A privacy protection method and system for federated learning model training based on a hybrid strategy

Abstract

The application discloses a kind of based on hybrid strategy's federal learning model training privacy protection method and system, combine to the local model training process of federal learning participant confounding auto-encoder network, data label is confused mapping, to this cut off the relationship between gradient information and data information, prevent attack party reconstructs out user original data using gradient information;Local differential privacy mechanism is combined to the parameter transmission process of federal learning, add Gaussian noise satisfying (epsilon, delta) local differential privacy to gradient parameter, to this gradient information is disturbed, while in the center server aggregation process is approximated average aggregation by randomization mechanism, hide single participant contribution, to this prevent inference attack carried out by attack party.The application can construct a privacy-safe federal learning system, resist various privacy risks caused by gradient leakage in the process of federal learning model training, while better balance between model performance and privacy security is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of federated learning and privacy protection, and in particular to a federated learning model training method and system for privacy protection by using a mixed defense strategy formed by combining a confusion autoencoder with local differential privacy. BACKGROUND

[0002] Federated learning is a distributed machine learning framework that emphasizes joint training by multiple parties to obtain a federated model without data leaving the local. In the centralized federated learning scenario, each participant interacts with a parameter aggregation server for parameters. First, each participant downloads a preliminary global model from the center server, then trains the model using local data, and uploads the local model parameters or parameter updates to the center server. The center server aggregates the parameters of these local models to obtain a new global model, which is distributed to each participant for the next round of training until the model converges. Federated learning provides an attractive compromise between practicality and user privacy. Each participant trains the model locally and shares some of the gradients with other participants, that is, the training set does not leave the local machine. By collecting and exchanging these gradients, federated learning can achieve a model with almost the same accuracy as centralized training. However, studies have shown that "honest but curious" participants and the center server can reconstruct the training data or member reasoning attack to determine the distribution of the participant's data by performing a reconstruction attack to obtain the participant's training data or a member reasoning attack to determine the distribution of the participant's data based on the gradient parameter information during federated training, causing the participant's data privacy to be compromised. Therefore, it is of great significance to study a federated learning model training method that protects privacy.

[0003] Currently, the main solutions to the privacy leakage caused by gradient transmission in federated learning model training are divided into two categories: defense schemes based on cryptography and defense schemes based on information masking. Cryptography-based schemes such as homomorphic encryption, secret sharing, and secure multi-party computation mainly encrypt the transmitted gradient information. This solution increases the computational and communication overhead of the federated learning system. In scenarios involving a large number of participants for federated learning, the huge computational and communication costs are difficult to tolerate. Defense schemes based on information masking focus on using gradient compression and differential privacy to perturb the transmitted gradient information, making it impossible for the attacker to obtain the relevant privacy information of the participant from the perturbed gradient parameter information. This solution reduces or perturbs the amount of information required for model training to varying degrees, negatively affecting the performance of the model. Therefore, the privacy protection problem in federated learning requires a solution that achieves a better balance between resource overhead, model performance, and privacy security. SUMMARY

[0004] In view of the above defects or improvement needs of the prior art, the present application provides a federated learning model training privacy protection method based on a hybrid strategy, which combines a confusion autoencoder with local differential privacy, can successfully resist reconstruction attacks and reasoning attacks of an "honest but curious" attacker, and can guarantee a high model main task accuracy, achieving a better balance between the privacy and performance of the federated learning model.

[0005] In order to solve the above problems, according to a first aspect of the present application, a federated learning model training privacy protection method based on a hybrid strategy is provided, comprising:

[0006] Step 1: a plurality of data participants and a center server form a centralized federated learning system as entities;

[0007] Step 2: the parties agree on a consistent training target, and the center server broadcasts an initial model to the participants;

[0008] Step 3: for the federated model described in step 2, the participants optimize it locally using local data, including: label confusion of the local data;

[0009] Step 4: the client uploads the obtained gradient parameters to the center server, wherein the gradient parameters are processed using a local differential privacy mechanism, including: gradient clipping, adding noise, and calculating the standard deviation of Gaussian noise.

[0010] Step 5: the server securely aggregates the gradient parameters uploaded by the client subset sampled in step 5, uses a randomization mechanism to confuse the sum of the updates of each party, and obtains an approximately average global model.

[0011] Step 6: the model performance loss is constrained according to a performance loss constraint mechanism, and the performance loss of the federated model is reduced.

