A method, apparatus, and equipment for processing a model.

Abstract

This specification discloses a model processing method, apparatus, and device. The method includes: receiving a target model from a server; acquiring sample data for training the target model, and training the target model based on the sample data to determine the gradient information corresponding to the target model after training; symbolizing the gradient information corresponding to the target model to obtain symbolic gradient information; sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule to obtain differential privacy gradient information; and sending the differential privacy gradient information to the server, wherein the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a method, apparatus and device for processing a model. Background Technology

[0002] Training a model using user data on a cloud server and then using that model to serve users is already common practice in current internet services. However, this approach inevitably relies on the cloud server's collection and analysis of user privacy data. Currently, laws, regulations, and industry standards related to user data privacy and security are becoming increasingly mature, and users themselves are paying more and more attention to the security of their privacy data. Therefore, the server-side data analysis and processing paradigm is no longer suitable for current data processing requirements.

[0003] To address the above issues, a distributed machine learning technique—federated learning—is proposed. Federated learning keeps most of the computation process and data locally on the user's device, replacing the original user data with gradient information needed for model updates sent to the cloud server, thus achieving usability without visibility of user data. However, when uploading gradient information to the server, intermediate gradient information is included. Attackers can analyze this intermediate gradient information to reconstruct parts of the original data, leading to privacy breaches. Furthermore, when there are many terminal devices, there is a large amount of communication between the server and these devices, resulting in significant communication overhead. Therefore, a technical solution with superior privacy protection and lower communication overhead is needed. Summary of the Invention

[0004] The purpose of the embodiments in this specification is to provide a technical solution with better privacy protection and lower communication overhead.

[0005] To achieve the above technical solution, the embodiments in this specification are implemented as follows:

[0006] This specification provides a model processing method, comprising: receiving a target model from a server; acquiring sample data for training the target model, and training the target model based on the sample data to determine the gradient information corresponding to the target model after training; symbolically processing the gradient information corresponding to the target model to obtain symbolic gradient information; sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule to obtain differential privacy gradient information; and sending the differential privacy gradient information to the server, wherein the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0007] This specification provides a model processing method, comprising: receiving differential privacy gradient information of a target model uploaded by a terminal device, wherein the differential privacy gradient information is obtained by the terminal device training the target model based on sample data acquired for training the target model, determining the gradient information corresponding to the target model after training, and symbolically processing the gradient information corresponding to the target model to obtain symbolic gradient information corresponding to the target model; sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule; aggregating the received differential privacy gradient information to obtain aggregated differential privacy gradient information; decoding the aggregated differential privacy gradient information to obtain corresponding target symbolic gradient information; and updating the target model based on the target symbolic gradient information to obtain an updated target model.

[0008] This specification provides a model processing apparatus, comprising: a model receiving module for receiving a target model from a server; a gradient acquisition module for acquiring sample data for training the target model, training the target model based on the sample data, and determining the gradient information corresponding to the target model after training; a differential privacy module for symbolizing the gradient information corresponding to the target model to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule to obtain differential privacy gradient information; and a gradient sending module for sending the differential privacy gradient information to the server, wherein the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0009] This specification provides a model processing apparatus, comprising: a differential gradient receiving module, which receives differential privacy gradient information of a target model uploaded by a terminal device. The differential privacy gradient information is obtained by the terminal device training the target model using sample data acquired for training the target model, determining the gradient information corresponding to the target model after training, symbolizing the gradient information to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule. An aggregation module aggregates the received differential privacy gradient information to obtain aggregated differential privacy gradient information. A decoding module decodes the aggregated differential privacy gradient information to obtain corresponding target symbolic gradient information. A model update module updates the target model based on the target symbolic gradient information to obtain an updated target model.

[0010] This specification provides a model processing device comprising: a processor; and a memory arranged to store computer-executable instructions, wherein the executable instructions, when executed, cause the processor to: receive a target model from a server; acquire sample data for training the target model, and train the target model based on the sample data to determine the gradient information corresponding to the target model after training; perform symbolic processing on the gradient information corresponding to the target model to obtain symbolic gradient information corresponding to the target model; sample the symbolic gradient information based on a preset probability distribution rule, and encode the sampled symbolic gradient information based on the probability distribution rule to obtain differential privacy gradient information; and send the differential privacy gradient information to the server, wherein the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0011] This specification provides a model processing device comprising: a processor; and a memory arranged to store computer-executable instructions. When executed, the executable instructions cause the processor to: receive differential privacy gradient information of a target model uploaded by a terminal device. The differential privacy gradient information is obtained by the terminal device training the target model based on acquired sample data used for training the target model, determining the gradient information corresponding to the target model after training, and symbolically processing the gradient information to obtain symbolic gradient information corresponding to the target model. The received differential privacy gradient information is then sampled based on a preset probability distribution rule, and the sampled symbolic gradient information is encoded based on the probability distribution rule. The received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information. The aggregated differential privacy gradient information is decoded to obtain corresponding target symbolic gradient information. The target model is then updated based on the target symbolic gradient information to obtain an updated target model.

[0012] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: receiving a target model from a server; acquiring sample data for training the target model and training the target model based on the sample data to determine the gradient information corresponding to the target model after training; symbolizing the gradient information corresponding to the target model to obtain symbolic gradient information; sampling the symbolic gradient information based on a preset probability distribution rule and encoding the sampled symbolic gradient information based on the probability distribution rule to obtain differential privacy gradient information; and sending the differential privacy gradient information to the server, which triggers the server to update the target model stored on the server based on the differential privacy gradient information.

[0013] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: receiving differential privacy gradient information of a target model uploaded by a terminal device. The differential privacy gradient information is obtained by the terminal device training the target model using sample data acquired for training the target model, determining the gradient information corresponding to the target model after training, and symbolically processing the gradient information to obtain symbolic gradient information. The symbolic gradient information is then sampled based on a preset probability distribution rule, and encoded based on the probability distribution rule. The received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information. The aggregated differential privacy gradient information is decoded to obtain corresponding target symbolic gradient information. The target model is updated based on the target symbolic gradient information to obtain an updated target model. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a schematic diagram of the processing system for one model in this specification;

[0016] Figure 2A This is an embodiment of a model processing method described in this specification;

[0017] Figure 2B This is a schematic diagram illustrating the processing procedure of one model in this specification;

[0018] Figure 3 This is a schematic diagram illustrating the processing procedure of another model in this specification;

[0019] Figure 4 This is a schematic diagram illustrating the processing procedure of another model in this specification;

[0020] Figure 5A This is an embodiment of another model processing method described in this specification;

[0021] Figure 5B This is a schematic diagram illustrating the processing procedure of another model in this specification;

[0022] Figure 6This is a schematic diagram illustrating the processing procedure of another model in this specification;

[0023] Figure 7 This is a schematic diagram illustrating the processing procedure of another model in this specification;

[0024] Figure 8 This is an embodiment of a processing device for a model described in this specification;

[0025] Figure 9 This is another embodiment of the processing device for a different model in this specification;

[0026] Figure 10 This is an embodiment of a processing device for one model in this specification. Detailed Implementation

[0027] This specification provides a method, apparatus, and device for processing a model.

[0028] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0029] This specification provides an embodiment of a federated learning mechanism. For federated learning, such as... Figure 1 As shown, its system architecture may include user terminal devices and a server. The server may include a model to be trained. The server can distribute the model to each user's terminal device. The user's terminal device can use the model distributed by the server as an initial model and train the initial model using sample data in the terminal device. After training, the gradient information corresponding to the model is determined. Then, the gradient information is symbolized and sampled according to a preset probability distribution rule. Finally, differential privacy gradient information is obtained through encoding and provided to the server so that the server can update its model. For specific processing details, please refer to the specific content in the following embodiments.

