Method, device, medium and electronic device for transverse federated learning model training

Abstract

This application provides a method, apparatus, medium, and electronic device for training a horizontal federated learning model. The method includes: when k is greater than or equal to 3, receiving gradient values ​​to be updated from all clients in the k-th training round; selecting a target gradient value to be updated from all the gradient values ​​to be updated; and performing an aggregation operation on the target gradient value to be updated to obtain aggregated information. Some embodiments of this application can complete backdoor attack defense during the training process, and then adjust the training parameters according to the detection results, thus effectively enhancing the ability to resist backdoor attacks during global model training.

Description

Technical Field

[0001] This application relates to the field of federated learning, and more specifically, the embodiments of this application relate to methods, apparatus, media, and electronic devices for training horizontal federated learning models. Background Technology

[0002] Currently, with the rapid development of artificial intelligence (AI) technology, its applications are becoming increasingly widespread, including image analysis, speech recognition, text processing, intelligent recommendation, and security detection. Privacy-preserving computing technologies, such as federated learning, have become a new cutting-edge and popular area. However, traditional federated learning, especially traditional horizontal federated learning, is vulnerable to backdoor attacks, leading to significant security risks in the global model.

[0003] The relevant technical solutions involve backdoor attack defense and remediation after the model training is completed or after a successful backdoor attack, resulting in low remediation efficiency. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, medium and electronic device for training a horizontal federated learning model. Some embodiments of this application can complete backdoor attack defense during the training process, and then adjust the training parameters according to the detection results, thus effectively enhancing the ability to resist backdoor attacks during the global model training process.

[0005] In a first aspect, embodiments of this application provide a method for training a horizontal federated learning model, applied to a master server. The method includes: when k is greater than or equal to 3, in the k-th round of training, receiving gradient values ​​to be updated from all clients; selecting a target gradient value to be updated from all gradient values ​​to be updated; and performing aggregation operations based on the target gradient value to be updated to obtain aggregated information.

[0006] Some embodiments of this application filter the gradient values ​​to be updated reported by each client during the Nth round of training, thereby deleting the parameters to be updated reported by clients suspected of being attacked (e.g., backdoor attack) in this round of training, effectively avoiding the impact of these clients' parameters to be updated on the aggregated information.

[0007] In some embodiments, selecting the target gradient value to be updated from all gradient values ​​to be updated includes: obtaining the target gradient value to be updated based on the magnitude of the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum.

[0008] Some embodiments of this application have designed principles for filtering gradient values ​​to be updated. According to these principles, gradient information to be updated that is suspected of being attacked by backdoors or other attacks can be better filtered out.

[0009] In some embodiments, obtaining the target gradient value to be updated based on the deviation of the projection components of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum includes: obtaining the deviation of the projection components of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum to obtain a deviation value corresponding to each client; and identifying the target gradient value to be updated from the multiple gradient values ​​to be updated based on the deviation value and empirical rules in statistics.

[0010] Some embodiments of this application use empirical rules and bias values ​​to filter the gradient values ​​to be updated reported by each client, which can improve the quality of the target gradient values ​​to be updated. Clients with these high-quality data are less likely to be attacked by backdoors or other attacks.

[0011] In some embodiments, obtaining the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum among a plurality of gradient values ​​to be updated, and obtaining the deviation value corresponding to each client, includes: obtaining a first unit vector in the same direction as the historical aggregated gradient momentum of the kj-th round, wherein when kj < 3, the historical aggregated gradient momentum of the kj-th round is the aggregated gradient obtained from the training of the kj-th round, and when kj ≥ 3, the historical aggregated gradient momentum of the kj-th round is obtained by weighted summation of the corrected aggregated gradient obtained from the training of the kj-th round and the gradient momentum obtained from the training of the kj-1-th round, where j is a positive integer greater than or equal to 1; obtaining a second unit vector perpendicular to the first unit vector; obtaining a third vector from a plurality of vectors that are perpendicular to both the first unit vector and the second unit vector; calculating the deviation of the projection component based on the third vector to obtain the deviation value.

[0012] Some embodiments of this application provide a calculation method for obtaining a plane perpendicular to the historical aggregation gradient momentum plane, thereby improving the accuracy and objectivity of the deviation value obtained based on it.

