Differential privacy based federated hierarchical learning method
By employing hierarchical training and differential privacy protection in federated learning, deep neural networks are trained layer by layer and noise is added during communication. This solves the problems of data privacy and communication costs in existing federated learning, achieving more efficient privacy protection and communication.
Patent Information
- Application Number
- CN202410634346.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-05-21
- Publication Date
- 2025-12-26
- Estimated Expiration
- 2044-05-21
AI Technical Summary
Existing federated learning methods have shortcomings in terms of data privacy protection and communication costs, especially in high-dimensional vector scenarios, where they cannot effectively solve data privacy problems.
A federated hierarchical learning method based on differential privacy is adopted. By training the deep neural network in layers and transmitting it layer by layer, combined with the differential privacy protection mechanism, only one layer of model parameters is updated and transmitted in each round of communication, and Gaussian noise is added during the transmission process to protect privacy.
It outperforms existing methods in terms of communication resources and data privacy protection, improves the model's accuracy and convergence and the robustness of privacy protection, and reduces equipment resource requirements and communication costs.
Smart Images
Figure CN118504659B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of machine learning, and particularly relates to a federated hierarchical learning method based on differential privacy. BACKGROUND
[0002] In recent years, computer vision has been widely used in face recognition, healthcare, transportation systems, etc. These applications rely on collecting large amounts of data for machine learning (ML) model training. In the Internet of Things (IoT) era, data is usually generated and captured from distributed devices. Usually, all raw data must be transmitted to a cloud server for further processing. This approach has raised concerns, particularly in the areas of data privacy and rising communication costs.
[0003] A forward-looking solution to these problems is to adopt federated learning (FL). This emerging technology allows clients to train machine learning models locally, exchanging only model parameters, thus eliminating the need for raw data transmission and addressing privacy issues in distributed learning. However, recent research has shown that this approach may not provide adequate data privacy protection. There is a risk of inferring sensitive information by analyzing the differences in parameters trained and uploaded from clients, and the source of the information can be traced back in the final trained model.
[0004] To strengthen privacy protection, differential privacy (DP) protection technology can be adopted in federated learning. It is achieved by adding artificial noise to the data to further protect data privacy. In recent years, various optimization strategies have emerged, such as DP-FL, APFL, LLDP, etc., all targeting refined accuracy. However, existing DP-based FL research generally focuses on adding noise to the entire model parameters. In scenarios involving high-dimensional vectors, the entire model needs to be trained on client devices and noise needs to be added, which not only has strict requirements on device resources, but also increases communication costs. SUMMARY
[0005] The purpose of the present application is to provide a federated hierarchical learning method based on differential privacy, which can outperform existing methods in terms of communication resources and data privacy protection, and demonstrate the robustness and efficiency of the hierarchical method in the context of privacy-protected FL.
[0006] The technical solutions adopted by the present application are as follows:
[0007] The federated hierarchical learning method based on differential privacy comprises a general FL system, a server and a plurality of clients, denotes the local data set of the th client, wherein ;
[0008] The learning method employs the following steps:
[0009] S1: Client Train your own local model based on a set of data samples;
[0010] In S1, using Indicates the first Training samples, including features and tags , Let represent the loss function, where These are model parameters; dataset The loss function on is:
[0011] in, For the client Number of samples; client The learning problem is to minimize the loss function. Find the optimal model parameters :
[0012] The server's goal is to... Each client learns the global model; the server will learn from... The weights received by the client are added as follows:
[0013] In the formula, ;in, Let be the total size of all data samples; the optimization problem can be expressed as:
[0014] , The client-side collaborative learning mechanism, coordinated by the server, iteratively executes the above process until the optimization problem is solved.
[0015] S2: Employing the mathematical framework of DP, it provides guidelines for differential privacy protection in distributed data processing systems;
[0016] In S2, the DP mathematical framework takes the following two forms:
[0017] S21: : has a domain Sum range random mechanism satisfy If all measurable sets And any two adjacent databases :
[0018] function satisfy wherein, is a relaxation factor; if then the random function gives pure differential privacy; if then denotes approximate differential privacy; the algorithm balances privacy protection and data utility, the smaller the
[0019] S22: Sensitivity: for any query function, the global sensitivity of the function is defined as:
[0020] ensures that the given noise distribution preserves ; wherein, denotes a Gaussian distribution, the noise scale is chosen as:
[0021] .
