Privacy-enhanced federated learning system with cloud-edge integration

Abstract

The present application relates to a privacy-enhanced federated learning system that integrates cloud, edge, and end. The system includes: a cloud center, an edge server, and a terminal. The cloud center and the terminal respectively use an adaptive control algorithm to solve a configuration optimization model to obtain the number of local iterations, the terminal sampling rate, the offloading decision, and the noise intensity to the edge server during offloading. The cloud center selects the terminal to participate in the training based on the terminal sampling rate. When the offloading decision is 1, the selected terminal divides the global model received from the cloud center into a shallow network layer and a deep network layer. The terminal perturbs the intermediate features of the shallow network layer under the current input batch based on the noise intensity to the edge server and the first differential privacy function. After performing end-edge iterative training based on the number of local iterations and the perturbed intermediate features, the terminal merges the trained shallow network layer and the deep network layer to obtain a trained local model. The use of this system can improve the efficiency of model training and resist edge and cloud threat attacks.

Description

Technical Field

[0001] The present application relates to the field of federated learning technology, and in particular to a privacy-enhanced federated learning system that integrates cloud, edge, and end. Background Art

[0002] The continuous advancement of mobile computing technology has led to the generation of vast amounts of data on ubiquitous smart devices. Combined with advanced artificial intelligence algorithms, this has fostered a wide range of applications in healthcare, mobile social networks, smart cities, and other fields. However, user awareness of personal data privacy has severely hindered the centralized collection and utilization of this fruitful data. Recently, federated learning has garnered attention by offering a solution for distributed data owners to collaboratively train machine learning models in parallel while preserving sensitive data locally. Indeed, federated learning has already been applied in products such as smart transportation and social news recommendations.

[0003] Traditional federated learning architectures typically adopt a cloud-device framework. Local training and global aggregation are performed alternately and iteratively on the device and cloud, respectively, for model optimization. However, the practical implementation of this framework inevitably faces resource and privacy challenges. Training complex models containing multiple multi-unit network layers can easily consume the device's CPU and even impact its normal performance. Furthermore, the network environment of the device is dynamically changing, especially the upload link. Frequent local model uploads lead to inefficient communication. Based on the model updates uploaded by the device, the cloud center honestly aggregates these updates, but out of curiosity, it can still recover the original training data and infer sensitive user information. These two issues, as two major obstacles to federated learning, have been extensively and independently studied in existing work. On the one hand, some researchers have proposed improving resource utilization by optimizing the scheduling of local training and global communication tasks. Furthermore, specialized DNN (Deep Neural Network) compression techniques have been proposed to reduce the communication burden during computation offloading. On the other hand, to enhance privacy, homomorphic encryption, multi-party computation, and differential privacy mechanisms have been widely used. Among them, differential privacy is more suitable for lightweight computing, and its privacy guarantee will change dynamically according to various factors in federated learning (such as the number of communication rounds).

[0004] However, the two approaches discussed above address training efficiency and data privacy in federated learning separately, ignoring the fact that these two issues are non-orthogonal to model training. Pursuing training efficiency alone may amplify privacy threats to local data, while the resulting privacy overhead or noise can reduce the efficiency and inference accuracy of federated learning. Summary of the Invention

[0005] Based on this, it is necessary to provide a privacy-enhanced federated learning system that integrates cloud, edge, and end to address the above technical issues.

[0006] A privacy-enhanced federated learning system that integrates cloud, edge, and end devices, comprising:

[0007] A cloud center, an edge server, and a terminal; the cloud center is connected to the edge server, and the edge server is connected to the terminal;

[0008] The cloud center and the terminal respectively use a preset adaptive control algorithm to solve the preset configuration optimization model, and obtain the number of local iterations, the terminal sampling rate, the offloading decision, and the noise intensity on the edge server during offloading;

[0009] The cloud center selects a terminal to participate in the training according to the terminal sampling rate. When the offloading decision is 1, the selected terminal divides the global model received from the cloud center into a shallow network layer and a deep network layer.

[0010] The terminal perturbs the intermediate features of the shallow network layer under the current input batch according to the noise intensity of the edge server and the first differential privacy function, and sends the perturbed intermediate features and the deep network layer to the edge server;

[0011] The edge server trains the deep network layer according to the perturbed intermediate features using a gradient descent method, and returns the gradient value of the terminal loss function with respect to the perturbed intermediate features to the terminal;

[0012] The terminal updates the shallow network layer according to the gradient value, performs end-edge iterative training according to the number of local iterations, and merges the trained shallow network layer and the trained deep network layer received from the edge server to obtain a trained local model.

