Data sharing method based on differential privacy federated learning and related device
By employing a differential privacy federated learning method and utilizing privacy budgeting and perturbation mechanisms to handle gradients, the problems of gradient leakage and model inversion attacks in federated learning are solved. This enables data sharing and privacy protection on low-cost devices and is suitable for IoT terminals and smart mobile devices.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHENZHEN INST OF ARTIFICIAL INTELLIGENCE & ROBOTICS FOR SOC
- Filing Date
- 2022-12-16
- Publication Date
- 2026-06-09
AI Technical Summary
Existing technologies pose privacy threats such as gradient leakage and model inversion attacks in federated learning, and homomorphic encryption methods have excessive computational and communication overhead in low-cost and resource-constrained scenarios.
Employing a differential privacy federated learning approach, this method coordinates training and demand servers, uses privacy budgets and perturbation mechanisms to process gradients, reduces gradient inversion threats, and enables data sharing. It is suitable for low-cost and resource-constrained IoT terminal devices or smart mobile devices.
While reducing computational and communication overhead, it achieves data privacy protection and good model training results, making it suitable for low-cost and resource-constrained devices.
Smart Images
Figure CN116383863B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of privacy protection, and in particular to a data sharing method and related equipment based on differential privacy federated learning. Background Technology
[0002] Federated learning is an emerging distributed machine learning paradigm that allows multiple data owners to collaboratively train a model and build a shared machine learning model without leaving their local storage. This effectively addresses the privacy and data security issues associated with existing data sharing methods for machine learning model training. However, data owners participating in federated learning still face privacy threats such as gradient leakage and model inversion attacks.
[0003] Existing technical solutions can use homomorphic encryption to encrypt gradients or model parameters to defend against the aforementioned privacy threats. However, such methods incur additional computational and communication overhead, making them unsuitable for low-cost and resource-constrained scenarios (such as scenarios where smart mobile devices or IoT terminal devices are the data owners). Summary of the Invention
[0004] This application provides a data sharing method and related equipment based on differential privacy federated learning, which balances the quality of data sharing during the data sharing process with lower computational cost and communication overhead.
[0005] The first aspect of this application provides a data sharing method based on differential privacy federated learning, applied to a training server, including:
[0006] Obtain the privacy budget for each demand server corresponding to the training server;
[0007] Receive the initial parameters for each demand server corresponding to the training server in the Tth round of training;
[0008] Based on the initial parameters of each demand server in the Tth round of training, the perturbation parameters of each demand server in the Tth round of training are trained respectively.
[0009] Based on the privacy budget of each demand server, the parameters to be perturbed during the Tth round of training for each demand server are perturbed to obtain the parameters to be aggregated during the Tth round of training for each demand server.
[0010] Each demand server sends the parameters to be aggregated during the Tth round of training to each demand server, so that each demand server determines the aggregated parameters obtained during the Tth round of training based on the parameters to be aggregated during the Tth round of training sent by the corresponding training server.
[0011] In one specific implementation, the step of perturbing the parameters to be perturbed during the T-th round of training for each demand server based on the privacy budget of each demand server, to obtain the parameters to be aggregated during the T-th round of training for each demand server, includes:
[0012] Based on the training samples used by each demand server in the Tth round of training, determine the training sample set for each demand server in the Tth round of training;
[0013] From the training sample set of each demand server in the Tth round of training, determine the training sample subset of the training server corresponding to the Tth round of training for each demand server;
[0014] Based on the privacy budget of each demand server and the training sample subset of the training server corresponding to each demand server in the Tth round of training, calculate the stochastic gradient of each demand server in the Tth round of training, where the sample subset is any subset of the training sample set of the training server.
[0015] According to the preset perturbation mechanism, the stochastic gradient of each demand server in the Tth round of training and the perturbation parameters of each demand server in the Tth round of training are processed to obtain the aggregation parameters of each demand server in the Tth round of training.
[0016] In one specific implementation, calculating the stochastic gradient of each demand server in the Tth round of training, based on the privacy budget of each demand server and the subset of training samples of the training server corresponding to each demand server in the Tth round of training, includes:
[0017] The stochastic gradient of each demand server during the Tth round of training is calculated using the following formula;
[0018]
[0019] in, This represents the stochastic gradient of the nth demand server in the Tth round of training among the multiple demand servers corresponding to the training server. This represents the subset of training samples of the training server corresponding to the nth demand server in the Tth round of training. Let τ represent the parameters to be perturbed for the nth demand server during the Tth round of training. i ,z i )express The i-th sample in the τ i Let z represent the features of the i-th sample. i Let represent the label of the i-th sample. This represents the initial stochastic gradient calculated based on the i-th sample.
[0020] In one specific implementation, the perturbation mechanism is a Gaussian mechanism. The step of processing the stochastic gradients of each demand server during training round T, and the parameters to be perturbed during training round T, according to the preset perturbation mechanism, to obtain the parameters to be aggregated during training round T for each demand server, includes:
[0021] The aggregation parameters for each demand server in the Tth round of training are calculated using the following formula;
[0022]
[0023] in, For the parameters to be aggregated in the training round T of the nth demand server, This represents a vector with a mean of 0 and a covariance matrix of . A multidimensional Gaussian distribution d n d-dimensional identity matrix n It represents the number of parameters in the demand model corresponding to the nth demand server.
