A federated learning privacy protection method based on cutmix data enhancement

Abstract

The application discloses a federated learning privacy protection method based on Cutmix data enhancement, and is applied to a scene of privacy protection of a hospital image data center. A central server of the hospital data center determines a deep learning model as a model for training of each client before federated training starts; after the federated training starts, the central server will distribute the model to each client; in order that there is no information pixel in the image in the training process, when the original data is protected, the Cutmix data enhancement method is adopted, the advantage of the data enhancement strategy in the picture generation is utilized, more robust features are learned by the training model, and the generalization ability of the model is effectively improved. The application is aimed at defending against gradient inversion attacks in federated learning, enhancing the constraint on the gradient inversion attack process, and proposing a more secure defense scene for federated learning. The method can defend against the most advanced attacks with a small amount of data utility loss.

Description

TECHNICAL FIELD

[0001] The application relates to a federated learning privacy protection method based on Cutmix data enhancement, and applies to the field of machine learning for privacy protection of a hospital image data center. BACKGROUND

[0002] Due to excellent performance in big data analysis and processing, artificial intelligence technology has been widely applied. Machine learning and deep learning models have played an important role in various demand scenarios due to their excellent performance, strong robustness and high adaptability. With the development of medical imaging facilities, hospitals produce a large amount of medical image data every day, and more and more data provide opportunities for researchers to develop data-driven methods and provide better healthcare. However, data-driven models need a large amount of data for sufficient training, and the amount of available data in each data center is always limited, so the deep learning models trained on local data centers may not reach their total performance capacity. One solution is to accumulate all data from different centers to a center, but data privacy regulations do not allow medical institutions to easily combine their data, and it becomes more and more difficult when the data of multiple countries is involved; another solution is to use a privacy protection algorithm, which can utilize all available data in multiple centers while maintaining the privacy of sensitive data. Federated learning (FL) is such a distributed learning mechanism that can be deployed to train large-scale machine learning models on different data centers without sharing sensitive data. Sharing models is a very important topic in distributed environments involving a large amount of data (e.g., medical high-resolution images or multi-layer MRI and CT scans). In federated learning, instead of transmitting data, a general model is trained on a local data set and transmitted between data centers. The data owner trains a local model and then uploads the updated gradient to the aggregation server, which aggregates the collected multiple gradients and then updates and maintains the final model. The aggregated updated model is then sent to each training participant to start a new round of training. In this way, direct exposure of data is avoided, and machine learning training can still be performed using private data. Federated learning has been identified as a promising research field with a wide range of possible uses in medical research and practice. Its architecture diagram is shown in Figure 1 .

[0003] Although gradient sharing is not considered to directly expose the training data of users, distributed learning still has many security risks. Studies have shown that distributed learning is vulnerable to various privacy theft attacks, and malicious attackers can steal the privacy information of data owners by obtaining model gradients, which is called "gradient inversion attack", and its flowchart is shown in Figure 2The attacker can start to reconstruct the private data of the client by eavesdropping the communication between the client and the server, and the attacker can also be a malicious participant in federated learning, including an honest and curious server that wants to reconstruct the private data of the client, or an honest and curious client that wants to reconstruct the private data of other clients. Therefore, the research on the defense method against the gradient attack of distributed learning can promote the further understanding of the security of federated learning, and help the distributed learning to develop in the direction of protecting the privacy of users. SUMMARY

[0004] The present application is used to solve the problem that the use of distributed machine learning model in gradient inversion attack causes the risk of privacy leakage of hospital data center, since the goal of gradient inversion attack is to recover the training data of hospital data center, therefore directly protecting the original data before training is an ideal defense strategy. The hospital data center client can hide the private image from the data source, making the private input difficult to perform. These generated samples not only can improve the accuracy of the trained model, but also can "aggregate" the original data. The present application specifically proposes a defense method based on data enhancement, which fully and effectively mines and utilizes the information hidden in the shared gradient and parameter data, and focuses on studying how to use the data enhancement method to better protect the original data, protect the local privacy data of the hospital data center from being stolen, and further defend more advanced gradient inversion attacks.