[0013] In one embodiment, the further step includes: constructing a configuration optimization model based on pre-set resource constraints and pre-set privacy constraints, with minimizing the global loss function value as the objective function.

[0014] In one embodiment, the method further includes: obtaining a resource constraint based on the computing resources consumed by training at the current number of iterations, the communication resources consumed by aggregation at the current number of aggregation rounds, the resource budget, and the offloading decision:

[0015]

[0016] Among them, x k =1 means that the network layer is unloaded in the kth round of federation aggregation, xk=0 means that the terminal chooses to train all network layers locally for privacy reasons, x k ∈X, X is the unloading decision, X={x1,x2…x K}, K is the number of global aggregation rounds, when x k = 1, each training iteration consumes c off Units of computing resources, each aggregation consumes b off Units of communication resources, when x k = 0, each training iteration consumes c loc Units of computing resources, each aggregation consumes b loc units of communication resources, R is the resource budget, and τ represents the number of local iterations in each round of aggregate training.

[0017] In one embodiment, the method further includes: obtaining the privacy constraints as follows based on the preset privacy budget of the edge server, the preset privacy budget of the cloud center, and differential privacy theory:

[0018] H(ε0,b / |D i |,τ,δ′ e )≤ε e

[0019] H(ε0,s,K,δ′ c )≤ε c

[0020] Among them, ε e is the privacy budget of the edge server, ε c is the privacy budget of the cloud center, H is the privacy protection function, ε0 is the initial value. When analyzing the privacy situation during task offloading, p b is the ratio of batch size b to dataset size, z is the number of local training times, and when analyzing the privacy of model parameters during aggregation, p b is the sampling rate of the terminal, z is the number of global aggregation rounds, δ′ e is the preset edge server constant, δ′ c is the preset cloud center constant, D i is the data set of terminal i, and s is the terminal sampling rate.

[0021] In one embodiment, the objective function is:

[0022]

[0023] Where ρ is any f i (w) and the Lipschitz constant of F(w), F(w) is the global loss function value, f i (w) is the loss function of terminal i, D i is the data set of terminal i, D i ∈D, D={D1,D2…D N}, N is the number of terminal devices, h(τ) is the distance between the model parameters obtained by distributed learning and centralized learning, η is the learning rate, φ is the control constant, T is the total number of training times, T = τ* K , β is any f i (w) and F(w), μ is the weighted average of the global dataset size, ||▽f i (w)-▽F(w)||≤μ i , ▽f i (w) is the gradient of the loss function of terminal i with respect to w, and ▽F(w) is the gradient of the global loss function F with respect to w.

[0024] In one embodiment, it also includes: when each terminal participating in the training receives the global model, the Lipschitz constant, smoothing constant, loss function and gradient value corresponding to the terminal are calculated to reflect the distributed training state, and the corresponding distributed training state is uploaded to the cloud center; the cloud center linearly searches for the optimal local iteration number within the interval to which the local iteration number belongs based on the distributed training state corresponding to each terminal participating in the training, the weighted average sum of the global data set size and the objective function; when the optimal local iteration number meets the resource constraint, the cloud center returns the optimal local iteration number to the terminal as the local iteration number in the next round of aggregation.

[0025] In one embodiment, it also includes: the cloud center calculates the current cumulative privacy budget consumed by the cloud center according to the privacy protection function to obtain the remaining privacy budget of the current cloud center, and estimates the remaining number of aggregation rounds based on the optimal number of local iterations and the current remaining resource budget of the cloud center; searches for the optimal terminal sampling rate according to the remaining number of aggregation rounds and a preset first search step size, so that the current remaining resource budget and the current remaining privacy budget of the cloud center are consumed at the same time; the cloud center uses the optimal terminal sampling rate as the terminal sampling rate for the next round of aggregation.

