Federated learning method, system and terminal for injecting model watermark on server side

Abstract

The present invention discloses a federated learning method, system and terminal for injecting model watermarks on the server side, the method comprising: obtaining a target model, and obtaining watermark strings respectively generated by a plurality of federated participants; issuing the target model to a plurality of the federated participants, the plurality of the federated participants and the local server respectively training the target model, and performing training after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to a plurality of the watermark strings; the watermark parameters are issued to each of the federated participants. The method of uniformly adding watermarks on the server side of the present invention improves the fairness of the intellectual property protection process; and in the aggregation stage of federated learning, it is compatible with commonly used security policies, and effectively alleviates the problems of watermark mutual interference and reduced accuracy of the main task.

Description

Technical Field

[0001] The present invention relates to the field of electronic communications, and in particular to a federated learning method, system and terminal for injecting model watermarks on a server side. Background Art

[0002] Federated learning is a distributed machine learning framework that allows geographically dispersed devices to collaboratively train a global model under the coordination of a central server without infringing their data privacy. However, the development and deployment phases of federated learning are prone to intellectual property infringement issues, such as illegal theft of global models and wanton dissemination of global models. At the same time, since there are multiple participants in federated learning, it is necessary to use certain methods to protect the intellectual property rights of each participant in the federated learning framework.

[0003] At present, the FedIPR framework adopts the method of each distributed device independently injecting model watermarks during the local training phase to independently protect its intellectual property rights, which can achieve a certain protection effect. However, the FedIPR framework ignores the fairness of watermarks and gives each party the autonomy to independently inject watermarks, which may cause some participants to inject too many watermarks, although their contribution is small; at the same time, the independent injection of watermarks during the local training phase will cause mutual interference during aggregation, reducing the recognition rate of watermarks and the accuracy of the main task.

[0004] Therefore, the prior art still needs to be improved and developed. Summary of the invention

[0005] The main purpose of the present invention is to provide a federated learning method, system, terminal and computer-readable storage medium for injecting model watermarks on the server side, aiming to solve the problem in the prior art that each participant independently injects a model watermark during federated learning, the intellectual property rights of each participant may be infringed, and when federated learning is aggregated, the independent injection of watermarks will cause mutual interference, thereby reducing the recognition rate of the watermark and the accuracy of the main task.

[0006] To achieve the above object, the present invention provides a federated learning method for injecting a model watermark on a server side, and the federated learning method for injecting a model watermark on a server side comprises the following steps:

[0007] Obtain the target model and obtain the watermark strings generated by multiple federation participants respectively;

[0008] Sending the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively train the target model, and perform training after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the plurality of watermark character strings;

[0009] The watermark parameters are distributed to each of the federation participants.

[0010] Optionally, the sending of the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively training the target model, performing training after a preset federation round, and obtaining the target global model and watermark parameters specifically includes:

[0011] During each training, the global model obtained during the previous training is sent to the plurality of federation participants, wherein during the first training, the target model is sent to the plurality of federation participants;

[0012] The global model obtained by the previous training is trained according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model;

[0013] The multiple participants respectively train the global model obtained in the previous training through the corresponding local data, generate multiple current participant target models, and send the multiple participant target models to the local server;

[0014] The current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model;

[0015] It is determined whether the current number of training times reaches the preset federal round. If the current number of training times reaches the preset federal round, the watermark parameter is obtained, and the current global model obtained by the training is used as the target global model.

[0016] Optionally, the determining whether the current number of training times reaches a preset federation round further includes:

[0017] If the current number of training times does not reach the preset federation round, the local server sends the current global model obtained from the training to the multiple federation participants;

[0018] The plurality of federated participants and the local server retrain the current global model obtained from the training.

[0019] Optionally, the step of training the global model obtained in the previous training according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model specifically includes:

[0020] Obtaining the watermark parameters generated before training;

[0021] constructing an additional regularization term according to the watermark parameter;

[0022] Constructing a server loss function according to the additional regularization term;

[0023] The global model obtained by the previous training is trained based on the server loss function to obtain the current server-side target model.

[0024] Optionally, constructing an additional regularization term for server training according to the watermark parameter specifically includes:

[0025] Get the hinge loss function and the sign function;

[0026] Based on the hinge loss function and the sign function, an additional regularization term for server training is constructed according to the watermark parameter.

