting method, and privacy merging is performed using the central limit theorem to obtain the target privacy cost.

[0065] If the target privacy cost exceeds the second preset privacy cost, it is determined that the organization will not participate in federated training.

[0066] Fifthly, a main training device is provided, the main training device comprising:

[0067] A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps included in any of the methods in the first aspect.

[0068] Sixthly, a collaborating device is provided, the collaborating device comprising:

[0069] A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps included in any of the methods in the second aspect.

[0070] In a seventh aspect, a storage medium is provided that stores computer-executable instructions for causing a main training device to perform steps included in any method of the first aspect or for causing a collaborating device to perform steps included in any method of the second aspect.

[0071] Eighthly, a computer program product is provided that, when the computer program product is run on a main training device, causes the main training device to perform the steps included in any method of the first aspect or causes a collaborating device to perform the steps included in any method of the second aspect.

[0072] The technical solutions provided by the embodiments of the present invention bring at least the following beneficial effects:

[0073] In this embodiment of the invention, the main training device can distribute the initialized machine learning model to at least one collaborating device, obtain the model gradient update parameters sent by at least one collaborating device, and construct a model gradient update set based on the obtained model gradient update parameters. The model gradient update parameters are obtained by the collaborating devices after training the initialized machine learning model using local data. A preset test set is used to perform global model prediction for the federated learning training task, obtaining the accuracy of the current round of model training. The accuracy of the current round of model training is reviewed, and based on the review results and the model gradient update set, a global model update based on Bayesian differential privacy is performed to obtain the updated global model. The global model includes all initialized machine learning models trained on at least one collaborating device. The current round of training of the global model is tracked through a first privacy accountant to obtain the privacy cost of the current round. The maximum privacy cost corresponding to all training rounds before the current round is summarized to obtain the merged privacy consumption. If the merged privacy consumption is greater than a first preset privacy budget, the federated training is terminated, and the target machine learning model is obtained. This allows for the reduction of communication resource consumption while achieving model training under privacy protection.

[0074] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practice. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0075] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0076] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention, but do not constitute an undue limitation of the invention.

[0077] Figure 1 This is a schematic diagram of an application scenario in an embodiment of the present invention;

[0078] Figure 2 This is a flowchart of a model aggregation training method in an embodiment of the present invention;

[0079] Figure 3 This is a flowchart of another model aggregation training method in an embodiment of the present invention;

[0080] Figure 4 This is an interactive flowchart of a model aggregation training method according to an embodiment of the present invention;

[0081] Figure 5 This is a structural block diagram of a model aggregation training device according to an embodiment of the present invention;

[0082] Figure 6 This is a structural block diagram of another model aggregation training device in an embodiment of the present invention;

[0083] Figure 7 This is a schematic diagram of the main training device in an embodiment of the present invention;

[0084] Figure 8 This is a schematic diagram of the structure of the collaborating device in an embodiment of the present invention. Detailed Implementation

[0085] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. Unless otherwise specified, the embodiments and features in the embodiments of this invention can be arbitrarily combined with each other. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0086] The terms "first" and "second" in the specification, claims, and accompanying drawings of this invention are used for descriptive purposes only and should not be construed as indicating or implying relative importance or order. Furthermore, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product, or apparatus that comprises a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0087] Currently, as mentioned earlier, various models based on big data technology rely on data distributed in the corresponding basic scenarios, thus requiring the collection of data from multiple sources. However, when collecting data from multiple sources for model training, there are various data security issues.

[0088] These data security concerns restrict access to the source data. Federated learning allows for collaborative training among multiple parties without sharing source data or centralized data storage, transmitting only model training parameters. However, federated learning itself does not provide theoretical privacy guarantees; exchanging only gradient data still carries the risk of privacy breaches. For example, on the central server side, member inference attacks can be used to analyze the information of collaborating parties involved in training; on the collaborating party side, attackers can completely reconstruct the training source data through gradient analysis. Therefore, privacy protection mechanisms are needed to track privacy during training.

[0089] A common privacy protection method is differential privacy, which adds noise during training to perturb the results and thus resist differential attacks. However, the privacy combination methods of traditional differential privacy mechanisms cannot provide precise privacy definitions. As a result, at the same level of privacy protection, traditional differential privacy mechanisms require more noise and allow fewer federated training rounds, thus significantly reducing the accuracy of the final trained global model.

[0090] Meanwhile, in federated learning training, the single-point limitation caused by the central server as the aggregator can lead to serious communication bottlenecks. Data transmission capacity is directly affected by the bandwidth of the central server. Generally, gradient communication load can be solved by gradient compression. However, in federated learning architectures with privacy protection measures (such as differential privacy mechanisms), when performing gradient model compression optimization for the target bit size of transmission, such as gradient quantization and gradient sparsity, statistical methods are required to determine and learn the compression scheme based on data. This cannot be combined with the differential privacy mechanism of the collaborating parties.

