Federated learning method, device, system and storage medium

Abstract

The present application provides a federated learning method, device, system and storage medium, and the participants in the federated learning include a first device deployed with a first network model and a second device deployed with a second network model. The method includes: the first device obtains the first feature data output by the first hidden layer in the first network model, performs activation processing of a bounded activation function on the first feature data, performs differential privacy processing on the first feature data after activation processing to obtain first feature data containing noise, performs noise reduction processing on the first feature data containing noise, and sends the first feature data after noise reduction processing to the second device. The second device obtains an output result based on the aggregation result of the second feature data output by the second hidden layer in the second network model and the first feature data after noise reduction processing, and the second feature data and the first feature data correspond to the same user. Through this solution, data privacy protection can be performed in the process of vertical federated learning.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a federated learning method, device, system and storage medium. Background Art

[0002] Federated learning is a distributed machine learning technology that is jointly carried out among multiple data participants. By exchanging the intermediate parameter information of the machine learning models of multiple participants, it ensures that the local original data of each participant is not stored, and realizes the joint training and joint prediction of the model. The goal of federated learning is to ensure the privacy, security, and compliance of training data under the premise of legal requirements, and to improve the efficiency of model training through distributed training. According to the different data distribution of multiple participants, federated learning can be divided into horizontal federated learning, vertical federated learning, and federated transfer learning.

[0003] In the federated learning process, the participants who own data and labels are called data users, and the participants who only hold data are called data contributors. In the traditional vertical federated learning process, the data contributor sends the intermediate network parameters output by the local neural network model to the data user. The data user fuses the network parameters obtained by local training with the intermediate network parameters received from the data contributor, and then calculates the loss gradient. The model parameters of the data contributor and the data user are updated through the back propagation process to complete the joint training.

[0004] In the above joint training process, the original data is not exchanged, which can protect data privacy. However, the exchanged intermediate network parameters may contain some privacy information that can be deduced and also need to be protected. Summary of the invention

[0005] Embodiments of the present invention provide a federated learning method, device, system and storage medium for securely protecting data privacy in a vertical federated learning process.

[0006] In a first aspect, an embodiment of the present invention provides a federated learning method, wherein participants in the federated learning include a first device and a second device, a first network model is deployed in the first device, and a second network model is deployed in the second device; the method includes:

[0007] The first device obtains first feature data output by a first hidden layer in a first network model;

[0008] The first device performs activation processing of a bounded activation function on the first feature data;

[0009] The first device performs differential privacy processing on the first feature data after the activation process to obtain first feature data containing noise;

[0010] The first device performs noise reduction processing on the first feature data containing noise;

[0011] The first device sends the first feature data after noise reduction processing to the second device, so that the second device inputs the aggregation result of the second feature data output by the second hidden layer in the second network model and the first feature data after noise reduction processing into the output layer in the second network model to obtain the output result, wherein the second feature data and the first feature data correspond to the same user.

[0012] In a second aspect, an embodiment of the present invention provides a federated learning device, wherein participants in the federated learning include a first device and a second device, wherein a first network model is deployed in the first device, and a second network model is deployed in the second device; the device is located in the first device, and includes:

[0013] An acquisition module, used to acquire first feature data output by a first hidden layer in a first network model;

[0014] A processing module, configured to perform activation processing of a bounded activation function on the first feature data; the first device performs differential privacy processing on the first feature data after the activation processing to obtain first feature data containing noise; the first device performs noise reduction processing on the first feature data containing noise;

[0015] A sending module is used to send the first feature data after noise reduction processing to a second device, so that the second device inputs the aggregation result of the second feature data output by the second hidden layer in the second network model and the first feature data after noise reduction processing into the output layer in the second network model to obtain an output result, wherein the second feature data and the first feature data correspond to the same user.

[0016] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the federated learning method as described in the first aspect.

[0017] In a fourth aspect, an embodiment of the present invention provides a non-temporary machine-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor executes the federated learning method as described in the first aspect.

[0018] In a fifth aspect, an embodiment of the present invention provides a federated learning method, wherein participants in the federated learning include a first device and a second device, a first network model is deployed in the first device, and a second network model is deployed in the second device; the method includes:

[0019] The second device receives the first feature data after noise reduction processing sent by the first device; wherein the first device obtains the first feature data output by the first hidden layer in the first network model, performs activation processing of a bounded activation function on the first feature data, performs differential privacy processing on the first feature data after activation processing to obtain first feature data containing noise, and then performs noise reduction processing on the first feature data containing noise to obtain the first feature data after noise reduction processing;

[0020] The second device inputs the second feature data output by the second hidden layer in the second network model and the first feature data after the noise reduction process into the aggregation layer in the second network model to obtain an aggregation result; wherein the second feature data and the first feature data correspond to the same user;

[0021] The second device inputs the aggregate combination into the output layer of the second network model to obtain an output result.

[0022] In a sixth aspect, an embodiment of the present invention provides a federated learning device, wherein the participants in the federated learning include a first device and a second device, wherein a first network model is deployed in the first device, and a second network model is deployed in the second device; the device is located in the second device, and includes:

[0023] A receiving module, configured to receive first feature data after noise reduction processing sent by a first device; wherein the first device obtains the first feature data output by a first hidden layer in a first network model, performs activation processing of a bounded activation function on the first feature data, performs differential privacy processing on the first feature data after activation processing to obtain first feature data containing noise, and then performs noise reduction processing on the first feature data containing noise to obtain the first feature data after noise reduction processing;

[0024] An aggregation module, configured for the second device to input the second feature data output by the second hidden layer in the second network model and the first feature data after the noise reduction process into the aggregation layer in the second network model to obtain an aggregation result; wherein the second feature data and the first feature data correspond to the same user;

[0025] The output module is used for the second device to input the aggregate combination into the output layer of the second network model to obtain an output result.

