A federated forgetting method based on malicious terminal intervention training

Abstract

The present application provides a federated forgetting method based on malicious terminal intervention training, which belongs to the technical field of privacy computing and federated learning. The present application eliminates the influence of malicious clients on the global model through federated forgetting, and subtracts the parameter update of the malicious client from the final global model parameter generated by federated learning, so as to continue training with a low-quality model that is theoretically infeasible to save the time of retraining, so that the server can delete the influence of the malicious client more quickly when performing the forgetting operation without seeking the willingness of the client whose contribution is deleted; and a comparison mechanism for judging the effect of the forgetting model of the last round and the effect of the forgetting model of the current round is set to analyze the forgetting effect, so that the forgetting operation is ended in advance to inhibit the influence caused by excessive forgetting of the forgetting model; secondly, a small data set is used to train the last forgetting model to restore the deviation of the model caused by the training process, thereby effectively improving the accuracy of the final forgetting model.

Description

Technical Field

[0001] This invention relates to the fields of privacy computing and federated learning technologies, specifically to a federated forgetting method based on malicious terminal interference training. Background Technology

[0002] With the advent of the big data era, citizens are increasingly concerned about the privacy of their personal data. Relevant laws have also implemented protections for user data security. The General Data Protection Regulation (GDPR) restricts companies' access to user data and strengthens the rights of data owners, granting them the right to delete contributions made by them during training. Federated forgetting, a derivative of federated learning, can remove contributions made by owners exercising their deletion rights during federated learning. This not only allows data owners to train models locally and maintain absolute control over their data but also enables them to smoothly exercise their deletion rights.

[0003] Federated forgetting is an emerging method based on federated learning with strong scalability. In federated learning training, each data owner selected by the server acts as a client, training the model locally and sending the model parameters to the server for aggregation. This process is repeated iteratively to generate the final global model. Traditional federated forgetting methods involve retraining, excluding clients who exercised the deletion right and selecting the remaining clients to re-execute the federated learning process.

[0004] Despite its immense potential in privacy-preserving computing, federated forgetting is still in its early stages, with limited methods available. Furthermore, existing methods suffer from issues such as overly idealized client states, restrictions on forgetting nodes, and the inappropriate use of the aggregated global model during federated learning. All current federated forgetting methods rely on clients possessing high-quality data and voluntarily performing the forgetting operation. Some methods can only execute the forgetting operation in the training epoch where the client requests to delete contributions, which hinders subsequent federated learning. Additionally, existing methods are ineffective at mitigating malicious influence when clients maliciously provide substandard data for federated learning. Summary of the Invention

[0005] To address the aforementioned problems in existing technologies, this invention proposes a federated forgetting method based on malicious terminal intervention training. This method effectively utilizes the global model generated by federated learning, weakens the impact of malicious clients participating in federated learning, and uses the server to perform forgetting operations without considering the degree of cooperation from the client, thereby improving the model's prediction accuracy and indirectly improving the problem of excessive model forgetting.

[0006] To achieve the above objectives, the technical solution of the present invention is as follows:

[0007] A federated forgetting method based on malicious terminal intervention training includes the following steps:

[0008] Step 1: Build a federated learning framework, construct a convolutional neural network model, and set the clients participating in the training as C = {C1, C2, ..., C...} N} and the client's local training data D = {D1, D2, ..., D} N}, where C N This is a malicious client;

[0009] Step 2: Refine the experimental parameter settings, and additionally add the benchmark dataset D. b After being stored on the central server, federated learning training is performed, and the training parameters ΔM updated by the malicious client in each round are recorded in the central server. Finally, the final global model M is obtained. T And perform tests to obtain the predicted score acc(M) T );

[0010] Step 3: Load the final global model M from Step 2 T After updating the parameters with the malicious client, a forgetting operation is performed, and a forgetting model M' is established. T The parameters are set to the final global model parameters minus the parameter updates of the malicious client in each round. At the same time, the forgetting operation is terminated in advance by judging the prediction score of the forgetting model.

[0011] Step 4: Load the forgetting model M' from Step 3 T The forgetting model is trained a specified number of times using a benchmark dataset to recover the model performance deviation caused when performing the forgetting operation, and finally the forgotten model at this time is output as the final model.

