Distributed training using randomized secure averaging

Abstract

A method for distributed machine learning for a network, comprising: receiving a local model update vector. The method also includes generating a public key and a secret key. The method also includes receiving an external public key for each other client device. The method also includes generating a pseudo-random number based on the secret key and the external public key. The method also includes determining whether to assign each other client device to a neighbor device set of the client device. The method also includes: based on the neighbor device set, generating a model update output according to security and protocol, and outputting the model update output for sending the model update output to a central server for incorporation into a global model update. The method enhances privacy protection of user data while solving the scalability problem and ensuring high practical utility.

Description

Technical Field

[0001] The present disclosure relates generally to the fields of data security and machine learning; more specifically, to methods and apparatus for distributed machine learning (or training) utilizing a randomized secure averaging protocol. Background Art

[0002] Nowadays, numerous services use machine learning (ML) to improve their usability in everyday life. Usually, a machine learning algorithm consists of two phases: a training phase and a prediction phase. With a machine learning algorithm, a model trained with sample data is developed. The sample data is used during the training phase in order to make predictions (or decisions) during the prediction phase of the model. Usually, when using customer data or personal data during the training phase and the prediction phase of the model, how to achieve privacy protection becomes a major technical issue.

[0003] At present, some methods have been proposed to enhance privacy, such as traditional federated learning (FL). Traditional federated learning is used as a distributed training mechanism for models without forcing clients (or clients) to upload their original data during the training phase. Therefore, traditional federated learning reduces the total communication cost while partially enhancing privacy. Traditional federated learning solves the need to continuously update the model at a low cost to a certain extent, and shows the possibility of training the model locally by using the client's (or client's) local data. However, traditional federated learning has privacy issues, for example, personal data can be directly extracted from the model update received by the traditional server. In addition, the model (or trained model) shared with other clients may also leak the personal information of the client (or client) participating in the model training phase. The privacy issues of traditional federated learning can be solved to a certain extent by using traditional security and technology and traditional differential privacy (DP) technology. In other words, the distributed training of the model (or machine learning model) is performed by using traditional security and technology or traditional differential privacy technology. Traditional security and technology is a cryptographic technology that simultaneously distributes and privately computes the sum of updates of multiple clients (or clients) and prevents traditional servers from observing any individual updates. Therefore, traditional security and technology protect the privacy of individual clients in a distributed learning manner. However, when the number of clients increases, traditional security and technology incurs high computational costs and does not provide privacy guarantees for the final trained model. In traditional differential privacy technology, the traditional server adds noise after each global iteration in the training phase. Therefore, traditional differential privacy technology provides a certain amount of formal privacy guarantees for the final trained model. However, traditional differential privacy technology does not solve the privacy problems associated with traditional servers. In addition, traditional differential privacy technology requires a large number of clients, and traditional security and technology exhibit scaling problems (i.e., cannot scale properly and are prone to errors) when the number of clients increases. Therefore, when a large number of clients are involved, or when the number of clients (i.e., client devices) increases, there is a technical problem of insufficient privacy protection of customer data or personal data, and scaling problems will emerge.

[0004] Therefore, based on the foregoing discussion, there is a need to overcome the above-mentioned shortcomings associated with traditional techniques for distributed machine learning. Summary of the invention

[0005] The present disclosure seeks to provide methods and apparatus for distributed machine learning that improve privacy protection of user data or personal data, have high performance and high utility. The present disclosure seeks to provide a solution to the existing problem of insufficient privacy protection of client data or personal data when a large number of clients are involved or when the increase in the number of clients (i.e., client devices) leads to scaling problems. The purpose of the present disclosure is to provide a solution that at least partially overcomes the problems encountered in the prior art and provides methods and apparatus for distributed machine learning that improve privacy protection of user data, including personal data, while solving scaling problems and ensuring high performance and high practical utility.

[0006] The objects of the present disclosure are achieved by what is presented in the attached independent claims. Advantageous implementations of the present disclosure are further defined in the dependent claims.

[0007] In one aspect, the present disclosure provides a method for distributed machine learning for a network, comprising: a processor of a client device receives a local model update vector. The method also includes: the processor generates a public key and a secret key, wherein the public key is used to broadcast to multiple other client devices on the network. The method also includes the processor receiving an external public key for each other client device. The method also includes, for each other client device: generating a pseudo-random number based on the secret key and the external public key; determining whether to assign each other client device to a neighbor device set of the client device based on the pseudo-random number and a predefined neighbor probability parameter. The method also includes: the processor generates a model update output based on the neighbor device set according to security and protocol; the processor outputs the model update output, which is used to send the model update output to a central server for merging into a global model update.

[0008] The method disclosed herein uses distributed machine learning using a random secure averaging (RdSA) protocol. The disclosed method provides enhanced privacy protection, improved performance, and high utility for data (including personal data) of a client device (or user). The disclosed method uses a combination of security and technology (or cryptographic technology) and differential privacy technology in a coordinated and collaborative manner to enhance the data privacy of the client device. The method using security and protocols prevents a central server from accessing private information from any individual client. Beneficially, the method disclosed herein uses a neighbor selection algorithm. Based on the neighbor selection algorithm, a neighbor set is selected in each iteration of the random secure averaging (RdSA) protocol. By using the neighbor selection algorithm, the number of client devices is reduced in each iteration of the RdSA protocol, which further solves the expansion problem. The use of the neighbor selection algorithm also supports the use of differential privacy technology to further enhance the privacy protection of the data of the client device.

[0009] In one implementation, the neighbor probability parameter is used to define the number of neighbors in the neighbor device set based on a predefined value, wherein the predefined value is defined based on a modeled risk of a successful attack.

[0010] The disclosed method provides enhanced privacy protection of user data and improved performance, even in the presence of a large number of client devices. By using a neighbor selection algorithm, the scalability problem of traditional security and technology is solved. By using the neighbor selection algorithm, the client device selects its neighbors based on a neighbor probability parameter. The neighbors are selected in such a way that each pair of client devices negotiates whether they are neighbors, and any other client device (e.g., a central server) has no knowledge of whether they are neighbors. When the number of client devices is large, the neighbor selection algorithm still provides strong privacy at a lower computational cost by selecting a set of neighbor client devices. In addition, the use of the neighbor selection algorithm enables the use of differential privacy techniques to further enhance the data privacy of the client.

[0011] In another implementation, for a neighbor probability parameter p and a predefined value r:

[0012] f(n h ,p)>1-r, and for accuracy δ, f(n h ,p-δ)<1-r

[0013] in:

[0014]

[0015] in:

[0016]

[0017] By configuring the neighbor probability parameter p, the disclosed method can be used with both active and passive security models. The active security model provides protection against very powerful (e.g., nation-level or state-level) attackers or internal attackers. The passive security model provides protection against data breaches, remote hacking, and regulatory compliance.

[0018] In another implementation, generating a model update output according to security and protocol includes: generating a one-time password for each neighbor device and adding multiple one-time passwords to a local model update vector, wherein the one-time password for each neighbor device is generated based on a shared key derived from a key of a client device and an external public key of the neighbor device.

[0019] Multiple one-time passwords are added to the local model update vector of the client device to encrypt the key value of the client device.

[0020] In another implementation, the set of all one-time pads generated by the plurality of client devices substantially sums to zero.

[0021] The set of all one-time pads generated by multiple client devices is summed up at the central server, essentially equal to zero, which means that the central server obtains the sum of the clients' (unencrypted) keys.

[0022] In another implementation, generating a model update output according to security and protocol includes splitting a local model vector update into multiple parts according to a number of neighbor devices, sending the multiple parts to corresponding neighbor devices, receiving an external part from the neighbor devices, and adding the multiple external parts to form the model update output.

[0023] Compared to traditional security techniques that have significant scaling issues, splitting the local model vector update into multiple parts based on the number of neighboring devices improves key sharing on the client side.

[0024] In another implementation, generating the model update output includes adding a locally generated noise signal to the local model update vector, the distribution of the locally generated noise signal being Gaussian or binomial.

[0025] In differential privacy techniques, locally generated noise signals are added to the local model update vector to provide improved local privacy, which means that private data is fully protected. The central server cannot observe any private information from any individual client. The noise signal is added locally (client side) rather than centrally (server side) because local privacy is preferred over central privacy. A locally generated binomial distribution noise signal is used to provide local privacy protection.

[0026] In another implementation, the locally generated noise signals are generated with a standard deviation defined by noise parameters received from a central server, wherein the noise parameters for each client device are such that corresponding locally generated noise signals from multiple client devices are aggregated into a global noise having a predetermined standard deviation.

[0027] The global noise is made to have a binomial distribution by generating a locally generated noise signal with a standard deviation chosen by the central server.

[0028] In another implementation, the method further includes converting the local model update vector from a vector of floating point values ​​to a vector of integers.

[0029] Converting the local model update vector from a vector of floating point values ​​to a vector of (modulo) integers ensures client-side security.

[0030] In another implementation, the method further includes sending a public key to a central server, and receiving an external public key from the central server.

[0031] The public key is transmitted to the central server, which further transmits the public key to other client devices so that the client devices can perform key negotiation with other client devices and select their neighbors.

[0032] In another implementation, a computer-readable medium is provided for storing instructions that, when executed, cause a client device processor to perform the method.

[0033] The client device processor realizes all the advantages and effects of this method.

