Methods, apparatus, devices, and media for model performance evaluation

Abstract

According to an embodiment of the present disclosure, a method, device, equipment and medium for model performance evaluation are provided. The method comprises: applying a plurality of data samples to a prediction model respectively at a client node to obtain a plurality of prediction scores of the prediction model output, the plurality of prediction scores respectively indicating a prediction probability of the plurality of data samples belonging to a first category or a second category; determining values of a plurality of metric parameters related to a predetermined performance indicator of the prediction model based on a plurality of true value labels of the plurality of data samples and the plurality of prediction scores; applying perturbation to the values of the plurality of metric parameters to obtain perturbed values of the plurality of metric parameters; and sending the perturbed values of the plurality of metric parameters to a service node. Thus, while realizing model performance evaluation, the purpose of privacy protection of local label data of the client node is achieved.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computers, and more particularly, to methods, devices, apparatuses, and computer-readable storage media for model performance evaluation. Background Art

[0002] Machine learning has been widely used, and its performance generally improves with increasing data volume. In some scenarios, sufficient data samples and labeled data must be collected centrally for training machine learning models. However, in many real-world scenarios, the so-called data silo problem exists, where data is often dispersed and isolated, stored across different entities (e.g., enterprises, user terminals). With data privacy protection gaining increasing attention, such centralized machine learning approaches struggle to achieve data protection objectives.

[0003] Currently, a federated learning solution has been proposed. Federated learning leverages data from various nodes to achieve collaborative modeling, while ensuring data privacy and security, thereby improving the effectiveness of artificial intelligence (AI) models. Federated learning allows individual nodes to remain connected, thus achieving data protection. Summary of the Invention

[0004] According to an example embodiment of the present disclosure, a solution for model performance evaluation is provided.

[0005] In a first aspect of the present disclosure, a method for model performance evaluation is provided. The method includes: at a client node, applying multiple data samples to a prediction model to obtain multiple prediction scores output by the prediction model, wherein the multiple prediction scores respectively indicate predicted probabilities that the multiple data samples belong to a first category or a second category; determining values ​​of multiple metric parameters related to predetermined performance indicators of the prediction model based on multiple true value labels and the multiple prediction scores of the multiple data samples; applying perturbations to the values ​​of the multiple metric parameters to obtain perturbation values ​​of the multiple metric parameters; and sending the perturbation values ​​of the multiple metric parameters to a service node.

[0006] In a second aspect of the present disclosure, a method for model performance evaluation is provided. The method includes: receiving, at a service node, perturbation values ​​of multiple metric parameters associated with a predetermined performance indicator of a prediction model from multiple client nodes; aggregating the perturbation values ​​of the multiple metric parameters from the multiple client nodes by the metric parameters to obtain aggregated values ​​of the multiple metric parameters; and determining a value of the predetermined performance indicator based on the aggregated values ​​of the multiple metric parameters.

[0007] In a third aspect of the present disclosure, a device for model performance evaluation is provided. The device includes: a prediction module configured to apply multiple data samples to a prediction model respectively to obtain multiple prediction scores output by the prediction model, wherein the multiple prediction scores respectively indicate the predicted probability that the multiple data samples belong to a first category or a second category; a metric determination module configured to determine the values ​​of multiple metric parameters related to a predetermined performance indicator of the prediction model based on multiple true value labels and multiple prediction scores of the multiple data samples; a perturbation module configured to apply perturbations to the values ​​of the multiple metric parameters to obtain perturbation values ​​of the multiple metric parameters; and a sending module configured to send the perturbation values ​​of the multiple metric parameters to a service node.

[0008] In a fourth aspect of the present disclosure, a device for model performance evaluation is provided. The device includes: a receiving module configured to receive, from multiple client nodes, perturbation values ​​of multiple metric parameters related to a predetermined performance indicator of a prediction model; an aggregation module configured to aggregate the perturbation values ​​of the multiple metric parameters from the multiple client nodes according to the metric parameters to obtain an aggregated value of the multiple metric parameters; and a performance determination module configured to determine a value of the predetermined performance indicator based on the aggregated value of the multiple metric parameters.

[0009] In a fifth aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. When executed by the at least one processing unit, the instructions cause the device to perform the method of the first aspect.

[0010] In a sixth aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. When executed by the at least one processing unit, the instructions cause the device to perform the method of the second aspect.

[0011] In a seventh aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the medium, and the computer program is executed by a processor to implement the method of the first aspect.

[0012] In an eighth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the medium, and the computer program is executed by a processor to implement the method of the second aspect.

[0013] It should be understood that the contents described in the summary of the present invention are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0015] Figure 1 A schematic diagram illustrating an example environment in which embodiments of the present disclosure can be applied;

[0016] Figure 2 A flowchart illustrating a signaling flow for model performance evaluation according to some embodiments of the present disclosure is shown;

[0017] Figure 3A A flowchart illustrating a process of determining a value of a metric parameter according to some embodiments of the present disclosure;

[0018] Figure 3B The following illustrates a flow of signaling for determining a value of a metric parameter according to some embodiments of the present disclosure;

[0019] Figure 4 A flowchart illustrating a process for model performance evaluation at a service node according to some embodiments of the present disclosure;

[0020] Figure 5 A flowchart illustrating a process for model performance evaluation at a service node according to some embodiments of the present disclosure;

[0021] Figure 6 A block diagram of an apparatus for model performance evaluation at a client node according to some embodiments of the present disclosure is shown;

[0022] Figure 7 A block diagram illustrating an apparatus for model performance evaluation at a service node according to some embodiments of the present disclosure; and

[0023] Figure 8 A block diagram is shown of a computing device / system capable of implementing one or more embodiments of the present disclosure. DETAILED DESCRIPTION

[0024] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0025] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, i.e., "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may be included below.

[0026] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) must comply with the requirements of relevant laws, regulations and relevant provisions.

[0027] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0028] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operations of the disclosed technical solution based on the prompt message.

[0029] As an optional but non-limiting implementation, in response to receiving a user's active request, a prompt message may be sent to the user, for example, in the form of a pop-up window, in which the prompt message may be presented in text form. Furthermore, the pop-up window may also include a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0030] It is understandable that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0031] As used herein, the term "model" can learn the association between corresponding inputs and outputs from training data, so that after training is completed, corresponding outputs can be generated for given inputs. The generation of the model can be based on machine learning technology. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs by using multiple layers of processing units. A neural network model is an example of a model based on deep learning. In this article, a "model" may also be referred to as a "machine learning model", "learning model", "machine learning network" or "learning network", and these terms are used interchangeably in this article.

[0032] A "neural network" is a machine learning network based on deep learning. A neural network is capable of processing inputs and providing corresponding outputs. It typically includes an input layer, an output layer, and one or more hidden layers between the input and output layers. Neural networks used in deep learning applications typically include many hidden layers, thereby increasing the depth of the network. The layers of a neural network are connected in sequence so that the output of the previous layer is provided as input to the next layer, where the input layer receives the input of the neural network and the output of the output layer serves as the final output of the neural network. Each layer of a neural network includes one or more nodes (also called processing nodes or neurons), each of which processes the input from the previous layer.

[0033] Generally speaking, machine learning can be roughly divided into three stages, namely the training stage, the testing stage, and the application stage (also known as the inference stage). In the training stage, a given model can be trained using a large amount of training data, and the parameter values ​​are continuously updated iteratively until the model can obtain consistent inferences that meet the expected goals from the training data. Through training, the model can be considered to be able to learn the association between input and output (also known as input-to-output mapping) from the training data. The parameter values ​​of the trained model are determined. In the testing stage, the test input is applied to the trained model to test whether the model can provide the correct output, thereby determining the performance of the model. In the application stage, the model can be used to process the actual input based on the parameter values ​​obtained through training to determine the corresponding output.