[0013] In some embodiments, obtaining the second unit vector perpendicular to the first unit vector includes: obtaining the second unit vector based on the historical aggregated gradient momentum of the ki-th round and the historical aggregated gradient momentum of the kj-th round, wherein when ki < 3, the historical aggregated gradient momentum of the ki-th round is the aggregated gradient obtained from the training of the ki-th round, and when ki ≥ 3, the historical aggregated gradient momentum of the ki-th round is obtained by weighted summation of the corrected aggregated gradient obtained from the training of the ki-th round and the gradient momentum obtained from the training of the (ki-1)-th round, where i is a positive integer less than j.

[0014] Some embodiments of this application provide a method for determining the relevant unit vector in a plane perpendicular to the historical aggregate gradient momentum plane, improving the accuracy and customizability of the obtained value.

[0015] In some embodiments, obtaining the second unit vector based on the historical aggregated gradient momentum of the ki-th round and the historical aggregated gradient momentum of the kj-th round includes: calculating a first projection vector of the historical aggregated gradient momentum of the ki-th round in the direction of the historical aggregated gradient momentum of the kj-th round; subtracting the first projection component from the historical aggregated gradient momentum of the ki-th round to obtain a second projection component; and calculating a unit vector in the same direction as the second projection component to obtain the second unit vector.

[0016] In some embodiments, the bias value obtained by the i-th client in the k-th round of training is characterized as B. ik The step of identifying the target gradient value to be updated from multiple gradient values ​​to be updated based on the deviation value and empirical rules in statistics includes: if the offset value of the i-th client is determined to be within the following range, then the gradient to be updated corresponding to the i-th client is confirmed to belong to the target gradient value to be updated:

[0017] μ k -3σ k ≤B ik ≤μ k +3σ k

[0018] Where, μ k It is B ik The average value, σ k It is B ik The standard deviation.

[0019] Some embodiments of this application employ the three sigma rule to filter out the target gradient value to be updated from all gradient values ​​to be updated, thereby improving the accuracy and objectivity of these data.

[0020] In some embodiments, the step of performing aggregation operations based on the target gradient value to be updated to obtain aggregation information includes: obtaining each client corresponding to the target gradient value to be updated, and obtaining an aggregated client set; obtaining the sum of the number of local samples of each client in the aggregated client set, and obtaining the total number of effective samples; obtaining a corrected aggregated gradient based on the gradient to be updated corresponding to each client in the aggregated client set and the total number of effective samples; and obtaining global model information based at least on the corrected aggregated gradient.

[0021] Embodiments of this application provide a method for calculating global model information.

[0022] In some embodiments, obtaining global model information based at least on the modified aggregated gradient includes: calculating the global model update gradient based on the weight constant, the historical global model update gradient, and the modified aggregated gradient.

[0023] This application provides a scheme for adjusting the modified aggregate gradient based on a weight constant to obtain the global model update gradient, which can improve the accuracy of the global model update gradient value.

[0024] In some embodiments, the k-th global model update gradient is calculated using the following formula:

[0025]

[0026] in, The gradient of the k-th global model update is represented by β, and the weight constant is represented by β. Characterizing the modified aggregate gradient, To update the gradient of the global model corresponding to the (k-1)th training round

[0027] Some embodiments of this application provide a formula for quantifying the global update gradient, thereby improving the accuracy of the value.

[0028] In some embodiments, obtaining global model information based at least on the modified aggregated gradient includes: calculating the k-th global model update gradient based on the weight constant and the modified aggregated gradient; and obtaining the k-th global model parameters based on the k-th global model update gradient.

[0029] In some embodiments, obtaining the parameters of the k-th global model based on the gradient update of the k-th global model includes:

[0030]

[0031] Where η represents the learning rate, Δ k-1 The gradient represents the (k-1)th global model update gradient.

[0032] This application provides a method for quantizing the parameters of the k-th global model.

[0033] In some embodiments, after performing aggregation operations based on the target gradient value to be updated to obtain aggregation information, the method includes: sending the aggregation information to all clients.

[0034] Secondly, some embodiments of this application provide a master server for training a horizontal federated learning model. The master server includes: a receiving module configured to receive gradient values ​​to be updated from all clients in the k-th round of training when k is greater than or equal to 3; a target gradient value to be updated acquisition module configured to filter out a target gradient value to be updated from all gradient values ​​to be updated; and an aggregation module configured to perform aggregation operations based on the target gradient value to be updated to obtain aggregation information.

[0035] Thirdly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the methods described in any of the above embodiments of the first and second aspects.

