Privacy-oriented federated learning method for deep quantization

Abstract

The present application relates to the technical field of information security and privacy protection, and aims to replace the Gaussian noise exceptionally added in the differential privacy technology with quantization error, and realize privacy protection for the local client. The privacy protection-oriented deep quantization federated learning method trains the deep quantization network by using the parameters of the updated model obtained after the local data of the client k is trained in the t global iteration process, then quantizes the updated model by using the trained deep quantization network and changes the quantization noise distribution to obtain the quantized index value, and the index value is sent to the server side after being losslessly encoded. The server side receives and decodes to obtain the aggregation update, obtains the updated global model, and distributes it to the user for the next round of federated learning iteration. The present application is mainly applied to the privacy protection communication occasion.

Description

Technical Field

[0001] This invention relates to the fields of information security and privacy protection, specifically to the quantization and privacy enhancement of federated learning. It is an algorithm for quantization in federated learning based on privacy enhancement tasks. Specifically, it involves the design of a deep quantization federated learning framework. Background Technology

[0002] With the development of communication and network technologies, the era of big data has arrived alongside the development of machine learning. Machine learning essentially involves training a machine learning model with massive amounts of data until the model converges, enabling it to predict and infer new input data. Data is ubiquitous; however, the legal acquisition and secure use of data have placed new demands on the framework and standards of machine learning. Federated learning, as a distributed machine learning paradigm, has the capability to handle intensive computation on edge devices. Compared to centralized training, federated learning only transmits the updated parts of the model to the server, rather than transmitting the original data. This improves communication efficiency, reduces network congestion, and provides a certain degree of privacy protection. Therefore, federated learning has received widespread attention due to these advantages.

[0003] Traditional centralized federated learning frameworks mainly consist of a central parameter server and multiple edge users who retain local datasets. The specific steps of the system framework are as follows:

[0004] Step 1: Model Initialization

[0005] Based on the designed training task and model structure, the server initializes itself and broadcasts the initialization model parameters to all users, who then receive the model parameters to initialize their models.

[0006] Step 2: Local Model Training

[0007] In the t-th round of global training, the server distributes the global model, and the activated users use their local datasets to train the model locally, obtain local model updates, and upload them to the server.

[0008] Step 3: Global Model Aggregation

[0009] The server aggregates the collected local models, updates the global model, and broadcasts it to the user's end for the next iteration of training.

[0010] Repeat steps 2 and 3 until the model converges.

[0011] Federated learning currently faces two main problems: large communication volume during network training and privacy leakage, which have attracted widespread attention from researchers. Quantization compression methods are commonly used to address network communication volume. For example, Konecny ​​et al. [1] extracted the model update sketch and compressed it using methods such as quantization, random rotation, and secondary sampling to reduce the communication volume between the central server and all users. Dan Alistarh et al. [2] considered using scalar quantization of the model gradient to improve the communication transmission problem in the computation of parallel stochastic gradient descent (SGD) and focused on the trade-off between communication bandwidth and convergence time. Regarding the privacy protection problem in federated learning, differential privacy is a commonly used method, which introduces noise to disturb sensitive information to protect private information. For example, reference [3] uses Local Differential Privacy (LDP) to protect user data of federated learning models based on stochastic gradient descent, and defines the query sensitivity used in LDP as a variable to achieve a trade-off between user privacy, global utility, and transmission rate. Reference [4] strengthens the protection of participant privacy by applying Local Differential Privacy (LDP) and Centralized Differential Privacy (CDP) respectively. Sparse gradient and momentum gradient descent are applied on the server and client sides to improve the accuracy performance of the model. Existing studies on communication volume and privacy protection usually consider the two as independent and unaffected components. For example, Reference [5] proposes a communication-efficient FL (Federated Learning) algorithm with LDP, which uses a Gaussian mechanism and then performs quantization and Elias-gamma encoding; Reference [6] proposes a general vector quantization method for federated learning with a local differential privacy mechanism. Artificial Gaussian noise is added to the local model update before aggregation on the client side, and then the model parameters are quantized using the vector quantization method.

[0012] [1] J.Konecny, HBMcMahan, FXYu, P.Richtárik, ATSuresh, and D.Bacon, “Federated learning:

[0013] Strategies for improving communication efficiency,” 2016.[Online].Available:arXiv:1610.05492

[0014] [2]D.Alistarh,D.Grubic,J.Li,R.Tomioka,and M.Vojnovic,“QSGD:Communication-Efficient SGD viaGradient Quantization and Encoding,”31stAnnual Conference on Neural Information Processing Systems

[0015] (NIPS),Long Beach,CA,United states,2017,vol.30,pp.1709-1720.

[0016] [3]M.Kim,O.Günlüand R.F.Schaefer,"Federated Learning with LocalDifferential Privacy:Trade-OffsBetween Privacy,Utility,and Communication,"ICASSP 2021-2021IEEE International Conference onAcoustics,Speech and SignalProcessing(ICASSP),Toronto,ON,Canada,2021,pp.2650-2654,doi:

[0017] 10.1109 / ICASSP39728.2021.9413764.