[0024] In one specific implementation, the method further includes:
[0025] Send the initial cost function information of the training server to the coordination server;
[0026] The system receives the initial privacy budget calculation rules and the initial pricing scheme sent by the coordination server. The initial privacy budget calculation rules and the initial pricing scheme are determined by the coordination server based on the initial cost function information of each training server and the initial utility function information of each demand server.
[0027] The expected cost function information of the training server is sent to the coordination server, and the expected cost function information is determined according to the initial privacy budget calculation rules and the initial pricing scheme;
[0028] The system receives the target privacy budget calculation rules and target pricing scheme sent by the coordination server. The target privacy budget calculation rules and target pricing scheme are determined by the coordination server based on the expected cost function information of each training server and the expected utility function information of each demand server.
[0029] Based on the target privacy budget calculation rules, the privacy budget for each demand server corresponding to the training server is determined.
[0030] A second aspect of this application provides a data sharing method based on differential privacy federated learning, applied to a demand server, comprising:
[0031] Send the initial parameters for the Tth round of training to each training server corresponding to the demand server;
[0032] The system receives the parameters to be aggregated in the Tth round of training sent by each training server. The parameters to be aggregated are obtained by each training server through perturbation processing of the parameters to be perturbed in the Tth round of training based on the privacy parameters corresponding to the demand server. The parameters to be perturbed are obtained by each training server through training the initial parameters on the training sample set of the demand server in the Tth round of training.
[0033] Aggregate the parameters to be aggregated sent by each training server in the Tth round of training to obtain the aggregated parameters of the demand server in the Tth round of training;
[0034] If the aggregated parameters of the demand server in the Tth round of training do not meet the preset convergence condition, then the initial parameters of the (T+1)th round of training are sent to each training server to perform the (T+1)th round of training; the aggregated parameters of each training server in the Tth round of training are the initial parameters of each training server in the (T+1)th round of training.
[0035] A third aspect of this application provides a training server, comprising:
[0036] The acquisition unit is used to acquire the privacy budget of each demand server corresponding to the training server;
[0037] The receiving unit is used to receive the initial parameters of each demand server corresponding to the training server in the Tth round of training;
[0038] The training unit is used to train the parameters to be perturbed for each demand server in the Tth round of training based on the initial parameters of each demand server in the Tth round of training.
[0039] The perturbation unit is used to perturb the parameters to be perturbed during the Tth round of training for each demand server based on the privacy budget of each demand server, so as to obtain the parameters to be aggregated during the Tth round of training for each demand server.
[0040] The sending unit is configured to send the parameters to be aggregated during the Tth round of training to each demand server, so that each demand server can determine the aggregated parameters obtained during the Tth round of training based on the parameters to be aggregated during the Tth round of training sent by the corresponding training server.
[0041] In one specific implementation, the perturbation unit is specifically used to determine the training sample set for each demand server in the Tth round of training based on the training samples used by each demand server in the Tth round of training.
[0042] From the training sample set of each demand server in the Tth round of training, determine the training sample subset of the training server corresponding to the Tth round of training for each demand server;
[0043] Based on the privacy budget of each demand server and the training sample subset of the training server corresponding to each demand server in the Tth round of training, calculate the stochastic gradient of each demand server in the Tth round of training, where the sample subset is any subset of the training sample set of the training server.
[0044] According to the preset perturbation mechanism, the stochastic gradient of each demand server in the Tth round of training and the perturbation parameters of each demand server in the Tth round of training are processed to obtain the aggregation parameters of each demand server in the Tth round of training.
[0045] In one specific implementation, the perturbation unit is specifically used to calculate the stochastic gradient of each demand server in the Tth round of training according to the following formula;
[0046]
[0047] in, This represents the stochastic gradient of the nth demand server in the Tth round of training among the multiple demand servers corresponding to the training server. This represents the subset of training samples of the training server corresponding to the nth demand server in the Tth round of training. Let τ represent the parameters to be perturbed for the nth demand server during the Tth round of training. i ,z i )express The i-th sample in the τ i Let z represent the features of the i-th sample. i Let represent the label of the i-th sample. This represents the initial stochastic gradient calculated based on the i-th sample.
[0048] In one specific implementation, the perturbation mechanism is a Gaussian mechanism, and the perturbation unit is specifically used to calculate the aggregation parameters of each demand server in the Tth round of training according to the following formula;
[0049]
[0050] in, For the parameters to be aggregated in the training round T of the nth demand server, This represents a vector with a mean of 0 and a covariance matrix of . A multidimensional Gaussian distribution dn d-dimensional identity matrix n It represents the number of parameters in the demand model corresponding to the nth demand server.
[0051] In one specific implementation, the training server further includes: a determining unit;
[0052] The sending unit is also used to send the initial cost function information of the training server to the coordination server;
[0053] The receiving unit is further configured to receive the privacy budget calculation rules and pricing scheme sent by the coordination server. The privacy budget calculation rules and pricing scheme are determined by the coordination server based on the initial cost function information of each training server and the initial utility function information of each demand server.