[0012] Step 5: Load the model from Step 4, input the test set images used to test the model into the trained final forgetting model, obtain the corresponding prediction scores, and determine the model's performance.

[0013] Furthermore, step 1 specifically includes:

[0014] Step 1.1: For the MNIST dataset, federated learning is performed using a custom network CNNMNIST. First, two convolutional layers and two fully connected layers are defined. The first convolutional layer, Conv1, has an input dimension of 3, an output dimension of 20, a kernel size of 5, and a stride of 1. The second convolutional layer, Conv2, has an input dimension of 20, an output dimension of 50, a kernel size of 3, and a stride of 1. The first fully connected layer, Fc1, maps 1250 dimensions to 500 dimensions; the second fully connected layer, Fc2, maps 500 dimensions to 10 dimensions.

[0015] The specific CNNMNIST model structure is shown below:

[0016] First, convolutional layers are executed. After each convolutional layer finishes running, an activation function and a max-pooling layer are executed. The first convolutional layer, Conv1, is executed first, followed by the second convolutional layer, Conv2. The process is represented by formula (1):

[0017] X = Maxpool(Relu(Conv) i (X)))(1)

[0018] In the formula, X is the input training data; Maxpool is the max pooling layer; ReLU is the activation function; Conv... i Let i be the i-th convolutional layer; i = 1, 2, which represents the index of the convolutional layer.

[0019] After the above process is completed, the view function in Python is used to automatically adjust the input training data X to have 1250 elements in each dimension, as expressed by formula (2):

[0020] X = X.view(-1, 1250)(2)

[0021] Next, the first fully connected layer Fc1 and the second fully connected layer Fc2 are executed respectively, as expressed by formula (3):

[0022] X = Fc j (X)(3)

[0023] In the formula, Fc j This represents the j-th fully connected layer; j = 1, 2, which indicates the index of the fully connected layer.

[0024] Finally, the log_softmax function is used on the input training data X to convert it into probability values, which are expressed by formula (4):

[0025] X = log_softmax(X, dim = 1)(4)

[0026] In the formula, dim=1 converts X into a column.

[0027] For the FMNIST dataset, a custom network, CNNFMNIST, is used for federated learning. CNNFMNIST is similar to CNNMNIST except for having only the first fully connected layer; the first fully connected layer, FMNIST_Fc1, maps 1250 dimensions to 10 dimensions.

[0028] Step 1.2: For malicious client C N This is defined as a data owner whose local data tags contain a large number of errors.

[0029] Furthermore, step 2 specifically includes:

[0030] Step 2.1: Include the correct data, and ensure the data size matches the client's local training data D. N Similar datasets are called benchmark datasets D. b Therefore, the benchmark dataset D is pre-stored on the central server. b This facilitates subsequent correction of performance biases in the forgotten model. Furthermore, since the size of the benchmark dataset is D times that of the local training data... Only a small amount of storage space is needed to completely restore the performance of the forgotten model.

[0031] Step 2.2: The federated learning process refers to each participating client downloading the global model for the current training round from the central server, then using local data to train the global model downloaded from the central server for the current training round, generating a local model; then uploading the updated parameters of the local model to the central server, aggregating them to generate a new round of global model, and iterating repeatedly until the global model converges. The federated learning training process can be represented by formula (5):

[0032]

[0033] In the formula, M t The global model generated in the t-th (t≥1) round of federated learning; N is the total number of clients participating in the training. This indicates that the parameter update generated by the local model of client C in round t.

[0034] Step 2.3: Use test set D t Perform outcome prediction to obtain the model prediction score acc(M) T The testing process can be represented by formula (6):

[0035] acc(M T ) = test(D t M T (6)

[0036] In the formula, test is the test function, and D t and M T As an input variable.

[0037] Furthermore, step 3 specifically includes:

[0038] This invention designs a federated forgetting method for subtracting parameter updates through theoretical derivation. The process is as follows:

[0039] Step 3.1: The global model parameters after each round of aggregation differ from the global model parameters of the previous round by the parameters obtained from the weighted aggregation of the local models of each client in this round. The parameter update ΔM of the global model in round t is... t This can be expressed by formula (7):

[0040]

[0041] Step 3.2: Since the malicious client also participates in the training, the parameter updates of the local models of the high-quality client and the malicious client can be calculated separately. Therefore, the parameter update ΔM of the global model in round t is... t As shown in formula (8):

[0042]

[0043] In the formula, For malicious client C N The parameters generated by the local model in round t are updated.

