Privacy detection method and system based on similarity alignment federated learning

Abstract

The application provides a privacy detection method and system based on similarity alignment federated learning. The application performs preliminary screening on the Internet of Things devices that may be poisoned by screening the model parameters locally trained by each Internet of Things device, and further determines the target Internet of Things device that is truly poisoned by using the model parameters uploaded by the screened Internet of Things devices that may be poisoned, and continues the federated learning of each unpoisoned Internet of Things device except the target Internet of Things device that is poisoned to train a global model, thereby avoiding the influence of the target Internet of Things device that is poisoned on the training of the global model, and improving the accuracy of the finally trained global model, such as an Internet of Things privacy detection model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to a privacy detection method and system based on similarity alignment federated learning. BACKGROUND

[0002] In the current privacy detection method based on federated learning, there are multiple Internet of Things devices and a server for managing the Internet of Things devices. The server distributes an initial model to each Internet of Things device, each Internet of Things device takes the initial model as a local model, and trains the local model based on local data to obtain parameters of a trained model, and then uploads the parameters of the trained model to the server, so that the server aggregates the parameters of the trained model uploaded by each Internet of Things device to obtain a new global model, and distributes the global model parameters to each Internet of Things device to update the local model, returns to the step of training the local model based on the local data to obtain the parameters of the trained model, until a federated learning end condition is met.

[0003] However, once there is an abnormal Internet of Things device providing abnormal local data, the abnormal Internet of Things device will train the local model based on the abnormal local data to obtain abnormal model parameters and upload them to the server, causing the server to aggregate the abnormal model parameters to obtain a new global model, resulting in a decrease in the detection accuracy of the global model. SUMMARY

[0004] Therefore, the present application provides a privacy detection method and system based on similarity alignment federated learning to improve the detection accuracy of the Internet of Things privacy detection model.

[0005] The technical solutions provided by the present application are as follows:

[0006] According to the embodiment of the first aspect of the present application, a privacy detection method based on similarity alignment federated learning is provided, which is applied to a server, and the method comprises:

[0007] determining first global model parameters according to the received model parameters uploaded by each Internet of Things device; the model parameters uploaded by any Internet of Things device are parameters of a trained model obtained by training a local model based on local training data, and the local training data of any Internet of Things device is obtained through at least two network layers, which are decoupled network layers in a neural network model;

[0008] grouping each Internet of Things device based on a first similarity between the model parameters uploaded by each Internet of Things device and the first global model parameters to obtain a suspected poisoning group and a normal group; determining second global model parameters using the model parameters uploaded by each Internet of Things device in the suspected poisoning group;

[0009] determine a target Internet of Things device based on the model parameters uploaded by each Internet of Things device in the suspected poisoned group of Internet of Things devices, the first global model parameters, and the second global model parameters; the target Internet of Things device is a poisoned Internet of Things device;

[0010] determine model correction parameters using the model parameters uploaded by the other Internet of Things devices except the target Internet of Things device, distribute the model correction parameters to each Internet of Things device, and instruct each Internet of Things device to update the local model based on the model correction parameters to obtain a target privacy detection model when the model correction parameters meet a set federated learning end condition; the target privacy detection model is used to detect Internet of Things privacy data; instruct each Internet of Things device to update the local model based on the model correction parameters and train the updated local model based on local training data to upload the parameters of the trained model to the server when the model correction parameters do not meet the set federated learning end condition.

[0011] Optionally, the determining the first global model parameters according to the received model parameters uploaded by each Internet of Things device comprises:

[0012] weighting and averaging the model parameters uploaded by each Internet of Things device to obtain the first global model parameters;

[0013] The determining the second global model parameters using the model parameters uploaded by each Internet of Things device in the suspected poisoned group of Internet of Things devices comprises:

[0014] weighting and averaging the model parameters uploaded by each Internet of Things device in the suspected poisoned group of Internet of Things devices to obtain the second global model parameters.

[0015] Optionally, the grouping each Internet of Things device based on the first similarity between the model parameters uploaded by each Internet of Things device and the first global model parameters to obtain a suspected poisoned group and a normal group comprises:

[0016] if the first similarity is less than a first threshold value, it is determined that the Internet of Things device uploading the model parameters belongs to the suspected poisoned group of Internet of Things devices;

[0017] if the first similarity is greater than or equal to the first threshold value, it is determined that the Internet of Things device uploading the model parameters belongs to the normal group of Internet of Things devices.

[0018] Optionally, the determining the target Internet of Things device based on the model parameters uploaded by each Internet of Things device in the suspected poisoned group of Internet of Things devices, the first global model parameters, and the second global model parameters comprises:

[0019] For each Internet of Things device in the suspected poisoning group, a first similarity of model parameters uploaded by the Internet of Things device to the first global model parameters is determined, and a second similarity of model parameters uploaded by the Internet of Things device to the second global privacy model is determined; a specified operation is performed on the first similarity and the second similarity to obtain an operation result, and whether the Internet of Things device is a target Internet of Things device is determined according to the operation result.

[0020] Optionally, the specified operation on the first similarity and the second similarity includes normalizing the first similarity and the second similarity.