[0036] Fourthly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the methods described in any of the embodiments of the first and second aspects above. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 An architecture diagram of a system for training a horizontal federated learning model provided in an embodiment of this application;

[0039] Figure 2 One of the flowcharts for a method of training a horizontal federated learning model provided in an embodiment of this application;

[0040] Figure 3 A second flowchart illustrating the method for training a horizontal federated learning model provided in this application embodiment;

[0041] Figure 4 A block diagram of the apparatus for training a horizontal federated learning model provided in the embodiments of this application;

[0042] Figure 5 This is a schematic diagram illustrating the composition of an electronic device provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0044] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0045] To address the aforementioned issues, some embodiments of this application propose a training method for a horizontal federated learning model that can defend against backdoor attacks. This method can identify clients suspected of being attackers during the training process, thereby eliminating the influence of model parameter information reported by these clients on the aggregation results, and thus enhancing the anti-interference and attack resistance capabilities of the global model training process.

[0046] For example, some embodiments of this application innovatively propose a training method for a lateral federated learning model. This method includes, for instance,: initializing model parameters using a Gaussian random initialization method and distributing the initialization parameters to all client nodes; client nodes training the model using local data and uploading the model parameter update gradients to the server node; the server node removing suspicious gradients (e.g., determining the removed gradients based on the deviation of the projection components of the gradients to be updated reported by each client to the server in this training round in the vertical direction of the plane formed by the historical aggregated gradient momentum), and then aggregating to generate new model parameters; the server node determining the termination condition of the training process, choosing to terminate the training or distributing the new model parameters to all client nodes. Some embodiments of this application innovatively propose a novel lateral federated learning model training process that can defend against various attacks using only user-uploaded update data.

[0047] Please refer to Figure 1 , Figure 1 for Figure 1 This is a system for training a horizontal federated learning model. The system includes: a server 100 and multiple clients (or multiple participants). The master server is used to aggregate the model information received from each client. Each client uses the training data in its local dataset to train its local model, sends model information to the server and receives aggregate information from the master server. Then, each client performs a new round of model training based on the aggregate information and local routing data.

[0048] The following is combined Figure 2 This paper exemplifies a method for training a horizontal federated learning model performed by server 100.

[0049] like Figure 2 As shown, Figure 1 The system's model training process includes:

[0050] S101, Local model initialization.

[0051] The initial parameters for local model initialization can be provided by the master server. For example, in some embodiments of this application, the master server uses a Gaussian random initialization method to initialize the model parameters and distributes the model initialization parameters to all client nodes.

[0052] In some embodiments, client nodes, i.e., participants, build local models based on their own datasets. In some embodiments, the master server may also provide the models to be trained to each participant.

[0053] S102, train the local model.

[0054] The client node trains the model using local data and uploads the model parameter information (e.g., gradients to be updated) to the server node.

[0055] Each client trains its local model using training data from its local dataset, and then sends the trained model parameters to the main server.

[0056] For example, participants send the model parameter information of their local models to the main server.

[0057] S103, Model parameters updated.

[0058] The master server performs secure aggregation based on the model information of the participants. Common secure aggregation algorithms include the Federated Averaging algorithm (FedAvg) and the Federated Optimization in Heterogeneous Network (FedProx) algorithm for heterogeneous federated models.

[0059] The master server broadcasts the aggregated information to all participants, who then update their local models accordingly.

[0060] In the embodiments of this application, the server nodes will remove suspicious model parameter information (e.g., suspicious gradients to be aggregated) from the client, and then use the remaining model parameter information to aggregate and generate new aggregate parameters.

[0061] It should be noted that the feature spaces of the multi-party datasets in horizontal federated learning are similar. Therefore, during the training of the federated model, there is no need for the participants to exchange intermediate computation results. Instead, the master server aggregates the models, and each party updates its local model based on the latest aggregated model information. This allows for knowledge exchange among the parties without knowing the source data of other participants. Therefore, preventing poisoning attacks on the local training data of each client becomes a major technical problem. Some embodiments of this application can exclude the model information of clients attempting poisoning attacks through relevant programs executed on the master server, thereby improving the aggregation effect.

[0062] The following is combined Figure 3 The present invention provides an exemplary description of the model parameter updates performed by the master server, which is a method for training a horizontal federated learning model according to some embodiments of this application.