[0005] To achieve the above object, the technical scheme adopted by the present application is a federated learning privacy protection method based on Cutmix data enhancement, and the flow chart of the present application is as shown in Figure 3 The implementation steps of the method are as follows:

[0006] Step (1): in the gradient inversion attack scene, first give a neural network with a parameter θ, and calculate the gradient by using a batch of private data ( is a real set; b and d are batch size and image size) to calculate the gradient The gradient is calculated from the real batch with image x * and label y * The attacker tries to recover the input picture and optimize towards the true value x * :

[0007]

[0008] Among them: The gradient of the synthesized data (for the original loss of the neural network) is forced to match the gradient of the recovered batch x with the provided gradient , The reconstructed image is regularized based on image priors, with parameter α used to prevent curve overfitting. Cosine distance is used as... Total variation as get:

[0009]

[0010] Where <·,·> are the inner products of vectors. It is the total variation of the image, and the total variation parameter α TV This refers to α in the above formula, which acts as a constraint on the model parameters. The search for α within the range {0, 0.001, 0.005, 0.01, 0.05, 0.1, 0.5} yields the result. TV The value of is determined by applying α. TV Setting the value to 0.1 reduces the degree of overfitting of the curve and maximizes the model's training accuracy score.

[0011] Step (2): Batch normalization is a technique for training neural networks that normalizes the input of each mini-batch to a single layer. Assume the model has L batch normalization layers. Given a batch of input images x, use x... l Let represent the input features of the l-th BatchNorm layer, where l ∈ [L]. During training, the l-th BatchNorm layer is trained based on the batch mean (xi). l ) and variance var(x l ) for x l The running estimate is normalized and preserves the mean and variance of all training data points, using μ. l and This indicates that during the reasoning process, the following is used: and Normalize the test image. (Omitted for simplicity) (i.e., using μ, σ) 2 express mean(x), var(x) represent During each training phase, the attacker will update x based on (μ, σ) of each batch. 2 Try to infer the mean and variance (mean(x)). * ),var(x * The attacker guesses about the private batch and normalizes it using (mean(x), var(x)). In this case, (μ, σ) 2 This can be used as a priori for the BatchNorm statistic to regularize the recovery, and a regularization term parameter α can be added. BN To prevent overfitting of the BN layer curve, as

[0012]

[0013] wherein

[0014]

[0015] After searching in {0, 0.0005, 0.001, 0.01, 0.05, 0.01}, alpha is applied to all defenses BN = 0.001, so that the degree of curve overfitting is reduced, and the model training accuracy score is higher. BatchNorm statistics that cannot access private batches can weaken the most advanced gradient inversion attacks;

[0016] Step (3): The label information of a single private image can be calculated from the gradient analysis of the layer before the output layer. The present application uses the CIFAR-10 dataset during training, and for different batch sizes, many training samples may have the same label and the distribution of the label is not uniform, so it cannot be determined how many images belong to the label, therefore, it becomes more difficult to infer the label, and the gradient inversion attack will be weakened;

[0017] Step (4): Since the goal of the gradient inversion attack is to recover the training data of the hospital data center, directly protecting the original data before training is an ideal defense strategy. The client can hide the private image from the data source, making it difficult to reconstruct the private input;

[0018] Step (4-1): The central server of the hospital data center determines a deep learning model as the model for training by each client before the start of federated training, and places it in the central server. After the start of federated training, the central server will distribute this model to each client. In response to the functional requirements of the defense method, it is assumed that a client has a CIFAR-10 dataset of N private images, the i-th data sample format is (x i ,y i ), where x i represents the pixel point matrix of the image sample, and y i represents the label of the sample, i.e. the category to which the image belongs. In the process of participating in federated learning, a ResNet-18 model is trained, which is a deep convolutional neural network (DCNN) structure with 18 layers of depth, consisting entirely of convolutional layers and fully connected layers;

[0019] Step (4-2): In order to have the characteristic of no information pixels during training, and to make the training more efficient, the present application adopts a method based on Cutmix data enhancement when protecting the original data, instead of simply deleting pixels, but replacing the deleted area with a patch from another image in the dataset. The Cutmix data enhancement method is shown in Figure 4 ;

[0020] Further, step (4-2) further comprises: and y represent the training image and its label respectively is a real number set; W, H, C are image width, height, and color channel number respectively). The goal of Cutmix is to generate new training samples A ,y A ) and (x B ,y B ) to generate new training samples The generated training samples are used to train the model with its original loss function. The combination operation is defined as

[0021]

[0022]