[0091] Therefore, how to reduce communication resource consumption and train the model while protecting privacy has become an urgent problem to be solved.

[0092] In view of this, the present invention provides a model aggregation training method and apparatus. The method distributes an initialized machine learning model to at least one collaborating device, obtains model gradient update parameters sent by each collaborating device, and constructs a model gradient update set. A preset test set is used to perform global model prediction for a federated learning training task, obtaining the accuracy of the current round of model training. The accuracy of the current round of model training is reviewed, and based on the review results and the model gradient update set, a global model update based on Bayesian differential privacy is performed to obtain the updated global model. The current round of global model training is tracked through a first privacy accountant to obtain the privacy cost of the current round. The maximum privacy costs corresponding to all previous training rounds are summarized to obtain the merged privacy cost. If the merged privacy cost is greater than a first preset privacy budget, the federated training is terminated, and the target machine learning model is obtained. In this way, communication resource consumption can be reduced while model training is achieved under privacy protection.

[0093] After introducing the design concept of the embodiments of the present invention, the following is a brief introduction to the application scenarios applicable to the technical solutions of the embodiments of the present invention. It should be noted that the application scenarios described in the embodiments of the present invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. As those skilled in the art will know, with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0094] In practice, the solutions provided by the embodiments of the present invention can be implemented and applied in multiple scenarios, as illustrated below.

[0095] 1. Data security scenarios

[0096] Data security protection is crucial in the storage, application, and sharing of big data resources, especially during big data sharing, where protecting data security and minimizing sharing costs are essential. The technical solution provided by this invention can, in data classification and grading scenarios, collaboratively construct an unstructured classification and grading model using data from multiple parties within a unified industry, thereby improving the accuracy of classification and grading.

[0097] 2. Financial Credit Scenarios

[0098] In this scenario, different financial institutions hope to improve the accuracy of user credit assessment by integrating data from multiple sources. If various parties possess the same characteristics across different users, the technical solution provided in this embodiment of the invention can be adopted, using a central server for federated learning. For example, in financial applications, a user may have multiple loans, such as borrowing money from one financial institution to pay off a loan from another. To accurately identify users in this situation without disclosing the user lists of each financial institution, the technical solution provided in this embodiment of the invention can be used, combined with some encryption mechanisms in federated learning. The user list is encrypted in each financial institution, and the intersection of the encrypted lists is taken in the federation. The final decryption result can obtain a list containing users in the aforementioned situation without exposing the information of trustworthy users.

[0099] Please see Figure 1 The diagram illustrates a scenario to which the invention can be applied. This scenario includes multiple collaborating devices 101 and a main training device 102. Optionally, the collaborating devices 101 can also be understood as devices containing user data, and the main training device 102 can be understood as the aforementioned central server. Figure 1 The example described uses the interaction between three collaborating devices (e.g., collaborating device 101-1, collaborating device 101-2, and collaborating device 101-3) and a main training device 102. In actual implementation, the number of collaborating devices 101 can be 4, 16, etc., and this is not limited in this embodiment of the invention.

[0100] The collaborating device 101 and the main training device 102 can communicate via a network 103. This network 103 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a Wi-Fi (Wi-Fi) network. Of course, it can also be other possible networks, and this embodiment of the invention does not limit them.

[0101] Among them, the collaborating device 101 and the main training device 102 can be understood as independent physical servers, or as a server cluster or distributed system composed of multiple physical servers. They can also be cloud servers or cloud server clusters that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, but are not limited to these.

[0102] In the specific implementation process, the main training device 102 can distribute the initialized machine learning model to at least one collaborating device, then obtain the model gradient update parameters sent by at least one collaborating device 101, and construct a model gradient update set; use a preset test set to perform global model prediction for the federated learning training task, obtain the model accuracy for this round, review the accuracy of this round of model training, and based on the obtained review results and the model gradient update set, perform a global model update based on Bayesian differential privacy to obtain the updated global model; track the training process of the global model for this round through a first privacy accountant to obtain the privacy cost for this round; summarize the maximum privacy costs corresponding to all training rounds before this round to obtain the merged privacy cost; if the merged privacy cost is greater than the first preset privacy budget, determine to end the federated training and obtain the target machine learning model.

[0103] To further illustrate the model aggregation training method provided in the embodiments of the present invention, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of the present invention provide method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of the present invention. In actual processing or device execution, the method may be executed in the order shown in the embodiments or drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing application environment).

[0104] The following combination Figure 2 The flowchart shown illustrates the model aggregation training method in this embodiment of the invention. Figure 2 The steps shown can be derived from, for example: Figure 1 The main training device shown is used for execution.

[0105] Step 201: Send the initialized machine learning model to at least one collaborating device, obtain the model gradient update parameters sent by at least one collaborating device, and construct a model gradient update set based on the obtained model gradient update parameters; wherein, the model gradient update parameters are obtained by the collaborating device after training the initialized machine learning model based on local data.

