Privacy data protection method for model segmentation optimization in federated edge learning environment

Abstract

The present invention proposes a privacy data protection method for model segmentation optimization in a federated edge learning environment. The present invention combines privacy security protection with a dynamic adjustment strategy for model segmentation, maximizes the efficiency of federated edge learning under the conditions of satisfying the computing tasks of federated edge learning, data privacy security, and energy consumption control of edge devices, and provides a dynamic adjustment strategy for model segmentation. First, based on model inversion, a model segmentation security point that satisfies data privacy security is found, and under the condition of satisfying data security, a model segmentation balance point of edge device energy consumption and training efficiency is found. Initialize the model segmentation deployment at the balance point. Then, during the training and reasoning process, the model segmentation point is dynamically adjusted according to the resource allocation requirements of the edge device to meet the requirements of maximizing model training efficiency and dynamic resource adjustment in a complex environment.

Description

Technical Field

[0001] The present invention relates to the technical field of federated edge learning and deep learning model segmentation, and specifically to a privacy data protection method for model segmentation optimization in a federated edge learning environment. Background Art

[0002] With the widespread application of deep learning networks (DNN) in the field of Internet of Things, such as speech recognition, computer vision, image processing, etc. In the application of deep learning tasks, a large amount of data is needed to train the DNN model, which requires a huge storage system and sufficient computing power support. The traditional solution adopts a centralized training method to transfer the data of edge devices to the cloud server for training. This solution has inevitable defects in data privacy protection. On the other hand, uploading data to the cloud also requires a lot of communication resources, which reduces the performance of the entire system. Based on this, setting up edge servers around edge devices has attracted people's attention. With the advantage of its physical distance, edge servers have more reliable short-distance communication transmission than cloud servers, which significantly reduces the communication cost of the system. However, the problem of data privacy protection in edge servers has not been solved.

[0003] The emergence of Federated Learning (FL) provides a new platform and opportunity for solving privacy protection problems. FL is a distributed learning paradigm that allows multiple edge devices to collaboratively train DNN models. In the FL framework, each edge device performs model training locally based on its own data set, and then uploads the local model parameters to the central server. The central server is responsible for aggregating the models of each edge device, obtaining the global model parameters, and redistributing the global model to the edge devices. Repeat the above training process until the model converges.

[0004] As more and more IoT devices participate in federated learning, researchers have been committed to optimizing the FL paradigm in recent years, with the optimization goals mainly focused on improving model accuracy and communication efficiency. In comparison, there are not many studies on improving the computational efficiency of FL and reducing the computational energy consumption of FL. Under the classic FL framework, resource-constrained edge devices undertake most of the model training tasks, while resource-rich edge servers only undertake aggregation tasks with small computational workloads. This unfair task allocation strategy greatly reduces the training efficiency of FL.

[0005] Edge Learning proposes to use resources at the edge of the network to perform computing tasks, which has the advantages of short data transmission distance and real-time data processing. Some solutions combine federated learning and edge computing to reduce the communication overhead when exchanging model parameters. They require the edge server to aggregate the models of proximal mobile devices and upload the aggregated models to the cloud data center. However, mobile devices still need to consume a lot of local computing resources to train models. This introduces an additional third party, the edge server, which may increase new potential security risks.

[0006] The emergence of Federal Edge Learning (FEEL) makes up for the shortcomings of FL in resource allocation strategy and balances the defects of edge learning privacy and security. In FEEL, based on the idea of ​​edge computing, the model computing task is transferred to a private and trusted edge server instead of simply aggregating the model on a central server. Edge devices, edge servers, and central servers constitute the three-layer architecture of FEEL. Most of the existing FEEL strategies add noise or perform encryption processing during the model computing communication process to enhance the security of data privacy, but at the same time increase the complexity of model training, which is not conducive to the efficiency of model training. Furthermore, most of the existing FEEL strategies inherit the characteristics of the classic FL framework, placing the entire DNN model on the edge device, and the resource-constrained edge device undertakes most of the model training tasks. This unfair task allocation strategy also greatly reduces the training efficiency of FEEL.

