A matrix factorization recommendation method based on shuffler federated differential privacy

Abstract

The application relates to a matrix decomposition recommendation method based on a shuffler federal differential privacy, and belongs to the fields of computer recommendation systems and information security. The method specifically comprises the following steps: a user i in [1, n] obtains a gradient of a user i's hidden factor vector item hidden factor matrix and selects top k gradients in [1, T] rounds of the user i, and uses PM perturbation, and then uses a public key pk a encryption to generate m i∈[1，n] , a shuffler obtains m i∈[1，n] , fills and disarranges the sequence to obtain m i∈[1，nl+v] , and finally, a server obtains an unbiased estimation through decryption, and simultaneously updates V t ; after T rounds, V is obtained. The application has good privacy protection and model accuracy.

Description

Technical Field

[0001] This invention belongs to the fields of computer recommendation systems and information security, and relates to a matrix factorization recommendation method based on shuffler federated differential privacy. Background Technology

[0002] Recommender systems play a crucial role and have wide applications in today's digital age. They can help businesses increase sales, user satisfaction, and user retention rates, while also helping users save time and effort and improve the efficiency and accuracy of information acquisition. However, if this data is improperly collected, stored, used, or disseminated, it may lead to the leakage of user privacy, posing potential risks and losses to users. In this context, recommender systems need to consider user privacy and security.

[0003] Differential privacy is a technique that protects privacy by adding noise to data. Even if an attacker knows the values ​​of other data points, they cannot determine the true value of a given data point. This technique provides mathematical proof methods to test and improve the strength of privacy protection. Federated learning is a technique where multiple participants collaborate on learning, improving model training performance while protecting data privacy. Currently, the mainstream federated learning methods are divided into two types: centralized models and local models. In the differential privacy protection of local models, changing the data of any one user has a negligible impact on the dataset processing results, and attackers cannot deduce the privacy information of any individual user. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a matrix factorization recommendation method based on shuffler federated differential privacy, which achieves a good balance between security and usability in the recommendation model when the server is untrusted.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A matrix factorization recommendation method based on shuffler-fed differential privacy includes the following steps:

[0007] S1: User rating matrix for the project Among them, the use of Let represent the rating of user i for item j; the training process consists of three parties: server S, shuffler s, and local user i∈[1,n]; where n represents the number of users and m represents the number of items;

[0008] S2: Randomly initialize the matrix in It is the user latent factor matrix. The i-th row of matrix U represents the latent factor vector of the i-th user, which is stored in the local user i. It is the project latent factor matrix. Let represent the j-th row of matrix V, which represents the latent factor vector of the j-th item, and update it in S; d represents the dimension of the latent factor vector.

[0009] S3: For all users i∈[1,n]; user i receives V from S t-1 Combined with user i's own rating vector r i The latent factor vector of the user in round (t-1) By solving the objective function L(U,V), we can obtain... Where t∈[1,T] represents the number of training rounds, and T represents the total number of training rounds to be updated; V represents the gradient; i Represents the item matrix for user i;

[0010] S4: For all users i∈[1,n]; for each user i, locally update the project gradient matrix. To make it easier to express, Set equal to x i User i via x i Select k*l unique gradient indices, where k are the indices corresponding to the largest gradient, and randomly select the remaining k(l-1) indices from those excluding the largest k indices. Perturb the gradients corresponding to the largest k indices using the PM mechanism, and randomly select the values ​​corresponding to the other indices from the distribution perturbed to 0 by the PM mechanism. Further, generate idx from the k*l indices selected by user i and their corresponding positions using the values ​​generated by the PM mechanism. i and y i ;in π r This is a random permutation operation performed on the index to shuffle the sort order; it sets the idx... i and y i Divide into l records of equal length, and obtain y j∈[1,l] PK via public key a Encrypt it with the encryption function E, and then encrypt it with idx. j∈[1,l] Combination generation Each encryption result m j∈[1,l] It consists of k elements; pk a It is a public key, which can be known by the three participating parties S, s, and user i;

[0011] S5: s received m i∈[1,n] For each dimension of f∈[1,D], add n n,f =n p -n pm,f Random noise is required; Each message is filled with a set of fake messages; each message has k indices and corresponding random noise; further, for u∈[1,v], we obtain... Among them, idx n+u To fill in the indices corresponding to k elements, where idx n+u From n n,f Choose k unique indices from >0, and each time an index is selected, it corresponds to n. n,f Decrease the value by one; It uses the PM mechanism to randomly select k values ​​from a distribution that perturbs 0 and then performs pk. a The encrypted result; s shuffles m i∈[1,nl+v] Get m π(i)∈[1,nl+v] ; where nl are messages from n users (l messages from each user); v are messages filled with s; n pm,f The f-th dimension comes from m i∈[1,n] The sum of the numbers; n p This represents the total value required for each dimension; D = d * m represents the dimension of the project matrix V, which also needs to be aggregated on the server side. The dimension; here, π is a permutation operation performed on the index, meaning to shuffle the order.

