A model training method and device, a storage medium and an electronic device

Abstract

The specification discloses a model training method and device, a storage medium and an electronic device. In the model training method provided in the specification, business data of a user in a history of performing a transaction service is obtained as private sample data; the private sample data is input into a target model to be trained to obtain a risk representation value of the transaction service output by the target model; a first loss is determined according to the risk representation value and a label corresponding to the private sample data, an initial gradient of the target model is determined according to the first loss; the initial gradient is scrambled to obtain a gradient with perturbation; the gradient with perturbation is input into a pre-trained denoising model to output a denoised gradient from the denoising model according to the gradient with perturbation, the denoised gradient is used to simulate a relationship between components of the initial gradient; and parameters of the target model are adjusted by using the denoised gradient.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a model training method, apparatus, storage medium, and electronic device. Background Technology

[0002] Today, across various industries, service providers and users are increasingly focused on the security of their privacy data, protecting it at every stage of business operations. For example, in businesses that provide recommendations and analytics based on user-provided data, models with corresponding functionalities need to be trained using this data. To prevent user-provided data from being stolen by others, differential privacy training methods are typically used to train these models.

[0003] In differential privacy training, noise is added to the gradients to prevent attackers from stealing the gradients during training and inferring user data. However, in this method, adding noise to the gradients inevitably has a negative impact on model training to some extent, reducing the model's training performance.

[0004] Therefore, how to train a high-performing model while protecting users' privacy data is an urgent problem to be solved. Summary of the Invention

[0005] This specification provides a model training method, apparatus, storage medium, and electronic device to partially solve the aforementioned problems existing in the prior art.

[0006] The following technical solution is adopted in this specification:

[0007] This manual provides a model training method, including:

[0008] Obtain business data from users' historical transaction transactions as private sample data;

[0009] The private sample data is input into the target model to be trained to obtain the risk characterization value of the transaction business output by the target model;

[0010] Based on the risk characterization value and the label corresponding to the private sample data, a first loss is determined, and the initial gradient of the target model is determined based on the first loss.

[0011] The initial gradient is scrambled to obtain a scrambled gradient;

[0012] The perturbation gradient is input into a pre-trained denoising model so that the denoising model outputs a denoising gradient based on the perturbation gradient. The denoising gradient is used to simulate the relationship between the components of the initial gradient.

[0013] The parameters of the target model are adjusted using the denoising gradient.

[0014] Optionally, a denoising model is pre-trained, specifically including:

[0015] Business data of publicly disclosed business operations are obtained from a public dataset and used as public sample data. The public sample data is then input into a control model to be trained to obtain the control risk characterization value of the publicly disclosed business output by the control model. The control model has the same structure as the target model.

[0016] Based on the control risk characterization value and the corresponding labels of the public sample data, the control loss is determined, and the control gradient of the control model is determined based on the control loss;

[0017] The control gradient is scrambled to obtain a scrambled control gradient;

[0018] The perturbation-controlled gradient is input into the denoising model to be trained, so that the denoising model outputs the denoising gradient to be optimized based on the perturbation-controlled gradient.

[0019] The denoising model is trained with the goal of minimizing the difference between the denoising gradient to be optimized and the control gradient.

[0020] Optionally, before determining the initial gradient of the target model, the method further includes:

[0021] Obtain the private sample features output from the intermediate layer of the target model;

[0022] The common sample data is input into the target model to obtain the common sample features output by the intermediate layer of the target model;

[0023] Determine a second loss between the private sample features and the public sample features.

[0024] Optionally, determining the initial gradient of the target model based on the first loss specifically includes:

[0025] The initial gradient of the target model is determined based on the first loss and the second loss.

[0026] Optionally, before scrambling the initial gradient, the method further includes:

[0027] When the value of the initial gradient is greater than the specified threshold, the value of the initial gradient is adjusted to the specified threshold.

[0028] Optionally, the initial gradient is scrambled, specifically including:

[0029] For each component in the initial gradient, a perturbation noise is determined within a preset noise range, and the perturbation noise is added to the gradient value of that component.