[0007] To this end, the present invention proposes a privacy data protection method for model segmentation optimization in a federated edge learning environment, which reduces the model computing energy consumption on the edge device side and improves the model computing efficiency while ensuring data privacy security. Summary of the invention

[0008] In view of the shortcomings of existing methods, the present invention proposes a privacy data protection method for model segmentation optimization in a federated edge learning environment.

[0009] The present invention proposes a privacy data protection method for model segmentation optimization in a federated edge learning environment, which reduces the model computing energy consumption on the edge device side and improves the model computing efficiency while ensuring data privacy security. The general idea of ​​the method of the present invention is: segmentation learning strategy, model inversion, model segmentation optimization and model segmentation dynamic adjustment strategy.

[0010] The segmentation learning strategy gives the segmentation strategy for model segmentation, performs effective model segmentation at the model segmentation point, and deploys it to edge devices and edge servers.

[0011] Model inversion is used to verify the privacy security of the sub-model of the edge device at different segmentation points. An inversion model is trained, and the intermediate activations at different segmentation points are inverted to test. According to the requirements for edge data security, a minimum model segmentation security point Q is found.

[0012] Model segmentation optimization is used to find a balance between data privacy and training performance. According to the segmentation balance point K, the model is initialized and segmented.

[0013] Dynamic adjustment strategy for model segmentation: When the edge device calculation changes, the model segmentation point is dynamically adjusted. There are two situations. When other computing tasks on the edge device occupy computing resources, if the response speed requirement of the new task is high, the computing amount occupied by the FEEL training task should be reduced, that is, the number of model layers on the edge device should be reduced. This part of the model relies on the edge server for training. When the amount of computing tasks on the edge device is small, the number of model layers of the FEEL training task on the edge device can be increased. Due to the resource limitations and energy consumption requirements of the edge device, the number of sub-model layers of the model on the edge device cannot be increased all the time. The strategy to be adopted is to increase the number of sub-model layers to the model segmentation balance point obtained by the previous model segmentation optimization.

[0014] The present invention is specifically as follows:

[0015] In a first aspect, the present invention provides a privacy data protection method for model segmentation optimization in a federated edge learning environment, comprising the following steps:

[0016] Step 1: Build a federated edge learning framework, including a cloud server S, a group of edge servers ES, n edge devices E, and a private dataset D for each edge device i ;

[0017] Step 2: Develop a model segmentation learning strategy to achieve segmentation of the DNN model, with one part deployed on the edge device and the other on the edge server.

[0018] Step 3: Build an inversion model, train and infer, and calculate the DNN model segmentation privacy security point Q according to the requirements for data security;

[0019] Step 4: Consider the computing performance and power consumption of each edge device, take into account the DNN model training efficiency, and determine the DNN model segmentation balance point K. Then, according to the model segmentation learning strategy shown in step 2, the DNN model is segmented and initialized at the model segmentation balance point K to protect the data privacy of each edge device;

[0020] Step 5: According to the resource allocation requirements of each edge device, dynamically adjust the DNN model split point while meeting data privacy and security to improve the flexibility of edge device task scheduling.

[0021] Furthermore, step 2 specifically includes the following steps:

[0022] The DNN model has a total of N layers from the input layer to the output layer, where the first m layers close to the input layer are deployed on the edge device and are called the left submodel M. l ; The Nm layers near the output layer are deployed on the edge server and are called the right sub-model M r , the model segmentation point is the current model segmentation point.

[0023] The edge device performs forward propagation locally and transmits the last activation parameters of the left sub-model to the right sub-model of the edge server. The edge server continues forward propagation using the received activation parameters. Afterwards, the edge server performs backpropagation on the model parameters of the right sub-model to update the right sub-model. Then, the edge server transmits the backpropagation model parameters of the right sub-model at the split point to the edge device. After receiving the backpropagation model parameters from the edge server, the edge device continues backpropagation on the local left sub-model. This is how separated edge federated learning is performed.