[0018] [4]S.Weng et al.,"Privacy-Preserving Federated Learning based onDifferential Privacy and MomentumGradient Descent,"2022International JointConference on Neural Networks(IJCNN),Padua,Italy,2022,pp.

[0019] 1-6,doi:10.1109 / IJCNN55064.2022.9889795.

[0020] [5] M.Kim, O.Günlüand RFSchaefer, "Effects of Quantization onFederated Learning with Local DifferentialPrivacy," GLOBECOM 2022-2022IEEEGlobal Communications Conference, Rio de Janeiro, Brazil, 2022,

[0021] pp.921-926,doi:10.1109 / GLOBECOM48099.2022.10000632.

[0022] [6]H.Zong,Q.Wang,X.Liu,Y.Li and Y.Shao,"Communication ReducingQuantization for FederatedLearning with Local Differential PrivacyMechanism,"2021IEEE / CIC International Conference onCommunications in China(ICCC),Xiamen,China,2021,pp.75-80,doi:10.1109 / ICCC52777.2021.9580315.[7]AbadiM,Chu A,Goodfellow I,et al.Deep learning with differential privacy[C] / / Proceedings of the 2016

[0023] ACM SIGSAC conference on computer and communications security.2016:308-318. Summary of the Invention

[0024] To overcome the shortcomings of existing technologies, this invention aims to replace the Gaussian noise added in differential privacy techniques with quantization error, achieving privacy protection for the local client without introducing additional noise. The invention also theoretically analyzes the privacy performance of the algorithm. To this end, the technical solution adopted by this invention is a privacy-preserving deep quantization federated learning method. In t global iterations, client k uses local data to train and obtain an updated model. The parameters are used to train the deep quantization network, which learns to determine the hyperparameters of the quantization mapping function and generates an adaptive deep scalar quantizer (DSQ). The trained deep quantization network is then used to quantize the updated model and modify the quantization noise distribution, resulting in the quantized model. The index value, the index value After lossless encoding, the index values ​​are sent to the server; the server receives the index values ​​sent by all active users. After decoding, the result is Then, an aggregation update is performed to obtain the updated global model, which is then distributed to users for the next round of federated learning iterations.

[0025] The detailed steps are as follows:

[0026] Step 1: Model Initialization

[0027] The central server initializes the model parameters to w0 and broadcasts them to all users. The system contains K users, the number of local training iterations is τ, the total number of training iterations is T, and the number of quantization levels of the deep quantization network is M.

[0028] Step 2: Local Model Training

[0029] For the t-th global model training round, the central server first distributes the aggregated model w from the previous t-1 rounds. t-1 For all activated users, the kth activated user utilizes the local dataset D k The updated model is obtained after local training τ times. The computational model was updated to

[0030] Step 3: Training the depth quantizer

[0031] Set the quantization level to M, and update the parameters using the model. The deep quantization network DSQ(.) is trained to learn the hyperparameter 'a' that determines the quantization mapping function. i b i and c i The quantization mapping function is obtained as shown in formula (1), the depth quantizer is as shown in formula (2), and the quantization interval is...

[0032]

[0033]

[0034] Step 4: Quantization and Encoding Transmission

[0035] The model update parameters are quantized using the trained deep quantization network DSQ(.), resulting in... Quantized index value Finally, the corresponding quantization index value will be... After being encoded using lossless encoding, it is sent to the central server.

[0036] Step 5: Global model aggregation update

[0037] The central server decodes the received codewords to obtain the index value, which is then mapped to obtain... And perform model aggregation according to model aggregation formula (3) and broadcast the updated global model;

[0038]

[0039] Repeat steps 2 through 5 for T iterations until the training process converges.

[0040] The steps to construct a deep quantization network are as follows:

[0041] Deep quantization networks actually use deep neural networks, which are deep neural networks containing multiple linear layers and Tanh activation functions. The quantization layer contains multiple Tanh activation functions. The overall network training goal is to make the network's input and output approximately the same, and to transform the distribution of the error between the input and output to satisfy a Gaussian distribution.

[0042] For the training part of the network, the Deep Scalar Quantizer (DSQ) is a linear deep neural network. To achieve the network's objective, two different loss functions are used. The first loss function is the Mean Squared Error (MSE) loss function, which is used to determine the quantization function of the deep quantizer and minimize the quantization error before and after quantization. The second loss function is the KL divergence loss function, which is used to transform the distribution of the quantization error to approximate a specified Gaussian distribution. The overall loss function is shown below:

[0043]

[0044] Among them, the first term min||DQ M (x)-x||2 represents minimizing the quantization error, where x is the value to be quantized, and ||.||2 represents the l2 norm operator, DQ. M (.) represents the quantization formula for the depth quantizer, as shown in equation (4). It mainly consists of the quantization mapping function q. M (.) and its hyperparameter a i b i and c i Composition; Second item To minimize the KL divergence so that the distribution function of the target quantization error is Approximates the target Gaussian distribution obtained through differential privacy analysis The KL divergence distance between them is closer, and the specific formula can be found in formula (6). The distribution is Gaussian, Δf is the sensitivity, and σ is the noise scale;