[0023] where M e {0, 1} W×H is a binary mask (W, H are image width and height respectively), represents the position of deletion and padding from two images, 1 is a binary mask filled with 1, and is element multiplication. The combination ratio λ between two data points is sampled from Beta(α, α) distribution. Set α to 1, that is, λ is sampled from uniform distribution (0, 1);

[0024] In order to sample the binary mask M, first sample the bounding box coordinates B = (r x ,r y ,r w ,r h ) representing the cropped region on x A and x B . Among them, r x ,r y represent the center point coordinates of the frame, and r w ,r h represent the width and height. Remove the region B in x A , and fill it with the patch cropped by B in x B . In the experiment, the rectangular mask M is sampled, and its aspect ratio is proportional to the original image. The bounding box coordinates are uniformly sampled according to the following conditions:

[0025]

[0026]

[0027] Among them, the Unif() function limits the coordinate region not to exceed the sample size, and r w ,r h, let the cutting area ratio be

[0028]

[0029] For the cutting area, the binary mask M is in {0, 1} W×H Decided by filling 0 in the bounding box B, otherwise 1. In each training iteration, two randomly selected training samples are combined into a small batch to generate a Cutmix-ed sample

[0030] Step (5): using the Cutmix data enhancement method based on the CIFAR-10 dataset to train the ResNet-18 architecture, and the generated global model is trained as the final model of the entire federal task. When training the network architecture, 200 epochs are performed, the batch size is 128, the SGD with momentum of 0.9 is used as the optimizer, the initial learning rate is set to 0.02 by default, the learning rate is decayed by 0.1 times every 50 epochs, and a subset of 50 CIFAR-10 images is used to evaluate the attack performance.

[0031] The application is based on the Cutmix data enhancement method from the perspective of input encryption when training the network model, so that the hospital data center client hides the private image from the data source, and the attacker is difficult to reconstruct the private input. The generated example not only improves the accuracy of the trained model, but also aggregates the original data, effectively mines and utilizes the information hidden in the shared gradient and parameter data. The application significantly protects the original data and ensures that the private data of the hospital data center local end is not stolen, thereby defending more advanced gradient inversion attacks. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 It is a schematic diagram of the hospital data center federal learning framework

[0033] Figure 2 It is a process diagram of gradient inversion attack

[0034] Figure 3 It is a flowchart of the application

[0035] Figure 4 It is a schematic diagram of the Cutmix data enhancement method DETAILED DESCRIPTION

[0036] The purpose of the application is to propose a federal learning privacy protection method based on Cutmix data enhancement, which is more effective in protecting the output results of the user privacy model on the data enhanced deep network learning model.

[0037] The technical solutions provided by the present application will be described in detail below in combination with specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present application and not to limit the scope of the present application.

[0038] Federated learning is a framework that allows multiple clients in a distributed environment to collaboratively train a neural network model on a central server. The parameter server initially sends a global model to each participant. After training with local data, participants only need to share the gradient for model updating. The server aggregates the gradient and sends the updated model back to each user. The complex patterns of huge hospital imaging datasets can be encoded in much smaller models. One of the direct advantages of this feature is that it is much more practical to share models than data in a distributed setting. Therefore, sharing models is an important issue in distributed environments involving large amounts of data (e.g., high-resolution images or multi-layer MRI and CT scans). Through gradient inversion attacks, an attacker who eavesdrops on the communication between the client and the server can reconstruct the private data of the client, which is a great threat to the security and privacy protection of federated learning. Therefore, the present application studies the defense method against gradient inversion attacks in federated learning. By taking advantage of the advantages of data augmentation strategies in image generation, the model learns more robust features, effectively improving the generalization ability of the model; at the same time, the constraints on the gradient inversion attack process are enhanced, and an effective defense scenario for federated learning is proposed. The results of the present application show that the defense method based on data augmentation can defend against the most advanced attacks with a small amount of data utility loss.

