Privacy protection federation recommendation method and system, processing equipment and storage medium

Abstract

The invention relates to a privacy protection federated recommendation method and system, a processing device and a storage medium, and the method is characterized in that the method comprises the steps: employing a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning to update a recommendation model of a central server, namely a global model, and obtaining an updated recommendation model; and acquiring an interaction data set of a real interaction index between the user and the article, and inputting the interaction data set into the updated recommendation model to obtain an article recommendation result for the user, so that on the premise that the recommendation accuracy is not obviously reduced, the communication overhead can be greatly reduced, meanwhile, the privacy security of user data is ensured, and the user experience is improved. The method can be widely applied to the fields of federal learning and privacy protection.

Description

Technical Field

[0001] The present invention relates to the field of federated learning and privacy protection, and in particular to a privacy-preserving federated recommendation method, system, processing device and storage medium. Background Art

[0002] In today's Internet big data era, recommendation systems have become a key technology to alleviate the problem of information overload and are widely used in fields such as e-commerce. In order to optimize recommendation performance, recommendation systems usually need to collect and analyze users' private information, while traditional centralized data collection methods bring the risk of user privacy leakage. With the implementation of privacy regulations and the enhancement of personal privacy protection awareness, federated learning has emerged, allowing multiple data holders to conduct joint training without sharing users' original data to protect user privacy. Despite this, federated learning still has the problem of insufficient privacy protection. Under the federated framework, the intermediate parameters or gradients used for model training may contain sensitive information of users, and directly uploading this information has the potential risk of privacy leakage. In addition, since federated training requires the transmission of the complete recommendation model, the federated recommendation system also faces the challenge of high communication costs in scenarios with a large number of items.

[0003] Federated recommendation methods enhance user privacy protection through distributed data processing, and can be mainly divided into two categories: matrix decomposition-based federated recommendation methods and deep learning-based federated recommendation methods. The core of the matrix decomposition-based federated recommendation method is to use matrix decomposition to predict missing values ​​in the user-item rating matrix to achieve personalized recommendations. Although existing work has made some progress in protecting user rating information, these methods need to transmit the feature vectors of all items during the federated training process, which significantly increases the communication cost of the client. Although some studies have tried to strengthen privacy protection through encryption methods, this method often increases computational overhead and affects the operating efficiency of the method, and has not completely solved the privacy leakage problem of inferring user rating behavior by analyzing changes in item feature vectors.

[0004] The federated recommendation method based on deep learning can handle more complex data and provide more accurate recommendations. However, this method still faces problems such as limited client storage and computing resources, and poor model quality due to limited data volume. Especially in federated scenarios, the complex structure and numerous parameters of deep learning models cause the communication cost of transmitting the complete model to rise sharply. In addition, the high complexity of deep learning models and the high dimensionality of parameters may cause gradients to carry a large amount of raw data information. Attackers can reconstruct or infer sensitive data features of the client by analyzing these gradients, increasing the risk of data privacy leakage. Summary of the invention

[0005] In view of the above problems, the object of the present invention is to provide a privacy-preserving federal recommendation method, system, processing device and storage medium that can reduce the amount of communication data and privacy risks.

[0006] To achieve the above objectives, the present invention adopts the following technical solutions: In a first aspect, a privacy-preserving federated recommendation method is provided, comprising:

[0007] Adopting a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning to update the recommendation model of the central server, i.e., the global model, to obtain an updated recommendation model;

[0008] The interaction dataset of the real interaction index between the user and the item is obtained and input into the updated recommendation model to obtain the item recommendation result for the user.

[0009] Furthermore, the federated recommendation algorithm based on matrix decomposition is used to update the recommendation model of the central server to obtain an updated recommendation model, including:

[0010] A sub-model selection algorithm based on differential privacy is used to filter the sub-models of the recommended model of the central server based on the interaction data of the real interaction index between the client and the item, and the sub-model set for subsequent transmission is selected;

[0011] A federated recommendation algorithm based on matrix decomposition is adopted to update the recommendation model based on the sub-models in the screened sub-model set to obtain an updated recommendation model.

[0012] Furthermore, the sub-model selection algorithm based on differential privacy is adopted to screen the sub-models of the recommendation model of the central server based on the interaction data of the real interaction index between the client itself and the item, and screen out the sub-model set for subsequent transmission, including:

[0013] The client locally converts the interaction data of the real interaction index between itself and the item into a binary interaction vector;

[0014] The client uses a random response mechanism to perturb the interaction vector, generate a perturbation vector that satisfies ε1-local differential privacy, and uploads it to the central server. ε1 is the privacy budget when perturbing the interaction data.

[0015] The central server aggregates the received disturbance vectors into a disturbance interaction matrix;

[0016] The central server adopts an estimation method based on the maximum likelihood function to determine the true interaction frequency of each item according to the perturbation interaction matrix, screens out items whose true interaction frequency exceeds the preset threshold, and uses the eigenvector matrix corresponding to the item as a sub-model for subsequent transmission and adds it to the sub-model set.