[0030] Example 1

[0031] like Figure 2A and Figure 2BAs shown in the embodiments of this specification, a method for processing a model is provided. The execution subject of this method can be a terminal device, which can be a mobile phone, tablet computer, or a computer device such as a laptop or desktop computer, or an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The method may specifically include the following steps:

[0032] In step S202, the target model sent by the server is received.

[0033] The server can be a server used to train the target model, or it can be a backend server of the business to which the target model belongs, etc., which can be set according to the actual situation. This specification does not limit this. The target model can be a model constructed using a specified algorithm, which can include classification algorithms, neural network algorithms, etc., which can be set according to the actual situation. This specification does not limit this. The target model can be used for data recognition (such as fingerprint recognition, face recognition, text recognition, etc.), or it can be used for the detection of predetermined risks (such as fraud risk or illegal transaction risk, etc.).

[0034] In practice, training a model using user data on a cloud server and then using that model to serve users is already very common in current internet services. However, this approach inevitably relies on the cloud server's collection and analysis of user privacy data. Currently, laws, regulations, and industry standards related to user data privacy and security are becoming increasingly mature, and users themselves are paying more and more attention to the security of their privacy data. Therefore, the server-side data analysis and processing paradigm is no longer suitable for current data processing requirements.

[0035] To address the above issues, a distributed machine learning technique—federated learning—is proposed. Federated learning allows most of the computation process and data to remain local to the user, replacing the original user data with gradient information needed for model updates sent to the cloud server, thus achieving usability without visibility of user data. Simultaneously, users can directly use the edge-side model for model inference and business decisions, significantly reducing data processing latency. However, even with this approach, privacy leaks still occur, and communication overhead increases. Specifically, when uploading gradient information to the server, intermediate gradient information is often included. Attackers can analyze this intermediate gradient information to reconstruct parts of the original data, leading to privacy leaks. Furthermore, when there are many terminal devices, there is a large amount of communication between the server and these devices, resulting in significant communication overhead. This is especially true as models become increasingly large; when hundreds or thousands of terminal devices send data to the server within short time intervals, the server's communication overhead is further exacerbated, potentially even causing link collapse.

[0036] Typically, privacy-preserving federated learning mechanisms can protect privacy data by pruning gradient information and adding noise on the server or terminal device side, then updating the model using the noisy gradient. However, if gradient pruning and noise addition are implemented on the server side, a trusted server is required. If gradient pruning and noise addition are performed on the terminal device side, it is difficult for the server to verify whether the terminal device actually performed these operations, potentially leading to vulnerability to Byzantine attacks. Furthermore, the gradient threshold used for pruning is a hyperparameter highly relevant to model performance, presenting a difficult hyperparameter tuning problem. Moreover, these operations do not improve communication; the terminal device still needs to upload or download an amount of information equal to the model size during each communication round. Therefore, a technical solution with better privacy protection and lower communication overhead is needed. This specification provides an achievable technical solution, which may include the following:

[0037] For federated learning, such as Figure 1 As shown, the server can include the model to be trained (i.e., the target model). The server can distribute the target model to each user's terminal device. The user's terminal device can use the target model distributed by the server as the initial model so that the initial model can be trained using the sample data in the terminal device later.

[0038] In step S204, sample data for training the target model is obtained, and the target model is trained based on the sample data to determine the gradient information of the target model after training.

[0039] In implementation, to train the target model in the terminal device, corresponding sample data is required. This sample data can be set according to the needs of the target model. In practical applications, when users process certain business through the terminal device, the terminal device can store relevant data. When a specified period or a certain time interval is reached, the terminal device can obtain the relevant data generated within the specified period or time interval. The obtained data can be used as sample data for training the target model. This sample data may include label information for training the target model. Specifically, for financial transactions in online financial institutions (especially internet financial institutions), there are a large number of financial transactions every day. These transactions may be for a single user or for multiple different specified users. Based on this, relevant information for each financial transaction can be recorded (e.g., user behavior information, account information of both parties, transaction amount, transaction time, and transaction location). This recorded information can be used as sample data.

[0040] After obtaining sample data in the above manner, the model parameters in the target model can be initialized to obtain the initial model parameters, and then the initial target model can be obtained. The sample data can be input into the target model to obtain the corresponding output results. Based on the obtained output results and combined with the label information of the sample data, the loss information of the target model can be determined through a preset loss function. The gradient information of the target model after model training can be determined based on the loss information.

[0041] It should be noted that the gradient information corresponding to the target model after model training can be the gradient information obtained above, or it can be the gradient information obtained above further processed according to the specified processing method (for example, an encoder can be set and the encoder can be used to encode the gradient information above). The processing result is used as the gradient information corresponding to the target model after model training, etc. The specific settings can be set according to the actual situation, and the embodiments in this specification do not limit this.

[0042] In step S206, the gradient information corresponding to the target model is symbolized to obtain the symbolic gradient information corresponding to the target model. The symbolic gradient information is sampled based on a preset probability distribution rule, and the sampled symbolic gradient information is encoded based on the probability distribution rule to obtain differential privacy gradient information.

[0043] Symbolization can be achieved by compressing the values ​​of each dimension in the gradient information from floating-point numbers into specified symbols. Then, the symbolic gradient information containing the specified symbols can be used to optimize the target model. This solves the performance bottleneck problem caused by frequent and large-scale communication of gradient information in large-scale distributed machine learning. Probability distribution rules refer to rules used to describe the probabilistic laws governing the values ​​of random variables. The probability of an event represents the likelihood of a particular outcome occurring in a single experiment. To fully understand an experiment, it is necessary to know all possible outcomes and the probabilities of each outcome, i.e., the probability distribution of the random experiment. Probability distribution rules can include various types, such as binomial distribution and Bernoulli distribution, and can be specifically set according to actual conditions. This specification does not limit this specific rule in the embodiments.

[0044] In implementation, to reduce the amount of data transmitted to the server, a small number of symbols can be set according to the actual situation. Specifically, two or three symbols can be set, such as "+1" and "-1", or "A", "B", and "C", etc. The specific symbols can be set according to the actual situation, and this specification does not limit this. Then, according to the preset mapping rules, the information of each dimension in the gradient information corresponding to the target model can be mapped to the aforementioned small number of symbols. For example, the information of the gradient information of dimensions greater than a first threshold can be mapped to "A", the information of the gradient information of dimensions less than a second threshold can be mapped to "C", and the information of the gradient information of dimensions greater than the second threshold and less than the first threshold can be mapped to "B". The first threshold is greater than the second threshold. The above is only one possible mapping method. In practical applications, many different mapping methods can be included, which can be set according to the actual situation and will not be elaborated here. Through the above mapping process, the gradient information corresponding to the target model can be symbolized, thereby obtaining the symbolic gradient information corresponding to the target model.

[0045] To protect the gradient information corresponding to the target model, differential privacy processing can be applied to the aforementioned symbolic gradient information. Specifically, a stochastic response mechanism can be used to protect the symbolic gradient information. This involves pre-setting probability distribution rules based on the actual situation, and then sampling the symbolic gradient information according to these rules to obtain the corresponding sampling results (i.e., the sampled symbolic gradient information). Encoding rules can also be pre-set based on the actual situation. For example, the symbols corresponding to the sampling results can be adjusted according to the probability distribution in the probability distribution rules. Specifically, based on the probability distribution rules, the encoding rules can be used to encode the sampled symbolic gradient information to obtain differential privacy gradient information. For instance, based on different probability distributions in the probability distribution rules, the encoding rules can be used to readjust the symbols corresponding to the sampling results, allowing the symbolic gradient information to be resampled and encoded to obtain differential privacy gradient information. The number of encoded symbols in the differential privacy gradient information can remain constant or be reduced, depending on the specific circumstances.

