A differential privacy gradient adaptive clipping method and device based on minimizing gradient square error

Abstract

The application discloses a differential privacy gradient adaptive clipping method and device based on minimizing gradient square error, which comprises the following steps: inputting a batch of sample data into a classification model and calculating a gradient, and calculating a two norm based on the gradient; constructing a privacy histogram of the two norm based on a preset range, and updating the range, resampling data, calculating the two norm and reconstructing the privacy histogram when judging that the range of the privacy histogram is not appropriate; constructing a candidate set according to a current clipping threshold, calculating the gradient square error of each clipping threshold in the candidate set based on the finally constructed privacy histogram, and screening the optimal clipping threshold of the current round based on the principle of minimizing the gradient square error; when judging that the optimal clipping threshold of the current round is not appropriate, constructing a new candidate set according to the optimal clipping threshold, and iteratively re-screening; and calculating the privacy overhead under the optimal clipping threshold. The method and device not only guarantee the model performance, but also greatly reduce the computing power overhead of the computing device, and are suitable for low-computing-power devices.

Description

A differential privacy gradient adaptive pruning method and apparatus based on minimizing the squared gradient error. Technical Field

[0001] This invention relates to the field of data privacy protection technology for deep learning models, and in particular to a differential privacy gradient adaptive pruning method and apparatus based on minimizing the gradient squared error. Background Technology

[0002] Over the past few decades, deep learning has made significant strides in fields such as computer vision, natural language processing, and speech processing. The success of deep learning models relies heavily on massive datasets; however, some datasets are highly sensitive (such as medical records, income information, and images of lesions). Existing research has shown that deep learning models trained using these datasets pose privacy risks. Attackers could even obtain information from the training data simply by gaining black-box access to the deep learning model. In today's world, where privacy is increasingly important, such risks hinder the further application of deep learning models.

[0003] Differential privacy is a widely used privacy mechanism to protect data privacy. Generally, differential privacy uses noise perturbation to ensure that the algorithm's output distribution does not significantly change when a data point is added or removed from the input, thus protecting the privacy of the data points. Differential privacy has various implementations, with perturbing the gradient during training being the most common method in deep learning training. Examples include existing techniques such as "Dpis: An enhanced mechanism for differentially private SGD with importance sampling" and "Deep Learning with Differential Privacy." In current mainstream gradient perturbation algorithms, to limit gradient sensitivity by adding appropriate noise, a pre-set threshold is typically used to prune the gradient to ensure an upper bound and thus maintain sensitivity. However, the choice of pruning threshold significantly impacts the model's final performance; and selecting the pruning threshold requires training a large number of models (potentially hundreds), incurring significant time and privacy overhead, making such a choice difficult for trainers with limited computing power. Summary of the Invention

[0004] To address the technical problem that setting a clipping threshold in existing gradient perturbation techniques incurs significant time and privacy overhead, this invention aims to provide a differential privacy gradient adaptive clipping method and apparatus based on minimizing the squared gradient error. This method acquires gradient distribution information while satisfying differential privacy, and dynamically sets the clipping threshold during training based on the principle of minimizing the squared gradient error. This method significantly reduces the computational overhead of computing devices while ensuring model performance, making it particularly suitable for devices with low computing power.

[0005] To achieve the above-mentioned objectives, an embodiment provides a differential privacy gradient adaptive pruning method based on minimizing the squared gradient error, comprising the following steps:

[0006] A batch of sample data containing privacy information is sampled, input into a classification model, and the gradient of the sample data in the classification model is calculated. The L2 norm is then calculated based on the gradient.

[0007] A privacy histogram with a 2-norm is constructed based on a preset range. When the range of the privacy histogram is deemed inappropriate, the range is updated, the data is resampled, the 2-norm is calculated, and the privacy histogram is reconstructed.

[0008] When the range of the privacy histogram is deemed appropriate, a candidate set is constructed based on the current pruning threshold. The gradient squared error of each pruning threshold in the candidate set is calculated based on the final constructed privacy histogram. The optimal pruning threshold for the current round is then selected based on the principle of minimizing the gradient squared error. If the optimal pruning threshold for the current round is deemed inappropriate, a new candidate set is constructed based on the optimal pruning threshold, and the selection is iteratively re-selected.

