A method and system for protecting privacy in federated learning

Abstract

The present invention discloses a method and system for protecting privacy in federated learning. In each federated learning process, the present invention encrypts the model parameters uploaded by each client, so that in the federated learning process, the model parameters uploaded by each client are unknown, thereby avoiding the problem that the gradient transmitted in the federated learning scenario may lead to the leakage of privacy information; at the same time, when the server aggregates the local model parameters, interference data is introduced, and differential privacy aggregation processing of the local model parameters is performed based on the interference data; based on this, while realizing global model parameter aggregation, the real data of each client can be concealed, making the real data invisible, thereby achieving the purpose of preventing differential privacy attacks; therefore, the present invention can prevent the data leakage of participants in the federated learning process, and improve the security of the data of each participant in the federated learning process.

Description

Technical Field

[0001] The present invention belongs to the technical field of data privacy protection, and specifically relates to a federated learning privacy protection method and system. Background Art

[0002] Federated Learning (FL), as a distributed deep learning method, can balance efficiency, accuracy and privacy to a certain extent, and thus has received widespread attention. The main process of federated learning is: the server randomly assigns values ​​to the global model parameters for initialization, and distributes the model to each user. Each user trains the model locally with their own data, and then sends the updated model parameters back to the server. The server updates the global model accordingly and distributes it to the user again, and then performs a new round of iterative updates. In this way, in this process, since the server only collects the parameters of the user model instead of the original data, it is more conducive to data privacy protection.

[0003] In actual application, although federated learning allows clients to jointly train models by only sharing gradients instead of directly providing training data to the server, which plays a certain role in protecting data, studies have shown that the gradients (i.e., model parameters) transmitted in federated learning scenarios will still lead to privacy information leakage; at the same time, when training global models, federated learning is vulnerable to differential attacks caused by malicious clients, which will leak the privacy information of members participating in the training, and thus create serious security risks; therefore, although the existing federated learning has avoided the problem of privacy leakage to a certain extent, data security still exists; based on this, how to provide a data privacy protection method that can prevent data leakage of participants in the federated learning process has become an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for protecting privacy in federated learning, so as to solve the problem of data privacy leakage that still exists in the existing federated learning process.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] In a first aspect, a method for protecting privacy in federated learning is provided, which is applied to a trusted platform, a server, and several clients, wherein a target model is deployed on the server and each client, and the method includes:

[0007] The trusted platform generates an information key pair, and sends the information private key in the information key pair to the server, and sends the information public key in the information key pair to each client;

[0008] The server sends initial global model parameters to each client;

[0009] Each client uses the local training data set and the received initial global model parameters to train the local target model, so as to obtain the corresponding local model parameters after the training is completed;

[0010] Each client uses the received information public key to encrypt the corresponding local model parameters to obtain encrypted model parameters, and sends the encrypted model parameters to the server;

[0011] The server uses the information private key to decrypt the received encrypted model parameters to obtain a number of decrypted model parameters;

[0012] The server generates interference data using the plurality of decryption model parameters, and uses the interference data to perform differential privacy aggregation processing on the plurality of decryption model parameters, so as to obtain privacy global model parameters after differential privacy aggregation processing;

[0013] The server determines whether the privacy global model parameters are global optimal model parameters;

[0014] If not, the privacy global model parameters are used as the initial global model parameters and resent to each client until the generated privacy global model parameters are the global optimal model parameters, and the global optimal model parameters are sent to each client to complete the privacy protection of each client and server in the federated learning process after sending.

[0015] Based on the above disclosed content, the present invention introduces a trusted platform in the federated learning process, which is used to generate an information key pair, and send the information public key in the information key pair to each client, and send the information private key to the server; in this way, each client can use the information public key generated by the trusted platform to encrypt the uploaded gradient information during the federated learning process, thereby ensuring that the uploaded information is invisible, that is: each client uses the local training data set and the received initial global model parameters to train the local target model, and after obtaining the local model parameters, the local model parameters can be encrypted using the information public key to obtain the encrypted model parameters; then, each client sends the corresponding encrypted model parameters to the server, so that the server can use The received encrypted model parameters are decrypted using the private key of the information to obtain several decrypted model parameters. At the same time, in order to prevent differential attacks from malicious clients, the present invention also generates interference data, and based on the interference data, performs differential privacy aggregation processing on several decrypted model parameters. Based on this, while realizing global model parameter aggregation, the real data of each client can be concealed, making the real data invisible, thereby achieving the purpose of preventing differential privacy attacks. Finally, the server sends the privacy global model parameters obtained by differential privacy aggregation to each client, so that each client can use the privacy global model parameters to train the local model again. In this way, the aforementioned process is repeated until the privacy global model is optimal, and the federated learning process can be terminated.

[0016] Through the above design, the present invention encrypts the model parameters uploaded by each client in each federated learning process. In this way, the model parameters uploaded by each client are unknown in the federated learning process, thereby avoiding the problem that the gradient transmitted in the federated learning scenario will lead to the leakage of privacy information; at the same time, when the server aggregates the local model parameters, interference data is introduced, and based on the interference data, the differential privacy aggregation of the local model parameters is performed to obtain the privacy global model parameters; based on this, while realizing the global model parameter aggregation, the real data of each client can be concealed, making the real data invisible, thereby achieving the purpose of preventing differential privacy attacks; therefore, the present invention can prevent the data leakage of participants in the federated learning process, protect the data privacy security of participants, and improve the security of the data of each participant in the federated learning process; therefore, it is very suitable for large-scale application and promotion in the federated learning process.

