A method for collaborative processing of machine learning model inference and forgetting request

Abstract

The application discloses a kind of machine learning model inference and forget request collaborative processing method, machine learning online service provider is updated model in real time in background based on forget request, and robustness detection is carried out to user inference request, service scheduling is carried out according to detection result, to realize faster response speed.The method comprises the following steps:1) sub-model training: split data set and train multiple sub-models with independent inference ability and online service;2) forget request processing: corresponding sub-model is updated in real time based on forget request received during service;3) inference request response: high robustness inference request is responded preferentially, and low robustness request is responded based on new model after model is completed updating.The application first proposes the collaborative processing method of multiple requests in the online service scene of machine learning, while guaranteeing privacy and correctness, higher response speed is realized, which is superior to existing method, with the advantages of strong universality, easy to deploy and the like.

Description

Technical Field

[0001] This invention relates to the field of online machine learning model services, and more particularly to a method for collaborative processing of machine learning model inference and forgetting requests. Background Technology

[0002] Machine learning inference services are typically deployed on cloud computing platforms, receiving inference requests from users and returning prediction results. In machine learning scenarios, it is not only necessary to remove data from the training dataset, but also to eliminate the impact of the data on model parameters; otherwise, there is still a high risk of privacy leakage (Y Liu, R Wen, X He, A Salem, Z Zhang, M Backes, E De Cristofaro, M Fritz, Y Zhang. 2022. ML-Doctor: Holistic risk assessment of inference attacks against machine learning models. 31st USENIX Security Symposium (USENIX Security 22), 4525-4542.). Early research on scheduling schemes only considered optimizing inference requests based on cost factors such as time and resources (D Crankshaw, X Wang, G Zhou, MJ Franklin, JE Gonzalez, I Stoica. 2017. Clipper: low-latency online prediction serving system. In Proceedings of the 14th USENIX Conference on Networked Systems Design and Implementation (NSDI'17). USENIX Association, USA, 613-627.)(HShen, L Chen, Y Jin, L Zhao, B Kong, M Philipose, A Krishnamurthy, R.S. undaram. 2019. Nexus: a GPU cluster engine for accelerating DNN-based video analysis. In Proceedings of the 27th ACM Symposium on Operating Systems Principles (SOSP'19). Association for Computing Machinery, New Zealand. (York, NY, USA, 322-337.), completely ignoring the forgetfulness requests of data owners, failing to strictly comply with privacy protection laws and regulations, and resulting in additional compliance costs.

[0003] The earliest forgetting algorithms for handling forgetting requests were designed based on specific model structures, such as those for logistic regression (C Guo, T Goldstein, A Hannun, L Van Der Maaten. 2020. Certified data removal from machine learning models. In Proceedings of the 37th International Conference on Machine Learning (ICML'20), Vol. 119. JMLR.org, Article 359, 3832-3842.), K-means clustering (B Mirzasoleiman, A Arbasi, A Krause. 2021. Deletion-robust submodular maximization: Data summarization with “the right to be forgotten”. International Conference on Machine Learning. PMLR, 2017: 2449-2458.), and random forests (J Brophy, D Lowd. 2021. Machine unlearning for randomforests. International Conference on Machine Learning). Learning.PMLR, 2021:1092-1104.), and subsequently some forgetting mechanisms for more general convex optimization models have emerged (A Sekhari, J Acharya, G Kamath, A.T. Suresh. Remember what you want to forget: Algorithms for machine unlearning[J].Advances in Neural Information Processing Systems, 2021, 34:18075-18086.)(AGolatkar, A.A. Chille, S. Soatto. 2020. Eternal sunshine of the spotless net: Selective forgetting in deep networks. Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition.(2020:9304-9312.). However, these forgetting requests and data deletion algorithms are generally only applicable to specific models and have limited effectiveness on currently widely used deep learning non-convex models; moreover, the research focus is limited to the design and efficiency optimization of forgetting techniques, lacking a comprehensive and systematic consideration from the perspective of machine learning inference services. The scheduling optimization problem of co-scheduling forgetting requests and inference requests remains to be solved.

