Safe and efficient federated learning system and method based on generative adversarial network

Abstract

The application discloses a kind of safe and efficient federated learning system and method based on generative adversarial network, system includes N client and a server;Each client trains a generative adversarial network using its local real data set;Second, each client generates a specified number of virtual samples and uploads to server;Then, server aggregates virtual samples and distributes;Afterwards, each client trains a model using real or virtual samples respectively, and merges two models;Then, each client adds noise disturbance gradient and uploads to server;Afterwards, server aggregates the gradient uploaded by client to update global model;Finally, client downloads new global model to update its local model.The application realizes more accurate model and significantly reduces training time.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a federated learning system and method, specifically a secure and efficient federated learning system and method based on generative adversarial networks. Background Technology

[0002] Federated learning is one of the most promising paradigms in distributed machine learning. Unlike centralized machine learning, federated learning allows multiple clients to collaboratively train a global model by sharing local intermediate results (such as model parameters or gradient updates) while keeping the original data local. It has been applied in various practical fields, such as cybersecurity, smart healthcare, and smart manufacturing. A major challenge in designing classic federated learning schemes is that the data from different clients is often non-independent and identically distributed (i.i.d.). This can affect the accuracy of the global model and even cause it to diverge. To handle non-independent and identically distributed data, previous methods typically employed model-centric learning, including designing better local loss functions or aggregation methods. However, due to the fundamental difference between minimizing local empirical loss and minimizing global empirical loss, these schemes fail to significantly improve model accuracy. Therefore, increasing attention is being paid to balancing the distribution by sharing data among clients, which is more conducive to improving performance. Since sharing the original data violates the principles of federated learning, a common practice is to share dummy data generated using methods such as generative adversarial networks (GANs).

[0003] While virtual data intuitively avoids information leakage regarding the original data, researchers have shown that membership inference attacks can still be applied to virtual data to infer whether individual data belong to the original training set. Furthermore, a more common finding is that privacy information about the original data can be extracted from intermediate results uploaded by each client, since these intermediate results are computed only based on the original data. To prevent such privacy leaks, a common lightweight approach is to introduce differential privacy into the training of generative adversarial networks and the intermediate results in federated learning. However, the introduced noise significantly reduces model accuracy and increases training time. Summary of the Invention

[0004] This invention addresses the shortcomings of existing technologies by providing a secure and efficient federated learning system and method based on generative adversarial networks (GANs). By generating virtual samples using GANs, the adverse effects of non-independent and identically distributed data on model training are mitigated. It ensures efficient training of complex models while providing privacy protection, avoiding the introduction of excessive noise into GAN training and federated learning that could affect model accuracy. At the same time, it effectively handles the model training relationship between virtual and real samples.

[0005] The technical solution adopted by the method of this invention is: a secure and efficient federated learning system based on generative adversarial networks, comprising a server and One client: The server is used to aggregate virtual samples, perform local model aggregation, and update global model parameters; each client Used to store local private real datasets, generate virtual samples, and train local models; No. Each client has a size of Private real dataset , , ; and These are the sample space and the label space, respectively. They represent the first The first client Features and labels, global dataset By using all local datasets Connection formed, This is the size of the global dataset.

[0006] The technical solution adopted by the method of this invention is: a secure and efficient federated learning method based on generative adversarial networks, applied to a secure and efficient federated learning system based on generative adversarial networks: the training of the client-side local model includes the following steps: Step 1: Each client Using its local real dataset Train a generative adversarial network; Step 2: Each client A pre-trained generative adversarial network is used to generate a specified number of virtual samples, forming a virtual dataset. Then upload it to the server; Step 3: The server aggregates all virtual datasets. form And distribute it to all clients; Step 4: Train a locally initialized deep neural network model using real data and virtual data respectively, and merge the two models to learn the image features of the local dataset to complete the data classification task. Step 5: Each client adds a noise perturbation gradient and uploads it to the server; the server aggregates the gradients uploaded by the clients to update the global model; Step 6: The client downloads the new global model to update its local model.