[0046] In step S208, the differential privacy gradient information is sent to the server. The differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0047] In implementation, the terminal device can upload the obtained differential privacy gradient information to the server. After receiving the differential privacy gradient information, the server can decode it to obtain the corresponding symbolic gradient information. The server can then reconstruct the corresponding gradient information from the symbolic gradient information and use this gradient information to update the model parameters of the target model stored on the server, thus obtaining the updated target model. The updated target model can then be sent to the designated terminal device. If the updated target model meets the specified convergence condition, no further update is needed. If the updated target model does not meet the specified convergence condition, the terminal device can be instructed to re-execute steps 202 to S208 until the updated target model meets the specified convergence condition.

[0048] This specification provides a model processing method. It involves receiving a target model from a server, acquiring sample data for training the target model, training the target model based on the sample data, determining the gradient information of the trained target model, symbolizing the gradient information to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can then update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is significantly reduced, achieving a compression of communication overhead by a certain factor. Furthermore, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0049] Example 2

[0050] like Figure 3 As shown in the embodiments of this specification, a method for processing a model is provided. The execution subject of this method can be a terminal device, which can be a mobile phone, tablet computer, or a computer device such as a laptop or desktop computer, or an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The method may specifically include the following steps:

[0051] In step S302, the target model sent by the server is received.

[0052] In step S304, sample data for training the target model is obtained, and the target model is trained based on the sample data to obtain the initial gradient information corresponding to the target model.

[0053] In implementation, sample data for training the target model can be obtained from the terminal device. Alternatively, the terminal device can record data input by the user during the execution of a certain service. When training the target model is required, sample data for training the target model can be obtained from the recorded data. The specific settings can be configured according to the actual situation. Then, the sample data can be used to train the target model, and the gradient information obtained from the model training can be used as the initial gradient information for the target model.

[0054] In step S306, historical gradient information of the target model is obtained. Based on the historical gradient information and the initial gradient information, the gradient information corresponding to the target model is determined by an adaptive optimization algorithm, which includes the Adam algorithm or the Adagrad algorithm.

[0055] The Adam (Adaptive Moment Estimation) algorithm is an optimized algorithm that comprehensively considers the first-order momentum (or first-order moment estimate, i.e., the mean of the gradient) and second-order momentum (or second-order moment estimate, i.e., the uncentered variance of the gradient) of the gradient information to calculate the update step size. The Adagrad algorithm can automatically adjust the size of the features of the learning data, thereby reducing the problem of insufficient model training.

[0056] In implementation, historical gradient information of the target model can be obtained according to the actual situation. Specifically, if the target model has not yet undergone model training, the historical gradient information after initialization can be obtained. If the target model has already undergone model training, the gradient information generated in the previous model training can be obtained, and this gradient information can be used as the historical gradient information obtained above. Alternatively, the gradient information generated in any previous model training can be obtained, and this gradient information can be used as the historical gradient information obtained above, etc. The specific settings can be configured according to the actual situation. Then, based on the historical gradient information and the initial gradient information, the gradient information corresponding to the target model can be calculated according to the calculation method set by the Adam algorithm or Adagrad algorithm. The specific calculation method can be based on the Adam algorithm or Adagrad algorithm, which will not be elaborated here.

[0057] The process of determining the gradient information corresponding to the target model based on historical gradient information and initial gradient information through an adaptive optimization algorithm in step S306 above can be varied. The following provides an optional processing method, which may specifically include the processing in steps A2 and A4.

[0058] In step A2, the first-order momentum and second-order momentum corresponding to the historical gradient information are determined based on the historical gradient information.

[0059] In implementation, the terminal device can store the first-order momentum and second-order momentum corresponding to different historical gradient information. When it is necessary to obtain the first-order momentum and second-order momentum corresponding to a certain historical gradient information, the first-order momentum and second-order momentum corresponding to the historical gradient information generated in the previous model training can be retrieved from the historical gradient information. For example, the first-order momentum corresponding to the historical gradient information can be m_{i,t-1}, and the second-order momentum corresponding to the historical gradient information can be v_{i,t-1}, where t represents the t-th model training round (i.e., the round of the current model training), and i represents the model parameters.

[0060] In step A4, based on the first-order and second-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the target model, the first-order and second-order momentum corresponding to the initial gradient information are determined, and based on the first-order and second-order momentum corresponding to the initial gradient information, the gradient information corresponding to the target model is determined.

[0061] In practice, the first-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the target model can be input into the following formula to obtain the first-order momentum corresponding to the initial gradient information.

[0062] m_{i,t}=1*m_{i,t-1}+(1-1)*g_i

[0063] Where 1 represents the exponential decay rate, and g_i represents the initial gradient information corresponding to the target model.

[0064] The first-order momentum corresponding to the historical gradient information, the second-order momentum corresponding to the historical gradient information, and the initial gradient information corresponding to the target model can be input into the following formula to obtain the second-order momentum corresponding to the initial gradient information.

[0065] v_{i,t}=2*v_{i,t-1}+(1-2)*[1*m_{i,t-1}+(1-1)*g_i] 2

[0066] Where 2 represents the exponential decay rate.

[0067] After obtaining the first-order momentum and second-order momentum corresponding to the initial gradient information through the above method, the first-order momentum and second-order momentum corresponding to the initial gradient information can be fused and calculated. The calculation result can be used as the gradient information corresponding to the target model. For example, the first-order momentum and second-order momentum corresponding to the initial gradient information can be input into the following formula for calculation, and the calculation result can be used as the gradient information corresponding to the target model.

[0068] g'_i=m_{i,t} / sqrt(v_{i,t})

[0069] Where g'_i represents the gradient information corresponding to the target model.

[0070] In practical applications, gradient information corresponding to the target model can also be calculated through other fusion calculation methods. For example, the result of m_{i,t} / sqrt(v_{i,t}) can be multiplied by a preset parameter, and the result can be used as the gradient information corresponding to the target model. Alternatively, the result of m_{i,t}+sqrt(v_{i,t}) can be used as the gradient information corresponding to the target model. The specific settings can be determined according to the actual situation.

[0071] A local adaptive strategy was used before the symbolic optimization. This ensured the smoothness of the gradient information before the symbolic optimization and made the symbolic optimization less affected by outliers.

[0072] The process of determining the first and second momentum corresponding to the initial gradient information based on the historical gradient information and the initial gradient information of the target model in step A4 above can be varied. The following provides an optional processing method, which may include the processing in steps A42 and A44.

[0073] In step A42, the first-order momentum corresponding to the initial gradient information is determined based on the first-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the target model.

[0074] The specific processing method for step A42 can be found in the above-mentioned content, and will not be repeated here.

[0075] In step A44, the second momentum corresponding to the initial gradient information is determined based on the second momentum corresponding to the historical gradient information and the first momentum corresponding to the initial gradient information.

[0076] In practice, the second-order momentum corresponding to the historical gradient information and the first-order momentum corresponding to the initial gradient information can be input into the following formula to obtain the second-order momentum corresponding to the initial gradient information.

[0077] v_{i,t}=2*v_{i,t-1}+(1-2)*m_{i,t}^2.

[0078] The gradient information corresponding to the target model is obtained in the above manner. Since the gradient information corresponding to the target model contains a large amount of information, if multiple terminal devices upload the gradient information to the server at the same time, it will increase the communication overhead of the server. Therefore, the above gradient information can be symbolically optimized to reduce the communication overhead of the server. For details, please refer to the processing in step S308 below.

[0079] In step S308, the gradient information corresponding to the target model whose value is greater than a preset threshold in each axis is set as the first symbol, and the gradient information corresponding to the target model whose value is less than the preset threshold in each axis is set as the second symbol, so as to obtain the symbol gradient information corresponding to the target model. The first symbol and the second symbol are different.

[0080] The preset threshold can include various values, such as 0 or 1, and can be set according to the actual situation. This specification does not limit this. The first symbol and the second symbol can be various. For example, the first symbol and the second symbol can both be numbers, both can be letters, or they can be specified characters. They can also be one of numbers and the other of letters, etc., and can be set according to the actual situation. This specification does not limit this.