[0012] Step 7: the server calculates the privacy loss of the updated global model and judges the model convergence and the corresponding global iteration number, if the privacy budget of the current model reaches the set threshold, that is, the model has the risk of privacy leakage, or the model converges, or the maximum iteration number is reached, then the server will terminate the model training process, send the termination training information to the client, and return the current federated model. Step 8: the server randomly subsamples the participants.

[0013] Step 9: for the client subset sampled in step 7, the server sends the latest global model obtained in step 5 to it.

[0014] Step 10: repeat steps 3-8 until step 6 is exited.

[0015] Step 11: obtain the final federated model.

[0016] Further, the algorithm for label confusion in step 3 using entropy-regularized autoencoder is shown in Figure 2 , including:

[0017] Step 3.1: Start local round model training;

[0018] Step 3.2: Calculate "pseudo-label":

[0019] Step 3.3: Use the label confused data to participate in federated training, and get the model predicted label: Y p

[0020] f(H);

[0021] Step 3.4: Calculate cross-entropy loss:

[0022] Step 3.5: Replace the original gradient with and upload to the center server;

[0023] Step 3.6: Wait for the next round of global model to be issued;

[0024] Further, the encoder network parameters W e in step 3.2 are obtained by the following process:

[0025] Step 3.2.1: Generate one-hot label for each data participating in training;

[0026] Step 3.2.2: Generate the encoded "pseudo-label" from ;

[0027] Step 3.2.3: Calculate the total loss: L = L contra -λ2L entropy , which is calculated by cross-entropy loss and contrastive loss, the cross-entropy loss is the entropy loss of mapping each real label to a substitute label, which is used to increase the confusion mapping between "pseudo-label" and data samples; L contra is the contrastive loss, which enables the decoder network to reconstruct the real label from the "pseudo-label", while forcing the "pseudo-label" to be different from the original label, λ s , s∈{1,2} are loss weights.

[0028] Step 3.2.4: Update parameters:

[0029] Step 3.2.5: Iterate until the model converges, and return the encoder network W e , the decoder network W d ;​

[0030] Further, step 4 comprises:

[0031] Step 4.1: The client calculates the intermediate gradient information according to the specific loss function using the current round global model sent by the local data optimization server b is each data pair in the training set B. Step 4.2: Gradient clipping is performed on the gradient parameters obtained in step 4.1 Mainly clipping the L2 norm of the gradient parameter ||g||2, if the threshold of gradient clipping is set to C, then the gradient parameter g obtained by the client i training i will be replaced, that is, when ||g||2≤C, the original gradient parameter g i is retained, and when ||g||2≥C, the uploaded gradient parameter g i is replaced by the threshold C.

[0032] Step 4.3: Update the model parameters,

[0033] Step 4.4: Calculate the privacy sensitivity C is the clipping threshold, m is the size of the local data set, and the sensitivity is the oscillation range of the randomized function after adding noise, which is a key factor in determining the size of the added noise.

[0034] Step 4.5: Calculate the noise scale according to the privacy sensitivity obtained in step 4.4 which is used to constrain the added noise, otherwise too much noise will cause the model not to converge, where the sensitivity of each round of training is defined as q is the sampling rate of the client, T is the training iteration round, ∈ i is the privacy budget of client i, and δ i represents the looseness.

[0035] Step 4.6: Perform gradient parameter perturbation according to the noise size obtained in step 4.5 w k is the original gradient, is the added noise, and the original gradient parameter is replaced by the Gaussian perturbed gradient parameter for uploading.

[0036] Further, step 5 comprises:

[0037] Step 5.1: Use a scaled version of the true update value to enhance the sensitivity: The scaling update has a sensitivity of S upper limit relative to the summation operation, so the median of the original contribution value is used as the clipping boundary S = media{Δw k}k∈Z t .

[0038] Step 5.2: Add Gaussian noise to the sum of all scaled updated updated values;

[0039] Step 5.3: Divide the output of the Gaussian mechanism by m t Get the approximation of the true average of all client updates;

[0040] Step 5.4: Add the obfuscated approximation to the current global model w t to get the new global model w t+1 :

[0041] Further, step 6 includes:

[0042] Step 6.1: Calculate the model performance loss of client i:

[0043] where is the performance function of the model, v0 is the probability density function of the Gaussian distribution N(0, σ 2 i ), and v1 is the probability density function of (qN(Δs, σ 2 i +(1-q)N(0, σ 2 i ).

[0044] Step 6.2: Calculate the performance loss of the entire federated learning system: where k is the number of participants, and E is the global communication round.