[0034] On the other hand, the present disclosure provides a client device comprising a training module for generating a local model update vector. The client device also includes a processor for generating a public key and a secret key. The client device also includes a transceiver for: broadcasting the public key to multiple other client devices on the network, receiving an external public key for each other client device, and sending the model update output to a central server to be incorporated into the global model update. The processor of the client device is also used to generate a pseudo-random number for each other client device based on the secret key and the external public key. The processor of the client device is also used to determine whether to assign each other client device to a neighbor device set of the client device based on the pseudo-random number and a predefined neighbor probability parameter. The processor of the client device is also used to generate a model update output based on the neighbor device set according to security and protocol.

[0035] The client devices of the present disclosure exhibit enhanced local privacy of personal data. The client devices use a neighbor selection algorithm that reduces the number of client devices in each iteration of the RdSA protocol. Therefore, the client devices exhibit reduced computational costs even in the presence of a large number of client devices. The client devices use security and techniques (or cryptographic techniques) and prevent the central server from accessing private information from any individual client.

[0036] In one implementation, the neighbor probability parameter is used to define the number of neighbor devices in the neighbor device set based on a predefined value, wherein the predefined value is defined based on a modeled risk of a successful attack.

[0037] The client device selects its neighbors by using the neighbor probability parameter in the neighbor selection algorithm. The neighbor selection method is that each pair of client devices negotiates whether they are neighbors, and any other client device (such as the central server) has no knowledge of whether they are neighbors.

[0038] In another implementation, for a neighbor probability parameter p and a predefined value r:

[0039] f(n h ,p)>1-r, and for accuracy δ, f(n h ,p-δ)<1-r

[0040] in:

[0041]

[0042] in:

[0043]

[0044] By configuring the neighbor probability parameter p, the client device can be used in both the active security model and the passive security model.

[0045] In another implementation, the processor is further configured to generate a model update output according to security and protocol in the following manner: generating a one-time password for each neighbor device and adding multiple one-time passwords to a local model update vector, wherein the one-time password for each neighbor device is generated based on a shared key derived from a key of the client device and an external public key of the neighbor device.

[0046] Multiple one-time passwords are added to the local model update vector of the client device to encrypt the key value of the client device.

[0047] In another implementation, the set of all one-time pads generated by the plurality of client devices substantially sums to zero.

[0048] The set of all one-time pads generated by multiple client devices is summed up at the central server, essentially equal to zero, which means that the central server obtains the sum of the clients' (unencrypted) keys.

[0049] In another implementation, the processor is further configured to generate a model update output according to security and protocol by splitting a local model vector update into a plurality of parts according to a number of neighbor devices, sending the plurality of parts to corresponding neighbor devices, receiving an external part from the neighbor devices, and adding the plurality of external parts to form a model update output.

[0050] Compared to traditional security techniques that have significant scaling issues, splitting the local model vector update into multiple parts based on the number of neighboring devices improves key sharing on the client side.

[0051] In another implementation, the processor is configured to generate the model update output by adding a locally generated noise signal to the local model update vector, the distribution of the locally generated noise signal being Gaussian or binomial.

[0052] In differential privacy techniques, client devices add locally generated noise signals to local model update vectors to provide improved local privacy, which means that private data is fully protected. The central server cannot observe any private information from any individual client. The noise signal is added locally (client-side) rather than centrally (server-side) because local privacy is preferred over central privacy. A locally generated binomial distribution noise signal is used to provide local privacy protection.

[0053] In another implementation, the locally generated noise signal is generated with a standard deviation defined by noise parameters received from a central server, wherein the noise parameters for each client device are such that corresponding differential private noise signals from multiple client devices aggregate to a global noise with a predetermined standard deviation.

[0054] The global noise is made to have a binomial distribution by generating a locally generated noise signal with a standard deviation chosen by the central server.

[0055] In another implementation, the processor is further configured to convert the local model update vector from a vector of floating point values ​​to a vector of integers.

[0056] The client device converts the local model update vector from a vector of floating point values ​​to a vector of (modulo) integers to ensure security.

[0057] In another implementation, the transceiver is further configured to send a public key to the central server and receive an external public key from the central server.

[0058] The client device transmits the public key to the central server, which further transmits the public key to other client devices so that the client device can perform key negotiation with other client devices and select its neighbors.

[0059] In another aspect, the present disclosure provides a method for distributed machine learning for a network, comprising: a central server receiving multiple model update outputs sent by multiple client devices; the method further comprises: the central server determining the sum of model updates based on the multiple model update outputs. The method further comprises: the central server updating a global model based on the sum of model updates. The method further comprises: the central server sending a global model update to each client device.

[0060] The central server performs a randomized secure average on the multiple model update outputs sent by the multiple client devices. Based on the randomized secure average, the central server determines a global model update that is further shared with the multiple client devices. Due to the global model update, the multiple client devices exhibit improved accuracy and enhanced personal data privacy protection.

[0061] In one implementation, updating the global model includes converting the integer vector to a floating point vector.

[0062] The global model includes conversion from integer vectors to floating point vectors for easy manipulation.

[0063] In another implementation, the method further includes the central server determining that the client device has been disconnected. The method further includes the central server adding additional noise to the sum of model updates based on a predetermined variance value of the local noise added to the sum of model updates.

[0064] The central server determines whether any client device is offline during the execution of the RdSA protocol. After determining the offline, the central server compensates for the lost noise by adding the additional noise to the sum of the model updates. In this way, the central server also performs differential noise recovery.

[0065] In another implementation, the method further includes executing a client dropout recovery protocol, including: a central server receiving a plurality of key portions from a plurality of client devices, representing a key set of each client device, the key set being split into a plurality of key portions according to a key sharing protocol, distributed among the client devices, and sent by each client device to the central server. The method further includes the central server determining that the client device has been dropped. The method further includes the central server combining the received plurality of key portions corresponding to the dropped client to recover a key corresponding to the dropped client.

[0066] The central server performs client offline recovery by using a key sharing protocol in the event that the client is offline.

[0067] In another implementation, a computer readable medium is provided for storing instructions that, when executed, cause a central server processor to perform the method.

[0068] The central server processor realizes all the advantages and effects of this method.

[0069] In another aspect, the present disclosure provides a central server, the central server comprising a transceiver for receiving a plurality of model update outputs sent by a plurality of client devices, and sending a global model update to each client device. The central server also comprises a processor for determining a sum of model updates based on the plurality of model update outputs, and updating a global model based on the sum of model updates to generate a global model update.

[0070] The central server performs a randomized secure average on the multiple model update outputs sent by the multiple client devices. Based on the randomized secure average, the central server determines a global model update that is further shared with the multiple client devices. Due to the global model update, the multiple client devices exhibit improved accuracy and enhanced personal data privacy protection.

[0071] In one implementation, updating the global model includes converting the integer vector to a floating point vector.

[0072] The global model includes conversion from integer vectors to floating point vectors to make it easy for the central server to operate.

[0073] In another implementation, the processor is further configured to determine that the client device has been disconnected. The processor is further configured to add additional noise to the sum of model updates based on a predetermined variance value of the local noise added to the sum of model updates.

[0074] The central server determines whether any client device is offline during the execution of the RdSA protocol. After determining the offline, the central server compensates for the lost noise by adding additional noise to the sum of the model updates. In this way, the central server also performs differential noise recovery.

[0075] In another implementation, the central server is further configured to execute a client offline recovery protocol, including: a transceiver receives a plurality of key parts from a plurality of client devices, representing a key set of each client device, the key set being split into a plurality of key parts according to a key sharing protocol, distributed in the client devices, and sent to the central server by each client device. The central server is further configured to execute a client offline recovery protocol, including: a processor determines that a client device has been offline. The central server is further configured to execute a client offline recovery protocol, including: a processor combines the received plurality of key parts corresponding to the offline client to recover a key corresponding to the offline client.

[0076] The central server performs client offline recovery by using a key sharing protocol in the event that the client is offline.

[0077] It should be noted that all devices, elements, circuits, units and modules described in this application can be implemented by software or hardware elements or any type of combination thereof. All steps performed by various entities described in this application and the described functions to be performed by various entities are intended to indicate that the corresponding entities are suitable for or used to perform the corresponding steps and functions. Although in the description of the following specific embodiments, the specific functions or steps performed by external entities are not reflected in the description of the specific detailed elements of the entities performing the specific steps or functions, it should be clear to the technician that these methods and functions can be implemented by corresponding hardware or software elements or any combination thereof. It should be understood that various combinations can be made to the features of the present disclosure, which will not deviate from the scope of the present disclosure defined by the appended claims.

[0078] Additional aspects, advantages, features and objects of the present disclosure will become apparent from the accompanying drawings and detailed description of illustrative implementations which is interpreted in conjunction with the following appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The above summary and the detailed description of the following illustrative embodiments may be better understood by reading in conjunction with the accompanying drawings. In order to illustrate the present disclosure, exemplary structures of the present disclosure are shown in the accompanying drawings. However, the present disclosure is not limited to the specific methods and tools disclosed herein. In addition, it should be understood by those skilled in the art that the accompanying drawings are not drawn to scale. Where possible, the same elements are represented by the same numbers.

[0080] Embodiments of the present disclosure will now be described, by way of example only, with reference to the following figures.

[0081] Figure 1 is a flowchart of a method for distributed machine learning for a network according to an embodiment of the present disclosure.