[0034] Figure 1 A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. Environment 100 relates to a federated learning environment, which includes N client nodes 110-1...110-k,...110-N (where N is an integer greater than 1, k=1, 2,...N) and a service node 120. Client nodes 110-1...110-k,...110-N can respectively maintain respective local datasets 112-1...112-k,...112-N. For ease of discussion, client nodes 110-1...110-k,...110-N may be collectively or individually referred to as client nodes 110, and local datasets 112-1...112-k,...112-N may be collectively or individually referred to as local datasets 112.

[0035] In some embodiments, client node 110 and / or service node 120 can be implemented at terminal device or server.Terminal device can be any type of mobile terminal, fixed terminal or portable terminal, including mobile phone, desktop computer, laptop computer, notebook computer, netbook computer, tablet computer, media computer, multimedia tablet, personal communication system (PCS) equipment, personal navigation device, personal digital assistant (PDA), audio / video player, digital camera / camcorder, positioning device, television receiver, radio broadcast receiver, e-book device, gaming device or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof.In some embodiments, terminal device can also support any type of interface for user (such as " wearable " circuit etc.).Server is various types of computing system / server that can provide computing power, including but not limited to mainframe, edge computing node, computing device in cloud environment, etc.

[0036] In federated learning, a client node is a node that provides a portion of the data used to train, validate, or evaluate a predictive model. Client nodes can also be referred to as clients, terminal nodes, end devices, or user devices. In federated learning, a serving node is a node that aggregates the results from client nodes.

[0037] exist Figure 1 In the example, assume that N client nodes 110 jointly participate in training prediction model 125 and aggregate intermediate training results to service node 120, so that service node 120 can update the parameter set of prediction model 125. The entire set of local data of these client nodes 110 constitutes the complete training data set of prediction model 125. Therefore, based on the mechanism of federated learning, service node 120 can determine the global prediction model 125.

[0038] For the prediction model 125 , the local dataset 112 at the client node 110 may include data samples and ground truth labels. Figure 1Specifically shown is a local data set 112-k at a client node 110-k, which includes a data sample set and a true value label set. The data sample set includes a plurality of (M) data samples 102-1, 102-i, ... 102-M (collectively or individually referred to as data samples 102), and the true value label set includes a corresponding plurality of (M) ground-truth labels 105-1, 105-i, ... 105-M (collectively or individually referred to as true value labels 105). Wherein M is an integer greater than 1, i = 1, 2, ... M. Each data sample 102 can be annotated with a corresponding true value label 105. The data sample 102 can correspond to the input of the prediction model 125, and the true value label 105 indicates the true output of the data sample 102. The true value label is an important part of supervised machine learning.

[0039] In an embodiment of the present disclosure, the prediction model 125 can be constructed based on various machine learning or deep learning model architectures and can be configured to implement various prediction tasks, such as various classification tasks, recommendation tasks, etc. Accordingly, the prediction model 125 can also be referred to as a recommendation model, a classification model, etc.

[0040] The data sample 102 may include input information related to the specific task of the prediction model 125, and the true value label 105 is related to the expected output of the task. As an example, in a binary classification task, the prediction model 125 can be configured to predict whether the input data sample belongs to the first category or the second category, and the true value label is used to mark whether the data sample actually belongs to the first category or the second category. Many practical applications can be classified as such binary classification tasks, such as whether the conversion of the recommended item (e.g., click, purchase, registration or other demand behavior) in the recommendation task is achieved or not, etc.

[0041] It should be understood that Figure 1 The federated learning environment is shown as an example only. Depending on the federated learning algorithm and actual application needs, the environment can also be different. For example, although shown as a separate node, in some applications, the service node 120, in addition to serving as a central node, can also serve as a client node to provide some data for model training, model performance evaluation, etc. The embodiments of the present disclosure are not limited in this respect.

[0042] During the training phase of prediction model 125, mechanisms are in place to protect the local data of each client node 110 from being leaked. For example, during model training, client node 110 does not need to disclose local data samples or label data. Instead, it sends gradient data calculated based on the local training data to service node 120, allowing service node 120 to update the parameter set of prediction model 125.

[0043] In some cases, it is also desirable to evaluate the performance of the trained prediction model. The evaluation of model performance also requires data, including data samples required for model input and label data corresponding to the data samples. The performance of the prediction model can be measured by one or more performance indicators. Different performance indicators can measure the difference between the predicted output given by the prediction model for the data sample set and the actual output indicated by the true value label set from different perspectives. Generally, if the difference between the predicted output given by the prediction model and the true output is small, it means that the performance of the prediction model is good. As can be seen, it is usually necessary to determine the performance indicator of the prediction model based on the true value label set of the data sample.

[0044] As data regulation continues to strengthen, the demand for data privacy protection is also increasing. The true value labels of data samples also need to be protected to prevent leakage. Therefore, determining the performance indicators of prediction models while protecting the local labeled data of client nodes from leakage is a challenging task. Currently, there is no fully effective solution to this problem.

[0045] According to an embodiment of the present disclosure, a model performance evaluation scheme is provided that can protect the local label data of the client node. Specifically, at the client node, after calculating the values ​​of multiple metric parameters related to the performance indicators of the prediction model, the values ​​of the determined metric parameters are perturbed to obtain perturbation values ​​of the multiple metric parameters. The client node sends the perturbation values ​​of the metric parameters to the service node. Because the true values ​​of the metric parameters do not need to be sent directly, it is difficult for an observer to deduce the true value label of the data sample from the perturbation values. In this way, data leakage can be effectively avoided.

[0046] At the service node, the service node receives perturbation values ​​for multiple metric parameters determined by multiple client nodes. The service node aggregates the perturbation values ​​for the multiple metric parameters from the multiple client nodes by metric parameter. After aggregating the perturbation values ​​from multiple different sources, the perturbations are canceled out. Therefore, based on the aggregated values ​​of the multiple metric parameters, the service node can accurately determine the value of the model's performance indicator.

[0047] According to the embodiments of the present disclosure, each client node does not need to expose its local set of true value labels or parameter values ​​determined based on these labels, and can still allow the service node to calculate the performance indicators of the model. In this way, the privacy of the client node's local label data is protected while achieving model performance evaluation.

[0048] Some example embodiments of the present disclosure will be described below with continued reference to the accompanying drawings.

[0049] Figure 2FIG2 shows a schematic block diagram of a signaling flow 200 for model performance evaluation according to some embodiments of the present disclosure. Figure 1 The signaling flow 200 involves a client node 110 and a service node 120.

[0050] In embodiments of the present disclosure, it is assumed that the performance of prediction model 125 is to be evaluated. In some embodiments, prediction model 125 to be evaluated may be a global prediction model determined based on a training process of federated learning, for example, client node 110 and service node 120 participated in the training process of prediction model 125. In some embodiments, prediction model 125 may also be a model obtained in any other manner, and client node 110 and service node 120 may not have participated in the training process of prediction model 125. The scope of the present disclosure is not limited in this respect.

[0051] In some embodiments, as shown in signaling flow 200, service node 120 sends 205 prediction model 125 to N client nodes 110. After receiving 210 prediction model 125, each client node 110 may perform a subsequent evaluation process based on prediction model 125. In some embodiments, prediction model 125 to be evaluated may also be provided to client node 110 in any other suitable manner.

[0052] In the embodiments of the present disclosure, the operations of the client side are described from the perspective of a single client node 110. Multiple client nodes 110 may operate similarly.

[0053] In the signaling flow 200, the client node 110 applies 215 the model 125 to a plurality of data samples to obtain a plurality of prediction scores output by the prediction model 125. Assume that the data sample set of the client node 110-k is X k , the prediction model 125 is represented as f(), then the set of prediction scores for the data sample set can be represented as s k =f(X k ).