[0007] Preferably, step 1 includes the following sub-steps: Step 1.1: Initialize the discriminator of the generative adversarial network and generator Model parameters and ; Step 1.2: Randomly sample noise vectors from a normal distribution. ,in This refers to the batch size; Step 1.3: From Real samples were obtained through random sampling. ; Generate virtual samples ,in To generate a generator for adversarial networks; Step 1.4: Train the discriminator of the generative adversarial network ; Calculate gradient Gradient clipping ,in The clipping factor; Batch size In the middle, measuring the real samples and virtual samples The FID between them is ;Will Normalization process is performed to obtain ; Calculate privacy noise weights ; Calculate adaptive noise ,in This represents a Gaussian distribution with a mean of 0 and a variance of . , For noise factor, For the clipping factor, The identity matrix is ​​used; noise is added to the gradient. Update the discriminator : ,in The learning rate; Step 1.5: Training the generator of the generative adversarial network ; Calculate gradient Update generator : , ,in This is the learning rate.

[0008] As a preferred option, in step 2, each client is recorded. Real datasets The total number of each category is The average is ,in This represents the total number of categories in the global dataset. Let be a random variable that follows a normal distribution. The mean is The variance is The number of virtual tags selected by the client for each category is denoted as . ,in , , To share the scaling factor; Client Determine all virtual tags, where the total number of virtual tags is... Select specific tags as ; Utilizing a trained generative adversarial network generator Generate features corresponding to virtual labels To form a virtual dataset And upload it to the server.

[0009] Preferably, the deep neural network model described in step 4 is a locally initialized deep neural network model; the initialization process specifically includes the following sub-steps: Step 4.1: Each client virtual dataset Half of the data in the corresponding category were incorporated into the local real dataset. middle; Step 4.2: In the first... During round model training, the client Each using its local real dataset and virtual datasets Each trains a deep neural network model and obtains the corresponding gradient. and ; Step 4.3: Use cosine similarity to measure the similarity of parameters between two models. ,in These are the model parameters obtained by training using a real dataset. These are the model parameters obtained by training using a virtual dataset. Represents the dot product of vectors. The Euclidean norm of a vector; Step 4.4: Normalize the cosine similarity. And calculate the true gradient after merging the models. .

[0010] As a preferred embodiment, step 5 includes the following sub-steps: Step 5.1: Each client Predicting the current iteration round using prior knowledge The global gradient is used as the pruning factor in this round. ,in This represents the exponentially weighted average of the squared global gradients over the previous iterations; the expression for calculating prior knowledge is... , ,in It's a hyperparameter; They represent the first The global gradient of the wheel; Step 5.2: Each client Set threshold ,if Then set the clipping factor to Otherwise, set the clipping factor to 0. ;in, This represents the gradient clipping factor threshold.

[0011] Step 5.3: Each client Add noise perturbation gradient The gradient of the perturbation is then uploaded to the server; among which, For the first The first client The true gradient after merging wheel models.

[0012] Preferably, the generative adversarial network described in step 1 includes a generator. and discriminator Its training process is a generator. and discriminator Zero-sum game, generator Given a random noise vector as input and virtual samples as output, the optimization objective is to make the discriminator as responsive as possible. Misclassifying virtual samples as real samples; discriminator The input consists of real and virtual samples, and the output is the probability that each sample is a real sample. The optimization goal is to distinguish between the two classes of samples as accurately as possible.

[0013] Preferably, the neural network model in step 4 is a multi-layered convolutional neural network, including an input layer, one or more hidden layers, and an output layer; the hidden layer includes one or more convolutional layers, pooling layers, and fully connected layers; the convolutional layer performs a dot product calculation between the convolutional kernel and the input matrix of the layer, and its activation function is ReLU. When the convolutional kernel slides along the input matrix of the layer, the convolution operation generates a feature map, which is then contributed to the input of the next layer.