[0024] Furthermore, step 3 specifically includes the following steps:

[0025] Starting from the input layer of the DNN model, layer-by-layer segmentation is performed. For each possible segmentation point (i.e., segmentation layer) L i , i = 1, 2, ..., N. Construct the inversion model G respectively i , used to test the privacy security of the split point. The split point is L i When , the left sub-model deployed on the edge device is recorded as M Li .

[0026] For the inversion model G i The training is performed to minimize the mean square error (MSE) between the inverted inference data and the original input data. Suppose the data set used to train the inversion model is Data g , then the inversion model G i The optimization can be expressed as:

[0027]

[0028] Using the trained inversion model G i For the left submodel M Li The intermediate activation parameter Ait sent i Perform inverse reasoning to reconstruct the original input data.

[0029] Peak Signal-to-Noise Ratio (PSNR) and structural similarity (SSIM) are used to measure the similarity between the reconstructed data of the inversion model and the original data. If the PSNR between the reconstructed data and the original data is > 30dB and SSIM > 0.8, it is considered that the model segmentation at the current segmentation point is privacy-insecure. On the contrary, if the PSNR between the reconstructed data and the original data is ≤ 30dB or SSIM ≤ 0.8, it is considered that the model segmentation at the current segmentation point is privacy-safe.

[0030] The training of the inversion model starts from i=1, and the inversion model G is trained one by one i , until the inversion model G i If the reconstructed image does not meet the evaluation index, then i is the model segmentation security point to be found, denoted as Q. In order to test the training effect of the inversion model on attacking different segmentation points, the inversion model G with different segmentation layers i is i The model structure and number of training times should be the same.

[0031] Furthermore, step 4 specifically includes the following steps:

[0032] 4-1 Calculate the total energy consumption E of edge devices;

[0033] The total energy consumption of a single edge device E sum It consists of two parts: edge device model computing energy consumption and communication transmission energy consumption. The edge device model computing energy consumption can be obtained by multiplying the device CPU / GPU power by the computing time, and the edge device communication energy consumption can be obtained by multiplying the device communication power by the communication transmission time. The total energy consumption E of the edge device can be expressed as:

[0034] E=P edge *T edge +P arr *T arr Formula (2)

[0035] Among them, P edge Represents the computing unit power of the edge device, P arr represents the edge device communication transmission power, T edge represents the time required for edge device calculation, T arr Indicates the time required for edge device communication;

[0036] 4-2 Calculate the total delay T of model training.

[0037] The total delay T of model training consists of three parts: edge device training time, communication transmission time and server training time. The edge device training time can be obtained by the computation of the left sub-model of the edge device, the computing power of the edge device and the hyperparameters of the training task. The server training time can be obtained by the computation of the right sub-model of the edge server, the computing power of the server device and the hyperparameters of the training task. The communication transmission time can be calculated by the time it takes to upload the model parameters to the server and download them to the local computer. The total delay T of model training can be expressed as:

[0038]

[0039] FLOPs edge The computational capacity of the left sub-model of the edge device, FLOPS sever is the computation amount of the right sub-model of the edge server, w edge 、w sever are the computing power of the left sub-model of edge devices and the right sub-model of edge servers, respectively. Ait is the amount of data transmitted in communication, r is the communication transmission rate, B is the batch size of model training, and epoch is the number of model training times;

[0040] The more layers of the left sub-model of the edge device, the smaller the number of parameters at the split point of the DNN model, the smaller the energy consumption and time of communication transmission, and the higher the model training efficiency, but at the same time it occupies more computing resources of the edge device and generates more energy consumption. Conversely, the fewer layers of the left sub-model of the edge device, the lower the energy consumption of the edge device, but at the same time the model training efficiency is reduced.

[0041] 4-3 Calculate the model segmentation balance point k so that the training time and energy consumption of the entire system are as short as possible.