[0054] In the embodiments of the present disclosure, particular attention is paid to the performance indicators of the prediction model in implementing a binary classification task. Each prediction score can indicate the predicted probability that the corresponding data sample 102 belongs to the first category or the second category. These two categories can be configured according to the actual task requirements.

[0055] The value range of the prediction score output by the prediction model 125 can be set arbitrarily. For example, the prediction score can be a value in a certain continuous value interval (for example, a value between 0 and 1), or it can be a value in a plurality of discrete values ​​(for example, it can be one of the discrete values ​​such as 0, 1, 2, 3, 4, 5, etc.). In some examples, a higher prediction score can indicate that the predicted probability of the data sample 102 belonging to the first category is greater, and the predicted probability of belonging to the second category is smaller. Of course, the opposite setting is also possible, for example, a higher prediction score can indicate that the predicted probability of the data sample 102 belonging to the second category is greater, and the predicted probability of belonging to the first category is smaller.

[0056] The client node 110 determines 220 values ​​of multiple metric parameters associated with predetermined performance indicators of the prediction model 125 based on multiple true value labels (also referred to as real value labels) of the multiple data samples 102 and multiple prediction scores output by the model.

[0057] The true value label 105 is used to mark whether the corresponding data sample 102 belongs to the first category or the second category. In the following, for the convenience of discussion, the data samples belonging to the first category are sometimes referred to as positive samples, positive examples or positive samples, and the data samples belonging to the second category are sometimes referred to as negative samples, negative examples or negative samples. In some embodiments, each true value label 105 can have one of two values, which are used to indicate the first category or the second category respectively. In some embodiments below, for the convenience of discussion, the value of the true value label 105 corresponding to the first category can be set to "1", which indicates that the data sample belongs to the first category and is a positive sample. In addition, the value of the true value label 105 corresponding to the second category can be set to "0", which indicates that the data sample belongs to the second category and is a negative sample.

[0058] In the embodiments of the present disclosure, individual client nodes 110 determine metrics related to the model's performance indicators based on their local datasets (data samples and ground truth labels). By aggregating the metrics from multiple client nodes 110 to service node 120, the performance of prediction model 125 can be evaluated based on the complete datasets of the multiple client nodes.

[0059] Metrics refer to information of interest when calculating a model's performance metrics, typically represented by multiple metrics parameters. The values ​​of these metrics are derived from the output of the model (i.e., the predicted score) and the corresponding ground truth labels of the data samples. The type of metrics provided by the client node depends on the specific performance metrics being calculated.

[0060] In the following, for ease of understanding, some example performance indicators of the prediction model 125 for implementing a binary classification task are first introduced.

[0061] The prediction score output by the prediction model 125 for a data sample is typically compared with a score threshold, and based on the comparison result, it is determined whether the data sample is predicted to belong to the first category or the second category. The prediction of the prediction model 125 for implementing a binary classification task may have four possible outcomes.

[0062] Specifically, for a certain data sample 102, assuming that the true value label 105 indicates that it belongs to the first category (positive sample), and the prediction model 125 also predicts that it is a positive sample, then the data sample is considered to be a true sample (True Positive, TP). If the true value label 105 indicates that it belongs to the first category (positive sample), and the prediction model 125 predicts that it is a negative sample, then the data sample is considered to be a false negative sample (False Negative, FN). If the true value label 105 indicates that it belongs to the second category (negative sample), but the prediction model 125 also predicts that it is a negative sample, then the data sample is considered to be a true negative (True Negative, TN). If the true value label 105 indicates that it belongs to the second category (negative sample), but the prediction model 125 predicts that it is a positive sample, then the data sample is considered to be a false positive (False Positive, FP). These four results can be indicated by the confusion matrix in Table 1 below.

[0063] Table 1

[0064]

[0065] When measuring the performance of the prediction model 125 , it is desirable to be able to calculate the performance metric based on the prediction results of the entire set of data samples from multiple client nodes 110 and the entire set of true value labels.

[0066] In some embodiments, the performance indicators of the prediction model 125 may also include the false positive rate (FPR) and / or the false positive rate (FPR). FPR can be defined as: the ratio of data samples that are actually negative examples that are incorrectly judged as positive by the model, expressed as FPR = FP / (FP+TN), where FP and TN represent the number of FP and TN counted in the entire data sample set. TPR: the ratio of samples that are actually positive that are correctly judged as positive, expressed as TPR = TP / (TP+FN).

[0067] In some embodiments, the performance metric of the prediction model 125 may include the area under the curve (AUC) of the receiver operating characteristic (ROC) curve.

[0068] The ROC curve is plotted based on different classification methods (using different scoring thresholds), with the false positive rate (FPR) on the X-axis and the true positive rate (TPR) on the Y-axis. For each possible scoring threshold, multiple (FPR, TPR) pairs of coordinate points can be calculated. Connecting these points with a line creates the ROC curve for a specific model.

[0069] From the definition, AUC refers to the area under the ROC curve. When calculating AUC, one possible way is to calculate AUC by using an approximate algorithm to calculate the area under the ROC curve based on the definition of AUC.

[0070] In some embodiments, AUC can also be determined from a probabilistic perspective. AUC can be considered as: randomly selecting a positive sample and a negative sample, the probability that the prediction model gives the positive sample a higher prediction score than the negative sample. That is to say, in the data sample set, the positive and negative samples are paired to form positive and negative sample pairs, where the prediction score of the positive sample is greater than the prediction score of the negative sample. If the model can output a higher prediction score for more positive samples than for negative samples, it can be considered that the AUC is higher and the model performance is better. The value range of AUC is between 0.5 and 1. The closer the AUC is to 1, the better the performance of the model.

[0071] In the above AUC calculations, it is necessary to determine the values ​​of some metric parameters based on the label data and prediction results of the data samples.

[0072] In addition to AUC, the performance indicators of the prediction model 125 may also include precision (Precision), which is expressed as Precision = TP / TP + FP. Precision represents the probability that a subset of data samples 102 predicted as positive samples is labeled as a positive sample. The performance indicators of the prediction model 125 may also include recall (Recall), which is expressed as Recall = TP / TP + FN, that is, the probability that a positive sample is predicted. The performance indicators of the prediction model 125 may also include a PR curve, which has recall as the horizontal axis and precision as the vertical axis. The closer the PR curve is to the upper right corner, the better the performance of the model. The area under the curve is called the AP score (Average Precision Score).

[0073] In the following, the determination of AUC will be mainly discussed as an example. AUC can be calculated in different ways, and different metric parameters are required in different calculation ways.

[0074] Figure 3AA flowchart of a process 300 for determining a value of a metric parameter according to some embodiments of the present disclosure is shown. The process 300 is used to determine a value of a metric parameter required in a calculation method of AUC. The process 300 may be implemented at the client node 110.

[0075] At block 310, the client node 110 determines the number of first-category labels (referred to as a "first number") among the plurality of ground-truth labels 105, where the first-category labels indicate that the corresponding data sample 102 belongs to the first category, e.g., indicating that the data sample 102 is a positive sample. At block 320, the client node 110 may also determine the number of second-category labels (referred to as a "second number") among the plurality of ground-truth labels 105, where the second-category labels indicate that the corresponding data sample 102 belongs to the second category, e.g., indicating that the data sample 102 is a negative sample.

[0076] At the client node 110 - k , the determination of the first number and the second number may be represented as follows:

[0077]

[0078] localN k =|X k |-localP k (2)

[0079] where |X k | represents the total number of data samples 102 of the client nodes 110 - k ; represents the value of the true value label 105 corresponding to the i-th data sample 102; localP k represents the number of first-class labels (labels indicating positive samples) at the client node 110-k, localN k represents the number of second-category labels (labels indicating positive samples) in the true value labels 105 at the client node 110 - k .