[0030] This specification provides a model training apparatus, including:

[0031] The acquisition module is used to acquire business data from when users performed transactions in the past, as private sample data.

[0032] The input module is used to input the private sample data into the target model to be trained, and obtain the risk characterization value of the transaction business output by the target model;

[0033] The gradient determination module is used to determine a first loss based on the risk characterization value and the label corresponding to the private sample data, and to determine the initial gradient of the target model based on the first loss.

[0034] A scrambling module is used to scramble the initial gradient to obtain a scrambled gradient;

[0035] A noise reduction module is used to input the perturbation gradient into a pre-trained noise reduction model so that the noise reduction model outputs a noise reduction gradient based on the perturbation gradient. The noise reduction gradient is used to simulate the relationship between the components of the initial gradient.

[0036] An adjustment module is used to adjust the parameters of the target model using the noise reduction gradient.

[0037] Optionally, the device further includes a pre-training module, specifically used to obtain business data of publicly available services from a public dataset as public sample data; input the public sample data into a control model to be trained to obtain the control risk representation value of the publicly available services output by the control model, wherein the control model has the same structure as the target model; determine the control loss based on the control risk representation value and the label corresponding to the public sample data; determine the control gradient of the control model based on the control loss; scramble the control gradient to obtain a scrambled control gradient; input the scrambled control gradient into a denoising model to be trained, so that the denoising model outputs a denoising gradient to be optimized based on the scrambled control gradient; and train the denoising model with the minimum difference between the denoising gradient to be optimized and the control gradient as the optimization objective.

[0038] Optionally, the apparatus further includes a loss determination module, specifically configured to: acquire private sample features output from the intermediate layer of the target model; input the public sample data into the target model to acquire the public sample features output from the intermediate layer of the target model; and determine a second loss between the private sample features and the public sample features.

[0039] Optionally, the gradient determination module is specifically used to determine the initial gradient of the target model based on the first loss and the second loss.

[0040] Optionally, the device further includes a clipping module, specifically used to adjust the value of the initial gradient to the specified threshold when the value of the initial gradient is greater than the specified threshold.

[0041] Optionally, the scrambling module is specifically used to determine perturbation noise within a preset noise range for each component in the initial gradient, and to add the perturbation noise to the gradient value of that component.

[0042] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described model training method.

[0043] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the model training method described above.

[0044] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0045] In the model training method provided in this specification, business data of users executing transactions in the past is obtained as private sample data; the private sample data is input into the target model to be trained to obtain the risk representation value of the transaction output by the target model; a first loss is determined according to the risk representation value and the label corresponding to the private sample data, and the initial gradient of the target model is determined according to the first loss; the initial gradient is scrambled to obtain a scrambled gradient; the scrambled gradient is input into a pre-trained denoising model so that the denoising model outputs a denoised gradient according to the scrambled gradient, and the denoised gradient is used to simulate the relationship between the components of the initial gradient; the parameters of the target model are adjusted using the denoised gradient.

[0046] When training the target model using the model training method provided in this manual, the initial gradient of the target model during backpropagation can be scrambled when training the target model with private sample data. The scrambled gradient is then processed by a pre-trained denoising model to obtain a denoised gradient that retains a certain amount of noise while reflecting the relationship between the components of the initial gradient. The target model is then adjusted based on the denoised gradient, which improves the training effect of the target model while ensuring that the private business data used for training is not exposed. Attached Figure Description

[0047] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and their descriptions, serving to explain this specification and do not constitute an undue limitation thereof.

[0048] In the picture:

[0049] Figure 1 This is a flowchart illustrating a model training method provided in this specification;

[0050] Figure 2 This is a schematic diagram of a model training device provided in this specification;

[0051] Figure 3 This specification provides a corresponding Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0052] Today, many businesses are able to differentiate services based on user data, maximizing the user experience for each individual. Among the data used by these businesses is personal user data obtained with user consent, which falls under the category of user privacy. Clearly, neither users nor business platforms want this data to be leaked.