[0026] In the seventh aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a communication interface; wherein the memory stores an executable code, and when the executable code is executed by the processor, the processor executes the federated learning method as described in the fifth aspect.

[0027] In an eighth aspect, an embodiment of the present invention provides a non-temporary machine-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor executes the federated learning method as described in the fifth aspect.

[0028] In a ninth aspect, an embodiment of the present invention provides a federated learning system, including:

[0029] A first device and a second device participating in federated learning, wherein a first network model is deployed in the first device and a second network model is deployed in the second device;

[0030] A first device is used to obtain first feature data output by a first hidden layer in a first network model, perform activation processing of a bounded activation function on the first feature data, perform differential privacy processing on the first feature data after the activation processing to obtain first feature data containing noise, perform noise reduction processing on the first feature data containing noise, and send the first feature data after the noise reduction processing to a second device;

[0031] The second device is used to obtain second feature data output by a second hidden layer in a second network model, input the second feature data and the first feature data after noise reduction processing into an aggregation layer in the second network model to obtain an aggregation result, and input the aggregation result into an output layer in the second network model to obtain an output result, wherein the second feature data and the first feature data correspond to the same user.

[0032] In the learning scheme of the vertical federated neural network model provided in the embodiment of the present invention, the first device corresponding to the data supporter performs differential privacy protection on the first feature data output by the first hidden layer in the first network model deployed therein during the forward propagation process before sending it to the second device corresponding to the data user, so as to avoid the first feature data being attacked to leak data privacy information. At the same time, before performing differential privacy protection (adding noise) on the first feature data, the first feature data is processed by a bounded activation function to limit the value of the input data of the differential privacy protection to a bounded range to ensure the boundedness of the input. At the same time, after performing differential privacy protection on the first feature data, noise reduction processing is performed. By adding a bounded activation function before adding noise and adding noise reduction processing after adding noise, the side effects of the added noise can be alleviated, and the availability and accuracy of the network model can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0034] Figure 1 It is a structural diagram of a deep neural network model;

[0035] Figure 2 A schematic diagram of the composition of a federated learning system provided in an embodiment of the present invention;

[0036] Figure 3 A flowchart of a federated learning method provided by an embodiment of the present invention;

[0037] Figure 4 A schematic diagram of a forward propagation process provided by an embodiment of the present invention;

[0038] Figure 5 A flowchart of a federated learning method provided by an embodiment of the present invention;

[0039] Figure 6 A schematic diagram of a reverse propagation process provided by an embodiment of the present invention;

[0040] Figure 7 A schematic diagram of the structure of a federated learning device provided in an embodiment of the present invention;

[0041] Figure 8 A schematic diagram of the structure of an electronic device provided in this embodiment;

[0042] Fig. 9 A schematic diagram of the structure of a federated learning device provided in an embodiment of the present invention;

[0043] Fig.10 A schematic diagram of the structure of an electronic device provided in this embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0046] First, the concepts involved in the embodiments of the present invention are explained.

[0047] Differential Privacy (DP) is a provably secure privacy protection technology that hides individual information in the overall information by adding appropriately distributed noise to the source data or calculation results to achieve privacy protection of user data. Assume there is a random algorithm M, S is the set of all possible output results of M, and Pr[] represents the probability. For any two adjacent data sets (there is only one record different between the two data sets) D and D′, if it satisfies: Pr(M(D)∈S)≤e ε Pr(M(D′∈S))+δ, then algorithm M is said to satisfy (ε,δ)-differential privacy. Among them, ε is the privacy budget, which is used to ensure the probability that the output results of algorithm M are consistent when a record is added or deleted from the data set. The smaller ε is, the stronger the privacy protection provided by algorithm M. δ is the privacy confidence, which is a relaxation term that allows algorithm M to not satisfy strict differential privacy to a certain extent. In particular, when δ=0, algorithm M is said to satisfy strict ε-differential privacy.

[0048] Moment accounting is a privacy budget calculation method used to calculate the size of the privacy budget. The smaller the privacy budget of an algorithm, the stronger the privacy protection provided by the algorithm. The size of the privacy budget of an algorithm usually has an upper bound but no lower bound, which varies according to the combinatorial theory. Combinatorial theory includes serial combination, advanced combination, etc.

[0049] Deep Neural Network (DNN) is a branch of machine learning. It is an algorithm that uses artificial neural networks as a framework to represent and learn data. The structure of a typical deep neural network model is as follows: Figure 1 As shown, it includes an input layer, a hidden layer (at least one layer) and an output layer, wherein each layer includes a plurality of neuron nodes.