[0027] Optionally, the current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model, specifically including:

[0028] Obtain the current server-side target model and multiple current participant target models obtained from the training;

[0029] Based on the federated averaging algorithm, the current server-side target model obtained from the training and multiple current participant target models are aggregated to obtain the current global model.

[0030] Optionally, the sending of the watermark parameters to each of the federation participants further includes:

[0031] The plurality of federation participants obtain the watermark parameters;

[0032] The plurality of federation participants obtain participation information of corresponding federation participants to the target global model based on the watermark parameters.

[0033] In addition, to achieve the above-mentioned purpose, the present invention further provides a federated learning system for injecting a model watermark on the server side, wherein the federated learning system for injecting a model watermark on the server side comprises:

[0034] An information acquisition module is used to obtain a target model and watermark strings generated by multiple federation participants;

[0035] A training module, used for sending a target model to a plurality of the federation participants, wherein the plurality of the federation participants and the local server respectively train the target model, and perform training after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the plurality of watermark character strings;

[0036] The parameter sending module is used to send the watermark parameters to each of the federation participants.

[0037] In addition, to achieve the above-mentioned purpose, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a server-side federated learning program for injecting model watermarks stored in the memory and runnable on the processor, and when the server-side federated learning program for injecting model watermarks is executed by the processor, the steps of the server-side federated learning method for injecting model watermarks are implemented as described above.

[0038] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a federated learning program for injecting model watermarks on the server side, and when the federated learning program for injecting model watermarks on the server side is executed by a processor, the steps of the federated learning method for injecting model watermarks on the server side as described above are implemented.

[0039] In the present invention, a target model is obtained, and watermark strings generated by multiple federation participants are obtained; the target model is sent to multiple federation participants, and multiple federation participants and a local server respectively train the target model, and the training is performed after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the multiple watermark strings; and the watermark parameters are sent to each of the federation participants. The present invention adopts a method of adding watermarks by a server to uniformly add independent model watermarks for each participant, so that the target global model trained in this application contains the model watermarks corresponding to each participant, and the corresponding watermark parameters are sent to each federal participant, which also facilitates the federal participants to verify the watermarks in the model, thereby realizing independent verification of intellectual property rights; in addition, since the watermark is added through the server in the present invention, the participants are avoided from adding watermarks individually, which improves the fairness of the intellectual property protection process in the federated learning process, and in the federated aggregation stage, since the watermark only exists in the model in the server, it is compatible with commonly used security policies during aggregation, which can effectively alleviate the problems of watermark mutual interference and reduced accuracy of the main task. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of a preferred embodiment of the federated learning method for injecting model watermark on the server side of the present invention;

[0041] Figure 2 It is a flow chart of a preferred embodiment of the federated learning method of injecting model watermark on the server side of the present invention;

[0042] Figure 3 It is a flow chart of a better full protection framework of the federated learning method of injecting model watermark on the server side of the present invention;

[0043] Figure 4It is a schematic diagram comparing the federated learning method of injecting model watermark on the server side of the present invention with other methods;

[0044] Figure 5 It is a structural diagram of a preferred embodiment of the federated learning system for injecting model watermarks on the server side of the present invention;

[0045] Figure 6 It is a structural diagram of a preferred embodiment of the terminal of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0047] Federated learning is a distributed machine learning framework that allows geographically dispersed devices to collaboratively train a global model under the coordination of a central server without infringing their data privacy. However, the development and deployment phases of federated learning are prone to intellectual property rights (IPR) infringement issues, such as illegal theft of global models and wanton dissemination of global models. At the same time, since there are multiple participants in federated learning, it is necessary to protect the intellectual property rights of each participant in the federated learning framework through certain methods.

[0048] At present, the FedIPR framework adopts the method of each distributed device independently injecting model watermarks during the local training phase to independently protect its intellectual property rights, and has achieved certain protection effects. However, the FedIPR framework ignores the fairness of watermarks and gives each party the autonomy to independently inject watermarks, which may cause some participants to inject too many watermarks, although their contributions are small; at the same time, the independent injection of watermarks during the local training phase will conflict with the security strategies commonly used in federated aggregation, and cause mutual interference problems during aggregation, reducing the recognition rate of watermarks and the accuracy of the main task.