[0042] Under the constraints of communication transmission rate r, model parameter params and model security, the optimization problem can be expressed as:

[0043]

[0044] sqK

[0045] K≤N

[0046] Params edge <M edge

[0047] Among them, Params edge is the parameter of the left sub-model of the edge device, M edge is the memory capacity of the edge device, N is the total number of layers of the DNN model network model, λ and μ represent the importance weighted indicators of energy consumption and latency respectively, and Q is the model segmentation safety point;

[0048] Using quadratic polynomial regression, we optimize and solve formula (4) to obtain the model segmentation equilibrium point K;

[0049] 4-4 Perform model segmentation at the segmentation balance point K, deploy the left sub-model (input end) on the edge device, and the right sub-model (output end) on the edge server after segmentation, completing the initialization of model segmentation.

[0050] Furthermore, step 5 specifically includes the following steps:

[0051] Monitor the edge device load in real time, and dynamically adjust the split point k of the current model segmentation based on resource (CPU / GPU / memory) occupancy, edge device core temperature, high-priority task queue jumping, etc.

[0052] 5-1 Train the DNN model, initialize the segmentation point k of the model as the model segmentation balance point, that is, k = K, time t = t0;

[0053] 5-2 Determine whether the segmentation point k of the model segmentation at the current time t satisfies k>Q. If not, execute step 5-3; if so, continue to determine whether there is at least one of the following situations in the training process: the resource (CPU / GPU / memory) occupancy rate is greater than the preset value θ and the priority is higher than the current task. If so, the computing task of the tail s layer of the left sub-model deployed on the edge device is handed over to the edge server, and the model segmentation point is updated to k=ks, and the updated segmentation point k satisfies k≥Q, and execute step 5-3; if not, update k=K, and then execute step 5-3;

[0054] 5-3 Determine whether the training task of the current DNN model is completed. If so, the model segmentation task is completed; if not, when t=t+Δt, Δt is the waiting time, return to step 5-2.

[0055] The edge device and the edge server complete the update of the model segmentation point k through one communication transmission. The communication transmission process is specifically that the edge device transmits the activation parameter Ait to the edge server while carrying a model segmentation dynamic adjustment state field Dynamic_adjustment = true, and the edge device transmits the model parameters of the ks-th layer to the k-th layer to the edge server. After that, the calculation task of this s layer will be undertaken by the edge server. The value of s should be set according to the size of the DNN model. The larger the model, the larger the step size s of each dynamic adjustment.

[0056] When the resource (CPU / GPU / memory) occupancy rate is low and high-priority tasks are processed, the model split point should be restored to the model split balance point K to ensure the balance of edge device energy consumption, resource occupancy, and training time. This process is the reverse process of reducing the number of layers of the left sub-model of the edge device, and the adjustment of the model split point is also completed through one communication.

[0057] In a second aspect, the present invention provides a privacy data protection system, comprising:

[0058] Federated Edge Learning Framework Building Blocks;

[0059] Model segmentation learning strategy module;

[0060] Inversion model building module, training and reasoning, calculating the DNN model segmentation privacy security point Q according to the requirements of data security;

[0061] The initial segmentation module determines the DNN model segmentation balance point K, and then performs initial segmentation of the DNN model at the model segmentation balance point K according to the model segmentation learning strategy;

[0062] The dynamic adjustment module dynamically adjusts the DNN model segmentation points according to the resource allocation requirements of each edge device while ensuring data privacy and security.

[0063] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described.

[0064] In a fourth aspect, the present invention provides a computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the described method is implemented.

[0065] Beneficial effects of the present invention:

[0066] The present invention proposes a privacy data protection method for model segmentation optimization in a federated edge learning environment, which combines privacy security protection and model segmentation dynamic adjustment strategy, so as to maximize the efficiency of federated edge learning while meeting the federated edge learning computing tasks, data privacy security and edge device energy consumption control.