[0021] According to the operation result, whether the Internet of Things device is a target Internet of Things device includes: if the normalization result is a first value, it is determined that the Internet of Things device uploading the model parameters is a target Internet of Things device, and if the normalization result is not the first value, it is determined that the Internet of Things device uploading the model parameters is not a target Internet of Things device.

[0022] Optionally, the normalization of the first similarity and the second similarity includes:

[0023] The first similarity and the second similarity are added to obtain a normalization result.

[0024] Optionally, the at least two network layers include:

[0025] The decoupled feature extractor and the first classifier and the second classifier in the neural network model;

[0026] The first classifier and the second classifier are configured with different loss functions.

[0027] The local training data is obtained by the following steps:

[0028] The preset original data is first input to the decoupled feature extractor to obtain data features, and the data features are input to the first classifier to obtain a first classification result, and then the first classification result is input to the second classifier to obtain; or,

[0029] The existing local training data is first input to the decoupled feature extractor to obtain data features, and the data features are input to the first classifier to obtain a first classification result, and then the first classification result is input to the second classifier to obtain.

[0030] Optionally, the loss function configured for the first classifier is a cross-entropy loss function based on small batch logit adjustment, and the loss function configured for the second classifier is a cross-entropy loss function.

[0031] According to the embodiments of the second aspect of the present application, a privacy detection system based on similarity alignment federated learning is provided, the system comprises:

[0032] a server, configured to execute the method of the first aspect;

[0033] a plurality of Internet of Things devices, wherein any Internet of Things device is configured to upload parameters of a trained model obtained by training a local model based on local training data to the server.

[0034] Optionally, any Internet of Things device is configured to, in a case where an initial model issued by the server is received, execute the step of uploading parameters of a trained model obtained by training a local model based on local training data, by taking the initial model as the local model;

[0035] any Internet of Things device is configured to, in a case where model correction parameters issued by the server and a training end instruction are received, update the local model based on the model correction parameters to obtain a target privacy detection model;

[0036] any Internet of Things device is configured to, in a case where model correction parameters issued by the server and a training continuation instruction are received, update the local model based on the model correction parameters and train the updated local model based on local training data to upload parameters of a trained model to the server.

[0037] As can be seen from the above technical solutions, the present application preliminarily screens the Internet of Things devices that may be poisoned by the model parameters trained locally by each Internet of Things device, and further determines the target Internet of Things device that is truly poisoned by using the model parameters uploaded by the screened Internet of Things devices that may be poisoned, and continues to train the global model by using each Internet of Things device that is not poisoned except the target Internet of Things device that is poisoned, thereby avoiding the influence of the target Internet of Things device that is poisoned on the training of the global model, and improving the precision of the global model such as the Internet of Things privacy detection model that is finally trained. BRIEF DESCRIPTION OF DRAWINGS

[0038] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0039] Figure 1 a flow chart of a privacy detection method based on similarity alignment federated learning provided for the embodiments of the present application;

[0040] Figure 2 a schematic diagram of the overall process of federated learning provided for the embodiments of the present application;

[0041] Figure 3A privacy detection system based on similarity alignment federated learning provided by an embodiment of the present application is shown in the schematic diagram.

[0042] Figure 4 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in the structural schematic diagram.

[0043] Figure 5 A structural diagram of a privacy detection device based on similarity alignment federated learning provided by an embodiment of the present application is shown in the structural diagram. DETAILED DESCRIPTION

[0044] In order to make the technical solution provided by the embodiments of the present application better understood by those skilled in the art, and make the above-mentioned purposes, features and advantages of the embodiments of the present application more apparent and easy to understand, the technical solutions in the embodiments of the present application are further described in detail below with reference to the accompanying drawings.

[0045] Please refer to Figure 1 , Figure 1 A flowchart of a privacy detection method based on similarity alignment federated learning provided by an embodiment of the present application is shown in the flowchart.

[0046] In the embodiment, the privacy detection method based on similarity alignment federated learning can be applied to a server.

[0047] As an embodiment, the server can be a management device for managing a plurality of Internet of Things devices in the Internet of Things, such as a central server or a cloud platform, etc., and the Internet of Things devices can include smart home devices, sensor devices, intelligent robots, etc., which are not limited by the present application.

[0048] As shown in Figure 1 , the method can include the following steps:

[0049] Step 101, determining first global model parameters according to the received model parameters uploaded by each Internet of Things device.

[0050] In the embodiment, the Internet of Things devices managed by the server are trained in the manner of federated learning. As an embodiment, each time the Internet of Things device completes a local training, it will upload the model parameters trained locally to the server. For example, the model parameters here can include one or more of the weight matrix of the Internet of Things device and the bias vector (used to represent the learning result of the model on the training data of the Internet of Things device), the model state, the training round, the identifier of the Internet of Things device, the model version or the synchronization state, etc.

[0051] As an embodiment, the local training of the Internet of Things device refers to the training of the local model of the Internet of Things device based on the local training data. Initially, the local model of the Internet of Things device is downloaded from the specified location by the Internet of Things device or is downloaded from the specified location by the Internet of Things device, and the present application does not limit this.