[0053] Currently, with the continuous development of artificial intelligence technology, many businesses can rely on pre-trained neural network models to complete their tasks. However, during the training process using user-provided data, attackers can steal the gradients generated by the neural network model during training and infer the original data. To prevent this from happening, many models employ differential privacy techniques during training.

[0054] In differential privacy training, noise is added to the gradients of the neural network model during backpropagation, making it impossible for attackers to deduce the original data even if they steal the gradients. However, while this method protects user privacy, it's easy to see that using noisy gradients to train the neural network model will inevitably have a negative impact on the training results.

[0055] Therefore, in order to solve the above-mentioned technical problems, this specification provides a model training method that can improve the training effect of neural network models while protecting user privacy data.

[0056] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0057] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0058] Figure 1 This is a flowchart illustrating a model training method provided in this specification, including the following steps:

[0059] S100: Obtain business data from when users performed transactions in the past, as private sample data.

[0060] In this specification, the execution entity used to implement the model training method can refer to a designated device such as a server set up on the business platform. For ease of description, this specification will only use the server as the execution entity as an example to illustrate one model training method provided in this specification.

[0061] The primary application scenario for the model training method provided in this manual is training risk control models for transaction-related businesses. Its main function is to evaluate transactions executed by users based on business data. The evaluation output by the model can determine whether the user's transaction carries any risk. This manual will use the above application scenario as an example to illustrate the model training method provided.

[0062] In transaction-related applications, the training samples used to train the target model are business data generated by users during historical transaction executions. However, this business data typically includes some personal user data; therefore, the acquired business data must be treated as private sample data and should not be publicly disclosed.

[0063] As can be conceived, the model training methods are quite general. Besides the application scenarios described above as examples in this specification, the model training methods provided in this specification can also be used in other application scenarios to train neural network models with different functions using different training samples. Such cases should also fall within the protection scope of the model training methods provided in this specification.

[0064] It should be noted that all actions involving the acquisition and processing of user data in this manual are carried out with the user's consent.

[0065] S102: Input the private sample data into the target model to be trained to obtain the risk representation value of the transaction business output by the target model.

[0066] As mentioned in step S100, in the model training method provided in this specification, the main function of the target model to be trained is to evaluate the transactions executed by the user based on the business data of the user when executing the transaction business, that is, to output the risk characterization value of the transaction business. Therefore, the risk characterization value output by the target model can be determined in this step.

[0067] S104: Determine the first loss based on the risk characterization value and the label corresponding to the private sample data, and determine the initial gradient of the target model based on the first loss.

[0068] In the model training method provided in this specification, the private sample data consists of business data from users' historical transaction executions, and the corresponding labels indicate whether the transaction involved any risk. The labeling of a transaction is determined based on historical data. For example, if a transaction historically experienced risk or anomalies, its label is "1," indicating that the transaction involved risk; conversely, if a transaction historically did not involve any risk or anomalies, its label can be "0," indicating that the transaction involved no risk.

[0069] When determining the first loss, the label "1" can correspond to "100%" and "0" can correspond to "0%". The risk representation value output by the target model ranges from [0, 1] and is used to represent the probability that a transaction carries risk. The first loss can be determined based on the label and the risk representation value, and is used to characterize the difference between the label and the risk representation value. The first loss can be determined in several different ways, such as using cross-entropy (CE) loss.

[0070] During training, the initial gradient of the target model can be determined by backpropagation using the obtained first loss.

[0071] S106: The initial gradient is scrambled to obtain a scrambled gradient.

[0072] Based on the idea of ​​differential privacy training, in order to prevent attackers from stealing the gradient of the target model during training and thus cracking the business data used for training, the initial gradient obtained in step S104 can be scrambled in this step to obtain a scrambled gradient.

[0073] There are various ways to scramble the initial gradient, and this specification provides one embodiment for reference. Specifically, for each component of the initial gradient, a perturbation noise can be determined within a preset noise range, and the perturbation noise can be added to the gradient value of that component.