[0049] In order to solve one or more of the above problems, the present invention discloses a federated learning method, system and terminal for injecting model watermarks on the server side. By adopting the method of adding watermarks on the server, independent model watermarks are added to each participant in a unified manner, so that the target global model trained in this application contains the model watermarks corresponding to each participant, and the corresponding watermark parameters are sent to each federated participant, which also facilitates the verification of the watermarks in the model by the federated participants, thereby realizing independent verification of intellectual property rights.

[0050] The federated learning method for injecting model watermarks on the server side described in the preferred embodiment of the present invention is as follows: Figure 1 As shown, the federated learning method for injecting model watermarks on the server side includes the following steps:

[0051] Step S10: Obtain the target model, and obtain the watermark character strings generated by multiple federation participants respectively.

[0052] It should be noted that, in this application, the target model is the model to be federated trained, and the watermark string is generated separately by each federation participant.

[0053] Specifically, the watermark string generated by each federation participant is a binary 01 string, as shown below:

[0054] B k ={0,1} N ;

[0055] Among them, B K is the watermark string (binary 01 string) that the kth participant needs to inject; N represents the length of the string, that is, the string is an N-bit 01 string.

[0056] By obtaining the watermark string of each federation participant, the server can conveniently perform the corresponding watermark injection operation.

[0057] Step S20, sending the target model to the multiple federation participants, the multiple federation participants and the local server respectively train the target model, and perform training after a preset federation round to obtain the target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the multiple watermark strings.

[0058] It should be noted that when training the issued target model, each federation participant and the local server will respectively train the corresponding target model, and when the number of training reaches the preset federation round, the training will be terminated, and the global target model obtained by the last training will be output accordingly, as well as the watermark parameters generated according to the multiple watermark strings before training the target model.

[0059] Further, the sending of the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively training the target model, performing training after a preset federation round, and obtaining the target global model and watermark parameters specifically include:

[0060] During each training, the global model obtained during the previous training is sent to the plurality of federation participants, wherein during the first training, the target model is sent to the plurality of federation participants;

[0061] The global model obtained by the previous training is trained according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model;

[0062] The multiple participants respectively train the global model obtained in the previous training through the corresponding local data, generate multiple current participant target models, and send the multiple participant target models to the local server;

[0063] The current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model;

[0064] It is determined whether the current number of training times reaches the preset federal round. If the current number of training times reaches the preset federal round, the watermark parameter is obtained, and the current global model obtained by the training is used as the target global model.

[0065] Specifically, in this application, the final target global model and watermark parameters are obtained through cyclic training. In each training, the global model obtained in the previous training is sent to each federation participant, and the corresponding federation participants and local servers update the model in the training process according to their corresponding local data. In each training stage of federated learning, the basic model update formula is as follows:

[0066]

[0067] in, Indicates that in the tth federation round, the kth participant trained the model for e batches (epochs); lr t is the corresponding learning rate, the initial value of the learning rate is set to 0.01, and the weight decay coefficient is 0.0005; D k is the local training data set of the kth participant, i.e., local data; n k is the number of samples in the data set; (x i ,y i ) is the data and label tuple of the i-th sample in the data set; L() is the loss function, which generally uses cross entropy.

[0068] Before training, watermark parameters are constructed through watermark character strings, wherein the watermark parameters include a watermark extraction matrix and a parameter position for watermark injection.

[0069] After each training is completed, it is determined whether the corresponding number of training times reaches the preset federal rounds. If so, the current global model obtained from the training is output as the target global model, and the corresponding watermark parameters can also be obtained.

[0070] Furthermore, the determining whether the current number of training times reaches a preset federation round further includes:

[0071] If the current number of training times does not reach the preset federation round, the local server sends the current global model obtained from the training to the multiple federation participants;

[0072] The plurality of federated participants and the local server retrain the current global model obtained from the training.

[0073] Specifically, in the present application, when it is determined that the current number of training times has not reached the preset federal rounds, the training should continue, that is, the current global model obtained from the training is sent to multiple federal participants, and the multiple federal participants and the corresponding local servers are trained again.

[0074] Furthermore, the training of the global model obtained in the previous training according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model specifically includes:

[0075] Obtaining the watermark parameters generated before training;

[0076] constructing an additional regularization term according to the watermark parameter;

[0077] Constructing a server loss function according to the additional regularization term;

[0078] The global model obtained by the previous training is trained based on the server loss function to obtain the current server-side target model.