[0044] Step 3.3: From the perspective of retrained federated forgetting, update the parameters ΔM of the forgetting model in the t-th round. t' It is the aggregation of parameters from N-1 high-quality client-side local models, which can be decomposed into formula (9) through formula simplification:

[0045]

[0046] Then, when the malicious client's parameter update approaches 0, the parameter update of the forgotten model in the t-th round is due to the coefficient. This brings about significant changes and produces certain deviations. To avoid this scenario, assume that the malicious client updates its parameters to 0 in round t, meaning it makes no contribution. The simplified result can be expressed by formula (10):

[0047]

[0048] Step 3.4: Combining formulas (10) and (4), we can obtain the final global model of federated learning by subtracting the parameter updates of the malicious client in each round, which gives us the final forgotten model M'. T It can be expressed by formula (11):

[0049]

[0050] In the formula, T represents the number of training sessions in the last round of the Federation's oblivion.

[0051] Step 3.5: Overall, subtracting the malicious client parameter updates can achieve the goal of making the global model forget the contribution of malicious clients, but it may lead to over-forgetting, which will cause a decrease in model performance. In this process, the effect of forgetting the model is judged to determine whether to terminate the forgetting operation early. When the first round of forgetting operation occurs, the previous round's forgotten model M′... pre For the final global model M T The current round of forgetting model M′ cur Subtract the parameter update of the malicious customer in the first round from the previous forgetting model, as shown in formula (12), until the accuracy of the previous forgetting model is greater than the accuracy of the current forgetting model, indicating that excessive forgetting has occurred, and the forgetting operation can be terminated in advance. The final forgetting model is the previous forgetting model.

[0052]

[0053]

[0054]

[0055] M′ T =M′ pre

[0056] Furthermore, step 4 specifically includes:

[0057] For the final forgetting model M' obtained in step 3.5 T Because model performance deviated during federated forgetting, further model performance fixing is needed. A benchmark dataset D is used. b For the final forgetting model M' T Performing additional m training iterations can enhance the final model's predictive performance.

[0058] Furthermore, step 5 specifically includes:

[0059] Load the final forgetting model trained in step 4, input the test set images used to test the model into the trained final forgetting model, calculate whether the predicted label of the test data matches the actual label, obtain the corresponding prediction score, and determine the performance of the model.

[0060] The beneficial effects of this invention are as follows: This invention eliminates the influence of malicious clients on the global model through federated forgetting, and uses the final global model parameters generated by federated learning to subtract the parameter updates of malicious clients, thereby saving retraining time by continuing to train theoretically unusable low-quality models. This allows the server to remove the influence of malicious clients more quickly when performing forgetting operations without needing to solicit the wishes of the clients whose contributions were deleted. Furthermore, it proposes a comparison mechanism to analyze the forgetting effect by judging the effect of the forgetting model in the previous round and the effect of the forgetting model in the current round, thereby ending the forgetting operation in advance to suppress the influence of the forgetting model caused by excessive forgetting. Secondly, it uses a small dataset to train the final forgetting model, recovering the biases introduced into the model during the training process, effectively improving the accuracy of the final forgetting model. Attached Figure Description

[0061] Figure 1 This is a schematic diagram of the overall structure of the federated forgetting method based on malicious terminal intervention training described in this invention.

[0062] Figure 2 This is a flowchart illustrating the federated forgetting method based on malicious terminal intervention training as described in this invention.

[0063] Figure 3 This is a flowchart illustrating step 2 of the federal forgetting method described in this invention. Detailed Implementation

[0064] The embodiments of the present invention are implemented under the premise of the technical solution of the present invention, and detailed implementation methods and specific operation processes are given. However, the protection scope of the present invention is not limited to the following embodiments.

[0065] This embodiment uses a Windows system as the development environment, PyCharm as the development platform, Python as the development language, and PyTorch as the development framework. It employs the federated forgetting method based on malicious terminal intervention training of this invention to complete label prediction for an image dataset.