[0045] The training of the first loss function is to min||DQ. M (x)-x||2, the deep quantizer network, in addition to training the weights of the overall quantization network, has hyperparameter a of its quantization mapping function qM(.). i b i and c i It is also trained together with the quantization layer weights of the overall quantization network. At the same time, in order to achieve end-to-end training of the quantization network, the sum of hyperbolic tangents is used to replace the non-differentiable mapping process of the quantization process. Its quantization mapping function is as shown in formula (3):

[0046]

[0047] Among them, a i b i and c i , where a are all trainable real-valued parameters. i Related to the magnitude of the quantized value, b i and c i Determine the quantization interval by adjusting c. i The size of the hyperparameter can make the values ​​before and after quantization more similar. The appropriate hyperparameter is determined by training to minimize the mean square error of the values ​​before and after quantization. After training, the quantization formula is obtained as follows:

[0048]

[0049] To achieve the second training objective First, the target distribution is obtained through differential privacy analysis. Subsequently, the KL divergence loss function guides the quantization error distribution generated by the depth quantizer to approximate the target distribution, thereby achieving the goal that the quantization energy of the quantizer can make the quantization error satisfy a Gaussian distribution.

[0050] The Depth Scalar Quantizer (DSQ) is a linear deep neural network employing two different loss functions. The first loss function, Mean Squared Error (MSE), determines the quantization function of the depth quantizer and minimizes the quantization error before and after quantization. The second loss function, KL divergence loss, transforms the distribution of the quantization error to approximate a Gaussian noise distribution satisfying a specified (∈,δ)-Local Differential Privacy (LDP).

[0051] Define (∈,δ)-Local Differential Privacy LDP

[0052] If a random mechanism M satisfies (∈,δ)-Local Differential Privacy ((∈,δ)-LDP), then for any adjacent datasets D of the same size, D′∈D, and output subset y∈range(O), it satisfies the following relation:

[0053] Pr[M(D)=y]≤e ∈ Pr[M(D′)=y]+δ

[0054] Where the parameter ∈ represents the privacy budget, signifying the degree of privacy protection achieved using differential privacy techniques; a smaller value indicates a higher degree of privacy protection. δ represents the probability of violating strict differential privacy, implemented using a Gaussian mechanism (∈,δ)-LDP, defined as follows:

[0055] Define Gaussian mechanism

[0056] For any random query function f, and neighboring datasets D, D′∈D, its sensitivity Then the random algorithm R = f(D) + l can provide (∈,δ)-LDP, where Let be the probability density function of random noise, that is, random noise l follows a Gaussian distribution with mean μ = 0 and standard deviation Δfσ, where Represented as a Gaussian distribution;

[0057] To achieve differential privacy, a deep quantizer is designed so that the quantization error approximates a given Gaussian noise, replacing the addition of local Gaussian noise. Specifically, the deep quantizer DSQ(.) is used to quantize the local model update for user k. Suppose that the local model quantized using a depth quantizer is updated to a query function. The noise addition process can be represented as in Δf represents the user's sensitivity, and σ represents the standard deviation of the quantization noise. Because differential privacy is post-processing invariant, the sensitivity of the query function is essentially the update of the local model quantized using the depth quantizer. The sensitivity is equivalent to the user k local model update. The sensitivity of the local model for user k will be updated next. The sensitivity Δf was analyzed and the standard deviation σ of the quantization error was constrained.

[0058] To perform local sensitivity Δf analysis, a pruning technique is required to trim the gradients of mini-batch SGD training to ensure that the gradients are bounded. The bounding value is set to C.

[0059] Assume the gradient is bounded

[0060] Assume the gradient of the model loss function F If the l2-norm is bounded, then it holds true for any input. Both ζ∈D satisfy

[0061] For any client k in FL, with only the j-th data sample ζ j Any two distinct adjacent mini-batch datasets B k and B′ k The sensitivity of the gradient updated using SGD, which has a magnitude of γ, is calculated as follows:

[0062]

[0063] Let be the gradient of the local model loss function. The above inequality is calculated based on the vector norm triangle inequality, that is: for all We have ||x + y|| ≤ ||x|| + ||y||. Let the current global model w be... t-1 Furthermore, since the local model of user k after τ local iterations in round t is: Where s is the number of local iterations and g is the gradient of the user model as a whole; therefore, local model update The calculation is as follows: Where η is the model learning rate;

[0064] For the sensitivity Δf of each local update for user k:

[0065]

[0066] Constraints on the standard deviation σ of quantization error: To further reduce the noise scale using a Gaussian-based time-accounting MA algorithm, the standard deviation of Gaussian noise should satisfy the following equation:

[0067]

[0068] Where C is the total number of iterations, parameter ∈ is the privacy budget, and δ represents the probability of violating strict differential privacy;

[0069] To satisfy the specified (∈,σ)-LDP, the required quantization error distribution should satisfy... Where Δf should satisfy (6), σ should satisfy (7), and the target distribution is P. gt Indicate, then That is, P gt The mean is μ gt =0, mean square deviation σ gt =Δfσ, whose distribution function satisfies: Gaussian distribution;

[0070] Finally, based on the target distribution obtained from the above privacy analysis... The KL divergence loss function is used to guide the quantization error distribution generated by the depth quantizer to approximate the target distribution; the true quantization error of the depth quantizer is expressed as... and distribution function Guided by KL loss, the loss function for KL divergence is calculated as follows:

[0071]

[0072] The federated learning algorithm is the FedAvg algorithm. In FedAvg, the server first randomly selects a subset of devices as active users, then has the selected devices perform multiple SGD iterations to minimize the local loss function, and then sends their local computation results to the server. Let τ represent the number of local iterations, and t∈[0,……,T-1] represent the index of the overall communication round. At round t, a group of k local users are randomly selected to download the current globally shared model w from the server. t and in w t Perform τ local iterations, let This represents the local model of user k in the s-th local iteration. The model update process is as follows:

[0073]

[0074] It can be seen that s = 0,

[0075]

[0076] After τ local iterations, the local model is updated as follows:

[0077]

[0078] Quantization is performed using a pre-trained task-based quantization network. After encoding, the data is sent to the central server, and the global model is aggregated as follows:

[0079]

[0080] The quantization error is:

[0081]

[0082] The local data consists of images of breast tumors or lung CT scans.

[0083] The features and beneficial effects of this invention are:

[0084] This invention proposes a federated learning method based on deep scalar quantization networks, achieving federated training with enhanced privacy and high communication efficiency. A novel task-based deep quantizer is proposed to quantize parameters for updating model updates on the user side of the federated learning system while preserving local privacy. The deep quantizer can reduce quantization error by determining the quantization value and quantization range during training, and simultaneously guides the error of the quantization network to follow a Gaussian distribution through KL divergence, achieving differential privacy protection during quantization. Experimental results show that the proposed deep quantizer has minimal impact on the convergence of federated learning, achieving an accuracy of 92.04% over 200 epochs with 3-bit quantization. Figure 4 As shown, the quantization error distribution diagram of the experimental process is extracted as follows. Figure 5 As shown. Attached image description:

[0085] Figure 1 A diagram of a privacy-preserving deep quantization federated learning framework.

[0086] Figure 2 Training flowchart for a privacy-preserving deep quantization federated learning model.

[0087] Figure 3 Design of depth quantizer module.

[0088] Figure 4 Accuracy test graph of this framework when 3-bit quantization of the MNIST dataset.

[0089] Figure 5 The distribution of quantization error in this framework when quantizing the MNIST dataset with 3 bits. Detailed Implementation

[0090] Existing federated learning frameworks typically address quantization and privacy enhancement separately. After quantization and other communication-reducing processes, existing algorithms introduce additional noise to perform differential privacy protection on uploaded model updates, aiming to prevent user privacy leaks. These two operations increase quantization noise and introduce differential privacy noise into the federated learning training process, thus affecting model aggregation and reducing network training efficiency. Considering that quantization error is usually objectively present and cannot be ignored, this invention utilizes a privacy-preserving deep quantization federated learning framework to replace the Gaussian noise added in differential privacy techniques with quantization error. This achieves privacy protection for the local client without introducing additional noise. The privacy performance of the algorithm is theoretically analyzed, and finally, the algorithm's performance is verified through experiments.

[0091] This invention tests the proposed privacy-preserving deep quantization federated learning framework by implementing a binary classification task using a DNN model. The invention considers real-world federated learning scenarios, such as a lung CAD system where various medical institutions jointly learn to provide doctors with supplementary third-party opinions to determine the presence of nodules, thereby improving the accuracy of lung CT image classification. For patient data privacy, each user terminal retains local data from various medical institutions, i.e., real lung CT images of patients from different medical institutions, and only needs to upload perturbed local model updates for global model aggregation training. The overall system model framework diagram considered in this paper is as follows: Figure 1 As shown: First, initialization occurs. The system initializes the DNN model based on the given DNN model and the lung CT images used for a binary classification task, and then sends the initialized DNN model parameters to each client. The client receives the current global DNN model and trains it using a local dataset (lung CT images containing patient privacy information from within the institution) to perform a binary classification task, resulting in an updated model. The Deep Scalar Quantizer (DSQ) network is trained based on the updated DNN model parameters. It learns the corresponding quantization mapping function and quantization function based on the features of the updated model parameters. The trained deep quantizer can transform the quantization error distribution to approximate a Gaussian noise distribution satisfying a specified (∈,δ)-Local Differential Privacy (LDP). The DSQ network is then used to update the model. Quantization is performed to obtain the quantized result. index value index value After lossless encoding, the codewords are sent to the server. The server receives the codewords sent by all K active users, decodes them, and obtains the relevant information based on the codebook and index value. Then, an aggregation update is performed to obtain the updated global classification model, which is then distributed to users for the next round of federated learning iterations.

[0092] 1. Overall Algorithm Flow

[0093] Consider a federated learning system consisting of K participants and a central server. Each participant k holds a local dataset D of CT images containing patient privacy information. k It contains |D k | Samples, each sample consists of an input CT image x i And whether there are still nodules, label value y i The dataset is composed of {0, 1}. For the overall dataset... It contains |D| samples, and the sample {x} i ,y i The loss function on model w is defined as f(w, x).i ,y i ), which is f i (w). The overall training objective of federated learning is to find a vector w. * To minimize the loss function of the global model for a given image classification:

[0094]

[0095] The flowchart of the privacy-enhanced deep quantization-based efficient federated learning algorithm is shown below. Figure 2 As shown, it consists of the following steps:

[0096] Step 1: Model Initialization

[0097] Given a binary classification task and a DNN network, assume that the central server initializes the model parameters to w0 and broadcasts them to all users, the system contains K users, the number of local training iterations is τ, the total number of training iterations is T, and the number of quantization levels of the deep quantization network is M.