[0052] As an embodiment, the local training data of the Internet of Things device is obtained through at least two network layers, and the at least two network layers are decoupled network layers in the neural network model. Optionally, the at least two decoupled network layers in the neural network model can include a decoupled feature extractor and a first classifier, a second classifier in the neural network model.

[0053] In the present embodiment, the feature extractor is used to extract features of the local data of the Internet of Things device to extract representative data features in the local data, retain important feature information, and reduce computational complexity.

[0054] In the present embodiment, the first classifier can be used to process the data of Non-IID (Non-Independent and Identically Distributed) included in the local data of the Internet of Things device, and the second classifier can be used to process the data of IID (Independent and Identically Distributed) included in the local data of the Internet of Things device.

[0055] As an embodiment, the first classifier and the second classifier are configured with different loss functions. For example, the loss function configured for the first classifier can be a cross-entropy loss function adjusted based on a small batch of logits, and the loss function configured for the second classifier can be a cross-entropy loss function.

[0056] For Non-IID data, there can be correlation between samples, and there can be uneven distribution of data and class imbalance. It is difficult to adjust the loss of different types and different distributions of sample data through a traditional global loss function. The present embodiment uses a cross-entropy loss function adjusted based on a small batch of logits to process Non-IID data, which can more flexibly adjust the loss according to different types and different distributions of sample data, thereby adapting to the non-independent and identically distributed characteristics of the data. The small batch loss function can reflect the loss of more different distribution of sample data, and can more effectively control the generalization ability of the model.

[0057] For IID data, the samples are independent and do not affect each other. In this case, the ordinary cross-entropy loss function can effectively measure the difference between the prediction and the true label, and does not need to be adjusted additionally.

[0058] In this embodiment, training data is obtained by processing the local data of IoT devices through the aforementioned feature extractor, first classifier, and second classifier. This results in a more balanced distribution of training data among IoT devices, leading to a more consistent overall data distribution across all IoT devices. This reduces the heterogeneity of training data distribution among IoT devices and enhances the convergence of the final global model aggregated by the server. In other words, inputting local data into at least two decoupled network layers in the neural network model yields more evenly distributed training data. Further training the local model with this training data reduces the accuracy degradation caused by data distribution heterogeneity.

[0059] As an example, the local training data of the IoT device can remain unchanged. For instance, it can be obtained by inputting the original data into the above-mentioned at least two network layers during the first local training. That is, the preset original data is first input into the decoupled feature extractor to obtain data features, and the data features are input into the first classifier to obtain the first classification result, and then the first classification result is input into the second classifier.

[0060] As an example, the local training data of IoT devices can also change dynamically. During the initial local training, the current local training data can be input into the above-mentioned at least two network layers. In subsequent local training, the existing local training data is first input into the decoupled feature extractor to obtain data features, and the data features are input into the first classifier to obtain the first classification result, and then the first classification result is input into the second classifier.

[0061] Based on the above description, each IoT device uploads the trained model parameters to the server after training its local model using local training data. This ultimately achieves the goal of the server receiving the model parameters uploaded by each IoT device in step 101 above. The following section provides an example of how the server uses these uploaded model parameters to determine the first global model parameters.

[0062] In this embodiment, after receiving the model parameters uploaded by each IoT device, the server can determine the first global model parameters based on the model parameters uploaded by each IoT device.

[0063] As an example, the first global model parameters can be obtained by weighted averaging of the model parameters uploaded by each IoT device.

[0064] As an embodiment, the method for determining the first global model parameter according to the model parameters uploaded by the respective Internet of Things devices can further include: sorting the received model parameters according to the weights, and selecting the model parameter corresponding to the median of the weights as the first global model parameter.

[0065] As an embodiment, the method for determining the first global model parameter according to the model parameters uploaded by the respective Internet of Things devices can further include: sorting the received model parameters according to the weights, and selecting the model parameter corresponding to the median of the weights as the first global model parameter.

[0066] As an embodiment, the weights of the model parameters uploaded by the respective Internet of Things devices can be determined according to the data volume of the local training data of the Internet of Things device, for example, the larger the data volume of the local training data of the Internet of Things device, the higher the weight corresponding to the Internet of Things device, and the smaller the data volume of the local training data of the Internet of Things device, the lower the weight corresponding to the Internet of Things device, and the present application does not limit this.

[0067] Thus far, the description of step 101 is ended, and step 102 is executed.

[0068] Step 102: grouping the respective Internet of Things devices based on the first similarity between the model parameters uploaded by the respective Internet of Things devices and the first global model parameter to obtain a suspected poisoning group and a normal group; and determining a second global model parameter using the model parameters uploaded by the respective Internet of Things devices in the suspected poisoning group.

[0069] In the present embodiment, after the server determines the first global model parameter through step 101, the model parameters uploaded by the respective Internet of Things devices can be preliminarily screened based on the first similarity between the model parameters uploaded by the respective Internet of Things devices and the first global model parameter, and the Internet of Things devices that are likely to be poisoned are determined and classified into an Internet of Things device suspected poisoning group.

[0070] As an implementable manner, if the first similarity is less than a first threshold value, it is determined that the Internet of Things device uploading the model parameter belongs to the Internet of Things device suspected poisoning group.