[0004] One idea most closely related to this method is to limit the impact of a single data point on the model, reduce the computational cost of forgetting processing, and thus improve the real-time performance of the processing (L Bourtoule, V Chandrasekaran, CAChoquette-Choo, H Jia, ATravers. 2021. Machine unlearning. 2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021: 141-159.). However, to improve the efficiency of forgetting handling, these methods temporarily suspend received forgetting requests until their number reaches a certain threshold, at which point they are merged and processed. During this period, the old model that has not undergone forgetting handling is used to respond to inference requests, which poses a risk of user data privacy leakage (Y Liu, Z Zhao, M Backes, Y Zhang. 2022. Membership Inference Attacks by Exploiting LossTrajectory. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS'22). Association for Computing Machinery, New York, NY, USA, 2085-2098.). More importantly, during the concentrated model update period, no inference requests can be responded to, causing a sharp increase in inference latency, which may lead to users abandoning the inference service. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a low-latency method for collaborative processing of machine learning model inference and forgetting requests, while maximizing the protection of user data privacy and security and meeting compliance requirements.

[0006] The objective of this invention is achieved through the following technical solution: a method for collaborative processing of machine learning model inference and forgetting requests, comprising the following steps:

[0007] (1) Sub-model training: First, the existing dataset is evenly and randomly divided into multiple sub-datasets, and each sub-dataset is used to train a sub-model that can be independently classified and recognized. Then, machine learning model inference services are provided based on these sub-models.

[0008] (2) Forget Request Handling: For some data owners who send forget requests due to concerns about data privacy leakage, that is, requesting the deletion of their data from the training dataset and the elimination of its impact on model parameters, firstly, the sub-model to which the requested data to be forgotten belongs is identified, and then the sub-model is updated in the background. During the update, the sub-model does not participate in the inference service.

[0009] (3) Inference request response based on robust detection: For each inference request received during the service period, first classify all the sub-models obtained in step (1) and detect the robustness of the aggregation result; for highly robust inference requests, the inference result can be returned immediately; for low robust inference requests, it is necessary to wait for the currently ongoing model update to be completed, and then re-infer based on the new model before returning the response result.

[0010] Further, step (1) includes the following sub-steps:

[0011] (1.1) First, the training dataset is divided into K uniformly random subsets of equal size {D1, D2, ..., D...}. K Then, based on these datasets, independently train K machine learning models {M1, M2, ..., M} for classification tasks. K};

[0012] (1.2) After the model training is completed, an online machine learning inference service is provided. The inference result is an aggregation of the classification results of K sub-models: Where x represents the sample in the inference request, and c represents the classification category. This is an indicator function; it outputs 1 when the input is true and 0 otherwise.

[0013] Furthermore, step (2) includes the following sub-steps:

[0014] (2.1) For each forgotten request (x) sent by the data owner, u y u First, based on the partitioning method in step (1.1), identify the dataset D to which it belongs. i and model M i ;

[0015] (2.2) First update the dataset D′ i =D i / (x u yu Then, based on this dataset, the model M is updated in the background. i Get M i Before the model update is complete, the sub-model will not participate in the inference service, while the model that is not in the update state will continue to provide inference services in the foreground.

[0016] (2.3) If the forgetting request arrives, model M i If the update is already in progress, terminate the ongoing update and proceed based on the latest dataset D′. i Restart the update.

[0017] Furthermore, step (3) includes the following sub-steps:

[0018] (3.1) Whenever an inference request x is received, first count the number U of models currently being updated. Then, inference is temporarily suspended; whenever a model update is completed, U is updated until...

[0019] (3.2) Once the conditions in step (3.1) are met, all models that are not in the update state are used to perform inference with x as input, resulting in KU classification results {M1(x), M2(x), ..., M...}. K-U (x)};

[0020] (3.3) For each possible classification category c, count the number of times it appears in these KU classification results. Count the number of items in each of the KU classification results and sort them. When the numbers are equal, the category with the smaller index comes first. The categories with the most items and the second most items are denoted as c1 and c2, respectively, and their quantities are denoted as n1 and n2, respectively. If it is highly robust, then c1 will be returned as the reasoning result to the user who submitted the reasoning request;

[0021] (3.4) If the conditions in step (3.3) are not met, i.e., if the robustness is low, then after each model update is completed, the updated model is used to infer x to obtain M. K-U+1 (x), then update U, c1, c2, n1, and n2 accordingly, and judge again. If the condition is met, return c1; otherwise, continue waiting for the next model update to complete and check again until the condition is met.