[0039] Step (1): In the gradient inversion attack scenario, first give a neural network with parameters θ, and a private data batch ( is the real number set; b, d are the batch size and image size) to calculate the gradient This gradient is calculated from the real batch with image x * and label y * The attacker tries to recover the input image and optimize towards the true value x * :

[0040]

[0041] Previous studies have shown that it is feasible to recover the input of the image classification task from the gradient (i.e., gradient inversion). In the process of optimizing it, the optimization objective consists of two parts: Make the gradient of the recovered batch x match the provided gradient , Regularize the recovered image based on image priors;

[0042] Force the gradient of the synthetic data (for the original loss of the neural network) so that the gradient of the recovered batch x is equal to the gradient provided. Perform a match. The reconstructed image is regularized based on image priors, with parameter α used to prevent curve overfitting. Cosine distance is used as... Total variation as get:

[0043]

[0044] Where <·,·> is the inner product between vectors. It is the total variation of the image, and the total variation parameter α TV This refers to α in the above formula, which acts as a constraint on the model parameters. The search for α within the range {0, 0.001, 0.005, 0.01, 0.05, 0.1, 0.5} yields the result. TV The value of is determined by applying α. TV Setting the value to 0.1 reduces the degree of overfitting of the curve and maximizes the model's training accuracy score.

[0045] Step (2): Batch normalization is a technique for training neural networks that normalizes the input of each mini-batch to a single layer. Assume the model has L batch normalization layers. Given a batch of input images x, use x... l Let represent the input features of the l-th BatchNorm layer, where l ∈ [L]. During training, the l-th BatchNorm layer is trained based on the batch mean (xi). l ) and variance var(x l ) for x l The running estimate is normalized and preserves the mean and variance of all training data points, using μ. l and This indicates that during the reasoning process, the following is used: and Normalize the test image. (Omitted for simplicity) (i.e., using μ, σ) 2 express mean(x), var(x) represent During each training phase, the attacker will update x based on (μ, σ) of each batch. 2 Try to infer the mean and variance (mean(x)). * ),var(x * The attacker guesses about the private batch and normalizes it using (mean(x), var(x)). In this case, (μ, σ) 2 This can be used as a priori for the BatchNorm statistic to regularize the recovery, and a regularization term parameter α can be added.BN Prevent BN layer curve overfitting, just as

[0046]

[0047] After searching in {0, 0.0005, 0.001, 0.01, 0.05, 0.01}, apply alpha to all defenses BN = 0.001, so that the degree of curve overfitting is reduced, and the model training accuracy score is higher. BatchNorm statistics that cannot access private batches can weaken the most advanced gradient inversion attacks.

[0048] Step (3): The label information of a single private image can be calculated from the gradient analysis of the layer before the output layer. The present application uses the CIFAR-10 dataset during training, and for different batch sizes, many training samples may have the same label, and the distribution of the label is not uniform, and it cannot be determined how many images belong to the label, therefore, it becomes more difficult to infer the label, and the gradient inversion attack will be weakened.

[0049] Step (4): Since the goal of gradient inversion attack is to recover the training data of the hospital data center, directly protecting the original data before training is an ideal defense strategy. The client can hide private images from the data source, making it difficult to reconstruct private input. These generated samples not only improve the accuracy of the trained model, but also aggregate the original data.

[0050] Step (4-1): The central server of the hospital data center determines a deep learning model as the model for training by each client before the start of federated training, and places it in the central server, and after the start of federated training, the central server will distribute this model to each client. In view of the functional requirements of the defense method, it is assumed that a client has a CIFAR-10 dataset of N private images, for example, in the CIFAR-10 image recognition training task, the data sample format of the dataset is (x i ,y i ), where x i represents the pixel point matrix of the image sample (such as a picture containing a car), and y i represents the label of the sample (i.e. the category to which the image belongs, such as a car). In the process of participating in federated learning, a ResNet-18 model is trained, which is a deep convolutional neural network (DCNN) structure with 18 layers of depth, consisting entirely of convolutional layers and fully connected layers.

[0051] Step (4-2): In order to the characteristic of no information pixels does not exist in the training process, the application adopts a method based on Cutmix data enhancement when protecting the original data, instead of simply deleting pixels, but replacing the deleted area with a patch of another image in the data set, and a schematic diagram of the Cutmix data enhancement method is as shown in Figure 4 ;

[0052] Let and y represent a training image and its label respectively is a real set; W, H, C are image width, height, and color channel number respectively). The goal of Cutmix is to generate a new training sample A by combining two training samples (x A , y B ) and (x B , y W×H ). The generated training sample is used to train the model with its original loss function. The combination operation is defined as

[0053]

[0054]

[0055] where M∈{0,1} x is a binary mask (W, H are image width and height respectively), represents the position of deletion and padding from two images, 1 is a binary mask filled with 1, and is element multiplication. The combination between two data points is λ sampled from Beta(α,α) distribution. Set α to 1, that is, λ is sampled from uniform distribution (0,1);