[0079] It should be noted that, in the present application, when the local server processes the watermark string and the corresponding current model, it will construct a watermark parameter according to the watermark string before training.

[0080] Specifically, in order to inject the binary watermark string B into the model parameters, the server first generates the parameters θ = {S, E} for extracting the watermark, where S is used to indicate the parameter position of the watermark injection and E is the watermark extraction matrix. The watermark injection target is shown in the following formula:

[0081] sgn(S(W)*E)=B,

[0082] Among them, sgn() is a sign function, and S(W) refers to selecting a specific part of the parameters in the model W as the watermark injection location.

[0083] After the current watermark parameters are constructed accordingly, in order to inject the watermark parameters into the model parameters, an additional regularization term is constructed accordingly to construct the loss function accordingly, and the current global model can be trained by the loss function.

[0084] Furthermore, the additional regularization term for server training is constructed according to the watermark parameter, specifically including:

[0085] Get the hinge loss function and the sign function;

[0086] Based on the hinge loss function and the sign function, an additional regularization term for server training is constructed according to the watermark parameter.

[0087] Specifically, the hinge-like loss function is as follows:

[0088]

[0089] Among them, μ is the hyperparameter of the hinge loss function; B is the binary watermark string actually owned by the participant; is the binary watermark string extracted from the trained model, i.e., sgn(S(W)*E); b j , They are B, The character (0 or 1) at the jth position in .

[0090] According to the hinge loss function and the sign function, an additional regularization term can be constructed. Specifically, the additional regularization term for local server training is as follows:

[0091] L B,θ =HL(sgn -1 (B),S(W)*E),

[0092] Among them, HL is the hinge loss function.

[0093] After obtaining the additional regularization term, the server loss function can be constructed accordingly, where the server loss function is expressed as follows:

[0094] L=L D (W)+α*L B,θ (W);

[0095] Where L D (W) is the loss function of the main task; α is the loss function scaling factor of the watermark injection task; L B,θ (W) is the loss function for the watermarking task, B is a binary watermark string, and θ is the parameter used to extract the watermark.

[0096] Furthermore, the current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model, which specifically includes:

[0097] Obtain the current server-side target model and multiple current participant target models obtained from the training;

[0098] Based on the federated averaging algorithm, the current server-side target model obtained from the training and multiple current participant target models are aggregated to obtain the current global model.

[0099] Specifically, in the federated aggregation phase of each round of federated learning during the training process, the server aggregates the current server-side target model trained by the server and injected with watermarks with the models uploaded by other federated participants. The aggregation method adopts the classic federated average algorithm, namely:

[0100]

[0101] in, represents the global model after completing t+1 federation rounds; K is the number of participants; k represents the kth participant; n k is the size of the data set owned by the kth participant (the number of samples); N is the sum of the sizes of the data sets owned by all participants (the sum of the number of samples); It indicates that in round t+1, the model uploaded to the server by the kth participant has undergone t federal rounds and E local batch training.

[0102] Since the server is responsible for aggregation, the model trained by the local server itself must be safe and reliable. Therefore, the federal security aggregation strategy does not need to consider the server model, but only needs to consider the models of other participants, thereby ensuring that the present invention is compatible with commonly used federal security aggregation strategies.

[0103] Step S30: Send the watermark parameters to each of the federation participants.

[0104] Specifically, in this application, at the end of training, that is, at the end of federated learning, the server sends the corresponding watermark extraction parameter θ k ={S k ,E k} to the kth participant (k∈{1,2,…,N}), and then the kth participant can independently verify its intellectual property rights to the federated learning global model W.

[0105] Furthermore, the sending of the watermark parameters to each of the federation participants further includes:

[0106] The plurality of federation participants obtain the watermark parameters;

[0107] The plurality of federation participants obtain participation information of corresponding federation participants to the target global model based on the watermark parameters.

[0108] Specifically, when the watermark parameters are sent to multiple federated participants, they can verify their intellectual property rights in federated learning based on the watermark parameters. Specifically, the kth participant can independently verify its intellectual property rights to the global model W of federated learning:

[0109]

[0110]

[0111] Among them, η k is the watermark detection rate obtained by the kth participant verifying its own watermark, and ∈ W is the maximum tolerable error rate of watermark verification.