[0022] (3.5) For forgotten requests that arrive during the processing of the reasoning request, as long as their timestamp is later than the timestamp of the reasoning request, the processing of the reasoning request is not affected by the forgotten request, and the old model before the update can be used for reasoning.

[0023] Furthermore, in step (3), the robustness level is determined by whether the result of the aggregate classification changes before and after the sub-model update triggered by the forgetting request is completed.

[0024] A machine learning model inference and forget request co-processing device includes one or more processors for implementing the above-described machine learning model inference and forget request co-processing method.

[0025] An electronic device includes a memory and a processor, the memory being coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-described machine learning model inference and forget request collaborative processing method.

[0026] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described machine learning model inference and forget request collaborative processing method.

[0027] The beneficial effects of this invention are that, by utilizing the structure of the aggregation model, it not only limits the scope of influence of a single data point on the model and improves the speed of forgetting processing, but also achieves robust detection based on the aggregation structure. Furthermore, by responding to highly robust inference requests in advance, it reduces the inference delay caused by forgetting processing. Under the premise of maximizing user data security and meeting data compliance requirements, it improves the efficiency of online inference services for machine learning models and has the advantages of strong model versatility and ease of deployment. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating the method of the present invention;

[0029] Figure 2 This is a schematic diagram of the structure of the device of the present invention;

[0030] Figure 3 This is a schematic diagram of an electronic device according to the present invention. Detailed Implementation

[0031] The present invention will now be described in detail with reference to the accompanying drawings.

[0032] This invention provides a collaborative processing method for machine learning model inference and forget requests in an online inference service scenario. An inference request is typically a piece of data submitted by a user, applicable to the model, requesting the model to return the classification result for that data. A forget request, on the other hand, is submitted by the owner of the training data, requesting the model holder to delete specific data from the training dataset and eliminate its impact on the model parameters. (See reference...) Figure 1 The collaborative processing method includes the following steps:

[0033] (1) Sub-model training: First, the existing training dataset is divided into multiple sub-datasets in a uniform and random manner. With the goal of minimizing the loss function, sub-models that can be independently classified and recognized are trained using each sub-dataset. Then, machine learning model inference services are provided based on these sub-models through model aggregation.

[0034] (1.1) First, the training dataset is divided into K uniformly random subsets of equal size {D1, D2, ..., D...}. K Then, train the model according to the pre-defined loss function:

[0035]

[0036] Specifically, with the goal of minimizing the aforementioned loss function, K machine learning models {M1, M2, ..., Mn} are independently trained using gradient descent on the partitioned dataset, each suitable for classification tasks. K}; where L is the loss function, D j For the j-th dataset, (x i y i Let x be the i-th data point in the dataset. i For data, y i For the label, l θ (x i y i ) indicates that when the parameter is θ, x i The model output calculated for input and y i The distance.

[0037] (1.2) After the model training is completed, online machine learning inference services can be provided. Each sub-model takes the data x in the inference request as input and obtains the inference result M. i (x). The final inference result is aggregated from the classification results M(x) of the K sub-models in the following manner:

[0038]

[0039] Where x represents the sample in the inference request, c represents the classification category, and C represents the set of all possible categories. This is an indicator function; it outputs 1 when the input is true and 0 otherwise. When the number of different categories is equal, the category with the smaller number comes first.

[0040] (2) Forgot Request Handling: For some data owners who send forget requests due to concerns about data privacy leakage, that is, requesting the deletion of their data from the training dataset and the elimination of its impact on model parameters, the sub-model to which the requested data belongs must first be identified, and then the sub-model is updated in the background. During the update, the sub-model does not participate in the inference service.

[0041] (2.1) Let the forget request sent by the data owner be (x u y u ), where x u For the data in this forget request, y u Assign a label to the forget request. For each such request received, first define the scope of the data's impact on the model, that is, identify the dataset D to which it belongs based on the partitioning method in step (1.1). i and model M i .