[0067] The present invention uses an inversion model to find a model segmentation security point that meets data privacy security, and finds a model segmentation balance point for edge device energy consumption and training efficiency under the condition of meeting data security. Initialize the model segmentation deployment at the balance point. Then, during the training and reasoning process, dynamically adjust the model segmentation point according to the resource allocation requirements of the edge device, improve the flexibility of edge device task scheduling, and meet the needs of maximizing model training efficiency and dynamic resource adjustment in complex environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is the overall flow chart of the present invention;

[0069] Figure 2 This is a diagram of the federated edge learning architecture of the present invention;

[0070] Figure 3 It is a schematic diagram of the model segmentation method of the present invention;

[0071] Figure 4 A flow chart for determining the splitting balance point of the model of the present invention;

[0072] Figure 5 This is a flow chart of dynamic adjustment of model segmentation of the present invention. DETAILED DESCRIPTION

[0073] The present invention will be described below. Figure 1 The model segmentation optimization and privacy data protection methods are explained in detail.

[0074] Step 1: Build a federated edge learning framework, including a cloud server S, a group of edge servers ES, n edge devices E, and a private dataset D for each edge device i ,like Figure 2 As shown in the figure, edge devices and edge servers undertake the computing tasks of model training and reasoning, while cloud servers only undertake federation aggregation tasks.

[0075] Step 2: Develop a model segmentation strategy to split the DNN model into two parts, one on the edge device and the other on the edge server.

[0076] First, split the model into two parts, such as Figure 3 , the part close to the input layer is deployed on the edge device, called the left sub-model M l The part close to the output layer is deployed on the edge server and is called the right sub-model M r , the model segmentation point is the current model segmentation point.

[0077] The edge device performs forward propagation locally and converts the left submodel M l The final activation parameters are passed to the right sub-model M of the edge server r ; The edge server continues forward propagation using the received activation parameters; Afterwards, the edge server r Back propagation of model parameters is performed to update the right sub-model M r ; Then, the edge server sends the right sub-model M rThe back propagation model parameters at the split point are passed to the edge device; after the edge device receives the back propagation model parameters from the edge server, it performs a local left sub-model M l Continue back propagation to perform separate edge federated learning.

[0078] Step 3: Build an inversion model, train and infer, and calculate the model segmentation privacy security point Q based on the requirements for data security.

[0079] For each possible segmentation point (i.e. segmentation layer) L i i=1,2,…,N, respectively construct the inversion model G i , used to test the privacy security of the split point. The split point is L i When , the left sub-model deployed on the edge device is recorded as M Li .

[0080] For the inversion model G i The training is performed to minimize the mean square error (MSE) between the inverted inference data and the original input data. Suppose the data set used to train the inversion model is Data g , then the inversion model G i The optimization can be expressed as:

[0081]

[0082] Using the trained inversion model G i For the left submodel M Li The intermediate activation parameter Ait sent i Perform inverse reasoning to reconstruct edge device private data.

[0083] Peak Signal-to-Noise Ratio (PSNR) and structural similarity (SSIM) are used to measure the similarity between the reconstructed data of the inversion model and the original data. i For the left submodel M Li The intermediate activation parameter Ait sent i When the PSNR of the reconstructed data and the original data is > 30dB and the SSIM is > 0.8, the data reconstruction is considered successful, that is, model segmentation at layer i is privacy-insecure. On the contrary, if the PSNR of the reconstructed data and the original data is ≤ 30dB or the SSIM is ≤ 0.8, model segmentation at the current segmentation point is considered privacy-safe.

[0084] The training of the inversion model starts from i=1, and the inversion model G is trained one by one i , until the inversion model Gi If the reconstructed image does not meet the evaluation index, then the current i is the model segmentation security point to be found, denoted as Q. In order to test the training effect of the inversion model on attacking different segmentation points, the inversion model G with different segmentation layers i is i The number of training epochs should be the same.

[0085] Step 4: Considering the computing performance and power consumption of edge devices and the model training efficiency, calculate the total energy consumption E of edge devices and the total delay T of model training. Establish an optimization model based on E and T to determine the model segmentation balance point K, and then segment and initialize the DNN model at the model segmentation balance point K according to the model segmentation learning strategy in step 2 to protect the data privacy of each edge device.