[0050] The training process of the DNN model consists of the forward propagation process and the back propagation process. The prediction process of the DNN model is the forward propagation process. The forward propagation process starts from the input layer, where the training data is input from the input layer, and the activation value output after layer-by-layer calculation of the weights (i.e., network parameters) corresponding to each hidden layer in the middle is used as the input of the next layer of the network, and finally passed to the output layer to output the predicted label through the output layer. Formally, F represents a DNN model, L i (.) represents the activation value output by each layer of the network, X represents the training data, and the forward propagation process F(X) of DNN is expressed as follows:

[0051] F(X)←L N (L N-1 …(L0(X)))

[0052] Among them, L i (X) = W T X, Represents the weight corresponding to the i-th layer network.

[0053] The back propagation process starts from the output layer, calculates the loss function value based on the predicted label and the real label, i.e. the supervision information, calculates the gradient (called loss gradient) layer by layer in reverse, and updates the weight of each layer of the network until the input layer ends to complete a round of model parameter update. Let g represent the gradient, l represent the loss function value, and α represent the learning rate. The parameter update formula of the DNN model in each round of back propagation process is:

[0054]

[0055] The activation function is a function that runs on the neurons of the DNN model and is used for nonlinear calculations after the weighted summation of the input of each layer of the network. The activation function is generally used in the hidden layer and the output layer, which increases the nonlinear representation ability of the DNN model and makes the network more capable of learning complex feature data.

[0056] Common activation functions include Sigmoid, Relu and Tanh functions. Among them, the Sigmoid function is generally used in the output layer, with a value range of (0,1), and its function expression is: The Relu function is a commonly used hidden layer activation function, and its function expression is: a(x) = max(0,x), which is an unbounded function. The Tanh function is a bounded activation function, with a value range of [-1,1], and its function expression is:

[0057] The bounded activation function used in the embodiment of the present invention may be a Tanh function. In the DNN model training process based on differential privacy, the Tanh function can solve the activation value explosion problem caused by the Relu function due to noise addition.

[0058] Gradient clipping is a technique to solve the problem of gradient explosion. By setting a threshold, the gradient size can be clipped to a bounded range, so that the gradient remains small. Gradient explosion refers to the problem that during the training process of the DNN model, the back-propagation loss gradient becomes too large, making the model unstable.

[0059] Assuming the loss gradient is g and the threshold is c, the loss gradient after clipping is: ‖g‖ is the L2 norm of the loss gradient. The norm of the clipped loss gradient g′ is [-c, c]. In the DNN model training based on differential privacy, the bounded sensitivity can be obtained through gradient clipping technology to quantify the privacy protection strength provided by differential privacy.

[0060] Federated Learning (FL) is a distributed machine learning technology that exchanges intermediate parameter information of machine learning models of multiple participants to ensure that the local original data of each participant is not stored, and realizes joint training and joint prediction of the model. Federated learning has become a feasible solution to solve data silos, privacy protection and data security problems. According to the different data distribution of multiple participants, federated learning can be divided into horizontal federated learning, vertical federated learning and federated transfer learning. Among them, horizontal federated learning and federated transfer learning are not considered in the scope of the embodiments of the present invention, so they will not be repeated here.

[0061] The essence of vertical federated learning is the union of features. It is suitable for scenarios where multiple parties reach the same or similar users but different feature data, that is, there is a lot of overlap in user IDs but little overlap in features. For example, e-commerce and live streaming platforms in the same region reach users who are residents of the region (that is, the sample ID is the same), but the feature data obtained from e-commerce and financial platforms are different. For example, a user has purchased products in categories A and B on an e-commerce platform, watched a live broadcast room on a live streaming platform, and purchased products in category C through the live streaming platform.

[0062] The following introduces the federated learning solution provided by an embodiment of the present invention.

[0063] Figure 2 A schematic diagram of the composition of a federated learning system provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the system includes a first device and a second device participating in federated learning, wherein the first device is a device corresponding to a data provider, and the second device is a device corresponding to a data user.

[0064] Among them, the data supporter refers to the participant who owns the feature data, and the data user refers to the participant who owns the feature data and the supervision label. In a special case, the data user may only have the label without the feature data. Taking the classification task scenario as an example, the label at this time refers to the set multiple category labels. For example, in the binary classification task scenario of predicting whether the user has the intention to buy a certain product, the corresponding binary classification labels include two categories: willingness to buy and lack of willingness to buy. In this example, the feature data includes, but is not limited to, user attribute features, product features, etc.

[0065] In actual applications, the information related to users and their behaviors used is available with the authorization of the users. In addition, in actual applications, the number of data supporters may not be one, that is, multiple data supporters may be included to conduct joint model training with data users. The processing process for each data supporter is similar. In the embodiment of the present invention, only one data supporter is used as an example.

[0066] like Figure 2 As shown in , a first network model corresponding to a data provider is deployed in the first device, and a second network model corresponding to a data user is deployed in the second device. Both the first network model and the second network model can be used in the same Figure 1 The DNN model shown has a similar network structure.

[0067] However, in the vertical federated learning scenario, Figure 2 As shown in , the first network model does not include an output layer, and the second network model includes an output layer, that is, the two network models share one output layer.

[0068] like Figure 2 As shown in , the first network model includes an input layer, a hidden layer, and a bounded activation layer, a noise adding layer, and a noise reducing layer connected after the hidden layer. Optionally, a normalization layer may also be included before the bounded activation layer.

[0069] Among them, Figure 2 As shown in , when the first network model includes multiple hidden layers, a bounded activation layer is connected after the last hidden layer. A bounded activation function such as a tanh function is run in the bounded activation layer to activate the feature data output by the hidden layer and limit the value range of the corresponding feature value to a corresponding bounded range, such as [-1,1].