[0042] (2.2) First, delete the data from the dataset:

[0043] D′ i =D i / (x u y u )

[0044] Among them, D′ i To delete the data from the dataset, and then update model M in the background based on that dataset. i Get M i The update method involves retraining the sub-model using the new dataset. Since only the corresponding sub-model needs to be trained, this is much faster than retraining the entire model. Before the model update is complete, the sub-model no longer participates in inference services, while the model not being updated continues to provide inference services in the foreground.

[0045] (2.3) If the forgetting request arrives, model M i If the data is already being updated, the ongoing update will be terminated because the dataset it relies on can no longer meet the requirements of the new forget request. After the data corresponding to the forget request is deleted, the update will then be based on the latest dataset D′. i Restart the update.

[0046] (3) Robust detection-based inference request response: During model service, each inference request x is first classified using all the sub-models obtained in step (1), and the robustness of the aggregated result is detected. Here, robustness is defined as if all sub-models are in use. For highly robust inference requests, the inference result can be returned immediately; for low robust inference requests, the current model update needs to be completed, and the inference is re-inferred based on the new model before the response result is returned.

[0047] (3.1) Whenever an inference request x is received, first count the number U of models currently being updated. This inference result will inevitably have low robustness because the predictions of all updating sub-models are unknown, and in extreme cases, they may form an absolute majority over the predictions of existing models. Therefore, inference will not be performed for the time being; U will be updated whenever a model update is completed, until... Only then is it possible to obtain a highly robust reasoning result.

[0048] (3.2) If the inference request has the potential to obtain a highly robust inference result, that is, after the condition in step (3.1) is met, inference is performed using all available models with x as input. This step will yield KU classification results {M1(x), M2(x), ..., M...} K-U (x)}.

[0049] (3.3) For each possible classification category c∈C, count the number of times it appears in these KU classification results, num. c :

[0050]

[0051] Count the number of each class {num1, num2, ..., num} in KU classification results. |C| Sort the categories (if the quantities are equal, the category with the smaller index comes first), and denote the categories with the largest and second largest quantities as c1 and c2, respectively, with their quantities as n1 and n2. If the following expression is satisfied:

[0052]

[0053] This indicates that even if all the inference results after the updated models are completed are c2, their total number will not exceed the number of c1, n1. The final classification result will definitely be c1, which is highly robust. In this case, we do not need to wait for the currently updated sub-models to complete their updates, but can directly return c1 as the inference result to the user who submitted the inference request.

[0054] (3.4) If the condition in step (3.3) is not met, it indicates low robustness because if the inference result after all the updated models are completed is c2, their total number will exceed the number of c1, n1, causing the aggregated inference result to change. In this case, it is necessary to wait for the sub-model updates to complete. Each time a model is updated, the updated model is used to infer x, resulting in M. K-U+1 (x), then update U, c1, c2, n1, and n2 accordingly, and judge again. If the condition is met, return c1; otherwise, continue waiting for the next model update to complete and check again until the robustness condition is met.

[0055] (3.5) For forgotten requests that arrive during the processing of the reasoning request, as long as their timestamp is later than the timestamp of the reasoning request, the processing of the reasoning request is not affected by the forgotten request, and the old model before the update can be used for reasoning.

[0056] Based on the above steps, efficient real-time collaborative processing of inference and forgetting requests can be achieved in online service scenarios of machine learning classification models.

[0057] Corresponding to the aforementioned embodiments of the machine learning model inference and forget request collaborative processing method, the present invention also provides embodiments of a machine learning model inference and forget request collaborative processing apparatus.

[0058] See Figure 2 The machine learning model inference and forgetting request co-processing apparatus provided in this embodiment of the invention includes one or more processors for implementing the machine learning model inference and forgetting request co-processing method in the above embodiment.

[0059] The embodiments of the machine learning model inference and forget request collaborative processing device of the present invention can be applied to any device with data processing capabilities, such as a computer or other similar device. The device embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 2 The diagram shown is a hardware structure diagram of any data processing-capable device containing the machine learning model inference and forget request collaborative processing device of the present invention, except... Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0060] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0061] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0062] Corresponding to the aforementioned embodiments of the machine learning model inference and forget request collaborative processing method, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the machine learning model inference and forget request collaborative processing method as described above. Figure 3 The diagram shown is a hardware structure diagram of any device with data processing capabilities where the machine learning model inference and forget request collaborative processing method provided in this application embodiment is located, except... Figure 3 In addition to the processor, memory, DMA controller, disk, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0063] Corresponding to the aforementioned embodiments of the machine learning model inference and forget request collaborative processing method, this embodiment of the invention also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the machine learning model inference and forget request collaborative processing method in the above embodiments.