[0054] The sending unit is further configured to send the expected cost function information of the training server to the coordination server, wherein the expected cost function information is determined according to the privacy budget calculation rules and pricing scheme;
[0055] The receiving unit is further configured to receive the target privacy budget calculation rules and target pricing scheme sent by the coordination server. The target privacy budget calculation rules and target pricing scheme are determined by the coordination server based on the expected cost function information of each training server and the expected utility function information of each demand server.
[0056] The determining unit is used to determine the privacy budget for each demand server corresponding to the training server based on the target privacy budget calculation rule.
[0057] A fourth aspect of this application provides a demand server, including:
[0058] The sending unit is used to send the initial parameters of the Tth round of training to each training server corresponding to the demand server;
[0059] The receiving unit is configured to receive the parameters to be aggregated in the Tth round of training sent by each training server. The parameters to be aggregated are obtained by each training server through perturbation processing of the parameters to be perturbed in the Tth round of training based on the privacy parameters corresponding to the demand server. The parameters to be perturbed are obtained by each training server through training the initial parameters on the training sample set of the demand server in the Tth round of training.
[0060] An aggregation unit is used to aggregate the parameters to be aggregated sent by each training server in the Tth round of training to obtain the aggregated parameters of the demand server in the Tth round of training.
[0061] The sending unit is further configured to send the initial parameters for the (T+1)th round of training to each training server if the aggregate parameters of the demand server in the Tth round of training do not meet the preset convergence condition, so as to perform the (T+1)th round of training; the aggregate parameters of each training server in the Tth round of training are the initial parameters of each training server in the (T+1)th round of training.
[0062] A third aspect of this application provides a computer device, including:
[0063] Central processing unit, memory, and input / output interfaces;
[0064] The memory is either a short-term storage memory or a persistent storage memory;
[0065] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method described in the first or second aspect.
[0066] A fourth aspect of this application provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first or second aspect.
[0067] A fifth aspect of this application provides a computer storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described in the first or second aspect.
[0068] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: the data sharing method based on differential privacy federated learning is simple and easy to implement, suitable for low-cost and resource-constrained IoT terminal devices or smart mobile devices, and the algorithm has high execution efficiency and strong scalability. By obtaining the parameters to be aggregated in each round of training through a perturbation mechanism and sending these parameters to the corresponding demand server, a trade-off is struck between reducing data leakage caused by gradient inversion threats and improving model training performance, thus achieving both data privacy protection and good model training results. Attached Figure Description
[0069] Figure 1 This is a system architecture diagram of the data sharing method disclosed in the embodiments of this application;
[0070] Figure 2 This is a schematic flowchart of a data sharing method disclosed in an embodiment of this application;
[0071] Figure 3 This is a schematic diagram of the structure of the training server disclosed in an embodiment of this application;
[0072] Figure 4This is a schematic diagram of the structure of the demand server disclosed in an embodiment of this application;
[0073] Figure 5 This is a schematic diagram of the structure of a computer device disclosed in an embodiment of this application. Detailed Implementation
[0074] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0075] This application provides a data sharing method and related equipment based on differential privacy federated learning, which balances the quality of data sharing during the data sharing process with lower computational cost and communication overhead.
[0076] Please see Figure 1 In practical applications, data owners (i.e., the training server) tend to allocate a smaller privacy budget (using larger noise perturbations during model training) to achieve strong privacy protection, while model requesters (i.e., the request server) expect data owners to allocate a larger budget (using smaller noise perturbations during model training) to obtain high-quality models. These conflicting needs lead to a new approach: introducing a non-profit third party as a coordinator (i.e., a coordinating server) to coordinate data sharing between data owners and model requesters. This helps them reach an agreement on privacy budget allocation, effectively guiding data owners to participate in model training tasks for model requesters through differential privacy federated learning. However, the coordinator cannot directly obtain the agreed-upon privacy budget value when participating in differential privacy federated learning model training tasks for model requesters, as it lacks access to the privacy cost function of data owners and the utility function of model requesters regarding model quality.
[0077] Specifically, the coordinator can coordinate training quotes and privacy budgets between data owners and model requesters. Data owners and model requesters engage in federated learning (with the model requester acting as the federated server, aggregating the parameters to be perturbed from each training server in each round). The data owner uses their corresponding privacy budget to perturb the parameters to be perturbed on the requesting server to obtain the parameters to be aggregated, and then sends the perturbed parameters to the corresponding requesting server for aggregation.
[0078] Please see Figure 2This application provides a data sharing method based on differential privacy federated learning, which can be executed by the aforementioned data owner, coordinator, and / or model requester, and includes the following steps:
[0079] 201. The training server obtains the privacy budget for each requirement server corresponding to the training server.
[0080] First, it's important to clarify that even within each training server and each demand server participating in the same data sharing, the training server corresponding to each demand server can be not entirely the same, completely the same, or completely different, depending on training requirements and privacy budget considerations. In other words, the demand models trained by each training server participating in the same data sharing are not entirely the same. Simply put, if we consider the training server A training the demand model of demand server 1 as having a correspondence between training server A and demand server 1, then the demand servers corresponding to each training server in the same data sharing can not be completely identical, and the training servers corresponding to each demand server in the same data sharing can not be completely identical.