[0106] In this embodiment of the invention, the main training device uses Bayesian differential privacy (BDP) technology to create a first privacy accountant. Optionally, the first privacy accountant can be called a Bayesian privacy accountant, which can be understood as a privacy tracking tool constructed using Bayesian differential privacy technology. The main training device can use the Bayesian privacy accountant to achieve privacy tracking during global model aggregation.

[0107] In this embodiment of the invention, the main training device can send the packaged federated learning application and its dependencies to a portable lightweight container in at least one collaborating device, so that at least one collaborating device can create a local training environment for the initialized machine learning model.

[0108] Optionally, the main training device can also initialize a model management service, which performs persistent storage, grouping, and other operations to determine at least one collaborating device that will distribute the initialized machine learning model according to the preset federated learning training parameters. In this way, the main training device can determine at least one collaborating device that will distribute the initialized machine learning model based on the certified collaborating device set in the preset federated learning training parameters, and then distribute the initialized machine learning model to at least one collaborating device.

[0109] Optionally, the aforementioned federated learning training parameters may also include exposing relevant gPRC interfaces and Hypertext Transfer Protocol (HTTP) interfaces, delegating all requests from external systems to the gateway service for request forwarding, setting the maximum number of communication rounds for the federated training task, and setting a random rate for dynamic accuracy review, etc.

[0110] In this embodiment of the invention, the main training device can obtain model gradient update parameters sent by at least one collaborating device. Then, the main training device can format and parse each obtained model gradient update parameter to obtain processed model gradient update parameters, and then construct a model gradient update set based on all obtained processed model gradient update parameters.

[0111] Step 202: Use a preset test set to perform global model prediction for the federated learning training task, obtain the accuracy of the model in this round, review the accuracy of the model in this round, and perform global model update based on Bayesian differential privacy according to the obtained review results and model gradient update set to obtain the updated global model. The global model includes all initialized machine learning models trained on at least one collaborating device.

[0112] In this embodiment of the invention, considering that adding noise during the gradient descent phase of the collaborating device's model training and the aggregation phase in the main training device can cause the federated learning algorithm to converge slowly or diverge completely, the main training device can use a preset test set to perform global model prediction for the federated learning training task, obtain the model accuracy for this round, and review the accuracy of this round of model training.

[0113] Optionally, if it is determined that the model task prediction result is within the preset accuracy review range, a global model update based on Bayesian differential privacy is performed based on the mutual exclusion probability of the dynamic accuracy review random rate and the model gradient update set to obtain the updated global model. Specifically, the main training device can use a review re-aggregation strategy with the review random rate parameter as the probability to collect the gradient update data of each collaborator in this round into the model gradient update dataset, while reducing the review random rate parameter value to reduce the probability of review re-aggregation in the next round, thereby increasing the training randomness. The review re-aggregation strategy can be understood as directly updating the global model with the mutual exclusion probability of the review random rate parameter, increasing the review random rate parameter value to increase the probability of review re-aggregation in the next round. If it is determined that the model task prediction result is not within the preset accuracy review range, a global model update is performed directly.

[0114] In this embodiment of the invention, the main training device can use the processed model gradient update dataset to perform global model updates based on Bayesian differential privacy. A subsampled Gaussian noise mechanism, combined with a sampling estimator, is applied to the global model update to perform hierarchical noise perturbation based on the training model, thereby eliminating the non-independent and identically distributed characteristics of data from different collaborating devices.

[0115] Step 203: Track the current training process of the global model through the first privacy accounting method to obtain the privacy cost of this round; summarize the maximum privacy cost corresponding to all training rounds before this round to obtain the merged privacy consumption.

[0116] Step 204: If the combined privacy cost is greater than the first preset privacy budget, determine to end federated training and obtain the target machine learning model.

[0117] In this embodiment of the invention, the main training device can use Bayesian privacy accounting to calculate the privacy cost of this round. However, since the collaborating device also uses local differential privacy training, the total privacy cost accounting needs to be combined with the noise parameters of the collaborating device and then recalculate the privacy cost to obtain the combined privacy cost.

[0118] As can be seen, in this embodiment of the invention, a subsampled Gaussian noise mechanism is used in global model aggregation, hierarchical noise perturbation is implemented based on the trained model in global model update, and privacy merging is performed by combining the noise of collaborators during privacy tracking. This enables more accurate global privacy tracking and prevents premature termination of training before the federated task is completed. Furthermore, based on privacy protection and communication compression, a dynamic accuracy check is proposed to dynamically monitor and handle disordered phenomena in the model training task without requiring manual resetting of the training task.

[0119] The following combination Figure 3 The flowchart shown illustrates the model aggregation training method in this embodiment of the invention. Figure 3 The steps shown can be derived from, for example: Figure 1 The collaborating device shown is executing the commands.