[0045] Step 6.3: According to steps 6.1 and 6.2, the loss function at time λ during federated training is further constrained, i.e. This formula shows that the federated learning training method proposed by the present application only needs to be constrained by E v1,v0 , thereby reducing the performance loss in the federated learning process.

[0046] Further, step 7 includes:

[0047] Step 7.1: Calculate the privacy loss of the current model: The essence is that the algorithm outputs the difference in probability of o on adjacent data sets d, d';

[0048] Step 7.2: judging the relationship between the privacy loss and Q, if the privacy loss exceeds the threshold Q, the training of the model will be terminated, because the model cannot guarantee (ε, δ)-local differential privacy if it continues to be trained, and the possibility of privacy leakage will be greater than δ;

[0049] Step 7.3: judging the convergence of the model, if the model has converged, directly return the global model, and there is no need to wait until the maximum iteration number;

[0050] Step 7.4: judging the iteration number of the model, if it is less than the set maximum global communication round, a new round of global training is started, otherwise the global model is returned.

[0051] According to a second aspect of the present application, a hybrid strategy-based federated learning privacy protection system is provided, comprising:

[0052] The flow control module of the client is used to control the execution logic of the local training part of the federated learning model. The local model training mainly includes three steps, which are 1) model training; 2) auto-encoder model training; and 3) parameter perturbation. In step one, each client uses the local data set to train the global model locally. In step two, the auto-encoder network is updated by optimizing the cross-entropy loss and the contrast loss, the obtained encoder is used to encode and confuse the local data samples, and the encoded labels are used to replace the real labels to participate in the training of the federated model. In step three, the gradient parameters output by the federated model network are updated by clipping, the privacy sensitivity and noise scale are calculated, the parameters are perturbed, and then sent to the cloud center server. After uploading successfully, the next round of global model is waited for;

[0053] The server training control module is used to control the execution logic of the entire federated learning training. After the global model is updated and the next round of model iteration is started, the privacy tracking mechanism is used to judge whether the privacy budget is used up. If the set privacy threshold is exceeded, the training of the entire federated model will be terminated, and the current model is returned. Otherwise, the parameters uploaded by the client are aggregated, and finally the training control module selects to start the next round of federated model training process or ends the training according to the convergence of the model;

[0054] The model parameter aggregation module is used for the secure aggregation of the federated model parameters, and the Gaussian mechanism is used to confuse all the updates. The appropriate clipping boundary S, the deformation degree, and the privacy loss parameters σ and m are selected to ensure the performance of the model under more stringent privacy loss requirements;

[0055] The terminal management module is used for managing each participant of the federated learning system, that is, the client participating in the federated model training, and an instance object is created for each client to save some information of the client, for example, the client IP address, the computing ability, the storage ability, the transmission ability, the local data set size and the average loss function value in the local training process and the like. The terminal management module is also responsible for interacting with other modules, for example, when the process control module sends specific instructions such as starting the next round of training or stopping the training process to the terminal management module, the terminal management module also needs to generate corresponding transmission content according to the specific information, and after serialization by ProtoBuf, the data is transmitted to the remote calling module;

[0056] The remote calling module is used for building a communication system between the client and the center server, and is implemented by using the gRPC framework. When the terminal management module delivers specific transmission data to the remote calling module, the remote calling module sends the message to the client through network transmission and starts to wait for the training result of the terminal;

[0057] The serialization module is used for serializing and deserializing the parameter information transmitted between the client and the server, and is implemented by using the ProtoBuf framework. Compared with JSON and XML, the ProtoBuf framework is a light and efficient structured data storage format, has a smaller size and a faster parsing speed, and can significantly improve the communication efficiency of the federated learning system.

[0058] Overall, compared with the prior art, the above technical solutions conceived by the present application can achieve the following beneficial effects:

[0059] 1. The method of the present application can successfully resist reconstruction attacks and reasoning attacks against the centralized federated learning, and can guarantee the relative accuracy of the federated model main task and the convergence of the model, consume less computing resources and communication resources, and achieve a better balance between model performance and privacy loss.

[0060] 2. The system design of the present application can realize a privacy-safe federated learning system, complete the training of the federated model under the premise of guaranteeing the privacy and safety of data, provide corresponding services after deployment, and has certain practical significance and application value. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 The figure is a whole framework diagram of the federated learning of the present application.

[0062] Figure 2 The figure is a training flowchart of the federated learning combined with the autoencoder of the present application.