[0017] In one possible design, the trusted platform generates a message key pair, including:

[0018] Obtaining a first key parameter and a second key parameter, and generating a first public key and a first private key according to the first key parameter and the second key parameter;

[0019] Generate a public key random number, and determine a second public key using the public key random number and the first public key;

[0020] Generate a second private key based on the first public key and the first private key;

[0021] The information public key is composed of the first public key and the second public key, and the information private key is composed of the first private key and the second private key, so as to generate the information key pair based on the information public key and the information private key.

[0022] In one possible design, the first key parameter and the second key parameter satisfy , where represents the first key parameter and the second key parameter in sequence, and Solve the function for the greatest common divisor;

[0023] Wherein, using the public key random number and the first public key to determine the second public key includes:

[0024] The second public key is generated using the following formula (1);

[0025] (1)

[0026] In the above formula (1), represents the second public key, represents the public key random number, represents the first public key, represents the modulo operation, where , represents a target positive integer set, which is based on and obtained, and Representation model The set of positive integers under Indicates less than or equal to , and with The set of mutually prime positive integers;

[0027] Correspondingly, generating a second private key based on the first public key and the first private key includes:

[0028] The second private key is generated using the following formula (2);

[0029] (2)

[0030] In the above formula (2), represents the second private key, Represents the first private key.

[0031] In a possible design, the information public key includes a first public key and a second public key, wherein each client uses the received information public key to encrypt the corresponding local model parameter to obtain the encrypted model parameter, including:

[0032] For any client, based on the first public key and the second public key, and using the following formula (3), encrypt the corresponding local model parameters to obtain encrypted model parameters;

[0033] (3)

[0034] In the above formula (3), represents the encryption model parameters corresponding to any of the clients, represents the first public key, represents the second public key, represents the encryption control factor, Indicates the local model parameters corresponding to any of the clients.

[0035] In one possible design, the server generates interference data using several decryption model parameters, including:

[0036] Generate a first disturbance factor according to the plurality of decryption model parameters;

[0037] Determining a second disturbance factor based on the plurality of decryption model parameters and the first disturbance factor;

[0038] Calculating a noise scale according to the second disturbance factor;

[0039] Determining a noise variance using the noise scale and the first disturbance factor;

[0040] According to the noise variance, noise data whose probability density function obeys normal distribution is generated, so as to use the noise data as the interference data.

[0041] In a possible design, any decryption model parameter is in vector form, and each element in the vector corresponds to a model parameter, wherein the first perturbation factor is generated according to the decryption model parameters, including:

[0042] Obtaining target parameters of the target model deployed on the server, wherein the target parameters are privacy global model parameters of the target model deployed on the server in the last federated learning process;

[0043] Calculating the difference vectors between each decryption model parameter and the target parameter, and obtaining the L2 norm of each difference vector to obtain a number of L2 norm values;

[0044] Arrange a number of L2 norm values ​​in ascending order to obtain a sorted sequence, and use the median of the sorted sequence as the first disturbance factor.

[0045] In one possible design, determining a second disturbance factor based on the plurality of decryption model parameters and the first disturbance factor includes:

[0046] Selecting any decryption model parameter from the plurality of decryption model parameters as a designated parameter;

[0047] According to the specified parameter, the target parameter and the first disturbance factor, and in accordance with the following formula (4), the second disturbance factor is calculated;

[0048] (4)

[0049] In the above formula (4), represents the second perturbation factor, represents the first perturbation factor, represents the specified parameter, represents the target parameter, represents the L2 norm;

[0050] Correspondingly, calculating the noise scale according to the second disturbance factor includes:

[0051] Obtain a scale control factor, wherein the value interval of the scale control factor is (0,1);

[0052] The ratio of the second disturbance factor to the scale control factor is used as the noise scale.

[0053] In a possible design, any decryption model parameter is in vector form, and each element in the vector corresponds to a model parameter, wherein the server uses the interference data to perform differential privacy aggregation processing on the decryption model parameters to obtain a privacy global model parameter after differential privacy aggregation processing, including:

[0054] Obtaining target parameters of the target model deployed on the server, wherein the target parameters are privacy global model parameters of the target model deployed on the server in the last federated learning process;

[0055] Calculating the difference vector between each decryption model parameter and the target parameter;

[0056] The privacy global model parameters are generated according to the interference data, the target parameters, the first disturbance factor and each difference vector.

[0057] In a possible design, generating the privacy global model parameters according to the interference data, the target parameter, the first disturbance factor, and each difference vector includes:

[0058] According to the following formula (5), the privacy global model parameters are generated;

[0059] (5)

[0060] In the above formula (5), represents the privacy global model parameters, represents the target parameter, represents the interference data, represents the first perturbation factor, Indicates the first difference vector, represents the total number of difference vectors, and represents the L2 norm.