[0022] S3: Hierarchical DNN training for each client;
[0023] In the S3, each client can train the model layer by layer, instead of training the complete DNN model in each round of communication;
[0024] The DNN network is initially divided into multiple layers or blocks, starting from training one layer / block until its parameters converge; for the training layer / block, the model developer attaches a new classifier on it to output the prediction and calculate the training loss; another layer / block is attached on the converged model, and only this layer / block is trained, while the previously converged layer / block is frozen.
[0025] S4: The client uses a DP mechanism to perturb the parameters after training one layer in each round.
[0026] In the S4, the DP mechanism training step is as follows:
[0027] S51: Model initialization and configuration: the server is responsible for global model initialization and configuration;
[0028] The server configures the model architecture and parameters, in each round, the server selects a subset of all clients to participate in the training of this round, and decides which layer to train, then sends the initial parameters and clipping threshold of the determined training layer to the selected clients;
[0029] S52: Local training: The client holds training data containing sensitive information;
[0030] Each client uses local data, trains in parallel, and only trains the layers. The parameters are uploaded to the server, and the client performs calculations on the local data. The gradient, and its parameters are clipped. Each client adds artificial noise according to the differential privacy rules of the Gaussian mechanism as a protective measure to protect sensitive information from potential attacks. After local training is completed, all participating clients upload the parameters of the training layer to the server of the uplink communication channel.
[0031] S53: Model Aggregation: The server is responsible for aggregating the model from each client layer. Uploaded parameters;
[0032] The aggregation process typically involves weighted combinations of these parameters, followed by averaging the weighted parameters of the training layer to generate an updated aggregation layer that reflects the collective knowledge of all participating clients.
[0033] In S53, strict differential privacy is maintained in the downlink communication channel, that is... The server introduces Gaussian noise into the aggregated global model.
[0034] The client employs differential privacy-based hierarchical federated training.
[0035] Layer updates are protected by updating only one layer per round of communication, and Gaussian noise is added to protect parameters; if the batch size for local training equals the number of training samples, the client... Upload only the training layer The parameters, the query function is responsible for the computation layer. The function of the parameters can be represented as:
[0036] In the formula, For the client Local dataset, For the client The local model layer The parameters, for The first in One sample; The sensitivity can be expressed as:
[0037] in, Presentation layer The clipping threshold, Is with Adjacent datasets, the same size but differing by only one sample. is the th sample in , the global sensitivity of the uplink channel can be defined as:
[0038] The minimum size of the local dataset between clients is defined as ; therefore, .
[0039] If each client participates in the round training, the privacy budget is , in order to ensure that each client in the uplink has in one exposure, set the noise scale:
[0040] From the perspective of the downlink, The aggregation operation can be represented as:
[0041] wherein , is the server aggregation parameter to be broadcast to the client, and the sensitivity of after aggregation is:
[0042] wherein, in an ideal case, all local data sets of the clients have the same data size, so ; to ensure that in the aggregated downlink channel , the server adds Gaussian noise to the aggregation parameter , and the standard deviation is:
[0043] .
[0044] The technical effects obtained by the present application are:
[0045] The federated hierarchical learning method based on differential privacy of the present application is superior to the existing method in terms of communication resources and data privacy protection. The LFL-DP is compared with the differential privacy federated learning (FL-DP) in terms of precision convergence, and the results prove that the LFL-DP is superior to the performance of the FL-dp in terms of precision convergence, and prove the robustness and efficiency of the hierarchical method in the privacy protection FL scene. BRIEF DESCRIPTION OF DRAWINGS
[0046] Figure 1 is the test precision of the LFL-DP method and the FL-DP of the embodiment of the present application on the CIFAR10 and MNIST data sets;
[0047] Figure 2 is the flowchart of the embodiment of the present application. DETAILED DESCRIPTION
[0048] In order to make the purposes and advantages of the present application clearer, the present application will be specifically described below in conjunction with embodiments. It should be understood that the following description is only used to describe one or several specific embodiments of the present application, and does not strictly limit the scope of protection of the present application.
[0049] As shown in the following formula, the federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients. Figure 1 The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients. The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients. The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients. The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients. The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients. The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients.