[0014] Compared with the prior art, the beneficial effects of the present invention include: (1) This invention designs a privacy-preserving virtual sample generation algorithm, which utilizes generative adversarial networks (GANs) to generate virtual samples and share them to address the problem of non-independent and identically distributed data. To mitigate the negative impact of differential privacy on training performance while providing privacy protection, we design adaptive noise adjustment algorithms for virtual sample generation in GANs and model training in federated learning, respectively. These two algorithms reduce noise based on two metrics: the quality of virtual samples and the gradient clipping factor. Furthermore, we propose a separate training and merging algorithm to better handle the training relationship between virtual and real samples. Compared to previous schemes, this invention achieves a more accurate global model and significantly reduces model training time. Attached Figure Description

[0015] The technical solutions described herein are further illustrated below using examples and specific implementation methods. Additionally, accompanying drawings are used in the description of the technical solutions. Those skilled in the art can, without any creative effort, obtain other drawings and the intent of the present invention based on these drawings.

[0016] Figure 1 This is a system overall architecture diagram according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the method flow according to an embodiment of the present invention; Figure 3 This is a diagram of the generative adversarial network structure according to an embodiment of the present invention; Figure 4 This is a diagram of the neural network model structure according to an embodiment of the present invention; Detailed Implementation Federated learning aims to train neural network models using distributed data resources from multiple clients without sharing the original data. It is currently widely used in various fields, such as cybersecurity, smart healthcare, and smart manufacturing. One common problem with federated learning is its sensitivity to non-independent, identically distributed (ICD) data. While integrating generative adversarial networks (GANs) into federated learning to generate dummy data can address the ICD problem, it remains vulnerable to member inference attacks. Differential privacy can help defend against such attacks. However, the accuracy loss introduced by differential privacy makes achieving a balance between privacy and accuracy extremely challenging.

[0017] Generative Adversarial Networks (GANs) are a machine learning architecture that learns by having two neural network models compete against each other. A GAN consists of a generator and a discriminator. The generator randomly samples data from the latent space as input, and its output should mimic real samples in the training set as closely as possible. The discriminator takes either real samples or the generator's output as input, and its goal is to distinguish the generator's output from real samples as much as possible. The generator, in turn, tries to deceive the discriminator. The two models compete against each other, constantly adjusting their parameters, with the ultimate goal of making it impossible for the discriminator to determine whether the generator's output is genuine.

[0018] Differential privacy is a provable mathematical framework that adds carefully crafted noise to the samples. It ensures that any individual modification to the dataset will not significantly affect the output. Therefore, attackers cannot infer the existence of individual data points in the dataset by analyzing the output.

[0019] Please see Figure 1 This embodiment provides a secure and efficient federated learning system based on generative adversarial networks, comprising a server and One client: The server is used to aggregate virtual samples, perform local model aggregation, and update global model parameters; each client Used to store local private real datasets Generate virtual samples and train the local model; No. Each client has a size of Private real dataset ,in , ; and These are the sample space and the label space, respectively. They represent the first The first client Features and labels; global dataset It is by using all local datasets Formed by connection, where This is the size of the global dataset.

[0020] Please see Figure 2 This embodiment provides a secure and efficient federated learning method based on generative adversarial networks, which includes the following steps: Step 1: Train the generative adversarial network; Each client Using its local real dataset Train a generative adversarial network.

[0021] In one implementation, please see Figure 3 The generative adversarial network (GAN) is a machine learning architecture that includes a generator. and discriminator Its training process can be viewed as a zero-sum game between two models, with the generator... Given a random noise vector as input and virtual samples as output, the optimization objective is to make the discriminator as responsive as possible. Misclassifying virtual samples as real samples; discriminator The input consists of real and virtual samples, and the output is the probability that each sample is a real sample. The optimization goal is to distinguish between the two classes of samples as accurately as possible.