[0070] Among them, the normalization layer is used to normalize the feature data output by the hidden layer, so as to normalize the values ​​of features of different dimensions to the same set value range. The noise layer is used for differential privacy processing, that is, adding Gaussian noise. The noise reduction layer is used to perform noise reduction on feature data containing noise, such as multiplying it by a coefficient less than 1 to reduce the value of the feature value.

[0071] like Figure 2 As shown in , in addition to the input layer, hidden layer, aggregation layer and output layer, the second network model can also connect a normalization layer and a bounded activation layer, a denoising layer, a denoising layer, a gradient clipping layer between the last hidden layer and the aggregation layer.

[0072] The aggregation layer is used to realize the aggregation between the feature data transmitted by the first network model and the feature data extracted by the local second network model. The gradient clipping layer is used to clip the loss gradient and limit its value range.

[0073] The federated learning solution provided in the embodiment of the present invention is applicable to the application scenario of vertical federated learning. In the vertical federated learning scenario, Figure 2 As shown in , feature aggregation and prediction processing are performed on the data user side, and the data enhancer only passes the intermediate parameters, i.e., the features extracted from the hidden layer, to the data user side after privacy protection processing.

[0074] The following is based on Figure 2 The model structure shown introduces the federated learning solution provided by an embodiment of the present invention.

[0075] Figure 3 A flowchart of a federated learning method provided by an embodiment of the present invention is as follows: Figure 3 As shown, the method comprises the following steps:

[0076] 301. A first device obtains first feature data output by a first hidden layer in a first network model.

[0077] 302. The first device performs activation processing of a bounded activation function on the first feature data, performs differential privacy processing on the first feature data after the activation processing to obtain first feature data containing noise, and performs noise reduction processing on the first feature data containing noise.

[0078] 303. The first device sends the first feature data after noise reduction processing to the second device.

[0079] 304. The second device inputs the aggregation result of the second feature data output by the second hidden layer in the second network model and the first feature data after noise reduction processing into the output layer in the second network model to obtain an output result, wherein the second feature data and the first feature data correspond to the same user.

[0080] This embodiment introduces the processing process of the first device and the second device during the forward propagation process.

[0081] As described above, the federated learning solution provided by the embodiment of the present invention is applicable to the application scenario of vertical federated learning. In the application scenario of vertical federated learning, the size of the sample set corresponding to the data supporter and the data user is N, that is, the data supporter has partial feature data of N users, represented as Xc, and the data user has another partial feature data of the N users, represented as Xs, and has label information Y.

[0082] For example, assuming that the data supporter is a financial platform in a certain region, and the data user is an e-commerce platform in the region, then the N users mentioned above may be several residents in the region. The feature data Xc may include, for example, the user's attribute characteristics, the attribute characteristics of the purchased financial products, the transaction flow characteristics, and other feature information authorized by the user to use. The feature data Xs may include, for example, the user's attribute characteristics, the attribute characteristics of the purchased goods, and other feature information authorized by the user to use.

[0083] Simply put, in the above-mentioned vertical federated learning scenario, the data provider and the data user can respectively obtain feature data of different dimensions of the same user for joint training.

[0084] The joint training process of the first network model and the second network model needs to go through multiple rounds of iterative training. Assuming that the total number of training rounds is T (such as T = 10, 50, etc.), in each round of training, n samples can be sampled from the overall training sample set (i.e., the feature data corresponding to n users in the data supporter and the data user, respectively) for training, that is, the batch size is n. And assume that the tensor dimension of the forward feature data output by the data supporter is kc, and the tensor dimension of the forward feature data output by the data user is ks.

[0085] Take the feature data Xc and feature data Xs corresponding to a user i as an example, combined with Figure 4 The forward propagation process is shown in FIG. 1 . The initial feature data Xc of the data supporter is input into the first network model from the node of the input layer of the first network model, and is forward propagated to the first hidden layer (for example, the last hidden layer), and the first feature data A=(a1,…,a kc ), then, after normalization, it is activated by a bounded activation function, and the activation result is expressed as A'=tanh(A), which realizes the clipping of activation value. After that, A' is input into the loading layer to add Gaussian noise, so that the intermediate parameter information transmitted by the data supporter is differentially privately protected, and the output first feature data containing noise is expressed as: IR=A'+N(0,σ c 2 I). Among them, σ c is the noise variance, which is determined by the data supporter according to security requirements. For example, if the required security level is high, the noise variance can be set to a larger value, otherwise it can be set to a smaller value. After that, IR is input into the denoising layer to perform a certain amount of noise reduction to obtain the denoised output result: IR'=λ*IR,λ∈(0,1]. Based on the post-processing of differential privacy, the operation of the denoising layer can alleviate the side effects of noise without sacrificing security. After that, the data supporter sends IR' to the data user.

[0086] For the data supporter, the first hidden layer may be set to be the last hidden layer, or may not be limited thereto, for example, may be set to be the second to last hidden layer.

[0087] On the data user side, the initial feature data Xs of the same user is input into the second network model from the node of the input layer in the second network model, and the second feature data output by the second hidden layer is processed by the normalization layer and the bounded activation layer, and then input into the aggregation layer, so as to aggregate the second feature data and the first feature data IR' after noise reduction received from the data supporter through the aggregation layer, and the aggregation result is input into the output layer to obtain the predicted output result, so as to complete the forward propagation process. The aggregation process may be the splicing of feature data.