[0061] In the second aspect, a federated learning privacy protection system is provided, including: a trusted platform, a server, and several clients, and a target model is deployed on the server and each client:

[0062] A trusted platform, used to generate an information key pair, and send the information private key in the information key pair to the server, and send the information public key in the information key pair to each client;

[0063] The server is used to send initial global model parameters to each client;

[0064] Each client is used to train a local target model using a local training data set and the received initial global model parameters, so as to obtain corresponding local model parameters after the training is completed;

[0065] Each client is further used to encrypt the corresponding local model parameters using the received information public key to obtain the encrypted model parameters, and send the encrypted model parameters to the server;

[0066] The server is used to decrypt each received encrypted model parameter using the information private key to obtain a number of decrypted model parameters;

[0067] The server is used to generate interference data using a number of decryption model parameters, and use the interference data to perform differential privacy aggregation processing on the number of decryption model parameters, so as to obtain privacy global model parameters after differential privacy aggregation processing;

[0068] A server, configured to determine whether the privacy global model parameters are global optimal model parameters;

[0069] If not, the server is used to use the privacy global model parameters as the initial global model parameters and resend them to each client until the generated privacy global model parameters are the global optimal model parameters, and send the global optimal model parameters to each client to complete the privacy protection of each client and server in the federated learning process after sending.

[0070] In the third aspect, a federated learning privacy protection device is provided. Taking the device as an electronic device as an example, the device includes a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the federated learning privacy protection method as described in the first aspect or any possible design of the first aspect.

[0071] In a fourth aspect, a storage medium is provided, on which instructions are stored. When the instructions are executed on a computer, the federated learning privacy protection method as described in the first aspect or any possible design of the first aspect is executed.

[0072] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, causes the computer to execute the federated learning privacy protection method as described in the first aspect or any possible design of the first aspect.

[0073] Beneficial effects:

[0074] (1) In each federated learning process, the present invention encrypts the model parameters uploaded by each client. In this way, the model parameters uploaded by each client are unknown during the federated learning process, thereby avoiding the problem that the gradient transmitted in the federated learning scenario may lead to the leakage of privacy information. At the same time, when the server aggregates the local model parameters, interference data is introduced, and based on the interference data, the local model parameters are differentially privately aggregated to obtain the private global model parameters. Based on this, while realizing the global model parameter aggregation, the real data of each client can be concealed, making the real data invisible, thereby achieving the purpose of preventing differential privacy attacks. Therefore, the present invention can prevent the data leakage of participants in the federated learning process, protect the data privacy security of participants, and improve the security of the data of each participant in the federated learning process. Therefore, it is very suitable for large-scale application and promotion in the federated learning process. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1A schematic diagram of the steps of the federated learning privacy protection method provided in an embodiment of the present invention;

[0076] Figure 2 A schematic diagram of the structure of a federated learning privacy protection system provided by an embodiment of the present invention;

[0077] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0078] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0079] It should be understood that although the terms first, second, etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another unit. For example, a first unit can be referred to as a second unit, and similarly, a second unit can be referred to as a first unit without departing from the scope of the exemplary embodiments of the present invention.

[0080] It should be understood that the term "and / or" that may appear in this article is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" that may appear in this article describes another type of association object relationship, indicating that two relationships may exist. For example, A / and B can represent two situations: A exists alone, and A and B exist alone. In addition, the character " / " that may appear in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0081] Example:

[0082] See also Figure 2As shown, a system architecture is provided for the federated learning privacy protection method provided by the present application, and the system may include but is not limited to: a trusted platform, a server and several clients; wherein the server and each client are deployed with a target model (i.e., a neural network model to be trained, the type of which can be specifically set according to actual use), and the trusted platform is used to generate an information key pair used for data encryption in the federated learning process, and send the information public key in the information key pair to each client, and send the information private key to the server; in this way, each client can use the information public key after each federated learning to encrypt the local model parameters obtained by training, and then upload the encrypted local model parameters to the server, thereby ensuring that the uploaded information is invisible; then, the server The private key can be used to decrypt the encrypted local model parameters received, so as to facilitate the subsequent update of the global model parameters. At the same time, in order to prevent differential attacks from malicious clients, the server adopts differential privacy aggregation processing to aggregate the decrypted model parameters to obtain the private global model parameters. Based on this, the server adopts this method to aggregate parameters, which can ensure the invisibility of the real data of each client while updating the global model parameters, thereby preventing differential privacy attacks. Finally, the server sends the aforementioned private global model parameters to each client, and each client can perform local model training again based on this. Thus, the aforementioned process is continuously repeated until the private global model parameters reach the optimal level, and the federated learning process can be terminated.

[0083] Therefore, through the above-mentioned design, this system encrypts the model parameters uploaded by each client in each federated learning process. In this way, the model parameters uploaded by each client are unknown during the federated learning process, thereby avoiding the problem of privacy information leakage caused by the gradient transmitted in the federated learning scenario; at the same time, the differential privacy aggregation processing method is adopted on the server side to aggregate the decrypted model parameters; based on this, while realizing global model parameter aggregation, the real data of each client can be concealed, making the real data invisible, thereby achieving the purpose of preventing differential privacy attacks; therefore, this system can prevent data leakage of participants in the federated learning process, protect the data privacy security of participants, and improve the security of data of each participant in the federated learning process.

[0084] See also Figure 1 As shown, the federated learning privacy protection method provided in this embodiment can be, but is not limited to, run on a trusted platform, a server, and each client side. It can be understood that the aforementioned execution entity does not constitute a limitation on the embodiments of the present application. Accordingly, the operation steps of this method can be, but are not limited to, as shown in the following steps S1 to S8.