[0017] Furthermore, the federated recommendation algorithm based on matrix decomposition is used to update the recommendation model based on the sub-models in the screened sub-model set to obtain an updated recommendation model, including:

[0018] For each round of global training, the central server calculates the number of clients participating in the training according to the sampling ratio of the clients, and randomly selects the corresponding number of clients to participate in the training;

[0019] The central server sends the sub-models in the filtered sub-model set to the selected client;

[0020] The client participating in this round of training downloads the sub-model of the current round from the central server, trains the sub-model locally using local data, and updates the user feature vector locally;

[0021] After completing the model training locally, the client calculates the feature vector gradient of each item corresponding to the sub-model locally;

[0022] The client performs gradient clipping on the calculated feature vector gradient and perturbs it using a gradient perturbation strategy based on the Laplace mechanism to generate a perturbed gradient that satisfies ε2-differential privacy and uploads it to the central server. ε2 is the privacy budget in the gradient perturbation stage.

[0023] The central server performs weighted aggregation on the perturbation gradients that satisfy ε2-differential privacy uploaded by the client and updates the recommendation model;

[0024] Repeat the above steps for global training until the preset rounds of training are completed to obtain an updated recommendation model.

[0025] Furthermore, the recommendation model of the central server is updated by using a federated recommendation algorithm based on deep learning to obtain an updated recommendation model, including:

[0026] A sub-model selection algorithm based on differential privacy is used to screen the shallow network sub-models in the recommendation model of the central server based on the interaction data of the real interaction index between the client and the item, and obtain the shallow network sub-model;

[0027] A federated recommendation algorithm based on deep learning is adopted to update the recommendation model based on the deep network model parameters of the recommendation model itself and the screened shallow network sub-model to obtain an updated recommendation model.

[0028] Furthermore, the federated recommendation algorithm based on deep learning is used to update the recommendation model based on the deep network model parameters of the recommendation model itself and the screened shallow network sub-model to obtain an updated recommendation model, including:

[0029] For each round of global training, the central server calculates the number of clients participating in the training according to the sampling ratio of the clients, and randomly selects the corresponding number of clients to participate in the training;

[0030] The central server sends the deep network model parameters and the selected shallow network sub-models in the recommended model to the selected client;

[0031] The clients participating in this round of training download the shallow network sub-model and deep network model parameters from the central server, train the shallow network sub-model and deep network model parameters using local data, and update the user feature vector locally;

[0032] After completing the model training locally, the client calculates the updated shallow network sub-model and updated deep network model parameters locally;

[0033] The client performs a gradient compression strategy on the updated deep network model parameters;

[0034] The client performs gradient clipping on the updated shallow network sub-model and the deep network model parameters after the gradient compression strategy;

[0035] The client perturbs the shallow network sub-model and deep network model parameters after gradient clipping to generate shallow network sub-model and deep network model parameters that meet ε3-differential privacy, and uploads them to the central server. ε3 is the privacy budget for gradient perturbation using the Gaussian mechanism.

[0036] The central server aggregates and optimizes the parameters of the shallow network sub-model and deep network model that satisfy ε3-differential privacy, and updates the recommendation model;

[0037] Repeat the above steps for global training until the preset rounds of training are completed to obtain an updated recommendation model.

[0038] Furthermore, the client performs a gradient compression strategy on the updated deep network model parameters, including:

[0039] The client performs gradient sparse processing on the updated deep network model parameters to obtain the deep network model parameters after gradient sparse processing;

[0040] The client performs local gradient clipping on the deep network model parameters after gradient sparsification processing to obtain the deep network model parameters after local gradient clipping.

[0041] Second, a privacy-preserving federated recommendation system is provided, including:

[0042] A model updating module is used to update the recommendation model of the central server, i.e., the global model, by adopting a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning to obtain an updated recommendation model;

[0043] The recommendation module is used to obtain the interaction data set of the real interaction index between the user and the item, and input it into the updated recommendation model to obtain the item recommendation result for the user.

[0044] In a third aspect, a processing device is provided, comprising computer program instructions, wherein the computer program instructions, when executed by the processing device, are used to implement steps corresponding to the above-mentioned privacy protection federal recommendation method.

[0045] In a fourth aspect, a computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions, when executed by a processor, are used to implement the steps corresponding to the above-mentioned privacy protection federal recommendation method.

[0046] The present invention adopts the above technical solution, which has the following advantages:

[0047] 1. The present invention applies the sub-model selection algorithm based on differential privacy to the federated recommendation algorithm based on matrix decomposition, so that the client uses the sub-model that meets the differential privacy protection sent by the central server to perform model training, and then uses the gradient perturbation strategy to perturb the uploaded gradient. The entire algorithm process improves the communication efficiency while meeting the differential privacy protection.

[0048] 2. In the federated recommendation algorithm based on deep learning, the present invention achieves a significant improvement in communication efficiency by structurally dividing the recommendation model and proposing different model optimization strategies for shallow networks and deep networks. At the same time, the introduction of the gradient perturbation strategy ensures the differential privacy protection of the uploaded gradient, effectively protects the user's privacy data, and demonstrates the superior performance of the algorithm in dealing with the communication and privacy protection challenges in federated deep learning recommendations.

[0049] 3. The present invention can significantly reduce communication overhead without significantly reducing recommendation accuracy, while ensuring the privacy and security of user data.

[0050] 4. The present invention strengthens the privacy protection of user interaction data through a random response mechanism, and introduces a method based on maximum likelihood estimation to ensure that under the premise of protecting the privacy of user interaction data, the central server can efficiently and accurately infer and issue a sub-model that meets the client's needs, thereby achieving an effective balance between user privacy protection and model utility.