[0112] Furthermore, the present application provides a preferred embodiment of the process of the federated learning method for injecting model watermarks on the server side, as follows: Figure 2 As shown, the step includes:

[0113] Step S21, each participant generates a watermark string, transmits it to the server, and proceeds to step S22;

[0114] Step S22: The server sends the target model to each participant, and then proceeds to steps S23 and S25 respectively;

[0115] Step S23: The participants use local data for training and proceed to step S24;

[0116] Step S24: The participant submits the updated model to the server, and then proceeds to step S26;

[0117] Step S25, the server uses the local data for training, adds additional regularization items during the training process, and obtains watermark parameters, and then proceeds to step S26;

[0118] Step S26: The server aggregates the model submitted by the participant and the model trained on the server side, and then proceeds to step S27;

[0119] Step S27, determine whether the required federation round is reached, if yes, proceed to step S28, if no, proceed to step S22;

[0120] Step S28: The final target global model is obtained, and the server sends the watermark parameters to each participant.

[0121] pass Figure 2From the process shown, it can be seen that in this application, the watermarking operation is performed through the server, thereby avoiding the participants from adding watermarks individually, improving the fairness of the intellectual property protection process in the federated learning process, and in the federated aggregation stage, since the watermark only exists in the model in the server, it is compatible with common security strategies during aggregation, which can effectively alleviate the problems of watermark interference and reduced accuracy of the main task.

[0122] Furthermore, if Figure 3 As shown, the present application provides a flowchart of a better full protection framework of the federated learning method of injecting model watermarks on the server side, which is composed of Figure 3 It can be seen that in a federation round, the server performs a model distribution operation, and the corresponding server and participants respectively use data sets to train models. During the training process of the server, a watermark string is introduced. When the training is completed, the model aggregation operation is performed. It can be seen that in this application, the operation of adding watermarks can be implemented through the server, which ensures the fairness of the intellectual property protection process during the federation learning process.

[0123] Furthermore, the present application also compares the method described in the present application with the main task accuracy and watermark detection rate of the previous FedIPR work. The specific comparison diagram is shown in FIG. Figure 4 As shown by Figure 4 It can be seen that compared with the previous scheme, the scheme of the present invention significantly improves the main task accuracy of federated learning (image recognition accuracy) and a higher watermark detection rate; at the same time, the federation rounds required for the convergence of the model are also greatly reduced, and when training continues after convergence, the main task accuracy and watermark detection rate fluctuate less and are more stable.

[0124] In summary, the present invention adopts the method of adding watermarks by the server to uniformly add independent model watermarks for each participant, so that the target global model trained in this application contains the model watermarks corresponding to each participant, and the corresponding watermark parameters are sent to each federal participant, which also facilitates the federal participants to verify the watermarks in the model, thereby realizing independent verification of intellectual property rights.

[0125] Furthermore, if Figure 5 As shown, based on the above-mentioned federated learning method for injecting model watermarks on the server side, the present invention also provides a federated learning system for injecting model watermarks on the server side, wherein the federated learning system for injecting model watermarks on the server side includes:

[0126] The information acquisition module 51 is used to acquire the target model and acquire the watermark character strings generated by multiple federation participants respectively;

[0127] The training module 52 is used to send the target model to the plurality of federation participants, and the plurality of federation participants and the local server respectively train the target model, and perform the training after the preset federation round to obtain the target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the plurality of watermark character strings;

[0128] The parameter sending module 53 is used to send the watermark parameters to each of the federation participants.

[0129] Furthermore, if Figure 6 As shown, based on the above-mentioned federated learning method and system for injecting model watermarks on the server side, the present invention also provides a terminal accordingly, and the terminal includes a processor 10, a memory 20 and a display 30. Figure 6 Only some components of the terminal are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0130] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard disk or memory of the terminal. In other embodiments, the memory 20 may also be an external storage device of the terminal, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the terminal. Further, the memory 20 may also include both an internal storage unit of the terminal and an external storage device. The memory 20 is used to store application software and various types of data installed on the terminal, such as the program code of the installation terminal. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, a federated learning program 40 for injecting a model watermark on the server side is stored on the memory 20, and the federated learning program 40 for injecting a model watermark on the server side can be executed by the processor 10, thereby realizing the federated learning method for injecting a model watermark on the server side in the present application.

[0131] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run the program code or process data stored in the memory 20, such as executing the federated learning method of injecting model watermarks on the server side.

