Method and device for multi-party joint training model

Abstract

The embodiments of this specification provide a method and device for jointly updating a model, which is applicable to a vertical federated learning architecture, and performs appropriate data interaction based on the technical concept of out-of-order processing of feature members and hidden processing of label data and prediction data by label members. Specifically, a single feature member shuffles the fusion tensor of the intermediate results of each feature member in the sample dimension, and the label member uses the out-of-order fusion tensor for prediction. The label member hides the out-of-order fusion tensor and the label data in the normal order in the disturbed data and provides it to the single feature member, which then feeds back the gradient data of the prediction result in the out-of-order condition, so that the label member updates the global model, and determines the gradient information of the fusion data in the out-of-order condition through the reverse transfer of the gradient and passes it to the feature member, which then updates the local model. In this way, the label can be transmitted in plain text, avoiding malicious labeling of data by label members, and more effectively protecting data privacy.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of secure computing technology, and in particular, to a method and apparatus for multi-party joint training models. Background Art

[0002] With the rapid development of deep learning, artificial intelligence (AI) technology is demonstrating its advantages in nearly every industry. However, big data-driven AI faces many real-world challenges. For example, data silos are rampant, utilization is low, and costs remain high. In some industries, single training teams may face limited or poor data quality. Furthermore, due to industry competition, privacy concerns, and complex management procedures, data integration even between different departments within the same company can face significant resistance and high costs.

[0003] It is in this context that federated learning was proposed. Federated learning is a framework based on distributed machine learning. Its main idea is to build machine learning models based on datasets distributed across multiple devices while preventing data leakage. In this framework, clients (such as mobile devices) collaboratively train models under the coordination of a server. Training data can be retained locally on the client, eliminating the need to upload data to a data center as with traditional machine learning methods. To ensure data privacy during federated learning, it is often necessary to introduce data confidentiality methods and perform reasonable data processing and communication based on these methods. Therefore, how each training member processes and exchanges data, and how to strike a balance between protecting data privacy and reducing communication volume, are key issues in federated learning. Summary of the Invention

[0004] One or more embodiments of this specification describe a method, device, and system for multi-party joint training of a model to solve one or more problems mentioned in the background technology.

[0005] According to a first aspect, a method for multi-party joint training model is provided, which is suitable for scenarios in which multiple training members use their respective local private data to perform longitudinal federated learning, the multiple training members include a first member holding label data and at least one feature member, the model includes local models corresponding to each feature member, and a global model corresponding to the first member, and the at least one feature member includes a second member; the method is executed by the second member, and in the current update cycle of the model, for the current batch of samples, the method includes: fusing the intermediate result ciphertexts corresponding to each feature member to obtain a fused tensor ciphertext, wherein a single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result with a first key, and a single intermediate result is a processing result of a single feature member processing local feature data through a local local model, and the first key is provided by the first member; the fused tensor ciphertext is shuffled in the sample dimension through a shuffling rule f to obtain a shuffled fused ciphertext, and provided to the first member, so that the first member can use the second key corresponding to the first key to decrypt the shuffled fused ciphertext. After the random fusion tensor is obtained, the random fusion tensor is processed based on the global model to obtain a random prediction tensor; a random perturbation prediction tensor and a perturbation label tensor are obtained from the first member, wherein the random perturbation prediction tensor and the perturbation label tensor are respectively obtained by expanding the random prediction tensor in the prediction dimension and the label data in the label dimension, and the position k of the random prediction tensor in the prediction dimension corresponds to the position k of the label data in the label dimension; based on the random rule f, the perturbation label tensor, and the random perturbation prediction tensor, the global random gradient corresponding to the random perturbation prediction tensor is determined by comparison; an oblivious transfer protocol is executed with the first member, and the first member securely selects a first sub-random gradient at position k from the global random gradient, so that the first member uses the reverse transfer of the first sub-random gradient to update the global model, and feeds back the second sub-random gradient corresponding to the random fusion ciphertext; the local second local model is updated using the second sub-gradient obtained by sequentially restoring the second sub-random gradient in the sample dimension based on the random rule f.

[0006] In one embodiment, the at least one feature member includes a third member corresponding to a third local model, and the method further includes: determining a third sub-gradient of the intermediate tensor corresponding to the third member based on the second sub-gradient and the fusion method of each intermediate result ciphertext; and providing the third sub-gradient to the third member so that the third member uses the third sub-gradient to update the third local model.

[0007] In one embodiment, the fusion method of fusing the intermediate result ciphertexts corresponding to the feature members includes one of the following: summation and weighted average.

[0008] In one embodiment, the comparison and determination of the global disorder gradient corresponding to the disordered perturbation prediction tensor based on the disorder rule f, the perturbation label tensor, and the disordered perturbation prediction tensor includes: disordering the perturbation label tensor based on the disorder rule f to obtain a disordered perturbation label tensor; comparing the disordered perturbation label tensor with the perturbation label tensor to obtain a model loss; and determining the global disorder gradient according to the partial derivative of the model loss for each element in the disordered perturbation prediction tensor.

[0009] In one embodiment, the sequential restoration of the second sub-random gradient in the sample dimension based on the random rule f includes: determining the inverse random rule f of the random rule f -1 ; Use the reverse order rule f -1 The second sub-random gradient is sequentially adjusted in the sample dimension.

[0010] In one embodiment, the oblivious transfer protocol is executed with the first member, and the first member securely selects a first sub-random gradient at position k from the global random gradient, including: dividing the global random gradient into P messages in sequence according to the dimension occupied by the prediction tensor in the prediction dimension; and executing the oblivious transfer protocol with the first member, and the first member selecting the kth message from the P messages.

[0011] According to the second aspect, a method for multi-party joint training model is provided, which is suitable for scenarios in which multiple training members use their respective local privacy data for longitudinal federated learning, the multiple training members include a first member holding label data and at least one feature member, the model includes local models corresponding to each feature member, and a global model corresponding to the first member, and the at least one feature member includes a second member; the method is executed by the first member, and in the current update cycle of the model, for the current batch of samples, the method includes: obtaining a random fusion ciphertext from the second member, wherein the random fusion ciphertext is obtained by fusing the intermediate result ciphertexts corresponding to each feature member by the second member and then randomizing them according to the random rule f, a single intermediate result is a processing result of a single feature member processing local feature data through a local local model, and a single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result by a first key, and the first key is provided by the first member; the random fusion ciphertext is decrypted into a random fusion tensor using the second key, and the second key is used to decrypt the random fusion ciphertext into a random fusion tensor. The key is used to decrypt the data encrypted by the first key; the disordered fusion tensor is processed based on the global model to obtain a disordered prediction tensor; the disordered prediction tensor is expanded in the prediction dimension and the label data is expanded in the label dimension to obtain a disordered perturbation prediction tensor and a perturbation label tensor, and the perturbation label tensor is provided to the second member, wherein the position k of the disordered prediction tensor in the disordered perturbation prediction tensor corresponds to the position k of the label data in the perturbation label tensor, so that the second member can feedback the global disordered gradient for the disordered perturbation label tensor based on the disorder rule f, the disordered perturbation prediction tensor, and the perturbation label tensor; the oblivious transfer protocol is executed with the second member to securely select the first sub-disordered gradient at position k from the global disordered gradient; the reverse transfer of the first sub-disordered gradient is used to update the global model and determine the second sub-disordered gradient corresponding to the disordered fusion ciphertext; the second sub-disordered gradient is provided to the second member, so that the second member can update the local second local model based on the disorder rule f and the second sub-disordered gradient.

[0012] In one embodiment, the first member also corresponds to first feature data and a first local model, and the method further includes: using the first local model and the updated global model to sequentially process the first feature data of the first batch of samples to obtain a first prediction tensor; determining the local model loss based on a comparison between the first label data corresponding to the first batch of samples and the first prediction tensor; adjusting the undetermined parameters in the first local model in a direction in which the local model loss is reduced, thereby updating the first local model.

[0013] In a further embodiment, the first batch of samples is consistent with the samples of the current batch, the intermediate result obtained by the first local model processing the first feature data of the current batch is the first intermediate result, and the first feature data of the first batch of samples is processed in sequence by the first local model and the updated global model to obtain the first prediction tensor: the first intermediate result is processed by the updated global model to obtain the first prediction tensor.

[0014] In one embodiment, the fusion method of the second member for fusing the intermediate result ciphertexts corresponding to the feature members includes one of the following: summation and weighted average.

[0015] In one embodiment, the out-of-order perturbation prediction tensor / perturbation label tensor is expanded in the following manner: randomly generating perturbation data consistent with the volume of P-1 prediction tensors / label data within the value range corresponding to the prediction value / label value; arranging the perturbation data and the prediction tensor / label data along the prediction dimension / label dimension to form the out-of-order perturbation prediction tensor / perturbation label tensor, wherein the perturbation data and the prediction tensor / label data are arranged at position k.