[0081] However, the training method of each training server and the aggregation method of each demand server are completely consistent. It should be noted that, in order to more clearly illustrate the technical solution of this application, the data sharing method of this application embodiment will only be described from the perspective of one training server and one demand server participating in the same data sharing.
[0082] Specifically, to balance privacy budget and model training performance during data sharing, the training server should first obtain the privacy budget of the server corresponding to the currently trained model. It should be noted that this step only needs to be performed before step 204; that is, this step can be performed before or after steps 202-203, and is not limited here.
[0083] In practical applications, the privacy budget and price of each demand server are usually determined first, and then the model is trained. Therefore, in the same data sharing process, the privacy budget of each demand server can remain consistent in different rounds of local training.
[0084] 202. The demand server sends the initial parameters for the Tth round of training to each training server corresponding to the demand server.
[0085] If T is 1, then the initial parameters of the Tth round of training are the initial parameters of the corresponding demand server's demand model; if T is greater than 1, then the initial parameters of the Tth round of training are the aggregate parameters of the corresponding demand server's demand model in the (T-1)th round of training.
[0086] It should be noted that during a training round, the request server first sends the initial parameters for this round of training, and then the training server executes the training based on the initial parameters to obtain the parameters to be perturbed for this round; next, the training server perturbs the corresponding parameters to be perturbed according to the corresponding privacy budget to obtain the parameters to be aggregated; finally, the request server aggregates the parameters to be aggregated sent by each training server to obtain the final aggregated parameters for this round of training.
[0087] 203. The training server trains the parameters to be perturbed for each demand server in the Tth round of training based on the initial parameters of each demand server in the Tth round of training.
[0088] Specifically, according to the training requirements of each demand server, the training sample set corresponding to each demand server can be obtained from the local sample set of the training server. In other words, the training sample set corresponding to each demand server is a subset of the local sample set of the training server.
[0089] Based on the training sample set corresponding to each demand server, the initial parameters for the Tth round of training for each demand server are trained, and the perturbation parameters for each demand server in the Tth round of training are obtained.
[0090] 204. The training server perturbs the parameters to be perturbed for each demand server in the Tth round of training based on the privacy budget of each demand server, and obtains the parameters to be aggregated for each demand server in the Tth round of training.
[0091] Specifically, firstly, based on the privacy budget of each demand server during the Tth round of training, a stochastic gradient is generated to perturb the parameters to be perturbed corresponding to that demand server in this round of training. Then, the parameters to be perturbed for each demand server are perturbed according to the corresponding stochastic gradient to obtain the corresponding parameters to be aggregated.
[0092] 205. The training server sends the parameters to be aggregated for each demand server during the Tth round of training to each demand server.
[0093] Specifically, the parameters to be aggregated for each demand server are sent to that demand server. In other words, each demand server only receives the parameters to be aggregated for the corresponding demand model obtained in this round of training from its own training server.
[0094] 207. The demand server aggregates the parameters to be aggregated sent by each training server during the Tth round of training to obtain the aggregated parameters of the demand server during the Tth round of training.
[0095] Specifically, the aggregation parameters for this round can be obtained by weighting and aggregating the parameters sent by each training server based on the sample size of each training server and / or the preset weighting weights.
[0096] 208. If the aggregated parameters of the demand server in the Tth round of training do not meet the preset convergence condition, the demand server sends the initial parameters of the (T+1)th round of training to each training server to carry out the (T+1)th round of training; the aggregated parameters of each training server in the Tth round of training are the initial parameters of each training server in the (T+1)th round of training.
[0097] Understandably, if the aggregated parameters obtained in the Tth round of training do not meet the preset convergence conditions, then the next round of training will be initiated; if the aggregated parameters obtained in the Tth round of training meet the preset convergence conditions, then there is no need to initiate the next round of training, and the aggregated parameters in this round are the target parameters after the demand model completes data sharing. When each demand server has completed data sharing (i.e., obtained the target parameters after the demand model has completed data sharing), it is considered that this data sharing is complete.
[0098] In this embodiment, the data sharing method based on differential privacy federated learning is simple and easy to implement, suitable for low-cost and resource-constrained IoT terminal devices or smart mobile devices. The algorithm has high execution efficiency and strong scalability. By obtaining the parameters to be aggregated in each training round through a perturbation mechanism and sending these parameters to the corresponding request server, a trade-off is struck between reducing data leakage caused by gradient inversion threats and improving model training performance, thus achieving both data privacy protection and good model training results.
[0099] In some specific implementations, step 204 can be implemented as follows: Based on the training samples used by each demand server in round T of training, determine the training sample set for each demand server in round T of training; from the training sample set for each demand server in round T of training, determine the training sample subset of the training server corresponding to each demand server in round T of training; based on the privacy budget of each demand server and the training sample subset of the training server corresponding to each demand server in round T of training, calculate the stochastic gradient of each demand server in round T of training, where the sample subset is any subset of the training sample set of the training server; according to a preset perturbation mechanism, process the stochastic gradient of each demand server in round T of training and the parameters to be perturbed of each demand server in round T of training to obtain the parameters to be aggregated for each demand server in round T of training.
