Privacy protection method for resisting label reasoning attack in longitudinal federated learning

Abstract

The invention discloses a privacy protection method for resisting label reasoning attacks in longitudinal federated learning, which comprises the following steps: S1, acquiring intermediate parameters of a local model uploaded by each client, and uploading the parameters to a server, including preprocessing target data; s2, the server side optimizes a loss function of the top model; s3, the server side trains the top model by receiving the intermediate parameters of the clients, and updates the gradient of the model through a gradient descent algorithm; in the process, the server side calculates the gradient of each client side, a proper amount of noise is introduced into the gradient, and the size of the local gradient is adjusted in a self-adaptive mode, so that iterative updating of model parameters is achieved. The process aims to realize collaborative optimization of the model while protecting data privacy. By means of the method, model optimization and updating can be effectively carried out, the model optimization efficiency is improved, the defense capacity on label reasoning attacks can be enhanced, and data privacy and safety are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of federated machine learning, and in particular to a privacy protection method for resisting label inference attacks in vertical federated learning. Background Art

[0002] In existing vertical federated learning environments, attackers may indirectly infer private information of clients through model outputs or learned parameters. Non-server clients attempt to infer label information through gradient data sent by the server. Such attacks include passive attacks (using indirect label data to optimize the attacker's local model for label prediction) and direct attacks (using the gradient sign of the final prediction layer to evaluate prediction accuracy, identify correct or incorrect predictions through the cross entropy loss function, and infer label information).

[0003] When performing distributed training on mobile devices, the client can easily infer the data labels held by the server, causing privacy leakage of the server. If traditional privacy protection methods are directly used to solve the privacy leakage problem, although the privacy security of the model is improved, the accuracy of the model prediction is reduced. Summary of the invention

[0004] The present invention provides a privacy protection method for resisting label inference attacks in vertical federated learning, which can not only effectively defend against label inference attacks, but also improve the accuracy of model prediction.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] A privacy protection method for resisting label inference attacks in vertical federated learning, characterized by comprising the following steps:

[0007] S1. Obtain the intermediate parameters of the local model uploaded by each client, each client trains the intermediate parameters, and transmits the trained logit values ​​of the intermediate parameters to the server; the local model is the bottom model held by the client in vertical federated learning;

[0008] S2. Optimize the top model loss function on the server side. Add the center average loss function to the cross entropy loss function of the top model, and make numerical changes to the original gradient so that the label cannot be inferred based on the symbolic relationship.

[0009] S3. The server trains the optimized top model through the intermediate parameter logit values ​​uploaded by each client, and updates the gradient through the gradient descent algorithm; at the same time, the gradient of each client is calculated, and an appropriate amount of noise is added to the gradient, the size of the local gradient is adaptively adjusted, and steps S1 to S3 are iteratively executed.

[0010] Furthermore, in step S1, under the vertical federated learning framework, each client preprocesses the target data, and the processed data is trained in the local bottom model. The intermediate parameters are generated during the training process, which are reflected as logit values. The specific steps for preprocessing the target data are:

[0011] The target data is divided into several data sets, and uniform random sampling is performed to obtain the batch size of the data set used for training in each iteration, and the target data set is obtained; each client first receives the initialized bottom model parameters, which provide a starting point for model training, and then each client uses the target data set calculated by the paradigm boundary to train its own bottom model. During this training process, the bottom model will learn how to extract features from the input data and generate intermediate parameters, which are usually expressed in the form of logit values, and the logit values ​​are encrypted and transmitted to the server.

[0012] Furthermore, in step S3, after receiving the intermediate parameter logit value uploaded by each client, the server immediately starts the top model training process, calculates the gradient of the composite loss function, and dynamically updates the model parameters through the back propagation algorithm; the composite loss function is a combination of the cross entropy loss function and the central average loss function in step S2.

[0013] Furthermore, in step S3, the server calculates the gradient of each client, adds noise to the gradient, and adaptively adjusts the local gradient size, including:

[0014] The gradients of each client calculated by the top model are stored in a vector in order to obtain a first vector;

[0015] Sampling generates corresponding Gaussian noise, and setting local noise control parameters Pearson coefficient, Euclidean distance and cosine similarity, adding the generated Gaussian noise to the original gradient to form a noisy gradient, and obtaining a second vector;

[0016] The Pearson coefficient, Euclidean distance and cosine similarity between the first vector and the second vector are calculated. When the three parameters are within the set control parameter range, the noisy gradient is sent to each client to update the bottom model.

[0017] Compared with the prior art, the present invention has the following advantages or technical effects:

[0018] By standardizing the data and calculating the intermediate parameters of the local model, the intermediate parameters are then transmitted to the server. After receiving these input parameters, the server concatenates the parameters and calculates the composite loss function, generates gradients, and protects privacy by adding noise. Finally, the server transmits the processed gradients back to the client, and the client uses these gradients to update the local model parameters and complete a full training iteration. This method maintains the accuracy of the model while protecting privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present invention and its features, configurations and advantages will become more apparent by reading the detailed description of non-limiting embodiments with reference to the following drawings. The same reference numerals indicate the same parts throughout the drawings. The drawings are not drawn to scale, but rather to illustrate the subject matter of the present invention.