[0120] Step 301: In response to the initialized machine learning model sent by the main training device, perform data preprocessing on the local data, construct a local training dataset based on the obtained preprocessed data, and create a second privacy accountant.

[0121] In this embodiment of the invention, the collaborating device can unpack the federated learning application and its dependencies in a portable lightweight container, and build a local training environment for the model based on the federated learning application and its dependencies; perform data preprocessing on the local source data to obtain a local training dataset; the data preprocessing includes one or more of the following: distinguishing feature matrices, processing missing data, encoding categorical data, and feature scaling.

[0122] In this embodiment of the invention, the collaborating device can use slice sampling or random sampling to amplify the privacy of preset privacy data, obtaining an initialized second privacy account. The initialized second privacy account can be understood as an initialized Gaussian privacy account. The collaborating device can use Gaussian difference privacy technology, i.e., hypothesis testing, to measure the privacy output and obtain the preset Gaussian privacy account. f can be understood as the trade-off function used in the aforementioned measurement; therefore, the initialized second privacy account can be simply referred to as f-privacy account. By using slice sampling and random sampling to amplify the preset privacy data a second time, a fine-grained characterization of privacy consumption is achieved, thereby ensuring a higher model prediction accuracy at the same level of privacy protection.

[0123] Step 302: Based on the local data training set, perform local model training on the initialized machine learning model to obtain model gradient update data.

[0124] Step 303: Based on the model gradient update data and the preset sending strategy, send the model gradient update data to the main training device; the preset sending strategy is used to determine whether to skip gradient checking and send the model gradient update data directly.

[0125] In this embodiment of the invention, the collaborating device can perform data quality analysis on the model gradient update data to obtain the exemption weights. If the exemption weights meet the preset range, the gradient check is skipped, and the model gradient update data is uploaded to the main training device. If the exemption weights do not meet the preset range, the gradient check is not skipped, and the first contribution value generated after this round of training is obtained based on the global model parameter values ​​before this round, the average model parameters corresponding to all collaborating devices in this round, and the differential correction function. When the first contribution value is not less than the average contribution value, the model gradient update data is transmitted to the main training device.

[0126] In this way, the gradient exchange compression method mentioned above can be extended under the differential privacy mechanism. It adaptively calculates and skips some interactive communication, and realizes inspection relaxation through differential correction function and inspection-free weight. This prevents the training task from crashing due to excessive noise under the differential privacy mechanism, and effectively solves the single-point communication bottleneck problem between collaborating devices and main training devices under privacy protection.

[0127] Step 304: Conduct a local privacy check according to the second privacy accounting, and determine whether to participate in federal training based on the check results.

[0128] In this embodiment of the invention, the collaborating device can use the second privacy accounting to update the local privacy consumption, use the central limit theorem to perform privacy merging, and obtain the target privacy cost; if the target privacy cost exceeds the second preset privacy cost, it is determined not to participate in federated training.

[0129] In this embodiment of the invention, for a clearer description of the model aggregation training method provided in this embodiment, please refer to [link to relevant documentation]. Figure 4 The following example illustrates the interaction between a main training device and a collaborating device.

[0130] Step 401: The main training device builds a machine learning model, initializes the machine learning model parameters, federated training parameters, and Bayesian privacy accounting, and distributes the initialized machine learning model to at least one collaborating device.

[0131] Step 402: In response to the initialized machine learning model sent by the main training device, the collaborating device performs data preprocessing on the local data and constructs a local training dataset based on the obtained preprocessed data.

[0132] Step 403: The collaborating device trains the initialized machine learning model locally based on the local data training set, obtains model gradient update data, and sends the model gradient update data to the main training device according to the model gradient update data and the preset sending strategy; wherein, the preset sending strategy is used to determine whether to skip gradient checking and send the model gradient update data directly.

[0133] Optionally, in this embodiment of the invention, the collaborating device can first create an f-privacy account, and then perform a local privacy check based on the f-privacy account. Based on the check result, it can then determine whether to participate in federated training. Specifically, the collaborating device can update its local privacy consumption using a second privacy account, perform privacy merging using the central limit theorem, and obtain a target privacy cost. If the target privacy cost exceeds a second preset privacy cost, it is determined not to participate in federated training. If the target privacy cost does not exceed the second preset privacy cost, the collaborating device repeatedly executes local training until the training task ends, and no longer receives the latest machine learning model from the main training device.

[0134] Step 404: The main training device obtains model gradient update parameters sent by at least one collaborating device, and constructs a model gradient update set based on the obtained model gradient update parameters.

[0135] Step 405: The main training device uses a preset test set to perform global model prediction for the federated learning training task, obtains the accuracy of the model in this round, reviews the accuracy of the model in this round, and performs a global model update based on Bayesian differential privacy based on the obtained review results and the model gradient update set to obtain the updated global model.