[0009] If the optimal pruning threshold for the current round is appropriate, output the optimal pruning threshold and calculate the privacy overhead under the optimal pruning threshold.

[0010] Preferably, the step of constructing a privacy histogram based on a preset range using a L2 norm includes:

[0011] The histogram has a preset range of [0, R] and m buckets. Each bucket records the number of L2 norm values ​​falling within its corresponding interval. L2 norm values ​​exceeding the preset range are placed in the last bucket of the histogram. The calculation process for the bucket index into which the L2 norm n is placed is as follows:

[0012]

[0013] Add noise with a Gaussian distribution of mean 0 and standard deviation σ to the number of L2 norms in each bucket of the histogram to obtain the privacy histogram H′.

[0014] Preferably, when the range of the privacy histogram is deemed inappropriate, the range is updated, the L2 norm is calculated from the resampled data, and the privacy histogram is reconstructed, including:

[0015] The privacy histogram's range is determined by whether the data clusters on its left or right side. The method for determining if the privacy histogram's range is too large is as follows:

[0016]

[0017] ∑H ′ [i] represents the summation of the right half of the privacy histogram's buckets, where i represents the bucket index. This indicates that the range of the histogram is too large. Set the histogram range R to 0.5R, resample the data based on the updated 0.5R, calculate the L2 norm, and reconstruct the privacy histogram.

[0018] The method to determine if the range of a privacy histogram is too small is as follows:

[0019]

[0020] H ′ [m-1] represents the value of the rightmost bucket in the histogram. If too much data is found to be outside the histogram range and placed in the last histogram bucket, the histogram range R is set to 2R. Based on the updated 2R, the data is resampled, the L2 norm is calculated, and the privacy histogram is reconstructed.

[0021] Preferably, when the range of the privacy histogram is determined to be appropriate, constructing a candidate set based on the current pruning threshold includes:

[0022] when and In this case, the range of the privacy histogram is considered appropriate;

[0023] The current pruning threshold is C, and i is set to an integer from 1 to 20. Then the candidate set is... That is, the candidate set range is [0.1C, 2C].

[0024] Preferably, the optimal pruning threshold C for the current round is selected using the following formula based on the principle of minimizing the squared gradient error. new :

[0025]

[0026]

[0027] Where C represents belonging to the candidate set S C In the clipping threshold, SE(C) represents the squared error of the gradient of the clipping threshold C, and σ T This represents the noise intensity added to the gradient in the differential privacy deep learning gradient perturbation training algorithm, where d represents the dimension of the gradient, and B represents the noise intensity added to the gradient. T The value represents the batch size of the data during training, i represents the bucket index, which takes values ​​from 0 to m, and H′[i] represents the number of L2 norms in the i-th bucket of the privacy histogram.

[0028] Preferably, when the optimal pruning threshold for the current round is deemed unsuitable, constructing a new candidate set based on the optimal pruning threshold includes:

[0029] When the optimal clipping threshold C new If the value is 0.1C or 2C, the optimal pruning threshold for the current round is considered inappropriate; otherwise, the optimal pruning threshold for the current round is considered appropriate. If inappropriate, let C = C. new Construct a new candidate set as [0.1C]. new 2C new ].

[0030] Preferably, calculating the privacy overhead under the optimal pruning threshold includes:

[0031] Calculate a series of (α,ρ)-RDPs using the following formula:

[0032]

[0033] Where, n H The number of times the privacy histogram is constructed is given by: exp(x) = e raised to the power of x; α is the order of RDP, which is a positive integer greater than 1; k is the index of the order; σ represents the intensity of the noise added when constructing the privacy histogram; B represents the expected amount of sampled data; N represents the total amount of data; ρ represents a parameter that measures the degree of privacy protection. The smaller ρ is, the better the privacy protection. RDP (Renyi Differential Privacy) represents Renyi differential privacy.