[0071] If the first similarity is greater than or equal to the first threshold value, it is determined that the Internet of Things device uploading the model parameter belongs to the Internet of Things device normal group.

[0072] In the present embodiment, the proportion of the poisoned Internet of Things devices in all Internet of Things devices is very small, in other words, only a small number of Internet of Things devices are poisoned Internet of Things devices, and the first similarity between the model parameters uploaded by the poisoned Internet of Things devices and the first global model parameter should be relatively low.

[0073] As an embodiment, the first similarity can be a cosine similarity between the model parameters uploaded by each Internet of Things device and the first global model parameters, or a difference between the model parameters uploaded by each Internet of Things device and the first global model parameters, or a ratio between the model parameters uploaded by each Internet of Things device and the first global model parameters, and the application does not make any limitation in this regard.

[0074] As an embodiment, taking the first similarity as a cosine similarity as an example, a first threshold can be specified in advance, and the Internet of Things device corresponding to the model parameters with a cosine similarity less than the first threshold is determined as an Internet of Things device in the Internet of Things device suspected poisoning group. Since the cosine similarity value is in the range of [-1, 1], and the proportion of poisoned Internet of Things devices in all Internet of Things devices is very small, the cosine similarity value of the poisoned Internet of Things devices will be significantly lower than that of the normal Internet of Things devices. For example, the first threshold can be defined as 0, that is, the Internet of Things device corresponding to the model parameters with a cosine similarity less than 0 is determined as an Internet of Things device in the Internet of Things device suspected poisoning group, and the Internet of Things device corresponding to the model parameters with a cosine similarity greater than or equal to 0 is determined as an Internet of Things device in the normal Internet of Things device group.

[0075] After the grouping of each Internet of Things device is completed, the Internet of Things devices included in the Internet of Things device suspected poisoning group are the Internet of Things devices that are preliminarily screened out as possible poisoned Internet of Things devices. However, the poisoned Internet of Things devices determined only through preliminary screening are not accurate, and there can be a case that a normal Internet of Things device is mistakenly divided into the Internet of Things device suspected poisoning group.

[0076] Based on this, the embodiments of the application can further screen the Internet of Things devices in the Internet of Things device suspected poisoning group.

[0077] Firstly, the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group can be used to determine the second global model parameters.

[0078] As an embodiment, the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group can be weighted and averaged to obtain the second global model parameters.

[0079] In this embodiment, the process of determining the second global model parameters by using the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group is similar to the process of determining the first global model parameters according to the model parameters uploaded by each Internet of Things device in step 101, and the only difference is that the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group are aggregated, instead of aggregating the model parameters uploaded by all Internet of Things devices. The specific method has been described in step 101, and will not be described here.

[0080] So far, the description of step 102 ends, and step 103 is performed next.

[0081] In step 103, based on the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group, the first global model parameters, and the second global model parameters, the target Internet of Things device is determined.

[0082] In this embodiment, after the first global model parameters and the second global model parameters are determined through step 102, the truly poisoned Internet of Things device, i.e., the target Internet of Things device, can be further screened out from the Internet of Things devices included in the Internet of Things device suspected poisoning group according to the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group, the first global model parameters, and the second global model parameters.

[0083] As an implementable manner, for each Internet of Things device in the suspected poisoning group, the first similarity between the model parameters uploaded by the Internet of Things device and the first global model parameters is determined, and the second similarity between the model parameters uploaded by the Internet of Things device and the second global model is determined; the first similarity and the second similarity are subjected to specified operation processing to obtain an operation result, and whether the Internet of Things device is the target Internet of Things device is determined according to the operation result.

[0084] In this embodiment, for the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group, the first similarity with the first global model and the second similarity with the second global model are calculated respectively, wherein the first similarity has been calculated in step 102, and the calculation method of the second similarity can be the same as that of the first similarity, such as the first similarity and the second similarity are both cosine similarities. Since the calculation method of the first similarity has been described in step 102, the calculation method of the second similarity will not be described here.

[0085] It should be noted that the truly poisoned Internet of Things device (target Internet of Things device) accounts for a very small proportion in all Internet of Things devices, and even in the Internet of Things device suspected poisoning group, the truly poisoned Internet of Things device also accounts for a small proportion, and most of them are misclassified as Internet of Things devices in the Internet of Things device suspected poisoning group. Taking the first similarity and the second similarity as cosine similarities as an example, the greater the second similarity corresponding to the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group (the closer to 1), the more similar the Internet of Things device is to the second global model parameters, and the more likely the Internet of Things device is a normal Internet of Things device misclassified as the Internet of Things device suspected poisoning group.

[0086] After the first similarity and the second similarity corresponding to the model parameters uploaded by each Internet of Things device in the suspected poisoned group of Internet of Things devices are determined, the first similarity and the second similarity can be subjected to specified operation to obtain an operation result, and whether the Internet of Things device is the target Internet of Things device is determined according to the operation result.

[0087] As an embodiment, the specified operation processing can be normalization processing; if the normalization processing result is a first value, it is determined that the Internet of Things device uploading the model parameters is the target Internet of Things device, and if the normalization processing result is not the first value, it is determined that the Internet of Things device uploading the model parameters is not the target Internet of Things device.