[0088] For the data user, the second hidden layer can be one of the multiple hidden layers included in the second network model. Assuming that the second hidden layer is the third hidden layer, the aggregation layer can be the fourth hidden layer. In practical applications, the last hidden layer in the second network model can be used as the aggregation layer, and a hidden layer before the aggregation layer or a set number of hidden layers can be used as the second hidden layer. Of course, the aggregation layer can also be selected as one of the multiple hidden layers in the second network model, not limited to the last hidden layer.

[0089] In the above scheme, a combined denoising method is provided: bounded activation function + post-processing denoising method, that is, adding a bounded activation layer before denoising and a denoising layer after denoising. This denoising method can alleviate the impact of gradient clipping and denoising without sacrificing privacy, and improve the accuracy and convergence speed of the model. Among them, the bounded activation function before denoising is used to limit the input range, that is, to ensure the boundedness of the input. Based on this, the privacy budget can be calculated, and the activation value explosion can be prevented, which has a certain denoising effect. The main purpose of the denoising process after denoising is denoising, that is, to avoid the impact of introducing too much noise. For example, the value of a feature data before denoising is 0.5, and the added noise size is 2, then the value of the feature data after denoising becomes 2.5, which is much higher than the original 0.5. If the above λ=0.1, then 2.5*0.1=0.25, which can reduce the impact of the introduced noise.

[0090] Through the above-mentioned forward propagation process, the privacy of the intermediate information obtained by the data supporter can be protected when it is sent to the data user. At the same time, through bounded activation functions and noise reduction processing, the boundedness of the noise input information is guaranteed and the noisy data is limited to an appropriate range.

[0091] After completing the forward propagation process as above, you can execute Figure 5 The back propagation process is shown.

[0092] Figure 5 A flowchart of a federated learning method provided by an embodiment of the present invention is as follows: Figure 5 As shown, the method comprises the following steps:

[0093] 501. The second device determines a first loss gradient corresponding to the first device and a second loss gradient corresponding to the second device according to the output result.

[0094] 502. The second device updates the parameters of the second network model according to the second loss gradient.

[0095] 503. The second device performs gradient clipping on the first loss gradient, performs differential privacy processing on the first loss gradient after the gradient clipping to obtain a first loss gradient containing noise, performs noise reduction processing on the first loss gradient containing noise, and sends the first loss gradient after the noise reduction processing to the first device.

[0096] 504. The first device updates the parameters of the first network model according to the first loss gradient after the noise reduction process.

[0097] After the second device calculates the aggregated feature data layer by layer and inputs it into the output layer of the second network model, and obtains the output result as the predicted label, it can calculate the loss function value according to the real label corresponding to the user i and the predicted label, and perform back propagation to the aggregation layer. The output result of the aggregation layer includes the first loss gradient g corresponding to the first device, i.e., the data supporter. c And the second loss gradient g corresponding to the second device, i.e., the data user s .

[0098] Combination Figure 6 This shows the back propagation process. Figure 6 As shown in s , continue to perform local back propagation to the input layer to complete the update of local model parameters. Among them, the second loss gradient g s It can first be activated by a bounded activation layer, then normalized, and then back-propagated to the hidden layer and input layer.

[0099] Among them, the first loss gradient g c Gradient clipping is performed to output bounded gradients Among them, c is the set clipping parameter, which can be set by the data user according to the needs, for example, set to 0.1. Then, bounded gradient After the noise layer is used for differential privacy protection, the gradient g' is obtained after the noise reduction layer is used. c , where the calculation of the noise reduction process is similar to the forward propagation process. Afterwards, the gradient g' cThe first device receives the gradient g' c Continue local back propagation to the input layer to complete the update of local model parameters. Figure 6 As shown in the first device, the gradient g' c Enter the bounded activation layer to limit the activation value, and then backpropagate to the hidden layer and input layer.

[0100] At this point, one round of model training is completed, and the next iterative training will be carried out.

[0101] In the above-mentioned back-propagation process, by protecting the privacy of the first loss gradient that needs to be sent to the data supporter, it is possible to avoid deducing the data privacy information of the data supporter through the first loss gradient. In addition, the bounded activation function can limit the output range of the activation value, thereby preventing the activation value from exploding.

[0102] In summary, the differential privacy-based vertical federated learning scheme provided by the embodiment of the present invention can, first of all, ensure the privacy security of the data supporter and the data user by superimposing differential privacy technology in the forward propagation and backpropagation processes for security reinforcement, and the computational and communication overhead is almost the same as direct plaintext training. Secondly, the proposed combined denoising method of adding a bounded activation layer before denoising and adding a denoising layer after denoising can alleviate the side effects of noise, improve the availability and accuracy of the model, and facilitate rapid convergence of the model.

[0103] After obtaining the trained first network model and the second network model, the prediction process can be performed.

[0104] Assuming that the first network model and the second network model are trained to complete a certain classification prediction task, then in the prediction process, the data supporter and the data user can respectively obtain part of the characteristic data of the target user, input it into the input layer of the network model they maintain, and finally obtain the corresponding prediction result through the output layer of the second network model. For example, predict whether the target user has the intention to buy a certain product. The execution of the prediction process is the same as that of the forward propagation process, which will not be repeated here.