[0022] In one implementation, step 1 specifically includes the following sub-steps: Step 1.1: Initialize the discriminator of the generative adversarial network and generator Model parameters and ; Step 1.2: Randomly sample noise vectors from a normal distribution. ,in This refers to the batch size; Step 1.3: From Real samples were obtained through random sampling. ; Generate virtual samples ,in, To generate a generator for adversarial networks; Step 1.4: Train the discriminator of the generative adversarial network ; Calculate gradient Gradient clipping ,in The clipping factor; Batch size In the middle, measuring the real samples and virtual samples The FID (Fréchet Inception Distance) between them is ;Will Normalization process is performed to obtain ; Calculate privacy noise weights ; Calculate adaptive noise ,in This represents a Gaussian distribution with a mean of 0 and a variance of . , For noise factor, For the clipping factor, The identity matrix is ​​used; noise is added to the gradient. Update the discriminator : ,in The learning rate; Step 1.5: Training the generator of the generative adversarial network ; Calculate gradient Update generator : , ,in This is the learning rate.

[0023] Step 2: Upload virtual sample; Each client A pre-trained generative adversarial network is used to generate a specified number of virtual samples, forming a virtual dataset. Then it is uploaded to the server.

[0024] In one implementation, step 2 specifically includes the following sub-steps: Step 2.1: Record each client Its real dataset The total number of each category is Its average is ,in This represents the total number of categories in the global dataset. Step 2.2: Record Let be a random variable that follows a normal distribution. The mean is The variance is The number of virtual tags that the client needs to select for each category is denoted as . ,in , , To share the scaling factor; Step 2.3: Client Determine all virtual tags, where the total number of virtual tags is... Select specific tags as ; Step 2.4: Utilize the trained generative adversarial network generator Generate features corresponding to virtual labels To form a virtual dataset And upload it to the server.

[0025] Step 3: Distribute shared virtual samples; The server aggregates all virtual datasets. form And distribute it to all clients.

[0026] In one implementation, the server aggregates all virtual datasets. form And distribute it to all clients.

[0027] Step 4: Training separately and then merging; A locally initialized deep neural network model is trained using real data and virtual data respectively, and the two models are merged to learn the image features of the local dataset to complete the data classification task.

[0028] In one implementation, please see Figure 4 The neural network (NN) model described is a multi-layered feedforward neural network. It includes an input layer, one or more hidden layers, and an output layer. In each layer, a set of nodes performs linear or nonlinear transformations on the input signal and passes the processed information to the next layer. Linear transformations use weight matrices to linearly combine the inputs, while nonlinear transformations apply nonlinear activation functions (such as ReLU, Sigmoid, Tanh, etc.) to the result. In this system, the activation layer uses the ReLU activation function. This structure enables deep neural networks to learn complex features, demonstrating superior performance in specific fields such as computer vision, natural language processing, and speech recognition.

[0029] The hidden layer includes one or more convolutional layers, which involves performing a dot product calculation between the convolutional kernel and the input matrix of the layer, with the activation function typically being ReLU; as the convolutional kernel slides along the input matrix of the layer, the convolution operation generates a feature map, which is then contributed to the input of the next layer; followed by other layers, such as pooling layers and fully connected layers; The convolutional layer can generate a set of parallel feature maps, which are formed by sliding different convolutional kernels on the input image and performing certain operations. At each sliding position, an element-wise product operation is performed between the convolutional kernel and the input image and summed to project the information in the receptive field onto an element in the feature map. The size of the convolutional kernel is much smaller than that of the input image and it acts on the input image in an overlapping or parallel manner. All elements in a feature map are calculated by a single convolutional kernel, that is, a feature map shares the same weights and bias terms. The ReLU layer uses functions As an activation function for this layer, it can enhance the nonlinear characteristics of the entire neural network without changing the convolutional layer computation itself. The pooling layer is actually a non-linear form of downsampling; max pooling is the most common. It divides the input image into several rectangular regions and outputs the maximum value for each sub-region. The pooling layer continuously reduces the spatial size of the data, thus reducing the number of parameters and computational cost. Through the pooling layer, we can reduce the sensitivity of the convolutional layer to edges. The pooling layer calculates the output in a pooling window at a time, and then moves the pooling window according to the stride. The pooling layer used is a two-dimensional max pooling layer with a stride of 2 and a pooling window of 2×2. Then, it takes the maximum value of the four numbers in each block, which will reduce the amount of data by 75%. The fully connected layer connects each node in one layer to each node in another layer. After several convolutional and max-pooling layers, the prediction part in the neural network model is completed through the fully connected layer. The nodes in the fully connected layer are associated with all the activations in the previous layer; their activations can be calculated as an affine transformation, that is, multiplied by a matrix and then added with an offset.