[0082] Figure 2 is a flowchart of a method for distributed machine learning in a network according to another embodiment of the present disclosure.

[0083] Figure 3A It is a network environment diagram for distributed machine learning using random secure averaging according to an embodiment of the present disclosure.

[0084] Figure 3B is a block diagram of various exemplary components of a client device according to an embodiment of the present disclosure.

[0085] Figure 3C is a block diagram of various exemplary components of a central server according to an embodiment of the present disclosure.

[0086] Figure 4 A network environment diagram describing distributed machine learning using random secure averaging according to another embodiment of the present disclosure.

[0087] Figure 5 An exemplary implementation scenario of distributed machine learning according to an embodiment of the present disclosure is shown.

[0088] In the drawings, an underlined number is used to indicate the item in which the underlined number is located or an item adjacent to the underlined number. A non-underlined number refers to the item identified by the line connecting the non-underlined number to the item. When a number is not underlined and has an associated arrow, the non-underlined number is used to identify the general item to which the arrow points. DETAILED DESCRIPTION

[0089] The following detailed description describes embodiments of the present disclosure and ways in which these embodiments can be implemented. Although some modes of implementing the present disclosure have been disclosed, those skilled in the art will recognize that there may be other embodiments for implementing or practicing the present disclosure.

[0090] Figure 1 is a flow chart of a method for distributed machine learning for a network according to an embodiment of the present disclosure. Figure 1 , a method 100 for distributed machine learning for a network is shown. The method 100 includes steps 102, 104, 106, 108, 110, 112, and 114. In one implementation, the method 100 is performed by a client device, for example, Figure 3A and Figure 3B Described in detail in.

[0091] In step 102 , the method 100 includes: a processor of the client device receives a local model update vector. The processor of the client device updates the local model update vector by using local data or original data of the client device.

[0092] In step 104, method 100 further includes: the processor generates a public key and a secret key, wherein the public key is used to broadcast to multiple other client devices on the network. The generated public key and the secret key (or private key) of the client device are used to perform key negotiation with another client device.

[0093] In step 106, method 100 also includes the processor receiving the external public key of each other client device. The processor of the client device performs key negotiation with multiple other client devices on the network and generates a key pair based on the received external public keys. The key negotiation is performed by using a key agreement scheme, such as elliptic-curve-diffie-hellman (ECDH), which supports two client devices to establish a shared key over an insecure channel, each client device having an elliptic curve external public key-key pair (also called a shared key). For example, s u,vis a shared secret between two clients (e.g., client u and client v). The shared secret is obtained by applying a secure key derivation function (e.g., a hash-based key derivation function (HKDF)) to an elliptic curve external public key-secret pair (or shared secret).

[0094] In step 108, the method 100 further includes, for each other client device: generating a pseudo-random number based on the secret key and the external public key. An elliptic curve external public key-key pair based on the secret key and the external public key is used to generate a pseudo-random number for each other client device. Shared key s u,v Used as a seed for a pseudo-random number generator that is secure and deterministic. For example, is a sequence of random numbers generated by the client for (u,v).

[0095] In step 110, the method 100 further includes, for each other client device: determining whether to assign each other client device to a neighbor device set of the client device based on the pseudo-random number and the predefined neighbor probability parameter. For example, for each other client device (i.e., client v), the client device (i.e., client u) generates a pseudo-random number, such as At least 128 bits. The neighbor device set of the client device (i.e., client u) is:

[0096]

[0097] Where: p is the predefined neighbor probability parameter for each other client device, and d is the bit size of the generated pseudo-random number.

[0098] In step 112, the method 100 further includes: the processor generating a model update output based on the neighbor device set according to a security and protocol. The security and protocol is used to generate the model update output by using an additive key sharing scheme or a one-time-pad (OTP) based scheme.

[0099] In step 114, method 100 further includes: the processor outputting a model update output for sending the model update output to the central server to be incorporated into the global model update. The processor of the client device sends the locally trained model update output to the central server to finalize the global model update that is further shared with each client device.

[0100] According to an embodiment, the neighbor probability parameter is used to define the number of neighbor devices in the neighbor device set based on a predefined value, wherein the predefined value is defined based on the modeled risk of a successful attack. For N rounds of training, the predefined value based on the modeled risk of a successful attack is represented as rtot The predefined value calculated for each training round is So that 1-(1-r) N =r tot . The modeled risk of a successful attack is also referred to as a risk parameter α, such that α∈[0,1]. The risk parameter α represents the probability that the privacy of at least one client is not protected by the central server. The risk parameter α can be calculated for each round of training or for N rounds of training (or the entire training). In one example, if α=0.01 for each round, then for each round of training, there is a 1% chance that the privacy of at least one client is not protected with respect to the central server. In another example, if α=0.1 for 100 (i.e., N=100) rounds of training, there is a 10% chance that the privacy of at least one client is not protected at some point during training. The risk parameter α can be selected based on business needs. A higher privacy risk will translate into better computational performance. Typically, the risk parameter α is selected to be of the same order of magnitude as the standard δ parameter used in traditional differential privacy techniques.

[0101] According to an embodiment, for a neighbor probability parameter p and a predefined value r:

[0102] f(n h ,p)>1-r, and for accuracy δ, f(n h ,p-δ)<1-r

[0103] in:

[0104]

[0105] in:

[0106]

[0107] f(n h ,p) is n h The probability of a random graph connection on vertices. Method 100 includes an active security model and a passive security model. The active security model provides privacy protection in the case where a malicious server attempts to recover the client's updates by modifying messages sent by multiple clients. The active security model provides security suitable for highly confidential data (such as medical data or financial data). In addition, the active security model also provides protection against very powerful (such as national or state level) attackers or internal attackers. The passive security model provides privacy protection in the case of an honest but curious server, in which case the attacker attempts to recover the client's updates by eavesdropping on the conversation between the client number and the traditional server. The passive security model provides security suitable for, for example, personal data. Additionally, the passive security model provides protection against data leaks, remote hacking, and regulatory compliance.

[0108] According to an embodiment, generating a model update output according to security and protocol includes: generating a one-time password for each neighbor device, and adding multiple one-time passwords to a local model update vector, wherein the one-time password of each neighbor device is generated based on a shared key derived from a key of a client device and an external public key of a neighbor device. Generally, in cryptography, a one-time password is an encryption technique that uses a key of a client device and an external public key of a neighbor device to encrypt a shared key. For example, for each other client device (i.e., client v), the client device (i.e., client u) generates a pseudo-random number sequence by using the generated A one-time password (OTP) is generated such that two neighbor devices use the same OTP. Thereafter, multiple one-time passwords (i.e., encryption keys) generated for multiple other client devices are added to the local model update vector. Thus, a sum is obtained for the (unencrypted) keys for each client device. According to an embodiment, the number of neighbors for each client is significantly reduced by the neighbor selection algorithm described above, which reduces the cost associated with the aggregation step on the client device.

[0109] According to an embodiment, the set of all one-time pads generated by the plurality of client devices substantially sums to zero. The generated OTPs of each pair of neighbors cancel each other out, and thus, the sum of the set of all one-time pads generated by the plurality of client devices equals zero.

[0110] Alternatively, according to an embodiment, generating a model update output according to a security and protocol includes splitting a local model vector update into a plurality of parts according to the number of neighbor devices, sending the plurality of parts to the corresponding neighbor devices, receiving an external part from the neighbor device, and adding the plurality of external parts to form a model update output. The security and protocol is used to generate the model update output by using an additive key sharing scheme (e.g., Shamir Secret Sharing (SSS)). In the additive key sharing scheme, the local model update vector is quantized and treated as a vector of fixed-length integers. The client device splits each integer into a plurality of parts, one part for each neighbor device. The plurality of parts are sent to the corresponding neighbor devices. Thereafter, the external part is received from the neighbor device and the external part is added to form the model update output.

[0111] According to an embodiment, generating the model update output includes adding a locally generated noise signal to the local model update vector, the distribution of the locally generated noise signal being Gaussian or binomial. The locally generated noise signal has a Gaussian distribution or a binomial distribution. The binomial distribution is generally preferred, particularly for small word sizes.

[0112] According to an embodiment, the locally generated noise signals are generated with a standard deviation defined by noise parameters received from a central server, wherein the noise parameters for each client device are such that a corresponding set of locally generated noise signals from a plurality of client devices sums to a global noise having a predetermined standard deviation. The corresponding set of locally generated noise signals from a plurality of client devices, when summed with the global noise, has a binomial distribution and a predetermined standard deviation (σ).

[0113] According to an embodiment, method 100 also includes converting the local model update vector from a vector of floating point values ​​to an integer vector. Through a quantization process, the local model update vector is converted from a vector of floating point values ​​to an integer (or modulus) vector. During the quantization process, an unbiased, space-efficient algorithm is used. For example, bounds are required for individual model parameters to support efficient mapping to integer space. These bounds can be provided directly by the central server or inferred from differential privacy (DP) specific parameters (e.g., model update cutoff bound S). When summing weighted updates from multiple other client devices, quantization must take into account the risk of overflow. Specifically, multiple other client devices must know the sum of weights to be used during this iteration.

[0114] According to an embodiment, method 100 also includes sending a public key to a central server and receiving an external public key from the central server. The public key generated by the processor of the client device is transmitted to the central server. The processor of the client device is used to receive the external public key of each other client device from the central server.