[0100] Specifically, the training server can determine at least a subset of training samples from the training sample set of each demand server in this round of training as the training sample subset corresponding to that demand server. This subset of training samples for each demand server can be used to determine the stochastic gradient perturbation required for each demand server in this round of training on its corresponding training server. Furthermore, the perturbation mechanism can be either a Gaussian mechanism or a Laplace mechanism; there is no limitation here.
[0101] Furthermore, if the perturbation mechanism is Gaussian, the stochastic gradient can be calculated as follows: calculate the stochastic gradient of each demand server in the Tth round of training according to the following formula;
[0102]
[0103] in, This represents the stochastic gradient of the nth demand server in the Tth round of training among multiple demand servers corresponding to the training server. This represents the subset of training samples from the training server corresponding to the nth demand server in the Tth round of training. Let τ represent the parameters to be perturbed for the nth demand server during the Tth round of training. i ,z i )express The i-th sample in the τ i Let z represent the features of the i-th sample. i Let represent the label of the i-th sample. This represents the initial stochastic gradient calculated based on the i-th sample.
[0104] Based on the foregoing embodiments, the parameters to be aggregated can be calculated in the following way: calculate the stochastic gradient of each demand server in the Tth round of training according to the following formula;
[0105]
[0106] in, This represents the stochastic gradient of the nth demand server in the Tth round of training among multiple demand servers corresponding to the training server. This represents the subset of training samples from the training server corresponding to the nth demand server in the Tth round of training. Let τ represent the parameters to be perturbed for the nth demand server during the Tth round of training. i ,z i )express The i-th sample in the τ i Let z represent the features of the i-th sample. i Let represent the label of the i-th sample. This represents the initial stochastic gradient calculated based on the i-th sample.
[0107] Finally, prior to step 204, in this embodiment, the privacy budget for each demand server can be determined as follows: Initial cost function information of the training server is sent to the coordination server; the initial privacy budget calculation rules and initial pricing scheme are received from the coordination server, whereby the initial privacy budget calculation rules and initial pricing scheme are determined by the coordination server based on the initial cost function information of each training server and the initial utility function information of each demand server; the expected cost function information of the training server is sent to the coordination server, whereby the expected cost function information is determined based on the initial privacy budget calculation rules and initial pricing scheme; the target privacy budget calculation rules and target pricing scheme are received from the coordination server, whereby the target privacy budget calculation rules and target pricing scheme are determined by the coordination server based on the expected cost function information of each training server and the expected utility function information of each demand server; and the privacy budget for each demand server corresponding to the training server is determined based on the target privacy budget calculation rules.
[0108] Specifically, the coordinator first designs the initial privacy budget calculation rules and the initial pricing scheme (the coordinator can calculate the amount of privacy budget that each data owner should invest when participating in the model training task based on differential privacy federated learning for each model user, based on the privacy cost function of the data owner and the model utility function of the model user, i.e. the initial privacy calculation rules, as well as the remuneration that each model user should pay to the coordinator and the remuneration that the coordinator pays to the data owner, i.e. the initial pricing scheme) and publishes it to the data owner and the model user;
[0109] Each data owner can calculate the privacy budget corresponding to each information reporting strategy based on the initial privacy budget calculation rules and initial pricing scheme received, and then calculate the privacy cost and the reward that can be obtained (and calculate the revenue), and finally choose the information reporting strategy that maximizes its own benefits.
[0110] Each model user can calculate the privacy budget corresponding to each information reporting strategy based on the privacy budget calculation rules and pricing schemes they receive, and then calculate the model utility and the remuneration required (and calculate the revenue), and finally choose the information reporting strategy that maximizes their own revenue.
[0111] In practical applications, users (data owners and model requesters) may also consider the bids from other data owners and model requesters in each round when choosing an information reporting strategy that maximizes their own benefits, in order to ensure that the mechanism converges as soon as possible.
[0112] Based on the latest privacy cost functions reported by each data owner and the model utility functions reported by each model requester, the coordinator calculates the expected privacy budget and reward value for both parties. The coordinator then updates the privacy budget calculation rules and pricing scheme based on the difference between the expected privacy budgets and rewards. The updated privacy budget calculation rules and pricing scheme are then sent to each data owner and model requester, and the aforementioned coordination process continues, so that the subsequently calculated privacy budgets and rewards for both parties gradually approach each other and reach an agreement.
[0113] The auction process described above iterates until the mechanism converges (meaning that both the model requester and the data owner accept the current privacy budget calculation rules and pricing scheme), that is, the bidding schemes of the data owner and the model requester no longer change. By running the above two-way auction mechanism, the amount of privacy budget that each data owner needs to invest in participating in the differential privacy federated learning model training task for each model requester can be determined.
[0114] The preceding sections described various embodiments of the data sharing method of this application. The following section describes the data sharing method of an embodiment of this application in a specific scenario.
[0115] According to the aforementioned embodiments, the auction process is executed iteratively until the privacy budget converges, meaning the bidding schemes of data owners and model requesters no longer change. By running the above two-way auction mechanism, the amount of privacy budget each data owner needs to invest in participating in the differential privacy federated learning model training task for each model requester can be determined. Then, based on this privacy budget, the model training process based on differential privacy federated learning is as follows:
[0116] Model demander set There are N model requesters in total, and one of them is a model requester. Set its current global model parameters θ n Share with the set of data owners ( There are a total of W data owners, and a data owner is denoted as w, that is...