[0081] In practical applications, the preset threshold in step S308 can be 0, the first sign can be +1, and the second sign can be -1. Then, the gradient information corresponding to the target model with a value greater than 0 on each axis can be set to +1, and the gradient information corresponding to the target model with a value less than 0 on each axis can be set to -1. The final result is the symbolic gradient information corresponding to the target model. In this way, the symbolic gradient information corresponding to the target model can be regarded as a binary vector, with each axis taking a value between the two signs +1 and -1. Each terminal device will have a symbolic gradient information in each model training round, which can greatly reduce communication overhead.

[0082] To protect users' privacy data, a random response differential privacy mechanism can be used to protect the uploaded symbol gradient information, as detailed in steps S310 to S314 below.

[0083] In step S310, the symbol gradient information is sampled based on a preset probability distribution rule to obtain sampled symbol gradient information composed of multiple sampling points.

[0084] The probability distribution rule can be a distribution rule that includes two probabilities. For example, for a certain experiment, the experiment includes two experimental results. The probability of one experimental result can be the first probability (which can be represented by p), and the probability of the other experimental result can be the second probability (which can be represented by q). The second probability q = 1 - p. For the sake of convenience, the experimental result corresponding to the first probability can be represented by "0", and the experimental result corresponding to the second probability can be represented by "1", etc.

[0085] In implementation, the symbol gradient information is sampled based on a preset probability distribution rule. During the sampling process, information about the corresponding sampling points, as well as the probability or experimental result corresponding to each sampling point, can be recorded. For example, for the first sampling point, relevant information about the first sampling point (such as its location and identifier) ​​can be recorded, and the probability corresponding to the first sampling point can be recorded as the first probability p (the corresponding experimental result is 1). Finally, the sampled symbol gradient information can be constructed from multiple sampling points.

[0086] In step S312, for each sampling point in the sampled symbol gradient information, if the first probability of the two different probabilities contained in the probability distribution rule corresponding to the sampling point is determined based on the probability distribution rule, and the sampling point is the second symbol, then the second symbol of the sampling point is deleted.

[0087] In practical applications, if the sampling point corresponds to the first probability among two different probabilities in the probability distribution rule, and the sampling point has the second symbol, then the second symbol of the sampling point is deleted. Conversely, if the sampling point has the first symbol, no processing is required; that is, the sampling point can remain unchanged as having the first symbol. In another embodiment of this specification, in the above case, if the sampling point has the second symbol, then the second symbol of the sampling point is deleted. Simultaneously, the symbol gradient information of the sampling point can also be set to 0, etc., depending on the actual situation.

[0088] In step S314, for each sampling point in the sampled symbol gradient information, if the sampling point corresponds to the second probability among two different probabilities contained in the probability distribution rule based on the probability distribution rule, then the sampling point is resampled based on the probability distribution rule, and the symbol gradient information of the resampled sampling point is reassigned according to the corresponding probability contained in the probability distribution rule, and finally the differential privacy gradient information is obtained.

[0089] In implementation, for example, for a certain sampling point in the sampled symbol gradient information, if it is determined based on the probability distribution rule that the sampling point corresponds to the second probability among two different probabilities contained in the probability distribution rule, then the sampling point is resampled based on the probability distribution rule. If the resampled sampling point corresponds to the first probability, the symbol of the resampled sampling point can be deleted (if the resampled sampling point is the first symbol, then the first symbol is deleted; if the resampled sampling point is the second symbol, then the second symbol is deleted). If the resampled sampling point corresponds to the second probability, the symbol gradient information of the resampled sampling point can be set to a new symbol, or it can be set to the first symbol or the second symbol, etc. The specific setting can be determined according to the actual situation. The above method can greatly improve the security of user privacy data.

[0090] In practical applications, the probability distribution rule in step S314 above may include the Bernoulli distribution, where the first probability is the probability corresponding to 0 in the Bernoulli distribution and the second probability is the probability corresponding to 1 in the Bernoulli distribution. Therefore, the process of reassigning the sign gradient information of the resampled sampling points according to the corresponding probabilities contained in the probability distribution rule in step S314 above can be varied. The following provides an optional processing method, which may specifically include the processing in steps B2 and B4.

[0091] In step B2, if the resampled sampling point corresponds to the first probability, then the sign gradient information of the resampled sampling point is set to 0.

[0092] In step B4, if the resampled sampling point corresponds to the second probability, then the sign gradient information of the resampled sampling point is set to +1.

[0093] Through the processing in steps B2 and B4 above, the symbol gradient information can be transformed from a binary vector with values ​​between +1 and -1 on each axis into a binary vector with values ​​between +1 and 0 on each axis.

[0094] It should be noted that the higher the second probability in the probability distribution rule, the higher the security of the encoding result (or differential privacy processing result). In addition, considering the accuracy of subsequent decoding, an appropriate probability distribution rule can be selected for the above encoding process.

[0095] In step S316, the differential privacy gradient information is sent to the server. The differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0096] It should be noted that the server can subsequently distribute the updated target model to the designated terminal device. If the updated target model meets the specified convergence condition, there is no need to update the target model again. If the updated target model does not meet the specified convergence condition, the terminal device can be instructed to re-execute the above steps 302 to S316 until the updated target model meets the specified convergence condition. Based on this, the target model in step S302 can also be the model distributed by the server after updating the target model stored in the server with the differential privacy gradient information sent by the terminal device, and determining that the updated target model does not meet the preset convergence condition.

[0097] Based on the above processing, by using symbolic gradient information for data transmission during communication, the required storage space for gradient information is only 1 / 32 of that for the original gradient information, theoretically achieving a 32-fold reduction in communication overhead. Simultaneously, a stochastic response mechanism is used to implement differential privacy processing. Compared to differential privacy processing methods that add Gaussian noise, gradient clipping is avoided, and a stricter level of differential privacy protection is achieved. Furthermore, to avoid outliers in a single model training epoch and to accelerate the convergence of the target model, adaptive optimization processing is performed on the gradient information before converting it into symbolic gradient information. This converted symbolic gradient information has greater optimization reference value. Furthermore, symbolic optimization can defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0098] This specification provides a model processing method. It involves receiving a target model from a server, acquiring sample data for training the target model, training the target model based on the sample data, determining the gradient information of the trained target model, symbolizing the gradient information to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can then update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is significantly reduced, achieving a compression of communication overhead by a certain factor. Furthermore, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0099] Example 3

[0100] The following describes in detail a model processing method provided by the embodiments of this specification in conjunction with specific application scenarios. The target model can be a risk control model for preset risks, and the sample data can be historical transaction data between different users. Specifically, it can include user behavior information, account information of both parties to the transaction, transaction amount, transaction time and transaction location, etc. The probability distribution rule is a Bernoulli distribution with parameter p.

[0101] like Figure 4 As shown in the embodiments of this specification, a method for processing a model is provided. The execution subject of this method can be a terminal device, which can be a mobile phone, tablet computer, or a computer device such as a laptop or desktop computer, or an IoT device (specifically, a smartwatch, in-vehicle device, etc.). The method may specifically include the following steps:

[0102] In step S402, the risk prevention and control model for preset risks is received from the server.

[0103] The pre-set risks may include one or more of the following: fraud risk and illegal transaction risk.

[0104] In step S404, historical transaction data between different users used to train the risk control model is obtained, and the risk control model is trained based on the historical transaction data to obtain the initial gradient information corresponding to the risk control model.

[0105] In step S406, historical gradient information of the risk prevention and control model is obtained, and the first-order momentum and second-order momentum corresponding to the historical gradient information are determined based on the historical gradient information.

[0106] In step S408, the first-order momentum corresponding to the initial gradient information is determined based on the first-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the risk prevention and control model.

[0107] In step S410, based on the second-order momentum corresponding to the historical gradient information and the first-order momentum corresponding to the initial gradient information, the second-order momentum corresponding to the initial gradient information is determined, and based on the first-order momentum and second-order momentum corresponding to the initial gradient information, the gradient information corresponding to the risk prevention and control model is determined.