[0115] According to an embodiment, a computer readable medium is provided for storing instructions, which when executed, cause a processor of a client device to perform the method 100. The processor of the client device is configured to perform the method 100.

[0116] Steps 102, 104, 106, 108, 110, 112, and 114 are merely illustrative, and other alternatives may be provided in which one or more steps are added, one or more steps are deleted, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0117] Figure 2 is a flow chart of a method for distributed machine learning for a network according to another embodiment of the present disclosure. Figure 1 Component Description Figure 2 . refer to Figure 2 , a method 200 for distributed machine learning for a network is shown. The method 200 includes steps 202, 204, 206, and 208. In one implementation, the method 200 is performed by a central server, for example, Figure 3A and Figure 3C Described in detail in.

[0118] In step 202, method 200 includes a central server receiving a plurality of model update outputs sent by a plurality of client devices. The central server receives a plurality of model update outputs corresponding to the plurality of client devices. Each of the plurality of client devices generates one of the plurality of model update outputs by training its corresponding local model update vector.

[0119] In step 204, the method 200 further includes: the central server determines a sum of model updates based on the multiple model update outputs. The central server obtains a vector representing the sum of model updates based on the multiple model update outputs.

[0120] In step 206, method 200 further includes the central server updating the global model based on the sum of the model updates. The central server determines a global model update to share with each of the plurality of client devices based on the sum of the model updates.

[0121] In step 208, method 200 further includes the central server sending the global model update to each client device. The central server sends the global model update to each client device for the next iteration.

[0122] According to an embodiment, updating the global model includes converting the integer vector to a floating point vector. The global model is updated by converting from the integer (modulus) vector to the floating point vector through a dequantization process. The conversion from the integer (modulus) vector to the floating point vector produces a sum of noise model updates. If the client device has been disconnected during this process, the central server takes into account the lost noise when performing the dequantization process.

[0123] According to an embodiment, the method further includes the central server determining that the client device has been disconnected. The method further includes the central server adding additional noise to the sum of the model updates based on a predetermined variance value of the local noise added to the sum of the model updates. In one case, the central server is configured to perform noise compensation when one or more of the plurality of client devices have been disconnected during execution of a randomized secure averaging (RdSA) protocol. The central server is configured to add additional noise to the sum of the model updates based on a predetermined variance value of the local noise added to the sum of the model updates, such as in Figure 3A Described in detail in.

[0124] According to an embodiment, the method also includes executing a client disconnection recovery protocol, including: a central server receives multiple key parts from multiple client devices, representing a key set of each client device, the key set is split into multiple key parts according to a key sharing protocol, distributed in the client devices, and sent by each client device to the central server. The method also includes the central server determining that the client device has been disconnected. The method also includes the central server combining the multiple key parts corresponding to the disconnected client received to recover the key corresponding to the disconnected client. The central server combines the multiple key parts corresponding to the disconnected client received to derive a value of random noise added to the sum of model updates. The addition of the value of the random noise is used to compensate for the noise lost in the sum of model updates caused by the disconnected client. For example, in Figure 3A Described in detail in .

[0125] According to an embodiment, a computer readable medium is used to store instructions, which, when executed, cause a central server processor to perform method 200. The processor of the central server is used to perform method 200.

[0126] Steps 202, 204, 206, and 208 are merely illustrative, and other alternatives may be provided in which one or more steps are added, one or more steps are deleted, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0127] Figure 3A FIG. 1 is a network environment diagram for describing distributed machine learning using a random secure averaging protocol according to an embodiment of the present disclosure. Figure 1 and Figure 2 Component Description Figure 3A . refer to Figure 3A , shows a system 300A including multiple client devices 302, a central server 304, and a network 306. Multiple client devices 302 include client device 302A and other client devices 302B-302N. System 300A describes an exemplary sequence of operations 308A, 308B, 308C, 308D, 308E, and 308F performed by client device 302A.

[0128] Each of the plurality of client devices 302 may include suitable logic, circuitry, interfaces, and / or code for communicating with the central server 304 via the network 306. Each of the plurality of client devices 302 may also be configured to train a local model update vector and calculate a model update output. Examples of the plurality of client devices 302 may include, but are not limited to, a user device, a laptop, a computing device, a communication device including a portable or non-portable electronic device, or a supercomputer. For example, in Figure 3B Various exemplary components of client device 302A are described in detail in .

[0129] The central server 304 includes appropriate logic, circuitry, interfaces, or code for communicating with multiple client devices 302 via a network 306. The central server 304 is also used to determine global model updates that are further shared with each of the multiple client devices 302 for the next iteration. Examples of the central server 304 include, but are not limited to, storage servers, cloud servers, web servers, application servers, or combinations thereof. According to an embodiment, the central server 304 includes a physical or virtual computing entity device that is capable of enhancing information to perform various computing tasks. In one example, the central server 304 may be a single hardware server. In another example, the central server 304 may be multiple hardware servers running in a parallel or distributed architecture. In one implementation, the central server 304 may include components such as a memory, a processor, a network interface, etc. to store, process, or share information with multiple client devices 302. In another implementation, the central server 304 is implemented as a computer program that provides various services (e.g., database services) to multiple client devices 302 or modules or devices. For example, in Figure 3C Various exemplary components of the central server 304 are described in detail in .

[0130] The network 306 includes a medium (e.g., a communication channel) through which multiple client devices 302 communicate with the central server 304, and vice versa. The network 306 can be a wired or wireless communication network. Examples of the network 306 can include, but are not limited to, a wireless fidelity (Wireless Fidelity, Wi-Fi) network, a local area network (Local Area Network, LAN), a wireless personal area network (Wireless personal area network, WPAN), a wireless local area network (Wireless Local Area Network, WLAN), a wireless wide area network (Wireless wide area network, WWAN), a cloud network, a long term evolution (Long Term Evolution, LTE) network, a metropolitan area network (Metropolitan Area Network, MAN), or the Internet. Multiple client devices 302 and the central server 304 may be used to connect to the network 306 according to various wired and wireless communication protocols. Examples of such wired and wireless communication protocols may include, but are not limited to, Transmission Control Protocol and Internet Protocol (TCP / IP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), ZigBee, EDGE, infrared (IR), IEEE 802.11, 802.16, Long Term Evolution (LTE), Light Fidelity (Li-Fi) or other cellular communication protocols or Bluetooth (BT) communication protocol, including variations thereof.

[0131] In operation, the client device 302A among the plurality of client devices 302 performs local training in a series of operations. In operation 308A, the client device 302A is used to generate a local model update vector. The client device 302A updates the local model update vector by using the local data.

[0132] In operation 308B, the client device 302A is further configured to generate a public key and a secret key. The client device 302A generates a public key and a secret key (or a private key) to perform key negotiation with other client devices 302B-302N.

[0133] In operation 308C, the client device 302A is further used to broadcast the public key to other client devices 302B-302N on the network 306, receive the external public key of each other client device 302B-302N, and send the model update output to the central server 304 to be merged into the global model update 312. The client device 302A is used to broadcast the generated public key to other client devices 302B-302N on the network 306. In one case, the client device 302A cannot communicate directly with the other client devices 302B-302N. In this case, the generated public key is broadcast to the other client devices 302B-302N through the central server 304. In another case of an active security model (or malicious server), a trusted third party is used to initially establish a key agreement between each of the clients 302. Thereafter, the client device 302A is further used to receive the external public key of each other client device 302B-302N to generate a key pair based on the received external public key and the generated key. Key agreement is performed using the Elliptic Curve Diffie-Hellman (ECDH) key agreement scheme, which enables two client devices to establish a shared key over an insecure channel, each with an elliptic curve external public-secret key pair (also called a shared secret).

[0134] In operation 308D, client device 302A is further used to generate a pseudo-random number for each other client device 302B-302N based on the secret key and the external public key. Two client devices that establish a shared secret key create the same pseudo-random number to indicate that the two clients are neighbors of each other.

[0135] In operation 308E, the client device 302A is further configured to determine whether to assign each of the other client devices 302B-302N to the neighbor device set of the client device 302A based on the pseudo-random number and the predefined neighbor probability parameter. The neighbor device set of the client device 302A is:

[0136]

[0137] Where: p is a predefined neighbor probability parameter for each of the other client devices 302B-302N, and d is the bit size of the generated pseudo-random number.

[0138] In operation 308F, the client device 302A is further configured to generate a model update output based on the set of neighbor devices according to the security and protocol 310. The client device 302A generates the model update by applying the security and protocol 310 to the set of neighbor devices. The security and protocol 310 is applied through an additive key sharing scheme or a one-time password (OTP) based scheme.

[0139] According to an embodiment, the neighbor probability parameter is used to define the number of neighbor devices in the neighbor device set based on a predefined value, wherein the predefined value is defined based on the modeled risk of a successful attack. The number of neighbor devices in the neighbor device set is calculated by using a neighbor selection algorithm. The neighbor selection algorithm includes two phases, namely a setup phase and an online phase. In the setup phase, the calculation of the number of neighbor devices in the neighbor device set depends on the risk parameter r trained in N rounds. tot and neighbor probability parameter p, for example, in Figure 1 In the online phase, the client device 302A obtains the shared key of one of the other client devices 302B-302N. The client device 302A is used to derive k shared uniform bit b from the shared key. i , then, if ∑ i b i 2 i <p2 k , then a corresponding one of the other client devices 302B-302N is added to the neighbor list.