[0098] Step 2: Local Model Training

[0099] For the t-th global model training round, the central server first distributes the aggregated model w from the previous t-1 rounds. t-1 To all activated users. The k-th activated user utilizes the local dataset D k The updated model is obtained after local training τ times. The computational model was updated to

[0100] Step 3: Training the depth quantizer

[0101] Update parameters using the model The deep quantization network DSQ(.) is trained to learn the hyperparameter 'a' that determines the quantization mapping function. i b i and c i The quantization mapping function is obtained as shown in Equation (1) and the depth quantizer is shown in Equation (2), and its quantization noise is made to approximate the specified Gaussian distribution.

[0102] Step 4: Quantization and Encoding Transmission

[0103] The model update parameters are quantized using the trained deep quantization network DSQ(.), resulting in... The quantized index value. Finally, the corresponding quantized codebook and index value are encoded using lossless encoding and sent to the central server.

[0104] Step 5: Global model aggregation update

[0105] The central server decodes the received codewords to obtain the quantized codebook and index value, which are then mapped to obtain... The model is aggregated according to the model aggregation formula (2) and the updated global model is broadcast.

[0106]

[0107] Repeat steps 2 through 5 for T iterations until the training process converges.

[0108] 2. Deep Quantization Network Design

[0109] This invention mainly proposes a globally differentiable, end-to-end trainable deep scalar quantizer (DSQ), which can be viewed as a deep neural network (DNN). Its main objectives are: (1) to determine the quantization mapping function, its hyperparameters, and the quantization function based on the characteristics of the value to be quantized; and (2) to change the distribution of the quantization error to approximate a Gaussian distribution with specified (∈,δ)-Local Differential Privacy (LDP). The deep scalar quantization system model is as follows: Figure 3 As shown, the overall model can be regarded as a deep neural network containing multiple linear layers and Tanh activation functions. The quantization layer can be regarded as an activation function composed of multiple Tanh layers. The training objective of the overall network is to make the input and output of the network approximate each other and to transform the distribution of the error between the input and output to satisfy a Gaussian distribution.

[0110] For the training part of the network, the deep quantizer is a linear deep neural network. To achieve the network's objective, two different loss functions are used. The first loss function is the Mean Square Error (MSE) loss function, which determines the quantization function of the deep quantizer and minimizes the quantization error before and after quantization. The second loss function is the Kullback-Leibler (KL) divergence loss function, which transforms the distribution of the quantization error to approximate a specified Gaussian distribution. The overall loss function is shown below:

[0111]

[0112] Among them, the first term min||DQ M (x)-x||2 represents minimizing the quantization error, where x is the value to be quantized, and ||.||2 represents the l2 norm operator, DQ. M (.) represents the quantization formula for the depth quantizer, as shown in equation (4). It mainly consists of the quantization mapping function q. M (.) and its hyperparameter a i bi and c i Composition. Second item To minimize the KL divergence so that the distribution function of the target quantization error is Approximates the target Gaussian distribution obtained through differential privacy analysis The KL divergence distance between them is closer, and the specific formula can be found in formula (6). The loss function follows a Gaussian distribution, where Δf represents the sensitivity and σ is the noise scale. The design of these two training loss functions will be detailed below.

[0113] The training of the first loss function is to min||DQ. M (x)-x||2, our designed deep quantizer network, in addition to training the weights of the overall quantization network, has a quantization mapping function q. M The hyperparameter a of (.) i b i and c i It is also trained together as the quantization layer weights of the overall quantization network. Meanwhile, to achieve end-to-end training of the quantization network, the sum of hyperbolic tangents is used to replace the non-differentiable mapping process of the quantization process, and its quantization mapping function is shown in formula (3):

[0114]

[0115] Among them, a i b i and c i , where are all trainable real-valued parameters. i Related to the magnitude of the quantized value, b i and c i Determine the quantization interval by adjusting c. i The magnitude of the hyperparameters makes the values ​​before and after quantization more similar. We determine suitable hyperparameters by training to minimize the mean square error of the values ​​before and after quantization. After training, we can further obtain the quantization formula as follows:

[0116]

[0117] To achieve the second training objective We first obtain the target distribution through differential privacy analysis. Subsequently, the KL divergence loss function guides the quantization error distribution generated by the deep quantizer to approximate the target distribution, thereby achieving the goal that the quantization error can satisfy a Gaussian distribution through the quantizer. This quantization noise is then used to perturb the distribution of the original input and hide the model parameter information of each client.