[0085] S1. The trusted platform generates an information key pair, and sends the information private key in the information key pair to the server, and sends the information public key in the information key pair to each client. In this embodiment, the trusted platform, as an independent and trusted organization, is responsible for distributing and managing the information public key and information private key used in the federated learning process, so that subsequent servers and each client can complete the data privacy protection in the federated learning process based on the aforementioned information public key and private key.

[0086] Optionally, for example, the trusted platform may, but is not limited to, use the following steps S11 to S14 to generate the aforementioned information key pair.

[0087] S11. Obtain a first key parameter and a second key parameter, and generate a first public key and a first private key according to the first key parameter and the second key parameter; in a specific implementation, the first key parameter and the second key parameter are prime numbers and meet the following conditions: , where represents the first key parameter and the second key parameter in sequence, and is a function for solving the greatest common divisor; thus, after generating the first key parameter and the second key parameter that satisfy the aforementioned conditions, the first public key and the first private key can be generated based on this.

[0088] In a specific implementation, for example, but not limited to, the product of the first key parameter and the second key parameter is used as the first public key; and the first private key can be calculated using the following formula:

[0089] (6)

[0090] In the above formula (6), represents the first private key, and It represents the lowest common divisor solving function.

[0091] In this way, after calculating the first public key and the first private key based on the above method, the first public key can be used to generate the second public key, and the second private key can be generated based on the first private key; wherein, the generation process of the second public key can be but is not limited to as shown in the following step S12.

[0092] S12. Generate a public key random number, and use the public key random number and the first public key to determine a second public key; in specific applications, the following formula (1) may be used, for example but not limited to, to generate the second public key.

[0093] (1)

[0094] In the above formula (1), represents the second public key, represents the public key random number, represents the first public key, represents the modulo operation, where , represents a target positive integer set, which is based on and obtained, and Representation model The set of positive integers (i.e. 0- ), a positive integer between Indicates less than or equal to , and with The set of mutually prime positive integers; in this case, the relationship between the above three sets is: .

[0095] Therefore, after the second public key is calculated based on the above formula (1), the second private key can be calculated using the first public key and the first private key. The calculation process can be but is not limited to the following step S13.

[0096] S13. Generate a second private key based on the first public key and the first private key. In this embodiment, the second private key may be generated by, for example but not limited to, using the following formula (2).

[0097] (2)

[0098] In the above formula (2), represents the second private key, Represents the first private key.

[0099] Based on this, after the second private key is calculated using the aforementioned formula (2), it can be combined with the aforementioned first private key, the first public key and the second public key to generate an information public key and an information private key, so that an information key pair can be formed based on this later; wherein, the combination process of the aforementioned public key and private key can be but is not limited to as shown in the following step S14.

[0100] S14. Using the first public key and the second public key to form the information public key, and using the first private key and the second private key to form the information private key, so as to generate the information key pair based on the information public key and the information private key; in this embodiment, the information public key is , and the private key of the message is ; In this way, using the information private key and public key, an information key pair can be formed.

[0101] Therefore, through the aforementioned steps S11 to S14, the trusted platform can generate an information key pair, and then send the aforementioned information public key to each client, and send the information private key to the server, so as to encrypt data in the subsequent federated learning process; at the same time, in this embodiment, the trusted platform will also send the first public key to the server, so that the subsequent server can decrypt the data in combination with the information private key; of course, the encryption and decryption process is described in detail below.

[0102] After completing the data preparation before the federated learning process, the server can generate initial global model parameters to send to each client so that each client can start federated learning based on this; wherein, the process of sending the initial global model parameters can be but is not limited to as shown in the following step S2.

[0103] S2. The server sends initial global model parameters to each client. In specific implementation, the server will randomly assign model parameters of the corresponding target model to obtain initial global model parameters. Then, the server will send the initial global model parameters to each client so that each client can train the local target model based on the initial global model parameters and local data. The local model training process in the federated learning process is shown in the following step S3.

[0104] S3. Each client uses the local training data set and the received initial global model parameters to train the local target model, so as to obtain the corresponding local model parameters after the training. In this embodiment, each client uses the initial global model parameters as the model parameters of the corresponding local target model, and then uses the local training data set to train the corresponding target model, so as to obtain the local model parameters after the training. For example, each client can use but is not limited to the stochastic gradient descent algorithm to train the local model.

[0105] After each client completes a local training and obtains the corresponding local model parameters, it can use the public key issued by the trusted platform to encrypt the corresponding local model parameters to ensure the invisibility of the uploaded data, thereby avoiding the problem of data leakage due to gradient information; wherein, the encryption process of the local model parameters can be but is not limited to as shown in the following step S4.

[0106] S4. Each client uses the received information public key to encrypt the corresponding local model parameters to obtain encrypted model parameters, and sends the encrypted model parameters to the server. In specific applications, since the encryption process of the local model parameters of each client is the same, the encryption operation is described below using any client as an example. For any client, the example may be, but is not limited to, based on the first public key and the second public key, and using the following formula (3) to encrypt the corresponding local model parameters to obtain encrypted model parameters.