[0136] Step 406: The main training device tracks the current training process of the global model through the first privacy accountant to obtain the privacy cost of this round; it summarizes the maximum privacy cost corresponding to all training rounds before this round to obtain the merged privacy cost; if the merged privacy cost is greater than the first preset privacy budget, it determines to end the federated training and obtains the target machine learning model.

[0137] As can be seen, in this embodiment of the invention, dual privacy tracking is used. Bayesian differential privacy effectively calibrates noise to achieve differential privacy protection on the main training device side, while the strict privacy definition of f-differential privacy achieves differential privacy protection on the collaborating device side. Simultaneously, the collaborating device side can set a local privacy policy, ceasing participation in federated training when the custom privacy budget (i.e., the second preset privacy cost) is exceeded, which facilitates self-control of the collaborating device's local privacy. Furthermore, by combining the aforementioned two privacy tracking methods, privacy guarantees at both the collaborating device level and the data record level are achieved, effectively resisting member inference attacks and model analysis attacks.

[0138] Based on the same inventive concept, embodiments of the present invention provide a model aggregation training device that can realize the functions corresponding to the aforementioned model aggregation training method applied to a main training device. This model aggregation training device can be a hardware structure, a software module, or a hardware structure plus a software module. The model aggregation training device can be implemented by a chip system, which can consist of chips or include chips and other discrete components. Please refer to [link to previous text]. Figure 5 As shown, the model aggregation training device includes:

[0139] The first processing unit 501 is configured to send the initialized machine learning model to at least one collaborating device, obtain the model gradient update parameters sent by the at least one collaborating device, and construct a model gradient update set based on the obtained at least one model gradient update parameter; wherein, the model gradient update parameter is obtained by the collaborating device after training the initialized machine learning model based on local data.

[0140] The second processing unit 502 is used to perform global model prediction for federated learning training tasks using a preset test set, obtain the accuracy of the current round of model, review the accuracy of the current round of model, and perform global model update based on Bayesian differential privacy according to the obtained review results and the model gradient update set to obtain the updated global model. The global model includes all initialized machine learning models trained on the at least one collaborating device.

[0141] The first obtaining unit 503 is used to track the current training process of the global model through the first privacy accounting to obtain the current privacy cost; and to summarize the maximum privacy cost corresponding to all training rounds before the current round to obtain the merged privacy consumption.

[0142] The second obtaining unit 504 is used to determine the end of federated training and obtain the target machine learning model if the merged privacy consumption is greater than the first preset privacy budget.

[0143] In one possible implementation, before distributing the initialized machine learning model to at least one collaborating device, the first processing unit 501 is further configured to:

[0144] Create the first privacy accountant using Bayesian differential privacy technology.

[0145] In one possible implementation, before distributing the initialized machine learning model to at least one collaborating device, the first processing unit 501 is further configured to:

[0146] The packaged federated learning application and its dependencies are sent to a portable, lightweight container in the at least one collaborating device, enabling the at least one collaborating device to create a local training environment for the initialized machine learning model; and,

[0147] Based on the set of certified collaborators in the preset federated learning training parameters, at least one collaborator device is determined to distribute the initialized machine learning model.

[0148] In one possible implementation, the second processing unit 502 is configured to:

[0149] If it is determined that the prediction result of the model task is within the preset accuracy review range, a global model update based on Bayesian differential privacy is performed based on the mutual exclusion probability of the dynamic accuracy review random rate and the model gradient update set to obtain the updated global model.

[0150] In one possible implementation, the second processing unit 502 is configured to:

[0151] Using a subsampled Gaussian noise mechanism, combined with a preset sampling estimator, hierarchical noise perturbation based on a learning machine model is performed in the global model update to eliminate the non-independent and identically distributed characteristics of data from the at least one collaborating device.

[0152] Based on the same inventive concept, embodiments of the present invention provide a model aggregation training device that can realize the functions corresponding to the aforementioned model aggregation training method applied to collaborating device. This model aggregation training device can be a hardware structure, a software module, or a hardware structure plus a software module. The model aggregation training device can be implemented by a chip system, which can consist of chips or include chips and other discrete components. Please refer to [link to previous text]. Figure 6 As shown, the model aggregation training device includes:

[0153] The response unit 601 is used to respond to the initialized machine learning model sent by the main training device, perform data preprocessing on the local data, construct a local training dataset based on the obtained preprocessed data, and create a second privacy account.

[0154] The obtaining unit 602 is used to perform local model training on the initialized machine learning model based on the local data training set to obtain model gradient update data.

[0155] The sending unit 603 is used to send the model gradient update data to the main training device according to the model gradient update data and the preset sending strategy; the preset sending strategy is used to determine whether to skip gradient checking and send the model gradient update data directly.

[0156] Processing unit 604 is configured to perform a local privacy check based on the second privacy accounting, and determine whether to participate in federal training based on the check results.