[0050] The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients. The federated hierarchical learning method based on differential privacy includes a general FL system, a server and a plurality of clients.
[0051] S1: The client trains its own local model based on the data sample set. S1: The client trains its own local model based on the data sample set.
[0052] In S1, the i-th training sample is represented by xi, which includes features xi and label yi, and the loss function is represented by L(θ, xi), where θ is the model parameter; the loss function on the data set is:
[0053]
[0054] The server aims to learn a global model from the plurality of clients; the server adds the weights received from the plurality of clients as:
[0055]
[0056] The clients collaboratively learn the ML model coordinated by the server, and iteratively perform the above process until the optimization problem is solved.
[0057] S2: Adopting the mathematical framework of DP to provide guidelines for differential privacy protection of distributed data processing system;
[0058] In S2, the DP mathematical framework is divided into the following two forms and definitions:
[0059] S21: : A random mechanism with domain and value domain satisfies : If all measurable sets , and any two adjacent databases :
[0060] The function satisfies , where is a relaxation factor; if , the random function gives pure differential privacy; if , then indicates consent differential privacy; by using this algorithm to balance privacy protection and data utility, the smaller the privacy protection is, the lower the data utility is;
[0061] S22: Sensitivity: For any query function, the global sensitivity of the function is defined as:
[0062] In order to ensure that the given noise distribution retains ; where indicates a Gaussian distribution, and the selected noise scale is:
[0063] .
[0064] S3: Hierarchical DNN training for each client;
[0065] In S3, each client can train the model layer by layer, rather than training the complete DNN model in each round of communication;
[0066] The DNN network is initially divided into multiple layers or blocks, starting from training one layer / block until its parameters converge; for the training layer / block, the model developer attaches a new classifier on it to output the prediction and calculate the training loss; on the converged model, another layer / block is attached, and only this layer / block is trained, while the previously converged layer / block is frozen.
[0067] S4: The client uses the DP mechanism to perturb the parameters after training one layer in each round.
[0068] In S4, the training steps using the DP mechanism are as follows:
[0069] Considering a FL system, assume that the server is honest but greedy. Generally, the entire model usually contains comprehensive data information, therefore, directly transmitting the accurate entire local model will cause security problems due to the risk of model parameters being intercepted. Advantageously, deep neural networks have a hierarchical structure, where each layer has a different function in mapping sample features. Therefore, one way to mitigate this vulnerability and prevent attackers from inferring sensitive data information by intercepting model parameters is to train and transmit the DNN model layer by layer. In addition, in order to further strengthen privacy protection, the client uses the DP mechanism to perturb the parameters after training one layer in each round;
[0070] S51: Model initialization and configuration: the server is responsible for global model initialization and configuration;
[0071] The server configures the model architecture and parameters, in each round, the server selects a subset of all clients to participate in the training of this round, and decides which layer to train, then sends the initial parameters of the determined training layer and the clipping threshold to the selected clients;
[0072] S52: Local training: the client holds training data containing sensitive information;
[0073] Each client uses local data, trains in parallel and only uploads the parameters of the training layer to the server, the client calculates the gradient of the layer on the local data and clips its parameters, each client adds artificial noise according to the differential privacy rule of the Gaussian mechanism, as a protective measure to protect sensitive information from potential attacks, after the local training is completed, all participating clients upload the parameters of the training layer to the server in the uplink communication channel;
[0074] S53: Model aggregation: the server is responsible for aggregating the parameters uploaded by each client for the layer;
[0075] The aggregation process usually involves a weighted combination of these parameters, then the weighted parameters of the training layer are averaged to generate an updated aggregated layer, which reflects the collective knowledge of all participating clients.
[0076] In S53, strict differential privacy is maintained in the downlink communication channel, i.e. The server introduces Gaussian noise into the aggregated global model. The noise level is determined according to a predetermined formula.
[0077] The iterative execution of the above process will be applied to each training layer systematically until it converges or reaches a predefined number of rounds.