[0105] In an embodiment of the present invention, after completing the model training, the privacy budget of the forward propagation process and the backward propagation process can also be calculated. Specifically, the privacy budget ε of the forward propagation process can be calculated in the first device corresponding to the data supporter. c The privacy budget ε of the back propagation process is calculated in the second device corresponding to the data user. s Calculation.

[0106] The first device may calculate the variance σ of the noise added to the first feature data according to c, the sensitivity s corresponding to the bounded activation function, the set privacy confidence δ, the set number of model training rounds T, the number of samples n used in each round of training, and the set total number of samples N, determine the total privacy budget corresponding to the forward propagation process:

[0107]

[0108] Where τ is a preset constant. When the bounded activation function is the tanh function, its corresponding L2 sensitivity is Among them, K is the dimension of feature data.

[0109] Similarly, the second device adds the variance σ of the noise added to the first loss gradient s , the sensitivity s corresponding to the bounded activation function, the set privacy confidence δ, the set number of model training rounds T, the number of samples n used in each round of training, and the set total number of samples N, the total privacy budget corresponding to the back-propagation process is determined as:

[0110]

[0111] Based on the calculation method of the privacy budget of the forward and backward propagation processes in the above vertical federated learning scenario, the quantitative results of the privacy budget in the forward and backward propagation processes can be obtained, and the degree of privacy protection can be intuitively known. The smaller the privacy budget, the stronger the privacy protection provided.

[0112] The following will describe in detail the federated learning device of one or more embodiments of the present invention. Those skilled in the art will appreciate that these devices can be configured using commercially available hardware components through the steps taught in this solution.

[0113] Figure 7 A structural diagram of a federated learning device provided in an embodiment of the present invention is shown in FIG. Figure 7 As shown, the apparatus is located in the first device, and includes: an acquisition module 11, a processing module 12, and a sending module 13.

[0114] The acquisition module 11 is used to acquire the first feature data output by the first hidden layer in the first network model.

[0115] The processing module 12 is used to perform activation processing of the first feature data using a bounded activation function; the first device performs differential privacy processing on the first feature data after the activation processing to obtain first feature data containing noise; the first device performs noise reduction processing on the first feature data containing noise.

[0116] The sending module 13 is used to send the first feature data after noise reduction processing to the second device, so that the second device inputs the aggregation result of the second feature data output by the second hidden layer in the second network model and the first feature data after noise reduction processing into the output layer in the second network model to obtain the output result, wherein the second feature data and the first feature data correspond to the same user.

[0117] Optionally, the device further comprises: a receiving module and an updating module.

[0118] The receiving module is used to receive the first loss gradient after noise reduction processing fed back by the second device, wherein the second device determines the first loss gradient corresponding to the first device and the second loss gradient corresponding to the second device according to the output result, and performs differential privacy processing on the first loss gradient to obtain the first loss gradient containing noise, and after performing noise reduction processing on the first loss gradient containing noise, the first loss gradient after noise reduction processing is sent to the first device; wherein the second device updates the parameters of the second network model according to the second loss gradient.

[0119] The updating module is used to update the parameters of the first network model according to the first loss gradient after the denoising process.

[0120] Among them, optionally, the update module is specifically used to: perform activation processing of the first loss gradient after the denoising processing with a bounded activation function, so as to input the first loss gradient after the activation processing into the first hidden layer in the first network model, so as to update the parameters of the first network model during the back propagation process.

[0121] Optionally, the processing module 12 is further configured to: the first device performs normalization processing on the first feature data.

[0122] Optionally, the device also includes: a privacy budget calculation module, used to determine the total privacy budget corresponding to the forward propagation process based on the variance of the noise added to the first feature data, the sensitivity corresponding to the bounded activation function, the set privacy confidence, the set number of model training rounds, the number of samples used in each round of training, and the set total number of samples.

[0123] Figure 7 The device shown can execute the steps executed by the first device in the aforementioned embodiment. For detailed execution process and technical effects, please refer to the description in the aforementioned embodiment and will not be repeated here.

[0124] In one possible design, the above Figure 7 The structure of the federated learning device shown in the figure can be implemented as an electronic device, which is the first device mentioned above. Figure 8As shown, the first device may include: a processor 21, a memory 22, and a communication interface 23. The memory 22 stores executable code, and when the executable code is executed by the processor 21, the processor 21 can at least implement the federated learning method executed by the first device in the above-mentioned embodiment.

[0125] In addition, an embodiment of the present invention provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of a first device, the processor can at least implement the federated learning method executed by the first device in the aforementioned embodiment.

[0126] Fig. 9 A structural diagram of a federated learning device provided in an embodiment of the present invention is shown in FIG. Fig. 9 As shown, the device is located in the second equipment and includes: a receiving module 31, an aggregation module 32, and an output module 33.

[0127] The receiving module 31 is used to receive the first feature data after noise reduction processing sent by the first device; wherein the first device obtains the first feature data output by the first hidden layer in the first network model, performs activation processing of a bounded activation function on the first feature data, performs differential privacy processing on the first feature data after activation processing to obtain the first feature data containing noise, and then performs noise reduction processing on the first feature data containing noise to obtain the first feature data after noise reduction processing.

[0128] The aggregation module 32 is used for the second device to input the second feature data output by the second hidden layer in the second network model and the first feature data after the noise reduction process into the aggregation layer in the second network model to obtain an aggregation result; wherein the second feature data and the first feature data correspond to the same user.