[0034] The series of corresponding (α,ρ)-RDPs are converted to (∈,δ)-DPs using the following formula:

[0035]

[0036] Where δ represents the failure probability, ∈ represents the parameter that measures the strength of privacy protection, log() represents the logarithm to the base 2, and DP represents differential privacy;

[0037] Select the smallest ∈ from a series of (∈,δ)-DP and output it.

[0038] Preferably, the differential privacy gradient adaptive cropping method is used in image classification tasks, where the sample data is image data with privacy information and the corresponding classification model is an image classification model.

[0039] It is also used in text classification tasks, where the sample data is text data with privacy information, and the corresponding classification model is a text classification model.

[0040] It is also used in speech classification tasks, where the sample data is text and speech data with privacy information, and the corresponding classification model is a speech classification model.

[0041] To achieve the above-mentioned objectives, the embodiments also provide a differential privacy gradient adaptive pruning device based on minimizing the gradient squared error, including a data sampling module, a histogram construction module, a histogram judgment module, a calculation module, a candidate set judgment module, and a privacy statistics module;

[0042] The data sampling module is used to sample a batch of sample data containing privacy information, input it into the classification model, calculate the gradient of the sample data in the classification model, and calculate the L2 norm based on the gradient.

[0043] The histogram construction module is used to construct a privacy histogram with a L2 norm based on a preset range;

[0044] The histogram judgment module is used to determine whether the range of the privacy histogram is appropriate based on whether the data distribution of the privacy histogram is concentrated on one side. When the range of the privacy histogram is determined to be inappropriate, the range is updated, the data is resampled, the L2 norm is calculated, and the privacy histogram is reconstructed.

[0045] The calculation module is used to construct a candidate set based on the current pruning threshold when the range of the privacy histogram is deemed appropriate, calculate the gradient squared error of each pruning threshold in the candidate set based on the finally constructed privacy histogram, and select the optimal pruning threshold for the current round based on the principle of minimizing the gradient squared error.

[0046] The candidate set judgment module is used to construct a new candidate set based on the optimal pruning threshold when it is determined that the optimal pruning threshold of the current round is not appropriate, and to iteratively re-filter and output the final optimal pruning threshold.

[0047] The privacy statistics module is used to calculate the privacy overhead of the entire process when it determines that the optimal pruning threshold for the current round is appropriate.

[0048] Preferably, the differential privacy gradient adaptive cropping device is used in image classification tasks, where the sample data is image data with privacy information and the corresponding classification model is an image classification model.

[0049] It is also used in text classification tasks, where the sample data is text data with privacy information, and the corresponding classification model is a text classification model.

[0050] It is also used in speech classification tasks, where the sample data is text and speech data with privacy information, and the corresponding classification model is a speech classification model.

[0051] Compared with the prior art, the present invention has at least the following beneficial effects:

[0052] (1) This invention eliminates the need for external manual adjustment of the pruning threshold (any initial pruning threshold can be set, and this invention will adjust it adaptively), while ensuring that the pruning threshold is dynamically updated during training, which is beneficial to the convergence of the differential privacy classification model training algorithm.

[0053] (2) This invention does not require additional auxiliary datasets or other hyperparameters. By approximating the privacy of the gradient norm 2 during the training of the classification model, the optimal pruning threshold can be automatically determined during the training process, which greatly reduces the overhead of hyperparameter tuning for differential privacy deep learning.

[0054] (3) This invention is simple and feasible, with low computational overhead. It does not require modification of the differential privacy gradient perturbation method and can be combined as an enhancement module with various gradient perturbation algorithms that require a pruning threshold C. It can also be combined with various common optimization algorithms, such as SGD, Adam, and SGD-Momentum.

[0055] (4) This invention uses a privacy histogram with low sensitivity to approximate the gradient L2 norm distribution. Combined with the privacy enhancement effect of downsampling, it has a small privacy overhead when analyzed under the RDP framework. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 is a flowchart of the differential privacy gradient adaptive pruning method based on minimizing the gradient squared error provided in the embodiment;

[0058] Figure 2 is a schematic diagram of the differential privacy gradient adaptive pruning device based on minimizing the gradient squared error provided in the embodiment;

[0059] Figure 3 is a flowchart of the combination of the method of the present invention and the differential privacy gradient perturbation method provided in the embodiment. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of protection of this invention.