[0088] As an embodiment, the specified operation processing can be normalization processing, subtraction processing, calculation of the absolute value difference of the two, etc., and the present application does not limit this.

[0089] As an embodiment, the specific method of normalization processing can be that the first similarity and the second similarity are subjected to addition operation to obtain the normalization processing result.

[0090] As an embodiment, the specific method of normalization processing can also be that the first similarity and the second similarity are subjected to weighted average, linear combination or nonlinear combination, etc., and the present application does not limit this.

[0091] The determination method of the target Internet of Things device is described below through an embodiment.

[0092] As an embodiment, the first similarity corresponding to the model parameters uploaded by the Internet of Things devices included in the suspected poisoned group of Internet of Things devices is denoted as:

[0093]

[0094] wherein, denotes the first similarity corresponding to the model parameters uploaded by the nth Internet of Things device included in the suspected poisoned group of Internet of Things devices, denotes a set of the first similarities corresponding to the model parameters uploaded by the Internet of Things devices included in the suspected poisoned group of Internet of Things devices, and the first similarity is a cosine similarity.

[0095] The second similarity corresponding to the model parameters uploaded by the Internet of Things devices included in the suspected poisoned group of Internet of Things devices is denoted as:

[0096]

[0097] wherein, denotes the second similarity corresponding to the model parameters uploaded by the nth Internet of Things device included in the suspected poisoned group of Internet of Things devices, a set of second similarities corresponding to the model parameters uploaded by each Internet of Things device included in the Internet of Things device suspected poisoning group, the second similarity being a cosine similarity.

[0098] The corresponding similarity values in the first similarity set and the second similarity set are normalized, and the specific method of normalization is to add the first similarity and the second similarity to obtain a normalization result:

[0099]

[0100] wherein, denotes the operation result after normalization, denotes a set of first similarities corresponding to the model parameters uploaded by each Internet of Things device included in the Internet of Things device suspected poisoning group, denotes a set of second similarities corresponding to the model parameters uploaded by each Internet of Things device included in the Internet of Things device suspected poisoning group.

[0101] In this embodiment, the method of normalization is to add the first similarity and the second similarity corresponding to the same Internet of Things device in the Internet of Things device suspected poisoning group. If the sum of the first similarity and the second similarity is less than a threshold 0, it is determined that the normalization result corresponding to the Internet of Things device is 0 (a first value), and at this time it is determined that the Internet of Things device uploading the model parameters is the target Internet of Things device. If the sum of the first similarity and the second similarity is greater than or equal to the threshold 0, it is determined that the normalization result corresponding to the Internet of Things device is 1 (a second value), and at this time it is determined that the Internet of Things device uploading the model parameters is a normal Internet of Things device.

[0102] At this point, the target Internet of Things device is determined from the Internet of Things devices in the Internet of Things device suspected poisoning group. The description of step 103 ends, and step 104 is executed.

[0103] Step 104, using the model parameters uploaded by the other Internet of Things devices except the target Internet of Things device to determine the model correction parameters, distributing the model correction parameters to each Internet of Things device, and instructing each Internet of Things device to update the local model based on the model correction parameters to obtain a target privacy detection model when the model correction parameters meet the set federated learning end condition; the target privacy detection model is used to detect Internet of Things privacy data; when the model correction parameters do not meet the set federated learning end condition, instructing each Internet of Things device to update the local model based on the model correction parameters and training the updated local model based on the local training data to upload the parameters of the trained model to the server.

[0104] In this embodiment, after the target IoT device is determined through step 103, the model parameters uploaded by the target IoT device can be discarded, and the aggregation of the model parameters uploaded by the IoT devices other than the target IoT device is performed to obtain the model correction parameters.

[0105] It is easy to understand that, after the model parameters uploaded by the target IoT device are discarded, the model correction parameters obtained by aggregating the model parameters uploaded by the other IoT devices avoid the influence of abnormal data in the poisoned IoT device, and improve the detection accuracy of the IoT privacy detection model.

[0106] Further, after obtaining the model correction parameters, the server will distribute the model correction parameters to each IoT device, and instruct each IoT device to end or continue training.

[0107] If the server detects that the model correction parameters have met the federated learning end condition, it will simultaneously distribute a training end instruction to each IoT device, so that each IoT device updates the local model based on the model correction parameters to obtain a target privacy detection model, that is, obtains the final trained model, and ends the training process.

[0108] If the server detects that the model correction parameters do not meet the federated learning end condition, it will simultaneously distribute a training continuation instruction to each IoT device, so that each IoT device updates the local model based on the model correction parameters, and returns to train the updated local model based on the local training data to upload the trained model parameters to the server, that is, performs the next round of training, until the obtained model correction parameters meet the federated learning end condition.

[0109] In this embodiment, the end condition of federated learning can be that a preset accuracy or performance index is reached, the parameter change of the local model is small enough, a set maximum training round number or iteration number is reached, etc., and the present application does not limit this.

[0110] Thus far, the description of the flowchart of the privacy detection method based on similarity alignment federated learning is ended. Figure 1

[0111] The present application performs preliminary screening on the model parameters trained by each IoT device, further determines the target IoT device that is actually poisoned by using the model parameters uploaded by the screened IoT devices that may be poisoned, and continues federated learning on each unpoisoned IoT device other than the target IoT device that is poisoned to train the global model, thereby avoiding the influence of the target IoT device that is poisoned on the training of the global model, and improving the accuracy of the finally trained global model such as the IoT privacy detection model.