[0026] In one embodiment, the terminal further includes: obtaining a privacy budget to be consumed by the edge server based on the optimal number of local iterations, the current corresponding local configuration, and the privacy protection function; when the privacy budget to be consumed by the edge server exceeds a preset privacy budget of the edge server, increasing the noise intensity of the edge server by a preset second search step until the privacy constraint is satisfied, outputting the optimal noise intensity of the edge server, and setting the offloading decision to 1; if the noise intensity is not within the preset range that satisfies the privacy budget, setting the offloading decision to 0.

[0027] In one embodiment, the method further includes: obtaining a first sensitivity of a first differential privacy function according to the maximum value and the minimum value of each activation unit in the shallow network model; and constructing a first differential privacy function according to the first sensitivity as follows:

[0028]

[0029] Among them, O represents the intermediate feature, σ e represents the noise intensity to the edge server, S f represents a first sensitivity; and perturbing the intermediate feature according to the first differential privacy function.

[0030] In one embodiment, the method further includes: performing differential privacy noise addition on the trained network layer by a plurality of selected terminals and edge servers using a second differential privacy function, and sending the noisy network layer to a cloud center for aggregation to obtain an optimized global model; the second differential privacy function is:

[0031]

[0032] Among them, σ c represents the noise intensity at the cloud center, represents the second sensitivity corresponding to the second differential privacy function, represents the model update of the j-th layer network of the model at terminal i.

[0033] The above-mentioned privacy-enhanced federated learning system with cloud-edge-end integration integrates the edge computing paradigm into the traditional federated learning framework through the edge computing training optimization mechanism, offloading computing tasks from terminals with limited computing resources to edge nodes with relatively strong computing resources and close distance to alleviate the problem of insufficient terminal resources. Based on the cloud-edge-end architecture, part of the terminal's training tasks is offloaded to the nearby edge to improve training efficiency. By real-time perception of the training status and dynamic changes of the system, the cloud center dynamically adjusts the terminal sampling rate to select terminals to participate in training, and sends the number of local training times in each round to the selected terminals, achieving high inference accuracy under the dual constraints of resources and privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flowchart of a privacy-enhanced federated learning system with cloud-edge integration in one embodiment. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0036] In one embodiment, a privacy-enhanced federated learning system with cloud-edge integration is provided, including:

[0037] Cloud center, edge server and terminal; cloud center connects to edge server, edge server connects to terminal;

[0038] The cloud center and the terminal respectively use a preset adaptive control algorithm to solve the preset configuration optimization model, and obtain the number of local iterations, the terminal sampling rate, the offloading decision, and the noise intensity on the edge server during offloading;

[0039] The cloud center selects terminals to participate in training based on the terminal sampling rate. When the offload decision is 1, the selected terminal divides the global model received from the cloud center into shallow network layers and deep network layers.

[0040] The terminal perturbs the intermediate features of the shallow network layer under the current input batch according to the noise intensity of the edge server and the first differential privacy function, and sends the perturbed intermediate features and the deep network layer to the edge server;

[0041] The edge server uses the gradient descent method to train the deep network layer based on the perturbed intermediate features, and returns the gradient value of the terminal loss function to the perturbed intermediate features to the terminal;

[0042] The terminal updates the shallow network layer according to the gradient value, performs end-to-edge iterative training according to the number of local iterations, and then merges the trained shallow network layer and the trained deep network layer received from the edge server to obtain a trained local model.

[0043] Among them, the cloud center is connected to multiple edge servers, and each edge server is connected to multiple terminals organized in a tree structure.

[0044] In the above-mentioned privacy-enhanced federated learning system that integrates cloud, edge and end, the edge computing paradigm is integrated into the traditional federated learning framework through the training optimization mechanism of edge computing, and computing tasks are offloaded from terminals with limited computing resources to edge nodes with relatively strong computing resources and close distance to alleviate the problem of insufficient terminal resources. Based on the cloud-edge-end architecture, part of the terminal's training tasks are offloaded to the nearby edge to improve training efficiency. By real-time perception of the training status and dynamic changes of the system, the cloud center dynamically adjusts the terminal sampling rate to select terminals to participate in training, and sends the number of local training times in each round to the selected terminals, achieving high inference accuracy under the dual constraints of resources and privacy.

[0045] In a specific embodiment, Figure 1 As shown in the figure, a flow chart of a privacy-enhanced federated learning system with cloud-edge integration is provided. Figure 1 The process is as follows:

[0046] Step 1: The terminal device i receives the global model w(t) and the local iteration number τ from the cloud center.