[0140] According to an embodiment, for a neighbor probability parameter p and a predefined value r:

[0141] f(n h ,p)>1-r, and for accuracy δ, f(n h ,p-δ)<1-r

[0142] in:

[0143]

[0144] in:

[0145]

[0146] Client device 302A displays active security model and passive security model as needed. Figure 1 The active safety model and the passive safety model have been described in detail.

[0147] According to an embodiment, the client device 302A is further configured to generate a model update output according to the security protocol 310 by generating a one-time password for each neighbor device and adding multiple one-time passwords to the local model update vector, wherein the one-time password for each neighbor device is generated based on a shared key derived from the secret key of the client device 302A and the external public key of the neighbor device. Figure 1The OTP-based scheme described in detail in

[0044] is used to apply security and protocol 310. After generating the OTP for each neighbor device, the client device 302A adds multiple one-time passwords to the local model update vector and generates a model update output.

[0148] According to an embodiment, the set of all one-time pads generated by the plurality of client devices 302 substantially sums to zero. The OTPs generated for each pair of neighbors cancel each other out, and thus, the set of all one-time pads generated by the plurality of client devices sums to zero.

[0149] Alternatively, according to an embodiment, the client device 302A is also used to generate a model update output according to the security and protocol 310 in the following manner: splitting the local model vector update into multiple parts according to the number of neighbor devices, sending the multiple parts to the corresponding neighbor devices, receiving the external part from the neighbor device, and adding the multiple external parts to form the model update output. After the neighbor selection, the security and protocol 310 is applied through an additive key sharing scheme, such as the Shamir key sharing (SSS) scheme. In the additive key sharing scheme, the local model update vector is quantized and treated as a vector of a fixed length modulus integer. The client device 302A splits each integer into multiple parts, one part for each neighbor device. The multiple parts are sent to the corresponding neighbor devices 302B-302N. Thereafter, the external part is received from the neighbor devices 302B-302N and the external part is added to form the model update output.

[0150] According to an embodiment, the client device 302A is further configured to generate a model update output by adding a locally generated noise signal to the local model update vector, the distribution of the locally generated noise signal being Gaussian or binomial. The locally generated noise signal has a Gaussian distribution or a binomial distribution. The binomial distribution is generally preferred, particularly for small font sizes.

[0151] According to an embodiment, the locally generated noise signal is generated with a standard deviation defined by noise parameters received from the central server 304, wherein the noise parameters of each client device 302A-302N are such that the corresponding differential private noise signals from the plurality of client devices 302 are aggregated into a global noise with a predetermined standard deviation. The central server 304 is used to determine the noise parameters (e.g., noise multiplier z) and the model update cutoff boundary S. The locally generated noise signal is derived from the noise multiplier by the following steps: In a first step, the standard deviation is calculated, which is added to the sum, as σ=zS. In a second step, a noise splitting strategy is selected to split the locally generated noise signal to the plurality of clients 302. The noise splitting strategy is provided with the standard deviation σ and a set of weights {w u} u, and returns the local noise set {σ u} u , so that Three different noise splitting strategies can be used, Strategy 1: Strategy 2: Strategy 3: To generate a Gaussian distributed locally generated noise signal, the local noise of client device 302A is has a normal distribution, mean 0, and variance To generate a binomial locally generated distributed noise signal, four steps are followed. These steps are: (a) Set N = 2 wordsize , (b) Setting quantization parameters (c) Settings or So that∑ u N u = N, (d) Calculate the local noise following the following binomial mechanism: As such, the corresponding set of locally generated noise signals from the plurality of client devices 302, when summed with the global noise, have a binomial distribution and a predetermined standard deviation (σ).

[0152] According to an embodiment, the client device 302A is also used to convert the local model update vector from a vector of floating point values ​​to an integer vector. Through the quantization process, the local model update vector is converted from a vector of floating point values ​​to an integer (or module) vector. In the quantization process, an unbiased, space-efficient algorithm is used. For example, the boundaries required for individual model parameters support efficient mapping to integer space. These boundaries can be provided directly or inferred from the differential privacy parameters S. The quantization process must consider the risk of overflow when summing weighted updates from multiple other client devices 302B-302N. Specifically, multiple other client devices 302B-302N must know the sum of the weights to be used during this iteration.

[0153] According to an embodiment, the client device 302A is also used to send a public key to the central server 304 and receive an external public key from the central server 304. For example, in one case, the client device 302A cannot directly communicate with multiple other client devices 302B-302N. Then, in this case, the client device 302A transmits the generated public key to the central server 304, and the central server 304 further transmits the generated public key to the multiple other client devices 302B-302N. After transmitting the generated public key to the central server 304, the client device 302A is used to receive the external public key from the central server 304.

[0154] Therefore, each of the plurality of client devices 302 trains a local model update vector and generates a model update output. Each of the plurality of client devices 302 scales the local model update vector, quantizes the local model update vector, and then adds calibration noise having a binomial distribution to the local model update vector. The calibration noise is based on the privacy requirements and the type of security model used (i.e., active security model or passive security model). Afterwards, each of the plurality of client devices 302 is assigned a risk parameter and the selected security model, and then each of the plurality of client devices 302 derives a neighbor probability parameter p by using a neighbor selection algorithm. The neighbor selection algorithm is based on the concept of connectivity of a random graph. After neighbor selection, each pair of client devices shares a key. The shared key is used to derive shared randomness. Using the neighbor probability parameter p (on the shared randomness), each pair of client devices is selected as a neighbor. Each pair of neighbors generates the same pseudo-random number and adds it to the corresponding key value (with opposite signs) to generate a model update output. Afterwards, each of the plurality of client devices 302 sends the generated model update output to the central server 304.

[0155] The central server 304 is configured to receive multiple model update outputs sent by the multiple client devices 302 and send a global model update 312 to each client device 302A-302N. The central server 304 determines the global model update 312 by using the multiple model update outputs sent by the multiple client devices 302. The central server 304 is also configured to send the global model update 312 to each client device 302A-302N for the next iteration.

[0156] The central server 304 is further configured to determine a sum of model updates based on the plurality of model update outputs, and to update the global model based on the sum of the model updates to generate a global model update 312. The central server 304 obtains a vector representing the sum of the model updates based on the plurality of model update outputs. The central server 304 determines a global model update 312 to be shared with each of the plurality of client devices 302 based on the sum of the model updates.

[0157] According to an embodiment, updating the global model includes converting the integer vector to a floating point vector. The global model is updated by converting from the integer (modulus) vector to the floating point vector through a dequantization process. The conversion from the integer (modulus) vector to the floating point vector produces a sum of noise model updates. If the client device has been disconnected during this process, the central server 304 takes into account the lost noise when performing the dequantization process.

[0158] According to an embodiment, the central server 304 is further configured to determine that a client device has been disconnected. The central server 304 is further configured to add additional noise to the sum of model updates based on a predetermined variance value of the local noise added to the sum of model updates. In one case, the central server 304 is configured to perform noise compensation in the event that one or more of the plurality of client devices 302 have been disconnected during execution of a random secure averaging (RdSA) protocol. In such a client disconnection event, the total noise in the sum of model updates is less than a desired value. Therefore, the central server 304 is configured to add additional noise to the sum of model updates based on a predetermined variance value of the local noise added to the sum of model updates. In one example, if Gaussian distributed local noise is added to the sum of model updates, the predetermined variance is in, is the set of clients whose model update outputs are included in the sum of model updates. In another example, if binomial distributed local noise is added to the sum of model updates, the predetermined variance is in, is the set of clients whose model update outputs are included in the sum of model updates. Additional noise is added to the sum of model updates according to the distribution of local noise. In one implementation, if a Gaussian distribution is used, then it will have mean 0 and standard deviation Gaussian noise (i.e., additive noise) In another implementation, if a binomial distribution is used, the binomial noise (in, ) is added to the sum of model updates.

[0159] According to an embodiment, the central server 304 is also used to perform a client offline recovery protocol, including: receiving multiple key parts from multiple client devices 302, representing a key set of each client device 302A-302N, the key set is split into multiple key parts according to a key sharing protocol, distributed in the client devices, and sent to the central server 304 by each client device 302A-302N. The central server 304 is also used to determine that the client device has been offline. The central server 304 is also used to combine the received multiple key parts corresponding to the offline client to recover the key corresponding to the offline client. In one implementation, in order to determine that the client device has been offline, the central server 304 is used to combine the received multiple key parts corresponding to the offline client to recover the key corresponding to the offline client. After the central server 304 determines that the client device has been offline, the central server 304 combines the received multiple key parts corresponding to the offline client to derive a value of random noise added to the sum of model updates. The value of the random noise added due to the offline client is deleted from the sum of model updates. In another implementation, the central server 304 is used to combine the received multiple key parts corresponding to the non-offline clients to derive the value of the local random noise added in the sum of the model updates. The value of the local random noise added due to the non-offline clients is deleted from the sum of the model updates. In this way, the central server 304 obtains the sum of the model updates of the non-offline clients.

[0160] Therefore, the central server 304 determines the global model update 312 by using the model update outputs received from the plurality of client devices 302. Thereafter, the central server 304 shares the global model update 312 with the plurality of client devices 302 in preparation for the next iteration.