[0051] In summary, the present invention can be widely used in the fields of federated learning and privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Throughout the accompanying drawings, the same reference numerals are used to represent the same components. In the accompanying drawings:

[0053] Figure 1 is a schematic diagram of a sub-model selection algorithm based on differential privacy provided in one embodiment of the present invention;

[0054] Figure 2 is a schematic diagram of a random response mechanism provided by an embodiment of the present invention;

[0055] Figure 3 is a schematic diagram of an estimation method based on a maximum likelihood function provided by an embodiment of the present invention;

[0056] Figure 4 is a schematic diagram of a federated recommendation algorithm based on matrix decomposition provided by an embodiment of the present invention;

[0057] Figure 5 is a schematic diagram of the recommendation accuracy of three algorithms on the MovieLens 100K dataset provided by an embodiment of the present invention, wherein: Figure 5 (a) is a schematic diagram of the recommended accuracy of the HR@10 indicator. Figure 5 (b) is a schematic diagram of the recommended accuracy of the NDCG@10 indicator;

[0058] Figure 6 is a schematic diagram of the recommendation accuracy of three algorithms on the MovieLens 1M dataset provided by an embodiment of the present invention, wherein: Figure 6 (a) is a schematic diagram of the recommended accuracy of the HR@10 indicator. Figure 6 (b) is a schematic diagram of the recommended accuracy of the NDCG@10 indicator;

[0059] Figure 7 is a schematic diagram comparing the communication overheads of three algorithms provided in one embodiment of the present invention, wherein: Figure 7 (a) is a comparison diagram of the MovieLens 100K dataset. Figure 7 (b) is a comparison diagram of the MovieLens 1M dataset;

[0060] Figure 8 is a schematic diagram of the recommendation accuracy of four algorithms on the MovieLens 100K dataset provided by an embodiment of the present invention, wherein: Figure 8 (a) is a schematic diagram of the recommended accuracy of the HR@10 indicator. Figure 8 (b) is a schematic diagram of the recommended accuracy of the NDCG@10 indicator;

[0061] Fig. 9 is a schematic diagram of the recommendation accuracy of four algorithms on the MovieLens 1M dataset provided by an embodiment of the present invention, wherein: Fig. 9 (a) is a schematic diagram of the recommended accuracy of the HR@10 indicator. Fig. 9 (b) is a schematic diagram of the recommended accuracy of the NDCG@10 indicator;

[0062] Fig.10 is a schematic diagram comparing the communication overheads of four algorithms provided in an embodiment of the present invention, wherein: Fig.10 (a) is a comparison diagram of the MovieLens 100K dataset. Fig.10 (b) is a comparison diagram of the MovieLens 1M dataset. DETAILED DESCRIPTION

[0063] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0064] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0065] Although the terms first, second, third, etc. can be used in the text to describe multiple elements, components, regions, layers and / or sections, these elements, components, regions, layers and / or sections should not be limited by these terms. These terms can only be used to distinguish an element, component, region, layer or section from another region, layer or section. Unless the context clearly indicates, terms such as "first", "second" and other numerical terms do not imply order or sequence when used in the text. Therefore, the first element, component, region, layer or section discussed below can be referred to as the second element, component, region, layer or section without departing from the teaching of the example embodiments.

[0066] Existing federated recommendation methods can effectively avoid the centralized storage of user sensitive information on the central server by placing the modeling process of the recommendation system in a distributed environment and exchanging intermediate parameters to collaboratively train a shared model. However, this also causes the following problems: 1) Huge communication overhead: In existing federated learning recommendation systems, transmitting the complete recommendation model to each client will result in huge communication overhead. In a large-scale distributed environment, this high communication cost not only increases the network burden, but also prolongs the model training time, affecting the overall efficiency and scalability of the system. Therefore, there is an urgent need to significantly reduce the amount of communication data by optimizing the model transmission strategy. 2) Privacy leakage: In existing technologies, the client needs to upload updated models or gradient information to the server, which may be exploited by malicious attackers to leak user data and bring privacy risks.

[0067] The embodiment of the present invention provides a privacy-preserving federated recommendation method, including: using a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning to update the recommendation model of the central server, that is, the global model, to obtain an updated recommendation model; obtaining an interaction data set of the real interaction index between the user himself and the item, and inputting it into the updated recommendation model to obtain the item recommendation result for the user. The method used in the present invention includes:

[0068] Sub-model selection algorithm based on differential privacy: In view of the high communication overhead problem of the traditional federated recommendation framework when transmitting the complete recommendation model, this paper proposes a sub-model selection algorithm based on differential privacy, which strengthens the privacy protection of user interaction data through a random response mechanism, and effectively protects the privacy security of user data while reducing communication costs. At the same time, in view of the problem that the central server directly uses perturbation data for sub-model selection, which may lead to model bias and reduced utility, an estimation method based on the maximum likelihood function is proposed. This algorithm optimizes the selection of sub-models by estimating the real interaction frequency of items, ensuring that the server can efficiently and accurately infer and send sub-models that meet the needs of the client under the premise of protecting the privacy of user interaction data, thus achieving an effective balance between user privacy protection and model utility.

[0069] Gradient perturbation strategy: To ensure that the uploaded gradient information meets the requirements of differential privacy protection, this paper introduces a gradient perturbation strategy. By adding noise to the gradient, user privacy data is effectively protected, thereby preventing privacy leakage that may occur through gradient analysis.