[0056] In order to sample the binary mask M, first sample the bounding box coordinates B=(r y ,r w ,r h ), which represents the cropped area on x A and x B . Among them, r x ,r y represent the center point coordinates of the frame, and r w ,r h represent the width and height. Remove the area B in x A , and fill it with the patch patch cropped by B in x B . In the experiment, the rectangular mask M is sampled, and its aspect ratio is proportional to the original image. The bounding box coordinates are uniformly sampled according to the following conditions:

[0057] ​

[0058]

[0059] where the Unif() function limits the coordinate region not to exceed the sample size, and r of B is calculated according to the above formula w ,r h , let the clipping area ratio be

[0060]

[0061] For the clipping region, the binary mask M ∈ {0, 1} W×H is determined by filling 0 in the bounding box B, otherwise 1. In each training iteration, two randomly selected training samples are combined into a mini-batch to generate a Cutmix-ed sample

[0062] Step (5): Train the ResNet-18 architecture using the Cutmix data augmentation method on the CIFAR-10 dataset, and generate a global model as the final model of the entire federated task. When training the network architecture, 200 epochs are performed, the batch size is 128, the SGD with momentum of 0.9 is used as the optimizer, the initial learning rate is set to 0.02 by default, and the learning rate is decayed by 0.1 every 50 epochs. A subset of 50 CIFAR-10 images is used to evaluate the attack performance, and the attack Cutmix method involves another step of decoding the private image from the encoded image, where the attack proposed in the paper Is Private Learning Possible with Instance Encoding? (Carlini N, Deng S, Garg Set al. An Attack on InstaHide: Is Private Learning Possible with Instance Encoding? [J]. 2020.) is used as the decoding step. The attacker needs to eavesdrop T times of training instead of a single training step, and T = 20 is set in the experiment. The specific parameters of the decoding step are given to the attacker to evaluate the upper bound of privacy leakage, that is, given a Cutmix image after encoding a private image, assuming that the attacker knows the binary rectangular mask M of the image in the private data set and the combination ratio λ of each private image. After launching the attack, the defense performance of the present application is evaluated, and the gradient clipping defense method mentioned in the paper Deep leakage from gradients (Zhu L, Liu Z, Han S. Deep Leakage from Gradients [J]. 2019.) is compared.

[0063] The classification accuracy of the image recognition model obtained by the gradient inversion attack defense method based on Cutmix data enhancement is better than that of the existing method. Table 1 compares the gradient inversion attack defense method based on Cutmix data enhancement with the existing method, reports the average and best results of the reconstruction quality metric as a proxy for average and worst-case privacy leakage. In the CIFAR-10 image recognition task, the model performance obtained by the method of the present application is improved by 4.62% compared with the traditional gradient clipping based defense, and the loss is reduced by 18%, which has a significant performance improvement. The gradient inversion attack defense method based on Cutmix data enhancement can resist the most advanced attack, and does not cause the problem of more accuracy loss.

[0064] Table 1. Experimental results

[0065]

[0066] The size of the Batchsize is important for the effect of the attack. In the present application, a small and realistic Batchsize size of 16 is used to evaluate the attack to test the upper limit of privacy leakage. Finally, the learned perceptual image patch similarity (LPIPS) score is used to measure the mismatch between the reconstruction and the original image: the higher the value, the less mismatch (less privacy leakage).

[0067] In the embodiments provided by the present application, it should be understood that the disclosed method can be implemented in other ways without exceeding the spirit and scope of the application. The current embodiments are only exemplary and should not be used as limitations. The specific contents given should not limit the purpose of the application.