[0080] In the above formulas (5) and (6), it is assumed that for positive samples, The value of is 1, for negative samples, The value of is 0. Thus, by The sum of the positive samples indicated by the true value label 105 can be used to count the number of positive samples. The other samples except the positive samples are the number of negative samples indicated by the true value label 105. In other examples, if the true value label 105 uses other values ​​to indicate positive samples and negative samples, localP can also be counted in other ways. k and localN k , this article does not limit this. localP k and localN kmay be determined as values ​​of two metric parameters in the metric information at the client node 110 - k .

[0081] In some embodiments, at block 330, the client node 110 may further determine, based on the ranking result of the plurality of prediction scores among the prediction scores of all client nodes, the number of prediction scores in the set of prediction scores that the prediction score of the data sample 102 corresponding to the first class label (i.e., the positive sample) exceeds (referred to as a third number). The third number may serve as the value of another metric parameter of the performance indicator. This number may indicate the number of sample pairs in the total set of data samples 102 where the positive sample is ranked higher than the remaining samples (in ascending order).

[0082] For an individual client node 110 , in order to obtain a ranking result of its prediction score among the prediction scores of all client nodes, the client node 110 needs to perform signaling interaction with the service node 120 . Figure 3B A flow chart illustrating a signaling flow 350 for determining a value of a metric parameter according to some embodiments of the present disclosure.

[0083] In signaling flow 350 , client node 110 sends 352 the prediction scores output by prediction model 125 to service node 120 for ranking.

[0084] In some embodiments, before sending the prediction scores to the service node 120, the client node 110 may randomly adjust the order of the multiple prediction scores and send the multiple prediction scores to the service node in the adjusted order. By randomly adjusting the order, it is possible to avoid, in some special cases, the situation where, after the client node sequentially inputs multiple data samples 102 into the prediction model 125, the output prediction scores have a specific order, such as from largest to smallest or from smallest to largest, which may lead to certain information leakage. Random order adjustment can further enhance data privacy protection.

[0085] After receiving 354 the prediction scores, the service node 120 sorts 356 the prediction score sets from the plurality of client nodes 110 to obtain a sorted result of the prediction score from each client node 110 in the prediction score set.

[0086] In some embodiments, the service node 120 may sort the prediction score set in ascending order and assign each prediction score (Prediction score of the i-th data sample 102 of the client node 110-k) assigned ranking value In some embodiments, the ranking value Can indicate the prediction score The number of other prediction scores that are exceeded in the set of prediction scores. For example, in ascending order, the lowest prediction score is assigned a ranking value of 0, indicating that it does not exceed (is greater than) any other prediction score; the next prediction score is assigned a ranking value of 1, indicating that it is greater than 1 prediction score in the set, and so on. This assignment of ranking values ​​facilitates subsequent calculations.

[0087] For the client nodes 110 that received the prediction scores, the service node 120 sends 358 to the corresponding client nodes 110 a ranking result of its multiple prediction scores in the overall set of prediction scores. At the individual client nodes 110, based on the ranking result received 360 from the service node 120, the client node 110 may determine 362 a third number of prediction scores in the set of prediction scores that the prediction score of the data sample 102 corresponding to the first class label (i.e., the positive sample) exceeds. In some embodiments, at the client node 110-k, the third number may be determined by:

[0088]

[0089] where localSum k Indicates the third number, represents the value of the true value label 105 corresponding to the i-th data sample 102, represents the ranking value of the prediction score corresponding to the i-th data sample 102. As mentioned above, the ranking value Can be set to indicate the prediction score The number of other prediction scores exceeded in the prediction score set. In the above formula (7), it is also assumed that for positive samples, The value of is 1, for negative samples, The value of is 0. Thus, by The sum of the positive samples’ predicted scores can be used to determine the number of samples whose predicted scores are higher than the predicted scores of the remaining samples (also the number of such predicted scores). k It may be determined as a value (error value) of another metric parameter in the metric information at the client node 110 - k .

[0090] localP k 、localN k and localSum k are all metric parameters that need to be determined in the example calculation method of AUC. Assume that the total number of first-class labels at N client nodes 110 is The total number of first-class labels is And the total number of prediction scores that the prediction score of the data sample 102 (ie, the positive sample) corresponding to the first class label exceeds in the prediction score set is globalSum, then the AUC value of the model can be calculated as follows:

[0091]

[0092] In some embodiments, AUC can also be calculated by other means, and the calculation of AUC requires other metric parameters. In some embodiments, the client node 110 can determine the number of positive samples indicated by the true value label 105 and the number of negative samples indicated by the true value label 105 among the local multiple true value labels 105. In addition, the client node 110 can determine, based on the predicted score set, the number of positive samples whose predicted scores are greater than the predicted scores of negative samples in all data samples 102. Based on these three numbers, the values ​​of the metric parameters required to calculate the value of AUC can be obtained. Each client node 110 can determine the values ​​of these metric parameters statistically calculated on its own data set.

[0093] Assume that the total number of data samples 102 at N client nodes 110 is L, and the number of positive samples indicated by the true value labels 105 is m, and the number of negative samples is n. In addition, the prediction score corresponding to each data sample 102 is s i , i∈[1, L]. By traversing the pairwise combination of positive samples and negative samples, m*n sample pairs P can be formed i , i∈[1,m*n], then the AUC can be determined as follows:

[0094] (5)

[0095] in

[0096]

[0097] Some example calculation methods for AUC have been discussed above. If appropriate, AUC can also be determined from a probability and statistical perspective based on other methods.

[0098] In some embodiments, in addition to AUC, other performance indicators of the prediction model 125 may be evaluated, as long as such performance indicators can be determined from multiple prediction scores and multiple true value labels 105. Accordingly, the client node 110 may determine the value of a metric parameter related to the performance indicator from the local prediction scores and true value labels based on the type and calculation method of the performance indicator. The embodiments of the present disclosure are not limited in this respect.

[0099] In an embodiment of the present disclosure, in order to achieve privacy protection for the true value labels while determining the performance indicators of the prediction model 125, the values ​​of the multiple metric parameters determined by the client node 110 are not directly sent to the service node 120. Instead, in the signaling flow 200, after the values ​​of the multiple metric parameters are determined at the client node 110, the client node 110 applies 225 perturbations to the values ​​of the multiple metric parameters to obtain perturbed values ​​of the multiple metric parameters. The client node 110 sends 230 the perturbed values ​​of the multiple metric parameters to the service node 120.

[0100] In the embodiments of the present disclosure, by applying perturbations, it is possible to avoid exposing the true values ​​of the metric parameters calculated based on the true value labels. The following will discuss in detail how the client node applies perturbations. In this document, "perturbations" are sometimes also referred to as noise, interference, etc.

[0101] In some embodiments, it is desirable that the perturbation applied can satisfy the protection of differential privacy of the data. To better understand the embodiments of the present disclosure, the following will first briefly introduce differential privacy and random response mechanisms.

[0102] Assume that ∈, δ is a real number greater than or equal to 0, that is and It is a random mechanism (random algorithm). The so-called random mechanism means that for a specific input, the output of the mechanism is not a fixed value, but obeys a certain distribution. A random mechanism can be considered if the following conditions are met With (∈, δ)-differential privacy: For any two adjacent training datasets D, D′, and for For any subset S of the possible outputs, there exists:

[0103]

[0104] In addition, if δ = 0, it can also be considered that the random mechanism With ∈-differential privacy (∈-DP). In the differential privacy mechanism, for a random mechanism with (∈, δ)-differential privacy or ∈-differential privacy It is expected that the distributions of the two outputs obtained after applying them to two adjacent data sets will be difficult to distinguish. In this way, the observer will find it difficult to detect small changes in the input data set of the algorithm by observing the output results, thus achieving the purpose of privacy protection. If the probability of obtaining a specific output S is similar when applied to any adjacent data set, then it will be considered that the algorithm is unlikely to achieve differential privacy.