[0108] In step S412, the gradient information corresponding to the risk prevention and control model with a value greater than 0 in each axis is set to +1, and the gradient information corresponding to the risk prevention and control model with a value less than 0 in each axis is set to -1, thus obtaining the symbolic gradient information corresponding to the risk prevention and control model.

[0109] In step S414, the symbol gradient information is sampled based on the Bernoulli distribution with parameter p to obtain the sampled symbol gradient information composed of multiple sampling points.

[0110] In step S416, for each sampling point in the sampled symbol gradient information, if a sampling point corresponds to the experimental result 0 in the Bernoulli distribution and the sampling point is -1, then the symbol gradient information of the sampling point is set to 0; if a sampling point corresponds to the experimental result 0 in the Bernoulli distribution and the sampling point is +1, then the symbol gradient information of the sampling point remains unchanged.

[0111] In step S418, for each sampling point in the sampled symbol gradient information, if the experimental result 1 in the Bernoulli distribution corresponding to a certain sampling point is determined based on the Bernoulli distribution with parameter p, then the above sampling point is resampled based on the Bernoulli distribution with parameter p. If the resampled sampling point corresponds to the experimental result 0 in the Bernoulli distribution, then the symbol gradient information of the resampled sampling point is set to 0. If the resampled sampling point corresponds to the experimental result 1 in the Bernoulli distribution, then the symbol gradient information of the resampled sampling point is set to 1, and finally the differential privacy gradient information is obtained.

[0112] In step S420, differential privacy gradient information is sent to the server. The differential privacy gradient information is used to trigger the server to update the risk prevention and control model stored in the server based on the differential privacy gradient information.

[0113] The server can then distribute the updated risk control model to the designated terminal devices. If the updated risk control model meets the specified convergence conditions, there is no need to update the risk control model again. If the updated risk control model does not meet the specified convergence conditions, the terminal devices can be instructed to re-execute the above steps 402 to S420 until the updated risk control model meets the specified convergence conditions.

[0114] This specification provides a model processing method. It involves receiving a target model from a server, acquiring sample data for training the target model, training the target model based on the sample data, determining the gradient information of the trained target model, symbolizing the gradient information to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can then update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is significantly reduced, achieving a compression of communication overhead by a certain factor. Furthermore, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0115] Example 4

[0116] like Figure 5A and Figure 5B As shown in the embodiments of this specification, a method for processing a model is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. The server can be a backend server for financial or online shopping services, or a backend server for an application. Specifically, the method may include the following steps:

[0117] In step S502, the differential privacy gradient information of the target model uploaded by the terminal device is received. This differential privacy gradient information is obtained by the terminal device training the target model based on the sample data obtained for training the target model, determining the gradient information corresponding to the target model after model training, symbolizing the gradient information corresponding to the target model to obtain the symbolic gradient information corresponding to the target model, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule.

[0118] In step S504, the received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information.

[0119] In practice, the aggregation of received differential privacy gradient information can be performed in various ways. For example, the values ​​in the received differential privacy gradient information can be added together and the result can be used as the aggregated differential privacy gradient information. Alternatively, the values ​​in the received differential privacy gradient information can be weighted and summed to obtain the result as the aggregated differential privacy gradient information. The specific implementation can be set according to the actual situation, and the embodiments in this specification do not limit this.

[0120] In step S506, the aggregated differential privacy gradient information is decoded to obtain the corresponding target symbol gradient information.

[0121] In implementation, the purpose of decoding the aggregated differential privacy gradient information is to accurately reconstruct the aggregated result of the true symbol gradient information as much as possible. To accurately reconstruct the aggregated result of the true symbol gradient information using various methods, for example, an inverse processing procedure can be set based on the above encoding process. A corresponding decoder can be constructed based on this inverse processing procedure, and the aggregated differential privacy gradient information can be decoded using this decoder to obtain the corresponding target symbol gradient information. Specifically, if the above encoding process maps symbol gradient information to a specified encoded symbol based on probability distribution rules, then the corresponding decoding process can be to reverse-map the specified encoded symbol to symbol gradient information based on probability distribution rules, thereby obtaining the corresponding target symbol gradient information. Furthermore, corresponding algorithms can be pre-set based on conditions satisfied between the aggregated differential privacy gradient information and the aggregated result of the symbol gradient information. These algorithms can calculate the corresponding target symbol gradient information, etc., and can be specifically set according to actual conditions; this specification does not limit this aspect in the embodiments.

[0122] In step S508, the target model is updated based on the target symbol gradient information to obtain the updated target model.

[0123] In implementation, the server can restore the target symbol gradient information. The restoration method can include various approaches, such as the mapping and inverse mapping methods mentioned above. The specific method can be set according to the actual situation. By restoring the target symbol gradient information, the gradient information corresponding to the target model can be obtained. Based on this gradient information, the model parameters of the target model can be updated to obtain the updated target model. Then, the updated target model can be sent to the designated terminal device. If the updated target model meets the specified convergence condition, no further update is needed. If the updated target model does not meet the specified convergence condition, the terminal device can be instructed to re-execute steps 502 to S508 until the updated target model meets the specified convergence condition.

[0124] This specification provides a model processing method. It involves receiving a target model from a server, acquiring sample data for training the target model, training the target model based on the sample data, determining the gradient information of the trained target model, symbolizing the gradient information to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can then update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is significantly reduced, achieving a compression of communication overhead by a certain factor. Furthermore, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0125] Example 5

[0126] like Figure 6 As shown in the embodiments of this specification, a method for processing a model is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. The server can be a backend server for financial or online shopping services, or a backend server for an application. Specifically, the method may include the following steps:

[0127] In step S602, the differential privacy gradient information of the target model uploaded by the terminal device is received. This differential privacy gradient information is obtained by the terminal device training the target model based on the sample data obtained for training the target model, determining the gradient information corresponding to the target model after model training, symbolizing the gradient information corresponding to the target model to obtain the symbolic gradient information corresponding to the target model, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule.

[0128] In step S604, the received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information.

[0129] In practice, the aggregation of received differential privacy gradient information can be performed in various ways. For example, the values ​​in the received differential privacy gradient information can be added together and the result can be used as the aggregated differential privacy gradient information. Alternatively, the values ​​in the received differential privacy gradient information can be weighted and summed to obtain the result as the aggregated differential privacy gradient information. The specific implementation can be set according to the actual situation, and the embodiments in this specification do not limit this.

[0130] For cases where the probability distribution rule contains two different probabilities (see the above probability distribution rule as binomial distribution or Bernoulli distribution), the aggregated differential privacy gradient information can be decoded through the following steps S606 and S608.

[0131] In step S606, based on the aggregated differential privacy gradient information, the number of differential privacy gradient information processed by aggregation, and the two different probabilities contained in the probability distribution rule, the corresponding calculation results are obtained through a preset algorithm.

[0132] In implementation, if the number of differential privacy gradient information involved in aggregation is N, and for the k-th axis, the number of original symbolic gradient information with +1 is a, and the number of aggregated differential privacy gradient information is b, then the actual aggregation result of the symbolic gradient information can be 2a-N. In order to decode the aggregated differential privacy gradient information to obtain the accurate aggregation result of the symbolic gradient information, the corresponding calculation purpose is to estimate 2a-N unbiasedly through b, as follows: the value of b for a +1 outputs under the expected meaning can be calculated as b = (1-p)a + Np^2; then, by reverse reasoning, we can get a = (b-Np^2) / (1-p); thus, the aggregation result of the symbolic gradient information is 2a-N = (2(b-Np^2) / (1-p))-N. Based on the above, the aggregated differential privacy gradient information, the number of differential privacy gradient information processed by aggregation, the two different probabilities contained in the probability distribution rule, and the number N of differential privacy gradient information participating in aggregation can be substituted into the formula 2a-N=(2(b-Np^2) / (1-p))-N to obtain the result of 2a-N (i.e. the calculation result).

[0133] In step S608, the target symbol gradient information is determined based on the obtained calculation results.