[0070] Federated recommendation strategy: For the federated recommendation algorithm based on matrix decomposition, the recommendation model transmitted is the item feature vector matrix. The sub-model selection strategy and the gradient perturbation strategy can be directly used to perform communication-efficient federated recommendation. For the federated recommendation algorithm based on deep learning, the recommendation model contains large and sparse embedding layers and other dense layers. In order to effectively reduce the communication overhead and enhance the privacy protection of the model, the present invention divides the recommendation model into a shallow network and a deep network. In the shallow network, the present invention adopts a sub-model selection algorithm based on differential privacy, allowing the client to download and update only the model part directly related to its data. In the deep network, in order to further reduce the amount of data transmission, the present invention adopts a gradient compression strategy. Through this strategy, only important gradient information will be uploaded, thereby reducing the total amount of uploaded data while maintaining the effectiveness and efficiency of model training. In addition, the gradient perturbation strategy that meets differential privacy protection and the sub-model aggregation optimization technology based on the FedSubAvg algorithm are adopted to further balance the relationship between privacy protection, communication efficiency and recommendation performance.

[0071] Example 1

[0072] This embodiment provides a privacy-preserving federated recommendation method, including the following steps:

[0073] 1) Using a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning, the recommendation model of the central server, i.e., the global model, is updated to obtain an updated recommendation model.

[0074] Specifically, 1) a federated recommendation algorithm based on matrix decomposition is used to update the recommendation model of the central server to obtain an updated recommendation model, which is specifically:

[0075] 1.1) If Figure 1 As shown, a sub-model selection algorithm based on differential privacy (DP-SUB) is used to screen the sub-models of the recommendation model of the central server based on the interaction data of the real interaction index between the client and the item, and screen out a sub-model set for subsequent transmission. The recommendation model of the central server in the federated recommendation algorithm based on matrix decomposition is a complete item feature vector matrix. Since the user's interaction data usually only involves a small part of it, this embodiment selects the item feature vector that interacts with the user as the sub-model. The specific process of this step is:

[0076] 1.1.1) The client converts the interaction data of the real interaction index between itself and the item into a binary interaction vector S of length m locally. i .

[0077] Specifically, for the client's local dataset D i For each item j contained in i The jth bit in is set to 1, otherwise it is 0.

[0078] 1.1.2) If Figure 2 As shown, the client adopts a random response mechanism to the interaction vector S i Perturb and generate a perturbation vector that satisfies ε1-local differential privacy (ε-LDP) And upload to the central server.

[0079] Specifically, the interaction vector S i The perturbation rule for each perturbation vector is:

[0080]

[0081] in, is the interaction vector S i The j-th perturbation vector of ij is the interaction vector s i ; ε1 is the privacy budget when the interaction data is perturbed in the sub-model selection stage.

[0082] 1.1.3) The central server will receive the disturbance vector Aggregated into a perturbation interaction matrix n is the number of clients, used to calculate the frequency of item interaction after disturbance The perturbation interaction matrix The proportion of values ​​in each column being 1.

[0083] 1.1.4) If Figure 3 As shown, the central server uses an estimation method based on the maximum likelihood function, according to the disturbance interaction matrix Determine the true interaction frequency of each item That is, before the perturbation, the original interaction matrix S = [S1, S2, ..., S n ] The central server calculates the ratio of each column value to 1 based on the actual interaction frequency of each item. And the preset threshold p, filter out the real interaction frequency Items that exceed the preset threshold p are added to the sub-model set U′, and the feature vector matrix corresponding to the item is used as a sub-model for subsequent transmission to achieve a communication-efficient and privacy-preserving federated learning process.

[0084] Specifically, the actual interaction frequency of each item is:

[0085]

[0086] in, is the item interaction frequency of the jth item; p xy is the probability of data perturbation from x to y, p 00 is the probability that the data is still 0 after being disturbed by 0, p 11 is the probability that data 1 remains 1 after perturbation, and:

[0087]

[0088] 1.2) If Figure 4 As shown, the federated recommendation algorithm based on matrix decomposition is used to update the recommendation model based on the sub-models in the screened sub-model set to obtain the updated recommendation model:

[0089] 1.2.1) For each round of global training, the central server calculates the number of clients participating in this round of training according to the sampling ratio k of the clients, l = k*n, and randomly selects the corresponding number of clients to participate in this round of training. The set of selected clients is s t ={s1,s2,…,s l}.

[0090] 1.2.2) The central server sends the sub-model V in the sub-model set selected by the DP-SUB algorithm to the selected client. sub , that is, the item feature vector matrix corresponding to the sub-model set U′.

[0091] 1.2.3) The client participating in this round of training downloads the sub-model V of the current round from the central server sub , using local data Di Pair Model V sub Perform local training and update the user feature vector locally.

[0092] Specifically, the client performs E rounds of training locally.

[0093] 1.2.4) After completing the model training locally, the client calculates the sub-model V locally sub The corresponding feature vector gradient g of each item item .

[0094] 1.2.5) The client calculates the gradient of the feature vector g item Gradient clipping is performed, and the gradient perturbation strategy based on the Laplace mechanism is used to generate perturbation gradients that satisfy ε2-differential privacy. Upload to the central server:

[0095] 1.2.5.1) The client calculates the gradient of the feature vector g item Perform gradient clipping to obtain the feature vector gradient g after gradient clipping i ' tem for:

[0096]

[0097] Where C is the clipping threshold.