[0012] S6: S received m π(i)∈[1,nl+v] , through sk S Decryption and unbiased estimation yield... Then combine with V t-1 Get V t ;where sk S This is the private key, which only S possesses;

[0013] S7: Repeat S3 to S6 a total of T times;

[0014] S8: After T iterations, according to the formula Make predictions; when a user needs recommendations, the local u i It will be multiplied with the server's V matrix to generate predicted ratings, and the items with the TOP-N ratings corresponding to user i who has no ratings will be recommended to user i.

[0015] Furthermore, in step S3, the solution is... The specific steps are as follows:

[0016] S31: Determine the objective function L(U,V) as follows:

[0017]

[0018] Where Ω is the set of rated user-item pairs in R, M = |Ω| is the number of elements in Ω, and λ > 0 is the regularization parameter; the meanings of the other parameters are explained in S1 and S2.

[0019] S32: According to the stochastic gradient descent (SGD) method, the i-th user vector of U and the j-th item vector of V will be iteratively learned in the t-th iteration as follows. The equation is as follows:

[0020]

[0021]

[0022] Where η is the learning rate and t represents the number of training rounds. and u i and v j The gradient of . Where:

[0023]

[0024]

[0025] S33:

[0026] In federated learning, matrix factorization models are used to collect recommendation data from all users. And combine them to construct the gradient matrix as follows:

[0027]

[0028] in Let be the gradient matrix of user i, where:

[0029]

[0030] Where j:(i,j)∈Ω represents the set of items that user i has rated.

[0031] Furthermore, in step S4, for x i The specific steps for ensuring differential privacy of the selected portion using the PM mechanism are as follows:

[0032] S41: First, clip the values ​​to be noise-added, and then normalize them to (-1, 1). The specific formula is as follows:

[0033]

[0034] Where x i,j It is x i The gradient selected for PM perturbation, j∈[1,d*m], is a value; C represents the value of gradient clipping. Using the PM mechanism, the specific formula is as follows:

[0035]

[0036] Where ∈ ld Representing privacy budget, the segmentation mechanism (PM) is a perturbation mechanism applied to bounded values ​​to satisfy differential privacy. It is defined as follows:

[0037] Segmentation mechanism (PM): For input values Then the perturbation output value From [-C p C p The sample was obtained from [the sample], where:

[0038]

[0039] The probability density function is a step-like constant function, expressed as:

[0040]

[0041] in,

[0042]

[0043]

[0044] b2 = b1 + C p -1

[0045] Furthermore, in step S6, through sk S Decryption, and unbiased estimation, update to obtain V t The specific steps are as follows:

[0046] S61: where sk S The decryption steps are as follows:

[0047]

[0048] S62: The specific steps of the unbiased estimation are as follows:

[0049]

[0050]

[0051] Where k is the maximum number of indices selected by S4. The values ​​obtained by aggregating in S, C is the value obtained by the final unbiased estimate. p The clipping norm for PM perturbation.

[0052] S63: Where V t The specific steps are as follows:

[0053]

[0054] The beneficial effects of this invention are as follows: This invention addresses the privacy leakage problem in differential privacy matrix factorization recommendation methods under federated learning by combining a PM segmentation mechanism and a shuffling model to sample the top local gradient. k Noise is added to each gradient. A shuffling algorithm is introduced to significantly reduce the algorithm's privacy budget, provided that the user, server, and shuffling algorithm do not collude with each other. On the one hand, the shuffling algorithm improves privacy protection by rearranging the original dataset; on the other hand, to avoid adding too much noise to all gradients, this method selects the top gradient from D local gradients. k This algorithm perturbs the data using gradients (k << D), thereby significantly improving the accuracy of the recommendation system while enhancing privacy. It ensures the usability of the recommendation model while guaranteeing the security of user privacy data.

[0055] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0056] To make the objectives and technical solutions of this invention clearer, the preferred embodiments of this invention will be described in detail below with reference to the accompanying drawings, wherein:

[0057] Figure 1 This is a framework diagram for solving V using a recommendation algorithm based on shuffler-fed differential privacy.

[0058] Figure 2 This is an illustration of recommending projects to user u.

[0059] Figure 3 Comparison of the MAE metric between this invention and other methods under different privacy budgets Detailed Implementation

[0060] The specific embodiments and working principles of the present invention will be further described in detail below with reference to the accompanying drawings.