[0066] This invention conducted experiments using the MNIST and FMNIST datasets as input data. In this embodiment, using the MNIST dataset as an example, the federated forgetting method for malicious terminal interference training includes the following steps:

[0067] Step 1: Load the custom convolutional neural model and the corresponding benchmark and test datasets into a file such as... Figure 1 In the central server shown;

[0068] Step 2: Configure the client to participate in the training, such as... Figure 1As shown in the image, allocate local data to the client and add appropriate erroneous data to make the server remember the historical parameter updates of the malicious client. Combine this with the environment configuration in step 1 to prepare for training.

[0069] Step 3: The server issues a federated learning command. Each client loads the custom convolutional neural model set in Step 1 as the initial model, trains the initial model using local data to obtain a local model, and then uploads the local model to the server. The server aggregates the local models to obtain a new round of global models. Next, the server subtracts the parameter updates of each round from the malicious client using the final global model parameters and judges the forgetting effect. If the forgetting effect reaches the extreme, forgetting stops and additional training begins to recover the model performance deviation. This invention uses accuracy, which is the ratio of the number of times the image label is accurately predicted to the total number of predicted images when the test set images are used as input, as the model performance evaluation index. Its calculation method can be expressed by formula (13), where Acc is the prediction score of the model, S c and S total These represent the number of times the model made a correct prediction and the total number of predictions, respectively.

[0070]

[0071] Based on the above steps, this invention is compared with methods such as retraining federated learning, federated learning with malicious clients, directly subtracting historical updates from malicious clients, and federated forgetting using knowledge distillation. Table 1 shows that the method proposed in this invention generally outperforms the other methods in terms of accuracy on two common test sets.

[0072] Table 1 Comparison of the performance of each method on the MNIST test set.

[0073]