[0016] According to the third aspect, a method for multi-party joint training model is provided, which is suitable for a scenario in which a first member holding label data and a second member holding feature members conduct vertical federated learning, the model including a local model corresponding to the second member and a global model corresponding to the first member; in the current update cycle of the model, for the current batch of samples, the method includes: the second member uses the local model to process local feature data to obtain an intermediate result; the intermediate result is scrambled in the sample dimension through the scrambling rule f to obtain a scrambled intermediate result, and is provided to the first member; the first member processes the scrambled intermediate result based on the global model to obtain a scrambled prediction tensor; the first member expands the scrambled prediction tensor in the prediction dimension and the label data in the label dimension by the same multiples to obtain scrambled perturbation prediction tensors respectively. The measurement tensor and the perturbation label tensor are provided to the second member, wherein the position k of the out-of-order prediction tensor in the prediction dimension corresponds to the position k of the label data in the label dimension; the second member compares and determines the global out-of-order gradient corresponding to the out-of-order perturbation prediction tensor based on the out-of-order rule f, the perturbation label tensor, and the out-of-order perturbation prediction tensor; the first member and the second member execute the oblivious transfer protocol, so that the first member safely selects the first sub-out-of-order gradient at position k from the global out-of-order gradient, and uses the reverse transfer of the first sub-out-of-order gradient to update the global model, and feeds back the second sub-out-of-order gradient corresponding to the out-of-order intermediate result; the local model is updated using the second sub-gradient obtained by sequentially restoring the second sub-out-of-order gradient in the sample dimension based on the out-of-order rule f.

[0017] According to a fourth aspect, a device for a multi-party joint training model is provided, suitable for scenarios in which multiple training members use their respective local private data to perform longitudinal federated learning. The multiple training members include a first member holding labeled data and at least one feature member. The model includes local models corresponding to the feature members and a global model corresponding to the first member. The at least one feature member includes a second member. The device is provided on the second member and includes a fusion unit, a shuffling unit, an acquisition unit, a gradient determination unit, a secure transfer unit, and an update unit. During the current update cycle of the model, for the current batch of samples:

[0018] The fusion unit is configured to fuse the intermediate result ciphertexts corresponding to the respective feature members to obtain a fused tensor ciphertext, wherein the individual intermediate result ciphertext is obtained by encrypting the corresponding intermediate result using a first key, the individual intermediate result being a result of processing local feature data of a single feature member using a local local model, and the first key being provided by the first member;

[0019] The scrambling unit is configured to scramble the fused tensor ciphertext in the sample dimension according to the scrambling rule f to obtain a scrambled fused ciphertext, and provide the scrambled fused ciphertext to the first member, so that the first member decrypts the scrambled fused ciphertext into a scrambled fused tensor using a second key corresponding to the first key, and then processes the scrambled fused tensor based on the global model to obtain a scrambled prediction tensor.

[0020] The acquisition unit is configured to acquire a disordered perturbation prediction tensor and a perturbation label tensor from the first member, wherein the disordered perturbation prediction tensor and the perturbation label tensor are respectively obtained by expanding the disordered prediction tensor in a prediction dimension and the label data in a label dimension, and a position k of the disordered prediction tensor in the prediction dimension corresponds to a position k of the label data in the label dimension;

[0021] The gradient determination unit is configured to compare and determine a global out-of-order gradient corresponding to the out-of-order perturbation prediction tensor based on the out-of-order rule f, the perturbation label tensor, and the out-of-order perturbation prediction tensor;

[0022] The secure transfer unit is configured to perform an oblivious transfer protocol with the first member, whereby the first member securely selects a first sub-random gradient at position k from the global random gradient, so that the first member updates the global model using the reverse transfer of the first sub-random gradient, and feeds back a second sub-random gradient corresponding to the random fusion ciphertext;

[0023] The updating unit is configured to update the local second local model using a second sub-gradient obtained by sequentially restoring the second sub-random gradient in the sample dimension based on the random rule f.

[0024] According to a fifth aspect, a device for a multi-party joint training model is provided, suitable for scenarios in which multiple training members use their respective local private data to perform vertical federated learning. The multiple training members include a first member holding labeled data and at least one feature member. The model includes local models corresponding to the feature members and a global model corresponding to the first member. The at least one feature member includes a second member. The device is provided on the first member and includes a communication unit, a decryption unit, a prediction unit, an expansion unit, a secure acquisition unit, and a gradient transfer unit. During the current update cycle of the model, for the current batch of samples:

[0025] The communication unit is configured to obtain a random fusion ciphertext from the second member, wherein the random fusion ciphertext is obtained by the second member fusing the intermediate result ciphertexts corresponding to the respective feature members and then randomizing them according to the random rule f, wherein the single intermediate result is a processing result of the local feature data of the single feature member through the local local model, and the single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result by using a first key, wherein the first key is provided by the first member;

[0026] The decryption unit is configured to decrypt the scrambled fusion ciphertext into a scrambled fusion tensor using a second key, where the second key is used to decrypt data encrypted by the first key;

[0027] The prediction unit is configured to obtain an out-of-order prediction tensor by processing the out-of-order fusion tensor based on the global model;

[0028] The expansion unit is configured to expand the out-of-order prediction tensor in the prediction dimension and the label data in the label dimension to obtain an out-of-order perturbation prediction tensor and a perturbation label tensor, respectively, and provide them to the second member, wherein the position k of the out-of-order prediction tensor in the out-of-order perturbation prediction tensor corresponds to the position k of the label data in the perturbation label tensor, so that the second member can feedback the global out-of-order gradient for the out-of-order perturbation label tensor based on the out-of-order rule f, the out-of-order perturbation prediction tensor, and the perturbation label tensor;

[0029] The secure acquisition unit is configured to execute an oblivious transfer protocol with the second member to securely select a first sub-random gradient at position k from the global random gradient;

[0030] The gradient transfer unit is configured to update the global model and determine the second sub-random gradient corresponding to the random fusion ciphertext by using the reverse transfer of the first sub-random gradient;

[0031] The communication unit is further configured to provide the second sub-random gradient to the second member, so that the second member updates a local second local model based on the random rule f and the second sub-random gradient.

[0032] According to a sixth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect or the second aspect.

[0033] According to the seventh aspect, a computing device is provided, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

[0034] Through the method and apparatus provided in the embodiments of this specification, under the vertical federated learning architecture, a single feature member provides the fusion tensor of the intermediate results of each feature member to the label member after shuffling the sample dimension. The label member makes a prediction under the shuffled fusion tensor to obtain a shuffled prediction tensor. Afterwards, the label member hides the shuffled prediction tensor and the label tensor in the corresponding consistent position into the disturbed data and provides it to the feature member that was previously shuffled. The feature member that is shuffled compares the model loss, i.e., the gradient data, under the shuffled condition, and securely passes the shuffled gradient data to the first member via the OT protocol. The first member uses the shuffled gradient data to update the global model, and determines the gradient data of the shuffled fusion tensor to be passed to the feature member that is shuffled via the reverse transfer of the gradient. In this way, the feature member can obtain the gradient data of each intermediate result based on the gradient data of the fusion tensor via the reverse transfer of the fusion method, and then can update the local local model and pass the gradient information of the intermediate result to other feature members other than the first member.

[0035] In this way, based on the disordered processing of feature members and the hidden processing of label data and prediction data by label members, appropriate data interaction can be used to enable the transmission of labels in plain text, avoiding the leakage of data privacy caused by malicious labeling of data by label members, thereby reducing data communication volume while protecting data privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 This is a schematic diagram of the system architecture of each training member under the vertical federated learning architecture;

[0038] Figure 2 This is a schematic diagram of the model architecture of each training member under the vertical federated learning architecture;

[0039] Figure 3 A schematic diagram illustrating an interactive process of a single model update cycle of a multi-party joint training model according to an embodiment of this specification;

[0040] Figure 4 A schematic diagram illustrating a process flow of a multi-party joint training model performed by tag members according to one embodiment of the present specification;

[0041] Figure 5 A schematic diagram illustrating a process flow of a multi-party joint training model performed by out-of-order feature members according to one embodiment of the present specification;

[0042] Figure 6 A schematic block diagram illustrating a device for a multi-party joint training model of tag members according to an embodiment of the present specification;

[0043] Figure 7 A schematic block diagram of an apparatus for a multi-party joint training model performed by out-of-order feature members according to an embodiment of the present specification is shown. DETAILED DESCRIPTION

[0044] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0045] Federated Learning, also known as federated machine learning, joint learning, or alliance learning, is a machine learning framework that effectively helps multiple organizations use data and conduct machine learning modeling while meeting user privacy, data security, and regulatory requirements.

[0046] Specifically, suppose that companies A and B each build a task model. A single task could be classification or prediction, and these tasks have already been approved by their respective users when data was obtained. However, due to incomplete data—for example, company A lacks labeled data, company B lacks user feature data, or the data is insufficient, with insufficient sample size to build a good model—then the model on each end may not be built or may not perform well. Federated learning addresses the problem of building high-quality models on each end. These models are trained using data from both companies, while keeping each company's proprietary data private. In other words, a shared model is established without violating data privacy regulations. This shared model is like a superior model built by aggregating data from each party. In this way, the built model serves only the specific objectives of each party within their region.