[0061] The inventive concept of this invention is as follows: This invention proposes a gradient adaptive cropping method that minimizes the squared gradient error. This method is applicable to tasks such as image classification, text classification, and speech classification. By dynamically cropping the threshold, the performance of image classification models, text classification models, and speech classification models is improved. The dynamic cropping threshold only requires setting an initial value. Since this invention adaptively adjusts the candidate set, setting it to 1 is suitable for various scenarios. Therefore, the computational overhead of selecting the cropping threshold can be eliminated, solving the problem that existing technical solutions are difficult to apply in low-computation scenarios. Furthermore, the adaptive cropping process also satisfies differential privacy, effectively protecting the privacy of training sample data.

[0062] The differential privacy gradient adaptive cropping method can be used in image classification tasks, where the sample data is image data with privacy information, and the corresponding classification model is an image classification model. It can also be used in text classification tasks, where the sample data is text data with privacy information, and the corresponding classification model is a text classification model. Furthermore, it can be used in speech classification tasks, where the sample data is both text and speech data with privacy information, and the corresponding classification model is a speech classification model.

[0063] Taking the training of an image classification model for an image classification task as an example, the training dataset is CIFAR10, and the image classification model is ResNet18. Before training, the training image data is preprocessed, including normalization. During training, the commonly used Differential Privacy Stochastic Gradient Descent (DPSGD) algorithm is used, and the method of this invention is inserted into the training process.

[0064] As shown in Figure 1, the differential privacy gradient adaptive pruning method based on minimizing the squared gradient error provided in the embodiment includes the following steps:

[0065] Step 1: Sample a batch of image data containing privacy information, input it into the classification model, calculate the gradient of the image data in the image classification model, and calculate the L2 norm based on the gradient.

[0066] To reduce privacy overhead, downsampling is used to enhance privacy protection. A batch of data is sampled from the training dataset using equal-probability Poisson sampling (i.e., Bernoulli sampling). This sampled data is used to evaluate the distribution of the entire training image set. By leveraging the privacy amplification properties of downsampling, privacy overhead is reduced, while computation time is also decreased.

[0067] Specifically, in the downsampling phase, in each round of sampling, each image data has the same probability p = B / sampled, where B and N represent the expected sampled data volume and the total data volume, respectively. In this embodiment, N = 60000, and B is recommended to be set to 2000. Therefore, the actual number of images sampled in each round is not fixed, but the mathematical expectation is B. The sampled image data is then input into the image classification model, and backpropagation is used to calculate the gradient corresponding to each sample. During this process, the image classification model parameters θ are not updated; only the gradient g is calculated, and the L2 norm n = ||g|| for each gradient is calculated.

[0068] Step 2: Construct a privacy histogram with a 2-norm based on a preset range.

[0069] In this embodiment, the specific process of constructing the privacy histogram includes:

[0070] Step 2-1: To reduce sensitivity and thus the intensity of added noise, a histogram H is constructed to approximate the distribution of the L2 norm. This histogram H is a uniform histogram with a preset range of [0, R]. For example, R can be 100. The preset range is divided into m uniform intervals, corresponding to the m buckets of the histogram. For example, m can be 20. The histogram H is represented by an array of size m, which is initialized to 0. Then, for each L2 norm, its corresponding interval is calculated, and the array value of the corresponding interval is incremented by 1. For L2 norms outside the range [0, R], they are placed in the last bucket of the histogram. The calculation process for the bucket index where the L2 norm n should be placed is as follows:

[0071]

[0072] Since removing a L2 norm only affects the value of one bucket, and this value changes by at most 1, the sensitivity of histogram H is 1. Furthermore, because L2 norms outside the range are placed in the last bucket, an improperly set histogram range will result in an inaccurate approximation of the distribution, further leading to larger calculation errors in subsequent calculations. Therefore, a subsequent step will determine whether to change the histogram range and reconstruct it.

[0073] Step 2-2: Add Gaussian-distributed noise to the number of L2 norms corresponding to each bucket of the histogram to obtain the privacy histogram H′. The Gaussian distribution... This represents a Gaussian distribution with a mean of 0 and a standard deviation of σS. The sensitivity S is set to 1 in this example.