[0030] In one implementation, the deep neural network model is a locally initialized deep neural network model. In one implementation, the initialization process specifically includes the following sub-steps: Step 4.1: Each client virtual dataset Half of the data in the corresponding category were incorporated into the local real dataset. This enhances the local real dataset; Step 4.2: In the first... During round model training, the client Each using its local real dataset and virtual datasets Each trains its own neural network model and obtains the corresponding gradient. and ; Step 4.3: Use cosine similarity to measure the similarity of the parameters of the two models, and calculate... ,in These are the model parameters obtained by training using a real dataset. These are the model parameters obtained by training using a virtual dataset. Represents the dot product of vectors. The Euclidean norm of a vector; Step 4.4: Normalize the cosine similarity and calculate... And calculate the true gradient after merging the models. .

[0031] Step 5: Secure aggregation; Each client adds a noisy perturbation gradient and uploads it to the server; the server aggregates the gradients uploaded by the clients to update the global model.

[0032] In one implementation, step 5 specifically includes the following sub-steps: Step 5.1: Each client Predicting the current iteration round using prior knowledge The global gradient is used as the pruning factor in this round. ,in This represents the exponentially weighted average of the squared global gradients over the previous iterations; the expression for calculating prior knowledge is... , ,in It's a hyperparameter; They represent the first The global gradient of the wheel.

[0033] Step 5.2: Each client Set threshold ,if Then set the clipping factor to Otherwise, set the clipping factor to 0. ;in, This represents the gradient clipping factor threshold.

[0034] Step 5.3: Each client Add noise perturbation gradient The gradient of the perturbation is then uploaded to the server; among which, For the first The first client The true gradient after merging wheel models.

[0035] Step 6: Model update; The client downloads the new global model to update its local model.

[0036] In one implementation, the server performs a safe average aggregation of gradients. And perform a global model update; each client Download the new global model to update the local model.

[0037] In the training process In each iteration, all clients complete the model update for that round and return to step 4 to begin the next iteration. The training process involves iterative rounds; this process continues until the model converges or the maximum number of iterations is reached. Then the training ends.

[0038] This embodiment presents a secure and efficient federated learning scheme based on generative adversarial networks (GANs). The proposed privacy-preserving virtual sample generation algorithm utilizes GANs to generate virtual samples and addresses the issue of non-independent, identically distributed data by directly sharing them among clients. To mitigate the negative impact of differential privacy on training performance and provide privacy protection, adaptive noise adjustment algorithms are designed for both virtual sample generation in the GAN and federated learning model training. These two algorithms reduce optimization noise based on two metrics: the quality of the virtual samples and the gradient clipping factor. Finally, the scheme as a whole follows a two-layer model aggregation paradigm, and the proposed separate training and merging algorithms effectively handle the relationship between virtual and real samples.

[0039] The specific examples described in this invention are merely illustrative of the spirit of the invention. Those skilled in the art can make various modifications or additions to the described specific examples or use similar methods to replace them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