[0112] ​Meanwhile, the local data of each Internet of Things device is input into the at least two decoupled network layers of the neural network model to obtain training data with uniform distribution, and the local model is further trained by using the training data, so that the problem of precision reduction caused by data distribution heterogeneity can be reduced.

[0113] The embodiments of the present application will be described below in detail Figure 2 The overall process of federated learning is briefly introduced through one embodiment.

[0114] Please refer to Figure 2 , Figure 2 The overall process of federated learning is briefly introduced through one embodiment.

[0115] As Figure 2 shown, the overall process of federated learning includes:

[0116] In the initialization phase, a privacy leakage detection model is initialized on the server side, denoted as an initial model, and the initial model is sent to each Internet of Things device.

[0117] After receiving the initial model, each Internet of Things device takes the initial model as a local model, and trains the local model according to the local training data of the Internet of Things device to obtain the parameters of the trained model, and uploads the model parameters to the server. The local training data is obtained by sequentially inputting the local raw data into a decoupled feature extractor and a first classifier and a second classifier in a neural network model, the first classifier uses a cross-entropy loss function based on small batch logit adjustment, and the second classifier uses a cross-entropy loss function.

[0118] Further, the server determines the target Internet of Things device that is poisoned according to the model parameters uploaded by each Internet of Things device.

[0119] Specifically, the server, after receiving the model parameters uploaded by each Internet of Things device, performs weighted averaging on the model parameters uploaded by each Internet of Things device to obtain first global model parameters, and determines, for the model parameters uploaded by each Internet of Things device, a first cosine similarity between the model parameters and the first global model parameters.

[0120] According to the relationship between the first cosine similarity and the first threshold, each Internet of Things device is grouped to determine a suspected poisoned group of Internet of Things devices and a normal group of Internet of Things devices.

[0121] According to the model parameters uploaded by each Internet of Things device in the suspected poisoned group of Internet of Things devices, the second global model parameters are obtained by weighted averaging, and for the model parameters uploaded by each Internet of Things device in the suspected poisoned group of Internet of Things devices, the second cosine similarity between the model parameters and the second global model parameters is determined.

[0122] For the model parameters uploaded by each Internet of Things device in the Internet of Things device suspected poisoning group, the first cosine similarity and the second cosine similarity corresponding to the model parameters are normalized to obtain a normalization result, and the Internet of Things device corresponding to the model parameters with the first value of the normalization result is determined as the target Internet of Things device.

[0123] At this point, the process of determining the target Internet of Things device is completed.

[0124] If it is determined that there is a target Internet of Things device, the model parameters uploaded by the target Internet of Things device are removed, and if it is determined that there is no target Internet of Things device, or the model parameters uploaded by the target Internet of Things device have been removed, the server performs weighted averaging on the model parameters uploaded by the Internet of Things devices other than the target Internet of Things device to obtain model correction parameters.

[0125] If it is determined that the model correction parameters meet the federated learning end condition, the server distributes the model correction parameters to each Internet of Things device and instructs each Internet of Things device to update the local model according to the model correction parameters to obtain a target privacy detection model.

[0126] If it is determined that the model correction parameters do not meet the federated learning end condition, the server distributes the model correction parameters to each Internet of Things device and instructs each Internet of Things device to update the local model according to the model correction parameters and return to the step of training the local model by the Internet of Things device according to the training data until the model correction parameters meet the federated learning end condition.

[0127] At this point, the description of the overall flowchart of the federated learning process in the Internet of Things device suspected poisoning group is completed. Figure 2 Please refer to

[0128] , Figure 3 , Figure 3 The privacy detection system based on similarity alignment federated learning provided by the embodiments of the present application is shown in the schematic diagram.

[0129] As shown in Figure 3 , the privacy detection system based on similarity alignment federated learning includes:

[0130] a server for executing the method as shown in Figure 1 ;

[0131] a plurality of Internet of Things devices, wherein any Internet of Things device is configured to train a local model based on local training data to obtain trained model parameters and upload the trained model parameters to the server.

[0132] In this embodiment, the service end manages n Internet of Things devices 1 to n. Any Internet of Things device receives an initial model issued by the service end, takes the initial model as a local model, and performs a step of updating a parameter of a trained model obtained by training the local model based on local training data.

[0133] Any Internet of Things device receives a model correction parameter and a training end instruction issued by the service end, updates the local model based on the model correction parameter to obtain a target privacy detection model;

[0134] Any Internet of Things device receives a model correction parameter and a training end instruction issued by the service end, updates the local model based on the model correction parameter and trains the updated local model based on local training data to upload a parameter of a trained model to the service end.

[0135] Since the roles of the service end and the Internet of Things devices included in the privacy detection system based on similarity alignment federated learning have been described in detail above, they will not be described here.

[0136] Thus, the description of the privacy detection system based on similarity alignment federated learning in Figure 3 will be ended.