[0047] Each institution in federated learning can be referred to as a training member (or data entity, etc.). Each training member can hold different business data and can participate in joint model training through devices, computers, servers, and so on. Business data here can include various types of data, such as text, images, audio, animation, and video. Typically, the business data held by each training member is related, and the business entities corresponding to each training member are also related. For example, among multiple business entities involved in financial services, Business Entity 1 is a bank that provides savings and loan services to users and may hold data such as user income and expenditure records, loan limits, and deposit limits. Business Entity 2 is a shopping website that holds data such as user shopping habits, payment habits, and payment accounts. Another example is that among multiple business entities involved in medical services, each business entity can be a hospital, medical examination institution, etc. For example, Business Entity 1 is Hospital A, which holds local business data such as user symptoms, diagnosis results, treatment plans, and treatment results. Business Entity 2 can be Medical Examination Institution B, which holds medical examination records such as user symptoms and medical examination conclusions. A single training member of federated learning can hold the business data of one business party or multiple business parties.

[0048] In a federated learning architecture, two or more data providers can jointly train a model. These models can be any type of model used to process business data and produce corresponding business processing results, also referred to as business models. For example, the business data could be a user's financial data, and the resulting business processing result could be a financial credit assessment of the user. Another example could be a user's customer service conversation data, and the resulting business processing result could be a recommended customer service answer, and so on. Each training participant can perform local data processing on their local business data using their local business model. The goal of federated learning is to train a model that can better process this business data, so the federated learning model can also be referred to as a business model.

[0049] Federated learning can be categorized into horizontal and vertical federated learning. In a horizontal federated learning architecture, the sample features of different training members' sample sets overlap significantly, but the sample sources vary. For example, multiple sample sets may represent customers of different banks. While data features managed by different banks may be similar, the customers may differ. Therefore, if each training member holds business data from different banks, a horizontal federated learning approach can be used to train the model. In vertical federated learning, different datasets may have high ID overlap (for example, identical phone numbers), but different features. For example, a bank and a hospital serving the same user base (e.g., residents of a small county town) may share a high degree of overlap in their samples, but their features may differ. The bank data may represent features such as deposits and loans, while the hospital data may represent features such as physiological indicators, health status, and medical records. In this case, training members holding business data from the bank and hospital, respectively, can use a vertical federated learning approach to jointly train the model.

[0050] The technical solution provided in this specification proposes improvements to the model training method under the vertical federated learning architecture.

[0051] Vertical federated learning can also be called vertical segmentation learning, split learning, etc. Figure 1 A specific implementation architecture of vertical federated learning is shown. Under this implementation architecture, the feature data of the training samples are distributed among some (usually the majority) or all training members, and the label data is usually held by a few (such as one) training members. For the sake of convenience, this specification may refer to the training members holding the feature data as feature members (such as Figure 1 Training members 1, training members 2, ... training members n, etc.), the training members holding label data are called label members (such as Figure 1 Specifically, each feature member can hold partial feature data of a training sample, such as the first feature data, the second feature data, and so on. For a training sample, the first feature data can be associated with training member 1, the second feature data can be associated with training member 2, and so on, and the nth feature data can be associated with training member n, and label data can be associated with training member X. Specifically, training member X can be any one of training member 1, training member 2, and so on. That is, in some examples, training member X can hold both partial feature data and label data.

[0052] Further, Figure 2 The model architecture diagram of vertical federated learning is shown in Figure 2. Figure 2As shown in the figure, for vertical federated learning scenarios, the business model is usually divided into two parts: one is the local model held by each feature member, which is used to process local feature data to obtain intermediate results; the other is the global model held by the label member, which is used to process the intermediate results of each training member to obtain the final global output result (prediction result). Each feature member can provide the intermediate result data obtained by processing the local feature data with the local model to the label member. The label member can then use the global model to process the intermediate results to obtain the global prediction result.

[0053] on the other hand, Figure 2 The dotted arrow also shows the back propagation path of the parameter gradient in the model. After the label member obtains the global prediction result (i.e., the global output), it can be compared with the local label data to obtain the current model loss. Then, the label member determines the gradient of each undetermined parameter in the global model according to the model loss (the partial derivative of the model loss with respect to the undetermined parameter) to update the global model. In addition, the global model can be used to determine the gradient of each intermediate result. The label member feeds back the gradient of each intermediate result to the corresponding feature member, and the feature member uses the back propagation of the gradient of the intermediate result to determine the gradient of each undetermined parameter in the corresponding local model to update the undetermined parameters in the local local model.

[0054] When a training member holds both label data and partial feature data, it can hold both a global model and a local model that processes local feature data. In this case, the portion processing feature data using the local model serves as the feature member, while the portion performing global processing by comparing the global model's predictions with the label data serves as the label member. In other words, the training member serves as both a feature member and a label member. Furthermore, the intermediate data obtained by the feature member can be directly used by the label member, without requiring communication.

[0055] Because there is forward intermediate result and backward gradient transmission between feature members and label members in the vertical federated learning architecture, the amount of data transmitted is proportional to the sample size. The larger the amount of data, the greater the communication transmission volume. Moreover, calculations in a secret space require a large amount of encryption and decryption calculations, which slows the training speed and requires high computing power. In addition, in some implementation plans, in order to reduce the amount of data communication, data may be obfuscated by methods such as disorder. However, since it is impossible to check the plaintext when performing secret calculations, if the training members use methods such as labeling the data (such as the relationship between the label and the sample marked by the training members holding the label) to maliciously obtain the private data of the other party, it may cause the leakage of the obfuscated mapping (such as the disordered mapping) because it cannot be detected, and thus data privacy cannot be guaranteed.

[0056] In view of this, this specification provides a new technical concept of a multi-party joint training model, which is suitable for a multi-party secure computing architecture for vertical federated learning.

[0057] Under the technical concept provided in this specification, a feature data holder (non-label holder, such as training member a) fuses the intermediate result data of feature processing of each party and shuffles them in the sample dimension, and the label holder processes the fused data after shuffling to obtain a shuffled global output, and then hides the label data and the global output in their respective corresponding disturbed data and provides them to the training member a. The training member a maintains the order consistency of the global output and the label data (such as both are shuffled data) based on the shuffling rule, thereby determining the model loss and the shuffled gradient of the model loss to the shuffled global output. Furthermore, the label holder can update the global model through the shuffled gradient, and determine the gradient (partial derivative) of the model loss to the shuffled fusion data through the reverse transfer of the gradient. In this way, training member a obtains the gradient of the disordered fusion data, and can obtain the gradient of the fusion data in the correct order according to the gradient of the disordered fusion data through the inverse operation of the disorder. Then, on the one hand, training member a updates the local local model through the reverse transfer of the gradient of the fusion data in the correct order. On the other hand, training member a can provide the gradient data of the corresponding intermediate results to other feature holders (excluding label holders) according to the gradient of the fusion data in the correct order, and other feature holders each update their local local models.

[0058] In particular, when the label holder is also the holder of some features, the label holder can process local training samples through the local local model and the updated global model (which carries information about other parties' data), determine the model loss locally, and consider the global model as a whole (temporarily assuming that it has no undetermined parameters). After the gradient of the model loss is back-propagated, the gradient of each undetermined parameter in the local local model is determined, and each undetermined parameter in the local model is updated, thereby updating the local local model.

[0059] Since the label holder hides the real label data in the perturbation data, there is no need for multiple data transmissions during the multi-party secure computing process, which improves communication efficiency. In addition, the label data received by the out-of-order training members are all plain text, which makes it easy to check whether the data is labeled and prevent label members from maliciously labeling (for the purpose of obtaining the privacy of other members).

[0060] It should be noted that the model update mentioned in this specification generally refers to the update of the values of the undetermined parameters in the model.

[0061] The following is combined with Figure 3 The technical concept of this specification is described in detail.

[0062] Please refer to Figure 3 As shown in FIG, the interaction process of the joint update model in an embodiment is given. Figure 3 Before describing, the multi-party secure computation is described as follows: The participants of the joint update model include at least a first member and a second member, wherein the first member is the one holding the tag data (denoted as Y A ) members, the second member holds some feature data (denoted as X B ). And, the first member corresponds to the global model M L , the second member holds the local model M B , the second member acts as the disorder party and can determine a disorder rule f at any appropriate time.

[0063] The above is the basic structure of the technical concept used in this specification. Considering that there may be some other situations that may occur in practice, Figure 3 In the figure, it is also shown that the first member contains characteristic data X A , local model M A , and there are other characteristic members, such as the third member (corresponding to characteristic data X C , local model M C ) In the case where the federated learning architecture also includes other feature members, the first member may also correspond to the first key P k , the second key S k The public-private key pair (P k , S k ). The second member can obtain a key in the public-private key pair from the first member at any appropriate time, such as the first key P k (It can be considered that the first key P k As a public key), other feature members can obtain the first key P from the first member or the second member at any appropriate time. k .