[0063] It should be noted that this application embodiment provides a method for training a horizontal federated learning model, applied to a master server. The method includes: S201, when k is greater than or equal to 3, receiving gradient values ​​to be updated from all clients in the k-th round of training; S202, filtering out target gradient values ​​to be updated from all gradient values ​​to be updated; and S203, performing aggregation operations on the target gradient values ​​to be updated to obtain aggregated information.

[0064] Some embodiments of this application filter the gradient values ​​to be updated reported by each client during the Nth round of training, thereby deleting the parameters to be updated reported by clients suspected of being attacked (e.g., backdoor attack) in this round of training, effectively avoiding the impact of these clients' parameters to be updated on the aggregated information.

[0065] The following example illustrates... Figure 3 The implementation process of each step.

[0066] The gradient value to be updated in S201 is the model parameter information of the local model obtained by each client after the k-th round of training. It can be understood that the main server will perform the k-th round of aggregation based on this parameter information and finally obtain the aggregated model information (or aggregated information) for the k-th round. Then, this aggregated model information is forwarded to each client so that each client can perform the (k+1)-th round of model training based on this aggregated information until the training termination condition is met, and the target model is obtained. It should be noted that in some embodiments of this application, the value of k can also be 1 or 2 (i.e., k < 3). The specific calculation formulas for updating the global model parameters in the first and second rounds of training can be found below, and will not be elaborated further to avoid repetition.

[0067] In some embodiments of this application, step S202 filters the gradients to be updated reported by each client based on the magnitude of the deviation, thereby filtering out gradients suspected of being attacked and aggregating only the remaining gradients to be updated. This enables attack detection during training. For example, in some embodiments of this application, step S202 includes obtaining the target gradient value to be updated based on the magnitude of the deviation of the projection components of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum. In other words, some embodiments of this application design a principle for filtering gradient values ​​to be updated, which can better filter out gradient information suspected of being attacked by backdoors or other attacks.

[0068] For example, in some embodiments of this application, the process of obtaining the target gradient value to be updated based on the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum in step S202 includes, for example,:

[0069] The first step is to obtain the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum, and to obtain the deviation value corresponding to each client.

[0070] For example, this first step includes: obtaining a first unit vector in the same direction as the historical aggregated gradient momentum of the kj-th round, wherein when kj < 3, the historical aggregated gradient momentum of the kj-th round is the aggregated gradient obtained from training in the kj-th round; when kj ≥ 3, the historical aggregated gradient momentum of the kj-th round is obtained by weighted summation of the corrected aggregated gradient obtained from training in the kj-th round and the gradient momentum obtained from training in the kj-1-th round, where j is a positive integer greater than or equal to 1; obtaining a second unit vector perpendicular to the first unit vector; and from the first unit vector... and the second unit vector A third vector is obtained from multiple vectors that are perpendicular to each other; the deviation of the projection component is calculated based on the third vector to obtain the deviation value. It should be noted that there are infinitely many vectors that are perpendicular to both the first and second unit vectors, and not every one of them is the third vector in this embodiment. The third vector in this embodiment is... exist The projection vector in the direction is C1. exist The projection vector in the direction is C2. for The component vectors after subtracting C1 and C2.

[0071] It should be noted that, in some embodiments of this application, the process of obtaining the second unit vector perpendicular to the first unit vector includes, for example, obtaining the second unit vector based on the historical aggregated gradient momentum of the ki-th round and the historical aggregated gradient momentum of the kj-th round, wherein, when ki < 3, the historical aggregated gradient momentum of the ki-th round is the aggregated gradient obtained from the ki-th round of training; when ki ≥ 3, the historical aggregated gradient momentum of the ki-th round is obtained by weighted summation of the corrected aggregated gradient obtained from the ki-th round of training and the gradient momentum obtained from the (ki-1)-th round of training, where i is a positive integer less than j. Some embodiments of this application provide a method for determining the relevant unit vector in the plane perpendicular to the historical aggregated gradient momentum, improving the accuracy and customizability of the obtained value.

[0072] In some embodiments of this application, obtaining the second unit vector based on the historical aggregated gradient momentum of the ki-th round and the historical aggregated gradient momentum of the kj-th round includes: calculating a first projection vector of the historical aggregated gradient momentum of the ki-th round in the direction of the historical aggregated gradient momentum of the kj-th round; subtracting the first projection component from the historical aggregated gradient momentum of the ki-th round to obtain a second projection component; and calculating a unit vector in the same direction as the second projection component to obtain the second unit vector.

[0073] Some embodiments of this application provide a calculation method for obtaining a plane perpendicular to the historical aggregation gradient momentum plane, thereby improving the accuracy and objectivity of the deviation value obtained based on it.