[0086] Calculate the total energy consumption E of edge devices. The total energy consumption E of a single edge device sum It consists of two parts: edge device model computing energy consumption and communication transmission energy consumption. The edge device model computing energy consumption can be obtained by multiplying the device CPU / GPU power by the computing time, and the edge device communication energy consumption can be obtained by multiplying the device communication power by the communication transmission time. The total energy consumption E of the edge device can be expressed as:

[0087] E=P edge *T edge +P arr *T arr

[0088] Among them, P edge Represents the computing unit power of the edge device, P arr represents the edge device communication transmission power, T edge represents the time required for edge device calculation, T arr Indicates the time required for edge device communication.

[0089] Calculate the total delay T for model training. The total delay T for model training consists of three parts: edge device training time, communication transmission time, and server training time. The edge device training time can be derived from the edge sub-model computation, edge device computing power, and hyperparameters of the training task. The server training time can be derived from the server sub-model computation, server device computing power, and hyperparameters of the training task. The communication transmission time can be calculated from the time it takes to upload the model parameters to the server and the time it takes to download them to the local computer. The total delay T for model training can be expressed as:

[0090]

[0091] FLOPs edge The computation amount of the left sub-model of the edge device, FLOPs sever is the computation amount of the right sub-model of the edge server, w edge 、wsever are the computing power of the left sub-model of edge devices and the right sub-model of edge servers, respectively. Ait is the amount of data transmitted for communication, r is the communication transmission rate, B is the batch size for model training, and epoch is the number of model training times.

[0092] The more layers of the left sub-model of the edge device, the smaller the number of parameters at the split point of the DNN model, the smaller the energy consumption and time of communication transmission, and the higher the model training efficiency, but at the same time it occupies more computing resources of the edge device and generates more energy consumption. Conversely, the fewer layers of the left sub-model of the edge device, the lower the energy consumption of the edge device, but at the same time the model training efficiency is reduced.

[0093] Considering the computing performance and power consumption of edge devices, and taking into account the model training efficiency, a model segmentation balance point K is determined to minimize the training time and energy consumption of the entire system. At the same time, the data security transmitted during the communication process must be within an acceptable range, that is, the model segmentation balance point K cannot be less than the model segmentation security point Q. Under the constraints of the communication transmission rate r, the model parameter params, and the model security, the optimization problem can be expressed as:

[0094]

[0095] sqK

[0096] K≤N

[0097] Params edge <M edge

[0098] Among them, Params edge is the edge device model parameter, M edge is the memory capacity of the edge device, N is the total number of layers of the DNN model network model, and λ and μ represent the importance weighted indicators of energy consumption and latency, respectively.

[0099] Use quadratic polynomial regression to optimize and solve the model segmentation balance point K. Perform model segmentation at the K layer, deploy the left sub-model (input end) on the edge device, and the right sub-model (output end) on the edge server after segmentation to complete the initialization of model segmentation.

[0100] Step 5: Dynamic adjustment of model segmentation during training.

[0101] Monitor the edge device load in real time, and dynamically adjust the segmentation points of the model segmentation based on resource (CPU / GPU / memory) occupancy, edge device core temperature, high-priority task queue jumping, etc.

[0102] 5-1 Train the DNN model, initialize the segmentation point k of the model segmentation to the model segmentation balance point K, that is, k = K, time t = t0;

[0103] 5-2 Determine whether the segmentation point k of the model segmentation at the current time t satisfies k>Q, if not, execute step 5-3; if yes, continue to determine whether there is at least one of the following situations in the training process: the resource occupancy rate is greater than the preset value θ and the priority is higher than the current task. If yes, the calculation task of the tail s layer of the left sub-model deployed on the edge device is handed over to the edge server, and the model segmentation point is updated to k=ks, and the updated segmentation point k satisfies k≥Q, and execute step 5-3; if not, update k=K, and then execute step 5-3;

[0104] 5-3 Determine whether the training task of the current DNN model is completed. If so, the model segmentation task is completed; if not, when t=t+Δt, Δt is the waiting time, return to step 5-2.