[0098] 1.2.5.2) The client uses a gradient perturbation strategy based on the Laplace mechanism to perturb the feature vector gradient g after gradient clipping i ' tem Perform perturbations to generate perturbation gradients that satisfy ε2-differential privacy for:

[0099]

[0100] Among them, Lap is the Laplace mechanism; Δf is the sensitivity of function f; t is the number of training rounds; ε2 is the privacy budget in the gradient perturbation stage.

[0101] 1.2.5.3) The client will satisfy the perturbation gradient of ε2-differential privacy Upload to the central server.

[0102] 1.2.6) The central server uploads the perturbation gradient that satisfies ε2-differential privacy to the client Perform weighted aggregation and update the recommendation model, that is, the complete item feature vector matrix.

[0103] 1.2.7) Go to step 1.2.1) for global training until T rounds of training are completed to obtain an updated recommendation model.

[0104] Specifically, 2) a federated recommendation algorithm based on deep learning is used to update the recommendation model of the central server to obtain an updated recommendation model, which is specifically:

[0105] 2.1) Using the sub-model selection algorithm based on differential privacy, based on the interaction data of the real interaction index between the client and the item, the shallow network sub-model in the recommendation model of the central server is screened to obtain the shallow network sub-model X sub .

[0106] Furthermore, the recommendation model structure of the central server in the federated recommendation algorithm based on deep learning in the present invention is more complex, including large and sparse item embedding layers and other dense layers. In practical applications, the local data of the client is usually only associated with a smaller subset of the feature space, and the client only needs to download and update the part of the recommendation model related to its item features. Therefore, for the shallow part of the recommendation model of the central server in the federated recommendation algorithm based on deep learning, that is, the item embedding layer, the present invention adopts a shallow network sub-model selected by the DP-SUB algorithm. The shallow network sub-model received by the client includes the embedding vectors of all dense layers and part of the item embedding layer, rather than a huge complete item embedding layer. The specific process of this step is similar to the above steps 1.1.1) to 1.1.4), except that the structure of the recommendation model is different.

[0107] 2.2) Adopting the federated recommendation algorithm based on deep learning, based on the deep network model parameters W of the recommendation model itself d And the selected shallow network sub-model X sub , update the recommendation model and get the updated recommendation model:

[0108] 2.2.1) For each round of global training, the central server calculates the number of clients participating in the training according to the sampling ratio k of the clients, and randomly selects the corresponding number of clients to participate in the training. The set of selected clients is s. t ={s1,s2,…,s l}.

[0109] 2.2.2) The central server sends the deep network model parameters W in the recommended model to the selected client d And the shallow network sub-model X selected by DP-SUB algorithm sub .

[0110] 2.2.3) The client participating in this round of training downloads the shallow network sub-model X from the central server sub and the deep network model parameters W d , using local data to train the shallow network sub-model X suband the deep network model parameters W d Perform training and update the user feature vector locally.

[0111] Furthermore, the client performs round E of training locally.

[0112] 2.2.4) After completing the model training locally, the client calculates the updated shallow network sub-model ΔX locally sub and updated deep network model parameters

[0113] 2.2.5) To further optimize communication efficiency, the client updates the deep network model parameters Perform gradient compression strategy, including gradient sparse processing and local gradient clipping:

[0114] 2.2.5.1) Client updates deep network model parameters Perform gradient sparse processing to obtain the deep network model parameters after gradient sparse processing

[0115]

[0116] Here, τ is the sparsification threshold.

[0117] 2.2.5.2) Deep network model parameters after gradient sparsification by the client Perform local gradient clipping to obtain the deep network model parameters after local gradient clipping

[0118]

[0119] 2.2.6) Client updates the shallow network sub-model ΔX sub And the deep network model parameters after local gradient clipping Perform gradient clipping.

[0120] Furthermore, the shallow network sub-model ΔX after gradient clipping sub for:

[0121]

[0122] Among them, P is the gradient perturbation clipping threshold.

[0123] Deep network model parameters after gradient clipping for:

[0124]

[0125] 2.2.7) The client uses a gradient perturbation strategy based on the Gaussian mechanism to perturb the shallow network sub-model ΔX after gradient clipping sub and deep network model parameters Perturb and generate a shallow network sub-model ΔX that satisfies ε3-differential privacy s ' ub and deep network model parameters satisfying ε3-differential privacy And uploaded to the central server, where ε3 is the privacy budget for gradient perturbation using the Gaussian mechanism.

[0126] Furthermore, the shallow network submodel ΔX that satisfies ε3-differential privacy s ' ub for:

[0127] ΔX sub ′=ΔX sub +N(0,σ 2 P 2 ) (10)

[0128]

[0129] Among them, N(0,σ 2 P 2 ) is the Gaussian mechanism; σ is the noise scale that determines the Gaussian distribution.

[0130] 2.2.8) The central server uses the FedSubAvg algorithm to perform a ε3-differential privacy-compliant shallow network submodel ΔX uploaded by the client. s ' ub and deep network model parameters satisfying ε3-differential privacy Perform aggregation optimization and update the recommendation model.

[0131] 2.2.9) Go to step 2.2.1) for global training until T rounds of training are completed to obtain the updated recommendation model W t+1 :

[0132]

[0133] Among them, W t The updated recommendation model after the t-th round of training; n m The number of clients participating in the model parameter update; Δx i The recommended model uploaded by client i after the above processing, including the shallow network sub-model ΔX s ' ub and deep network model parameters

[0134] 2) Obtain an interaction dataset of the real interaction index between the user and the item, and input it into the updated recommendation model to obtain the item recommendation result for the user.