[0074] Since directly using histograms would compromise the privacy of image data, noise is added to the histograms to protect privacy. Because the sensitivity of a histogram is 1, Gaussian noise with a mean of 0 and a standard deviation of σ (σ = 2 in this example) is added to the number of L2 values ​​in each bucket of H, resulting in a privacy histogram H′. Due to the post-processing characteristics of differential privacy, using the privacy histogram H′ for calculation does not incur additional privacy overhead; when calculating privacy overhead, only the number of times the privacy histogram is constructed needs to be considered.

[0075] Step 3: If the range of the privacy histogram is deemed inappropriate, update the range and reconstruct the privacy histogram.

[0076] To ensure the accuracy of the final result, it is desirable for the histogram range to cover as many gradient L2 norms as possible, while also ensuring a relatively accurate approximate distribution of the L2 norms. To this end, the privacy histogram range is judged by whether the data in the privacy histogram clusters on the left or right side of the privacy histogram. The method for judging whether the privacy histogram range is too large is as follows:

[0077]

[0078] ∑H ′ [i] represents the summation of the right half of the privacy histogram's buckets, where i represents the bucket index. This indicates that the histogram range is too large. Set the histogram range R to 0.5R, and reconstruct the privacy histogram according to steps 1 and 2 based on the updated 0.5R.

[0079] The method to determine if the range of a privacy histogram is too small is as follows:

[0080]

[0081] H ′ [m-1] represents the value of the rightmost bucket in the histogram. If too much data is found to be outside the histogram range and placed in the last histogram bucket, the histogram range R is set to 2R. Based on the updated 2R, the privacy histogram is reconstructed according to steps 1 and 2.

[0082] Step 4: When the range of the privacy histogram is deemed appropriate, a candidate set is constructed based on the current pruning threshold. The gradient squared error of each pruning threshold in the candidate set is calculated based on the final constructed privacy histogram. The optimal pruning threshold for the current round is then selected based on the principle of minimizing the gradient squared error.

[0083] In the embodiment, when it is determined that the data in the privacy histogram does not cluster on the left or right side of the privacy histogram, that is, when... and If the range of the privacy histogram is considered appropriate, then based on the current pruning threshold of C, and setting i to an integer from 1 to 20, the constructed candidate set is... That is, the candidate set range is [0.1C, 2C].

[0084] To reduce privacy overhead, we use a privacy histogram H. ′ The gradient squared error is approximated using a method that avoids additional privacy overhead due to the post-processing characteristics of differential privacy. The gradient squared error corresponding to C is calculated based on the privacy histogram H′. This gradient squared error is the squared error between the clipped and denoised gradient and the original gradient, used to measure the impact of clipping and denoising on the gradient. A smaller squared error indicates a smaller impact of clipping and denoising on the gradient. The calculation formula is as follows:

[0085]

[0086] Where C represents belonging to the candidate set S C In the clipping threshold, SE(C) represents the squared error of the gradient of the clipping threshold C, and σ T This represents the noise intensity added to the gradient in the differential privacy deep learning gradient perturbation training algorithm, where d represents the dimension of the gradient, and B represents the noise intensity added to the gradient. T This indicates the batch size of data during training, where i represents the bucket index, with a value from 0 to m. Let x represent the j-th image sample. j The corresponding gradient's L2 norm, max() represents taking the maximum value.

[0087] Directly calculating SE(C) using the above formula requires obtaining the norm of each gradient, resulting in significant privacy overhead. This invention approximates the last term in the above formula based on the gradient norm described by the privacy histogram H′. During calculation, H′ is traversed, and for each bucket's norm value, the median of the corresponding interval is used. This median is then multiplied by the number of elements in the bucket and summed accordingly, finally averaging the results. The calculation formula is as follows:

[0088]

[0089] Where H′[i] represents the number of L2 norms in the i-th bucket of the privacy histogram.

[0090] Finally, calculate S in the candidate set. C For each C, output the C with the smallest squared gradient error. new The calculation formula is as follows:

[0091]

[0092] Step 5: If the optimal pruning threshold for the current round is not suitable, construct a new candidate set based on the optimal pruning threshold and iteratively re-filter.