[0040] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A secure and efficient federated learning method based on generative adversarial networks, applied to a secure and efficient federated learning system based on generative adversarial networks: characterized in that, Training the local model on the client side includes the following steps: Step 1: Each client Using its local real dataset Train a generative adversarial network; Step 1 includes the following sub-steps: Step 1.1: Initialize the discriminator of the generative adversarial network and generator Model parameters and ; Step 1.2: Randomly sample noise vectors from a normal distribution. ,in This refers to the batch size; Step 1.3: From Real samples were obtained through random sampling. ; Generate virtual samples ,in, To generate a generator for adversarial networks; Step 1.4: Train the discriminator of the generative adversarial network ; Calculate gradient Gradient clipping ,in The clipping factor; Batch size In the middle, measuring the real samples and virtual samples The FID between them is ,Will Normalization process is performed to obtain ; Calculate privacy noise weights ; Calculate adaptive noise ,in This represents a Gaussian distribution with a mean of 0 and a variance of . , For noise factor, For the clipping factor, The identity matrix is ​​used; noise is added to the gradient. Update the discriminator : ,in The learning rate; Step 1.5: Training the generator of the generative adversarial network ; Calculate gradient Update generator : , ,in The learning rate; Step 2: Each client A pre-trained generative adversarial network is used to generate a specified number of virtual samples, forming a virtual dataset. Then upload it to the server; Step 3: The server aggregates all virtual datasets. form And distribute it to all clients; Step 4: Train a locally initialized deep neural network model using real data and virtual data respectively, and merge the two models to learn the image features of the local dataset to complete the data classification task. The deep neural network model mentioned in step 4 is a locally initialized deep neural network model; the initialization process specifically includes the following sub-steps: Step 4.1: Each client virtual dataset Half of the data in the corresponding category were incorporated into the local real dataset. middle; Step 4.2: In the first... During the training of the round model, the client Each using its local real dataset and virtual datasets Each trains a deep neural network model and obtains the corresponding gradient. and ; Step 4.3: Use cosine similarity to measure the similarity of parameters between two models. ,in These are the model parameters obtained by training using a real dataset. These are the model parameters obtained by training using a virtual dataset. Represents the dot product of vectors. The Euclidean norm of a vector; Step 4.4: Normalize the cosine similarity. And calculate the true gradient after merging the models. ; Step 5: Each client adds a noise perturbation gradient and uploads it to the server; the server aggregates the gradients uploaded by the clients to update the global model; Step 6: The client downloads the new global model to update its local model.

2. The secure and efficient federated learning method based on generative adversarial networks according to claim 1, characterized in that, Step 5 includes the following sub-steps: Step 5.1: Each client Predicting the current iteration round using prior knowledge The global gradient is used as the pruning factor in this round. ,in This represents the exponentially weighted average of the squared global gradients over the previous iterations; the expression for calculating prior knowledge is... , ,in It's a hyperparameter; They represent the first The global gradient of the wheel; Step 5.2: Each client Set threshold ,if Then set the clipping factor to Otherwise, set the clipping factor to 0. ;in, Indicates the gradient clipping factor threshold; Step 5.3: Each client Add noise perturbation gradient The gradient of the perturbation is then uploaded to the server; among which, For the first The first client The true gradient after merging wheel models.

3. The secure and efficient federated learning method based on generative adversarial networks according to any one of claims 1-2, characterized in that: The generative adversarial network mentioned in step 1 includes a generator. and discriminator ; Its training process is a generator and discriminator Zero-sum game, generator The input is a random noise vector, and the output is a virtual sample. The optimization objective is to make the discriminator... The virtual sample was mistakenly identified as a real sample. Discriminator The input consists of real and virtual samples, and the output is the probability that each sample is a real sample. The optimization goal is to correctly distinguish between the two classes of samples.

4. The secure and efficient federated learning method based on generative adversarial networks according to any one of claims 1-2, characterized in that: The neural network model described in step 4 is a multi-layered convolutional neural network, including an input layer, one or more hidden layers, and an output layer. The hidden layer includes one or more convolutional layers, pooling layers, and fully connected layers. The convolutional layer performs a dot product calculation between the convolutional kernel and the input matrix, and its activation function is ReLU. When the convolutional kernel slides along the input matrix of the layer, the convolution operation generates a feature map, which is then contributed to the input of the next layer.

5. A secure and efficient federated learning system based on generative adversarial networks, used to implement the method described in any one of claims 1-4; characterized in that: Includes a server and One client: The server is used to aggregate virtual samples, perform local model aggregation, and update global model parameters; each client Used to store local private real datasets, generate virtual samples, and train local models; No. Each client has a size of Private real dataset , , ; and These are the sample space and the label space, respectively. They represent the first The first client Features and labels, global dataset By using all local datasets Connection formed, This is the size of the global dataset.

Images