[0074] The second step is to identify the target gradient value to be updated from among the multiple gradient values ​​to be updated based on the deviation value and empirical rules in statistics.

[0075] For example, suppose the bias value obtained by the i-th client in the k-th round of training is represented as B. ik In some embodiments of this application, the second step includes, for example, the following: if the offset value of the i-th client is determined to be within the following range, then the gradient to be updated corresponding to the i-th client is confirmed to belong to the target gradient value to be updated:

[0076] μ k -3σ k ≤B ik ≤μ k +3σ k

[0077] Where, μ k It is B ik The average value, σ k It is B ik The standard deviation.

[0078] Some embodiments of this application employ the three sigma rule to filter out the target gradient value to be updated from all gradient values ​​to be updated, thereby improving the accuracy and objectivity of these data.

[0079] Some embodiments of this application use empirical rules and bias values ​​to filter the gradient values ​​to be updated reported by each client, which can improve the quality of the target gradient values ​​to be updated. Clients with these high-quality data are less likely to be attacked by backdoors or other attacks.

[0080] It is understood that the aggregated information in S203 includes, for example, global model update gradients and global model parameters. The following examples illustrate how some embodiments of this application calculate this aggregated information.

[0081] In some embodiments of this application, S203 includes, for example:

[0082] The first step is to obtain each client corresponding to the target gradient value to be updated, thus obtaining an aggregated client set.

[0083] The second step is to obtain the sum of the number of local samples of each client in the aggregated client set, and thus obtain the total number of valid samples.

[0084] The third step is to obtain the corrected aggregate gradient based on the gradient to be updated corresponding to each client in the aggregated client set and the total number of valid samples.

[0085] The fourth step is to obtain global model information based at least on the corrected aggregated gradient.

[0086] For example, in some embodiments of this application, the process of obtaining global model information at least based on the corrected aggregated gradient in the fourth step includes, for instance, calculating the global model update gradient based on the weight constant, the historical global model update gradient, and the corrected aggregated gradient. This application provides a scheme for adjusting the corrected aggregated gradient based on the weight constant to obtain the global model update gradient, which can improve the accuracy of the global model update gradient value.

[0087] For example, in some embodiments of this application, the k-th global model update gradient is calculated using the following formula:

[0088]

[0089] in, The gradient of the k-th global model update is represented by β, and the weight constant is represented by β. Characterizing the modified aggregate gradient, The gradient is updated globally for the (k-1)th training iteration. Some embodiments of this application provide a formula for quantifying the global update gradient, improving the accuracy of this value.

[0090] For example, in some embodiments of this application, the process of obtaining global model information at least based on the modified aggregate gradient in the fourth step includes, for instance: calculating the k-th global model update gradient based on the weight constant and the modified aggregate gradient; and obtaining the k-th global model parameters based on the k-th global model update gradient.

[0091] For example, in some embodiments of this application, obtaining the parameters of the k-th global model based on the gradient update of the k-th global model includes:

[0092]

[0093] Where η represents the learning rate, Δ k-1 The gradient represents the (k-1)th global model update gradient.

[0094] This application provides a method for quantizing the parameters of the k-th global model.

[0095] It is understood that in some embodiments of this application, after S203, the method includes sending the aggregated information to all clients. In other words, embodiments of this application provide a method for calculating global model information.

[0096] The following is combined Figure 2 The entire process exemplifies a method for training a horizontal federated learning model, which is collaboratively executed by the client and the master server.

[0097] (1) Model initialization

[0098] Assume the master server for horizontal federated learning corresponds to node S, and the client node for horizontal federated learning is C. i Where i is the client node number, N c Let N be the total number of nodes in the horizontal federated learning client (i.e., the total number of clients), where 0 < i ≤ N. c , i and N c All values ​​are positive integers. Model initialization includes two steps: model parameter initialization and model parameter distribution.

[0099] For example, the “model parameter initialization” process described in step (1) includes, for instance, the node S of the master server using a Gaussian random initialization method to initialize the parameters of the deep neural network model.

[0100] For example, the “model parameter distribution” process described in step (1) includes, for instance, the server node S sending the parameter initialization value Δ0 of the deep neural network model to all nodes of all horizontal federated learning clients to start the first round of local model training and global model parameter update.

[0101] (2) Local training of the model

[0102] The initial training of the model mainly includes two steps: model training and parameter uploading.