[0074] Those skilled in the art will understand that gradients are typically represented as matrices, and a matrix contains several distinct elements, or components. For each component of the initial gradient, a perturbation noise can be determined within a preset noise range and added to the gradient value of that component. This perturbation noise can be randomly selected within the preset noise range or determined according to certain rules. The preset noise range can be determined based on specific needs, and this specification does not impose specific limitations on it. However, to ensure the effectiveness of the added noise, the noise added to each component of the initial gradient is determined individually, and typically, the same amount of noise is not added to each component.

[0075] Additionally, during training, it's important to consider that since gradients are obtained by training the model using sample data, there's a correlation between gradients and the training sample data. Attackers can use gradients to deduce the training sample data. The larger the gradient, the easier it is to expose the sample data. Even though the model training method provided in this manual scrambles the initial gradient, it's easy to see that with a fixed range of added noise, the larger the initial gradient, the smaller the impact of the added noise on the initial gradient, still posing a risk of exposing some data.

[0076] Therefore, to solve the above problem, gradient clipping can be performed on the initial gradient after it is obtained. Specifically, when the value of the initial gradient is greater than a specified threshold, the value of the initial gradient can be adjusted to the specified threshold. Here, the value of the initial gradient can refer to the norm of the initial gradient; that is, when the norm of the initial gradient is greater than the specified threshold, each component of the initial gradient can be proportionally reduced so that the norm of the initial gradient equals the specified threshold.

[0077] S108: Input the perturbed gradient into the pre-trained denoising model so that the denoising model outputs a denoising gradient based on the perturbed gradient, the denoising gradient being used to simulate the relationship between the components of the initial gradient.

[0078] In this step, the perturbed gradient obtained in step S106 can be input into the pre-trained denoising model to obtain the denoised gradient output by the denoising model. The function of the denoising model is to denoise the perturbed gradient, and at the same time, to ensure that the denoised gradient contains the relationship between the components of the initial gradient.

[0079] In reality, the components of the gradient obtained during model training are not completely random. When training the same model, there are certain relationships between the components in the gradient obtained in each training iteration. Furthermore, those skilled in the art should understand that, in most cases, the gradients obtained during model training are sparse and low-rank. Therefore, in the model training method provided in this specification, a denoising model can be pre-trained. This denoising model can denoise the scrambled model while simultaneously learning the characteristics of the initial gradient without added noise—that is, the relationships between the components. Thus, the denoised gradient output by the denoising model can reflect the relationships between the components of the original initial gradient while retaining an appropriate amount of noise. In other words, it removes unnecessary noise while retaining necessary noise to protect private business data, thereby improving the training effect of the target model. The relationships between the components of the initial gradient can include the proportional relationship between the values ​​of each component, the trend of the magnitude of the values ​​of each component, and also the characteristics of the initial gradient itself, such as sparsity and low rank.

[0080] S110: The parameters of the target model are adjusted using the noise reduction gradient.

[0081] In this step, the target noise reduction gradient determined in step S108 can be used to adjust the parameters of the target model. Once the adjusted target model meets the application requirements, training can end; otherwise, if the adjusted target model still does not meet the application requirements, the model training method provided in this manual can be repeated until the parameters of the target model meet the application requirements.

[0082] When training the target model using the model training method provided in this manual, the initial gradient of the target model during backpropagation can be scrambled when training the target model with private sample data. The scrambled gradient is then processed by a pre-trained denoising model to obtain a denoised gradient that retains a certain amount of noise while reflecting the relationship between the components of the initial gradient. The target model is then adjusted based on the denoised gradient, which improves the training effect of the target model while ensuring that the private business data used for training is not exposed.