[0107] (3)

[0108] In the above formula (3), represents the encryption model parameters corresponding to any of the clients, represents the first public key, represents the second public key, represents the encryption control factor, Represents the local model parameters corresponding to any of the clients; in the present embodiment, the encryption model parameters corresponding to any of the clients are set in vector form, that is, each element in the vector represents a model parameter. Therefore, when encrypting, it is equivalent to encrypting each element in the vector, and the encryption control factor can be, but is not limited to, set to 1.

[0109] In this way, each client can complete the encryption processing of its own local model parameters based on the above formula (3); and after the encryption is completed, the obtained encrypted model parameters can be sent to the server, so that the server can update the global model parameters based on this, thereby facilitating the next federated learning; wherein, the server's global model update is mainly divided into two steps, the first step is the decryption of the encrypted model parameters; the second step is the aggregation of the decrypted model parameters; optionally, the decryption process of the encrypted model parameters can be but is not limited to the following step S5.

[0110] S5. The server uses the information private key to decrypt the received encryption model parameters to obtain a number of decrypted model parameters. In this embodiment, any encryption model parameter is taken as an example to illustrate the decryption operation. For any encryption model parameter, the server may, but is not limited to, use the following formula (7) to perform decryption.

[0111] (7)

[0112] In the above formula (7), represents the decryption model parameters corresponding to any of the clients (i.e., the corresponding local model parameters). The remaining parameters have been explained in the above formulas and will not be elaborated here. Of course, the encryption model parameters are also in vector form. When decrypting, the elements in the vector are used as units. The decryption formula is the above formula (7), and the process will not be elaborated here.

[0113] In this way, based on the above formula (7), the server can complete the decryption processing of each encrypted model parameter, thereby obtaining a number of decrypted model parameters; then, the decrypted model parameters can be aggregated to complete the update of the global model parameters of the target model on the server; wherein, in specific applications, in order to prevent differential privacy attacks from malicious clients, this embodiment introduces a differential privacy aggregation method to achieve the update of global model parameters, and the process can be but is not limited to the following step S6.

[0114] S6. The server uses several decryption model parameters to generate interference data, and uses the interference data to perform differential privacy aggregation processing on several decryption model parameters, so as to obtain privacy global model parameters after differential privacy aggregation processing; in specific applications, this embodiment is equivalent to first generating a noise (that is, the aforementioned interference data); then, when aggregating several decryption model parameters, the noise is introduced, so as to achieve the purpose of differential privacy protection during aggregation.

[0115] Optionally, it has been explained above that the encryption model parameters are in vector form, therefore, any decryption model parameter is also in vector form, and each element in the vector corresponds to a model parameter; based on this, the example server can, but is not limited to, use the following steps S61 to S65 to generate the aforementioned interference data.

[0116] S61. Generate a first perturbation factor according to the decryption model parameters. In specific implementation, the target parameters of the target model deployed on the server may be obtained first, but are not limited to. In this embodiment, the target parameters are the privacy global model parameters of the target model deployed on the server in the last federated learning process (of course, the privacy global model parameters in the first federated learning process are the initial global model parameters). Thus, after obtaining the privacy global model parameters in the last federated learning process, the difference vectors between each decryption model parameter and the target parameter may be calculated, and the L2 norm of each difference vector may be obtained to obtain a number of L2 norm values ​​(the L2 norm of a vector is the square root of the sum of the squares of the vector elements). Then, the L2 norm values ​​are arranged in ascending order to obtain a sorted sequence. Finally, the median of the sorted sequence may be used as the first perturbation factor.

[0117] In this way, after the first disturbance factor is generated based on the aforementioned step S61, the second disturbance factor can be determined based on the first disturbance factor, so as to subsequently generate interference data based on it; wherein, the determination process of the second disturbance factor can be but is not limited to as shown in the following step S62.

[0118] S62. Based on the several decryption model parameters and the first disturbance factor, a second disturbance factor is determined; in a specific implementation, for example but not limited to, a decryption model parameter is first arbitrarily selected from the several decryption model parameters as a designated parameter; then, the second disturbance factor is calculated according to the designated parameter, the target parameter and the first disturbance factor.

[0119] The second disturbance factor may be calculated by, for example but not limited to, using the following formula (4).

[0120] (4)

[0121] In the above formula (4), represents the second perturbation factor, represents the first perturbation factor, represents the specified parameter, represents the target parameter, represents the L2 norm.

[0122] In this way, after the server determines the second disturbance factor based on the above formula (4), it can determine the noise scale based on the second disturbance factor, so as to subsequently calculate the noise variance based on the noise scale; wherein the calculation process of the noise scale can be but is not limited to the following step S63.

[0123] S63. Calculate the noise scale based on the second disturbance factor. In specific implementation, for example, but not limited to, first obtain the scale control factor. Then, take the ratio between the second disturbance factor and the scale control factor as the noise scale. In this embodiment, the scale control factor is taken as (0, 1) as an example. The specific value can be taken within the range according to actual use, and no specific limitation is made here.

[0124] After the noise scale is determined, the noise variance can be calculated based on it, so as to subsequently generate interference data based on the noise variance; wherein, the calculation process of the noise equation can be but is not limited to as shown in the following step S64.

[0125] S64. Determine the noise variance using the noise scale and the first disturbance factor. In specific applications, for example, but not limited to, first calculate the square of the noise scale and the square of the first disturbance factor, and then take the product of the two as the noise variance. Thus, after obtaining the noise variance, noise data can be generated based on this, so that the generated noise data can be used as the aforementioned interference data. The interference data generation process can be, but not limited to, as shown in the following step S65.