[0061] Let's take matrix factorization for movie recommendations as an example. In federated learning, users rate movies on their own devices instead of uploading data; instead, model updates are sent to the central server. This enhances data privacy, reduces data transfer volume, and improves efficiency.

[0062] PM perturbation is performed before uploading the model update, satisfying differential privacy and further enhancing data privacy. Simultaneously, top selection is used. kLocal gradient uploads, with the shuffling process disrupting the order, enhance the recommendation effect while providing better privacy protection.

[0063] User rating matrix for movies Among them, the use of This represents user i's rating of movie j, r i Let represent the vector representation of the ratings of the i-th user for all movies in the rating matrix R, and in federated learning, it exists only locally within the user. The training process consists of three parties: server S, shuffler s, and local user i∈[1,n].

[0064] The matrix factorization recommendation method based on shuffler-fed differential privacy described in this invention specifically includes the following steps:

[0065] Step 1: Randomly initialize the matrix in It is the user latent factor matrix. The i-th row of matrix U represents the latent factor vector of the i-th user, which is stored in the local user i. It is the project latent factor matrix. Let represent the j-th row of matrix V, which represents the latent factor vector of the j-th item, and update it in S; d represents the dimension of the latent factor vector; where n represents the number of users and m represents the number of items;

[0066] Step 2: For all users i∈[1,n]; user i receives V from S t-1 Combined with user i's own rating vector r i The latent factor vector of the user in round (t-1) By solving the objective function L(U,V), we can obtain... Where t∈[1,T] represents the number of training rounds, and T represents the total number of training rounds to be updated; V represents the gradient; i Represents the item matrix for user i; where For the update process, please refer to S31, S32, and S33.

[0067] Step 3: For all users i∈[1,n], the gradient matrix of the project is locally updated for user i. set up User i from Select k*l unique gradient indices and shuffle them to obtain idx. i ; where k are the indices corresponding to the largest gradient, and the remaining k(l-1) indices are randomly selected from those excluding the largest k indices; where π r It is a random permutation operation performed on the index to shuffle the sorting order;

[0068] Step 4: User i obtains idx from step 3. i For the k largest indices corresponding to x i The gradient value is perturbed using the PM mechanism, and the values ​​corresponding to other indices are randomly selected from the distribution perturbed to 0 by the PM mechanism; denoted as y. i ;in

[0069] Step 5, User i will use idx i and y i Divide into l records of equal length, and obtain y j∈[1,l] PK via public key a Encrypt it with the encryption function E, and then encrypt it with idx. j∈[1,l] Combination generation in pk a It is a public key, which can be known by the three participating parties S, s, and user i;

[0070] Step 6, the washing machine s receives m i∈[1,n] For each dimension of f∈[1,D], add n n,f =n p -n pm,f Random noise is required; The system populates the message with k fake messages; each message has k indices and corresponding random noise.

[0071] Where D = d*m represents the dimension of the project matrix V, which also needs to be aggregated on the server side. The dimension; n p It is the total value required for each dimension; n pm,f The f-th dimension comes from m i∈[1,n] The sum of the numbers;

[0072] Step 7: Further for u∈[1,v], the shuffler s is generated. Among them, idx nl+u To fill the indices corresponding to k elements, select k unique indices with n... n,f The index corresponding to >0, and n corresponding to each selection. n,f Decrease the value by one; It uses the PM mechanism to randomly select from the distribution that perturbs 0 for PK. a The encrypted result; where nl represents messages from n users;

[0073] Step 8: Mixer s shuffles m i∈[1,nl+v] Get m π(i)∈[1,nl+v] ; where π is a permutation operation performed on the index, meaning to shuffle the order;

[0074] Step 9, S receives m π(i)∈[1,nl+v] , through sk S Decryption and unbiased estimation yield... Then combine with V t-1 Get V t ;where sk S This is the private key, possessed only by S; the specific process is detailed in S61, S62, and S63 above.

[0075] Step 10: Repeat steps 2 through 9 a total of T times;

[0076] Step 11: After T iterations, according to the formula Make predictions; when a user needs recommendations, the local u i This will be multiplied with the server's V matrix to generate predicted ratings. The top-N movies without ratings for user i will then be recommended to user i. The recommendation process is as follows: Figure 2 .