[0020] Figure 1 It is an overall flow chart of a privacy protection method for resisting label inference attacks in vertical federated learning provided by the present invention;

[0021] Figure 2 It is a specific flow chart of a client data preprocessing algorithm in a privacy protection method for resisting label inference attacks in vertical federated learning provided by the present invention;

[0022] Figure 3 It is a specific flow chart of loss function optimization in a privacy protection method for resisting label inference attacks in vertical federated learning provided by the present invention;

[0023] Figure 4 It is a specific flow chart of performing gradient noise perturbation in a communication optimization method based on federated learning provided by the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but they are not intended to limit the present invention.

[0025] In the vertical federated learning algorithm, the client and the server jointly train a model. The client only has data, while the server has labels. Malicious clients will try to infer the labels on the server. In order to solve the privacy leakage problem caused by the existing technology when the server transmits the gradient to the client, if the traditional gradient transmission method is directly used, it will cause the server's label leakage problem. If gradient compression and other methods are used, it will cause the accuracy loss of model training. Therefore, as shown in the attached Figure 1As shown, the present invention provides a privacy protection method for resisting label inference attacks in vertical federated learning. Specifically, when calculating the loss function on the server side, the calculation of the loss function is optimized, and when the gradient is transmitted from the server side to the client side, the gradient is noise-perturbed, and the pre-set conditions need to be met. This can protect the security of the server-side labels without affecting the training effect of the model.

[0026] First, each client needs to pre-process the local target data and then train the local bottom model. This step is shown in the attached Figure 2 As shown, specifically including:

[0027] Data standardization: Each client i normalizes its local dataset D i Normalize the data. This is done by subtracting the mean and dividing by the standard deviation. Specifically, for each data sample (x ij ,y ij ), the standardized formula is: Among them, μ i is the mean of the data of client i, σ i is the standard deviation of the data for client i.

[0028] The client then trains the local model using the standardized data. i , where θ i Represents the model parameters. The training process generates an intermediate output h for each sample ij , indicating that the model is given a standardized input x' ij The output under the condition of h is calculated as follows: ij =f i (θ i ,x' ij ).

[0029] After training the local bottom model, the client will calculate the intermediate output h ij Transmitted to the server for further processing and calculation. The transmission of intermediate outputs ensures that each client's local data will not be directly leaked, and only the necessary model output results are transmitted.

[0030] Top-level model training: The server is responsible for receiving and processing the encrypted intermediate outputs from multiple clients, and then performing aggregation and top-level model training. The following are the detailed steps and mathematical descriptions: Receive and decrypt intermediate outputs: Receive the encrypted intermediate outputs Enc(h1), Enc(h2), …, Enc(h K-1 ), and decrypt to get the original intermediate output {h1,h2,…,h K-1}. These intermediate outputs are the results of local model processing and are used for subsequent model aggregation. The server will decrypt the intermediate output {h1,h2,…,h K-1} to obtain the aggregated output vector H = Aggregate(h1,h2,…,h K-1 ), used to integrate information from multiple clients. Initialize top-level model parameters: Initialize the top-level model parameters θ top , these parameters will be used as the initial state of the top-level model and will be gradually adjusted during the training process to adapt to the characteristics of the overall data.

[0031] Top-level model training and parameter update: The top-level model training uses the aggregated output H to train the top-level model. The goal is to minimize the composite loss function L(x,c) and update the top-level model parameters θ. top :

[0032] L(x,c)==L CE (x,c)+λL MSE (x,c)

[0033] Where, the predicted score of category c. Mean square error loss function where y i is the true label, C i is the predicted output of the model. Calculate the composite gradient and update the top-level model parameters First calculate the composite loss function L(C,x) for the output y i The gradient is:

[0034]

[0035] Among them, the cross entropy loss function L CE And the mean square error loss function L MSE The gradients of are calculated as:

[0036]

[0037] Calculate the composite gradient First calculate the composite loss function L(α,c) for the output y i The gradient of is expressed as follows: Among them, the cross entropy loss function L CE And the mean square error loss function L MSE The gradients are:

[0038]

[0039] The final composite gradient is:

[0040] Update the top model parameters using gradient descent or other optimization algorithms to update the top model parameters θtop , the update rules are as follows: Where η is the learning rate.