[0135] Specifically, for example: obtain the user's own movie dataset, including user ID, movie ID and user's rating data for several movies that have been watched, input the movie dataset into the updated recommendation model, obtain the user's rating for unwatched movies predicted by the recommendation model, and recommend movies to the user based on the rating.

[0136] The technical effects of the privacy protection federated recommendation method of the present invention are described in detail below through specific embodiments:

[0137] This example experiments on two real-world movie rating datasets, MovieLens 100k and MovieLens 1M, respectively, for the federated recommendation algorithm based on matrix decomposition and the federated recommendation algorithm based on deep learning in the present invention. Compared with the prior art, it is proved that the algorithm proposed in the present invention can significantly reduce the communication overhead without significantly reducing the accuracy of the recommendation, while ensuring the privacy and security of user data. The specific experimental results and analysis are as follows:

[0138] 1. Federated Recommendation Algorithm Based on Matrix Decomposition (Priv-FedMF-Sub)

[0139] In the federated recommendation algorithm based on matrix decomposition, the baseline methods for comparison include: the traditional federated matrix decomposition recommendation algorithm FedMF: all clients collaboratively train the recommendation model in the traditional federated learning method; the federated matrix decomposition recommendation algorithm DP-FedMF with local differential privacy protection: when the client uploads the gradient locally, it adds the same Laplace noise as the algorithm of the present invention to satisfy differential privacy protection.

[0140] First, this embodiment focuses on the recommendation accuracy of the three algorithms, and uses the two indicators HR@10 and NDCG@10 to measure the recommendation quality of each algorithm. Figure 5 and Figure 6The recommendation accuracy of the three algorithms on the MovieLens 100k and MovieLens 1M datasets are shown respectively. It can be seen that the FedMF model performs best. It jointly trains the recommendation model without directly uploading the user's original data, thus avoiding direct user data leakage. However, the method of exchanging intermediate gradients in federated training also has the risk of privacy leakage and cannot guarantee absolute privacy security. DP-FedMF adds perturbations to the gradients on the basis of FedMF to make it meet differential privacy protection. Compared with FedMF, although DP-FedMF reduces some of the recommendation accuracy, it achieves stronger privacy protection. Compared with DP-FedMF, Priv-FedMF-Sub has no significant reduction in recommendation accuracy under the same degree of privacy protection, showing a model availability comparable to DP-FedMF.

[0141] Secondly, this embodiment focuses on the communication overhead of the algorithm. Figure 7 The communication efficiency is measured by comparing the communication costs of the FedMF, DP-FedMF and Priv-FedMF-Sub algorithms. On the MovieLens 100K dataset, the total transmission parameter amount of FedMF is 2154.24Mil, the total transmission parameter amount of Priv-FedMF-Sub is 698.678Mil, and the communication efficiency is improved by 67.57%; on the MovieLens 1M dataset, the total transmission parameter amount of FedMF is 9487.36Mil, the total transmission parameter amount of Priv-FedMF-Sub is 2907.846Mil, and the communication efficiency is improved by 69.35%. This is because the Priv-FedMF-Sub of the present invention adopts the strategy of replacing the complete recommendation model with a sub-model, and sets the screening sub-model threshold p in the algorithm as the mean of the estimated interaction frequency, which reduces the communication burden brought by the federated training transmission. Through the significant reduction in data communication volume, it is proved that the federated recommendation algorithm based on matrix decomposition proposed by the present invention effectively reduces communication overhead while protecting user privacy.

[0142] In summary, the matrix decomposition-based federated recommendation algorithm proposed in the present invention achieves privacy protection of user data while ensuring the quality of recommendation, and significantly improves communication efficiency.

[0143] 2. Federal recommendation algorithm based on deep learning (Priv-FedNCF-Sub-Compress)

[0144] In the federated recommendation algorithm based on deep learning, the baseline methods for comparison are: the traditional federated deep learning recommendation algorithm FedNCF: all clients collaboratively train the recommendation model in the traditional federated learning way; the federated deep learning recommendation algorithm DP-FedNCF with local differential privacy protection: the client adds the same noise as the algorithm of the present invention when uploading the gradient locally to make it meet the differential privacy protection; DP-FedNCF-DGC: based on DP-FedNCF, a deep gradient compression strategy is adopted for the entire network model to reduce the communication overhead caused by federated training.

[0145] First, this embodiment focuses on the recommendation accuracy of the four algorithms and measures the recommendation quality of each algorithm through the two indicators of HR@10 and NDCG@10. Figure 8 and Fig. 9 The recommendation accuracy of the four algorithms on the MovieLens 100k and MovieLens 1M datasets is shown respectively. It can be seen that the FedNCF model performs best and provides a high recommendation accuracy without any other privacy protection measures. However, the intermediate gradients uploaded by the client may also be inferred from the original user data, and there is still a potential risk of privacy leakage. Compared with FedNCF, the HR@10 and NDCG@10 indicators of the DP-FedNCF algorithm that introduces differential privacy protection measures have decreased, which shows that adding noise to the gradient to enhance privacy protection will have a certain impact on the accuracy of the model. Compared with DP-FedNCF, the recommendation accuracy of DP-FedNCF-DGC has decreased. This is because the algorithm adds a deep gradient compression strategy to reduce communication overhead and compresses the uploaded gradient, resulting in some valid information not being trained. Compared with DP-FedNCF, the Priv-FedNCF-Sub-Compress algorithm proposed in this invention does not significantly reduce the recommendation accuracy while maintaining the same degree of differential privacy protection, and remains at a similar level to DP-FedNCF. At the same time, compared with DP-FedNCF-DGC, which adopts the deep gradient compression strategy, Priv-FedNCF-Sub-Compress has higher recommendation accuracy. This is because shallow networks usually have more important general information than deep networks. DP-FedNCF-DGC fully compresses the entire network, while Priv-FedNCF-Sub-Compress divides the network structure and only uses the gradient compression strategy for the deep neural network, protecting the general information of the shallow network.