[0064] The computer-readable storage medium can be an internal storage unit of any data processing device described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be any data processing device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0065] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0066] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for collaborative processing of machine learning model inference and forgetting requests, characterized in that, Includes the following steps: (1) Sub-model training: First, the existing dataset is evenly and randomly divided into multiple sub-datasets, and each sub-dataset is used to train a sub-model that can be independently classified and recognized. Then, machine learning model inference services are provided based on these sub-models. (2) Forget Request Handling: For forget requests sent by data owners due to concerns about data privacy leaks, i.e., requests to remove their data from the training dataset and eliminate its impact on model parameters, the sub-model to which the requested data belongs must first be identified. Then, the sub-model is updated in the background. During the update, the sub-model does not participate in the inference service; including: (2.1) For each forgotten request sent by the data owner received First, identify the dataset to which it belongs based on the partitioning method in step (1.1). and model ; (2.2) First update the dataset Then, the model is updated in the background based on this dataset. get Before the model update is complete, the sub-model will not participate in the inference service, while the model that is not in the update state will continue to provide inference services in the foreground. (2.3) If the forgetting request arrives, the model If the update is already in progress, terminate the ongoing update and proceed based on the latest dataset. Restart the update; (3) Robust detection-based inference request response: For each inference request received during the service period, first classify it using all the sub-models obtained in step (1), and then test the robustness of the aggregated result; for highly robust inference requests, the inference result can be returned immediately; for low robust inference requests, it is necessary to wait for the currently ongoing model update to complete, and then re-infer based on the new model before returning the response result; including: (3.1) Whenever a reasoning request is received First, count the number of models currently being updated. ,like If no model update is completed, then inference will not be performed for the time being; updates will be performed whenever a model update is completed. ,until ; (3.2) Once the conditions in step (3.1) are met, use all models that are not in the update state respectively... Reasoning is performed on the input to obtain Classification results ; (3.3) For each possible classification category Statistics on this Number of occurrences in each category result ,statistics The number of items in each category of the classification results is sorted. When the number of items is equal, the category with the smaller index comes first. The categories with the most items and the second most items are denoted as follows: and Their quantities are respectively denoted as and ;like That is, high robustness, then The inference result is returned to the user who submitted the inference request; (3.4) If the conditions in step (3.3) are not met, i.e., if the robustness is low, then after each model update is completed, the updated model is used to... Through reasoning, we obtain Then update accordingly. , , , and Make another judgment If satisfied, return. Otherwise, continue waiting for the next model update to complete and then judge again until the condition is met; (3.5) For forgotten requests that arrive during the processing of the reasoning request, as long as their timestamp is later than the timestamp of the reasoning request, the processing of the reasoning request will not be affected by the forgotten request, and the old model before the update can be used for reasoning.

2. The machine learning model inference and forgetting request collaborative processing method according to claim 1, characterized in that, Step (1) includes the following sub-steps: (1.1) First, the training dataset is divided into uniformly random groups. A subset of data of uniform size Then train independently based on these datasets. A machine learning model for classification tasks ; (1.2) After the model training is completed, an online machine learning inference service is provided, and the inference results are generated by... The classification results of each sub-model are aggregated: ,in This represents a sample in the inference request. Indicates the category, This is an indicator function; it outputs 1 when the input is true and 0 otherwise.

3. The machine learning model inference and forgetting request collaborative processing method according to claim 1, characterized in that, In step (3), the robustness is determined by whether the result of the aggregate classification changes before and after the sub-model update triggered by the forgetting request is completed.

4. A machine learning model inference and forget request co-processing device, characterized in that, It includes one or more processors for implementing the machine learning model inference and forgetting request co-processing method as described in any one of claims 1-3.

5. An electronic device, comprising a memory and a processor, characterized in that, The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the machine learning model inference and forget request collaborative processing method according to any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the machine learning model inference and forgetting request collaborative processing method as described in any one of claims 1-3.

Images