[0103] For example, the “model training” process described in step (2) includes, for instance, the following steps during the k-th round of local model training: each horizontal federated learning client node C i Using the global model parameters Δ received from node S corresponding to the master server k-1 To update the local model, use all locally stored sample data as the training dataset, train the local model for one epoch using the stochastic gradient descent algorithm, and calculate the loss function and model parameters to update the gradient. (i.e., the gradient to be updated in the kth training round).

[0104] For example, the “parameter upload” process described in step (2) includes, for instance, the node C of each horizontal federated learning client during the k-th round of local model training. i Update gradients using local model parameters. Node S sent to the master server.

[0105] (3) Model parameter update

[0106] Model parameter updates mainly include four steps: gradient aggregation, parameter evaluation, parameter update, and parameter distribution.

[0107] For example, the “gradient aggregation” process described in step (3) includes, for instance, the server node S calculating the initial global model aggregation gradient during the k-th round of global model parameter update. (referred to as the initial aggregate gradient), where D i For client node C i The locally stored sample dataset, |D i |For set D i The number of elements contained, |D T | represents the sum of the number of local samples across all clients.

[0108]

[0109]

[0110] For example, the “parameter evaluation” process described in step (3) includes, for instance, the following steps: when k ≥ 3 and the global model parameters are updated in the kth round, the server node S calculates the update gradient for each model. Deviation B ik . (i.e., the first unit vector) is the same as... (As an example of the first historical convergence gradient) unit vectors in the same direction, (i.e., the second unit vector) is related to Vertical unit vector, (i.e., the third vector) is related to Vectors that are perpendicular to each other, μ k (that is) B ik The average value, σ k It is B ik The standard deviation.

[0111]

[0112]

[0113]

[0114]

[0115]

[0116]

[0117] For example, the “parameter update” process described in step (3) is exemplified as follows: when k < 3 and during the k-th round of global model parameter update, the master server node S aggregates the gradients to be updated of the client nodes according to the following formula to generate global model parameters Δ. k , where η is the learning rate.

[0118]

[0119] If the empirical principle of statistics is the three-sigma rule (or the six-sigma rule), when k ≥ 3 and the global model parameters are updated in the k-th round, μ k -3σ k ≤B ik ≤μ k +3σ k The index numbers of the client nodes constitute a set A p (That is, the set of all clients corresponding to the target gradient to be updated is obtained). The node S of the master server aggregates the gradients to be updated of the client nodes according to the following formula to generate the update gradient of the global model. (i.e., the global model update gradient in the k-th round) and the global model parameters Δ k ,|D′ T | is the index number belonging to set A p The sum of the number of local samples on the client nodes. (i.e., corrected aggregate gradient) is the corrected... The weighted average, where β is a weight constant, 0 < β < 1.

[0120]

[0121]

[0122]

[0123]

[0124] For example, the “parameter distribution” process described in step (3) includes, for instance: if the parameters of the global model converge or k ≥ E TH If the training fails, the training process will terminate; otherwise, Δ will be applied. k The message is sent to all client nodes, and all sub-steps of steps (2) and (3) are repeated to begin the (k+1)th round of local model training and global model parameter update, where E TH It is a positive integer constant.

[0125] The following example, which can be applied to model security hardening based on federated learning, illustrates the method for training a horizontal federated learning model according to the embodiments of this application.

[0126] (1) Assume that the node of the master server in the horizontal federated learning is S, and the node of the client in the horizontal federated learning is C. i Where i is the client node number, N c =10000 represents the total number of client nodes in the horizontal federated learning. The master server node S uses a Gaussian random initialization method to initialize the parameters of the adopted neural network model (such as RNN, LSTM, CNN model, etc.), and sends the parameter initialization value Δ0 of the deep neural network model to all horizontal federated learning client nodes to start the first round of local model training and global model parameter update.

[0127] (2) During the k-th round of local model training, the node C of each horizontal federated learning client i Using the global model parameters Δ received from node S of the master server k-1 To update the local model, use all locally stored sample data as the training dataset, train the local model for one epoch using the stochastic gradient descent algorithm, and calculate the cross-entropy loss function and model parameter update gradients. During the k-th round of local model training, the number of nodes C in each lateral federated learning client is... i Update gradients using local model parameters. Node S sent to the master server.

[0128] (3) During the k-th round of global model parameter update, node S of the master server will calculate the aggregate gradient of the global model. Where D i For the client's node C iThe locally stored sample dataset, |D i |For set D i The number of elements contained.