[0118] First, we introduce the necessary concepts for differential privacy analysis. Our goal is to achieve (∈,δ)-Local Differential Privacy (LDP), which is defined as follows:

[0119] Define (∈,δ) - Local Differential Privacy (LDP)

[0120] If a random mechanism M satisfies (∈,δ)-Local Differential Privacy ((∈,δ)-LDP), then for any adjacent datasets D of the same size, D′∈D, and output subset y∈range(O), it satisfies the following relation:

[0121] Pr[M(D)=y]≤e ∈ Pr[M(D′)=y]+δ

[0122] Here, parameter ∈ represents the privacy budget, signifying the degree of privacy protection achieved using differential privacy techniques; a smaller value indicates a higher level of privacy protection. δ represents the probability of violating strict differential privacy, which we typically set to 10. -4 Differential privacy has different implementation mechanisms depending on the type of noise added. This paper mainly uses a Gaussian mechanism to implement (∈,δ)-LDP, defined as follows: Gaussian mechanism definition

[0123] For any random query function f, and neighboring datasets D, D′∈D, its sensitivity Then the random algorithm R = f(D) + l can provide (∈,δ)-LDP, where Let be the probability density function of random noise, that is, random noise l follows a Gaussian distribution with mean μ = 0 and standard deviation Δfσ, where It is represented by a Gaussian distribution.

[0124] Next, we will formally proceed with the differential privacy analysis. This paper utilizes the design of a deep quantizer to approximate the quantization error with a given Gaussian noise, replacing the addition of local Gaussian noise. Specifically, this paper uses the deep quantizer DSQ(.) to quantize the local model update for user k. Suppose that the local model quantized using a depth quantizer is updated to a query function. The noise addition process can be represented as in Δf represents the user's sensitivity, and σ represents the standard deviation of the quantization noise. Because differential privacy is post-processing invariant, the sensitivity of the query function is essentially the update of the local model quantized using the depth quantizer. The sensitivity is equivalent to the user k local model update. The sensitivity of the local model for user k will be updated next. The sensitivity Δf was analyzed and the standard deviation σ of the quantization error was constrained.

[0125] For local sensitivity Δf analysis, we previously needed to use a pruning technique to trim the gradients of mini-batch SGD training to ensure that the gradients are bounded, with the bound value set to C.

[0126] Assume the gradient is bounded

[0127] Assume the gradient of the model loss function F If the l2-norm is bounded, then it holds true for any input. Both ζ∈D satisfy

[0128] For any client k in FL, with only the j-th data sample ζ j Any two distinct adjacent mini-batch datasets B k and B′ k The sensitivity of the gradient updated using SGD, which has a magnitude of γ, can be calculated as follows:

[0129]

[0130] Let be the gradient of the local model loss function. The above inequality is calculated based on the vector norm triangle inequality, that is: for all We have ||x + y|| ≤ ||x|| + ||y||. Let the current global model w be... t-1 Furthermore, since the local model of user k after τ local iterations in round t is: Where s is the number of local iterations, and g is the gradient of the user model as a whole. Therefore, local model updates... The calculation is as follows: Where η is the model learning rate.

[0131] In summary, the sensitivity Δf of the proposed algorithm for each local update by user k is:

[0132]

[0133] Next, we analyze the constraint on the standard deviation σ of the quantization error. Since the use of (∈,σ)-LDP and its simple combined properties to capture the total privacy loss across multiple iterations is loose, it requires adding significant noise, sacrificing the model's practicality. To reduce the amount of noise added and improve the convergence rate while maintaining the (∈,σ)-LDP guarantee, we use a further improvement to the Momentum Account (MA) algorithm based on a Gaussian mechanism. [7] To reduce the noise scale. According to reference [7], the standard deviation of Gaussian noise should satisfy the following formula:

[0134]

[0135] Where C is the total number of iterations, parameter ∈ is the privacy budget, and δ represents the probability of violating strict differential privacy.

[0136] In summary, to satisfy the specified (∈,σ)-LDP, the required quantization error distribution should satisfy... Where Δf should satisfy (6) and σ should satisfy (7). Assume our target distribution is P. gt Indicate, then That is, P gt The mean is μ gt =0, mean square deviation σ gt =Δfσ, whose distribution function satisfies: The Gaussian distribution.

[0137] Finally, based on the target distribution obtained from the above privacy analysis... We use the KL divergence loss function to guide the quantization error distribution generated by the depth quantizer to approximate the target distribution. We represent the true quantization error of the depth quantizer as... and distribution function They are guided by KL loss, therefore the loss function for KL divergence is calculated as follows:

[0138]

[0139] 3. Privacy-Enhanced High-Efficiency Federated Learning Algorithm Based on Deep Quantization Networks

[0140] The Federated Averaging (FedAvg) algorithm is also used. In FedAvg, the server first randomly selects a subset of devices as active users, then has the selected devices perform multiple SGD iterations to minimize the local loss function, and then sends their local computation results to the server. Let τ represent the number of local iterations, and t∈[0,……,T-1] represent the index of the overall communication round. Specifically, at round t, a group of k local users are randomly selected to download the current globally shared model w from the server. t and in w t Perform τ local iterations. Let... This represents the local model of user k in the s-th local iteration. The model update process is as follows:

[0141]

[0142] It can be seen that s = 0,

[0143]

[0144] After τ local iterations, the local model is updated as follows:

[0145]

[0146] Quantization is performed using a pre-trained task-based quantization network. After encoding, the data is sent to the central server, and the global model is aggregated as follows:

[0147]

[0148] The quantization error is:

[0149]

[0150] The following is a specific example of the present invention.