[0117] During the t-th round of federated learning, each data owner For the various model requesters received model Using the corresponding training dataset (This refers to the training data used by data owner w when updating the model of model requester n locally) Local model training is performed, and the stochastic gradient is calculated. B wn Indicates from A randomly selected subset of training samples B wn In a training sample i, where Indicates features, Indicates the corresponding label, This represents the stochastic gradient calculated based on sample i.
[0118] Data owners The calculated stochastic gradient is processed using a Gaussian mechanism (or a Laplace mechanism). Perform a random perturbation and obtain the gradient after the perturbation, i.e., in This represents a vector with a mean of 0 and a covariance matrix of . A multidimensional Gaussian distribution d n d-dimensional identity matrix n It is model θ n The number of parameters. And will Send to the corresponding model requester n;
[0119] Various model users Received from various data owners participating in its model training task Gradient after perturbation Then, these data are aggregated, and subsequently, the global model is updated. Where η represents the update step size.
[0120] The training process of the aforementioned differential privacy federated learning model is iterative until the preset number of training rounds is reached or the global model converges to the ideal accuracy.
[0121] Please see Figure 3 This application provides a training server, including:
[0122] The acquisition unit 301 is used to acquire the privacy budget of each demand server corresponding to the training server;
[0123] The receiving unit 302 is used to receive the initial parameters of each demand server corresponding to the training server in the Tth round of training;
[0124] Training unit 303 is used to train the perturbation parameters of each demand server in the Tth round of training based on the initial parameters of each demand server in the Tth round of training.
[0125] The perturbation unit 304 is used to perturb the parameters to be perturbed during the training of each demand server in the Tth round, based on the privacy budget of each demand server, so as to obtain the parameters to be aggregated during the training of each demand server in the Tth round.
[0126] The sending unit 305 is used to send the parameters to be aggregated for training in round T to each demand server, so that each demand server can determine the aggregated parameters obtained in round T based on the parameters to be aggregated for training in round T sent by each corresponding training server.
[0127] In one specific implementation, the perturbation unit 304 is specifically used to determine the training sample set for each demand server in the Tth round of training based on the training samples used by each demand server in the Tth round of training.
[0128] From the training sample set of each demand server in the Tth round of training, determine the training sample subset of the training server corresponding to the Tth round of training for each demand server;
[0129] Based on the privacy budget of each demand server and the training sample subset of the training server corresponding to each demand server in the Tth round of training, calculate the stochastic gradient of each demand server in the Tth round of training. The sample subset is any subset of the training sample set of the training server.
[0130] According to the preset perturbation mechanism, the stochastic gradient of each demand server in the Tth round of training and the perturbation parameters of each demand server in the Tth round of training are processed to obtain the aggregation parameters of each demand server in the Tth round of training.
[0131] In one specific implementation, the perturbation unit 304 is specifically used to calculate the stochastic gradient of each demand server in the Tth round of training according to the following formula;
[0132]
[0133] in, This represents the stochastic gradient of the nth demand server in the Tth round of training among multiple demand servers corresponding to the training server. This represents the subset of training samples from the training server corresponding to the nth demand server in the Tth round of training. Let τ represent the parameters to be perturbed for the nth demand server during the Tth round of training. i ,z i )express The i-th sample in the τ i Let z represent the features of the i-th sample. i Let represent the label of the i-th sample. This represents the initial stochastic gradient calculated based on the i-th sample.
[0134] In one specific implementation, the perturbation mechanism is a Gaussian mechanism, and the perturbation unit 304 is specifically used to calculate the aggregation parameters of each demand server in the Tth round of training according to the following formula;
[0135]
[0136] in, For the parameters to be aggregated in the training round T of the nth demand server, This represents a vector with a mean of 0 and a covariance matrix of . A multidimensional Gaussian distribution d n d-dimensional identity matrix n It represents the number of parameters in the demand model corresponding to the nth demand server.
[0137] In one specific implementation, the training server further includes: a determination unit;
[0138] The sending unit 305 is also used to send the initial cost function information of the training server to the coordination server;
[0139] The receiving unit 302 is also used to receive the initial privacy budget calculation rules and initial pricing scheme sent by the coordination server. The initial privacy budget calculation rules and initial pricing scheme are determined by the coordination server based on the initial cost function information of each training server and the initial utility function information of each demand server.
[0140] The sending unit 305 is also used to send the expected cost function information of the training server to the coordination server. The expected cost function information is determined according to the initial privacy budget calculation rules and the initial pricing scheme.
[0141] The receiving unit 302 is also used to receive the target privacy budget calculation rules and target pricing scheme sent by the coordination server. The target privacy budget calculation rules and target pricing scheme are determined by the coordination server based on the expected cost function information of each training server and the expected utility function information of each demand server.
[0142] The determination unit is used to determine the privacy budget for each requirement server corresponding to the training server based on the target privacy budget calculation rules.
[0143] Please see Figure 4 This application provides a demand server, including:
[0144] The sending unit 401 is used to send the initial parameters of the Tth round of training to each training server corresponding to the demand server;
[0145] The receiving unit 402 is used to receive the parameters to be aggregated in the Tth round of training sent by each training server. The parameters to be aggregated are obtained by each training server based on the privacy parameters corresponding to the demand server and the perturbation parameters to be perturbed in the Tth round of training. The parameters to be perturbed are obtained by each training server based on the initial parameters trained on the training sample set in the Tth round of training according to the demand server.