[0129] The output module 33 is used for the second device to input the aggregate combination into the output layer of the second network model to obtain an output result.

[0130] Optionally, the device further includes: a gradient processing module, used to determine the first loss gradient corresponding to the first device and the second loss gradient corresponding to the second device according to the output result; update the parameters of the second network model according to the second loss gradient; perform gradient clipping on the first loss gradient; perform differential privacy processing on the first loss gradient after gradient clipping to obtain a first loss gradient containing noise; and perform noise reduction processing on the first loss gradient containing noise. The device further includes: a sending module, used to send the first loss gradient after noise reduction processing to the first device, so that the first device updates the parameters of the first network model according to the first loss gradient after noise reduction processing.

[0131] Optionally, the gradient processing module is specifically used to: perform activation processing of the second loss gradient with a bounded activation function, so as to input the second loss gradient after activation processing into the second hidden layer in the second network model, so as to update the parameters of the second network model during the back propagation process.

[0132] Optionally, the aggregation module 32 is specifically used to: perform activation processing of a bounded activation function on the second feature data; and input the second feature data after the activation processing and the first feature data after the noise reduction processing into the aggregation layer in the second network model.

[0133] Optionally, the device also includes: a privacy budget calculation module, used to determine the total privacy budget corresponding to the back propagation process based on the variance of the noise added to the first loss gradient, the sensitivity corresponding to the bounded activation function, the set privacy confidence, the set number of model training rounds, the number of samples used in each round of training, and the set total number of samples.

[0134] Fig. 9 The device shown can execute the steps executed by the second device in the aforementioned embodiment. For detailed execution process and technical effects, please refer to the description in the aforementioned embodiment and will not be repeated here.

[0135] In one possible design, the above Fig. 9 The structure of the federated learning device shown can be implemented as an electronic device, corresponding to the second device mentioned above. Fig.10 As shown, the electronic device may include: a processor 41, a memory 42, and a communication interface 43. The memory 42 stores executable code, and when the executable code is executed by the processor 41, the processor 41 can at least implement the federated learning method executed by the second device in the aforementioned embodiment.

[0136] In addition, an embodiment of the present invention provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the federated learning method executed by the second device in the aforementioned embodiment.

[0137] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Those of ordinary skill in the art may understand and implement the present invention without creative effort.

[0138] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by adding a necessary general hardware platform, and of course can also be implemented by combining hardware and software. Based on such an understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a computer product, and the present invention can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A federated learning method, It is characterized in that The participants in the federated learning include a first device and a second device, wherein a first network model is deployed in the first device, the first network model includes an input layer, a first hidden layer, a normalization layer, a bounded activation layer, a noise adding layer and a noise reduction layer, and a second network model is deployed in the second device, the second network model includes an input layer, a second hidden layer, a normalization layer, a bounded activation layer, a noise adding layer and a noise reduction layer, a gradient clipping layer, an aggregation layer and an output layer; the method includes: The first device obtains first feature data output by a first hidden layer in a first network model; The first device performs activation processing of a bounded activation function on the first feature data; The first device performs differential privacy processing on the first feature data after the activation process to obtain first feature data containing noise; The first device performs noise reduction processing on the first feature data containing noise; The first device sends the first feature data after noise reduction processing to the second device, so that the second device inputs the aggregation result of the second feature data output by the second hidden layer in the second network model and the first feature data after noise reduction processing into the output layer in the second network model to obtain an output result, wherein the second feature data and the first feature data correspond to the same user; The first device receives the first loss gradient after noise reduction processing fed back by the second device, wherein the second device determines the first loss gradient corresponding to the first device and the second loss gradient corresponding to the second device according to the output result, and performs differential privacy processing on the first loss gradient to obtain the first loss gradient containing noise, and after performing noise reduction processing on the first loss gradient containing noise, sends the first loss gradient after noise reduction processing to the first device; wherein the second device updates the parameters of the second network model according to the second loss gradient; The first device updates the parameters of the first network model according to the first loss gradient after the noise reduction process; The first device determines a total privacy budget corresponding to the forward propagation process according to the variance of the noise added to the first feature data, the sensitivity corresponding to the bounded activation function, the set privacy confidence, the set number of model training rounds, the number of samples used in each round of training, and the set total number of samples.

2. The method according to claim 1, It is characterized in that The first device updates the parameters of the first network model according to the first loss gradient after the noise reduction process, including: The first device performs activation processing of a bounded activation function on the first loss gradient after the denoising processing, so as to input the first loss gradient after the activation processing into the first hidden layer in the first network model, so as to update the parameters of the first network model during the back propagation process.

3. The method according to claim 1, It is characterized in that Before the first device performs bounded function activation processing on the first feature data, the method further includes: The first device normalizes the first feature data.