[0093] In the embodiment, it is necessary to determine C new Is it appropriate? Because of S C The corresponding range is [0.1C, 2C], and the graph of C-gradient squared error is a U-shaped curve. To avoid C values ​​outside this range that would result in a smaller gradient squared error, the optimal cropping threshold C is... new If the value is 0.1C or 2C, the optimal pruning threshold for the current round is considered inappropriate; otherwise, the optimal pruning threshold for the current round is considered appropriate. If inappropriate, let C = C. new Construct a new candidate set as [0.1C]. new 2C new Based on the new candidate set [0.1C] new 2C new Repeat step 4 to filter C. new The process. Due to the use of the previously created privacy histogram H... ′ The computation, based on the post-processing characteristics of differential privacy, does not incur additional privacy overhead.

[0094] Step 6: If the optimal pruning threshold for the current round is appropriate, output the optimal pruning threshold and calculate the privacy overhead under the optimal pruning threshold.

[0095] In this embodiment, it is necessary to calculate the privacy overhead. Throughout the algorithm, only step 1 accesses the results related to the unprocessed privacy data, i.e., the unprocessed gradient L2 norm. Therefore, each construction of the privacy histogram incurs privacy overhead. The specific steps for calculating the privacy overhead of the entire process are as follows:

[0096] Calculate a series of (α,ρ)-RDPs using the following formula:

[0097]

[0098] Where, n H The number of times the privacy histogram is constructed is given by exp(x), where exp(x) represents the natural base e raised to the power of x, α is the order of RDP, and its value is a positive integer greater than 1. To obtain a more accurate privacy overhead, multiple α values ​​need to be calculated, and any number of values ​​can be used. In practice, values ​​from 2 to 64 are generally used. k is the index of the order, σ represents the intensity of the noise added when constructing the privacy histogram, B represents the expected amount of sampled data, N represents the total amount of data, and ρ represents a parameter that measures the degree of privacy protection. The smaller the ρ value, the better the privacy protection. RDP (Renyi Differential Privacy) represents Renyi differential privacy.

[0099] The series of corresponding (α,ρ)-RDPs are converted to (∈,δ)-DPs using the following formula:

[0100]

[0101] Where δ represents the failure probability, ∈ represents the parameter that measures the strength of privacy protection, log() represents the logarithm to the base 2, and DP represents differential privacy;

[0102] The minimum ∈ is selected and output from a series of (∈,δ)-DPs. By first aggregating within the RDP framework and then converting to DP, this invention can output a relatively accurate result with low privacy overhead.

[0103] Based on the same inventive concept, the embodiment also provides a differential privacy gradient adaptive pruning device based on minimizing the gradient squared error, as shown in Figure 2, including a data sampling module, a histogram construction module, a histogram judgment module, a calculation module, a candidate set judgment module, and a privacy statistics module.

[0104] The data sampling module is used to sample a batch of sample data containing privacy information, input it into the classification model, calculate the gradient of the sample data in the classification model, and calculate the L2 norm based on the gradient.

[0105] The histogram construction module is used to construct privacy histograms with a L2 norm based on a preset range;

[0106] The histogram judgment module is used to determine whether the range of the privacy histogram is appropriate based on whether the data distribution of the privacy histogram is concentrated on one side. When the range of the privacy histogram is determined to be inappropriate, the range is updated, the data is resampled, the L2 norm is calculated, and the privacy histogram is reconstructed.

[0107] The calculation module is used to construct a candidate set based on the current pruning threshold when the range of the privacy histogram is deemed appropriate, calculate the gradient squared error of each pruning threshold in the candidate set based on the finally constructed privacy histogram, and select the optimal pruning threshold for the current round based on the principle of minimizing the gradient squared error.

[0108] The candidate set judgment module is used to check whether the range of the candidate set covers the theoretical optimal pruning threshold. If it is determined that the optimal pruning threshold of the current round is not appropriate, a new candidate set is constructed based on the optimal pruning threshold, and the selection is iteratively re-screened to output the final optimal pruning threshold.