[0157] In one possible implementation, the response unit 601 is specifically used for:

[0158] Unpack the federated learning application and its dependencies in a portable, lightweight container, and build a local training environment for the model based on the federated learning application and its dependencies.

[0159] The local source data is preprocessed to obtain a local training dataset; the data preprocessing includes one or more of the following: distinguishing feature matrix, processing missing data, encoding classification data, and feature scaling.

[0160] Privacy amplification is performed on preset privacy data using slice sampling or random sampling to obtain an initialized second privacy accountant.

[0161] In one possible implementation, the transmitting unit 603 is configured to:

[0162] Data quality analysis is performed on the gradient update data of the model to obtain the inspection-free weights;

[0163] If the exempt weights meet the preset range, then skip the gradient check and upload the model gradient update data to the main training device;

[0164] If the exemption weight does not meet the preset range, the gradient check is not skipped, and the first contribution value generated after this round of training is obtained based on the global model parameter value before this round, the average model parameter value corresponding to all collaborating devices in this round, and the differential correction function; when the first contribution value is not less than the average contribution value, the model gradient update data is transmitted to the main training device.

[0165] In one possible implementation, the processing unit 604 is configured to:

[0166] The local privacy cost is updated using the second privacy accounting method, and privacy merging is performed using the central limit theorem to obtain the target privacy cost.

[0167] If the target privacy cost exceeds the second preset privacy cost, it is determined that the organization will not participate in federated training.

[0168] All relevant content of each step involved in the aforementioned embodiments of the model aggregation training method can be referenced to the functional description of the corresponding functional module of the model aggregation training device in the embodiments of the present invention, and will not be repeated here.

[0169] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single controller, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0170] Based on the same inventive concept, embodiments of the present invention provide a main training device; please refer to [link to related information]. Figure 7 As shown, the main training device includes at least one processor 701 and a memory 702 connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor 701 and the memory 702 is not limited. Figure 7 Taking the connection between processor 701 and memory 702 via bus 700 as an example, bus 700 in... Figure 7 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 700 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 7 The symbol is represented by a single thick line, but this does not indicate that there is only one bus or one type of bus. Furthermore, the model aggregation training device also includes a communication interface 703 for receiving or sending data.

[0171] In this embodiment of the invention, the memory 702 stores instructions that can be executed by at least one processor 701. By executing the instructions stored in the memory 702, at least one processor 701 can perform the steps included in the aforementioned model aggregation training method.

[0172] The processor 701 is the control center of the main training device. It can connect to various parts of the main training device through various interfaces and lines. By running or executing instructions stored in memory 702 and calling data stored in memory 702, it can monitor the various functions and data processing of the main training device as a whole.

[0173] Optionally, processor 701 may include one or more processing units. Processor 701 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 701. In some embodiments, processor 701 and memory 702 may be implemented on the same chip; in some embodiments, they may be implemented separately on independent chips.

[0174] Processor 701 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0175] Memory 702, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 702 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 702 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In embodiments of the present invention, memory 702 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0176] By designing and programming the processor 701, the code corresponding to the model aggregation training method described in the foregoing embodiments can be embedded into the chip, so that the chip can execute the steps of the aforementioned model aggregation training method when running. How to design and program the processor 701 is a well-known technique to those skilled in the art, and will not be described in detail here.

[0177] Based on the same inventive concept, embodiments of the present invention provide a collaborating device; please refer to [link / reference]. Figure 8 As shown, the collaborating device includes at least one processor 801 and a memory 802 connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor 801 and the memory 802 is not limited. Figure 8 Taking the connection between processor 801 and memory 802 via bus 800 as an example, bus 800 in... Figure 8 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 800 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 8 The symbol is represented by a single thick line, but this does not indicate that there is only one bus or one type of bus. Furthermore, the model aggregation training device also includes a communication interface 803 for receiving or sending data.

[0178] In this embodiment of the invention, the memory 802 stores instructions that can be executed by at least one processor 801. By executing the instructions stored in the memory 802, at least one processor 801 can perform the steps included in the aforementioned model aggregation training method.

[0179] The processor 801 is the control center of the collaborating device. It can connect to various parts of the collaborating device through various interfaces and lines. By running or executing instructions stored in the memory 802 and calling data stored in the memory 802, it can monitor the various functions and data processing of the collaborating device as a whole.

[0180] Optionally, processor 801 may include one or more processing units. Processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 801. In some embodiments, processor 801 and memory 802 may be implemented on the same chip; in some embodiments, they may be implemented separately on independent chips.

[0181] Processor 801 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0182] Memory 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 802 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 802 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In embodiments of the present invention, memory 802 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0183] By designing and programming the processor 801, the code corresponding to the model aggregation training method described in the foregoing embodiments can be embedded into the chip, so that the chip can execute the steps of the aforementioned model aggregation training method when running. How to design and program the processor 801 is a well-known technique to those skilled in the art, and will not be described in detail here.