[0105] The edge device and the edge server complete the switching of the model segmentation point through one communication transmission. When the edge device transmits the activation parameter Ait to the server, it carries a model segmentation dynamic adjustment status word Dynamic_adjustment = true, indicating that after this communication, the model segmentation point will be adjusted. In addition, the edge device transmits the model parameters from the ks layer to the k layer to the edge server. After that, the computing tasks of the s layer will be undertaken by the edge server.

[0106] When the resource (CPU / GPU / memory) occupancy rate is low and high-priority tasks are processed, the model split point should be restored to the model split balance point K to ensure the balance of edge device energy consumption, resource occupancy, and training time. This process is the reverse process of reducing the number of layers of the left sub-model of the edge device, and the adjustment of the model split point is also completed through one communication.

Claims

1. A privacy data protection method for model segmentation optimization in a federated edge learning environment, characterized in that The method comprises the following steps: Step 1: Build a federated edge learning framework, including a cloud server S, a group of edge servers ES, n edge devices E, and a private dataset D for each edge device i ; Step 2: Develop a model segmentation learning strategy to achieve segmentation of the DNN model, with one part deployed on the edge device and the other on the edge server. The DNN model has a total of N layers from the input layer to the output layer, where the first m layers close to the input layer are deployed on the edge device and are called the left submodel M. l ; The Nm layers near the output layer are deployed on the edge server and are called the right sub-model M r , the model segmentation point is the current model segmentation point; The edge device performs forward propagation locally and converts the left submodel M l The final activation parameters are passed to the right sub-model M of the edge server r ; The edge server continues forward propagation using the received activation parameters; Afterwards, the edge server r Back propagation of model parameters is performed to update the right sub-model M r ; Then, the edge server sends the right sub-model M r The back propagation model parameters at the split point are passed to the edge device; after the edge device receives the back propagation model parameters from the edge server, it performs a local left sub-model M l Continue with back propagation; Step 3: Build an inversion model, train and infer, and calculate the DNN model segmentation privacy security point Q according to the requirements for data security; Step 4: Consider the computing performance and power consumption of each edge device, take into account the DNN model training efficiency, and determine the DNN model segmentation balance point K; then, according to the model segmentation learning strategy in step 2, the DNN model is segmented and initialized at the model segmentation balance point K to protect the data privacy of each edge device; Step 5: According to the resource allocation requirements of each edge device, dynamically adjust the DNN model split point while ensuring data privacy and security; specifically, the following steps are included: 5-1 Train the DNN model, initialize the segmentation point k of the model segmentation to the model segmentation balance point K, that is, k = K, time t = t0; 5-2 Determine whether the segmentation point k of the model segmentation at the current time t satisfies k>Q, if not, execute step 5-3; if yes, continue to determine whether there is at least one of the following situations in the training process: the resource occupancy rate is greater than the preset value θ and the priority is higher than the current task. If yes, the calculation task of the tail s layer of the left sub-model deployed on the edge device is handed over to the edge server, and the model segmentation point is updated to k=ks, and the updated segmentation point k satisfies k≥Q, and execute step 5-3; if not, update k=K, and then execute step 5-3; 5-3 Determine whether the training task of the current DNN model is completed. If so, the model segmentation task is completed; if not, when t=t+Δt, Δt is the waiting time, return to step 5-2.