[0078] The hierarchical federated training of the client with differential privacy;
[0079] Protect the update of the layer by updating only one layer per round of communication and protect the parameters by adding Gaussian noise; if the batch size of local training is equal to the number of training samples, the client Uploads only the parameters of the training layer The query function is the function responsible for calculating the parameters of the layer , which can be expressed as:
[0080] In the formula, is the local data set of the client , is the parameter of the layer of the local model of the client , is the th sample in ; The sensitivity of
[0081] where represents the clipping threshold of the layer , is the data set adjacent to , which is the same size but only differs by one sample, is the th sample in , and the global sensitivity of the uplink channel can be defined as:
[0082] Define the minimum size of the local data set between clients as ; therefore, .
[0083] If each client participates in the round of training, the privacy budget is , in order to ensure that each client in the uplink has in one exposure, set the noise scale:
[0084] From the perspective of the downlink, the aggregation operation can be expressed as:
[0085] where , To aggregate parameters of the server to be broadcast to the clients, after aggregation The sensitivity of the server is:
[0086] where, in the ideal case, the local dataset of all clients has the same data size, thus ; to ensure that the aggregated downlink channel has , the server adds to the aggregated parameters a Gaussian noise with standard deviation:
[0087] .
[0088] The following outlines our full pipeline for training an efficient model for privacy preservation and communication:
[0089] First, the server initializes the global DNN model with random weights, with a clipping threshold of for each layer; it then broadcasts the initial parameters of the model to the participating clients; the clients execute the function ClientUpdate() to update the parameters of the selected model layer , which are determined by the server and added with noise. Upon receiving the updates from all participating clients, the server performs layer weight aggregation. And adds noise to the downlink channel. It broadcasts the new version of the layer to the clients for the next round. The above steps are iteratively performed until the training of the layer converges, or a fixed but sufficient number of rounds is completed. Then, this layer is considered fully trained and is broadcast to all clients for training the next layer.
[0090] The function ClientUpdate() outlines the client operations performed by LFL-DP. A participating client loads from the server the received model parameters and clipping threshold to form . In front, this new layer is connected to the previous pre-trained layers, which are frozen during training. In the background, the client appends to its own derived classifier , which consists of fully connected layers and a softmax layer, as the model output to output predictions and compute training loss. The training layers and the classifier are updated through the training process. Upon completion of the training process, the parameters of the layer are clipped, and then added with a noise coefficient of: . Finally, each client sends the weights of the training layer to the server.
[0091]
[0092] Federated learning (FL) is a distributed machine learning approach that can protect data privacy because it requires exchanging training parameters between clients without sharing the original data. However, recent research has shown that malicious attackers can still infer sensitive information using model parameters. Furthermore, transmitting complete model parameters increases communication costs. To address these challenges, this invention introduces a novel privacy-preserving and communication-efficient framework called Hierarchical Federated Learning with Differential Privacy (LFL-DP). This method outperforms existing methods in terms of communication resources and data privacy protection. A comparison of LFL-DP with the well-known Differential Privacy Federated Learning (FL-DP) in terms of accuracy convergence demonstrates that LFL-DP outperforms FL-DP in accuracy convergence and proves the robustness and efficiency of the hierarchical approach in privacy-preserving FL scenarios.
[0093] Figure 1 The accuracy convergence analysis results for AlexNet trained on CIFAR10 with a privacy level of 4 and LeNet trained on MNIST with a privacy level of 1 are presented respectively. We can see that... Figure 1 In the upper part of the model (AlexNet on CIFA10), the accuracy drops sharply around 900 training epochs with FL-DP. This is likely due to the system getting stuck in local optima, hindering further accuracy improvements and severely impacting model convergence. We can also observe that for LeNet on MINST, the accuracy fluctuations of FL-DP are much larger than those of LFL-DP. The results indicate that, compared to LFL-DP, training the entire model in FL and introducing noise into the entire model parameters more severely exacerbates the bias in model accuracy.
[0094] The above description is merely a preferred embodiment of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention. Structures, devices, and operating methods not specifically described or explained in this invention are implemented according to conventional methods in the art unless otherwise specified or limited.