[0126] S65. According to the noise variance, generate noise data whose probability density function obeys normal distribution, so as to use the noise data as the interference data; in this embodiment, it is equivalent to generate a variance of Gaussian noise data ( represents the noise scale), thus taking the Gaussian noise data as interference data.

[0127] Therefore, through the aforementioned steps S61 to S65, interference data can be generated, and then, based on the interference data, differential privacy aggregation processing of the aforementioned several decryption model data can be performed; among which, for example, but not limited to, the following steps S66 to S68 can be used to complete the aforementioned differential privacy aggregation processing and obtain the privacy global model parameters.

[0128] S66. Obtain target parameters of the target model deployed on the server, wherein the target parameters are privacy global model parameters of the target model deployed on the server in the last federated learning process; in this embodiment, the process of obtaining the target parameters has been explained in the aforementioned step S61 and will not be repeated here.

[0129] After obtaining the target parameters, it is still necessary to calculate the difference vectors between each decryption model parameter and the target parameter, so as to subsequently perform privacy aggregation processing of several decryption model parameters based on each difference vector, wherein the calculation process of the difference vector can be but is not limited to as shown in the following step S67.

[0130] S67. Calculate the difference vector between each decryption model parameter and the target parameter; after completing the difference calculation between each decryption model parameter and the target parameter and obtaining a number of difference vectors, the aforementioned interference data and the first disturbance factor can be combined to perform differential privacy aggregation processing of each decryption model parameter, and the processing process is shown in the following step S68.

[0131] S68. Generate the privacy global model parameters according to the interference data, the target parameter, the first disturbance factor and each difference vector; in specific application, the privacy global model parameters can be generated by, for example but not limited to, using the following formula (5).

[0132] (5)

[0133] In the above formula (5), represents the privacy global model parameters, represents the target parameter, represents the interference data, represents the first perturbation factor, Indicates the first difference vector, represents the total number of difference vectors, and represents the L2 norm; in this embodiment, since the interference data is essentially Gaussian noise, it is a noise sequence that conforms to the Gaussian distribution; in this embodiment, the length of the interference data is the same as the vector length of each decryption model parameter. Therefore, when substituted into the aforementioned formula (5), the last part of formula (5) is a constant, and the first two parameters are vectors. Based on this, each noise in the interference data can be added to each element in the target parameter correspondingly, and finally, the constant calculated in the last part of formula (5) is added, so that after the calculation is completed, the privacy global model parameter (which is also a vector in essence) is obtained.

[0134] In this way, through the aforementioned steps S61 to S68, the differential privacy aggregation processing of each decryption model parameter can be completed on the server side, thereby realizing the update of the global model parameters on the server; based on this, the above-mentioned method is used to aggregate the global model parameters. While updating the global model parameters, the real data of each client can be guaranteed to be invisible, thereby achieving the purpose of preventing differential privacy attacks and further ensuring the security of the privacy information of each client.

[0135] After completing a federated learning, the server needs to determine whether the privacy global model parameters obtained this time are the global optimal model parameters, that is, to determine whether the federated learning process can be stopped; wherein, the judgment process can be but is not limited to as shown in the following step S7.

[0136] S7. The server determines whether the privacy global model parameters are global optimal model parameters. In this embodiment, the server performs model training based on the privacy global model parameters and determines whether the loss function of the model converges. If the loss function converges, the privacy global model parameters can be determined to be global optimal model parameters, and then the global optimal model parameters are sent to each client, thereby ending the federated learning process. Otherwise, it is necessary to continue the federated learning, that is, to send the privacy global model parameters to each client, so that each client can perform local target model training again based on the privacy global model parameters to obtain updated local model parameters. Then, the updated local model parameters are encrypted and uploaded again, and the above process is repeated until the iteration stop condition is met. The iterative process of federated learning can be but is not limited to the following step S8.

[0137] S8. If not, the privacy global model parameters are used as the initial global model parameters and resent to each client until the generated privacy global model parameters are the global optimal model parameters, and the global optimal model parameters are sent to each client, so as to complete the privacy protection of each client and the server in the federated learning process after sending. In this embodiment, an example is used to illustrate its iterative process: if the privacy global model parameters obtained in the first federated learning are not the global optimal model parameters, then it is necessary to repeat the above steps S2 to S8 until the privacy global model parameters obtained are the optimal global model parameters. Among them, assuming that in the eighth federated learning process, the privacy global model parameters obtained by the server are the global optimal model parameters, then the privacy global model parameters obtained by the eighth federated learning can be sent to each client, and each client can update the local target model based on this, and after the update is completed, it can be used as the optimal target model; then, each client can use the corresponding optimal target model to perform model applications locally, such as text recognition, face recognition, etc.; of course, the above examples are only for illustration, and their actual use is not limited to this.