[0134] In practice, the obtained calculation result can be directly used as the target symbol gradient information, or the obtained calculation result can be further processed (such as multiplying the obtained calculation result by a preset weight or adding a preset value to the obtained calculation result, etc.), and the final processed result can be used as the target symbol gradient information, etc. The specific settings can be set according to the actual situation, and the embodiments in this specification do not limit this.

[0135] In step S610, the target model is updated based on the target symbol gradient information to obtain the updated target model.

[0136] This specification provides a model processing method. It involves receiving a target model from a server, acquiring sample data for training the target model, training the target model based on the sample data, determining the gradient information of the trained target model, symbolizing the gradient information to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can then update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is significantly reduced, achieving a compression of communication overhead by a certain factor. Furthermore, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0137] Example 6

[0138] The following describes in detail a model processing method provided by the embodiments of this specification in conjunction with specific application scenarios. The target model can be a risk control model for preset risks, and the sample data can be historical transaction data between different users. Specifically, it can include user behavior information, account information of both parties to the transaction, transaction amount, transaction time and transaction location, etc. The probability distribution rule is a Bernoulli distribution with parameter p.

[0139] like Figure 7 As shown in the embodiments of this specification, a method for processing a model is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. The server can be a backend server for financial or online shopping services, or a backend server for an application. Specifically, the method may include the following steps:

[0140] In step S702, the differential privacy gradient information of the risk prevention and control model for the preset risk uploaded by the terminal device is received. This differential privacy gradient information is obtained by the terminal device training the risk prevention and control model based on the historical transaction data between different users used to train the risk prevention and control model, determining the gradient information corresponding to the risk prevention and control model after model training, symbolizing the gradient information corresponding to the risk prevention and control model to obtain the symbolic gradient information corresponding to the risk prevention and control model, sampling the symbolic gradient information based on the Bernoulli distribution with parameter p, and encoding the sampled symbolic gradient information based on the Bernoulli distribution with parameter p.

[0141] In step S704, the received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information.

[0142] In step S706, based on the aggregated differential privacy gradient information, the number of differential privacy gradient information processed by aggregation, and the Bernoulli distribution with parameter p, the corresponding calculation results are obtained through a preset algorithm.

[0143] In step S708, the target symbol gradient information is determined based on the obtained calculation results.

[0144] In step S710, the risk prevention and control model is updated based on the target symbol gradient information to obtain the updated risk prevention and control model.

[0145] This specification provides a model processing method. It involves receiving a target model from a server, acquiring sample data for training the target model, training the target model based on the sample data, determining the gradient information of the trained target model, symbolizing the gradient information to obtain symbolic gradient information, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can then update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is significantly reduced, achieving a compression of communication overhead by a certain factor. Furthermore, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0146] Example 7

[0147] The above describes the model processing method provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a model processing device, such as... Figure 8 As shown.

[0148] The processing device for this model includes: a model receiving module 801, a gradient acquisition module 802, a differential privacy module 803, and a gradient sending module 804, wherein:

[0149] Model receiving module 801 receives the target model sent by the server;

[0150] The gradient acquisition module 802 acquires sample data for training the target model, trains the target model based on the sample data, and determines the gradient information corresponding to the target model after training.

[0151] The differential privacy module 803 performs symbolic processing on the gradient information corresponding to the target model to obtain the symbolic gradient information corresponding to the target model, samples the symbolic gradient information based on a preset probability distribution rule, and encodes the sampled symbolic gradient information based on the probability distribution rule to obtain differential privacy gradient information.

[0152] The gradient sending module 804 sends the differential privacy gradient information to the server, and the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0153] In this embodiment of the specification, the gradient acquisition module 802 includes:

[0154] An initial gradient acquisition unit trains the target model based on the sample data to obtain the initial gradient information corresponding to the target model.

[0155] An adaptive optimization unit acquires historical gradient information of the target model, and determines the gradient information corresponding to the target model based on the historical gradient information and the initial gradient information through an adaptive optimization algorithm, wherein the adaptive optimization algorithm includes the Adam algorithm or the Adagrad algorithm.

[0156] In the embodiments of this specification, the adaptive optimization unit determines the first-order momentum and second-order momentum corresponding to the historical gradient information based on the historical gradient information; determines the first-order momentum and second-order momentum corresponding to the initial gradient information based on the first-order momentum and second-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the target model; and determines the gradient information corresponding to the target model based on the first-order momentum and second-order momentum corresponding to the initial gradient information.

[0157] In the embodiments of this specification, the adaptive optimization unit determines the first-order momentum corresponding to the initial gradient information based on the first-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the target model; and determines the second-order momentum corresponding to the initial gradient information based on the second-order momentum corresponding to the historical gradient information and the first-order momentum corresponding to the initial gradient information.

[0158] In this embodiment of the specification, the differential privacy module 803 sets the gradient information corresponding to the target model whose value is greater than a preset threshold in each axis as a first symbol, and sets the gradient information corresponding to the target model whose value is less than the preset threshold in each axis as a second symbol, thereby obtaining the symbol gradient information corresponding to the target model, wherein the first symbol and the second symbol are different.

[0159] In the embodiments described in this specification, the preset threshold is 0, the first symbol is +1, and the second symbol is -1.

[0160] In the embodiments of this specification, the differential privacy module 803 includes:

[0161] The sampling unit samples the symbol gradient information based on a preset probability distribution rule to obtain sampled symbol gradient information composed of multiple sampling points.

[0162] The differential privacy unit performs the following processing for each sampling point in the sampled symbol gradient information to obtain differential privacy gradient information: if the sampling point corresponds to the first probability among two different probabilities contained in the probability distribution rule based on the probability distribution rule, and the sampling point is the second symbol, then the second symbol of the sampling point is deleted; if the sampling point corresponds to the second probability among two different probabilities contained in the probability distribution rule based on the probability distribution rule, then the sampling point is resampled based on the probability distribution rule, and the symbol gradient information of the resampled sampling point is reassigned according to the corresponding probability contained in the probability distribution rule.

[0163] In this embodiment of the specification, the probability distribution rule includes a Bernoulli distribution, where the first probability is the probability corresponding to 0 in the Bernoulli distribution, and the second probability is the probability corresponding to 1 in the Bernoulli distribution. The differential privacy unit sets the sign gradient information of the resampled sampling point to 0 if the resampled sampling point corresponds to the first probability, and sets the sign gradient information of the resampled sampling point to 1 if the resampled sampling point corresponds to the second probability.

[0164] In the embodiments of this specification, the sample data is historical transaction data between different users, and the target model is a risk prevention and control model for preset risks, which include one or more of fraud risks and illegal transaction risks.

[0165] In the embodiments of this specification, the target model is a model that the server updates the target model stored in the server with differential privacy gradient information sent by the terminal device, and the server issues the model when it determines that the updated target model does not meet the preset convergence conditions.

[0166] This specification provides a model processing device that receives a target model from a server, acquires sample data for training the target model, trains the target model based on the sample data, determines the gradient information corresponding to the target model after training, then symbolizes the gradient information to obtain symbolic gradient information, samples the symbolic gradient information based on a preset probability distribution rule, and encodes the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is greatly reduced, achieving a compression of communication overhead by a certain factor. Simultaneously, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0167] Example 8

[0168] Based on the same idea, embodiments of this specification also provide a model processing device, such as... Figure 9 As shown.

[0169] The processing unit for this model includes: a differential gradient receiving module 901, an aggregation module 902, a decoding module 903, and a model update module 904, wherein:

[0170] The differential gradient receiving module 901 receives differential privacy gradient information of a target model uploaded by a terminal device. The differential privacy gradient information is obtained by the terminal device training the target model based on sample data acquired for training the target model, determining the gradient information corresponding to the target model after model training, symbolizing the gradient information corresponding to the target model to obtain symbolic gradient information corresponding to the target model, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule.