[0074] In summary, the above description is merely a specific embodiment of the present invention, intended to describe the basic principles, advantages, and objectives of the invention. Those skilled in the art should clearly understand that the present invention is not limited to the above embodiments, and that many more modifications and substitutions can be conceived based on the above description without departing from the precision and scope of the invention. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A federated forgetting method based on malicious terminal intervention training, characterized in that, The method includes the following steps: Step 1: Set up a federated learning framework, construct a convolutional neural network model, and configure the clients participating in the training. and the client's local training data ,in This is a malicious client; for malicious clients This is defined as the data owner whose local data tags contain numerous errors; Step 2: Refine the experimental parameter settings and add a baseline dataset. After being stored on a central server, federated learning training is performed, and the training parameters of the malicious client are updated in each round. Recorded in the central server, the final global model is finally obtained. And conduct tests to obtain predicted scores. ; Step 3: Load the final global model from Step 2 After updating the parameters with the malicious client, perform a forgetting operation to establish a forgetting model. The parameters are set to the final global model parameters minus the parameter updates of the malicious client in each round. At the same time, the forgetting operation is terminated in advance by judging the prediction score of the forgetting model. Step 4: Load the forgetting model from Step 3 The forgetting model is trained a specified number of times using a benchmark dataset to recover the model performance deviation caused when performing the forgetting operation, and finally the forgotten model at this time is output as the final model. Step 5: Load the model from Step 4, input the test set images used to test the model into the trained final forgetting model, obtain the corresponding prediction scores, and determine the model's performance. Step 2 specifically includes: Step 2.1: Include the correct data, and ensure the data size matches the client's local training data. Similar datasets are called benchmark datasets. Pre-store benchmark datasets on a central server. This facilitates subsequent correction of performance biases in the forgotten model; and, since the size of the benchmark dataset is local training data... of Only a small amount of storage space is needed to restore the performance of the forgotten model; Step 2.2: The federated learning process refers to each participating client downloading the global model for the current training round from the central server, then using local data to train the global model downloaded from the central server for the current training round, generating a local model; then uploading the updated parameters of the local model to the central server, aggregating to generate a new round of global model, and iterating repeatedly until the global model converges; the federated learning training process is represented by formula (5): (5) ； In the formula, For the first The global model generated by federated learning. ; The total number of clients participating in the training. Indicates client The local model in the first Parameters generated during the cycle are updated; Step 2.3: Use the test set Perform outcome prediction to obtain the model prediction score. The testing process is represented by formula (6): (6) ； In the formula, It is a test function. and As input variables; Step 3 specifically includes: Step 3.1: The global model parameters after each round of aggregation differ from the global model parameters of the previous round by the parameters obtained from the weighted aggregation of the local models of each client in this round. Round global model parameter update Expressed using formula (7): (7) ； Step 3.2: Since the malicious client also participated in the training, the parameter updates of the local models of the high-quality client and the malicious client are calculated separately. Therefore, the first step... Round global model parameter update As shown in formula (8): (8) ； In the formula, Malicious client The local model in the first Parameters generated during the cycle are updated; Step 3.3: From the perspective of retrained federated forgetting, the forgetting model's first... Wheel parameter update yes The parameters of a high-quality client-side local model are aggregated and simplified into formula (9): (9) ； Then, let the malicious client be at the 1st... The parameters of the wheel are updated to 0, meaning it makes no contribution. The simplified result is expressed by formula (10): (10) ； Step 3.4: Combining formulas (10) and (5), we obtain the final global model of federated learning by subtracting the parameters updated by the malicious client in each round, resulting in the final forgotten model. It can be expressed by formula (11): (11) ； In the formula, The last round of training sessions forgotten by the Federation; Step 3.5: Select the effect of the forgetting model to determine whether to terminate the forgetting operation early. During the forgetting operation, the forgetting model from the previous round is used. For the final global model Current round forgetting model Subtracting malicious customers from the previous forgetting model in the first round The parameters of the round are updated as shown in formula (12) until the accuracy of the forgetting model in the previous round is greater than that in the current round. This indicates that there is an over-forgetting phenomenon, and the forgetting operation is terminated in advance. The final forgetting model is the forgetting model in the previous round. (12)。 2. The federated forgetting method based on malicious terminal intervention training according to claim 1, characterized in that, Step 1 includes: A custom network was used for the MNIST dataset. To perform federated learning, we first define two convolutional layers and two fully connected layers; the first convolutional layer... The first convolutional layer has an input dimension of 3, an output dimension of 20, a kernel size of 5, and a stride of 1; the second convolutional layer... The input dimension is 20, the output dimension is 50, the kernel size is 3, and the stride is 1; the first fully connected layer Mapping 1250 dimensions to 500 dimensions; the second fully connected layer Mapping 500 dimensions to 10 dimensions; Specific The model structure is shown below: First, convolutional layers are executed; after each convolutional layer finishes, an activation function and a max-pooling layer are executed; the first convolutional layer is executed first. Then execute the second convolutional layer. The process is represented by formula (1): (1) ； In the formula, X is the input training data; This is the max pooling layer; For activation functions; For the first One convolutional layer; , represents the index of the convolutional layer; After the above process is completed, use Python's... The function automatically adjusts the input training data X to have 1250 elements in each dimension, as expressed by formula (2): (2) ； Next, the first fully connected layer is executed. and the second fully connected layer It can be expressed by formula (3): (3) ； In the formula, For the first One fully connected layer; , represents the index of the fully connected layer; Finally, the log_softmax function is used on the input training data X to convert it into probability values, which are expressed by formula (4): (4) ； In the formula, Its function is to Convert it into a column.

3. A federated forgetting method based on malicious terminal intervention training according to claim 1 or 2, characterized in that, Step 4 specifically includes: for the final forgetting model obtained in step 3... Using benchmark datasets For the final forgetting model Perform additional Repeated training can enhance the final model's predictive performance.

4. The federated forgetting method based on malicious terminal intervention training according to claim 1, characterized in that, Step 4 specifically includes: for the final forgetting model obtained in step 3... Using benchmark datasets For the final forgetting model Perform additional Repeated training can enhance the final model's predictive performance.

5. A federated forgetting method based on malicious terminal intervention training according to claim 1, 2, or 4, characterized in that, Step 5 specifically includes: loading the final forgetting model trained in step 4, inputting the test set images used to test the model into the trained final forgetting model, and determining the model's performance by calculating whether the predicted labels of the test data are consistent with the actual labels and obtaining the corresponding prediction scores.

6. The federated forgetting method based on malicious terminal intervention training according to claim 2, characterized in that, A custom network was used for the FMNIST dataset. Conduct federated learning; the aforementioned Except for having only the first fully connected layer, the other structures are similar to The same applies to the first fully connected layer. Map 1250 dimensions to 10 dimensions.

Images