[0109] The privacy statistics module is used to determine if the optimal pruning threshold is appropriate for the current round, and then calculate the privacy overhead under the optimal pruning threshold. That is, the privacy overhead is calculated based on the number of times the histogram is constructed and the intensity of the added noise.

[0110] In practical applications, this invention needs to be used in conjunction with the ordinary differential privacy gradient perturbation algorithm, as shown in Figure 3. The normal training process of this invention and the differential privacy gradient perturbation algorithm is independent. At the initial stage of training and after each subsequent training iteration (half or a full iteration), a pruning threshold C is obtained using this method, and this C is used for pruning during the training of the differential privacy gradient perturbation algorithm. To calculate the privacy overhead of the entire process, the (α,ρ)-RDP of this invention and the differential privacy gradient perturbation algorithm are calculated separately, and the sum of the two is converted to (∈,δ)-DP.

[0111] The specific embodiments described above illustrate the technical solution and beneficial effects of the present invention in detail. It should be understood that the above description is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A differential privacy gradient adaptive pruning method based on minimizing the squared gradient error, characterized in that, Includes the following steps: A batch of sample data containing privacy information is sampled, input into a classification model, and the gradient of the sample data in the classification model is calculated. The L2 norm is calculated based on the gradient. A privacy histogram of the L2 norm is constructed based on a preset range. When the range of the privacy histogram is deemed inappropriate, the range is updated, the data is resampled, the L2 norm is calculated, and the privacy histogram is reconstructed. When the range of the privacy histogram is deemed appropriate, a candidate set is constructed based on the current cropping threshold. The gradient squared error of each cropping threshold in the candidate set is calculated based on the final constructed privacy histogram. The optimal cropping threshold for the current round is then selected based on the principle of minimizing the gradient squared error. If the optimal cropping threshold for the current round is deemed inappropriate, a new candidate set is constructed based on the optimal cropping threshold, and the selection is iteratively repeated. If the optimal cropping threshold for the current round is deemed appropriate, the optimal cropping threshold is output, and the privacy overhead of the entire process is calculated. This differential privacy gradient adaptive cropping method is used in image classification tasks, where the sample data is image data with privacy information, and the corresponding classification model is an image classification model. It is also used in text classification tasks, where the sample data is text data with privacy information, and the corresponding classification model is a text classification model. Furthermore, it is used in speech classification tasks, where the sample data is text and speech data with privacy information, and the corresponding classification model is a speech classification model.

2. The differential privacy gradient adaptive pruning method based on minimizing the squared gradient error according to claim 1, characterized in that, The construction of a privacy histogram based on a preset range and its L2 norm includes: the preset range of the histogram is... The number of buckets in the histogram is Each bucket records the number of L2 norm values ​​falling within the corresponding interval of the bucket. L2 norm values ​​exceeding a preset range are placed into the last histogram bucket of the histogram. Then the L2 norm... Bucket number to be placed The calculation process is as follows: Add a value to the number of L2 norms in each bucket of the histogram that has a mean of 0 and a standard deviation of . The privacy histogram is obtained from the Gaussian distributed noise. 。 3. The differential privacy gradient adaptive pruning method based on minimizing the squared gradient error according to claim 1, characterized in that, When the range of the privacy histogram is deemed inappropriate, the range is updated, the L2 norm is calculated from the resampled data, and the privacy histogram is reconstructed. This includes determining whether the range of the privacy histogram is too large or too small by judging whether the data in the privacy histogram is clustered on the left or right side of the privacy histogram. The method for determining whether the range of the privacy histogram is too large is as follows: To accumulate the right half of the privacy histogram's buckets, where i represents the bucket index, if... This indicates that the range of the histogram is too large, and the range of the histogram should be reduced. Set as According to the updated Resample the data, calculate the L2 norm, and reconstruct the privacy histogram; determine if the range of the privacy histogram is too small by: To get the value of the rightmost bucket in the histogram, if If too much data exceeds the histogram's range, it is considered to have been placed in the last histogram bucket. Therefore, the histogram range R is set to 2R, based on the updated... The data was resampled, the L2 norm was calculated, and the privacy histogram was reconstructed.