[0151] (1) Model Structure

[0152] The implementation model of the depth quantizer of this invention is as follows: Figure 3 As shown.

[0153] The model consists of three linear layers at the beginning and end, with a Tanh activation layer and a scalar quantizer-approximate activation layer between each pair of linear layers. The parameters of the quantization layer are trained as weights along with the overall model, and the quantization values ​​and quantization intervals are determined after training.

[0154] (2) Model Training

[0155] Experiments were conducted on the LUNA16 dataset, using mini-batch stochastic gradient descent with a batch size of 128. The model was trained for 200 epochs on a GTX1080 GPU.

[0156] This invention also conducted experiments on images of breast tumors, demonstrating accurate classification and identification, thus improving diagnostic and treatment efficiency.

[0157] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A privacy-preserving deep quantization federated learning method, characterized in that, During the t-th global iteration, client k trains and obtains the updated model using local data. The parameters are used to train the deep quantization network, learn to determine the hyperparameters of the quantization mapping function, and generate an adaptive deep scalar quantizer (DSQ). The DSQ is a linear deep neural network that uses two different loss functions. The first loss function is the mean squared error (MSE) loss function, which is used to determine the quantization function of the deep quantizer and minimize the quantization error before and after quantization. The second loss function is the KL divergence loss function, which is used to transform the distribution of the quantization error to approximate a specified value. - Gaussian noise distribution of the local differential privacy LDP; then, the trained deep quantization network is used to quantize the updated model and change the quantization noise distribution to obtain the quantized result. The index value is used to train the deep quantizer network DSQ based on the parameters of the updated model. The corresponding quantization mapping function and quantization function are generated based on the features of the updated model parameters. The trained deep quantization network can transform the quantization error distribution to approximate the specified... - Local differential privacy Gaussian noise distribution, followed by updating the model using a deep quantizer (DSQ). Quantization is performed to obtain the quantized result. index value , index value After lossless encoding, the index values ​​are sent to the server; the server receives the index values ​​sent by all active users. After decoding, we get Then, an aggregation update is performed to obtain the updated global model, which is then distributed to users for the next round of federated learning iterations.

2. The privacy-preserving deep quantization federated learning method as described in claim 1, characterized in that, The detailed steps are as follows: Step 1: Model Initialization The central server initializes the model parameters as follows: And broadcast to all users. The system contains K users, and the number of local training iterations is... The total number of training iterations is T, and the number of quantization levels for the deep quantization network is M. Step 2: Local Model Training For the t-th global model training round, the central server first distributes the aggregated models from the previous t-1 rounds. For all activated users, the k-th activated user utilizes the local dataset. Perform local training The model was subsequently updated. The computational model is updated to ; Step 3: Training the depth quantizer Set the quantization level to M, and update the parameters using the model. For deep quantization networks Training is performed to learn and determine the hyperparameters of the quantization mapping function. , and The quantization mapping function is obtained as shown in formula (1), the depth quantizer is as shown in formula (2), and the quantization interval is... ; （1） （2） Step 4: Quantization and Encoding Transmission The model parameters are updated via a trained deep quantization network. Quantify to obtain Quantized index value Finally, the corresponding quantization index value After being encoded using lossless encoding, it is sent to the central server. Step 5: Global model aggregation update The central server decodes the received codewords to obtain the index value, which is then mapped to obtain... And according to the model aggregation formula (3), the model is aggregated and the updated global model is broadcast; （3） Repeat steps 2 through 5 for T iterations until the training process converges.

3. The privacy-preserving deep quantization federated learning method as described in claim 1, characterized in that, The steps to construct a deep quantization network are as follows: Deep quantization networks actually use deep neural networks, which are deep neural networks containing multiple linear layers and Tanh activation functions. The quantization layer contains multiple Tanh activation functions. The overall network training goal is to make the network's input and output approximately the same, and to transform the distribution of the error between the input and output to satisfy a Gaussian distribution. For the training part of the network, the Deep Scalar Quantizer (DSQ) is a linear deep neural network. To achieve the network's objective, two different loss functions are used. The first loss function is the Mean Squared Error (MSE) loss function, which is used to determine the quantization function of the deep quantizer and minimize the quantization error before and after quantization. The second loss function is the KL divergence loss function, which is used to transform the distribution of the quantization error to approximate a specified Gaussian distribution. The overall loss function is shown below: ； Among them, the first item This represents minimizing the quantization error, where x is the value to be quantized. express Norm operator, The quantization formula for the depth quantizer is shown in equation (4), which mainly consists of the quantization mapping function. and its hyperparameters , and Composition; Second item To minimize the KL divergence so that the distribution function of the target quantization error is Approximates the target Gaussian distribution obtained through differential privacy analysis The KL divergence distance between them is closer, and the specific formula can be found in formula (6). It follows a Gaussian distribution. For sensitivity, For noise scale; Training the first loss function is... The deep quantizer network, in addition to training the weights of the overall quantization network, has a quantization mapping function. hyperparameter , and It is also trained together as the quantization layer weights of the overall quantization network. At the same time, in order to achieve end-to-end training of the quantization network, the sum of hyperbolic tangents is used to replace the non-differentiable mapping process of the quantization process. Its quantization mapping function is as shown in formula (3): （3） in, , and All of these are trainable real-valued parameters. It is related to the magnitude of the quantized value. and Determine the quantification range, and adjust accordingly. The size of the hyperparameter can make the values ​​before and after quantization more similar. The appropriate hyperparameter is determined by training to minimize the mean square error of the values ​​before and after quantization. After training, the quantization formula is obtained as follows: （4） To achieve the second training objective The target distribution is first obtained through differential privacy analysis. Subsequently, the KL divergence loss function guides the quantization error distribution generated by the depth quantizer to approximate the target distribution, thereby achieving the goal that the quantization energy of the quantizer can make the quantization error satisfy a Gaussian distribution.