[0129]

[0130]

[0131] When k ≥ 3 and the global model parameters are updated in the kth round, node S of the main server calculates the update gradient for each model parameter. Deviation B ik (i.e., deviation value).

[0132]

[0133]

[0134]

[0135]

[0136]

[0137]

[0138] When k < 3 and the global model parameters are updated in the kth round, the master server node S aggregates the update gradients of the client nodes according to the following formula to generate the global model parameters Δ. k , where η = 0.05.

[0139]

[0140] When k≥3 and the global model parameters are updated in the kth round, μ k -3σ k ≤B ik ≤μ k +3σ k The index numbers of the client nodes constitute a set A p The master server node S aggregates the update gradients of the client nodes according to the following formula to generate the update gradients of the global model. and global model parameters Δ k , where β = 0.9.

[0141]

[0142]

[0143]

[0144]

[0145] If the parameters Δ of the global model k Convergence or k≥E TH If Δ = 100, the training process terminates; otherwise, Δ will be used. k Send the instructions to all client nodes and repeat steps (2) and (3) to begin the (k+1)th round of local model training and global model parameter update.

[0146] It is easy to understand that some embodiments of this application innovatively propose a novel lateral federated learning model training process, which can defend against backdoor attacks using only user-uploaded update data. Some embodiments of this application innovatively introduce anomaly detection technology based on data statistical distribution during the training process, which has good detection and defense effects against highly concealed backdoor attacks. Some embodiments of this application innovatively propose a backdoor attack detection and defense technology based on gradient vectors.

[0147] Please refer to Figure 4 , Figure 4 The present application illustrates a master server for training a horizontal federated learning model, and it should be understood that this device is similar to the one described above. Figure 2 Corresponding to the method embodiments, it can execute the various steps involved in the above method embodiments. The specific functions of the device can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here. The device includes at least one software functional module that can be stored in memory or embedded in the device's operating system in the form of software or firmware. The main server for training the lateral federated learning model includes: a receiving module 401, a target gradient value acquisition module 402, and an aggregation module 403.

[0148] The receiving module is configured to receive the gradient values ​​to be updated from all clients during the k-th training round when k is greater than or equal to 3.

[0149] The target gradient value acquisition module is configured to filter out the target gradient value from all gradient values ​​to be updated.

[0150] The aggregation module is configured to perform aggregation operations based on the target gradient value to be updated to obtain aggregated information.

[0151] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0152] Some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any of the embodiments of the lateral federated learning model training method described above.

[0153] like Figure 5 As shown, some embodiments of this application provide an electronic device 500, including a memory 510, a processor 520, and a computer program stored in the memory 510 and executable on the processor 520, wherein when the processor 520 reads and executes the program via a bus 530, it can implement the method described in any of the embodiments of the above-described method for training a lateral federated learning model.

[0154] Processor 520 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 520 can be a microprocessor.

[0155] The memory 510 can be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 520 of the embodiments of this disclosure can be used to execute the instructions in the memory 510 to implement… Figure 2 The method shown. Memory 510 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory well known to those skilled in the art.

[0156] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0157] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0158] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0159] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0160] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0161] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for training a horizontal federated learning model, applied to a master server, characterized in that, The method includes: When k is greater than or equal to 3, in the kth round of training, the gradient values ​​to be updated are received from all clients. Filter out the target gradient value to be updated from all the gradient values ​​to be updated; Aggregation information is obtained by performing aggregation operations based on the target gradient value to be updated. The step of selecting the target gradient value to be updated from all gradient values ​​to be updated includes: The target gradient value to be updated is obtained by the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum.

2. The method as described in claim 1, characterized in that, The step of obtaining the target gradient value to be updated based on the deviation of the projection components of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum includes: Obtain the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum, and obtain the deviation value corresponding to each client. The target gradient value to be updated is identified from a plurality of gradient values ​​to be updated based on the deviation value and empirical rules in statistics.

3. The method as described in claim 2, characterized in that, The step of obtaining the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum, and obtaining the deviation value corresponding to each client, includes: Obtain the first unit vector in the same direction as the historical aggregated gradient momentum of the kjth round, where, when kj < 3, the historical aggregated gradient momentum of the kjth round is the aggregated gradient obtained from the training of the kjth round, and when kj ≥ 3, the historical aggregated gradient momentum of the kjth round is obtained by weighted summation of the corrected aggregated gradient obtained from the training of the kjth round and the gradient momentum obtained from the training of the kj-1th round, where j is a positive integer greater than or equal to 1; Obtain a second unit vector that is perpendicular to the first unit vector; Obtain a third vector from a plurality of vectors that are perpendicular to both the first unit vector and the second unit vector; The deviation of the projection component is calculated based on the third vector to obtain the deviation value.