[0064] In order to fully describe the possible interaction processes and effects of the implementation architecture of this specification, Figure 3 It is worth noting that based on the most basic implementation architecture above, which only includes the first member holding the label data and the second member holding the feature data, in a single model update cycle, at least Figure 3 The solid lines show steps 312, 330, 304, and the related operations described in steps 306 to 3130 to achieve the corresponding technical effects. In other cases, the corresponding steps shown in dotted lines are added. Figure 3The description focuses on the interactive process shown in steps 312, 330, 304, and 306 to 3130. Furthermore, the feature data and label data described in the following steps can be pre-aligned by each training member through methods such as private intersection or trusted third-party-assisted sorting (i.e., the corresponding samples and arrangement order in the sample dimension are consistent). In one training cycle, a batch of samples, for example, n samples, can be processed.

[0065] First, in step 312, the second member uses the local model M B Processing feature data X B , and get the intermediate result H B .

[0066] Among them, the local model M B It can be any machine learning model that can process feature data, such as Figure 2 The multi-layer full neural network shown in the figure is generally a multi-dimensional (such as m-dimensional) vector after processing the feature data of a sample. The processing result of n sample data can be recorded in the form of a tensor, such as an n×m-dimensional tensor, and the processing result can be used as an intermediate result. It can be understood that when the processing result of n sample data is an n×m-dimensional tensor, each row in the tensor corresponds to a sample, and the direction along the tensor row (vertical) can be called the sample dimension. Similarly, if the intermediate result is described by an m×n-dimensional tensor, the direction of the tensor column (horizontal) can be called the sample dimension, and this specification does not limit this.

[0067] It is understandable that, when other feature members (such as the first member, the third member, etc.) are included, each feature member can process the local feature data through a local local model to obtain a corresponding intermediate result. At this time, since the second member holds the disorder rule f under the technical concept of this specification, each feature member can provide the local intermediate result to the second member for fusion. In order not to leak the data information of each feature member, each feature member can encrypt the local intermediate result, thereby providing an intermediate result ciphertext.

[0068] The first key P k The first member can provide the first key P alone. k , you can also Figure 3 The process shown is provided together with other data during execution. In the case of providing it separately, it can be provided in advance. In addition, the first key P k It can be used uniformly in each model update cycle, or it can be updated every predetermined number (such as one) of model update cycles. k The encrypted data ciphertext can be obtained through the second key Sk Decryption, and through the first key P k or the second key S k The encrypted data cannot be encrypted by the first key P k Decryption.

[0069] So, like Figure 3 As shown, in the case where the first member also holds feature data, the process may further include steps 311 and 321 performed by the first member. In step 311, the first member uses the local model M A Processing feature data X A , and get the intermediate result H A , and pass the first key P k Encrypt the intermediate result H A , get the corresponding intermediate result ciphertext <H A Then, through step 321, the first member provides the intermediate result ciphertext to the second member <H A >.

[0070] On the other hand, when the training members participating in the federated learning also include a third member as a feature member in addition to the first member and the second member, the process may further include steps 313 and 323 performed by the third member. In step 313, the third member uses the local model M C Processing feature data X C , and get the intermediate result H C , and pass the first key P k Encrypt the intermediate result H C , get the corresponding intermediate result ciphertext <H C Then, via step 323, the third member provides the intermediate result ciphertext to the second member. <H C >.

[0071] The process in which the first member or the third member uses the local local model to process the local feature data to obtain the intermediate result is similar to that of the second member and will not be repeated here.

[0072] Next, in step 330, the second member may shuffle the fused tensor H obtained by fusing the intermediate results corresponding to the respective feature holders using the shuffling rule f to obtain a shuffled fused tensor.

[0073] Among them, when the feature member only includes the second member, the fusion tensor H is the intermediate result H B , the intermediate result H at this time B It can be plain text data. In the case where the feature member also includes other members such as the first member or the third member, the other feature members need to provide the corresponding intermediate result ciphertext to the second member, and the fusion result H is in the form of ciphertext. <h>exists, such as being recorded as fused tensor ciphertext. At this time, before proceeding to step 330, the second member can also k Encrypt the intermediate result H B , get the corresponding intermediate result ciphertext <H B In the case of >, the intermediate result ciphertexts are homomorphically fused under the secret state. In the homomorphic encryption method, the fusion result of the intermediate result ciphertexts is consistent with the ciphertext of the fusion result of the intermediate results, which is called the fused tensor ciphertext. <h>.

[0074] In the process of fusing multiple intermediate ciphertexts, the second member can use a predetermined fusion rule such as summation, weighted average (including mean), or a differentiable neural network such as a linear neural network for fusion, which is not limited here. Taking summation as an example, the fusion tensor is: H = H A +H B +H C ; The fused tensor ciphertext is recorded as: <h>= <H A >+ <H B >+ <H C >.

[0075] As the name suggests, the shuffle rule f is a mapping rule that shuffles the order of data, for example, the original first row becomes the third row (1→3), the original second row becomes the fifth row (2→5), the original third row becomes the second row (3→2), and so on. In one embodiment, the mapping rule can be described by a vector, for example (3, 1, 4, 2) T , describes a rule for reordering the rows of a tensor, so that the first row of the new tensor is the third row of the original tensor, the second row of the new tensor is the first row of the original tensor, and so on. When each intermediate result is in the form of a two-dimensional tensor, a single row or column corresponds to a single sample, and the direction perpendicular to the row, that is, the vertical or horizontal direction, is the sample dimension.

[0076] The second member can perform a random operation on the sample dimension according to the random rule f, thereby randomizing the fused tensor H. In the case where there are other feature members besides the second member, the randomization of the fused tensor H can be achieved by performing a random operation on the fused tensor ciphertext <h>In this way, the vector corresponding to a single sample can be kept unchanged, and other parties cannot match the fused data (such as the fused tensor or its ciphertext after the shuffle) with the sample according to the sample order, so that the fusion information of a single sample will not be leaked after the shuffle. The fused tensor after the shuffle can be recorded as H f , then the random fusion tensor ciphertext can be recorded as <H f >.

[0077] Next, at step 340, the second member may provide the out-of-order fused tensor H to the first member. f , or random fusion tensor ciphertext <H f >.

[0078] The second member provides the scrambled fusion tensor ciphertext <H f >In the case of the first member, the first member can use the second key S in step 350 to k Decryption <H f >, get the out-of-order fusion tensor H f .

[0079] Further, via step 360, the first member can use the global model M L Processing out-of-order fusion tensor H f , get the out-of-order prediction tensor y f Here, it is called the out-of-order prediction tensor y f , is because the order of the prediction results in the sample dimension is disrupted relative to the initial sample order. That is, the prediction result y f In the sample dimension, the order is based on the order rule f, and the subscript f is used here to describe this order.

[0080] It can be understood that in scenarios such as binary classification, the prediction tensor can be a vector with the same dimension as the number of samples in the current batch (such as n), and a single element in the vector corresponds to a single sample. In scenarios such as multi-task, the prediction tensor can be a two-dimensional tensor (i.e., a tensor), corresponding to the sample dimension and the prediction dimension. On a single row / column of the sample dimension, it is a multi-task prediction value for a single sample. Since the prediction result corresponds to the label data, the label data can also have a similar structure to the prediction result, corresponding to the sample dimension and the label dimension. Here, the prediction result is recorded as the out-of-order prediction tensor y f In the case of , the label data can be recorded as the label tensor Y A .

[0081] Since the label tensor Y A It is arranged according to the initial order of the current batch of samples, and the disordered prediction tensor y f The sample dimension is disordered, and the first member does not know the disorder rule. Therefore, during the model update process, the first party cannot directly use the label tensor Y A with the out-of-order prediction tensor y f Compare and determine the model loss.

[0082] To this end, under the technical concept of this specification, the first member transforms the label tensor Y A with the out-of-order prediction tensor y f Keep the sample dimension unchanged, generate perturbed data in another prediction dimension or label dimension, and convert the label tensor Y A with the out-of-order prediction tensor y f It is hidden in the corresponding disrupted data and provided to the holder of the disrupted rule, such as the second member, who completes the comparison between the label tensor and the prediction tensor based on the disordered rule f.

[0083] Under this concept, through steps 370 and 380, the first member predicts the tensor y in disorder f , label tensor Y A Expand by perturbing the data in the prediction dimension or label dimension, and expand to the disordered perturbation prediction tensor y fp and the perturbation label tensor Y Ap Provided to the second member.

[0084] Here, the subscript P indicates that the volume is expanded to P times the original volume (P can be an integer greater than 1), or the dimension of the label dimension / prediction dimension (P is greater than the dimension of the label tensor in the label dimension). For example, the original label tensor Y A Is a column vector, after expansion, there are P column vectors, and the other P-1 column vectors can be randomly sampled in an optional value range (such as 0 or 1). Among them, the out-of-order prediction tensor y f , label tensor Y A The expanded two-dimensional tensors are recorded as the disordered perturbation prediction tensor y fp and the perturbation label tensor Y Ap . Out-of-order prediction tensor y f Expanded on the prediction dimension, the label tensor Y A The expansion is performed on the label dimension, and the dimension of the sample dimension remains unchanged after expansion.