[0146] Aggregation unit 403 is used to aggregate the parameters to be aggregated sent by each training server in the Tth round of training to obtain the aggregated parameters of the request server in the Tth round of training.
[0147] The sending unit 401 is further configured to send the initial parameters for the (T+1)th round of training to each training server if the aggregate parameters of the demand server in the Tth round of training do not meet the preset convergence condition, so as to carry out the (T+1)th round of training; the aggregate parameters of each training server in the Tth round of training are the initial parameters of each training server in the (T+1)th round of training.
[0148] Figure 5 This is a schematic diagram of a computer device structure provided in an embodiment of this application. The computer device 500 may include one or more central processing units (CPUs) 501 and a memory 505, in which one or more application programs or data are stored.
[0149] The memory 505 can be volatile or persistent storage. The program stored in the memory 505 can include one or more modules, each module including a series of instruction operations on the computer device. Furthermore, the central processing unit 501 can be configured to communicate with the memory 505 and execute the series of instruction operations stored in the memory 505 on the computer device 500.
[0150] Computer device 500 may also include one or more power supplies 502, one or more wired or wireless network interfaces 503, one or more input / output interfaces 504, and / or one or more operating systems, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.
[0151] The central processing unit 501 can perform the aforementioned... Figures 1 to 4 The methods described in the illustrated embodiments will not be elaborated further here.
[0152] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0153] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.
[0154] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0155] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0156] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0157] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the data sharing method based on differential privacy federated learning as described above.
Claims
1. A data sharing method based on differential privacy federated learning, characterized in that, Applied to a training server, the method includes: Obtain the privacy budget for each demand server corresponding to the training server; Receive the initial parameters for each demand server corresponding to the training server in the Tth round of training; Based on the initial parameters of each demand server in the Tth round of training, the perturbation parameters of each demand server in the Tth round of training are trained respectively. Based on the privacy budget of each demand server, the parameters to be perturbed during the Tth round of training for each demand server are perturbed to obtain the parameters to be aggregated during the Tth round of training for each demand server. Each demand server sends the parameters to be aggregated during the Tth round of training to each demand server, so that each demand server determines the aggregated parameters obtained during the Tth round of training based on the parameters to be aggregated during the Tth round of training sent by the corresponding training server. The step of perturbing the parameters to be perturbed during the Tth round of training for each demand server based on the privacy budget of each demand server, to obtain the parameters to be aggregated during the Tth round of training for each demand server, includes: Based on the training samples used by each demand server in the Tth round of training, determine the training sample set for each demand server in the Tth round of training; From the training sample set of each demand server in the Tth round of training, determine the training sample subset of the training server corresponding to the Tth round of training for each demand server; Based on the privacy budget of each demand server and the training sample subset of the training server corresponding to each demand server in the Tth round of training, calculate the stochastic gradient of each demand server in the Tth round of training, where the sample subset is any subset of the training sample set of the training server. According to the preset perturbation mechanism, the stochastic gradient of each demand server in the Tth round of training and the perturbation parameters of each demand server in the Tth round of training are processed to obtain the aggregation parameters of each demand server in the Tth round of training.
2. The method according to claim 1, characterized in that, The step of calculating the stochastic gradient of each demand server in the Tth round of training, based on the privacy budget of each demand server and the subset of training samples of the training server corresponding to each demand server in the Tth round of training, includes: The stochastic gradient of each demand server during the Tth round of training is calculated using the following formula; ;in, This represents the stochastic gradient of the nth demand server in the Tth round of training among the multiple demand servers corresponding to the training server. This represents the subset of training samples of the training server corresponding to the nth demand server in the Tth round of training. This represents the parameters to be perturbed for the nth demand server during the Tth round of training. express The i-th sample in the series, Represents the features of the i-th sample. Let represent the label of the i-th sample. This represents the initial stochastic gradient calculated based on the i-th sample.
3. The method according to claim 2, characterized in that, The perturbation mechanism is a Gaussian mechanism. The process involves processing the stochastic gradients of each demand server during training round T, and the parameters to be perturbed during training round T, according to the preset perturbation mechanism, to obtain the aggregation parameters of each demand server during training round T, including: The aggregation parameters for each demand server in the Tth round of training are calculated using the following formula; ;in, For the parameters to be aggregated in the training round T of the nth demand server, This represents a vector with a mean of 0 and a covariance matrix of . A multidimensional Gaussian distribution express 3D identity matrix It represents the number of parameters in the demand model corresponding to the nth demand server.
4. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Send the initial cost function information of the training server to the coordination server; The system receives the initial privacy budget calculation rules and the initial pricing scheme sent by the coordination server. The initial privacy budget calculation rules and the initial pricing scheme are determined by the coordination server based on the initial cost function information of each training server and the initial utility function information of each demand server. The expected cost function information of the training server is sent to the coordination server, and the expected cost function information is determined according to the initial privacy budget calculation rules and the initial pricing scheme; The system receives the target privacy budget calculation rules and target pricing scheme sent by the coordination server. The target privacy budget calculation rules and target pricing scheme are determined by the coordination server based on the expected cost function information of each training server and the expected utility function information of each demand server. Based on the target privacy budget calculation rules, the privacy budget for each demand server corresponding to the training server is determined.