[0137] Please refer to Figure 4 , Figure 4 is a schematic structural diagram of an electronic device according to an embodiment of the present application. At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course can also include other hardware required by the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs, and forms a terminal interactive device at the logical level. Of course, in addition to the software implementation, the present application does not exclude other implementation manners, such as logic devices or software and hardware combined manner, etc., that is, the execution subject of the following processing flow is not limited to each logical unit, but can also be hardware or logic device.

[0138] Please refer to Figure 5 , Figure 5 is a schematic structural diagram of a privacy detection device based on similarity alignment federated learning according to an embodiment of the present application, which is applied to a service end. As shown in Figure 5 , the privacy detection device based on similarity alignment federated learning can include a first determination unit 501, a grouping unit 502, a second determination unit 503, and a correction unit 504. Specifically, the device includes:

[0139] The first determining unit 501 is configured to determine a first global model parameter according to the model parameters uploaded by the received each Internet of Things device; the model parameter uploaded by any Internet of Things device is a parameter of a trained model obtained by training a local model based on local training data of the Internet of Things device, and the local training data of any Internet of Things device is obtained through at least two network layers; the at least two network layers are decoupled network layers in a neural network model;

[0140] The grouping unit 502 is configured to group each Internet of Things device based on a first similarity between the model parameter uploaded by each Internet of Things device and the first global model parameter to obtain a suspected poisoning group and a normal group; and determine a second global model parameter by using the model parameters uploaded by each Internet of Things device in the suspected poisoning group;

[0141] The second determining unit 503 is configured to determine a target Internet of Things device based on the model parameters uploaded by each Internet of Things device in the suspected poisoning group of the Internet of Things devices, the first global model parameter and the second global model parameter; the target Internet of Things device is a poisoned Internet of Things device;

[0142] The correction unit 504 is configured to determine a model correction parameter by using the model parameters uploaded by the other Internet of Things devices except the target Internet of Things device, distribute the model correction parameter to each Internet of Things device, and instruct each Internet of Things device to update the local model based on the model correction parameter to obtain a target privacy detection model when the model correction parameter meets a set federated learning end condition; the target privacy detection model is used to detect Internet of Things privacy data; and instruct each Internet of Things device to update the local model based on the model correction parameter and train the updated local model based on the local training data to upload the parameter of the trained model to the server when the model correction parameter does not meet the set federated learning end condition.

[0143] Optionally, the first determining unit 501 is specifically configured to:

[0144] The model parameters uploaded by each Internet of Things device are weighted and averaged to obtain the first global model parameter;

[0145] The grouping unit 502 is specifically configured to:

[0146] The model parameters uploaded by each Internet of Things device in the suspected poisoning group of the Internet of Things devices are weighted and averaged to obtain the second global model parameter.

[0147] Optionally, the grouping unit 502 is specifically configured to:

[0148] If the first similarity is less than a first threshold value, it is determined that the Internet of Things device uploading the model parameter belongs to the suspected poisoning group of the Internet of Things devices;

[0149] If the first similarity is greater than or equal to the first threshold, it is determined that the Internet of Things device uploading the model parameter belongs to the normal group of Internet of Things devices.

[0150] Optionally, the second determination unit 503 is specifically configured to:

[0151] For each Internet of Things device in the suspected poisoning group, a first similarity between the model parameter uploaded by the Internet of Things device and the first global model parameter is determined, and a second similarity between the model parameter uploaded by the Internet of Things device and the second global privacy model is determined; the first similarity and the second similarity are subjected to specified operation processing to obtain an operation result, and it is determined whether the Internet of Things device is a target Internet of Things device according to the operation result.

[0152] Optionally, the second determination unit 503 is specifically configured to normalize the first similarity and the second similarity.

[0153] According to the operation result, it is determined whether the Internet of Things device is a target Internet of Things device, including: if the normalized processing result is a first value, it is determined that the Internet of Things device uploading the model parameter is a target Internet of Things device, and if the normalized processing result is not the first value, it is determined that the Internet of Things device uploading the model parameter is not a target Internet of Things device.

[0154] Optionally, the second determination unit 503 is specifically configured to:

[0155] The first similarity and the second similarity are subjected to addition operation to obtain the normalized processing result.

[0156] Optionally, the at least two network layers include:

[0157] The decoupled feature extractor and the first classifier and the second classifier in the neural network model;

[0158] The first classifier and the second classifier are configured with different loss functions;

[0159] The local training data is obtained by the following steps:

[0160] The preset original data is first input to the decoupled feature extractor to obtain data features, and the data features are input to the first classifier to obtain a first classification result, and then the first classification result is input to the second classifier to obtain; or,

[0161] The existing local training data is first input to the decoupled feature extractor to obtain data features, and the data features are input to the first classifier to obtain a first classification result, and then the first classification result is input to the second classifier to obtain.

[0162] Optionally, the first classifier is configured with a loss function that is a cross-entropy loss function adjusted for small batch logits, and the second classifier is configured with a loss function that is a cross-entropy loss function.

[0163] So far, the description of the privacy detection device based on similarity alignment federated learning in the embodiment is completed. Figure 5 So far, the description of the privacy detection device based on similarity alignment federated learning in the embodiment is completed.