[0047] Step 2: The terminal will be local model w i (t) is initialized to w(t).

[0048] Step 3: Terminal i converts model w i (t) is divided into two parts, the shallow network layer and deep network layers

[0049] Step 4: The terminal will Send to the neighboring edge server, the edge server uses Initialize deep network layers at the edges.

[0050] Steps 5-9 are iterated for τ rounds to complete the local model training task as agreed.

[0051] Step 5: The terminal is based on the shallow network layer Calculate the output for each data batch d. The output is labeled O and is also called the intermediate feature of the model.

[0052] Step 6: The terminal uses the intermediate feature DP1(O,δ e ) and the corresponding label label(d) are sent to the edge server.

[0053] Step 7: The edge server treats the received intermediate features as input and optimizes the deep network layer through gradient descent training. η is the learning rate, f i The loss function set for terminal i.

[0054] Step 8: The edge server calculates the gradient of the loss function with respect to the perturbed intermediate features and returns it to the terminal.

[0055] Step 9: The terminal receives the gradient value and uses it to update the shallow network layer

[0056] Step 10: Through the τ-round end-edge iterative training, the edge server will train the deep network layer Return to the terminal device.

[0057] Step 11: The terminal merges the shallow network layer with the deep network layer to restore the original model.

[0058] Step 12: The terminal adds differential privacy noise to the shallow network layer. The parameters of the shallow network layer after noise are Send to the cloud.

[0059] Step 13: The edge server adds differential privacy noise to the deep network layer. The parameters of the deep network layer after noise are Send to the cloud.

[0060] In this embodiment, the number of local iterations in step 1 is the optimal number of local iterations obtained by the cloud center using an adaptive control algorithm to solve the configuration optimization model.

[0061] In order to enhance privacy, a two-level differential privacy protection mechanism is adopted in the two types of interaction forms of the above three-level system, which can maximize the availability of data analysis while minimizing the probability of personal privacy leakage.

[0062] Specifically include:

[0063] Offloading computing tasks between the device and the edge: Consider a medical scenario where, while knowing the diagnosis results, some internal staff may steal patients' physiological data from the hospital's private servers for personal gain. However, the edge server may be both honest and curious. While honestly assisting with model training, it may also seek to infer or even construct the user's original data information from intermediate features. To prevent privacy leaks, the intermediate features O must be perturbed when the terminal sends them to the edge server.

[0064] Model update transmission between edge-cloud and end-cloud: Based on the model updates uploaded by the terminal, the cloud center honestly aggregates these updates, but out of curiosity, it can still restore the original training data and infer the user's sensitive information. Therefore, when transmitting model updates, differential privacy noise needs to be added to the cloud center.

[0065] In one embodiment, the step of perturbing the intermediate features using the first differential privacy function includes: obtaining a first sensitivity of the first differential privacy function based on the maximum and minimum values ​​of each activation unit in the shallow network model; and constructing the first differential privacy function based on the first sensitivity as follows:

[0066]

[0067] Among them, O represents the intermediate feature, σ e represents the noise intensity to the edge server, S f represents the first sensitivity; the intermediate features are perturbed according to the first differential privacy function. In this embodiment, when the terminal offloads computing tasks, the noise intensity of the edge server is configured based on the optimal noise intensity for the edge server obtained by solving the configuration optimization model using an adaptive control algorithm. Terminal offloading computing tasks means that the terminal divides the global model into a shallow network layer and a deep network layer, and assigns the training task of the deep network layer to a nearby edge server.

[0068] In one embodiment, the method further includes: the selected terminal and edge server respectively perform differential privacy noise on the trained network layer using a second differential privacy function, and send the noisy network layer to the cloud center for aggregation to obtain an optimized global model; the second differential privacy function is:

[0069]

[0070] Among them, σ c represents the noise intensity at the cloud center, represents the second sensitivity corresponding to the second differential privacy function, represents the model update of the j-th layer network of the model at terminal i.

[0071] In this embodiment, Refers to the model update of the jth layer network of the model on terminal i. When the model update is sent to the cloud center, the preprocessing That is, for each Perform L2 normalization and then expand it to an empirical value ,Will Set to the second sensitivity of the differential privacy function DP2 for model updates.