5. A data sharing method based on differential privacy federated learning, characterized in that, Applied to a demand server, the method includes: Send the initial parameters for the Tth round of training to each training server corresponding to the demand server; The system receives the parameters to be aggregated from each training server during the Tth round of training. These parameters are obtained by perturbing the parameters to be perturbed by each training server based on the privacy parameters corresponding to the demand server during the Tth round of training. The perturbed parameters are obtained by each training server training the initial parameters using the training sample set used by the demand server during the Tth round of training. The parameters to be aggregated are obtained by: determining the training sample set used by each demand server during the Tth round of training; and then... The training sample subset of the training server corresponding to each demand server in the Tth round of training is determined. Based on the privacy budget of each demand server and the training sample subset of the training server corresponding to each demand server in the Tth round of training, the stochastic gradient of each demand server in the Tth round of training is calculated, where the sample subset is any subset of the training sample set of the training server. The stochastic gradient of each demand server in the Tth round of training and the parameters to be perturbed of each demand server in the Tth round of training are processed according to a preset perturbation mechanism to obtain the parameters to be aggregated for each demand server in the Tth round of training. Aggregate the parameters to be aggregated sent by each training server in the Tth round of training to obtain the aggregated parameters of the demand server in the Tth round of training; If the aggregated parameters of the demand server in the Tth round of training do not meet the preset convergence condition, then the initial parameters of the (T+1)th round of training are sent to each training server to perform the (T+1)th round of training; the aggregated parameters of each training server in the Tth round of training are the initial parameters of each training server in the (T+1)th round of training.
6. A training server, characterized in that, include: The acquisition unit is used to acquire the privacy budget of each demand server corresponding to the training server; The receiving unit is used to receive the initial parameters of each demand server corresponding to the training server in the Tth round of training; The training unit is used to train the parameters to be perturbed for each demand server in the Tth round of training based on the initial parameters of each demand server in the Tth round of training. The perturbation unit is used to perturb the parameters to be perturbed during the Tth round of training for each demand server based on the privacy budget of each demand server, so as to obtain the parameters to be aggregated during the Tth round of training for each demand server. The sending unit is used to send the parameters to be aggregated in the Tth round of training to each demand server respectively, so that each demand server determines the aggregated parameters obtained in the Tth round of training based on the parameters to be aggregated in the Tth round of training sent by each corresponding training server. The perturbation unit is specifically used to determine the training sample set for each demand server in the Tth round of training based on the training samples used by each demand server in the Tth round of training. From the training sample set of each demand server in the Tth round of training, determine the training sample subset of the training server corresponding to the Tth round of training for each demand server; Based on the privacy budget of each demand server and the training sample subset of the training server corresponding to each demand server in the Tth round of training, calculate the stochastic gradient of each demand server in the Tth round of training, where the sample subset is any subset of the training sample set of the training server. According to the preset perturbation mechanism, the stochastic gradient of each demand server in the Tth round of training and the perturbation parameters of each demand server in the Tth round of training are processed to obtain the aggregation parameters of each demand server in the Tth round of training.
7. A demand server, characterized in that, include: The sending unit is used to send the initial parameters of the Tth round of training to each training server corresponding to the demand server; The receiving unit is configured to receive the parameters to be aggregated in the Tth round of training sent by each training server. The parameters to be aggregated are obtained by each training server through perturbation processing of the parameters to be perturbed in the Tth round of training based on the privacy parameters corresponding to the demand server. The parameters to be perturbed are obtained by each training server through training the initial parameters on the training sample set of the demand server in the Tth round of training. The parameters to be aggregated are obtained by determining the training sample set for each demand server in the Tth round of training based on the training samples used by each demand server in the Tth round of training. From the training sample set of each demand server in the Tth round of training, determine the training sample subset of the training server corresponding to the Tth round of training for each demand server; calculate the stochastic gradient of each demand server in the Tth round of training based on the privacy budget of each demand server and the training sample subset of the training server corresponding to the Tth round of training for each demand server, where the sample subset is any subset of the training sample set of the training server; process the stochastic gradient of each demand server in the Tth round of training and the parameters to be perturbed of each demand server in the Tth round of training according to a preset perturbation mechanism to obtain the parameters to be aggregated for each demand server in the Tth round of training; An aggregation unit is used to aggregate the parameters to be aggregated sent by each training server in the Tth round of training to obtain the aggregated parameters of the demand server in the Tth round of training. If the aggregated parameters of the demand server in the Tth round of training do not meet the preset convergence condition, then the initial parameters of the (T+1)th round of training are sent to each training server to perform the (T+1)th round of training; the aggregated parameters of each training server in the Tth round of training are the initial parameters of each training server in the (T+1)th round of training.
8. A computer device, characterized in that, include: Central processing unit, memory, and input / output interfaces; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method of any one of claims 1 to 4 or 5.
9. A computer storage medium, characterized in that, The computer storage medium stores instructions that, when executed on the computer, cause the computer to perform the method as described in any one of claims 1 to 4 or 5.