[0063] Figure 3 The figure is a system module diagram of the present application.

[0064] Figure 4 Entity interaction diagram for the present application.

[0065] Figure 5 Client training flowchart for the present application.

[0066] Figure 6 Central server training flowchart for the present application. DETAILED DESCRIPTION

[0067] In order for those skilled in the art to better understand the solutions of the embodiments of the present application, the embodiments of the present application are further described in detail below in combination with the drawings and embodiments.

[0068] The present application mainly enhances the privacy of the federated learning system based on the confusion auto-encoder network and differential privacy technology, and the overall framework is as shown in Figure 1 .

[0069] The privacy-protected federated learning system designed by the present application is divided into four layers, as shown in Figure 3 , which are application layer, platform execution layer, basic service layer and physical resource layer. The application layer deploys the trained federated learning model, such as image classification, target detection, etc., and provides corresponding external interfaces to provide services. The platform execution layer includes the terminal execution module Client-Module deployed by each participant and the central server module Server-Module in the cloud. The Client-Module is responsible for controlling the training process of the local federated model of the participant, while the Server-Module is responsible for parameter security aggregation in the model training process and management of the entire federated learning process, including execution process, terminal management, etc. The basic service layer provides basic services for the construction of distributed federated learning, including communication control tools gRPC, communication serialization protocol ProtoBuf, deep learning framework Pytorch, and virtualization platform Docker. The physical resource layer is composed of participants and cloud center servers. The participants provide corresponding model training data and server resources needed for local model training, and the cloud server acts as a parameter server for parameter exchange of each participant.

[0070] The system is mainly composed of two entities: participant terminals and cloud servers. The interaction process between the client and the server is as follows:

[0071] Step 1: The cloud center server distributes the initial model to the client sampling result set;

[0072] Step 2: The participant terminal optimizes the local model using local data;

[0073] Step 3: Combine the sample label confusion with the auto-encoder network and use local differential privacy to add noise to the parameters;

[0074] Step 4: After the client completes the training task, the current round of perturbed parameters are sent to the center server for aggregation;

[0075] Step 5: After the center server performs secure aggregation based on differential privacy, the new round of parameters are issued to each participant terminal;

[0076] Step 6: Repeat the above process until the global model converges or the set privacy budget is used up.

[0077] The interaction process is as shown in Figure 4 .

[0078] The flow control module of the client mainly controls the execution logic of the entire federated learning model training part. The local model training is mainly divided into three steps, which are:

[0079] Step 1: Local model training, each client uses the local data set to train the global model through the input, hidden, and output layers;

[0080] Step 2: Confused autoencoder model training, update the autoencoder network by optimizing the cross-entropy loss and contrast loss, use the obtained encoder to encode and confuse the local data samples, and use the encoded labels to replace the real labels to participate in the training of the local neural network model;

[0081] Step 3: Update the gradient parameters output by the local model, calculate the privacy sensitivity and noise scale, send the perturbed parameters to the cloud center server after parameter perturbation, and wait for the next round of global model after uploading successfully.

[0082] The client training process of the federated learning system is as shown in Figure 5 .

[0083] The cloud center server aggregation module mainly uses the Gaussian mechanism to confuse the sums updated by the clients, and improves the problem that the Fed_Avg algorithm is easy to cause privacy information leakage when subjected to inference attacks. The center server aggregation is mainly divided into two steps, which are:

[0084] Step 1: Random subsampling;

[0085] Step 2: Use the Gaussian mechanism to transform all updated sums.

[0086] In step 1, the training flow control module randomly samples m tThe aggregated model is sent to the selected clients through the terminal management module, and the updated model is returned to the center server after local training. In step 2, the model parameter aggregation module needs to use the Gaussian mechanism to confuse the sum of all collected updates, and the Gaussian mechanism adds noise to the sum of all scaled update values. Divide the output of the Gaussian mechanism by m t An approximation of the true average of all client updates is obtained as the global model for the next communication round. The center server aggregation process is shown in Figure 6

[0087] It should be noted that the method of the embodiment of the present application is applicable to any center-based federated deep supervised learning model training scenario, and has better balance performance when the number of participants is large.