[0146] Secondly, this embodiment focuses on the communication overhead of the algorithm. Fig.10The communication efficiency is measured by comparing the communication costs of FedNCF, DP-FedNCF, DP-FedNCF-DGC and Priv-FedNCF-Sub-Compress algorithms. Compared with the method of using the recommended model transmission, Priv-FedNCF-Sub-Compress has significantly improved the communication efficiency of both datasets, where the average amount of transmitted parameters is used to measure the communication cost, in millions (Mil). On the MovieLens 100K dataset, the average amount of parameters transmitted per iteration of FedNCF is 10771.2Mil, and the average amount of parameters transmitted per iteration of Priv-FedNCF-Sub-Compress is 4200.0Mil, and the communication efficiency is improved by about 61%; on the MovieLens 1M dataset, the average amount of parameters transmitted per iteration of FedNCF is 47436.8Mil, and the average amount of parameters transmitted per iteration of Priv-FedNCF-Sub-Compress is 4421.2Mil, which greatly reduces the communication overhead. This is because the Priv-FedNCF-Sub-Compress algorithm combines the sub-model selection strategy of the shallow network and the gradient compression strategy of the deep network, and significantly reduces the communication cost in federated training by performing sub-model screening on the item feature embedding layer and gradient compression on the deep neural network. In addition, compared with the algorithm DP-FedNCF-DGC that adopts the deep gradient compression strategy, the federated recommendation algorithm based on deep learning proposed in the present invention achieves similar communication efficiency and obtains higher recommendation accuracy, which shows the feasibility and superiority of the method of the present invention.

[0147] In summary, the deep learning-based federated recommendation algorithm proposed in the present invention not only ensures the quality of recommendation, but also realizes the privacy protection of user data and significantly improves the communication efficiency.

[0148] Example 2

[0149] This embodiment provides a privacy-preserving federated recommendation system, including:

[0150] The model updating module is used to update the recommendation model of the central server, that is, the global model, by adopting a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning to obtain an updated recommendation model.

[0151] The recommendation module is used to obtain the interaction data set of the real interaction index between the user and the item, and input it into the updated recommendation model to obtain the item recommendation result for the user.

[0152] The system provided in this embodiment is used to execute the above-mentioned method embodiments. Please refer to the above-mentioned embodiments for specific processes and detailed contents, which will not be repeated here.

[0153] Example 3

[0154] This embodiment provides a processing device corresponding to the privacy protection federal recommendation method provided in Embodiment 1. The processing device can be applicable to a client processing device, such as a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the method of Embodiment 1.

[0155] The processing device includes a processor, a memory, a communication interface and a bus, and the processor, the memory and the communication interface are connected through the bus to complete mutual communication. The memory stores a computer program that can be run on the processing device, and the processing device executes the privacy protection federation recommendation method provided in this embodiment 1 when running the computer program.

[0156] In some implementations, the memory may be a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory.

[0157] In some other implementations, the processor may be a central processing unit (CPU), a digital signal processor (DSP), or other general-purpose processors of various types, which are not limited herein.

[0158] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0159] Those skilled in the art will understand that the structure of the above-mentioned computing device is only a partial structure related to the solution of the present invention, and does not constitute a limitation on the computing device to which the solution of the present invention is applied. The specific computing device may include more or fewer components, or combine certain components, or have a different arrangement of components.

[0160] Example 4

[0161] This embodiment provides a computer program product corresponding to the privacy-preserving federal recommendation method provided in Embodiment 1. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing the privacy-preserving federal recommendation method described in Embodiment 1.

[0162] Computer readable storage media can be tangible devices that hold and store instructions used by instruction execution devices. Computer readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any combination thereof.

[0163] The above embodiment provides a computer-readable storage medium, whose implementation principle and technical effect are similar to those of the above method embodiment, and will not be repeated here.

[0164] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0165] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0166] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0167] The above embodiments are only used to illustrate the present invention, wherein the structure, connection mode and manufacturing process of each component may be changed. Any equivalent transformations and improvements based on the technical solution of the present invention should not be excluded from the protection scope of the present invention.

Claims

1. A privacy-preserving federated recommendation method, characterized in that: include: Adopting a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning to update the recommendation model of the central server and obtain an updated recommendation model; The interaction dataset of the real interaction index between the user and the item is obtained and input into the updated recommendation model to obtain the item recommendation result for the user.

2. A privacy-preserving federated recommendation method as claimed in claim 1, characterized in that: The federated recommendation algorithm based on matrix decomposition is used to update the recommendation model of the central server to obtain an updated recommendation model, including: A sub-model selection algorithm based on differential privacy is used to filter the sub-models of the recommended model of the central server based on the interaction data of the real interaction index between the client and the item, and the sub-model set for subsequent transmission is selected; A federated recommendation algorithm based on matrix decomposition is adopted to update the recommendation model based on the sub-models in the screened sub-model set to obtain an updated recommendation model.