[0083] The denoising model used in the model training method provided in this specification can be pre-trained. Specifically, business data of publicly available services can be obtained from a public dataset as public sample data. This public sample data is input into the control model to be trained to obtain the control risk representation value of the publicly available services output by the control model. The control model has the same structure as the target model. Based on the control risk representation value and the corresponding labels of the public sample data, a control loss is determined. Based on the control loss, a control gradient of the control model is determined. The control gradient is scrambled to obtain a scrambled control gradient. The scrambled control gradient is input into the denoising model to be trained so that the denoising model outputs a denoising gradient to be optimized based on the scrambled control gradient. The denoising model is trained with the optimization objective of minimizing the difference between the denoising gradient to be optimized and the control gradient. The difference between the denoising gradient to be optimized and the control gradient can be represented in various ways, such as mean squared error (MSE) loss, etc. This specification does not impose specific limitations on this.

[0084] Since the function of the denoising model is to reduce the noise in gradients, and gradients are quantities generated during the training of neural network models, the training of the denoising model needs to be carried out while training other models. On the other hand, different models have different structures and require different parameters, resulting in different gradient forms during training. Therefore, to ensure that the trained denoising model can be applied to the target model, a control model with the same structure as the target model needs to be used for auxiliary training during the training of the denoising model.

[0085] In addition, since the effectiveness of the denoising model cannot be guaranteed during the training process, in order to prevent the exposure of private business data, public business data obtained from public datasets is used as public sample data for input control models when training the denoising model.

[0086] Similar to training the target model, the public sample data also has corresponding annotations when training the control model. The annotation format is the same as that of the private sample data, using "1" and "0" to represent different values: "1" indicates that the corresponding public business has historically been risky, and "0" indicates that the corresponding public business has historically not been risky. Based on the annotations of the public sample data and the control risk representation values ​​output by the control model, the control gradient during training can be determined.

[0087] Similarly, the control gradient also needs to be scrambled during training. The scrambling method can be the same as the scrambling method used for the initial gradient when training the target model, which will not be elaborated here. The scrambled control gradient is input into the denoising model to obtain the denoised gradient to be optimized output by the denoising model. The denoising model is trained with the goal of minimizing the difference between the denoised gradient to be optimized and the control gradient before scrambling. Thus, upon completion of training, a denoising model can be obtained that can denoise the scrambled gradient and simulate the relationship between the components of the gradient before scrambling.

[0088] In practical applications, denoising models cannot achieve 100% perfect training. Therefore, they cannot completely remove noise from the gradients, and the resulting denoised gradients will inevitably retain some noise. This retained noise can then be used to protect the training data, and the removed noise improves the model's training performance.

[0089] When training a denoising model, it learns the relationships between the components of the gradient without added noise. These relationships can be ratios of gradient values, magnitudes, or a sum of both. The denoising model also learns characteristics of the gradient without added noise, such as sparsity and low rank. Sparsity means that most components of the gradient have a value of 0; low rank means the gradient matrix has a small rank. For example, in the gradient without added noise, some components may have a value of 0. After adding noise, these components will no longer have a value of 0; however, after processing by the denoising model, the values ​​of these components will return to 0.

[0090] Furthermore, although the control model and the target model have the same structure, the public sample data and the private sample data will inevitably differ. Therefore, when training the control model and the target model using public sample data and private sample data respectively, the parameter changes of the two models will also differ, which means that the gradients of the models will differ. To enable the denoising model trained with the assistance of the control model to better adapt to the target model, the target model and the control model can be aligned to a certain extent. Specifically, the private sample features output from the intermediate layer of the target model can be obtained; the public sample data can be input into the target model to obtain the public sample features output from the intermediate layer of the target model; and a second loss between the private sample features and the public sample features can be determined.

[0091] The intermediate layers of the target model can be any layer in the target model that can output feature vectors. Generally, except for the last layer of the target model, which is the output layer, other network layers can be used as intermediate layers; to ensure the best results, the first layer of the target model is usually used as an intermediate layer.

[0092] While obtaining the private sample features output from the intermediate layer of the target model, public sample data can also be input into the target model to obtain the public sample features output from the intermediate layer of the target model; then, a second loss is determined between the private sample features and the public sample features. This second loss can be obtained in various ways, such as the Coral loss, and this specification does not impose specific limitations on it.