[0105] In the embodiments of this paper, we focus on the differential privacy of the labels of data samples, and the labels indicate the binary classification results. Therefore, following the setting of differential privacy, we can define label differential privacy. Specifically, assuming ∈, δ is a real number greater than or equal to 0, that is, and It is a random mechanism (random algorithm). If the following conditions are met, it can be considered a random mechanism With (∈, δ)-label differential privacy: for any two adjacent training datasets D, D′, their difference lies only in the label of a single data sample, and for For any subset S of the possible outputs, there exists:

[0106]

[0107] In addition, if δ = 0, it can also be considered that the random mechanism With ∈-differential privacy (∈-DP). That is, it is expected that after changing the label of the data sample, The distribution of the output results is still small, making it difficult for observers to detect the change of labels.

[0108] The random mechanism can obey a certain probability distribution. In some embodiments, the perturbation can be applied based on a Gaussian distribution or a Laplace distribution. In some embodiments, the client node 110 applies random perturbations to the values ​​of the metric parameters by determining a sensitivity value for the metric parameter to be perturbed and determining a probability distribution based on the sensitivity value. The following first describes sensitivity, followed by how to determine a probability distribution based on sensitivity.

[0109] Assume d is a positive integer, D is the set of data sets, and f: D → R d is a function that changes from D to R d The sensitivity of a function can be expressed as Δf, which can be defined as Δf = max||f(D1) - f(D2)||1, which represents the maximum value among all pairs of data sets D1 and D2 in D, where D1 and D2 differ by at most one data element, and ||·||1 represents the l1 norm. According to the above definition, sensitivity refers to the maximum difference in the function output when at most one data element changes.

[0110] In different types of probability distributions, sensitivity values ​​can be introduced to define specific probability distribution methods. For example, for the Gaussian distribution mechanism, for any (∈, δ)∈(0, 1), the standard deviation of the Gaussian distribution can be defined as Where Δ represents the sensitivity value. Such a Gaussian distribution has (∈, δ) differential privacy (i.e., (∈, δ)-DP).

[0111] For another example, for a Laplace distribution mechanism (which is centered at 0) with a width (scale) of b, its probability density function is expressed as: If the random noise (random perturbation) is determined by the Laplace distribution of Lap(Δ / ∈), then it can be considered that such a probability distribution can provide differential privacy of (∈, 0).

[0112] Based on the above discussion, when applying perturbations, client node 110 may determine sensitivity values ​​associated with the perturbations of different metric parameters, and determine corresponding probability distributions based on the sensitivity values ​​and the differential privacy mechanism. Client node 110 may apply perturbation values ​​to the corresponding metric parameters according to the probability distributions.

[0113] In some embodiments, the number of first-category labels localP in the plurality of true value labels 105 determined at the client node 110 - k is k and the number of second-class labels localN k , the client node 110 - k can simply apply a perturbation to any one of the values, because the other value can be determined by subtracting the previous number of perturbation values ​​from the total number of true value labels 105 at the node.

[0114] Specifically, the client node 110-k determines the local k and localN k For the value of the number of labels, it can be seen that if the value of a true value label is randomly changed, localP k or localN k The maximum change is 1. Therefore, the sensitivity value here can be determined as Δ=1. Based on the sensitivity value, the client node 110-k can determine the probability distribution that the perturbation should follow according to the differential privacy mechanism.

[0115] In some examples, a Gaussian distribution can be determined and perturbations (also called noise or Gaussian noise) can be applied based on the Gaussian distribution. According to the Gaussian distribution mechanism discussed above, for any (∈, δ)∈(0, 1), the standard deviation of the Gaussian distribution can be determined as The sensitivity value Δ = 1. Such a Gaussian distribution mechanism can satisfy (∈, δ) differential privacy (i.e., (∈, δ)-DP).

[0116] In some examples, a Laplace distribution can be determined and perturbations (also called noise or Laplace noise) can be applied based on the Laplace distribution. If differential privacy of (∈, 0) is to be satisfied, the width of the Laplace distribution can be determined as b = Δ / ∈, that is, random noise is applied from the distribution of Lap(Δ / ∈). The standard deviation of this distribution is

[0117] In some embodiments, the prediction score of the data sample 102 (ie, the positive sample) corresponding to the first class label determined at the client node 110 - k exceeds a third number of prediction scores in the set of prediction scores, localSum k , the client node 110 - k may determine a sensitivity value to a disturbance of the metric parameter.

[0118] In some embodiments, with localSum k The relevant sensitivity value is determined by the service node 120 from a global perspective. Such a perturbation method can achieve global privacy protection. From a global perspective, the sensitivity of the number of predicted scores in the predicted score set that the predicted score of the positive sample corresponding to the first class label exceeds can be determined as Δ=Q-1, where Q is the total number of data samples at N client nodes 110. The sensitivity value here means that if one data sample in the full set of data samples is changed, then the localSum k In some embodiments, a client node 110-k may receive information related to the sensitivity value from the service node 120. This information may be the total number Q of data samples from multiple client nodes, or the sensitivity value Q-1 may be directly received, or other information that can determine the sensitivity value.

[0119] In some embodiments, with localSum k The sensitivity value is determined locally by each client node 110-k. This perturbation method can achieve local privacy protection. Specifically, the client node 110-k determines the highest ranking result from the ranking results of the local multiple prediction scores, and determines the sensitivity value based on the highest ranking result, which can be expressed as That is, for the local data set at each client node, if one of the data samples is changed, then localSum k The value that changes the most is associated with the highest ranking of its corresponding prediction score in the overall set of prediction scores.

[0120] The client node 110 - k determines in any manner the value of the localSum kAfter the sensitivity value is obtained, the client node 110-k can determine the localSum based on the sensitivity value according to the differential privacy mechanism. k The probability distribution according to which the perturbation should be applied.

[0121] In some examples, a Gaussian distribution can be determined and perturbations (also called noise or Gaussian noise) can be applied based on the Gaussian distribution. According to the Gaussian distribution mechanism discussed above, for any (∈, δ)∈(0, 1), the standard deviation of the Gaussian distribution can be determined as Such a Gaussian distribution mechanism can satisfy (∈, δ) differential privacy (i.e., (∈, δ)-DP).

[0122] In some examples, a Laplace distribution can be determined and perturbations (also called noise or Laplace noise) can be applied based on the Laplace distribution. If differential privacy of (∈, 0) is to be satisfied, the width of the Laplace distribution can be determined as b = Δ / ∈, that is, random noise is applied from the distribution of Lap(Δ / ∈). The standard deviation of this distribution is

[0123] The above discussion discusses how to apply perturbations to some example metric parameters. For other different metric parameters, a similar approach can be used to determine sensitivity values ​​and corresponding probability distributions for applying perturbations accordingly. This will not be repeated here.

[0124] By applying random perturbations, the values ​​of the metric parameters determined from the local true value labels do not need to be exposed. The client node 110 may send the perturbed values ​​of the metric parameters to the service node 120.

[0125] Continue to refer Figure 2 Service node 120 receives 235 perturbation values ​​of a plurality of metric parameters provided by each of client nodes 110. Service node 120 aggregates 240 the perturbation values ​​of the plurality of metric parameters from client nodes 110 by metric parameter to obtain aggregated values ​​of the plurality of metric parameters. Service node 120 determines 245 a value of a performance indicator of prediction model 125 based on the aggregated values ​​of the plurality of metric parameters.

[0126] In some embodiments, it is assumed that the perturbation value of the metric parameter received from the client node 110 is localSum′ k , localP′ k , localN′ k , the service node 120 aggregates (e.g., adds together) the values ​​of these metric parameters of each client node 110 to obtain:

[0127]

[0128]

[0129]

[0130] Because these aggregate values ​​are determined based on perturbation values, they may not be completely equivalent to the values ​​calculated from the true labels and predicted scores of the multiple client nodes 110. However, since the multiple client nodes 110 each apply a random perturbation, in some embodiments, the mean of the random perturbations (e.g., probability distributions) applied by the client nodes 110 is 0. Thus, through the aggregation operation at the service node 120, the random perturbations of the various client nodes 110 can be offset from each other, so that the aggregate values ​​approximate the true values ​​of the metric parameters.