[0138] Therefore, through the federated learning privacy protection method described in detail in the aforementioned steps S1 to S8, the present invention encrypts the model parameters uploaded by each client in each federated learning process. In this way, the model parameters uploaded by each client are unknown during the federated learning process, thereby avoiding the problem of privacy information leakage caused by the gradient transmitted in the federated learning scenario; at the same time, a differential privacy aggregation processing method is adopted on the server side to aggregate the decrypted model parameters; based on this, while realizing global model parameter aggregation, the real data of each client can be concealed, making the real data invisible, thereby achieving the purpose of preventing differential privacy attacks; therefore, the present invention can prevent data leakage of participants in the federated learning process, protect the data privacy security of participants, and improve the security of data of each participant in the federated learning process; therefore, it is very suitable for large-scale application and promotion.

[0139] like Figure 2 As shown, the second aspect of this embodiment provides a hardware system for implementing the federated learning privacy protection method described in the first aspect of the embodiment, including: a trusted platform, a server, and several clients, and the server and each client are deployed with a target model; wherein the working process of the aforementioned system is:

[0140] The trusted platform is used to generate an information key pair, send the information private key in the information key pair to the server, and send the information public key in the information key pair to each client.

[0141] The server is used to send initial global model parameters to each client.

[0142] Each client is used to train a local target model using a local training data set and the received initial global model parameters, so as to obtain corresponding local model parameters after the training is completed.

[0143] Each client is also used to use the received information public key to encrypt the corresponding local model parameters to obtain the encrypted model parameters, and send the encrypted model parameters to the server.

[0144] The server is used to use the information private key to decrypt the received encryption model parameters to obtain a number of decryption model parameters.

[0145] The server is used to generate interference data using a number of decryption model parameters, and use the interference data to perform differential privacy aggregation processing on the number of decryption model parameters, so as to obtain privacy global model parameters after differential privacy aggregation processing.

[0146] The server is used to determine whether the privacy global model parameters are global optimal model parameters.

[0147] If not, the server is used to use the privacy global model parameters as the initial global model parameters and resend them to each client until the generated privacy global model parameters are the global optimal model parameters, and send the global optimal model parameters to each client to complete the privacy protection of each client and server in the federated learning process after sending.

[0148] The working process, working details and technical effects of the system provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0149] like Figure 3 As shown, the third aspect of this embodiment provides a federated learning privacy protection device, taking the device as an electronic device as an example, comprising: a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the federated learning privacy protection method as described in the first aspect of the embodiment.

[0150] For example, the memory may include, but is not limited to, random access memory (RAM), read only memory (ROM), flash memory, first input first output (FIFO) and / or first in last out (FILO), etc. Specifically, the processor may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). At the same time, the processor may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state.

[0151] In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. For example, the processor may not be limited to a microprocessor of the STM32F105 series, a reduced instruction set computer (RISC) microprocessor, an X86 architecture processor, or a processor with an integrated embedded neural network processing unit (NPU); the transceiver may be, but is not limited to, a wireless fidelity (WIFI) wireless transceiver, a Bluetooth wireless transceiver, a General Packet Radio Service (GPRS) wireless transceiver, a ZigBee protocol (a low-power LAN protocol based on the IEEE802.15.4 standard, ZigBee) wireless transceiver, a 3G transceiver, a 4G transceiver, and / or a 5G transceiver. In addition, the device may also include, but is not limited to, a power module, a display screen, and other necessary components.

[0152] The working process, working details and technical effects of the electronic device provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0153] The fourth aspect of this embodiment provides a storage medium storing instructions including the federated learning privacy protection method described in the first aspect of the embodiment, that is, the storage medium stores instructions, and when the instructions are executed on a computer, the federated learning privacy protection method described in the first aspect of the embodiment is executed.