[0072] This paper proposes a two-level differential privacy protection mechanism for two types of interactions in the multi-level federated learning framework designed by this paper, which poses a privacy risk. This design can meet users' expectations for privacy protection in federated learning. However, in distributed learning, training efficiency and privacy protection are actually non-orthogonal. Based on this design architecture, this paper proposes an adaptive control algorithm for multi-constraint problems to improve inference accuracy.

[0073] In one embodiment, the step of obtaining the configuration optimization model includes: constructing the configuration optimization model based on preset resource constraints and preset privacy constraints with the minimum global loss function value as the objective function.

[0074] In this embodiment, the problem with building a configuration optimization model is described as follows: Simply pursuing training efficiency may amplify privacy threats to local data, while the resulting privacy protection overhead or noise can reduce the efficiency and inference accuracy of federated learning. Therefore, it is necessary to resolve the conflict between dynamic resource consumption and the accumulation of privacy risks. Resources include the time and energy costs associated with computing and communication. Given the limited resources at the edge of the network, an upper limit budget, namely the resource budget R, is imposed on resource consumption.

[0075] In one embodiment, the step of obtaining the resource constraint includes: obtaining the resource constraint as follows based on the computing resources consumed by training under the current number of iterations, the communication resources consumed by aggregation under the current number of aggregation rounds, the resource budget, and the offloading decision:

[0076]

[0077] Among them, x k =1 means the network layer is unloaded in the kth round of federation aggregation, x k =0 means that the terminal chooses to train all network layers locally for privacy reasons, x k ∈X, X is the unloading decision, X={x1,x2…x K}, K is the number of global aggregation rounds, when x k = 1, each training iteration consumes c off Units of computing resources, each aggregation consumes b off Units of communication resources, when x k = 0, each training iteration consumes c loc Units of computing resources, each aggregation consumes b loc units of communication resources, R is the resource budget, and τ represents the number of local iterations in each round of aggregate training.

[0078] In one embodiment, the step of obtaining the privacy constraint includes: obtaining the privacy constraint as follows based on a preset privacy budget of the edge server, a preset privacy budget of the cloud center, and differential privacy theory:

[0079] H(ε0,b / |D i |,τ,δ′ e )≤ε e

[0080] H(ε0,s,K,δ′ c )≤ε c

[0081] Among them, ε e is the privacy budget of the edge server, ε c is the privacy budget of the cloud center, H is the privacy protection function, ε0 is the initial value. When analyzing the privacy situation during task offloading, p b is the ratio of batch size b to dataset size, z is the number of local training times, and when analyzing the privacy of model parameters during aggregation, p b is the sampling rate of the terminal, z is the number of global aggregation rounds, δ′ e is the preset edge server constant, δ′ c is the preset cloud center constant, D i is the data set of terminal i, and s is the terminal sampling rate.

[0082] In this embodiment, according to the differential privacy theory, to ensure (ε, δ)-DP, we should follow After z rounds of queries, the privacy guarantee is weakened to (H(ε,p b ,z,δ′),p b zδ+δ′)-DP, δ′>0.

[0083] In one embodiment, the objective function is:

[0084]

[0085] Where ρ is any f i (w) and the Lipschitz constant of F(w), F(w) is the global loss function value, f i (w) is the loss function of terminal i, D i is the data set of terminal i, D i ∈D, D={D1,D2…D N}, N is the number of terminal devices, h(τ) is the distance between the model parameters obtained by distributed learning and centralized learning, η is the learning rate, φ is the control constant, T is the total number of training times, T = τ * K, β is any f i (w) and F(w), μ is the weighted average of the global dataset size, ||▽f i (w)-▽F(w)||≤μ i , ▽f i (w) is the gradient of the loss function of terminal i with respect to w, and ▽F(w) is the gradient of the global loss function F with respect to w.

[0086] In this embodiment, in order to obtain a high-quality global model, it is necessary to obtain the parameter w under the above constraints so that the global loss function value F(w) is minimized. The definition of F(w) is as follows:

[0087]

[0088] Among them, F(w) is the global loss function value, D i is the data set of terminal i, D i ∈D, D={D1,D2…D N}, N is the number of terminal devices, f i (w) is the loss function of terminal i, w * Denote as the model parameter that minimizes F(w), w(T) is the global model after the T-th round of aggregation, and the gap between the two can be approximately formalized as the following formula:

[0089]

[0090] The configuration optimization model is obtained as follows:

[0091]

[0092] st

[0093]

[0094] H(ε0,b / |D i |,τ,δ′ e )≤ε e

[0095] H(ε0,s,K,δ′ c )≤ε c

[0096] For this configuration optimization model, this paper proposes an adaptive control algorithm and embeds it into the multi-level federated learning framework designed above. This algorithm allows for more precise coordination of resource and privacy constraints in federated learning, achieving high-accuracy model inference. The adaptive control algorithm includes a resource scheduling strategy, a terminal sampling strategy, and a local noise injection strategy.