[0161] System 300A is based on graph theory and the connectivity properties of random graphs. In system 300A, central server 304 learns the sum of at least n / 3 private model updates, unless the probability is equal to the risk parameter α. System 300A provides enhanced privacy protection, improved performance, and high utility for data (including personal data) of client devices. System 300A uses a combination of security and technology (or cryptographic technology) and differential privacy technology. Security and technology (or cryptographic technology) prevent central server 304 from accessing private information from any individual client. In differential privacy technology, noise is added locally (on the client side) rather than centrally (on the central server side), which provides strong privacy protection.

[0162] Figure 3B is a block diagram of various exemplary components of a client device according to an embodiment of the present disclosure. Figure 1 , Figure 2 and Figure 3AComponent Description Figure 3B . refer to Figure 3B , showing that ( Figure 3A The block diagram 300B of the client device 302A includes a processor 314, a network interface 316, a memory 318, and an input / output (I / O) component 320. The memory 318 also includes a training module 318A.

[0163] Processor 314 includes appropriate logic, circuits or interfaces for generating public and private keys. In one implementation, processor 314 is used to execute instructions stored in memory 318. In one example, processor 314 can be a general-purpose processor. Other examples of processor 314 can include, but are not limited to, microprocessors, microcontrollers, complex instruction set computing (CISC) processors, application-specific integrated circuits (ASIC) processors, reduced instruction set computing (RISC) processors, very long instruction words (VLIW) processors, central processing units (CPUs), state machines, data processing units, and other processors or control circuits. In addition, processor 314 can refer to one or more separate processors, processing devices, or processing units as part of a machine, such as client device 302A.

[0164] The network interface 316 includes suitable logic, circuitry, or interfaces for broadcasting a public key to multiple other client devices 302B-302N on the network 306, receiving an external public key from each of the other client devices 302B-302N, and sending the model update output to the central server 304 for incorporation into the global model update 312. Examples of the network interface 316 may include, but are not limited to, an antenna, a radio frequency (RF) transceiver, one or more amplifiers, a digital signal processor, or a subscriber identity module (SIM) card.

[0165] The memory 318 includes suitable logic, circuits or interfaces for storing instructions executable by the processor 314. Examples of implementations of the memory 318 may include, but are not limited to, Electrically Erasable Programmable Read-Only Memory (EEPROM), Random Access Memory (RAM), Read Only Memory (ROM), Hard Disk Drive (HDD), Flash memory, Solid-State Drive (SSD), or CPU cache memory. The memory 318 may store an operating system or other program products (including one or more operating algorithms) to operate the client device 302A.

[0166] In an exemplary implementation, the training module 318A is used to generate a local model update vector. The training module 318A corresponds to a machine learning model trained by using a local model update vector. The training module 318A is locally trained on the client device 302A. During training, the client device 302A uses a security and protocol 310, which prevents the central server 304 from observing any private information from the training module 318A. Additionally, the client device 302A adds local differential privacy (DP) noise to the training module 318A to further enhance privacy protection. After training, the client device 302A shares the locally trained model with the central server 304. Similarly, the central server 304 receives the locally trained model with respect to each of a plurality of other client devices 302B-302N. After receiving the locally trained model, the central server 304 calculates a global model update shared with each of the plurality of client devices 302. The global model update exhibits improved performance in terms of more accurate predictions or decisions, privacy protection of personal data, and lower computational costs even in the presence of a large number of client devices. In one implementation, the training module 318A (which may include one or more software modules) may be implemented as a separate circuit in the client device 302 A. Alternatively, in another implementation, the training module 318A is implemented as part of another circuit to perform various operations.

[0167] Input / output (I / O) components 320 refer to input and output components (or devices) that can receive input from a user (e.g., client device 302A) and provide output to a user (i.e., client device 302A). I / O components 320 can be communicatively coupled to processor 314. Examples of input components can include, but are not limited to, touch screens, such as touch screens of display devices, microphones, motion sensors, light sensors, dedicated hardware input units (e.g., buttons), and docking stations. Examples of output components include display devices and speakers.

[0168] In operation, the training module 318A is used to generate a local model update vector. The processor 314 is used to generate a public key and a secret key. The transceiver 316 (or network interface) is used to broadcast the public key to multiple other client devices 302B-302N on the network 306, receive the external public key of each other client device 302B-302N, and send the model update output to the central server 304 to be merged into the global model update 312. The processor 314 is also used to generate a pseudo-random number for each other client device 302B-302N based on the secret key and the external public key. The processor 314 is also used to determine whether to assign each other client device 302B-302N to the neighbor device set of the client device 302A based on the pseudo-random number and the predefined neighbor probability parameter. The processor 314 is also used to generate a model update output based on the neighbor device set according to security and protocol. In one implementation, the processor 314 is further used to generate a model update output according to security and protocol by generating a one-time password for each neighbor device and adding multiple one-time passwords to a local model update vector, wherein the one-time password for each neighbor device is generated based on a shared key derived from a key of the client device 302A and an external public key of the neighbor device. The set of all one-time passwords generated by multiple client devices 302 substantially sums to zero. In another implementation, the processor 314 is further used to generate a model update output according to security and protocol by splitting the local model vector update into multiple parts according to the number of neighbor devices, sending the multiple parts to the corresponding neighbor devices, receiving an external part from the neighbor device, and adding the multiple external parts to form a model update output. According to an embodiment, the processor 314 is also used to generate a model update output by adding a locally generated noise signal to the local model update vector, wherein the distribution of the locally generated noise signal is Gaussian or binomial. The processor 314 is also used to convert the local model update vector from a vector of floating point values ​​to an integer vector. Figure 1 The various embodiments, operations, and variations disclosed in method 100 are applicable to client device 302A and processor 314.

[0169] Figure 3Cis a block diagram of various exemplary components of a central server according to an embodiment of the present disclosure. Figure 1 , Figure 2 , Figure 3A and Figure 3B Component Description Figure 3C . refer to Figure 3C , showing that ( Figure 3A Block diagram 300C of the central server 304 includes a processor 322, a network interface 324 and a memory 326.

[0170] The processor 322 includes appropriate logic, circuits, or interfaces for performing the following operations: determining the sum of model updates based on multiple model update outputs, and updating the global model based on the sum of model updates to generate global model updates. In one implementation, the processor 322 is used to execute instructions stored in the memory 326. In one example, the processor 322 can be a general-purpose processor. Other examples of the processor 322 can include, but are not limited to, a microprocessor, a microcontroller, a complex instruction set computing (CISC) processor, an application-specific integrated circuit (ASIC) processor, a reduced instruction set (RISC) processor, a very long instruction word (VLIW) processor, a central processing unit (CPU), a state machine, a data processing unit, and other processors or control circuits. In addition, the processor 322 can refer to one or more separate processors, processing devices, or processing units as part of a machine, such as a central server 304.

[0171] The network interface 324 comprises suitable logic, circuitry, or interfaces for receiving the plurality of model update outputs sent by the plurality of client devices 302 and sending the global model update 312 to each of the client devices 302A-302N. Examples of the network interface 324 may include, but are not limited to, an antenna, a radio frequency (RF) transceiver, one or more amplifiers, a digital signal processor, or a subscriber identity module (SIM) card.

[0172] The memory 326 includes suitable logic, circuits or interfaces for storing instructions executable by the processor 322. Examples of implementations of the memory 326 may include, but are not limited to, electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), read-only memory (ROM), hard disk drive (HDD), flash memory, solid state drive (SSD), or CPU cache memory. The memory 326 may store an operating system or other program products (including one or more operating algorithms) to operate the central server 304.

[0173] In operation, the transceiver 324 (or network interface) is used to receive multiple model update outputs sent by multiple client devices 302 and send a global model update 312 to each client device 302A-302N. The processor 322 is used to determine the sum of model updates based on the multiple model update outputs and update the global model based on the sum of model updates to generate a global model update 312.

[0174] According to an embodiment, the processor 322 is further configured to determine that the client device has been disconnected, and to add additional noise to the sum of the model updates based on a predetermined variance value of the local noise added to the sum of the model updates. The central server 304 is further configured to execute a client disconnection recovery protocol, including: the transceiver 324 receives a plurality of key parts from a plurality of client devices 302, representing a key set of each client device 302, the key set being split into a plurality of key parts according to a key sharing protocol, distributed in the client devices, and sent to the central server 304 by each client device 302. The central server 304 is further configured to execute a client disconnection recovery protocol, including: the processor 322 determines that the client device has been disconnected, and the processor 322 combines the received plurality of key parts corresponding to the disconnected client to recover the key corresponding to the disconnected client. Figure 2 The various embodiments, operations, and variations disclosed in method 200 are applicable to central server 304 and processor 322 mutatis mutandis.

[0175] Figure 4 FIG. 1 is a network environment diagram for distributed machine learning using random security averaging according to another embodiment of the present disclosure. Figure 1 , Figure 2 , Figure 3A , Figure 3B and Figure 3C Component Description Figure 4 . refer to Figure 4 , a system 400 is shown that describes in more detail an implementation of distributed machine learning using random security average (RdSA). System 400 describes an exemplary sequence of operations 402, 402A, 402B, 402C, 402D, 402E, 402F, 402G, 402H, and 402I performed by client device 302A. An exemplary sequence of operations 404A, 404B, 404C, 404D, 404E, 404F, and 406 performed by central server 304 is also shown.