[0164] Correspondingly, in the embodiment, the application further provides a computer readable storage medium, and the computer readable storage medium stores a plurality of computer instructions. When the computer instructions are executed, the method disclosed in the above examples of the application can be implemented.

[0165] For example, the computer readable storage medium can be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard disk drive), a solid state disk, any type of storage disk (such as an optical disk, a DVD, etc.), or similar storage medium, or a combination thereof.

[0166] The above is only a preferred embodiment of the application, and is not intended to limit the application. The application can have various changes and modifications for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A privacy detection method based on similarity alignment federated learning, characterized in that, The method is applied to a server side, and the method comprises: determining a first global model parameter according to received model parameters uploaded by each Internet of Things device; the model parameter uploaded by any Internet of Things device is a parameter of a trained model obtained by training a local model based on local training data by the Internet of Things device, and the local training data of any Internet of Things device is obtained through at least two network layers, which are decoupled network layers in a neural network model; grouping each Internet of Things device based on a first similarity between the model parameter uploaded by each Internet of Things device and the first global model parameter to obtain a suspected poisoning group and a normal group; determining a second global model parameter using the model parameter uploaded by each Internet of Things device in the suspected poisoning group; determining a target Internet of Things device based on the model parameter uploaded by each Internet of Things device in the suspected poisoning group, the first global model parameter and the second global model parameter; the target Internet of Things device is a poisoned Internet of Things device; determining a model correction parameter using the model parameter uploaded by each Internet of Things device except the target Internet of Things device, issuing the model correction parameter to each Internet of Things device, and instructing each Internet of Things device to update a local model based on the model correction parameter to obtain a target privacy detection model when the model correction parameter meets a set federated learning end condition; the target privacy detection model is used to detect Internet of Things privacy data; when the model correction parameter does not meet the set federated learning end condition, instructing each Internet of Things device to update the local model based on the model correction parameter and train the updated local model based on local training data to upload the parameter of the trained model to the server side.

2. The method of claim 1, wherein, The method comprises: weighting and averaging the model parameters uploaded by each Internet of Things device to obtain the first global model parameter; The method comprises: weighting and averaging the model parameters uploaded by each Internet of Things device in the suspected poisoning group to obtain the second global model parameter.

3. The method of claim 1, wherein, The method comprises: if the first similarity is less than a first threshold value, determining that the Internet of Things device uploading the model parameter belongs to the suspected poisoning group of Internet of Things devices; if the first similarity is greater than or equal to the first threshold value, determining that the Internet of Things device uploading the model parameter belongs to the normal group of Internet of Things devices.

4. The method of claim 1, wherein, The method comprises: For each Internet of Things device in the suspected poisoning group, a first similarity between model parameters uploaded by the Internet of Things device and the first global model parameters is determined, and a second similarity between the model parameters uploaded by the Internet of Things device and the second global privacy model is determined; a specified operation is performed on the first similarity and the second similarity to obtain an operation result, and whether the Internet of Things device is a target Internet of Things device is determined according to the operation result.

5. The method of claim 4, wherein, The specified operation on the first similarity and the second similarity includes normalizing the first similarity and the second similarity. Determining whether the Internet of Things device is a target Internet of Things device according to the operation result includes: if the normalization result is a first value, determining that the Internet of Things device uploading the model parameters is a target Internet of Things device, and if the normalization result is not the first value, determining that the Internet of Things device uploading the model parameters is not a target Internet of Things device.

6. The method of claim 5, wherein, The normalization of the first similarity and the second similarity includes: The first similarity and the second similarity are added to obtain a normalization result.

7. The method of claim 1, wherein, The at least two network layers include: The decoupled feature extractor and the first classifier and the second classifier in the neural network model; The first classifier and the second classifier are configured with different loss functions. The local training data is obtained by the following steps: The preset original data is first input into the decoupled feature extractor to obtain data features, and the data features are input into the first classifier to obtain a first classification result, and then the first classification result is input into the second classifier to obtain; or The existing local training data is first input into the decoupled feature extractor to obtain data features, and the data features are input into the first classifier to obtain a first classification result, and then the first classification result is input into the second classifier to obtain.

8. The method of claim 7, wherein, The loss function configured for the first classifier is a cross-entropy loss function based on small batch logit adjustment, and the loss function configured for the second classifier is a cross-entropy loss function.

9. A privacy detection system based on similarity alignment federated learning, characterized in that, The system includes: A server for executing the method of any one of claims 1 to 8; A plurality of Internet of Things devices, wherein any Internet of Things device is configured to upload parameters of a trained model obtained by training a local model based on local training data to the server.

10. The system of claim 9, wherein, Any Internet of Things device is configured to, in the case of receiving an initial model issued by the server, take the initial model as the local model and perform the step of uploading parameters of a trained model obtained by training a local model based on local training data; Any Internet of Things device is configured to, in the case of receiving model correction parameters and a training end instruction issued by the server, update the local model based on the model correction parameters to obtain a target privacy detection model; Any Internet of Things device is configured to, in the case of receiving model correction parameters and a training continuation instruction issued by the server, update the local model based on the model correction parameters and train the updated local model based on local training data to upload parameters of a trained model to the server.

Images