[0041] The server adds noise to the gradient to protect privacy. The server adds noise to the calculated gradient g ik Perform noise injection processing. This step is as shown in the attached Figure 4 As shown, the specific steps are as follows:

[0042] Gradient sorting: Sort the gradients to get the sorted gradient V and index S. V, S = Sort(flatten(g ik )) Initialize similarity gradient: Initially, the similarity gradient is set to the original gradient. ik =g ik Generate noisy gradients: Try to generate up to R noise gradients until the similarity threshold is met. When the number of generated times is less than R. Constructing gradient noise from normal distribution follows N(0,σ 2 ). Calculate the cosine distance S between the noise gradient and the original gradient cos , Euclidean distance S euc and Pearson correlation coefficient S pear .

[0043] S cos =CosineDistance(i,V)

[0044] S euc =EuclideanDistance(i,V)

[0045] S pear =PearsonCorrelation(i,V)

[0046] Gradient update and feedback under privacy protection: Update after similarity threshold is met If the similarity threshold is met, the similarity gradient is updated. The specific conditions are as follows:

[0047] S cos ≤T cos and S euc ≤T euc and S pear ≥T pear .

[0048] If the above conditions are met, then update: g ik Feedback to the client will be the updated gradient g ik Transmitted back to the client. After the client receives the gradients transmitted back by the server, it uses these gradients to update the local model parameters. Update the local model parameters using the received similar gradients g ik , update the local model parameters θ i :θi ←θ i -ηg ik Where η is the learning rate. Repeat the above process in multiple iterations until the model converges or reaches the preset stopping condition.

[0049] The present invention standardizes the data and calculates the intermediate parameters of the local model, and then transmits the intermediate parameters to the server. After receiving these input parameters, the server concatenates the parameters and calculates the composite loss function, generates gradients, and protects privacy by adding noise. Finally, the server transmits the processed gradients back to the client, and the client uses these gradients to update the local model parameters and complete a complete training iteration. This method maintains the accuracy of the model while protecting privacy.

[0050] The preferred embodiments of the present invention are described above; it should be understood that the present invention is not limited to the above-mentioned specific embodiments, and the devices and structures not described in detail should be understood to be implemented in a common manner in the art; any technician familiar with the art can make many possible changes and modifications without departing from the technical solution of the present invention, or modify them into equivalent embodiments with equivalent changes, which does not affect the essential content of the present invention; therefore, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of protection of the technical solution of the present invention.

Claims

1. A privacy protection method for resisting label inference attacks in vertical federated learning, characterized in that: The steps include: S1. Obtain the intermediate parameters of the local model uploaded by each client, each client trains the intermediate parameters, and transmits the trained logit values ​​of the intermediate parameters to the server; the local model is the bottom model held by the client in vertical federated learning; S2. Optimize the top model loss function on the server side, and add a central average loss function on the basis of the cross entropy loss function of the top model loss function; S3. The server trains the optimized top model through the intermediate parameter logit values ​​uploaded by each client, and updates the gradient through the gradient descent algorithm; at the same time, the gradient of each client is calculated, and noise is added to the gradient, the size of the local gradient is adaptively adjusted, and steps S1 to S3 are iteratively executed.

2. According to claim 1, a privacy protection method for resisting label inference attacks in vertical federated learning is characterized in that: In step S1, under the vertical federated learning framework, each client preprocesses the target data, and the processed data is trained in the local bottom model. The intermediate parameters are generated during the training process, which are reflected as logit values.

3. According to claim 2, a privacy protection method for resisting label inference attacks in vertical federated learning is characterized in that: The specific steps for preprocessing the target data are: The target data is divided into several data sets, and a uniform random sampling operation is performed to obtain the batch size of the data set used for training in each iteration, thereby obtaining the target data set; Calculate the paradigm boundary for the target data set; Each client obtains the initialized bottom model parameters, trains the local bottom model with the target data set after the paradigm boundary calculation, calculates the intermediate parameter logit value of the bottom model, and encrypts the logit value and transmits it to the server.

4. According to claim 1, a privacy protection method for resisting label inference attacks in vertical federated learning is characterized in that: In step S3, after receiving the intermediate parameter logit value uploaded by each client, the server immediately starts the top model training process, calculates the gradient of the composite loss function, and dynamically updates the model parameters through the back propagation algorithm; the composite loss function is a combination of the cross entropy loss function and the central average loss function in step S2.

5. According to claim 1, a privacy protection method for resisting label inference attacks in vertical federated learning is characterized in that: In step S3, the server calculates the gradient of each client, adds noise to the gradient, and adaptively adjusts the local gradient size, including: The gradients of each client calculated by the top model are stored in a vector in order to obtain a first vector; Sampling generates corresponding Gaussian noise, and setting local noise control parameters Pearson coefficient, Euclidean distance and cosine similarity, adding the generated Gaussian noise to the original gradient to form a noisy gradient, and obtaining a second vector; The Pearson coefficient, Euclidean distance and cosine similarity between the first vector and the second vector are calculated. When the three parameters are within the set control parameter range, the noisy gradient is sent to each client to update the bottom model.

Images