[0085] Out-of-order prediction tensor y f Perturb the prediction tensor y in out of order fp The relative position on the prediction dimension and the label data Y A Perturbing the label tensor Y Ap The relative position on the label dimension should remain consistent, such as denoted as position k. In one embodiment, position k can be a fixed value, for example, when describing the relative position, the tensor y can be predicted in an out-of-order manner. f or label tensor Y A The volume size will disrupt the prediction tensor y fp and the perturbation label tensor Y Ap Each is considered as P units, each unit corresponds to a relative position, and the relative position k represents the kth unit in P units. For example, the label tensor Y A is a two-dimensional tensor of n×3, then the expanded perturbation label tensor Y Ap It is a two-dimensional tensor of n×3P, the label tensor Y A The positions occupied are from column 3(k-1)+1=3k-2 to column 3k (3 columns in total, with a volume of n×3). In another embodiment, the disordered perturbation prediction tensor y fp and the perturbation label tensor Y Ap Not out-of-order prediction tensor y f , label tensor Y A If k is an integer multiple of , then k can represent a range or multiple scattered positions of the prediction dimension / label dimension, such as the 3rd to 5th columns, or two scattered positions of the 3rd and 6th columns.

[0086] The first member predicts the tensor y f , label tensor Y A Expand by perturbing the data in the prediction dimension or label dimension and provide the perturbed prediction tensor y to the second member fp and the perturbation label tensor Y Ap The operations can be performed sequentially (such as expanding and sending the prediction data first and then expanding and sending the label data), in parallel, or mixed (such as expanding the out-of-order prediction tensor y in sequence). f , label tensor Y A The expanded results are then sent together, etc.) This specification does not limit this. The inclusion of steps 370 and 380 here also indicates that there is no explicit timing limit for the two. In fact, the operations in steps 370 and 380 involving the first member expanding the label tensor and providing the expanded scrambled data to the second member can be performed at any appropriate time before step 390, such as pre-processing by sample batch, and are not limited here.

[0087] Next, in step 390, the second member compares the disordered perturbation prediction tensor y based on the disorder rule f fp and the perturbation label tensor Y Ap The gap in the disordered case determines the model loss and the global disordered gradient G of the disordered perturbation label tensor under the current model loss f .

[0088] Those skilled in the art will understand that, during the model training process, gradient-related methods (such as gradient descent method, Newton's method, etc.) can usually be used to adjust the pending parameters in the model in the direction of reducing the model loss. Therefore, in order to obtain the additional gradient data of the pending parameters, the model loss can be first determined by comparing the label data with the prediction results, and then the gradient information of each pending parameter can be mined by determining the model loss, so as to adjust the pending parameters according to the gradient. Under the technical concept of this specification, the data on which the first member obtains the prediction result through the global model is the fusion result after disorder. Therefore, when adjusting the pending parameters in the global model, the gradient data in the disordered situation should be relied upon.

[0089] In some optional implementations, the second member can process the perturbation label tensor Y by the shuffling rule f Ap , get the disordered perturbation label tensor Y Afp At this time, the random perturbation label tensor Y Afp and the out-of-order perturbation prediction tensor y fp The sample dimensions are consistent, so the second member can perturb the label tensor Y based on the disorder Afp and the out-of-order perturbation prediction tensor y fp Comparison of the global disorder gradient G under disorder fp .

[0090] In some other optional implementations, the second member can also be obtained by performing the inverse operation of the disorder rule f (e.g., f -1 ) handles the disordered perturbation prediction tensor y fp , get the disturbance prediction tensor y p , at this time, the perturbation prediction tensor y p and the perturbation label tensor Y Ap The elements in the sample order are consistent one by one, so the second member can be based on the perturbation label tensor Y Ap and the perturbation prediction tensor y p Comparison of the global gradient G P , and then process the global gradient G through the disorder rule f P The global disorder gradient G in disordered conditions can be obtained fp .

[0091] Here the global random gradient G fp Not only does it include the perturbation prediction tensor y p In the disordered case, the gradient information of each element also includes the gradient information of each other perturbed element. Since the method of determining the model loss (such as the loss function) can be negotiated and determined by each training member in advance and can be made public, if the second member directly uses the global disordered gradient G f To protect data privacy, in step 3100, the first member and the second member can execute the oblivious transfer (OT) protocol, where the first member securely transfers the global disordered gradient G from the second member. fp Get the first sub-random gradient G at position k f Among them, the first sub-random gradient G f Contains local disordered gradient G fp The element at the position corresponding to the prediction tensor (such as the k-th position of the prediction dimension).

[0092] The OT protocol can solve the problem of one party obtaining any one of the N messages from the other party without letting the other party know which message it has obtained, that is, 1-out-of-N. In this step 3100, the number of messages N can be P. If k represents a position or position unit, that is, the second member can f According to the dimension of the predicted tensor, it is divided into P messages, and the OT protocol is executed with the first member, so that the first party selects the kth message from the P messages, which is the first sub-random gradient G f If k represents a position range or multiple scattered positions, the first member and the second member can execute the OT protocol multiple times to obtain the gradient vector of each position in turn to form the first sub-random gradient G f .

[0093] Thus, through step 3110, the first member can pass the first sub-random gradient G f In the global model M L In the backward pass, on the one hand, the global model M is determined L The gradient of each undetermined parameter in , thereby updating the global model M L On the other hand, determine the out-of-order fusion result H f Or random fusion ciphertext <H f >Corresponding to the second sub-disordered gradient G s .

[0094] It can be understood that the gradient of the parameter is the partial derivative of the model loss with respect to the parameter. In the process of determining the gradient of the undetermined parameter, the input value can be regarded as a fixed value, such as a model y=wx. In the process of determining the gradient of the undetermined parameter w, the input value x can be regarded as a fixed value, and the gradient of w is the product of the partial derivative of the model loss Loss with respect to y and the partial derivative of y with respect to w (such as x). The gradient data between multi-layer neural networks has reverse transmission. For example, the first layer is y1=w a x, the second layer is y2=w b y1, then w a The gradient is the partial derivative of the model loss Loss to y1, y1 to w a The partial derivative of model loss Loss with respect to y1 can be obtained by the partial derivative of model loss Loss with respect to y2 and the partial derivative w of y2 with respect to y1. b The product of is determined.

[0095] Thus, on the one hand, the first member can be based on the first sub-random gradient G f The global model M in the local L Backward propagation in the process to determine the global model M L The corresponding gradients are determined for each undetermined parameter in the . These gradient data can be used by the first member to update the global model M based on the gradient descent method. L For example, the gradient of the undetermined parameter w is δ, and the update step is λ: w = w-λδ. On the other hand, when the gradient is passed to the last layer (i.e., the global model M L The first layer) model can regard the undetermined parameters as fixed values to determine the out-of-order fusion result H f Or random fusion ciphertext <H f >The corresponding gradient is recorded as the second sub-random gradient G s .

[0096] After step 3120, the first member can s Provided to the second member.

[0097] Further, in step 3130, the second member can be based on the disorder rule f and the second sub-disorder gradient G s , update the local model M B .

[0098] It can be understood that the second sub-random gradient G s With respect to each intermediate result, the order in the sample dimension is disrupted by the disorder rule f. Therefore, in the inverse operation of the disorder rule f (such as f -1 ) Process the second sub-random gradient G s In the case of , the gradient data of the fusion tensor of the current cycle can be determined, such as the second sub-gradient G H .

[0099] In the absence of other members (such as the first member and the third member) as feature members, the fusion tensor H is the local model M of the second member. B Process local feature data X B The intermediate result H B , the second sub-gradient G H It is the intermediate result H B Thus, the second member can use the second sub-gradient G H In the local model M B Backward propagation to determine the local model M B The gradient G of each unknown parameter in B , thereby updating the local model M using methods such as the gradient descent method described above B .

[0100] When there are other members (such as the first member and the third member) other than the second member as feature members, the fusion tensor H is the intermediate results (such as H A 、H B 、H C ) fusion result, the second member can be based on the second sub-gradient G H The fusion method of each intermediate result ciphertext (such as summation, weighted average, etc.) is used to determine the gradient data corresponding to each intermediate result ciphertext (that is, the gradient data corresponding to each intermediate result, such as G B , G C ). For example, in the simple addition fusion mode, the second sub-gradient G H The gradient of each intermediate result ciphertext is equal. In this way, the second member can use the intermediate result H B The gradient G B Update the local model M B On the other hand, for other feature members, such as the third member, the second member obtains the intermediate result ciphertext <H C >The third sub-gradient G C After that, the third sub-gradient G can be converted into C Then, through step 3150, the third member uses the third sub-gradient G C Update the local model M C .

[0101] It is worth noting that for the first member, if it also holds the feature data X as a feature member A , the second party will take the intermediate result H A Gradient data G A If it is passed to the first member, it is very likely to leak the disorder rule f. Therefore, the second member cannot directly pass the gradient data G A Update the local model M by passing it to the first member A To this end, this specification takes into account the updated global model M L Contains information about other feature members, providing a solution, using the updated global model M L As known information, update the local model M A .