[0184] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions, which, when executed on a computer, cause the computer to perform the aforementioned actions. Figure 2 , Figure 3 The steps of the model aggregation training method are shown.

[0185] In some possible implementations, various aspects of the model aggregation training method provided by the present invention can also be implemented in the form of a program product, which includes program code that, when the program product is run on a control master training device or collaborating device, causes the control master training device or collaborating device to perform the steps in the model aggregation training method according to various exemplary embodiments of the present invention described above.

[0186] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0187] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0188] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0189] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0190] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A model aggregation training method, characterized in that, Applied to the main training device, the method includes: The initialized machine learning model is sent to at least one collaborating device, and the model gradient update parameters sent by the at least one collaborating device are obtained respectively. A model gradient update set is constructed based on the obtained at least one model gradient update parameter. The model gradient update parameter is obtained by the collaborating device after training the initialized machine learning model based on local data. Global model prediction for federated learning training task is performed using a preset test set to obtain the accuracy of the current round of model training. The accuracy of the current round of model training is reviewed, and based on the review results and the model gradient update set, a global model update based on Bayesian differential privacy is performed to obtain the updated global model. The global model includes all initialized machine learning models trained on the at least one collaborating device. The current training process of the global model is tracked through the first privacy accounting method to obtain the privacy cost of this round; the maximum privacy cost corresponding to all training rounds before this round is summarized to obtain the combined privacy consumption; If the privacy consumption of the merged model exceeds the first preset privacy budget, the federated training is terminated, and the target machine learning model is obtained.

2. The method as described in claim 1, characterized in that, Before distributing the initialized machine learning model to at least one collaborating device, the method further includes: Create the first privacy accountant using Bayesian differential privacy technology.

3. The method as described in claim 2, characterized in that, Before distributing the initialized machine learning model to at least one collaborating device, the method further includes: The packaged federated learning application and its dependencies are sent to a portable, lightweight container in the at least one collaborating device, enabling the at least one collaborating device to create a local training environment for the initialized machine learning model; and, Based on the set of certified collaborators in the preset federated learning training parameters, at least one collaborator device is determined to distribute the initialized machine learning model.

4. The method according to any one of claims 1-3, characterized in that, Based on the obtained review results and the model gradient update set, a global model update based on Bayesian differential privacy is performed to obtain the updated global model, including: If it is determined that the prediction result of the model task is within the preset accuracy review range, a global model update based on Bayesian differential privacy is performed based on the mutual exclusion probability of the dynamic accuracy review random rate and the model gradient update set to obtain the updated global model.

5. The method as described in claim 4, characterized in that, Perform global model updates based on Bayesian differential privacy, including: Using a subsampled Gaussian noise mechanism, combined with a preset sampling estimator, hierarchical noise perturbation based on a learning machine model is performed in the global model update to eliminate the non-independent and identically distributed characteristics of data from the at least one collaborating device.

6. A model aggregation training method, characterized in that, Applied to collaborating device, the method includes: In response to the initialized machine learning model sent by the main training device, the local data is preprocessed, a local training dataset is constructed based on the obtained preprocessed data, and privacy amplification of the preset privacy data is performed using slice sampling or random sampling to obtain a second privacy account. Based on the local training dataset, the initialized machine learning model is trained locally to obtain model gradient update data; Based on the model gradient update data and the preset sending strategy, the model gradient update data is sent to the main training device; the preset sending strategy is used to determine whether to skip gradient checking and directly send the model gradient update data. According to the second privacy accounting, a local privacy check is performed, and the result of the check determines whether to participate in federal training.

7. The method as described in claim 6, characterized in that, In response to the initialized machine learning model received from the main training device, the local data is preprocessed, and a local training dataset is constructed based on the obtained preprocessed data, including: Unpack the federated learning application and its dependencies in a portable, lightweight container, and build a local training environment for the model based on the federated learning application and its dependencies. Local source data is preprocessed to obtain a local training dataset; the data preprocessing includes one or more of the following: distinguishing feature matrices, processing missing data, encoding categorical data, and feature scaling.

8. The method as described in claim 7, characterized in that, Based on the model gradient update data and a preset sending strategy, the model gradient update data is sent to the main training device, including: Data quality analysis is performed on the gradient update data of the model to obtain the inspection-free weights; If the exempt weights meet the preset range, then skip the gradient check and upload the model gradient update data to the main training device; If the exemption weight does not meet the preset range, the gradient check is not skipped, and the first contribution value generated after this round of training is obtained based on the global model parameter value before this round, the average model parameter value corresponding to all collaborating devices in this round, and the differential correction function; when the first contribution value is not less than the average contribution value, the model gradient update data is transmitted to the main training device.

9. The method as described in any one of claims 6-8, characterized in that, According to the second privacy accounting, a local privacy check is performed, and based on the check results, it is determined whether to participate in federal training, including: The local privacy cost is updated using the second privacy accounting method, and privacy merging is performed using the central limit theorem to obtain the target privacy cost. If the target privacy cost exceeds the second preset privacy cost, it is determined that the organization will not participate in federated training.