4. The method as described in claim 3, characterized in that, Obtaining the second unit vector perpendicular to the first unit vector includes: The second unit vector is obtained based on the historical aggregated gradient momentum of the ki-th round and the historical aggregated gradient momentum of the kj-th round. When ki < 3, the historical aggregated gradient momentum of the ki-th round is the aggregated gradient obtained from the training of the ki-th round. When ki ≥ 3, the historical aggregated gradient momentum of the ki-th round is obtained by weighted summation of the corrected aggregated gradient obtained from the training of the ki-th round and the gradient momentum obtained from the training of the (ki-1)-th round. i is a positive integer less than j.

5. The method as described in claim 4, characterized in that, The step of obtaining the second unit vector based on the historical aggregated gradient momentum of the ki-th round and the historical aggregated gradient momentum of the kj-th round includes: Find the first projection component of the historical aggregate gradient momentum of the ki-th round in the direction of the historical aggregate gradient momentum of the kj-th round; Subtracting the first projection component from the historical aggregated gradient momentum of the ki-th round yields the second projection component; The second unit vector is obtained by finding the unit vector in the same direction as the second projection component.

6. The method as described in claim 2, characterized in that, The bias value obtained by the i-th client in the k-th round of training is characterized as follows: ,in, The step of identifying the target gradient value to be updated from a plurality of gradient values ​​to be updated based on the deviation value and empirical rules in statistics includes: If the offset value of the i-th client is determined to be within the following range, then the gradient to be updated corresponding to the i-th client is confirmed to belong to the target gradient value to be updated: in, yes The average value, yes The standard deviation.

7. The method according to any one of claims 1-6, characterized in that, The step of performing aggregation operations based on the target gradient value to be updated to obtain aggregated information includes: Obtain each client corresponding to the target gradient value to be updated, and obtain an aggregated client set; The total number of valid samples is obtained by summing the number of local samples of each client in the aggregated client set. The corrected aggregate gradient is obtained based on the gradient to be updated corresponding to each client in the aggregated client set and the total number of valid samples; At least the global model information is obtained based on the modified aggregate gradient.

8. The method as described in claim 7, characterized in that, The step of obtaining global model information based at least on the corrected aggregated gradient includes: Based on the weight constant, the historical global model update gradient and the corrected aggregated gradient are used to calculate the k-th global model update gradient corresponding to the k-th round of training.

9. The method as described in claim 8, characterized in that, The k-th global model update gradient is calculated using the following formula: in, Characterizes the gradient of the k-th global model update. Characterizing the weight constant, Characterizing the modified aggregate gradient, Update the gradient of the global model corresponding to the (k-1)th round of training.

10. The method as described in claim 7, characterized in that, The step of obtaining global model information based at least on the corrected aggregated gradient includes: Calculate the k-th global model update gradient based on the weight constants and the corrected aggregate gradient; The parameters of the k-th global model are obtained by updating the gradient of the k-th global model.

11. The method as described in claim 10, characterized in that, The step of updating the gradient based on the k-th global model to obtain the parameters of the k-th global model includes: in, Representation learning rate, It represents the gradient of the (k-1)th global model update.

12. The method as described in claim 1, characterized in that, After obtaining aggregated information by performing aggregation operations based on the target gradient value to be updated, the method includes: The aggregated information is sent to all the clients.

13. A master server for training a horizontal federated learning model, characterized in that, The main server includes: The receiving module is configured to receive the gradient values ​​to be updated from all clients in the k-th round of training when k is greater than or equal to 3. The target gradient value acquisition module is configured to filter out the target gradient value to be updated from all gradient values ​​to be updated; The aggregation module is configured to perform aggregation operations based on the target gradient value to be updated to obtain aggregation information; The target gradient value acquisition module is specifically configured as follows: The target gradient value to be updated is obtained by the deviation of the projection component of each gradient value to be updated in the vertical direction of the plane formed by the historical aggregated gradient momentum.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it can implement the method described in any one of claims 1-12.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the program, it can implement the method as described in any one of claims 1-12.

Images