[0176] System 400 includes Figure 3AA plurality of client devices 302 and a central server 304. The client-side distributed learning or the client-side random security average is explained about the client device 302A and the plurality of other client devices 302B-302N. Similarly, the central server-side distributed learning or the central server-side random security average is explained about the central server 304.

[0177] In operation, client device 302A among the plurality of client devices 302 performs local training of the global model in a series of operations. The global model is shared by central server 304 with each of the plurality of client devices 302. In addition, central server 304 selects values ​​for standard distributed learning parameters, such as the number of local round-robin cycles, the learning rate, or the total number of iterations N. Central server 304 shares the selected standard distributed learning parameters with the plurality of client devices 302.

[0178] In operation 402 , the client device 302A starts local training of a local model update vector by using local data or raw data.

[0179] In operation 402A, the client device 302A performs selection on the parameters shared by the central server 304. The selected parameters are used for local training of the local model update vector.

[0180] In operation 402B, client device 302A is also used to generate public and secret keys. Client device 302A generates public and secret keys (or private keys) to perform key negotiation with other client devices 302B-302N. In one case, client device 302A cannot directly communicate with multiple other client devices 302B-302N. In this case, client device 302A transmits the generated public key to central server 304. Central server 304 shares the generated public key with each of multiple client devices 302. Therefore, in return, each client device 302 receives an external public key from central server 304.

[0181] In operation 402C, the client device 302A is further used to generate a key pair based on the generated key and the received external public key. The generated key pair is used to perform key negotiation with multiple other client devices 302B-302N. The key negotiation is performed by using an elliptic curve-Diffie-Hellman (ECDH) key agreement scheme, which supports two client devices to establish a shared key over an insecure channel, each client device having an elliptic curve external public key-key pair (also called a shared key).

[0182] In operation 402D, the client device 302A is further configured to select its neighbors by using a neighbor selection algorithm, e.g. Figure 1 and Figure 3AThe two client devices that establish a shared key create the same pseudo-random number to indicate that the two clients are neighbors of each other.

[0183] In operation 402E, key sharing is performed to split the private key of the client device 302A. Two private keys of the client device 302A are split in operation 402E, such as the key of the client device 302A, from which a shared key is derived for generating a one-time pad for each neighbor device, and a personal seed of the client device 302A for adding random noise in further operations.

[0184] In operation 402F, the client device 302A is further configured to add a locally generated differentially private (DP) noise signal to the local model update vector, wherein the distribution of the locally generated DP noise signal is Gaussian or binomial. The locally generated noise signal has a Gaussian distribution or a binomial distribution. The noise parameters are selected by the central server 304 and shared with each of the plurality of client devices 302 for generating the DP noise signal.

[0185] In operation 402G, after adding the locally generated differentially private (DP) noise signal to the local model update vector, the client device 302A is further configured to perform a quantization process. In the quantization process, the local model update vector is converted from a vector of floating point values ​​to an integer (or modulus) vector.

[0186] In operation 402H, the client device 302A is further configured to apply security and protocol 310 by generating a one-time password for each neighbor device and adding the generated one-time password to the quantization model update vector. The one-time password of each neighbor device is generated based on a shared key derived from the secret key of the client device 302A and the external public key of the neighbor device. In addition, the client device 302A is further configured to calculate local random noise based on its personal seed and add the calculated local random noise to the quantization model update vector.

[0187] In operation 402I, the client device 302A is used to transmit a portion of each other client to the central server 304. In one example, if another client device is offline during the execution of the RdSA protocol, the client device 302A is used to transmit the portion of the key of the other client device to the central server 304 to derive the shared OTP of the other client device. In another example, if the other client device is offline during the execution of the RdSA protocol, the client device 302A is used to transmit the portion of the personal seed of the other client device to the central server 304 to derive the local random noise of multiple other client devices 302B-302N.

[0188] Operations 402A to 402G are necessary to perform client-side random security averaging. For each of the plurality of client devices 302, operations 402A to 402I are performed in the same order. By performing operations from 402A, 402B, 402C, 402D, 402E, 402F, and 402G, each of the plurality of client devices 302 is used to determine a plurality of model update outputs after training the local model update vectors, respectively. Each of the plurality of client devices 302 shares the plurality of model update outputs with the central server 304.

[0189] Similarly, the central server 304 is operable to perform a series of operations to determine a global model update 406. In operation 404A, the central server 304 is operable to broadcast the generated public key of the client device 302A to a plurality of other client devices 302B-302N.

[0190] In operation 404B, the central server 304 is operable to distribute the portions of the client device 302A to a plurality of other client devices 302B-302N.

[0191] In operation 404C, the central server 304 is used to receive multiple model update outputs sent by multiple client devices 302. The central server 304 is also used to determine the sum of model updates based on the multiple model update outputs. The central server 304 obtains a vector representing the sum of model updates based on the multiple model update outputs. The central server 304 determines a global model update 406 shared with each of the multiple client devices 302 based on the sum of model updates.

[0192] In operation 404D, the central server 304 is used to perform offline recovery. For example, Figure 3A The two methods of offline recovery have been described in detail.

[0193] In operation 404E, the central server 304 is used to perform a dequantization process to convert the integer vector into a floating point vector. The conversion from the integer (modulus) vector to the floating point vector generates a sum of noise model updates.

[0194] In operation 404F, the central server 304 is used to compensate for differential privacy noise in the event that one or more client devices are offline during the execution of the RdSA protocol. The central server 304 is also used to add additional noise to the sum of model updates based on a predetermined variance value of the local noise added to the sum of model updates.

[0195] After performing the operations from 404A, 404B, 404C, 404D, 404E, and 404F, the central server 304 determines a global model update 406. The global model update 406 is transmitted to each of the plurality of client devices 302 in preparation for the next iteration. The order of operations of 404A, 404B, 404C, 404D, 404E, and 404F indicates a central server-side random security average (RdSA).

[0196] Figure 5 An exemplary implementation scenario of distributed machine learning according to an embodiment of the present disclosure is shown. Figure 1 , Figure 2 , Figure 3A , Figure 3B , Figure 3C and Figure 4 Component Description Figure 5 . refer to Figure 5 , a system 500 including multiple client devices 502, a central server 504, and a network 506 is shown. Multiple client devices 502 include client device 502A and other client devices 502B-502N. Client device 502A uses a video recommendation tool 508A (e.g., a machine learning model). Similarly, other client devices 502B-502N use video recommendation tools 508B-508N.

[0197] The plurality of client devices 502, the central server 504 and the network 506 correspond to Figure 3A Multiple client devices 302, a central server 304 and a network 306.

[0198] Client device 502A uses video recommendation tool 508A, which uses a predictive model. Video recommendation tool 508A is locally trained on client device 502A because system 500 uses distributed machine learning using random security average (RdSA) protocol. Similarly, other client devices 502B-502N locally train their corresponding video recommendation tools 508B-508N. Each of multiple client devices 502 shares its corresponding locally trained video recommendation tool with central server 504. Thereafter, RdSA protocol is used to calculate private global model updates for N (hundreds to thousands) client devices at central server 504. Private global model updates calculated at central server 504 are shared with each of multiple client devices 502, and multiple client devices 502 benefit from the improved accuracy and privacy protection of the video recommendation tool.

[0199] In another implementation scenario, the plurality of client devices 502 may correspond to a plurality of computing devices used by a hospital or laboratory. For example, client device 502A corresponds to a computing device used by a hospital, client device 502B corresponds to another computing device used by a laboratory or organization, and so on. Each of the plurality of client devices 502 uses a training model trained from an image and annotations manually provided by a doctor, which are used to detect diseases using medical images. In many jurisdictions, such medical image models cannot be shared between different hospitals or laboratories. Therefore, local training of such models is performed on corresponding computing devices used by the hospital, laboratory, or organization. After local training, each of the plurality of computing devices used in the hospital or laboratory or organization shares its locally trained model with the central server 504. In this exemplary scenario, the central server 504 can calculate global model updates by using the RdSA protocol and share the calculated global model updates with each of the plurality of computing devices used in the hospital, laboratory, or organization, which is accurately detecting diseases while maintaining improved privacy and personal data protection (formal guarantees of strong data privacy protection can be provided) and avoiding expansion problems.

[0200] The embodiments of the present disclosure described above may be modified without departing from the scope of the present disclosure as defined by the appended claims. Expressions such as "including", "combined with", "having", "is", etc. used to describe and claim the present disclosure are intended to be interpreted in a non-exclusive manner, that is, support for the existence of items, components or elements that are not explicitly described. References to the singular should also be interpreted as being related to the plural. The word "exemplary" used herein means "as an example, instance or illustration". Any embodiment described as "exemplary" is not necessarily interpreted as being more preferred or more advantageous than other embodiments, and / or excluding the combination of features of other embodiments. The word "optionally" used herein means "provided in some embodiments and not provided in other embodiments". It should be understood that some features of the present disclosure described in the context of a separate embodiment for the sake of clarity may also be provided in combination in a single embodiment. On the contrary, the various features of the present disclosure described in the context of a single embodiment for the sake of brevity may also be provided separately, in any appropriate combination, or suitable for any other described embodiment of the present disclosure.