[0131] In some embodiments, the service node 120 may calculate the AUC value of the prediction model 125 according to the above formula (4). In some embodiments, the service node 120 may also similarly aggregate the perturbation values ​​of other metric parameters obtained from the client node 110 for use in calculating the performance indicator. For example, for the calculation method of the AUC given in the above formula (5), the service node 120 may receive the perturbation values ​​of the corresponding metric parameters from the client node 110 and aggregate them for use in calculating the AUC.

[0132] Although aggregation can offset variance in a probability distribution with a mean of 0, the resulting value may still have some variance compared to the true value of the performance indicator. However, through repeated experiments and verification, the inventors have found that this variance is small and within the acceptable range. In particular, the variance decreases as the number of participating client nodes increases.

[0133] Strictly speaking, even with true value labels, many algorithms for calculating AUC use approximations to approximate the true value of the AUC, i.e., the area under the ROC curve. Therefore, in scenarios where privacy protection of labeled data is required, various embodiments of the present disclosure enable service nodes to determine more accurate performance metrics while achieving differential privacy protection for the data.

[0134] The following discusses the error between the performance metrics (using AUC as an example) calculated according to some embodiments of the present disclosure and their true values. For convenience, it is temporarily assumed that when calculating AUC, the service node uses values ​​based on true label statistics, such as the true number of positive and negative samples.

[0135] When applying perturbations based on global privacy protection, the standard deviation of the calculated AUC is Where P is the number of positive samples, N is the number of negative samples, c is the number of client nodes, and σ is the standard deviation of the added perturbation (noise). As can be seen from the above formula, as the number of clients decreases, the added noise decreases, and the standard deviation of the calculated AUC also decreases. Taking the Laplace mechanism as an example in global privacy protection, M is the total number of client nodes. Therefore, the variance of AUC can be calculated as The standard deviation is Assuming that there is only one data sample on each client node, that is, c = M, then the standard deviation is This value is a small value in general applications.

[0136] When applying perturbations based on local privacy protection, for ease of calculation, we assume that in an extreme case, each client node has only one data sample, that is, c = M. Then the sensitivity values ​​used by these client nodes are [0, 1, 2, ..., M-1], respectively. Still taking the Laplace distribution as an example, the variance of the calculated AUC is as follows, which is also a small value in general applications:

[0137]

[0138] It should be understood that although AUC is used as an example for description, in some embodiments, the service node 120 can additionally or alternatively calculate the values ​​of other performance indicators in a similar perturbation and interaction manner.

[0139] Figure 4 Flowchart showing a process 400 for model performance evaluation at a client node according to some embodiments of the present disclosure. The process 400 may be implemented at the client node 110.

[0140] At block 410, client node 110 applies multiple data samples to a prediction model at the client node to obtain multiple prediction scores output by the prediction model. The multiple prediction scores respectively indicate predicted probabilities that the multiple data samples belong to the first category or the second category. At block 420, client node 110 determines values ​​of multiple metric parameters associated with predetermined performance indicators of the prediction model based on the multiple true value labels of the multiple data samples and the multiple prediction scores. At block 430, client node 110 perturbs the values ​​of the multiple metric parameters to obtain perturbed values ​​for the multiple metric parameters. At block 440, client node 110 transmits the perturbed values ​​of the multiple metric parameters to the service node.

[0141] In some embodiments, determining the values ​​of multiple metric parameters includes: determining a first number of first-category labels among multiple true-value labels as the value of the first metric parameter, the first-category labels indicating that the corresponding data samples belong to the first category; and determining a second number of second-category labels among multiple true-value labels as the value of the second metric parameter, the second-category labels indicating that the corresponding data samples belong to the second category.

[0142] In some embodiments, applying perturbations to the values ​​of multiple measurement parameters includes: determining a first sensitivity value associated with the perturbation of one of the first and second measurement parameters; determining a first probability distribution based on the first sensitivity value and a differential privacy mechanism; applying perturbations to the value of one of the first and second measurement parameters based on the first probability distribution to obtain a perturbation value of the measurement parameter; and determining a perturbation value of another measurement parameter of the first and second measurement parameters based on the total number of multiple true value labels and the perturbation values ​​of the measurement parameters of the first and second measurement parameters.

[0143] In some embodiments, determining the values ​​of multiple metric parameters includes: sending multiple prediction scores to a service node; receiving from the service node a ranking result of each of the multiple prediction scores in a prediction score set, the prediction score set including prediction scores sent by multiple client nodes, the multiple client nodes including client nodes; and based on the ranking result of each of the multiple prediction scores, determining a third number of prediction scores that the prediction score of the data sample corresponding to the first category label exceeds in the prediction score set as the value of the third metric parameter.

[0144] In some embodiments, applying perturbations to the values ​​of multiple measurement parameters includes: determining a second sensitivity value related to the perturbation of a third measurement parameter; determining a second probability distribution based on the second sensitivity value and a differential privacy mechanism; and applying perturbations to the value of the third measurement parameter based on the second probability distribution.

[0145] In some embodiments, determining the second sensitivity value includes: receiving information related to the second sensitivity value from the serving node; and determining the second sensitivity value based on the received information.

[0146] In some embodiments, the information related to the second sensitivity value includes a total number of data samples of the plurality of client nodes.

[0147] In some embodiments, determining the second sensitivity value includes: determining a highest ranked result from the ranked results of each of the plurality of prediction scores; and determining the second sensitivity value based on the highest ranked result.

[0148] In some embodiments, the predetermined performance metric includes at least the area under the curve (AUC) of a receiver operating characteristic (ROC) curve.

[0149] Figure 5 Flowchart showing a process 500 for model performance evaluation at a service node according to some embodiments of the present disclosure. Process 500 may be implemented at service node 120.

[0150] At block 510, service node 120 receives perturbation values ​​of multiple metric parameters associated with a predetermined performance indicator of a prediction model from multiple client nodes. At block 520, service node 120 aggregates the perturbation values ​​of the multiple metric parameters from the multiple client nodes by metric parameter to obtain aggregated values ​​of the multiple metric parameters. At block 530, service node 120 determines a value for the predetermined performance indicator based on the aggregated values ​​of the multiple metric parameters.

[0151] In some embodiments, for a given client node among a plurality of client nodes, the perturbation values ​​of the plurality of metric parameters indicate at least one of the following: a first number of first class labels among a plurality of true value labels at the given client node, the first class labels indicating that the corresponding data samples belong to the first class; a second number of second class labels among the plurality of true value labels, as the value of the second metric parameter, the second class labels indicating that the corresponding data samples belong to the second class; and a third number of prediction scores in a set of prediction scores that the prediction scores of the data samples corresponding to the first class labels at the given client node exceed, the prediction scores being determined by a prediction model based on the data samples, and the set of prediction scores including the prediction scores sent by the plurality of client nodes.

[0152] In some embodiments, process 500 further includes sending information related to the second sensitivity value to each of the plurality of client nodes.

[0153] In some embodiments, the information related to the second sensitivity value includes a total number of data samples of the plurality of client nodes.

[0154] In some embodiments, the predetermined performance metric includes at least the area under the curve (AUC) of a receiver operating characteristic (ROC) curve.

[0155] Figure 6 1 shows a block diagram of an apparatus 600 for model performance evaluation at a client node according to some embodiments of the present disclosure. The apparatus 600 may be implemented as or included in the client node 110. Each module / component in the apparatus 600 may be implemented by hardware, software, firmware, or any combination thereof.