[0068] The above describes only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A federated learning privacy protection method based on Cutmix data enhancement, when privacy protection is performed on a hospital image data center, characterized in that, Comprising the following steps: Step (1): In the gradient inversion attack scenario, first give a neural network with parameters θ, through private data batch processing For real set; b, d are batch size and image size, calculate the gradient The gradient is calculated from the real batch with image x * And label y * , the attacker tries to recover the input image And optimize towards the true value x * : where: forcing the gradient of the synthetic data, the gradient of the recovered batch x is matched to the provided gradient performing the matching, regularizing the recovered image based on image priors, the parameter a is used to prevent overfitting of the curve; by using the cosine distance as total variation as resulting in: where <·,·> is the inner product between vectors, the gradient is computed from a real batch with images x and labels y, is the total variation of the image, the total variation parameter a TV is a, which limits the model parameters in the above formula, a is searched in {0, 0.001, 0.005, 0.01, 0.05, 0.1, 0.5} TV The value of a is selected to reduce the degree of curve overfitting and the model training accuracy score is the highest TV ; Step (2): The model has L BatchNorm layers; given a batch of input images x, let x l denote the input features of the l-th BatchNorm layer, where l e [L]; during training, the l-th BatchNorm layer normalizes x l according to the batch mean mean(x l ) and variance var(x l ) and keeps running estimates of the mean and variance of all training data points, denoted by μ l and respectively, and normalizes test images during inference with and ; for simplicity, we omit i.e., we denote 2 mean(x), var(x) respectively At each training episode, the attacker attempts to infer the mean and variance (mean(x * ), var(x * )) from (μ, σ 2 ) of each batch while updating x; the attacker makes guesses on the private batch and uses (mean(x), var(x)) to normalize the batch; in this case, (μ, σ 2 ) as the prior of the BatchNorm statistics to regularize the recovery and add a regularization term parameter a BN to prevent the BN layer curve from overfitting, is the batch normalization regularization of images, as​ Wherein a BN After searching in {0, 0.0005, 0.001, 0.01, 0.05, 0.01}, select a that makes the degree of curve overfitting lower, the model training accuracy score higher BN ; Step (3): The label information of the single private image is calculated from the gradient analysis of the layer before the output layer; Step (4): Since the goal of the gradient inversion attack is to recover the training data of the hospital data center, directly protecting the original data before training is an ideal defense strategy; The client hides the private image from the data source, making it difficult to reconstruct the private input; Specifically as follows: Step (4-1): The central server of the hospital data center determines a deep learning model as the model for training of each client before the start of federated training, and places it in the central server. After the start of federated training, the central server will distribute the model to each client; for the functional requirements of the defense method, it is assumed that a client has a CIFAR-10 dataset of N private images, and the i-th data sample is in the format (x i ,y i ), where x i represents the pixel point matrix of the image sample, and y i represents the label of the sample, i.e. the category to which the image belongs; in the process of participating in federated learning, a ResNet-18 model is trained, which is a kind of deep convolutional neural network (DCNN) structure with 18 layers of depth, and is completely composed of convolutional layers and fully connected layers; Step (4-2): When protecting the original data, a method based on Cutmix data enhancement is used, not simply deleting pixels, but replacing the deleted area with a patch of another image in the data set; Let and y represent the training image and its label, respectively, is a real set; W, H, C are the image width, height, and number of color channels, respectively; the goal of Cutmix is to generate a new training sample A , A ) and (x B , B ) by combining two training samples (x The generated training sample is used to train the model with its original loss function; the combination operation is defined as where M e {0,1} W×H denotes a binary mask, W, H are the image width, height, respectively, denotes the positions to remove and pad from the two images, 1 is a binary mask padded with 1 s, is element-wise multiplication; the combination of two data points is sampled from a beta distribution Beta(a,a); set a to 1, i.e. sample from a uniform distribution (0,1); To sample the binary mask M, first sample the bounding box coordinates B = (r x ,r y ,r w ,r h ) representing the cropped region on x A and x B ; where r x ,r y denote the center point coordinates of the box and r w ,r h denote the width and height; remove the region B in x A and fill it with the patch cropped by B in x B ; in the experiment, the aspect ratio of the rectangular mask M is proportional to that of the original image; uniformly sample the bounding box coordinates according to the following conditions: Where, Unif() function limits the coordinate area not to exceed the sample size, and r of B is calculated according to the above formula w ,r h , let the cutting area ratio be For the cropped region, a binary mask M e {0, 1} W×H Decided by filling 0 inside the bounding box B, otherwise 1; in each training iteration, two randomly selected training samples are combined into a mini-batch to generate a Cutmix-ed sample Step (5): Train the ResNet-18 architecture on the CIFAR-10 dataset using the Cutmix data enhancement method, and train the generated global model as the final model for the entire federated task; When training the network architecture, perform 200 epochs, with a batch size of 128, use SGD with a momentum of 0.9 as the optimizer, and set the initial learning rate to 0.02 by default, and reduce the learning rate by 0.1 every 50 epochs.

Images