[0102] Specifically, as shown in step 3160, the first member can use the local model M A and the updated global model M L , process the feature data X of a local batch of samples in turn A ', get the predicted tensor y A ', based on the prediction tensor y A ' and label tensor Y A ', determine the model loss, and convert the global model M L The model parameters in are taken as known parameters, and the model loss is determined inversely for the local model M A The gradient of each undetermined parameter in , thereby updating the local model M A .

[0103] It is worth noting that the characteristic data X here A ', label data Y A ' corresponds to updating the local model M A The samples used in the current model cycle and the samples used in conjunction with other training members can be consistent or inconsistent, and the number of samples can be the same or different, which is not limited here. In the case that the samples used are consistent, the updated global model M can be directly used in step 3160. L Processing intermediate results H A , get the predicted tensor y A ', with the label tensor Y A The comparison determines the model loss, which will not be repeated here.

[0104] In this way, through the iteration of the model update process over multiple model update cycles, each training member can complete the model update if predetermined conditions are met. The predetermined conditions here may include, for example, at least one of the following: loss function convergence, gradient convergence, undetermined parameter convergence, model accuracy reaching a predetermined value, the number of model update cycles reaching a predetermined number of cycles, etc.

[0105] Figure 3 The operations performed by each training member are described from the perspective of multiple training members' interactions. Figure 3 It can be seen that under the improved implementation architecture of this specification, the second member fuses and scrambles the intermediate results, and the first member extends and disrupts the plaintext data transmitted by the prediction results and label data, thereby protecting data privacy and preventing the label holder from labeling the label data and maliciously obtaining the privacy of other members.

[0106] Figure 4 、 Figure 5 From the perspectives of the first member and the second member respectively, the process executed by a single training member for the current batch of samples in an update cycle of the model (such as called the current update cycle) is described.

[0107] like Figure 4 As shown, the first member can perform the following process:

[0108] Step 401, obtaining the disordered fusion ciphertext from the second member;

[0109] The disordered fusion ciphertext is obtained by fusing the intermediate result ciphertexts corresponding to the respective feature members by the second member and then disordering them according to the disorder rule f. The single intermediate result is the processing result of the local feature data processed by the local local model by the single feature member. The single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result by the first key, and the first key is provided by the first member.

[0110] In the case where there are multiple feature members, the second member can be any one of the multiple feature members except the first member;

[0111] Step 402: Decrypt the scrambled fusion ciphertext into a scrambled fusion tensor using a second key;

[0112] The second key is used to decrypt data encrypted by the first key;

[0113] Step 403: Process the out-of-order fusion tensor based on the global model to obtain an out-of-order prediction tensor;

[0114] Step 404: Expand the out-of-order prediction tensor in the prediction dimension and the label data in the label dimension to obtain an out-of-order perturbation prediction tensor and a perturbation label tensor, and provide them to the second member;

[0115] Among them, the position k of the disordered prediction tensor in the disordered perturbation prediction tensor corresponds to the position k of the label data in the perturbation label tensor, so that the second member can feedback the global disorder gradient of the disordered perturbation label tensor based on the disorder rule f, the disordered perturbation prediction tensor, and the perturbation label tensor;

[0116] Step 405 , executing the oblivious transfer protocol with the second member to securely select the first sub-random gradient at position k from the global random gradient;

[0117] Step 406: using the reverse transfer of the first sub-random gradient, update the global model and determine the second sub-random gradient corresponding to the random fusion ciphertext;

[0118] Step 407 : Provide the second sub-random gradient to the second member, so that the second member can update the local second partial model based on the random rule f and the second sub-random gradient.

[0119] In some possible architectures, the first member also corresponds to the first feature data and the first local model. The process executed by the first member also includes: using the first local model and the updated global model to process the first feature data of the first batch of samples in sequence to obtain the first prediction tensor; based on the comparison of the first label data corresponding to the first batch of samples with the first prediction tensor, determine the local model loss; adjust the pending parameters in the first local model in the direction of reducing the local model loss, thereby updating the first local model. The first batch of samples here can be consistent with the current batch of samples or inconsistent. In the case of consistency, the first member can directly use the updated global model to process the intermediate results corresponding to the current batch of samples (such as Figure 3 H in A ), get the first prediction tensor, and based on the first prediction tensor and label data Y A Perform a comparison to determine the model loss.

[0120] like Figure 5 As shown, the second member can perform the following process:

[0121] Step 501: fuse the intermediate ciphertexts corresponding to the feature members to obtain a fused tensor ciphertext.

[0122] The single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result with the first key, the single intermediate result is the processing result of a single feature member processing local feature data through a local local model, and the first key is provided by the first member;

[0123] Step 502: Scramble the fused tensor ciphertext in the sample dimension using the scrambling rule f to obtain a scrambled fused ciphertext, and provide it to the first member;

[0124] In this way, the first member can use the second key corresponding to the first key to decrypt the disordered fusion ciphertext into a disordered fusion tensor, and then process the disordered fusion tensor based on the global model to obtain a disordered prediction tensor;

[0125] Step 503: Obtain the out-of-order perturbation prediction tensor and the perturbation label tensor from the first member;

[0126] Among them, the disordered perturbation prediction tensor and the perturbation label tensor are obtained by expanding the disordered prediction tensor in the prediction dimension and the label data in the label dimension, respectively, and the position k of the disordered prediction tensor in the prediction dimension corresponds to the position k of the label data in the label dimension;

[0127] Step 504: Based on the disorder rule f, the disturbance label tensor, and the disorder disturbance prediction tensor, a global disorder gradient corresponding to the disorder disturbance prediction tensor is determined by comparison;

[0128] Step 505 , executing an oblivious transfer protocol with the first member, and having the first member securely select a first sub-random gradient at position k from the global random gradient;

[0129] This allows the first member to use the reverse transfer of the first sub-random gradient to update the global model and feed back the second sub-random gradient corresponding to the random fusion ciphertext;

[0130] Step 506 : Update the local second local model using the second sub-gradient obtained by sequentially restoring the second sub-random gradient in the sample dimension based on the random rule f.

[0131] In some possible embodiments, the feature member further includes a third member, corresponding to a third local model. The above process may further include:

[0132] Based on the second sub-gradient and the fusion method of each intermediate result ciphertext, determine the third sub-gradient of the intermediate tensor corresponding to the third member;

[0133] The third sub-gradient is provided to the third member, so that the third member updates the third local model by using the third sub-gradient.

[0134] Recalling the above process, in the vertical federated learning conducted jointly by multiple training members, a single feature member provides the fused tensor of the intermediate results of each feature member after shuffling the sample dimension and providing it to the label member. The label member performs predictions based on the shuffled fused tensor, obtaining a shuffled prediction tensor. The label member then hides the shuffled prediction tensor and label tensor in the scrambled data at corresponding positions and provides it to the feature member that previously shuffled the data. The feature member that shuffled the data compares the model loss, i.e., the gradient data, under the shuffled state and securely transmits the shuffled gradient data to the first member via the OT protocol. The first member uses the shuffled gradient data to update the global model and, through gradient backpropagation, determines the gradient data of the shuffled fused tensor and transmits it to the feature member that shuffled the data. In this way, the feature member can obtain the gradient data of each intermediate result based on the gradient data of the fused tensor through the fusion backpropagation method. Furthermore, it can update the local model and transmit the gradient information of the intermediate results to other feature members other than the first member.

[0135] When the label member also holds feature data, due to the privacy protection requirements of the out-of-order rule, it cannot directly obtain the gradient information of the intermediate results from the feature member. Instead, it uses the pending parameters in the local global model as known data, utilizes the connection between the local local model and the global model, and uses local samples to update the local local model.

[0136] In this way, based on the disordered processing of feature members and the hidden processing of label data and prediction data by label members, appropriate data interaction can be used to enable the transmission of labels in plain text, avoid malicious labeling of data by label members, and more effectively protect data privacy.

[0137] According to another embodiment, there is also provided a device for jointly updating the model, which is suitable for scenarios where multiple training members use their own local private data to perform vertical federated learning. Specifically, it can be respectively set at Figure 3 The first member and the second member are shown. Figure 6 、 Figure 7 Devices 600 and 700 for a joint update model of tag members and feature members according to an embodiment are respectively shown.

[0138] like Figure 6 As shown, the apparatus 600 for jointly updating the model of tag members may include a communication unit 601 , a decryption unit 602 , a prediction unit 603 , an expansion unit 604 , a security acquisition unit 605 , and a gradient transfer unit 606 .