4. A federated learning method, It is characterized in that The participants in the federated learning include a first device and a second device, wherein a first network model is deployed in the first device, the first network model includes an input layer, a first hidden layer, a normalization layer, a bounded activation layer, a noise adding layer and a noise reduction layer, and a second network model is deployed in the second device, the second network model includes an input layer, a second hidden layer, a normalization layer, a bounded activation layer, a noise adding layer and a noise reduction layer, a gradient clipping layer, an aggregation layer and an output layer; the method includes: The second device receives the first feature data after noise reduction processing sent by the first device; wherein the first device obtains the first feature data output by the first hidden layer in the first network model, performs activation processing of a bounded activation function on the first feature data, performs differential privacy processing on the first feature data after activation processing to obtain first feature data containing noise, and then performs noise reduction processing on the first feature data containing noise to obtain the first feature data after noise reduction processing; The second device inputs the second feature data output by the second hidden layer in the second network model and the first feature data after the noise reduction process into the aggregation layer in the second network model to obtain an aggregation result; wherein the second feature data and the first feature data correspond to the same user; The second device inputs the aggregation result into the output layer of the second network model to obtain an output result; The second device determines a first loss gradient corresponding to the first device and a second loss gradient corresponding to the second device according to the output result; The second device updates the parameters of the second network model according to the second loss gradient; The second device performs gradient clipping processing on the first loss gradient; The second device performs differential privacy processing on the first loss gradient after gradient clipping to obtain a first loss gradient containing noise; The second device performs denoising on the first loss gradient containing noise, and sends the denoised first loss gradient to the first device, so that the first device updates the parameters of the first network model according to the denoised first loss gradient; The second device determines a total privacy budget corresponding to the back propagation process according to the variance of the noise added to the first loss gradient, the sensitivity corresponding to the bounded activation function, the set privacy confidence, the set number of model training rounds, the number of samples used in each round of training, and the set total number of samples.

5. The method according to claim 4, It is characterized in that The second device updates the parameters of the second network model according to the second loss gradient, including: The second device performs activation processing of the second loss gradient using a bounded activation function to input the activated second loss gradient into the second hidden layer in the second network model to update the parameters of the second network model during back propagation.

6. The method according to claim 4, It is characterized in that The second device inputs the second feature data output by the second hidden layer in the second network model and the first feature data after the noise reduction process into the aggregation layer in the second network model, including: The second device performs activation processing of a bounded activation function on the second feature data; The second device inputs the second feature data after the activation processing and the first feature data after the noise reduction processing into the aggregation layer in the second network model.

7. An electronic device, It is characterized in that include: A memory, a processor, and a communication interface; wherein the memory stores an executable code, and when the executable code is executed by the processor, the processor executes the federated learning method as described in any one of claims 1 to 3, or executes the federated learning method as described in any one of claims 4 to 6.

8. A non-transitory machine-readable storage medium, It is characterized in that The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by a processor of an electronic device, the processor executes the federated learning method as described in any one of claims 1 to 3, or executes the federated learning method as described in any one of claims 4 to 6.

9. A federated learning system, It is characterized in that include: A first device and a second device participating in federated learning, wherein a first network model is deployed in the first device, and the first network model includes an input layer, a first hidden layer, a normalization layer, a bounded activation layer, a noise adding layer, and a noise reduction layer; and a second network model is deployed in the second device, and the second network model includes an input layer, a second hidden layer, a normalization layer, a bounded activation layer, a noise adding layer, a noise reduction layer, a gradient clipping layer, an aggregation layer, and an output layer; A first device is used to obtain first feature data output by a first hidden layer in a first network model, perform activation processing of a bounded activation function on the first feature data, perform differential privacy processing on the first feature data after the activation processing to obtain first feature data containing noise, perform noise reduction processing on the first feature data containing noise, and send the first feature data after noise reduction processing to a second device, so that the second device inputs the aggregation result of the second feature data output by the second hidden layer in the second network model and the first feature data after noise reduction processing into the output layer of the second network model to obtain an output result, wherein the second feature data and the first feature data correspond to the same user; receive the first loss gradient after noise reduction processing fed back by the second device, and update the first loss gradient after noise reduction processing according to the first loss gradient after noise reduction processing. The method comprises: updating the parameters of the first network model according to the output result, wherein the second device determines a first loss gradient corresponding to the first device and a second loss gradient corresponding to the second device according to the output result, and performs differential privacy processing on the first loss gradient to obtain a first loss gradient containing noise, and after performing noise reduction processing on the first loss gradient containing noise, sends the first loss gradient after noise reduction processing to the first device; wherein the second device updates the parameters of the second network model according to the second loss gradient; and determines the total privacy budget corresponding to the forward propagation process according to the variance of the noise added to the first feature data, the sensitivity corresponding to the bounded activation function, the set privacy confidence, the set number of model training rounds, the number of samples used in each round of training, and the set total number of samples; A second device is used to obtain second feature data output by a second hidden layer in a second network model, input the second feature data and the first feature data after denoising into an aggregation layer in the second network model to obtain an aggregation result, and input the aggregation result into an output layer in the second network model to obtain an output result, wherein the second feature data and the first feature data correspond to the same user; determine a first loss gradient corresponding to the first device and a second loss gradient corresponding to the second device according to the output result, update the parameters of the second network model according to the second loss gradient, perform gradient clipping on the first loss gradient, perform differential privacy processing on the first loss gradient after gradient clipping to obtain a first loss gradient containing noise, perform denoising on the first loss gradient containing noise, and send the denoised first loss gradient to the first device, so that the first device updates the parameters of the first network model according to the denoised first loss gradient; determine a total privacy budget corresponding to the back propagation process according to the variance of the noise added to the first loss gradient, the sensitivity corresponding to the bounded activation function, the set privacy confidence, the set number of model training rounds, the number of samples used in each round of training, and the set total number of samples.

Images