[0097] In one embodiment, the adaptive control algorithm includes: when each terminal participating in the training receives the global model, it calculates the Lipschitz constant, smoothing constant, loss function, and gradient value corresponding to the terminal to reflect the distributed training state, and uploads the corresponding distributed training state to the cloud center; the cloud center linearly searches for the optimal number of local iterations within the range of local iterations based on the distributed training state corresponding to each terminal participating in the training, the weighted average sum of the global data set size, and the objective function; when the optimal number of local iterations meets the resource constraints, the cloud center returns the optimal number of local iterations to the terminal as the number of local iterations in the next round of aggregation. In this embodiment, in order to improve model performance, the cloud center monitors the training status and resource consumption of terminal devices and optimizes the resource scheduling of federated learning. The performance-driven resource scheduling strategy is shown in Table 1:

[0098] Table 1

[0099]

[0100] Each terminal device estimates c by monitoring its computing and communication resource consumption i and b i , when receiving the global model w(t), by estimating ρ i , β i , f i (w(t)) and ▽f i (w(t)) reflects the distributed training status. This information is uploaded to the cloud, and the cloud will f i (w(t)) is weighted averaged to obtain the global F(w(t)), and then the cloud is calculated by ρi , β i , ▽f i (w(t)) weighted average to estimate the global ρ, β and ▽F(w(t)), and then each terminal participating in the training is trained according to ||▽f i (w)-▽F(w)||≤μ i Estimation of μ i And calculate the global μ, the cloud center inputs these parameters into the configuration optimization model and performs linear search in the interval [1,τ max ] to find the optimal τ value, τ max is the preset upper bound of τ. Afterwards, the cloud will check the legality of τ, that is, whether it exceeds the resource budget R. Record the resource budget consumed. If the budget is exceeded, τ will be reduced one by one until it is within the budget. Finally, the algorithm will return the τ value for the next round.

[0101] In one embodiment, the adaptive control algorithm further includes: the cloud center calculates the current cumulative privacy budget consumed by the cloud center based on the privacy protection function to obtain the remaining privacy budget of the current cloud center, and estimates the remaining number of aggregation rounds based on the optimal number of local iterations and the current remaining resource budget; searches for the optimal terminal sampling rate based on the remaining number of aggregation rounds and a preset first search step size so that the current remaining resource budget and the current remaining privacy budget of the cloud center are consumed at the same time; the cloud center uses the optimal terminal sampling rate as the terminal sampling rate for the next round of aggregation. In this embodiment, privacy concerns for the cloud are integrated into the above-mentioned resource scheduling optimization, and the budget-aware device sampling strategy is shown in Table 2:

[0102] Table 2

[0103]

[0104] First, the cloud center calculates the current cumulative privacy budget according to the function H. Then, it estimates how many rounds of parameter aggregation can be performed before the remaining resource budget is exhausted when the current latest τ value is adopted. The algorithm linearly searches for the optimal terminal sampling rate s with a search step of γ, so that the resource budget and privacy budget are consumed almost at the same time to avoid premature termination of training due to lack of a certain type of budget. Since too low a sampling rate will cause the model to not be able to acquire knowledge from the terminal well and cannot achieve good inference performance, the lower bound of s is set to s min Finally, the algorithm returns s as the next sampling rate. In the next round of aggregation, the cloud center samples the terminals according to the currently calculated terminal sampling rate and selects some terminals to participate in training.