[0093] After determining the second loss, it can be used as one of the reference values, together with the first loss, to determine the initial gradient. Specifically, the initial gradient of the target model can be determined based on the first loss and the second loss. Alternatively, the first and second losses can be directly added together to obtain a loss sum, and the initial gradient of the target model can be determined based on this loss sum; alternatively, different weights can be assigned to the first and second losses respectively to obtain a weighted sum of the first and second losses, and the initial gradient of the target model can be determined based on this weighted sum. This specification does not impose specific limitations on this approach.

[0094] The above describes one or more methods for implementing model training in this manual. Based on the same approach, this manual also provides corresponding model training devices, such as... Figure 2 As shown.

[0095] Figure 2 A schematic diagram of a model training device provided in this specification includes:

[0096] The acquisition module 200 is used to acquire business data of users when they have executed transactions in the past, as private sample data.

[0097] Input module 202 is used to input the private sample data into the target model to be trained, and obtain the risk characterization value of the transaction business output by the target model;

[0098] The gradient determination module 204 is used to determine a first loss based on the risk characterization value and the label corresponding to the private sample data, and to determine the initial gradient of the target model based on the first loss.

[0099] The scrambling module 206 is used to scramble the initial gradient to obtain a scrambled gradient;

[0100] The noise reduction module 208 is used to input the perturbation gradient into a pre-trained noise reduction model so that the noise reduction model outputs a noise reduction gradient based on the perturbation gradient. The noise reduction gradient is used to simulate the relationship between the components of the initial gradient.

[0101] The adjustment module 210 is used to adjust the parameters of the target model using the noise reduction gradient.

[0102] Optionally, the device further includes a pre-training module 212, specifically used to obtain public business data from a public dataset as public sample data; input the public sample data into a control model to be trained to obtain the control risk representation value of the public business output by the control model, wherein the control model has the same structure as the target model; determine the control loss based on the control risk representation value and the label corresponding to the public sample data; determine the control gradient of the control model based on the control loss; scramble the control gradient to obtain a scrambled control gradient; input the scrambled control gradient into a denoising model to be trained, so that the denoising model outputs a denoising gradient to be optimized based on the scrambled control gradient; and train the denoising model with the minimum difference between the denoising gradient to be optimized and the control gradient as the optimization objective.

[0103] Optionally, the device further includes a loss determination module 214, specifically configured to: acquire private sample features output from the intermediate layer of the target model; input the public sample data into the target model to acquire the public sample features output from the intermediate layer of the target model; and determine a second loss between the private sample features and the public sample features.

[0104] Optionally, the gradient determination module 204 is specifically used to determine the initial gradient of the target model based on the first loss and the second loss.

[0105] Optionally, the device further includes a trimming module 216, specifically used to adjust the value of the initial gradient to the specified threshold when the value of the initial gradient is greater than the specified threshold.

[0106] Optionally, the scrambling module 206 is specifically used to determine perturbation noise within a preset noise range for each component in the initial gradient, and to add the perturbation noise to the gradient value of that component.

[0107] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 This provides a model training method.

[0108] This instruction manual also provides Figure 3 One of the corresponding Figure 1 A schematic diagram of the structure of an electronic device. (e.g.) Figure 3 At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1 The model training method described herein. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0109] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0110] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0111] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0112] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0113] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0114] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0115] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0116] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0117] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0118] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0119] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0120] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0121] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0122] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0123] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0124] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A model training method, comprising: Obtain business data from users' historical transaction transactions as private sample data; The private sample data is input into the target model to be trained to obtain the risk characterization value of the transaction business output by the target model; Based on the risk characterization value and the label corresponding to the private sample data, a first loss is determined, and the initial gradient of the target model is determined based on the first loss. The initial gradient is scrambled to obtain a scrambled gradient; The perturbation gradient is input into a pre-trained denoising model so that the denoising model outputs a denoising gradient based on the perturbation gradient. The denoising gradient is used to simulate the relationship between the components of the initial gradient. The parameters of the target model are adjusted using the denoising gradient.