Claims

1. A method (100) for distributed machine learning in a network (306), characterized in that include: A processor (314) of the client device (302A) receives a local model update vector; The processor (314) generates a public key and a secret key, wherein the public key is used to broadcast to a plurality of other client devices (302B-302N) on the network (306); The processor (314) receives an external public key of each of the other client devices (302B-302N); For each additional client device (302B-302N): generating a pseudo-random number based on the secret key and the external public key; determining whether to assign each of the other client devices (302B-302N) to a neighbor device set of the client device (302A) based on the pseudo-random number and a predefined neighbor probability parameter; The processor (314) generates a model update output based on the set of neighbor devices and in accordance with security and protocol (310); The processor (314) outputs the model update output for sending the model update output to the central server (304) to be incorporated into the global model update (312).

2. The method (100) according to claim 1, characterized in that: The neighbor probability parameter is used to define the number of neighbor devices in the neighbor device set based on a predefined value, wherein the predefined value is defined based on a modeled risk of a successful attack.

3. The method (100) according to claim 2, characterized in that: For a neighbor probability parameter p and a predefined value r: μ(n h ,p)>1-r, and for accuracy δ, f(n h ,p-δ)<1-r in: in: n is the number of the neighbor devices in the neighbor device set.

4. The method (100) according to any one of claims 1 to 3, characterized in that: Generating the model update output according to the security and protocol (310) includes: generating a one-time password for each neighbor device and adding multiple one-time passwords to the local model update vector, wherein the one-time password for each neighbor device is generated based on a shared key derived from the key of the client device and the external public key of the neighbor device.

5. The method (100) according to claim 4, characterized in that: The set of all one-time pads generated by the plurality of client devices (302) substantially sums to zero.

6. The method (100) according to claim 2 or 3, characterized in that: Generating the model update output according to the security and protocol (310) includes: splitting the local model vector update into multiple parts according to the number of the neighbor devices, sending the multiple parts to corresponding neighbor devices, receiving multiple external parts from the neighbor devices, and adding the multiple external parts to form the model update output.

7. The method (100) according to any one of claims 1 to 3, characterized in that Generating the model update output includes adding a locally generated noise signal to the local model update vector, the distribution of the locally generated noise signal being Gaussian or binomial.

8. The method (100) according to claim 7, characterized in that: The locally generated noise signals are generated with a standard deviation defined by noise parameters received from the central server (304), wherein the noise parameters for each client device (302A-302N) are such that the corresponding locally generated noise signals from the plurality of client devices (302) are aggregated into a global noise having a predetermined standard deviation.

9. The method (100) according to any one of claims 1 to 3, characterized in that: Also includes: The local model update vector is converted from a vector of floating point values ​​to a vector of integers.

10. The method (100) according to any one of claims 1 to 3, characterized in that: Also includes: The public key is sent to the central server (304), and the external public key is received from the central server (304).

11. A computer readable medium, characterized in that Used to store instructions, which, when executed, cause a client device processor (314) to perform the method (100) of any one of claims 1 to 10.

12. A client device (302A), characterized in that: include: A training module (318A) for generating a local model update vector; A processor (314) for generating a public key and a secret key; a transceiver (316) for broadcasting the public key to a plurality of other client devices (302B-302N) on the network (306), receiving the external public key of each of the other client devices (302B-302N), and sending the model update output to the central server (304) for incorporation into the global model update (312); Wherein, the processor (314) is further configured to: generating a pseudo-random number for each other client device (302B-302N) based on the secret key and the external public key; determining whether to assign each of the other client devices (302B-302N) to a neighbor device set of the client device (302A) based on the pseudo-random number and a predefined neighbor probability parameter; Based on the set of neighbor devices, the model update output is generated according to security and protocol (310).

13. The client device (302A) according to claim 12, characterized in that The neighbor probability parameter is used to define the number of neighbor devices in the neighbor device set based on a predefined value, wherein the predefined value is defined based on a modeled risk of a successful attack.

14. The client device (302A) according to claim 13, characterized in that For a neighbor probability parameter p and a predefined value r: f(n h ,p)>1-r, and for accuracy δ, f(n h ,p-δ)<1-r in: in: n is the number of the neighbor devices in the neighbor device set.

15. The client device (302A) according to any one of claims 12 to 14, characterized in that: The processor (314) is used to generate the model update output according to the security and protocol (310) in the following manner: generating a one-time password for each neighbor device and adding multiple one-time passwords to the local model update vector, wherein the one-time password for each neighbor device is generated based on a shared key derived from the secret key of the client device and the external public key of the neighbor device.

16. The client device (302A) according to claim 15, characterized in that The set of all one-time pads generated by the plurality of client devices (302) substantially sums to zero.

17. The client device (302A) according to claim 13 or 14, characterized in that: The processor (314) is used to generate the model update output according to the security and protocol (310) by splitting the local model vector update into multiple parts according to the number of neighbor devices, sending the multiple parts to corresponding neighbor devices, receiving external parts from the neighbor devices, and adding the multiple external parts to form the model update output.

18. The client device (302A) according to any one of claims 12 to 14, characterized in that: The processor (314) is configured to generate the model update output by adding a locally generated noise signal to the local model update vector, wherein the distribution of the locally generated noise signal is Gaussian or binomial.

19. The client device (302A) according to claim 18, characterized in that The locally generated noise signal is generated with a standard deviation defined by noise parameters received from the central server (304), wherein the noise parameters for each client device (302A-302N) are such that the corresponding differential private noise signals from the plurality of client devices (302) are aggregated into a global noise having a predetermined standard deviation.

20. The client device (302A) according to any one of claims 12 to 14, characterized in that: The processor (314) is further configured to convert the local model update vector from a vector of floating point values ​​to a vector of integers.

21. The client device (302A) according to any one of claims 12 to 14, characterized in that: The transceiver (316) is also used to send the public key to the central server (304) and receive the external public key from the central server (304).

22. A method for distributed machine learning in a network (306), characterized in that include: A processor (314) of the client device (302A) receives a local model update vector; The processor (314) generates a public key and a secret key, wherein the public key is used to broadcast to a plurality of other client devices (302B-302N) on the network (306); The processor (314) receives an external public key of each of the other client devices (302B-302N); For each additional client device (302B-302N): generating a pseudo-random number based on the secret key and the external public key; determining whether to assign each of the other client devices (302B-302N) to a neighbor device set of the client device (302A) based on the pseudo-random number and a predefined neighbor probability parameter; The processor (314) generates a model update output based on the set of neighbor devices and in accordance with security and protocol (310); The processor (314) outputs the model update output; The transceiver (316) of the client device (302A) sends the model update output to the central server (304); the central server (304) receives multiple model update outputs sent by multiple client devices (302); The central server (304) determines a sum of model updates based on the plurality of model update outputs; The central server (304) updates a global model based on the sum of the model updates; The central server (304) sends the global model update (312) to each client device (302A-302N).

23. The method according to claim 22, characterized in that Updating the global model includes converting the integer vector to a floating point vector.

24. The method according to claim 22 or 23, characterized in that Also includes: The central server (304) determines that the client device has been offline; The central server (304) adds additional noise to the sum of the model updates based on a predetermined variance value of the local noise added to the sum of the model updates.

25. The method according to claim 22 or 23, characterized in that Also includes: Execute the client offline recovery protocol, including: The central server (304) receives a plurality of key parts from the plurality of client devices (302), representing a key set for each client device (302A-302N), the key set being split into a plurality of key parts according to a key sharing protocol, distributed among the client devices, and sent by each client device (302A-302N) to the central server (304); The central server (304) determines that the client device has been offline; The central server (304) combines the received multiple key parts corresponding to the offline client to recover the key corresponding to the offline client.

26. A system (300A) for distributed machine learning in a network (306), characterized in that: include: A plurality of client devices (302) and a central server (304); The client device (302A) includes: A training module (318A) for generating a local model update vector; A processor (314) for generating a public key and a secret key; a transceiver (316) for broadcasting the public key to a plurality of other client devices (302B-302N) on the network (306), receiving an external public key from each of the other client devices (302B-302N), and sending a model update output to the central server (304); Wherein, the processor (314) is further configured to: generating a pseudo-random number for each other client device (302B-302N) based on the secret key and the external public key; determining whether to assign each of the other client devices (302B-302N) to a neighbor device set of the client device (302A) based on the pseudo-random number and a predefined neighbor probability parameter; generating the model update output based on the set of neighbor devices according to security and protocol (310); Wherein, the central server (304) comprises: a transceiver (324) for receiving a plurality of model update outputs sent by the plurality of client devices (302) and sending a global model update (312) to each client device (302A-302N); A processor (322) is configured to determine a sum of model updates based on the plurality of model update outputs, and update a global model based on the sum of the model updates to generate the global model update (312).

27. The system (300A) of claim 26, wherein: Updating the global model includes converting the integer vector to a floating point vector.

28. The system (300A) according to claim 26 or 27, characterized in that The processor (322) of the central server (304) is further configured to: Determine that the client device has been disconnected; Additional noise is added to the sum of the model updates based on a predetermined variance value of the local noise added to the sum of the model updates.

29. The system (300A) according to claim 26 or 27, characterized in that Also used to: execute the client offline recovery protocol, including: The transceiver (324) of the central server (304) receives a plurality of key parts from the plurality of client devices (302), representing a key set for each client device (302A-302N), the key set being split into a plurality of key parts according to a key sharing protocol, distributed among the client devices, and sent by each client device (302A-302N) to the central server (304); The processor (322) of the central server (304) determines that the client device has gone offline; The processor (322) of the central server (304) combines the received multiple key parts corresponding to the offline client to recover the key corresponding to the offline client.

Images