[0105] In one embodiment, the adaptive control algorithm further includes: the terminal obtains the privacy budget to be consumed by the edge server based on the optimal number of local iterations, the current corresponding local configuration, and the privacy protection function; when the privacy budget to be consumed by the edge server exceeds the preset privacy budget of the edge server, the noise intensity of the edge server is increased by a preset second search step size until the privacy constraint is satisfied, and then the optimal noise intensity of the edge server is output and the offloading decision is set to 1. If the noise intensity is not within the preset range that satisfies the privacy budget, the offloading decision is set to 0. In this embodiment, an adaptive local noise injection mechanism is further designed to minimize terminal resource consumption under the privacy constraint of the edge server. The adaptive local noise injection strategy is shown in Table 3:

[0106] Table 3

[0107]

[0108] First, the noise intensity σ e Set as the lower bound σ e(min) , and initialize the uninstall decision x k Then, the received τ value and the current corresponding local configuration are input into the function H to calculate the privacy budget to be spent , which may exceed the privacy budget ε preset by the terminal device for the edge e , in this case, it will keep increasing σ with the search step size γ′ e The value of will be adjusted until the privacy constraint is satisfied. At the same time, in order to avoid excessive noise causing the model to be difficult to converge, σ will be set. e The highest threshold. If σ e The uninstall decision x is not within the preset range that meets the privacy budget. k will be set to 0, and finally, the algorithm will return x k and σ e To indicate whether the terminal offloads computing tasks and the noise intensity during offloading.

[0109] The above-mentioned privacy-enhanced federated learning system with cloud-edge-end integration, by introducing the edge computing paradigm, explores the advantages and characteristics of the cloud, edge, and end, and offloads some of the terminal's computing tasks to the edge with stronger computing power and shorter transmission distance, thereby improving model training efficiency. Through the two-level differential privacy mechanism, it protects the interactive information between the cloud and edge, and between the edge and the end, and resists threats and attacks from untrusted edges and clouds. Through the method of this application, the training status and dynamic changes of the system can be perceived in real time. According to the quantitative resource constraints and privacy requirements given by the user, the resource scheduling and privacy configuration of the terminal can be adaptively adjusted, achieving high reasoning accuracy under the dual constraints of resources and privacy.

[0110] It should be understood that although Figure 1The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0111] Each module in the aforementioned cloud-edge-device integrated privacy-enhancing federated learning system can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or stored in a computer device's memory in software form, allowing the processor to call and execute the corresponding operations of each module.

[0112] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0113] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A privacy-enhanced federated learning system that integrates cloud, edge, and end devices, characterized by: The system comprises: A cloud center, an edge server, and a terminal; the cloud center is connected to the edge server, and the edge server is connected to the terminal; The cloud center and the terminal respectively use a preset adaptive control algorithm to solve the preset configuration optimization model, and obtain the number of local iterations, the terminal sampling rate, the offloading decision, and the noise intensity on the edge server during offloading; The cloud center selects a terminal to participate in the training according to the terminal sampling rate. When the offloading decision is 1, the selected terminal divides the global model received from the cloud center into a shallow network layer and a deep network layer. The terminal perturbs the intermediate features of the shallow network layer under the current input batch according to the noise intensity of the edge server and the first differential privacy function, and sends the perturbed intermediate features and the deep network layer to the edge server; The edge server trains the deep network layer according to the perturbed intermediate features using a gradient descent method, and returns the gradient value of the terminal loss function with respect to the perturbed intermediate features to the terminal; The terminal updates the shallow network layer according to the gradient value, performs end-edge iterative training according to the number of local iterations, and merges the trained shallow network layer and the trained deep network layer received from the edge server to obtain a trained local model.

2. The system according to claim 1, wherein: The step of obtaining the configuration optimization model includes: According to the pre-set resource constraints and pre-set privacy constraints, a configuration optimization model is constructed with the minimum global loss function value as the objective function.

3. The system according to claim 2, characterized in that The step of obtaining the resource constraint includes: According to the computing resources consumed by training under the current number of iterations, the communication resources consumed by aggregation under the current number of aggregation rounds, the resource budget and the offloading decision, the resource constraints are obtained as follows: Among them, x k =1 means the network layer is unloaded in the kth round of federation aggregation, x k =0 means that the terminal chooses to train all network layers locally for privacy reasons, x k ∈X, X is the unloading decision, X={x1,x2…x K }, K is the number of global aggregation rounds, when x k = 1, each training iteration consumes c off Units of computing resources, each aggregation consumes b off Units of communication resources, when x k = 0, each training iteration consumes c loc Units of computing resources, each aggregation consumes b loc units of communication resources, R is the resource budget, and τ represents the number of local iterations in each round of aggregation training.