Claims
1. A federated hierarchical learning method based on differential privacy, characterized in that: including a generic FL system, server and a set of clients, a local dataset representing the first client, wherein ; The learning method adopts the following steps: S1: Client train own local model based on data sample set; S2: Using the mathematical framework of DP to provide guidelines for differential privacy protection of distributed data processing systems; S3: Hierarchical DNN training for each client; In S3, each client can train the model layer by layer, rather than training the complete DNN model in each round of communication; DNN networks are initially divided into multiple layers or blocks, from training one layer / block until its parameters converge; for the trained layer / block, the model developer appends a new classifier on top of it to output predictions and compute training loss; on the converged model, another layer / block is appended, and only this layer / block is trained while the previously converged layers / blocks are frozen; S4: The client uses the DP mechanism to perturb the parameters after training a layer in each round; In S4, the DP mechanism training steps are as follows: S51: Model initialization and configuration: the server is responsible for global model initialization and configuration; The server configures a model architecture and parameters, in each round, the server selects a subset of all clients to participate in the training of this round, and decides which layer to train, then sends the determined training layer initial parameters and pruning thresholds to the selected clients; S52: Local training: the client holds training data containing sensitive information; Each client uses local data, trains in parallel and only uploads the parameters of the training layer to the server The client calculates the gradient of the layer on the local data and clips its parameters Each client adds artificial noise according to the differential privacy rule of Gaussian mechanism as a protective measure to protect sensitive information from potential attacks After local training is completed, all participating clients upload the parameters of the training layer to the server on the uplink communication channel; S53: Model Aggregation: The server is responsible for aggregating layers from each client uploaded parameters; The aggregation process usually involves a weighted combination of these parameters, and then the weighted parameters of the training layer are averaged to generate an updated aggregated layer that reflects the collective knowledge of all participating clients.
2. The federated hierarchical learning method based on differential privacy according to claim 1, characterized in that: In the S1, use to represent the i-th training sample, including features and labels , , and use to represent the loss function, where is the model parameter; the loss function on the data set is: where, is the number of samples of the client ; the learning problem of the client is to find the optimal model parameters by minimizing the loss function : The goal of the server is to learn a global model from clients; the server will add the weights received from the clients as: wherein, ; wherein, is the total size of all data samples; the optimization problem can be expressed as: , The client collaborates with the server-coordinated ML model to iteratively perform the above process until the optimization problem is solved.
3. The federated hierarchical learning method based on differential privacy according to claim 1, characterized in that: In S2, the DP mathematical framework is divided into the following two forms: S21: : having a domain and a range of values random mechanism satisfies : if all measurable sets , and any two adjacent databases : function satisfies where, is a relaxation factor; if , the random function gives pure differential privacy; if , the denotes approximate differential privacy; by using this participation, the privacy protection and data utility are balanced, the smaller, the higher the privacy protection, the lower the data utility; S22: Sensitivity: For any query function, the global sensitivity of the function is defined as: ensuring a given noise distribution retaining ; wherein, denotes a Gaussian distribution, the noise scale being chosen as: 。 4. The federated hierarchical learning method based on differential privacy according to claim 1, characterized in that: In the S53, strict differential privacy is maintained in the downlink communication channel, that is , the server introduces Gaussian noise into the aggregated global model.
5. The federated hierarchical learning method based on differential privacy according to claim 1, characterized in that: The client adopts hierarchical federated training with differential privacy; The update of the layer is protected by updating only one layer per round of communication, and the parameters are protected by adding Gaussian noise; if the batch size of the local training is equal to the number of training samples, the client only uploads the parameters of the training layer The query function is a function responsible for calculating the parameters of the layer , which can be expressed as: In the formula, For the client Local dataset, For the client The local model layer The parameters, for The first in One sample; The sensitivity can be expressed as: where, the representation layer the clipping threshold, is the data set adjacent to with the same size but only one sample difference, is the th sample in The global sensitivity of the uplink channel can be defined by the above formula: The minimum size of the local data set defined between clients is ; therefore, .
6. The federated hierarchical learning method based on differential privacy according to claim 5, characterized in that: If each client participates in the round of training, the privacy budget is , to ensure that each client in the uplink has , set the noise scale: From the downlink perspective, The aggregation operation of the downlink can be expressed as: wherein, , is a server aggregation parameter to be broadcast to the clients, after aggregation the sensitivity is: where, in an ideal case, the local data sets of all clients have the same data size, thus ; to ensure that the clients have the aggregated downlink channel , the server applies the aggregation parameter to the data set of the client with the highest data size. The standard deviation of the added Gaussian noise is: 。