[0132] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 30 is used to display information on the terminal and to display a visual user interface. The components 10-30 of the terminal communicate with each other via a system bus.

[0133] In one embodiment, when the processor 10 executes the federated learning program 40 for injecting model watermarks on the server side in the memory 20, the following steps are implemented:

[0134] Obtain the target model and obtain the watermark strings generated by multiple federation participants respectively;

[0135] Sending the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively train the target model, and perform training after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the plurality of watermark character strings;

[0136] The watermark parameters are distributed to each of the federation participants.

[0137] The sending of the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively training the target model, performing training after a preset federation round, and obtaining the target global model and watermark parameters specifically include:

[0138] During each training, the global model obtained during the previous training is sent to the plurality of federation participants, wherein during the first training, the target model is sent to the plurality of federation participants;

[0139] The global model obtained by the previous training is trained according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model;

[0140] The multiple participants respectively train the global model obtained in the previous training through the corresponding local data, generate multiple current participant target models, and send the multiple participant target models to the local server;

[0141] The current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model;

[0142] It is determined whether the current number of training times reaches the preset federal round. If the current number of training times reaches the preset federal round, the watermark parameter is obtained, and the current global model obtained by the training is used as the target global model.

[0143] The step of determining whether the current number of training times reaches a preset number of federation rounds further includes:

[0144] If the current number of training times does not reach the preset federation round, the local server sends the current global model obtained from the training to the multiple federation participants;

[0145] The plurality of federated participants and the local server retrain the current global model obtained from the training.

[0146] The step of training the global model obtained in the previous training according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model specifically includes:

[0147] Obtaining the watermark parameters generated before training;

[0148] constructing an additional regularization term according to the watermark parameter;

[0149] Constructing a server loss function according to the additional regularization term;

[0150] The global model obtained by the previous training is trained based on the server loss function to obtain the current server-side target model.

[0151] The additional regularization term for server training is constructed according to the watermark parameter, specifically including:

[0152] Get the hinge loss function and the sign function;

[0153] Based on the hinge loss function and the sign function, an additional regularization term for server training is constructed according to the watermark parameter.

[0154] The current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model, specifically including:

[0155] Obtain the current server-side target model and multiple current participant target models obtained from the training;

[0156] Based on the federated averaging algorithm, the current server-side target model obtained from the training and multiple current participant target models are aggregated to obtain the current global model.

[0157] The step of sending the watermark parameters to each of the federation participants further includes:

[0158] The plurality of federation participants obtain the watermark parameters;

[0159] The plurality of federation participants obtain participation information of corresponding federation participants to the target global model based on the watermark parameters.

[0160] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a federated learning program for injecting a model watermark on the server side, and when the federated learning program for injecting a model watermark on the server side is executed by a processor, the steps of the federated learning method for injecting a model watermark on the server side as described above are implemented.

[0161] In summary, the present invention provides a federated learning method, system, terminal and storage medium for injecting model watermarks on the server side. The method includes: obtaining a target model and obtaining watermark strings respectively generated by multiple federated participants; issuing the target model to multiple federated participants, and the multiple federated participants and the local server respectively train the target model, and perform training after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the multiple watermark strings; and the watermark parameters are issued to each of the federated participants. The present invention adopts a method of adding watermarks by a server to uniformly add independent model watermarks to each participant, so that the target global model trained in this application contains the model watermarks corresponding to each participant, and the corresponding watermark parameters are sent to each federal participant, which also facilitates the federal participant to verify the watermark in the model, thereby realizing independent verification of intellectual property rights; in addition, since the watermark is added through the server in the present invention, the participant is avoided from adding watermarks individually, which improves the fairness of the intellectual property protection process in the federated learning process, and in the federated aggregation stage, since the watermark only exists in the model in the server, it is compatible with commonly used security policies during aggregation, which can effectively alleviate the problems of watermark mutual interference and reduced accuracy of the main task.

[0162] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or terminal including the element.

[0163] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the program can be stored in a computer-readable storage medium that can be read by a computer, and the program can include the processes of the above-mentioned method embodiments when executed. The computer-readable storage medium can be a memory, a disk, an optical disk, etc.