[0139] In the current update cycle of the model, for the samples of the current batch:

[0140] The communication unit 601 is configured to obtain a scrambled fusion ciphertext from the second member, wherein the scrambled fusion ciphertext is obtained by fusing the intermediate result ciphertexts corresponding to the respective feature members by the second member and then scrambling them according to the scrambling rule f, wherein the individual intermediate result is a result of processing local feature data of the individual feature member using the local local model, and the individual intermediate result ciphertext is obtained by encrypting the corresponding intermediate result using a first key provided by the first member;

[0141] The decryption unit 602 is configured to decrypt the scrambled fusion ciphertext into a scrambled fusion tensor using a second key, where the second key is used to decrypt data encrypted with the first key;

[0142] The prediction unit 603 is configured to process the out-of-order fusion tensor based on the global model to obtain an out-of-order prediction tensor;

[0143] The expansion unit 604 is configured to expand the disordered prediction tensor in the prediction dimension and the label data in the label dimension to obtain a disordered perturbation prediction tensor and a perturbation label tensor, respectively, and provide them to the second member, wherein the position k of the disordered prediction tensor in the disordered perturbation prediction tensor corresponds to the position k of the label data in the perturbation label tensor, so that the second member can feedback the global disorder gradient of the disordered perturbation label tensor based on the disorder rule f, the disordered perturbation prediction tensor, and the perturbation label tensor;

[0144] The secure acquisition unit 605 is configured to execute an oblivious transfer protocol with the second member to securely select a first sub-random gradient at position k from the global random gradient;

[0145] The gradient transfer unit 606 is configured to update the global model and determine the second sub-random gradient corresponding to the random fusion ciphertext using the reverse transfer of the first sub-random gradient;

[0146] The communication unit 601 is further configured to provide the second sub-random gradient to the second member, so that the second member updates the local second partial model based on the random rule f and the second sub-random gradient.

[0147] In the case where the first member also corresponds to the first feature data and the first local model, the device 600 may further include an updating unit (not shown), configured to: use the first local model and the updated global model to sequentially process the first feature data of the first batch of samples to obtain a first prediction tensor; determine the local model loss based on the comparison between the first label data corresponding to the first batch of samples and the first prediction tensor; adjust the pending parameters in the first local model in the direction of reducing the local model loss, thereby updating the first local model. The first batch of samples here may be consistent with the current batch of samples or inconsistent. In the case of consistency, the updating unit can directly use the updated global model to process the intermediate results corresponding to the current batch of samples (such as Figure 3 H in A ), get the first prediction tensor, and based on the first prediction tensor and label data Y A Perform a comparison to determine the model loss.

[0148] like Figure 7 As shown, the apparatus 700 for the joint update model of tag members may include a fusion unit 701 , a shuffling unit 702 , an acquisition unit 703 , a gradient determination unit 704 , a secure transfer unit 705 , and an update unit 706 .

[0149] In the current update cycle of the model, for the samples of the current batch:

[0150] The fusion unit 701 is configured to fuse the intermediate result ciphertexts corresponding to the respective feature members to obtain a fused tensor ciphertext; wherein the individual intermediate result ciphertext is obtained by encrypting the corresponding intermediate result using a first key, and the individual intermediate result is a result of processing local feature data of a single feature member using a local local model, and the first key is provided by the first member;

[0151] The scrambling unit 702 is configured to scramble the fused tensor ciphertext in the sample dimension according to the scrambling rule f to obtain a scrambled fused ciphertext, and provide the scrambled fused ciphertext to the first member, so that the first member can decrypt the scrambled fused ciphertext into a scrambled fused tensor using a second key corresponding to the first key, and then process the scrambled fused tensor based on the global model to obtain a scrambled prediction tensor.

[0152] The acquisition unit 703 is configured to obtain a disordered perturbation prediction tensor and a perturbation label tensor from the first member; wherein the disordered perturbation prediction tensor and the perturbation label tensor are respectively obtained by expanding the disordered prediction tensor in the prediction dimension and the label data in the label dimension, and the position k of the disordered prediction tensor in the prediction dimension corresponds to the position k of the label data in the label dimension;

[0153] The gradient determination unit 704 is configured to compare and determine a global out-of-order gradient corresponding to the out-of-order perturbation prediction tensor based on the out-of-order rule f, the perturbation label tensor, and the out-of-order perturbation prediction tensor;

[0154] The secure transfer unit 705 is configured to perform an oblivious transfer protocol with the first member, whereby the first member securely selects a first sub-random gradient at position k from the global random gradient, so that the first member updates the global model using the reverse transfer of the first sub-random gradient and feeds back a second sub-random gradient corresponding to the random fusion ciphertext;

[0155] The updating unit 706 is configured to update the local second local model using the second sub-gradient obtained by sequentially restoring the second sub-random gradient in the sample dimension based on the random rule f.

[0156] In some possible embodiments, the feature member also includes a third member, corresponding to a third local model, and the device 700 may further include a providing unit (not shown), configured to: determine the third sub-gradient of the intermediate tensor corresponding to the third member based on the second sub-gradient and the fusion method of each intermediate result ciphertext; provide the third sub-gradient to the third member, so that the third member uses the third sub-gradient to update the third local model.

[0157] It is worth mentioning that Figure 6 、 Figure 7 The devices 600 and 700 are shown respectively with Figure 4 、 Figure 5 The method embodiment shown corresponds to and can be applied to Figure 3 The first member and the second member in the interactive process shown cooperate with each other to complete Figure 3 The model update process shown in . Therefore, Figure 3 The description of the first member and the second member, and Figure 4 、 Figure 5 The description of the method embodiment shown can be adapted to FIG. 6, Figure 7 The devices 600 and 700 shown are not described in detail here.

[0158] According to another embodiment, there is also provided a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 4 、 Figure 5 The method described by et al.

[0159] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores an executable code, and when the processor executes the executable code, the system realizes the combination of Figure 4 、 Figure 5 The method described by et al.

[0160] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described in the embodiments of this specification may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0161] The specific implementation methods described above further explain in detail the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above description is only a specific implementation method of the technical concept of this specification and is not intended to limit the scope of protection of the technical concept of this specification. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the scope of protection of the technical concept of this specification.< / h> < / h> < / h> < / h>

Claims

1. A method for multi-party joint model training, applicable to scenarios where multiple training members conduct longitudinal federated learning using their respective local private data. The multiple training members include a first member holding labeled data and at least one feature member. The model includes local models corresponding to the feature members and a global model corresponding to the first member. The at least one feature member includes a second member. The method is executed by the second member. During the current update cycle of the model, for the current batch of samples, the method includes: Fusing the intermediate result ciphertexts corresponding to the respective feature members to obtain a fused tensor ciphertext, wherein the individual intermediate result ciphertext is obtained by encrypting the corresponding intermediate result using a first key, and the individual intermediate result is a result of processing local feature data of a single feature member using a local local model, and the first key is provided by the first member; The fused tensor ciphertext is scrambled in the sample dimension using a scrambling rule f to obtain a scrambled fused ciphertext, and the scrambled fused ciphertext is provided to the first member, so that the first member uses a second key corresponding to the first key to decrypt the scrambled fused ciphertext into a scrambled fused tensor, and then processes the scrambled fused tensor based on the global model to obtain a scrambled prediction tensor; Obtaining a disordered perturbation prediction tensor and a perturbation label tensor from the first member, wherein the disordered perturbation prediction tensor and the perturbation label tensor are respectively obtained by expanding the disordered prediction tensor in the prediction dimension and the label data in the label dimension, and the position k of the disordered prediction tensor in the prediction dimension corresponds to the position k of the label data in the label dimension; Based on the disorder rule f, the disturbance label tensor, and the disorder disturbance prediction tensor, comparing and determining the global disorder gradient corresponding to the disorder disturbance prediction tensor; An oblivious transfer protocol is executed with the first member, where the first member securely selects a first sub-random gradient at position k from the global random gradient, so that the first member updates the global model using the reverse transfer of the first sub-random gradient and feeds back a second sub-random gradient corresponding to the random fusion ciphertext; The local second local model is updated using the second sub-gradient obtained by sequentially restoring the second sub-random gradient in the sample dimension based on the random rule f.

2. The method according to claim 1, wherein The at least one characteristic member includes a third member corresponding to a third partial model, and the method further includes: Determine a third sub-gradient of the intermediate tensor corresponding to the third member based on the second sub-gradient and the fusion method of each intermediate result ciphertext; The third sub-gradient is provided to a third member, so that the third member updates the third local model by using the third sub-gradient.

3. The method according to claim 1, wherein The fusion method for fusing the intermediate result ciphertexts corresponding to the feature members includes one of the following: summation and weighted average.

4. The method according to claim 1, wherein The comparing and determining the global disorder gradient corresponding to the disordered disturbance prediction tensor based on the disordered rule f, the disturbance label tensor, and the disordered disturbance prediction tensor includes: Scrambling the perturbation label tensor based on the scrambling rule f to obtain a scrambled perturbation label tensor; Comparing the disordered perturbation label tensor with the perturbation label tensor to obtain a model loss; The global out-of-order gradient is determined according to the partial derivative of the model loss with respect to each element in the out-of-order perturbation prediction tensor.

5. The method according to claim 1, wherein Restoring the order of the second sub-random gradient in the sample dimension based on the random rule f includes: Determine the inverse of the disorder rule f -1 ; Using the reverse order rule f -1 The second sub-random gradient is sequentially adjusted in the sample dimension.

6. The method of claim 1, wherein: The performing of the oblivious transfer protocol with the first member, wherein the first member securely selects a first sub-random gradient at position k from the global random gradient, comprises: According to the dimension occupied by the prediction tensor in the prediction dimension, the global disordered gradient is divided into P messages in sequence; An oblivious transfer protocol is performed with the first member, and the first member selects a kth message from the P messages.