2. The method as described in claim 1, wherein pre-training the denoising model specifically includes: Business data of publicly disclosed business operations are obtained from a public dataset and used as public sample data. The public sample data is then input into a control model to be trained to obtain the control risk characterization value of the publicly disclosed business output by the control model. The control model has the same structure as the target model. Based on the control risk characterization value and the corresponding labels of the public sample data, the control loss is determined, and the control gradient of the control model is determined based on the control loss; The control gradient is scrambled to obtain a scrambled control gradient; The perturbation-controlled gradient is input into the denoising model to be trained, so that the denoising model outputs the denoising gradient to be optimized based on the perturbation-controlled gradient. The denoising model is trained with the goal of minimizing the difference between the denoising gradient to be optimized and the control gradient.

3. The method of claim 2, further comprising, before determining the initial gradient of the target model: Obtain the private sample features output from the intermediate layer of the target model; The common sample data is input into the target model to obtain the common sample features output by the intermediate layer of the target model; Determine a second loss between the private sample features and the public sample features.

4. The method as described in claim 3, wherein determining the initial gradient of the target model based on the first loss specifically includes: The initial gradient of the target model is determined based on the first loss and the second loss.

5. The method of claim 1, further comprising, before scrambling the initial gradient: When the value of the initial gradient is greater than the specified threshold, the value of the initial gradient is adjusted to the specified threshold.

6. The method of claim 1, wherein scrambling the initial gradient specifically includes: For each component in the initial gradient, a perturbation noise is determined within a preset noise range, and the perturbation noise is added to the gradient value of that component.

7. A model training device, comprising: The acquisition module is used to acquire business data from when users performed transactions in the past, as private sample data. The input module is used to input the private sample data into the target model to be trained, and obtain the risk characterization value of the transaction business output by the target model; The gradient determination module is used to determine a first loss based on the risk characterization value and the label corresponding to the private sample data, and to determine the initial gradient of the target model based on the first loss. A scrambling module is used to scramble the initial gradient to obtain a scrambled gradient; A noise reduction module is used to input the perturbation gradient into a pre-trained noise reduction model so that the noise reduction model outputs a noise reduction gradient based on the perturbation gradient. The noise reduction gradient is used to simulate the relationship between the components of the initial gradient. An adjustment module is used to adjust the parameters of the target model using the noise reduction gradient.

8. The apparatus of claim 7, further comprising a pre-training module, specifically configured to acquire business data of publicly available services from a public dataset as public sample data, input the public sample data into a control model to be trained, and obtain the control risk characterization value of the publicly available services output by the control model, wherein, The control model has the same structure as the target model; the control loss is determined based on the control risk characterization value and the corresponding label of the public sample data, and the control gradient of the control model is determined based on the control loss; the control gradient is scrambled to obtain a scrambled control gradient; the scrambled control gradient is input into the denoising model to be trained, so that the denoising model outputs the denoising gradient to be optimized based on the scrambled control gradient; the denoising model is trained with the minimum difference between the denoising gradient to be optimized and the control gradient as the optimization objective.

9. The apparatus of claim 8, further comprising a loss determination module, specifically configured to: acquire private sample features output from the intermediate layer of the target model; input the public sample data into the target model to acquire the public sample features output from the intermediate layer of the target model; and determine a second loss between the private sample features and the public sample features.

10. The apparatus of claim 9, wherein the gradient determination module is specifically configured to determine the initial gradient of the target model based on the first loss and the second loss.

11. The apparatus of claim 7, further comprising a trimming module, specifically configured to adjust the value of the initial gradient to the specified threshold when the value of the initial gradient is greater than the specified threshold.

12. The apparatus of claim 7, wherein the scrambling module is specifically configured to determine perturbation noise within a preset noise range for each component in the initial gradient, and to add the perturbation noise to the gradient value of the component.

13. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 6.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 6.

Images