[0164] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A federated learning method for injecting model watermarks on the server side, characterized in that: The federated learning method for injecting model watermarks on the server side includes: Obtain the target model and obtain the watermark strings generated by multiple federation participants respectively; Sending the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively train the target model, and perform training after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the plurality of watermark character strings; Sending the watermark parameters to each of the federation participants; The sending of the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively training the target model, performing training after a preset federation round, and obtaining the target global model and watermark parameters specifically include: During each training, the global model obtained during the previous training is sent to the plurality of federation participants, wherein during the first training, the target model is sent to the plurality of federation participants; The global model obtained by the previous training is trained according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model; The multiple participants respectively train the global model obtained in the previous training through the corresponding local data, generate multiple current participant target models, and send the multiple participant target models to the local server; The current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model; It is determined whether the current number of training times reaches the preset federal round. If the current number of training times reaches the preset federal round, the watermark parameter is obtained, and the current global model obtained by the training is used as the target global model.

2. The federated learning method for injecting model watermarks on the server side according to claim 1, characterized in that: The step of determining whether the current number of training times reaches the preset federation rounds further includes: If the current number of training times does not reach the preset federation round, the local server sends the current global model obtained from the training to the multiple federation participants; The plurality of federated participants and the local server retrain the current global model obtained from the training.

3. The federated learning method for injecting model watermarks on the server side according to claim 1, characterized in that: The step of training the global model obtained by the previous training according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model specifically includes: Obtaining the watermark parameters generated before training; constructing an additional regularization term according to the watermark parameter; Constructing a server loss function according to the additional regularization term; The global model obtained by the previous training is trained based on the server loss function to obtain the current server-side target model.

4. The federated learning method for injecting model watermarks on the server side according to claim 3 is characterized in that: The additional regularization term for server training is constructed according to the watermark parameter, specifically comprising: Get the hinge loss function and the sign function; Based on the hinge loss function and the sign function, an additional regularization term for server training is constructed according to the watermark parameter.

5. The federated learning method for injecting model watermarks on the server side according to claim 1, characterized in that: The current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model, specifically including: Obtain the current server-side target model and multiple current participant target models obtained from the training; Based on the federated averaging algorithm, the current server-side target model obtained from the training and multiple current participant target models are aggregated to obtain the current global model.

6. The federated learning method for injecting model watermarks on the server side according to claim 1, characterized in that: The step of sending the watermark parameter to each of the federation participants further includes: The plurality of federation participants obtain the watermark parameters; The plurality of federation participants obtain participation information of corresponding federation participants to the target global model based on the watermark parameters.

7. A federated learning system with a server-side model watermark injection, characterized in that: The federated learning system for injecting model watermarks on the server side includes: An information acquisition module is used to obtain a target model and watermark strings generated by multiple federation participants; A training module, used for sending a target model to a plurality of the federation participants, wherein the plurality of the federation participants and the local server respectively train the target model, and perform training after a preset federation round to obtain a target global model and watermark parameters, wherein before training the target model, the watermark parameters are generated according to the plurality of watermark character strings; A parameter sending module, used for sending the watermark parameters to each of the federation participants; The sending of the target model to the plurality of federation participants, the plurality of federation participants and the local server respectively training the target model, performing training after a preset federation round, and obtaining the target global model and watermark parameters specifically include: During each training, the global model obtained during the previous training is sent to the plurality of federation participants, wherein during the first training, the target model is sent to the plurality of federation participants; The global model obtained by the previous training is trained according to the watermark parameters generated before the training and the local local data to obtain the current server-side target model; The multiple participants respectively train the global model obtained in the previous training through the corresponding local data, generate multiple current participant target models, and send the multiple participant target models to the local server; The current server-side target model obtained from the training and multiple current participant target models are federated and aggregated to obtain the current global model; It is determined whether the current number of training times reaches the preset federal round. If the current number of training times reaches the preset federal round, the watermark parameter is obtained, and the current global model obtained by the training is used as the target global model.

8. A terminal, characterized in that: The terminal includes: a memory, a processor, and a server-side federated learning program for injecting model watermarks stored in the memory and executable on the processor. When the server-side federated learning program for injecting model watermarks is executed by the processor, the steps of the server-side federated learning method for injecting model watermarks are implemented as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a server-side federated learning program for injecting model watermarks. When the server-side federated learning program for injecting model watermarks is executed by a processor, the steps of the server-side federated learning method for injecting model watermarks as described in any one of claims 1 to 6 are implemented.

Images