4. The differential privacy gradient adaptive pruning method based on minimizing the squared gradient error according to claim 3, characterized in that, The step of constructing a candidate set based on the current pruning threshold when the range of the privacy histogram is deemed appropriate includes: when and If the current pruning threshold is C, and i is set to an integer from 1 to 20, then the candidate set is... That is, the candidate set range is 。 5. The differential privacy gradient adaptive pruning method based on minimizing the squared gradient error according to claim 1, characterized in that, The following formula is used to select the optimal pruning threshold for the current round based on the principle of minimizing the squared gradient error. ： Where C represents belonging to the candidate set The clipping threshold in the middle, Indicates the clipping threshold The gradient squared error, This represents the noise intensity added to the gradient in the differential privacy deep learning gradient perturbation training algorithm. The dimension representing the gradient. Indicates the batch size of data during training. This represents the bucket index, with values ​​from 0 to m. This represents the number of L2 norms in the i-th bucket of the privacy histogram.

6. The differential privacy gradient adaptive pruning method based on minimizing the squared gradient error according to claim 1, characterized in that, When the optimal pruning threshold for the current round is deemed inappropriate, a new candidate set is constructed based on the optimal pruning threshold, including: when the optimal pruning threshold... If the value is 0.1C or 2C, the optimal pruning threshold for the current round is considered inappropriate; otherwise, the optimal pruning threshold for the current round is considered appropriate. If inappropriate, let... Construct a new candidate set for 。 7. The differential privacy gradient adaptive pruning method based on minimizing the squared gradient error according to claim 1, characterized in that, The calculation of the privacy overhead under the optimal pruning threshold includes: calculating a series of... RDP, the calculation formula is: in, This indicates the number of times the privacy histogram was constructed. Represents the natural base of Power of 1 This represents the order of the RDP, and its value is a positive integer greater than 1, where k is the index of the order. This indicates the intensity of the noise added during the construction of the privacy histogram. Indicates the expected amount of sampled data. Indicates the total amount of data. Parameters that measure the degree of privacy protection The smaller the value, the better the privacy protection. RDP stands for Renyi Differential Privacy; it combines a series of corresponding... -RDP converted to -DP, the calculation formula is as follows: in, Indicates the probability of failure. A parameter representing the strength of privacy protection. DP stands for differential privacy, representing the logarithm to the base 2; from a series of - Select the minimum value in DP And output it.

8. A differential privacy gradient adaptive pruning device based on minimizing the squared gradient error, characterized in that, The system includes a data sampling module, a histogram construction module, a histogram judgment module, a calculation module, a candidate set judgment module, and a privacy statistics module. The data sampling module samples a batch of data containing privacy information, inputs it into a classification model, calculates the gradient of the sample data in the classification model, and calculates the L2 norm based on the gradient. The histogram construction module constructs a privacy histogram with L2 norm based on a preset range. The histogram judgment module determines whether the range of the privacy histogram is appropriate based on whether the data distribution of the privacy histogram is concentrated on one side. If the range is deemed inappropriate, the range is updated, data is resampled, the L2 norm is calculated, and the privacy histogram is reconstructed. The calculation module, when the range of the privacy histogram is deemed appropriate, constructs a candidate set based on the current pruning threshold, calculates the gradient squared error of each pruning threshold in the candidate set based on the finally constructed privacy histogram, and selects the optimal pruning threshold for the current round based on the principle of minimizing the gradient squared error. The candidate set judgment module is used to construct a new candidate set based on the optimal cropping threshold when the current round's optimal cropping threshold is inappropriate, and iteratively re-filters to output the final optimal cropping threshold. The privacy statistics module is used to calculate the privacy overhead of the entire process when the current round's optimal cropping threshold is appropriate. The differential privacy gradient adaptive cropping device is used in image classification tasks, where the sample data is image data with privacy information, and the corresponding classification model is an image classification model; it is also used in text classification tasks, where the sample data is text data with privacy information, and the corresponding classification model is a text classification model; and it is also used in speech classification tasks, where the sample data is text and speech data with privacy information, and the corresponding classification model is a speech classification model.

Images