10. A model aggregation training device, characterized in that, Applied to a main training device, the device includes: The first processing unit is configured to send the initialized machine learning model to at least one collaborating device, obtain the model gradient update parameters sent by the at least one collaborating device, and construct a model gradient update set based on the obtained at least one model gradient update parameter; wherein the model gradient update parameter is obtained by the collaborating device after training the initialized machine learning model based on local data. The second processing unit is used to perform global model prediction for federated learning training tasks using a preset test set, obtain the accuracy of the current round of model training, review the accuracy of the current round of model training, and perform global model update based on Bayesian differential privacy according to the obtained review results and the model gradient update set to obtain the updated global model. The global model includes all initialized machine learning models trained on the at least one collaborating device. The first obtaining unit is used to track the current training process of the global model through the first privacy accounting to obtain the privacy cost of the current round; and to summarize the maximum privacy cost corresponding to all training rounds before the current round to obtain the merged privacy consumption. The second obtaining unit is used to determine to end federated training and obtain the target machine learning model if the merged privacy consumption is greater than the first preset privacy budget.

11. The apparatus as claimed in claim 10, characterized in that, Before distributing the initialized machine learning model to at least one collaborating device, the first processing unit is further configured to: Create the first privacy accountant using Bayesian differential privacy technology.

12. The apparatus as claimed in claim 11, characterized in that, Before distributing the initialized machine learning model to at least one collaborating device, the first processing unit is further configured to: The packaged federated learning application and its dependencies are sent to a portable lightweight container in the at least one collaborating device, so that the at least one collaborating device can create a local training environment for the initialized machine learning model. as well as, Based on the set of certified collaborators in the preset federated learning training parameters, at least one collaborator device is determined to distribute the initialized machine learning model.

13. The apparatus according to any one of claims 10-12, characterized in that, The second processing unit is used for: If it is determined that the prediction result of the model task is within the preset accuracy review range, a global model update based on Bayesian differential privacy is performed based on the mutual exclusion probability of the dynamic accuracy review random rate and the model gradient update set to obtain the updated global model.

14. The apparatus as claimed in claim 13, characterized in that, The second processing unit is used for: Using a subsampled Gaussian noise mechanism, combined with a preset sampling estimator, hierarchical noise perturbation based on a learning machine model is performed in the global model update to eliminate the non-independent and identically distributed characteristics of data from the at least one collaborating device.

15. A model aggregation training device, characterized in that, Applied to collaborating equipment, the device includes: The response unit is used to respond to the initialized machine learning model sent by the main training device, perform data preprocessing on the local data, construct a local training dataset based on the obtained preprocessed data, and use slice sampling or random sampling to amplify the privacy of the preset privacy data to obtain a second privacy account. The obtaining unit is used to perform local model training on the initialized machine learning model based on the local training dataset to obtain model gradient update data; The sending unit is used to send the model gradient update data to the main training device according to the model gradient update data and the preset sending strategy; the preset sending strategy is used to determine whether to skip gradient checking and send the model gradient update data directly. The processing unit is configured to perform a local privacy check based on the second privacy accounting, and determine whether to participate in federal training based on the check results.

16. The apparatus as claimed in claim 15, characterized in that, The response unit is specifically used for: Unpack the federated learning application and its dependencies in a portable, lightweight container, and build a local training environment for the model based on the federated learning application and its dependencies. Perform data preprocessing on the local source data to obtain the local training dataset; The data preprocessing includes one or more of the following: distinguishing feature matrices, processing missing data, encoding categorical data, and feature scaling.

17. The apparatus as claimed in claim 16, characterized in that, The transmitting unit is used for: Data quality analysis is performed on the gradient update data of the model to obtain the inspection-free weights; If the exempt weights meet the preset range, then skip the gradient check and upload the model gradient update data to the main training device; If the exemption weight does not meet the preset range, the gradient check is not skipped, and the first contribution value generated after this round of training is obtained based on the global model parameter value before this round, the average model parameter value corresponding to all collaborating devices in this round, and the differential correction function; when the first contribution value is not less than the average contribution value, the model gradient update data is transmitted to the main training device.

18. The apparatus as described in any one of claims 15-17, characterized in that, The processing unit is used for: The local privacy cost is updated using the second privacy accounting method, and privacy merging is performed using the central limit theorem to obtain the target privacy cost. If the target privacy cost exceeds the second preset privacy cost, it is determined that the organization will not participate in federated training.

19. A master training device, characterized in that, The main training device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the model aggregation training method as described in any one of claims 1 to 5.

20. A collaborative device, characterized in that, The collaborating device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the model aggregation training method as described in any one of claims 6 to 9.

21. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the model aggregation training method as claimed in any one of claims 1 to 5 or any one of claims 6 to 9.

Images