[0171] The aggregation module 902 performs aggregation processing on the received differential privacy gradient information to obtain aggregated differential privacy gradient information;

[0172] Decoding module 903 decodes the aggregated differential privacy gradient information to obtain the corresponding target symbol gradient information;

[0173] The model update module 904 updates the target model based on the target symbol gradient information to obtain the updated target model.

[0174] In this embodiment of the specification, the probability distribution rule includes two different probabilities, and the decoding module 903 includes:

[0175] The decoding unit, based on the aggregated differential privacy gradient information, the number of differential privacy gradient information processed by aggregation, and the two different probabilities contained in the probability distribution rule, obtains the corresponding calculation results through a preset algorithm;

[0176] The symbol gradient determination unit determines the target symbol gradient information based on the obtained calculation results.

[0177] This specification provides a model processing device that receives a target model from a server, acquires sample data for training the target model, trains the target model based on the sample data, determines the gradient information corresponding to the target model after training, then symbolizes the gradient information to obtain symbolic gradient information, samples the symbolic gradient information based on a preset probability distribution rule, and encodes the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is greatly reduced, achieving a compression of communication overhead by a certain factor. Simultaneously, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0178] Example 9

[0179] The above describes the model processing apparatus provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a model processing device, such as... Figure 10 As shown.

[0180] The processing device for the model can be a terminal device or a server, as described in the above embodiments.

[0181] The processing device of the model can vary considerably due to differences in configuration or performance, and may include one or more processors 1001 and memory 1002. Memory 1002 may store one or more application programs or data. Memory 1002 may be temporary or persistent storage. The application programs stored in memory 1002 may include one or more modules (not shown), each module including a series of computer-executable instructions for the model's processing device. Furthermore, processor 1001 may be configured to communicate with memory 1002 and execute the series of computer-executable instructions in memory 1002 on the model's processing device. The model's processing device may also include one or more power supplies 1003, one or more wired or wireless network interfaces 1004, one or more input / output interfaces 1005, and one or more keyboards 1006.

[0182] Specifically, in this embodiment, the processing device for the model includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the processing device of the model, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0183] Receive the target model sent by the server;

[0184] Obtain sample data for training the target model, and train the target model based on the sample data to determine the gradient information corresponding to the target model after training.

[0185] The gradient information corresponding to the target model is symbolized to obtain the symbolic gradient information corresponding to the target model. The symbolic gradient information is sampled based on a preset probability distribution rule, and the sampled symbolic gradient information is encoded based on the probability distribution rule to obtain differential privacy gradient information.

[0186] The differential privacy gradient information is sent to the server, and the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0187] Furthermore, specifically in this embodiment, the processing device for the model includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the processing device of the model, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0188] The terminal device receives differential privacy gradient information of a target model uploaded by the terminal device. The differential privacy gradient information is obtained by the terminal device training the target model based on sample data acquired for training the target model, determining the gradient information corresponding to the target model after model training, symbolizing the gradient information corresponding to the target model to obtain symbolic gradient information corresponding to the target model, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule.

[0189] The received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information;

[0190] The aggregated differential privacy gradient information is decoded to obtain the corresponding target symbol gradient information;

[0191] The target model is updated based on the target symbol gradient information to obtain the updated target model.

[0192] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for processing the model are relatively simple in description because they are fundamentally similar to the method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0193] This specification provides a model processing device that receives a target model from a server, acquires sample data for training the target model, trains the target model based on the sample data, determines the gradient information corresponding to the target model after training, then symbolizes the gradient information to obtain symbolic gradient information, samples the symbolic gradient information based on a preset probability distribution rule, and encodes the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is greatly reduced, achieving a compression of communication overhead by a certain factor. Simultaneously, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0194] Example 10

[0195] Furthermore, based on the above Figures 2A to 7 The method shown in this specification, along with one or more embodiments, also provides a storage medium for storing computer-executable instruction information. In one specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can achieve the following process:

[0196] Receive the target model sent by the server;

[0197] Obtain sample data for training the target model, and train the target model based on the sample data to determine the gradient information corresponding to the target model after training.

[0198] The gradient information corresponding to the target model is symbolized to obtain the symbolic gradient information corresponding to the target model. The symbolic gradient information is sampled based on a preset probability distribution rule, and the sampled symbolic gradient information is encoded based on the probability distribution rule to obtain differential privacy gradient information.

[0199] The differential privacy gradient information is sent to the server, and the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

[0200] In another specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc., and the computer-executable instruction information stored in the storage medium can achieve the following process when executed by the processor:

[0201] The terminal device receives differential privacy gradient information of a target model uploaded by the terminal device. The differential privacy gradient information is obtained by the terminal device training the target model based on sample data acquired for training the target model, determining the gradient information corresponding to the target model after model training, symbolizing the gradient information corresponding to the target model to obtain symbolic gradient information corresponding to the target model, sampling the symbolic gradient information based on a preset probability distribution rule, and encoding the sampled symbolic gradient information based on the probability distribution rule.

[0202] The received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information;

[0203] The aggregated differential privacy gradient information is decoded to obtain the corresponding target symbol gradient information;

[0204] The target model is updated based on the target symbol gradient information to obtain the updated target model.

[0205] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described storage medium embodiment is basically similar to the method embodiment, so the description is relatively simple; relevant parts can be referred to the description of the method embodiment.

[0206] This specification provides a storage medium that receives a target model from a server, acquires sample data for training the target model, trains the target model based on the sample data, determines the gradient information corresponding to the target model after training, then symbolizes the gradient information to obtain symbolic gradient information, samples the symbolic gradient information based on a preset probability distribution rule, and encodes the sampled symbolic gradient information to obtain differential privacy gradient information. Finally, the differential privacy gradient information can be sent to the server, which can update the target model stored on the server based on the differential privacy gradient information. By using symbolic gradient information for data transmission during communication, the required gradient information storage space is greatly reduced, achieving a compression of communication overhead by a certain factor. Simultaneously, a random response mechanism is used to implement differential privacy processing, thereby avoiding gradient pruning and achieving more stringent differential privacy protection capabilities. In addition, to avoid outliers in a single training cycle and to accelerate the convergence of the target model, gradient information is converted into symbolic gradient information. This converted symbolic gradient information has more optimization reference value. At the same time, symbolic optimization can also defend against Byzantine attacks during gradient aggregation, minimizing the risk of Byzantine attacks.

[0207] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0208] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using a hardware physical module. For example, a Programmable Logic Device (PLD) (e.g., a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program a digital system themselves to "integrate" it onto a PLD, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0209] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0210] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0211] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0212] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0213] Embodiments in this specification are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0214] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0215] These computer program instructions can also be loaded onto a computer or other programmable device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0216] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0217] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0218] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0219] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0220] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0221] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0222] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0223] The above description is merely an embodiment of this specification and is not intended to limit this application. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for processing a model, the method comprising: Receive the target model sent by the server; Obtain sample data for training the target model, and train the target model based on the sample data to determine the gradient information corresponding to the target model after training. The gradient information corresponding to the target model is symbolized to obtain the symbolic gradient information corresponding to the target model. The symbolic gradient information is sampled based on a preset probability distribution rule. Based on the probability distribution rule, a random response mechanism is used to encode the sampled symbolic gradient information to obtain differential privacy gradient information. The symbolization process compresses the value of each dimension in the gradient information from a floating-point value into a specified symbol. The symbolic gradient information containing the specified symbol is used to optimize the target model. The differential privacy gradient information is sent to the server, and the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

2. The method according to claim 1, wherein training the target model based on the sample data and determining the gradient information corresponding to the target model after training includes: The target model is trained based on the sample data to obtain the initial gradient information corresponding to the target model. The historical gradient information of the target model is obtained. Based on the historical gradient information and the initial gradient information, the gradient information corresponding to the target model is determined by an adaptive optimization algorithm, including the Adam algorithm or the Adagrad algorithm.