[0156] As shown in the figure, the apparatus 600 includes a prediction module 610, which is configured to apply multiple data samples to the prediction model to obtain multiple prediction scores output by the prediction model, wherein the multiple prediction scores respectively indicate the predicted probability that the multiple data samples belong to the first category or the second category. The apparatus 600 also includes a metric determination module 620, which is configured to determine the values ​​of multiple metric parameters related to predetermined performance indicators of the prediction model based on multiple true value labels and multiple prediction scores of the multiple data samples. The apparatus 600 also includes a perturbation module 630, which is configured to apply perturbations to the values ​​of the multiple metric parameters to obtain perturbation values ​​of the multiple metric parameters; and a sending module 640, which is configured to send the perturbation values ​​of the multiple metric parameters to the service node.

[0157] In some embodiments, the metric determination module 620 includes: a first determination module, configured to determine a first number of first-category labels among a plurality of true-value labels as a value of a first metric parameter, the first-category labels indicating that the corresponding data sample belongs to the first category; and a second determination module, configured to determine a second number of second-category labels among a plurality of true-value labels as a value of a second metric parameter, the second-category labels indicating that the corresponding data sample belongs to the second category.

[0158] In some embodiments, the perturbation module includes: a first sensitivity determination module, configured to determine a first sensitivity value associated with a perturbation of one of the first and second measurement parameters; a first distribution determination module, configured to determine a first probability distribution based on the first sensitivity value and a differential privacy mechanism; a first perturbation application module, configured to apply a perturbation to the value of one of the first and second measurement parameters based on the first probability distribution to obtain a perturbation value of the one measurement parameter; and a perturbation value determination module, configured to determine the perturbation value of the other measurement parameter of the first and second measurement parameters based on the total number of multiple true value labels and the perturbation value of the measurement parameter of the first and second measurement parameters.

[0159] In some embodiments, the metric determination module includes: a score sending module configured to send multiple prediction scores to a service node; a result receiving module configured to receive, from the service node, a ranking result of each of the multiple prediction scores in a prediction score set, the prediction score set including prediction scores sent by multiple client nodes, the multiple client nodes including client nodes; and a third determination module configured to determine, based on the ranking result of each of the multiple prediction scores, a third number of prediction scores that the prediction score of the data sample corresponding to the first category label exceeds in the prediction score set, as the value of the third metric parameter.

[0160] In some embodiments, the perturbation module includes: a second sensitivity determination module, configured to determine a second sensitivity value related to the perturbation of the third measurement parameter; a second distribution determination module, configured to determine a second probability distribution based on the second sensitivity value and the differential privacy mechanism; and a second perturbation application module, configured to apply perturbation to the value of the third measurement parameter based on the second probability distribution.

[0161] In some embodiments, the second sensitivity determination module includes: a sensitivity receiving module configured to receive information related to the second sensitivity value from the service node; and an information-based determination module configured to determine the second sensitivity value based on the received information.

[0162] In some embodiments, the information related to the second sensitivity value includes a total number of data samples of the plurality of client nodes.

[0163] In some embodiments, the second sensitivity determination module includes: a ranking determination module configured to determine the highest ranking result from the ranking results of each of the multiple prediction scores; and a ranking-based determination module configured to determine the second sensitivity value based on the highest ranking result.

[0164] In some embodiments, the predetermined performance metric includes at least the area under the curve (AUC) of a receiver operating characteristic (ROC) curve.

[0165] Figure 7 1 shows a block diagram of an apparatus 700 for model performance evaluation at a client node according to some embodiments of the present disclosure. The apparatus 700 may be implemented as or included in the service node 120. Each module / component in the apparatus 700 may be implemented by hardware, software, firmware, or any combination thereof.

[0166] As shown, apparatus 700 includes a receiving module 710 configured to receive, from multiple client nodes, perturbation values ​​of multiple metric parameters associated with a predetermined performance indicator of a prediction model. Apparatus 700 also includes an aggregation module 720 configured to aggregate the perturbation values ​​of the multiple metric parameters from the multiple client nodes by metric parameter to obtain aggregated values ​​of the multiple metric parameters. Apparatus 700 also includes a performance determination module 730 configured to determine the value of the predetermined performance indicator based on the aggregated value of the multiple metric parameters.

[0167] In some embodiments, for a given client node among a plurality of client nodes, the perturbation values ​​of the plurality of metric parameters indicate at least one of the following: a first number of first class labels among a plurality of true value labels at the given client node, the first class labels indicating that the corresponding data samples belong to the first class; a second number of second class labels among the plurality of true value labels, as the value of the second metric parameter, the second class labels indicating that the corresponding data samples belong to the second class; and a third number of prediction scores in a set of prediction scores that the prediction scores of the data samples corresponding to the first class labels at the given client node exceed, the prediction scores being determined by a prediction model based on the data samples, and the set of prediction scores including the prediction scores sent by the plurality of client nodes.

[0168] In some embodiments, the apparatus 700 further includes: a sensitivity sending module configured to send information related to the second sensitivity value to a plurality of client nodes respectively.

[0169] In some embodiments, the information related to the second sensitivity value includes a total number of data samples of the plurality of client nodes.

[0170] In some embodiments, the predetermined performance metric includes at least the area under the curve (AUC) of a receiver operating characteristic (ROC) curve.

[0171] Figure 8 8 is a block diagram of a computing device / system 800 capable of implementing one or more embodiments of the present disclosure. Figure 8 The illustrated computing device / system 800 is merely exemplary and should not be construed as limiting the functionality and scope of the embodiments described herein. Figure 8 The computing device / system 800 shown may be used to implement Figure 1 The client node 110 or the service node 120 of FIG.

[0172] like Figure 8 As shown, computing device / system 800 is in the form of a general-purpose computing device. Components of computing device / system 800 may include, but are not limited to, one or more processors or processing units 810, memory 820, storage devices 830, one or more communication units 840, one or more input devices 850, and one or more output devices 860. Processing unit 810 may be a real or virtual processor and is capable of performing various processes according to a program stored in memory 820. In a multi-processor system, multiple processing units execute computer-executable instructions in parallel to increase the parallel processing capabilities of computing device / system 800.

[0173] The computing device / system 800 typically includes a plurality of computer storage media. Such media can be any available media accessible to the computing device / system 800, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 820 can be a volatile memory (e.g., registers, cache, random access memory (RAM)), a non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 830 can be a removable or non-removable medium and can include a machine-readable medium, such as a flash drive, a disk, or any other medium that can be used to store information and / or data (e.g., training data for training) and can be accessed within the computing device / system 800.

[0174] The computing device / system 800 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 8 As shown in FIG, a magnetic disk drive for reading from or writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk") and an optical disk drive for reading from or writing to a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to a bus (not shown) by one or more data media interfaces. The memory 820 may include a computer program product 825 having one or more program modules configured to perform the various methods or actions of various embodiments of the present disclosure.

[0175] The communication unit 840 enables communication with other computing devices via a communication medium. Additionally, the functionality of the components of the computing device / system 800 can be implemented as a single computing cluster or multiple computing machines that can communicate via a communication connection. Thus, the computing device / system 800 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or other network nodes.

[0176] Input device 850 may be one or more input devices, such as a mouse, keyboard, trackball, etc. Output device 860 may be one or more output devices, such as a display, speaker, printer, etc. Computing device / system 800 may also communicate with one or more external devices (not shown) via communication unit 840 as needed, such as storage devices, display devices, etc., with one or more devices that allow a user to interact with computing device / system 800, or with any device that allows computing device / system 800 to communicate with one or more other computing devices (e.g., a network card, modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0177] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions or a computer program are stored, wherein the computer-executable instructions or the computer program are executed by a processor to implement the method described above.

[0178] According to an exemplary implementation of the present disclosure, a computer program product is further provided. The computer program product is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions. The computer-executable instructions are executed by a processor to implement the method described above.