2. The method according to claim 1, characterized in that Step 3 specifically includes the following steps: Starting from the input layer of the DNN model, layer-by-layer segmentation is performed. For each possible segmentation point L i , i=1,2,…,N, respectively construct the inversion model G i , the left sub-model deployed on the edge device is denoted as M Li ; For the inversion model G i Training is performed to minimize the mean square error (MSE) between the inverted and inferred data and the original input data. Suppose the data set used to train the inversion model is Data g , then the inversion model G i The optimization can be expressed as: Using the trained inversion model G i For the left submodel M Li The intermediate activation parameter Ait sent i Perform inverse reasoning to reconstruct the original input data; Peak signal-to-noise ratio (PSNR) and structural similarity (SSIM) are used to measure the similarity between the reconstructed data of the inversion model and the original data. If the PSNR between the reconstructed data and the original data is greater than 30 dB and the SSIM is greater than 0.8, it is considered that the model segmentation at the current segmentation point is privacy-insecure. On the contrary, if the PSNR between the reconstructed data and the original data is less than or equal to 30 dB or the SSIM is less than or equal to 0.8, it is considered that the model segmentation at the current segmentation point is privacy-secure. The training of the inversion model starts from i=1, and the inversion model G is trained one by one i , until the inversion model G i If the reconstructed image does not meet the evaluation criteria, then the current i is the model segmentation safety point to be found, denoted as Q.

3. The method according to claim 2, characterized in that Inversion model G with different segmentation layers i in step 3 i The model structure and number of training times should be the same.

4. The method according to claim 1, characterized in that Step 4 specifically includes the following steps: 4-1 Calculate the total energy consumption E of edge devices; The total energy consumption of a single edge device E sum It consists of two parts: edge device model computing energy consumption and communication transmission energy consumption. The edge device model computing energy consumption can be obtained by multiplying the device CPU / GPU power by the computing time, and the edge device communication energy consumption can be obtained by multiplying the device communication power by the communication transmission time. The total energy consumption E of the edge device can be expressed as: E=P edge *T edge +P arr *T arr Formula (2) Among them, P edge Represents the computing unit power of the edge device, P arr represents the edge device communication transmission power, T edge represents the time required for edge device calculation, T arr Indicates the time required for edge device communication; 4-2 Calculate the total delay T of model training; The total delay T of model training consists of three parts: edge device training time, communication transmission time and server training time. The edge device training time can be obtained by the computation of the left sub-model of the edge device, the computing power of the edge device and the hyperparameters of the training task. The server training time can be obtained by the computation of the right sub-model of the edge server, the computing power of the server device and the hyperparameters of the training task. The communication transmission time can be calculated by the time it takes to upload the model parameters to the server and download them to the local computer. The total delay T of model training can be expressed as: FLOPs edge The computation amount of the left sub-model of the edge device, FLOPs sever is the computation amount of the right sub-model of the edge server, w edge 、w sever are the computing power of the left sub-model of edge devices and the right sub-model of edge servers, respectively. Ait is the amount of data transmitted in communication, r is the communication transmission rate, B is the batch size of model training, and epoch is the number of model training times; 4-3 Calculate the model segmentation equilibrium point K so that the training time and energy consumption of the entire system are as short as possible; Under the constraints of communication transmission rate r, model parameter params and model security, the optimization problem can be expressed as: sqK K≤N Params edge <M edge Among them, Params edge is the parameter of the left sub-model of the edge device, M edge is the memory capacity of the edge device, N is the total number of layers of the DNN model network model, λ and μ represent the importance weighted indicators of energy consumption and latency respectively, and Q is the model segmentation safety point; Using quadratic polynomial regression, we optimize and solve formula (4) to obtain the model segmentation equilibrium point K; 4-4 Perform model segmentation at the segmentation balance point K, deploy the left sub-model of the segmented DNN model on the edge device, and deploy the right sub-model on the edge server to complete the initialization of model segmentation.

5. A privacy data protection system for implementing the method described in any one of claims 1 to 4, characterized in that include: Federated Edge Learning Framework Building Blocks; Model segmentation learning strategy module; Inversion model building module, training and reasoning, calculating the DNN model segmentation privacy security point Q according to the requirements of data security; The initial segmentation module determines the DNN model segmentation balance point K, and then performs initial segmentation of the DNN model at the model segmentation balance point K according to the model segmentation learning strategy; The dynamic adjustment module dynamically adjusts the DNN model split points according to the resource allocation requirements of each edge device while ensuring data privacy and security.

6. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 4.

7. A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 4 is implemented.

Images