[0088] The above describes the embodiments of the present application in detail, and the present application is described by applying the specific implementation. The above embodiment is only used to help understand the method of the present application; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation and application range will be changed, and the above description should not be understood as a limitation of the present application.​

Claims

1. A privacy protection method for federated learning model training based on a hybrid strategy, characterized in that, Comprising the following steps: Step 1: Multi-data participants and a central server as an entity constitute a centralized federated learning system; Step 2: All parties agree on a consistent deep learning model training direction, and the central server will issue the initial global model to each participant; Step 3: Each participant optimizes the local global model using local data, and the labels of local data are mapped using a confusion autoencoder network; Step 4: Calculate the local intermediate gradient parameters and perform gradient clipping and add Gaussian noise; Step 5: Send the perturbed gradient parameters to the server; Step 6: The server uses the Gaussian mechanism to confuse the collected updates; Step 7: Update the global model; Step 8: Calculate the privacy loss, if it exceeds the set threshold or the global model converges, reach the set global communication round, return the global model; Step 9: If the set threshold is not exceeded or the global model does not converge, the set global communication round is not reached, then repeat steps 3-8; In step 4, the specific process of local gradient perturbation is: Step 4.1: clipping the gradient information output by the loss function, the threshold of clipping is set as C, then the gradient parameter trained by the client i will be substituted, denotes the L2 norm of the gradient information; Step 4.2: Using a relaxed differential privacy definition, calculate the sensitivity S to determine the amount of noise to add. ,in, This represents the dataset owned by client i. express The j-th sample in the dataset, This refers to the loss function of the local model. When taking the minimum value, the model variable parameters The value of ; Step 4.3: Compute the standard deviation of the added Gaussian noise on the gradient parameters to bound the impact of the added noise on the model performance, where the sensitivity of each round of training is defined as q is the client sampling rate, and T is the number of training iteration rounds, is the privacy budget for client i, represents the looseness degree; In step 6, the specific process of server parameter aggregation is: Step 6.1: Random subsampling of clients A random subset of clients is formed , The clients in the random subset each optimize the global model using local data to form a local model The local models are different from each other The difference between the optimized local model and the global model is ; Step 6.2: Employ Gaussian mechanism to obfuscate all updated sums, using scaled versions of the true update values to enhance sensitivity , indicating that the sensitivity of the scaled updates with respect to the sum operation is upper bounded by the clipping bound S; Step 6.3: Add the obfuscated approximation to the current global model to get the new global model : , i.e. the added noise, , the two parts are added and divided by the number of sampling clients to get the obfuscated updated mean, which is added to the current global model to get the new global parameters .

2. The privacy protection method for federated learning model training based on a hybrid strategy according to claim 1, wherein, In step 3, the specific process of label confusion is: Step 3.1: Training of the autoencoder network with local data, the training objective is to optimize the contrastive loss and the cross-entropy loss , the final learning objective is: ; where the contrastive loss is to make the decoder network able to reconstruct the true label from the "pseudo label", while forcing the "pseudo label" to be different from the original label, and the cross-entropy loss is the entropy loss of mapping each true label to the alternative label, so that the label mapping introduces more confusion, where is the loss weight, CE(*) is the calculation of the cross-entropy loss; Step 3.2: Real labels are input to the encoder network to get "pseudo labels" Input encoder network to get "pseudo labels" ; Step 3.3: Utilize [x, ] to participate in federated learning local model optimization; Step 3.4: The model inference stage uses the decoder to reconstruct the "pseudo label" into the real label without loss.

3. A privacy protection system for federated learning model training based on a hybrid strategy, used to implement the privacy protection method for federated learning model training based on a hybrid strategy in claim 1. The system comprises: The client's flow control module controls the execution logic of the local training part of the federated learning model, including local model optimization, confusion autoencoder network optimization, and local parameter perturbation; The federated training control module of the central server controls the execution logic of the entire federated learning training, which will first judge whether the privacy budget is used up at the beginning of each communication round. If the set privacy threshold is exceeded, the entire federated model training will be terminated and the current model will be returned. Otherwise, the uploaded parameters of the client are aggregated, and finally the training control module selects to start the next round of federated model training process or ends the training according to the convergence of the model; The terminal management module is used to manage the participants of the federated learning system, i.e. the client participating in the federated model training. The terminal management module will create a client object for each client participating in the federated learning system to save the relevant information of each client, including the IP address, computing power, storage capacity, transmission capacity, local dataset size, and average loss function value during local training; The remote calling module is implemented using the gRPC framework and is responsible for the communication between the server and the client. When the terminal management module passes the specific transmission data to the remote calling module, the remote calling module sends the message to the participant terminal through network transmission and starts waiting for the training result of the terminal; The serialization module is implemented using the ProtoBuf framework.

Images