3. The method according to claim 2, wherein determining the gradient information corresponding to the target model based on the historical gradient information and the initial gradient information using an adaptive optimization algorithm includes: The first-order momentum and second-order momentum corresponding to the historical gradient information are determined based on the historical gradient information. Based on the first-order and second-order momentum corresponding to the historical gradient information, and the initial gradient information corresponding to the target model, the first-order and second-order momentum corresponding to the initial gradient information are determined, and based on the first-order and second-order momentum corresponding to the initial gradient information, the gradient information corresponding to the target model is determined.

4. The method according to claim 3, wherein determining the first-order momentum and second-order momentum corresponding to the initial gradient information based on the first-order momentum and second-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the target model comprises: Based on the first-order momentum corresponding to the historical gradient information and the initial gradient information corresponding to the target model, the first-order momentum corresponding to the initial gradient information is determined. Based on the second-order momentum corresponding to the historical gradient information and the first-order momentum corresponding to the initial gradient information, the second-order momentum corresponding to the initial gradient information is determined.

5. The method according to any one of claims 1-4, wherein the symbolic processing of the gradient information corresponding to the target model to obtain the symbolic gradient information corresponding to the target model includes: The gradient information corresponding to the target model whose value is greater than a preset threshold in each axis is set as the first symbol, and the gradient information corresponding to the target model whose value is less than the preset threshold in each axis is set as the second symbol, thus obtaining the symbol gradient information corresponding to the target model. The first symbol and the second symbol are different.

6. The method according to claim 5, wherein the preset threshold is 0, the first symbol is +1, and the second symbol is -1.

7. The method according to claim 6, wherein sampling the symbol gradient information based on a preset probability distribution rule, and encoding the sampled symbol gradient information using a random response mechanism based on the probability distribution rule to obtain differential privacy gradient information, includes: The symbol gradient information is sampled based on a preset probability distribution rule to obtain sampled symbol gradient information composed of multiple sampling points. For each sampling point in the sampled symbol gradient information, the following processing is performed to obtain differential privacy gradient information: If, based on the probability distribution rule, it is determined that the sampling point corresponds to the first probability among two different probabilities contained in the probability distribution rule, and the sampling point is the second symbol, then the second symbol of the sampling point is deleted. If, based on the probability distribution rule, the sampling point corresponds to the second probability among two different probabilities contained in the probability distribution rule, then the sampling point is resampled based on the probability distribution rule, and the sign gradient information of the resampled sampling point is reassigned according to the corresponding probability contained in the probability distribution rule.

8. The method according to claim 7, wherein the probability distribution rule includes a Bernoulli distribution, the first probability is the probability corresponding to 0 in the Bernoulli distribution, the second probability is the probability corresponding to 1 in the Bernoulli distribution, and the step of reassigning the sign gradient information of the resampled sampling points according to the corresponding probability included in the probability distribution rule includes: If the resampled sampling point corresponds to the first probability, then the sign gradient information of the resampled sampling point is set to 0; If the resampled sampling point corresponds to the second probability, then the sign gradient information of the resampled sampling point is set to 1.

9. The method according to claim 1, wherein the sample data is historical transaction data between different users, and the target model is a risk prevention and control model for preset risks, wherein the preset risks include one or more of fraud risks and illegal transaction risks.

10. The method according to claim 1, wherein the target model is a model that the server updates the target model stored in the server with differential privacy gradient information sent by the terminal device, and the updated target model is issued when it is determined that the updated target model does not meet the preset convergence condition.

11. A method for processing a model, the method comprising: The system receives differential privacy gradient information of a target model uploaded by a terminal device. This differential privacy gradient information is obtained by the terminal device training the target model using sample data acquired for training the target model, determining the gradient information corresponding to the target model after training, and symbolizing the gradient information to obtain symbolic gradient information. The symbolic gradient information is then sampled based on a preset probability distribution rule, and encoded using a random response mechanism based on the probability distribution rule. The symbolization process compresses the values ​​of each dimension in the gradient information from floating-point values ​​into specified symbols, and then uses the symbolic gradient information containing the specified symbols to optimize the target model. The received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information; The aggregated differential privacy gradient information is decoded to obtain the corresponding target symbol gradient information; The target model is updated based on the target symbol gradient information to obtain the updated target model.

12. The method according to claim 11, wherein the probability distribution rule contains two different probabilities, and the decoding process of the aggregated differential privacy gradient information to obtain the corresponding target symbol gradient information includes: Based on the aggregated differential privacy gradient information, the number of differential privacy gradient information processed by aggregation, and the two different probabilities contained in the probability distribution rule, the corresponding calculation results are obtained through a preset algorithm. The target symbol gradient information is determined based on the obtained calculation results.

13. A model processing apparatus, the apparatus comprising: The model receiving module receives the target model sent by the server. The gradient acquisition module acquires sample data for training the target model, trains the target model based on the sample data, and determines the gradient information corresponding to the target model after training. The differential privacy module performs symbolic processing on the gradient information corresponding to the target model to obtain symbolic gradient information corresponding to the target model. Based on a preset probability distribution rule, it samples the symbolic gradient information and, based on the probability distribution rule, uses a random response mechanism to encode the sampled symbolic gradient information to obtain differential privacy gradient information. The symbolic processing compresses the value of each dimension in the gradient information from a floating-point value into a specified symbol. The symbolic gradient information containing the specified symbol is used to optimize the target model. The gradient sending module sends the differential privacy gradient information to the server, and the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

14. A model processing apparatus, the apparatus comprising: The differential gradient receiving module receives differential privacy gradient information of a target model uploaded by a terminal device. This differential privacy gradient information is obtained by the terminal device training the target model using sample data acquired for training the target model, determining the gradient information corresponding to the target model after training, and symbolizing the gradient information to obtain symbolic gradient information. The symbolic gradient information is then sampled based on a preset probability distribution rule, and encoded using a random response mechanism based on the probability distribution rule. The symbolization process compresses the values ​​of each dimension in the gradient information from floating-point values ​​into specified symbols, and the symbolic gradient information containing the specified symbols is used to optimize the target model. The aggregation module aggregates the received differential privacy gradient information to obtain aggregated differential privacy gradient information. The decoding module decodes the aggregated differential privacy gradient information to obtain the corresponding target symbol gradient information. The model update module updates the target model based on the target symbol gradient information to obtain the updated target model.

15. A model processing apparatus, the model processing apparatus comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to: Receive the target model sent by the server; Obtain sample data for training the target model, and train the target model based on the sample data to determine the gradient information corresponding to the target model after training. The gradient information corresponding to the target model is symbolized to obtain the symbolic gradient information corresponding to the target model. The symbolic gradient information is sampled based on a preset probability distribution rule. Based on the probability distribution rule, a random response mechanism is used to encode the sampled symbolic gradient information to obtain differential privacy gradient information. The symbolization process compresses the value of each dimension in the gradient information from a floating-point value into a specified symbol. The symbolic gradient information containing the specified symbol is used to optimize the target model. The differential privacy gradient information is sent to the server, and the differential privacy gradient information is used to trigger the server to update the target model stored in the server based on the differential privacy gradient information.

16. A model processing apparatus, the model processing apparatus comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to: The system receives differential privacy gradient information of a target model uploaded by a terminal device. This differential privacy gradient information is obtained by the terminal device training the target model using sample data acquired for training the target model, determining the gradient information corresponding to the target model after training, and symbolizing the gradient information to obtain symbolic gradient information. The symbolic gradient information is then sampled based on a preset probability distribution rule, and encoded using a random response mechanism based on the probability distribution rule. The symbolization process compresses the values ​​of each dimension in the gradient information from floating-point values ​​into specified symbols, and then uses the symbolic gradient information containing the specified symbols to optimize the target model. The received differential privacy gradient information is aggregated to obtain aggregated differential privacy gradient information; The aggregated differential privacy gradient information is decoded to obtain the corresponding target symbol gradient information; The target model is updated based on the target symbol gradient information to obtain the updated target model.

Images