4. The system according to claim 2, wherein: The step of obtaining the privacy constraint comprises: Based on the pre-set privacy budget of the edge server, the pre-set privacy budget of the cloud center, and the differential privacy theory, the privacy constraints are obtained as follows: H(ε0,b / |D i |,τ,δ′ e )≤ε e H(ε0,s,K,δ′ c )≤ε c Among them, ε e is the privacy budget of the edge server, ε c is the privacy budget of the cloud center, H is the privacy protection function, ε0 is the initial value. When analyzing the privacy situation during task offloading, p b is the ratio of batch size b to dataset size, z is the number of local training times, and when analyzing the privacy of model parameters during aggregation, p b is the sampling rate of the terminal, z is the number of global aggregation rounds, δ′ e is the preset edge server constant, δ′ c is the preset cloud center constant, D i is the data set of terminal i, and s is the terminal sampling rate.

5. The system according to claim 2, wherein: The objective function is: Where ρ is any f i (w) and the Lipschitz constant of F(w), F(w) is the global loss function value, f i (w) is the loss function of terminal i, D i is the data set of terminal i, D i ∈D, D={D1,D2…D N }, N is the number of terminal devices, h(τ) is the distance between the model parameters obtained by distributed learning and centralized learning, η is the learning rate, φ is the control constant, T is the total number of training times, T = τ * K, β is any f i (w) and F(w), μ is the weighted average of the global dataset size, is the gradient of the loss function of terminal i with respect to w, is the gradient of the global loss function F with respect to w.

6. The system according to any one of claims 1 to 5, characterized in that: The adaptive control algorithm includes: When each terminal participating in the training receives the global model, it calculates the Lipschitz constant, smoothing constant, loss function and gradient value corresponding to the terminal to reflect the distributed training state, and uploads the corresponding distributed training state to the cloud center; The cloud center linearly searches for the optimal number of local iterations within the interval to which the number of local iterations belongs based on the distributed training state corresponding to each terminal participating in the training, the weighted average sum of the global data set size, and the objective function; When the optimal number of local iterations meets the resource constraint, the cloud center returns the optimal number of local iterations to the terminal as the number of local iterations in the next round of aggregation.

7. The system according to claim 6, characterized in that The adaptive control algorithm further includes: The cloud center calculates the current cumulative privacy budget consumed by the cloud center according to the privacy protection function, obtains the remaining privacy budget of the current cloud center, and estimates the remaining number of aggregated rounds based on the optimal number of local iterations and the remaining resource budget of the current cloud center; Searching for an optimal terminal sampling rate according to the remaining number of aggregated rounds and a preset first search step length, so that the current remaining resource budget and the current remaining privacy budget of the cloud center are consumed at the same time; The cloud center uses the optimal terminal sampling rate as the terminal sampling rate for the next round of aggregation.

8. The system according to claim 7, characterized in that The adaptive control algorithm further includes: The terminal obtains a privacy budget to be consumed by the edge server according to the optimal number of local iterations, the current corresponding local configuration and the privacy protection function; When the privacy budget to be consumed by the edge server exceeds the preset privacy budget of the edge server, the noise intensity of the edge server is increased by a preset second search step until the privacy constraint is satisfied, the optimal noise intensity of the edge server is output, and the offloading decision is set to 1; If the noise intensity is not within the preset range that satisfies the privacy budget, the offloading decision is set to 0.

9. The system according to claim 1, wherein: The step of perturbing the intermediate feature using a first differential privacy function includes: Obtaining a first sensitivity of a first differential privacy function according to a maximum value and a minimum value of each activation unit in the shallow network model; The first differential privacy function is constructed according to the first sensitivity: Among them, O represents the intermediate feature, σ e represents the noise intensity to the edge server, S f Indicates the first sensitivity; The intermediate features are perturbed according to the first differential privacy function.

10. The system according to claim 1, wherein: The system further comprises: The selected terminals and edge servers use the second differential privacy function to perform differential privacy noise on the trained network layer, and send the noisy network layer to the cloud center for aggregation to obtain the optimized global model; The second differential privacy function is: Among them, σ c represents the noise intensity at the cloud center, represents the second sensitivity corresponding to the second differential privacy function, represents the model update of the j-th layer network of the model at terminal i.

Images