Claims

1. A matrix factorization recommendation method based on shuffler-fed differential privacy, specifically including the following steps: S1: User rating matrix for the project , among which Indicates user For the project The scoring; the training process is handled by server S, shuffler s, and local user respectively. It consists of three parties; among which Indicates the number of users. Indicates the number of items; S2: Randomly initialize the matrix ;in It is the user latent factor matrix. Representation matrix The Line, representing the first The latent factor vector of each user, in the local user Save in; It is the project latent factor matrix. Representation matrix The Line, representing the first The latent factor vectors of each project are updated in S; d represents the dimension of the latent factor vectors. S3: For all users ;user Received project matrix from S Combined with users The rating vector itself , No. User latent factor vectors of the round Through the objective function Solving for the given information yields the following results. ;in This indicates the number of training epochs, where T represents the total number of training epochs to be updated. Represents the gradient; S4: For all users Each user Local update to obtain project gradient matrix For convenience, Set equal to ;user By from Selected from _n_ unique gradient indices, where The index corresponding to the largest gradient, and the remaining ones. The indexes are from, except for the largest Randomly select from outside the indexes; for the largest one... The gradient corresponding to each index uses a piecewise mechanism. To perturb, the values ​​corresponding to other indices change from... Randomly selected from a distribution perturbed to 0; further processing of users Selected The index and its corresponding position are obtained through The generated value and ;in , ; This is a random permutation operation performed on the index to shuffle the sort order; and Divide into equal parts 1 record, get ;Will Through public key and encryption functions Encrypt it and... Combination generation Each encryption result Depend on One element; As a public key, it can be shared by the three participating parties: S, s, and the user. Know; S5:s received ;right In each dimension, add Random noise is required; The message is populated with a number of fake messages; each message contains... Each index and its corresponding random noise; further... ,get ;in For filling The indices corresponding to each element, where from Winning Each unique index corresponds to a specific index when it is selected. minus one It is randomly selected from the distribution that uses PM to perturb 0. each value The encrypted result; s shuffled get ;in It comes from The message for each user; v is the message filled by s; For the first Each dimension comes from The sum of the numbers; This is the total value required for each dimension; express The dimension also needs to be aggregated on the server side. The dimension; here, It is a sorting operation performed on the index, meaning to shuffle the order; S6: S received ,pass Decryption and unbiased estimation yield... Then combine get ;in This is the private key, which only S possesses; S7: Repeat S3 to S6 a total of T times; S8: After T iterations, according to the formula Make predictions; When a user requests a recommendation, locally... Will with the server Matrix multiplication to generate predicted ratings will not include users. No items with the top-N ratings are recommended to users. .

2. The matrix factorization recommendation method based on shuffler-fed differential privacy according to claim 1, characterized in that: In step S3, the objective function is used. Solve Specifically, it includes the following steps: S31: Determine the objective function for: ， in It is a set of user-item pairs that have been rated in R. yes The number of elements in the middle, This is the regularization parameter; for the meaning of the other parameters, refer to S1 and S2. S32: According to the stochastic gradient descent (SGD) method, the i-th user vector of U and the j-th item vector of V will be iteratively learned in the t-th iteration as follows, with the equation as follows: ， ， in For learning rate, Represents training rounds, and They are respectively and The gradient; and The specific formula is as follows: ， ； S33: In federated learning, matrix factorization models are used to collect data from all users. And combine them to construct the gradient matrix. The specific formula is as follows: ， in User The gradient matrix, where: ， in Representing users A collection of rated projects.

3. The matrix factorization recommendation method based on shuffler-fed differential privacy according to claim 1, characterized in that: In step S4, for The specific steps for ensuring differential privacy of the selected portion using PM are as follows: S41: First, clip the values ​​to be noise-added, and then normalize them. The specific formula is as follows: ， in yes Selected to proceed The gradient of the perturbation, , This represents the value of gradient clipping; for use The specific formula is as follows: ， in Indicates privacy budget, It is a perturbation mechanism applied to bounded values ​​to satisfy differential privacy, and it is defined as follows: For input values Then the perturbation output value From The sample was obtained from the middle, where: , The probability density function is a step-like constant function, expressed as: ， in: ， ， 。 4. The matrix factorization recommendation method based on shuffler-fed differential privacy according to claim 1, characterized in that: In step S6, by Decryption, and unbiased estimation, updated to obtain The specific steps are as follows: S61: Where through The decryption steps are as follows: ； S62: The specific steps of the unbiased estimation are as follows: ， ， in The maximum number of indices selected for S4. The values ​​obtained by aggregating in S, This is the value obtained from the final unbiased estimate. In order to conduct The clipping norm of the perturbation; S63: Among them The specific steps are as follows: 。 5. The matrix factorization recommendation method based on shuffler-fed differential privacy according to claim 1, characterized in that: In step S8, according to the formula Make predictions; when users need recommendations, locally... Will with the server Matrix multiplication to generate predicted ratings will not include users. No items with the top-N ratings are recommended to users. .

Images