[0179] Various aspects of the present disclosure are described herein with reference to flowcharts and / or block diagrams of methods, apparatuses, devices, and computer program products implemented according to the present disclosure. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0180] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, such that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0181] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0182] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple implementations of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a part for a module, program segment or instruction, and a part for a module, program segment or instruction comprises one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0183] While various implementations of the present disclosure have been described above, the foregoing description is intended to be illustrative, not exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terminology used herein is selected to best explain the principles of the implementations, their practical applications, or improvements to existing technologies, or to enable others skilled in the art to understand the various implementations disclosed herein.

Claims

1. A method for evaluating model performance, comprising: At the client node, applying the plurality of data samples to the prediction model respectively to obtain a plurality of prediction scores output by the prediction model, the plurality of prediction scores respectively indicating a predicted probability that the plurality of data samples belong to the first category or the second category; Determining values ​​of a plurality of metric parameters related to predetermined performance indicators of the prediction model based on the plurality of true value labels of the plurality of data samples and the plurality of prediction scores, wherein determining the values ​​of the plurality of metric parameters comprises: Sending the plurality of prediction scores to a service node; receiving, from the service node, a ranking result of each of the plurality of prediction scores in a set of prediction scores, the set of prediction scores including prediction scores sent by a plurality of client nodes, the plurality of client nodes including the client node; and Based on the ranking results of each of the multiple prediction scores, determining the number of prediction scores in the prediction score set that the prediction score of the data sample corresponding to the first class label exceeds, as the value of one of the multiple metric parameters; applying perturbations to the values ​​of the plurality of measurement parameters to obtain perturbation values ​​of the plurality of measurement parameters; and The perturbation values ​​of the multiple metric parameters are sent to the service node.

2. The method of claim 1 , wherein determining the values ​​of the plurality of metric parameters comprises: determining a first number of first-category labels among the plurality of true value labels as a value of a first metric parameter, wherein the first-category labels indicate that corresponding data samples belong to the first category; as well as A second number of second-category labels among the plurality of true value labels is determined as a value of a second metric parameter, wherein the second-category labels indicate that the corresponding data sample belongs to the second category.

3. The method of claim 2 , wherein applying a perturbation to the values ​​of the plurality of metric parameters comprises: determining a first sensitivity value associated with a disturbance of one of the first metric parameter and the second metric parameter; Determining a first probability distribution based on the first sensitivity value and a differential privacy mechanism; Applying a perturbation to the value of the one metric parameter between the first metric parameter and the second metric parameter based on the first probability distribution to obtain a perturbation value of the one metric parameter; as well as A perturbation value of the other metric parameter of the first metric parameter and the second metric parameter is determined based on the total number of the plurality of true value labels and the perturbation value of the metric parameter of the first metric parameter and the second metric parameter.

4. The method of claim 1 , wherein applying a perturbation to the values ​​of the plurality of metric parameters comprises: determining a second sensitivity value associated with a perturbation of the metric parameter; determining a second probability distribution based on the second sensitivity value and a differential privacy mechanism; as well as Based on the second probability distribution, a perturbation is applied to the value of the metric parameter.

5. The method of claim 4 , wherein determining the second sensitivity value comprises: receiving information related to the second sensitivity value from the serving node; as well as The second sensitivity value is determined based on the received information. The method of claim 4 , wherein the information related to the second sensitivity value comprises a total number of data samples of the plurality of client nodes.

7. The method of claim 4, wherein determining the second sensitivity value comprises: determining a highest ranked result from the ranked results of each of the plurality of prediction scores; as well as The second sensitivity value is determined based on the highest ranked result.

8. The method according to any one of claims 1 to 7, wherein the predetermined performance indicator comprises at least the area under the curve (AUC) of a receiver operating characteristic (ROC) curve.

9. A method for evaluating model performance, comprising: determining, at a service node, a ranking result of each of a plurality of prediction scores for each of a plurality of client nodes in a set of prediction scores, the set of prediction scores comprising the prediction scores sent by the plurality of client nodes; sending the ranking result of each client node in the plurality of client nodes to the corresponding client node; receiving, from the plurality of client nodes, disturbance values ​​of a plurality of metric parameters associated with predetermined performance indicators of the prediction model; aggregating the disturbance values ​​of the multiple metric parameters from the multiple client nodes according to the metric parameters to obtain an aggregate value of the multiple metric parameters; as well as A value of the predetermined performance indicator is determined based on the aggregated values ​​of the plurality of metric parameters.

10. The method of claim 9, wherein for a given client node among the plurality of client nodes, the perturbed values ​​of the plurality of metric parameters indicate at least one of the following: a first number of first-category labels among the plurality of ground-truth labels at the given client node, the first-category labels indicating that the corresponding data samples belong to a first category; a second number of second-category labels in the plurality of true value labels, as a value of a second metric parameter, wherein the second-category labels indicate that the corresponding data sample belongs to a second category; and The prediction score of the data sample corresponding to the first class label at the given client node exceeds a third number of prediction scores in a set of prediction scores, wherein the prediction score is determined by the prediction model based on the data sample, and the set of prediction scores includes the prediction scores sent by the multiple client nodes.

11. The method according to claim 10, further comprising: Information related to the second sensitivity value is sent to each of the plurality of client nodes. 12 . The method of claim 11 , wherein the information related to the second sensitivity value comprises a total number of data samples of the plurality of client nodes.

13. The method according to any one of claims 9 to 12, wherein the predetermined performance indicator comprises at least the area under the curve (AUC) of a receiver operating characteristic (ROC) curve.

14. A device for model performance evaluation, comprising: a prediction module configured to apply the plurality of data samples to the prediction model respectively to obtain a plurality of prediction scores output by the prediction model, the plurality of prediction scores respectively indicating a predicted probability that the plurality of data samples belong to the first category or the second category; A metric determination module is configured to determine values ​​of a plurality of metric parameters related to predetermined performance indicators of the prediction model based on a plurality of true value labels of the plurality of data samples and the plurality of prediction scores, wherein determining the values ​​of the plurality of metric parameters comprises: Sending the plurality of prediction scores to a service node; receiving, from the service node, a ranking result of each of the plurality of prediction scores in a set of prediction scores, the set of prediction scores including prediction scores sent by a plurality of client nodes, the plurality of client nodes including the client node; and Based on the ranking results of each of the multiple prediction scores, determining the number of prediction scores in the prediction score set that the prediction score of the data sample corresponding to the first class label exceeds, as the value of one of the multiple metric parameters; a perturbation module configured to apply perturbations to the values ​​of the plurality of measurement parameters to obtain perturbation values ​​of the plurality of measurement parameters; and The sending module is configured to send the disturbance values ​​of the multiple measurement parameters to the service node.

15. A device for model performance evaluation, comprising: a ranking module configured to determine a ranking result of each of a plurality of prediction scores of each client node in a plurality of client nodes in a set of prediction scores, the set of prediction scores including the prediction scores sent by the plurality of client nodes; a sending module, configured to send the ranking result of each client node among the plurality of client nodes to the corresponding client node; a receiving module configured to receive, from a plurality of client nodes, disturbance values ​​of a plurality of metric parameters associated with a predetermined performance indicator of the prediction model; an aggregation module configured to aggregate the disturbance values ​​of the multiple metric parameters from the multiple client nodes according to the metric parameters to obtain an aggregate value of the multiple metric parameters; as well as The performance determination module is configured to determine a value of the predetermined performance indicator based on the aggregated value of the multiple metric parameters.

16. An electronic device comprising: at least one processing unit; as well as At least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the apparatus to perform the method according to any one of claims 1 to 8 when executed by the at least one processing unit.

17. An electronic device comprising: at least one processing unit; as well as At least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the apparatus to perform the method according to any one of claims 9 to 13.

18. A computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the method according to any one of claims 1 to 8.

19. A computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the method according to any one of claims 9 to 13.

Images