7. A method for multi-party joint model training, applicable to scenarios where multiple training members conduct longitudinal federated learning using their respective local private data. The multiple training members include a first member holding labeled data and at least one feature member. The model includes local models corresponding to the feature members and a global model corresponding to the first member. The at least one feature member includes a second member. The method is executed by the first member. During the current update cycle of the model, for the current batch of samples, the method includes: Obtaining a scrambled fusion ciphertext from the second member, wherein the scrambled fusion ciphertext is obtained by the second member fusing the intermediate result ciphertexts corresponding to the respective feature members and then scrambling them according to the scrambling rule f, wherein the single intermediate result is a processing result of the local feature data of the single feature member processed by the local local model, and the single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result using a first key provided by the first member; Decrypting the scrambled fusion ciphertext into a scrambled fusion tensor using a second key, where the second key is used to decrypt data encrypted by the first key; Processing the out-of-order fusion tensor based on the global model to obtain an out-of-order prediction tensor; The out-of-order prediction tensor is expanded in the prediction dimension and the label data is expanded in the label dimension to obtain an out-of-order perturbation prediction tensor and a perturbation label tensor, and the obtained tensors are provided to the second member, wherein the position k of the out-of-order prediction tensor in the out-of-order perturbation prediction tensor corresponds to the position k of the label data in the perturbation label tensor, so that the second member can feedback the global out-of-order gradient for the out-of-order perturbation label tensor based on the out-of-order rule f, the out-of-order perturbation prediction tensor, and the perturbation label tensor; executing an oblivious transfer protocol with the second member to securely select a first sub-random gradient at position k from the global random gradient; Using the reverse transfer of the first sub-random gradient, the global model is updated and the second sub-random gradient corresponding to the random fusion ciphertext is determined; The second sub-random gradient is provided to the second member, so that the second member updates a local second partial model based on the random rule f and the second sub-random gradient.

8. The method of claim 7, wherein: The first member further corresponds to first feature data and a first local model, and the method further includes: Using the first local model and the updated global model to sequentially process the first feature data of the first batch of samples to obtain a first prediction tensor; Determining a local model loss based on a comparison of first label data corresponding to the first batch of samples and the first prediction tensor; The undetermined parameters in the first local model are adjusted in a direction in which the loss of the local model is reduced, thereby updating the first local model.

9. The method of claim 8, wherein: The first batch of samples is consistent with the samples of the current batch. The intermediate result obtained by processing the first feature data of the current batch by the first local model is the first intermediate result. The first feature data of the first batch of samples is processed in sequence by the first local model and the updated global model to obtain the first prediction tensor: The first intermediate result is processed using the updated global model to obtain the first prediction tensor.

10. The method of claim 7, wherein: The second member fuses the intermediate result ciphertexts corresponding to the feature members in one of the following ways: summation and weighted average.

11. The method according to claim 7, wherein: The shuffled prediction tensor / perturbation label tensor is expanded in the following way: Randomly generate perturbation data that is consistent with the volume of P-1 prediction tensors / label data within the range of the predicted value / label value. The perturbation data and the prediction tensor / label data are arranged along the prediction dimension / label dimension to form the out-of-order perturbation prediction tensor / perturbation label tensor, wherein the perturbation data and the prediction tensor / label data are arranged at position k.

12. A method for multi-party joint training of a model, applicable to scenarios where a first member holding labeled data and a second member holding feature members perform longitudinal federated learning, wherein the model comprises a local model corresponding to the second member and a global model corresponding to the first member. During the current update cycle of the model, for the current batch of samples, the method comprises: The second member processes the local feature data using the local model to obtain an intermediate result; Scrambling the intermediate results in the sample dimension using the scrambling rule f to obtain scrambled intermediate results, and providing the scrambled intermediate results to the first member; The first member processes the out-of-order intermediate result based on the global model to obtain an out-of-order prediction tensor; The first member expands the out-of-order prediction tensor in the prediction dimension and the label data in the label dimension by the same multiple to obtain an out-of-order perturbation prediction tensor and a perturbation label tensor, respectively, and provides them to the second member, wherein the position k of the out-of-order prediction tensor in the prediction dimension corresponds to the position k of the label data in the label dimension; The second member compares and determines the global disorder gradient corresponding to the disordered perturbation prediction tensor based on the disordered rule f, the perturbation label tensor, and the disordered perturbation prediction tensor; The first member and the second member execute an oblivious transfer protocol, whereby the first member securely selects a first sub-random gradient at position k from the global random gradient, updates the global model using a reverse transfer of the first sub-random gradient, and feeds back a second sub-random gradient corresponding to the random intermediate result; The local model is updated using a second sub-gradient obtained by sequentially restoring the second sub-random gradient in the sample dimension based on the random rule f.

13. A device for a multi-party joint training model, suitable for scenarios where multiple training members conduct longitudinal federated learning using their respective local private data. The multiple training members include a first member holding labeled data and at least one feature member. The model includes local models corresponding to the feature members and a global model corresponding to the first member. The at least one feature member includes a second member. The device, located on the second member, includes a fusion unit, a shuffling unit, an acquisition unit, a gradient determination unit, a secure transfer unit, and an update unit. During the current update cycle of the model, for the current batch of samples: The fusion unit is configured to fuse the intermediate result ciphertexts corresponding to the feature members to obtain a fused tensor ciphertext, wherein: The single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result with the first key, the single intermediate result being the result of a single feature member processing local feature data through a local local model, and the first key is provided by the first member; The scrambling unit is configured to scramble the fused tensor ciphertext in the sample dimension according to the scrambling rule f to obtain a scrambled fused ciphertext, and provide the scrambled fused ciphertext to the first member, so that the first member decrypts the scrambled fused ciphertext into a scrambled fused tensor using a second key corresponding to the first key, and then processes the scrambled fused tensor based on the global model to obtain a scrambled prediction tensor. The acquisition unit is configured to acquire a disordered perturbation prediction tensor and a perturbation label tensor from the first member, wherein the disordered perturbation prediction tensor and the perturbation label tensor are respectively obtained by expanding the disordered prediction tensor in a prediction dimension and the label data in a label dimension, and a position k of the disordered prediction tensor in the prediction dimension corresponds to a position k of the label data in the label dimension; The gradient determination unit is configured to compare and determine a global out-of-order gradient corresponding to the out-of-order perturbation prediction tensor based on the out-of-order rule f, the perturbation label tensor, and the out-of-order perturbation prediction tensor; The secure transfer unit is configured to perform an oblivious transfer protocol with the first member, whereby the first member securely selects a first sub-random gradient at position k from the global random gradient, so that the first member updates the global model using the reverse transfer of the first sub-random gradient, and feeds back a second sub-random gradient corresponding to the random fusion ciphertext; The updating unit is configured to update the local second local model using a second sub-gradient obtained by sequentially restoring the second sub-random gradient in the sample dimension based on the random rule f.

14. A device for a multi-party joint training model, suitable for scenarios where multiple training members conduct longitudinal federated learning using their respective local private data. The multiple training members include a first member holding labeled data and at least one feature member. The model includes local models corresponding to the feature members and a global model corresponding to the first member. The at least one feature member includes a second member. The device is located on the first member and includes a communication unit, a decryption unit, a prediction unit, an expansion unit, a secure acquisition unit, and a gradient transfer unit. During the current update cycle of the model, for the current batch of samples: The communication unit is configured to obtain the disordered fusion ciphertext from the second member, wherein: The out-of-order fusion ciphertext is obtained by fusing the intermediate result ciphertexts corresponding to the respective feature members by the second member and then scrambling them according to the scrambling rule f. The single intermediate result is the processing result of the local feature data processed by the local local model by the single feature member. The single intermediate result ciphertext is obtained by encrypting the corresponding intermediate result by the first key, and the first key is provided by the first member. The decryption unit is configured to decrypt the scrambled fusion ciphertext into a scrambled fusion tensor using a second key, where the second key is used to decrypt data encrypted by the first key; The prediction unit is configured to obtain an out-of-order prediction tensor by processing the out-of-order fusion tensor based on the global model; The expansion unit is configured to expand the out-of-order prediction tensor in the prediction dimension and the label data in the label dimension to obtain an out-of-order perturbation prediction tensor and a perturbation label tensor, respectively, and provide them to the second member, wherein the position k of the out-of-order prediction tensor in the out-of-order perturbation prediction tensor corresponds to the position k of the label data in the perturbation label tensor, so that the second member can feedback the global out-of-order gradient for the out-of-order perturbation label tensor based on the out-of-order rule f, the out-of-order perturbation prediction tensor, and the perturbation label tensor; The secure acquisition unit is configured to execute an oblivious transfer protocol with the second member to securely select a first sub-random gradient at position k from the global random gradient; The gradient transfer unit is configured to update the global model and determine the second sub-random gradient corresponding to the random fusion ciphertext by using the reverse transfer of the first sub-random gradient; The communication unit is further configured to provide the second sub-random gradient to the second member, so that the second member updates a local second local model based on the random rule f and the second sub-random gradient.

15. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 11.

16. A computing device comprising a memory and a processor, characterized in that: The memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 11 is implemented.

Images