[0154] The storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, a CD, a hard disk, a flash memory, a USB flash drive and / or a memory stick, and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0155] The working process, working details and technical effects of the storage medium provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0156] The fifth aspect of this embodiment provides a computer program product comprising instructions, which, when executed on a computer, causes the computer to execute the federated learning privacy protection method as described in the first aspect of the embodiment, wherein the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0157] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for protecting privacy in federated learning, characterized in that: The method is applied to a trusted platform, a server and several clients, wherein the server and each client are deployed with a target model, and the method includes: The trusted platform generates an information key pair, and sends the information private key in the information key pair to the server, and sends the information public key in the information key pair to each client; The server sends initial global model parameters to each client; Each client uses the local training data set and the received initial global model parameters to train the local target model, so as to obtain the corresponding local model parameters after the training is completed; Each client uses the received information public key to encrypt the corresponding local model parameters to obtain encrypted model parameters, and sends the encrypted model parameters to the server; The server uses the information private key to decrypt the received encrypted model parameters to obtain a number of decrypted model parameters; The server generates interference data using the plurality of decryption model parameters, and uses the interference data to perform differential privacy aggregation processing on the plurality of decryption model parameters, so as to obtain privacy global model parameters after differential privacy aggregation processing; The server determines whether the privacy global model parameters are global optimal model parameters; If not, the privacy global model parameters are used as the initial global model parameters and resent to each client until the generated privacy global model parameters are the global optimal model parameters, and the global optimal model parameters are sent to each client, so as to complete the privacy protection of each client and the server in the federated learning process after sending; The server generates interference data using several decryption model parameters, including: Generate a first disturbance factor according to the plurality of decryption model parameters; Determining a second disturbance factor based on the plurality of decryption model parameters and the first disturbance factor; Calculating a noise scale according to the second disturbance factor; Determining a noise variance using the noise scale and the first disturbance factor; Generate noise data whose probability density function obeys normal distribution according to the noise variance, so as to use the noise data as the interference data; Any decryption model parameter is in vector form, and each element in the vector corresponds to a model parameter, wherein the first perturbation factor is generated according to the decryption model parameters, including: Obtaining target parameters of the target model deployed on the server, wherein the target parameters are privacy global model parameters of the target model deployed on the server in the last federated learning process; Calculating the difference vectors between each decryption model parameter and the target parameter, and obtaining the L2 norm of each difference vector to obtain a number of L2 norm values; Arrange a number of L2 norm values ​​in ascending order to obtain a sorted sequence, and use the median of the sorted sequence as the first perturbation factor; Determining a second disturbance factor based on the plurality of decryption model parameters and the first disturbance factor includes: Selecting any decryption model parameter from the plurality of decryption model parameters as a designated parameter; According to the specified parameter, the target parameter and the first disturbance factor, and in accordance with the following formula (4), the second disturbance factor is calculated; （4） In the above formula (4), represents the second perturbation factor, represents the first perturbation factor, represents the specified parameter, represents the target parameter, represents the L2 norm; Correspondingly, calculating the noise scale according to the second disturbance factor includes: Obtain a scale control factor, wherein the value interval of the scale control factor is (0,1); Using the ratio between the second disturbance factor and the scale control factor as the noise scale; Any decryption model parameter is in vector form, and each element in the vector corresponds to a model parameter, wherein the server uses the interference data to perform differential privacy aggregation processing on the decryption model parameters to obtain a privacy global model parameter after differential privacy aggregation processing, including: Obtaining target parameters of the target model deployed on the server, wherein the target parameters are privacy global model parameters of the target model deployed on the server in the last federated learning process; Calculating the difference vector between each decryption model parameter and the target parameter; The privacy global model parameters are generated according to the interference data, the target parameters, the first disturbance factor and each difference vector.

2. The method according to claim 1, characterized in that The trusted platform generates an information key pair, including: Obtaining a first key parameter and a second key parameter, and generating a first public key and a first private key according to the first key parameter and the second key parameter; Generate a public key random number, and determine a second public key using the public key random number and the first public key; Generate a second private key based on the first public key and the first private key; The information public key is composed of the first public key and the second public key, and the information private key is composed of the first private key and the second private key, so as to generate the information key pair based on the information public key and the information private key.

3. The method according to claim 2, characterized in that The first key parameter and the second key parameter satisfy , where represents the first key parameter and the second key parameter in sequence, and Solve the function for the greatest common divisor; Wherein, using the public key random number and the first public key to determine the second public key includes: The second public key is generated using the following formula (1); （1） In the above formula (1), represents the second public key, represents the public key random number, represents the first public key, represents the modulo operation, where , represents a target positive integer set, which is based on and obtained, and Representation model The set of positive integers under Indicates less than or equal to , and with The set of mutually prime positive integers; Correspondingly, generating a second private key based on the first public key and the first private key includes: The second private key is generated using the following formula (2); （2） In the above formula (2), represents the second private key, Represents the first private key.

4. The method according to claim 1, characterized in that: The information public key includes a first public key and a second public key, wherein each client uses the received information public key to encrypt the corresponding local model parameter to obtain the encrypted model parameter, including: For any client, based on the first public key and the second public key, and using the following formula (3), encrypt the corresponding local model parameters to obtain encrypted model parameters; （3） In the above formula (3), represents the encryption model parameters corresponding to any of the clients, represents the first public key, represents the second public key, represents the encryption control factor, Indicates the local model parameters corresponding to any of the clients.

5. The method according to claim 1, characterized in that Generating the privacy global model parameters according to the interference data, the target parameter, the first disturbance factor, and each difference vector includes: According to the following formula (5), the privacy global model parameters are generated; （5） In the above formula (5), represents the privacy global model parameters, represents the target parameter, represents the interference data, represents the first perturbation factor, Indicates the first difference vector, represents the total number of difference vectors, and represents the L2 norm.

6. A federated learning privacy protection system, characterized in that: Used to execute the federated learning privacy protection method according to any one of claims 1 to 5, wherein the federated learning privacy protection system comprises: a trusted platform, a server, and a plurality of clients, and a target model is deployed on the server and each client; A trusted platform, used to generate an information key pair, and send the information private key in the information key pair to the server, and send the information public key in the information key pair to each client; The server is used to send initial global model parameters to each client; Each client is used to train a local target model using a local training data set and the received initial global model parameters, so as to obtain corresponding local model parameters after the training is completed; Each client is further used to encrypt the corresponding local model parameters using the received information public key to obtain the encrypted model parameters, and send the encrypted model parameters to the server; The server is used to decrypt each received encrypted model parameter using the information private key to obtain a number of decrypted model parameters; The server is used to generate interference data using a number of decryption model parameters, and use the interference data to perform differential privacy aggregation processing on the number of decryption model parameters, so as to obtain privacy global model parameters after differential privacy aggregation processing; A server, configured to determine whether the privacy global model parameters are global optimal model parameters; If not, the server is used to use the privacy global model parameters as the initial global model parameters and resend them to each client until the generated privacy global model parameters are the global optimal model parameters, and send the global optimal model parameters to each client to complete the privacy protection of each client and server in the federated learning process after sending.

Images