3. A privacy-preserving federated recommendation method as claimed in claim 2, characterized in that: The sub-model selection algorithm based on differential privacy is adopted to screen the sub-models of the recommended model of the central server based on the interaction data of the real interaction index between the client and the item, and screen out the sub-model set for subsequent transmission, including: The client locally converts the interaction data of the real interaction index between itself and the item into a binary interaction vector; The client uses a random response mechanism to perturb the interaction vector, generate a perturbation vector that satisfies ε1-local differential privacy, and upload it to the central server. ε1 is the privacy budget when perturbing the interaction data. The central server aggregates the received disturbance vectors into a disturbance interaction matrix; The central server adopts an estimation method based on the maximum likelihood function to determine the true interaction frequency of each item according to the perturbation interaction matrix, screens out items whose true interaction frequency exceeds the preset threshold, and uses the eigenvector matrix corresponding to the item as a sub-model for subsequent transmission and adds it to the sub-model set.

4. A privacy-preserving federated recommendation method as claimed in claim 2, characterized in that: The federated recommendation algorithm based on matrix decomposition is used to update the recommendation model based on the sub-models in the screened sub-model set to obtain an updated recommendation model, including: For each round of global training, the central server calculates the number of clients participating in the training according to the sampling ratio of the clients, and randomly selects the corresponding number of clients to participate in the training; The central server sends the sub-models in the filtered sub-model set to the selected client; The client participating in this round of training downloads the sub-model of the current round from the central server, trains the sub-model locally using local data, and updates the user feature vector locally; After completing the model training locally, the client calculates the feature vector gradient of each item corresponding to the sub-model locally; The client performs gradient clipping on the calculated feature vector gradient and perturbs it using a gradient perturbation strategy based on the Laplace mechanism to generate a perturbed gradient that satisfies ε2-differential privacy and uploads it to the central server. ε2 is the privacy budget in the gradient perturbation stage. The central server performs weighted aggregation on the perturbation gradients that satisfy ε2-differential privacy uploaded by the client and updates the recommendation model; Repeat the above steps for global training until the preset rounds of training are completed to obtain an updated recommendation model.

5. A privacy-preserving federated recommendation method as claimed in claim 1, characterized in that: The federated recommendation algorithm based on deep learning is used to update the recommendation model of the central server to obtain an updated recommendation model, including: A sub-model selection algorithm based on differential privacy is used to screen the shallow network sub-models in the recommendation model of the central server based on the interaction data of the real interaction index between the client and the item, and obtain the shallow network sub-model; A federated recommendation algorithm based on deep learning is adopted to update the recommendation model based on the deep network model parameters of the recommendation model itself and the screened shallow network sub-model to obtain an updated recommendation model.

6. A privacy-preserving federated recommendation method as claimed in claim 5, characterized in that: The federated recommendation algorithm based on deep learning is used to update the recommendation model based on the deep network model parameters of the recommendation model itself and the screened shallow network sub-model to obtain an updated recommendation model, including: For each round of global training, the central server calculates the number of clients participating in the training according to the sampling ratio of the clients, and randomly selects the corresponding number of clients to participate in the training; The central server sends the deep network model parameters and the selected shallow network sub-models in the recommended model to the selected client; The clients participating in this round of training download the shallow network sub-model and deep network model parameters from the central server, train the shallow network sub-model and deep network model parameters using local data, and update the user feature vector locally; After completing the model training locally, the client calculates the updated shallow network sub-model and updated deep network model parameters locally; The client performs a gradient compression strategy on the updated deep network model parameters; The client performs gradient clipping on the updated shallow network sub-model and the deep network model parameters after the gradient compression strategy; The client perturbs the shallow network sub-model and deep network model parameters after gradient clipping to generate shallow network sub-model and deep network model parameters that meet ε3-differential privacy, and uploads them to the central server. ε3 is the privacy budget for gradient perturbation using the Gaussian mechanism. The central server aggregates and optimizes the parameters of the shallow network sub-model and deep network model that satisfy ε3-differential privacy, and updates the recommendation model; Repeat the above steps for global training until the preset rounds of training are completed to obtain an updated recommendation model.

7. A privacy-preserving federated recommendation method as claimed in claim 6, characterized in that: The client performs a gradient compression strategy on the updated deep network model parameters, including: The client performs gradient sparse processing on the updated deep network model parameters to obtain the deep network model parameters after gradient sparse processing; The client performs local gradient clipping on the deep network model parameters after gradient sparsification processing to obtain the deep network model parameters after local gradient clipping.

8. A privacy-preserving federated recommendation system, characterized in that: include: A model updating module is used to update the recommendation model of the central server by adopting a federated recommendation algorithm based on matrix decomposition or a federated recommendation algorithm based on deep learning to obtain an updated recommendation model; The recommendation module is used to obtain the interaction data set of the real interaction index between the user and the item, and input it into the updated recommendation model to obtain the item recommendation result for the user.

9. A processing device, characterized in that: It includes computer program instructions, wherein when the computer program instructions are executed by a processing device, they are used to implement the steps corresponding to the privacy protection federal recommendation method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, wherein the computer program instructions, when executed by a processor, are used to implement the steps corresponding to the privacy protection federal recommendation method described in any one of claims 1 to 7.

Images