4. The privacy-preserving deep quantization federated learning method as described in claim 1, characterized in that, The Depth Scalar Quantizer (DSQ) is essentially a linear deep neural network, employing two distinct loss functions. The first, Mean Squared Error (MSE), determines the quantization function of the depth quantizer and minimizes the quantization error before and after quantization. The second loss function, KL divergence loss, transforms the distribution of the quantization error to approximate a specified value. - The Gaussian noise distribution of Local Differential Privacy (LDP), where: definition Local Differential Privacy LDP If a random mechanism satisfy -Local differential privacy ( -LDP), then for any adjacent datasets of the same size , and output subset All satisfy the following relationship: ； Where parameters The privacy budget represents the level of privacy protection achieved by using differential privacy technology; the smaller the value, the higher the level of privacy protection. The probability of violating strict differential privacy is represented using a Gaussian mechanism. -LDP, defined as follows: Define Gaussian mechanism For any random query function Adjacent datasets , Its sensitivity So, random algorithm Can provide -LDP, where The probability density function of random noise, i.e., random noise Follows the parameter mean The standard deviation is The Gaussian distribution, where Represented as a Gaussian distribution; Achieving differential privacy: This is achieved by using a deep quantizer design to approximate the quantization error with a given Gaussian noise, replacing the addition of local Gaussian noise. Quantify the local model update for user k Suppose that the local model quantized using a depth quantizer is updated to a query function. The noise-adding process can be represented as +error, where , For the user's sensitivity, The standard deviation of the quantization noise is given; because differential privacy is post-processing invariant, the sensitivity of the query function is updated using the local model quantized by the depth quantizer. The sensitivity is equivalent to the user k local model update. The sensitivity of the local model for user k will be updated next. Sensitivity Perform analysis and determine the standard deviation of the quantization error. constraint; To perform local sensitivity Analysis suggests that a pruning technique is needed to trim the gradients of mini-batch SGD training to ensure that the gradients are bounded, with the bound value set to C. Assume the gradient is bounded Assume the gradient of the model loss function F of -If the norm is bounded, then it holds true for any input. and All satisfied ; For any client k in FL, with only the j-th data sample Any two distinct adjacent mini-batch datasets and Its size is The sensitivity of the gradient updated using SGD is calculated as follows: （5） Let be the gradient of the local model loss function. The above inequality is calculated based on the vector norm triangle inequality, that is: for all ,have Assume the current global model , because it was conducted in round t The local model of user k after the next local iteration is: , where s is the number of local iterations, The gradient is the overall gradient of the user model; therefore, the local model update... The calculation is as follows: [ ],in The model learning rate; Sensitivity for each local update by user k : （6） Standard deviation of quantization error Constraints: To further reduce the noise scale using a Gaussian-based time-accounting MA algorithm, the standard deviation of the Gaussian noise should satisfy the following equation: （7） Where C is the total number of iterations, and the parameter... For privacy budget, This represents the probability of violating strict differential privacy. To meet the specified -LDP, the required quantization error distribution should satisfy ,in It should satisfy (6). It should satisfy (7), the target distribution uses Indicate, then ,Right now The mean is Mean squared Its distribution function satisfies: Gaussian distribution; Finally, based on the target distribution obtained from the above privacy analysis... The KL divergence loss function is used to guide the quantization error distribution generated by the depth quantizer to approximate the target distribution; the true quantization error of the depth quantizer is expressed as... , and distribution function Guided by KL loss, the loss function for KL divergence is calculated as follows: （8）。 5. The privacy-preserving deep quantization federated learning method as described in claim 1, characterized in that, The federated learning algorithm is the Federated Average (FedAvg) algorithm. In FedAvg, the server first randomly selects a subset of devices as active users, then has the selected devices perform multiple SGD iterations to minimize the local loss function, and then sends the local computation results to the server. Indicates the number of local iterations. An index representing the total number of communication rounds, in During the round, a group is randomly selected. A local user downloads the current globally shared model from the server. and in Execution Sublocal iteration, let Indicates user In the The local model during the next local iteration, and the model update process are as follows: （9） It can be seen that, ; （10） go through After local iteration, the local model is updated as follows: （11） Quantization is performed using a pre-trained task-based quantization network. After encoding, it is sent to the central server, and the global model is aggregated as follows: （12） The quantization error is: （13）。

Images