Federal learning data processing method based on privacy protection

Abstract

The invention discloses a federal learning data processing method based on privacy protection, and the method comprises the following steps: S1, a client uses local data to train a generator of a generative adversarial network, and generates virtual data similar to the local data in distribution; s2, setting three privacy protection levels according to the privacy sensitivity of the local data; s3, performing model updating operation by using a homomorphic encryption technology; s4, utilizing a dynamic weight optimization mechanism based on a multi-arm bandit algorithm to obtain a priority processing data set; s5, preliminarily updating the global model, analyzing generated data through a reverse inference detection mechanism, and judging whether a privacy disclosure risk exists or not; s6, the server feeds back the updated global model to the client, and the client continues personalized model training in combination with local data; and S7, generating new virtual data, and carrying out the next round of global model training. According to the method, the generative adversarial network, differential privacy and homomorphic encryption are combined, so that efficient federated learning under privacy protection is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning and privacy protection, and in particular to a federated learning data processing method based on privacy protection. Background Art

[0002] With the rapid development of big data and artificial intelligence technologies, machine learning models have shown great potential in many fields. However, traditional centralized machine learning models usually rely on centralizing all data to a server or data center for training, which poses a severe challenge to data privacy. Especially in scenarios involving personal sensitive information such as medical care, finance, and social networks, the privacy and security of user data have become the focus of attention of all parties. In order to meet this challenge, Federated Learning (FL) technology came into being. Federated learning allows multiple clients (such as personal devices or enterprise servers) to collaboratively train global models without sharing local data. This approach effectively protects data privacy through distributed computing while maintaining efficient model training. However, existing federated learning systems still face multiple technical challenges.

[0003] First, traditional federated learning usually relies on each client to upload the gradient information of the model, and the server is responsible for aggregating the gradient and updating the global model. Although the client does not need to upload the original data directly, the information in the model gradient can still be used by malicious attackers to infer the client's sensitive data. This problem is called "reverse inference attack" or "model inference attack". The attacker can gradually restore the original data by collecting multiple rounds of gradient update information. This risk is particularly serious for clients with fewer data samples or significant features. Therefore, how to further protect the privacy of model gradients and data in federated learning has become an urgent problem to be solved.

[0004] In order to address this privacy leakage risk, differential privacy (DP) technology has been gradually introduced into federated learning in recent years. Differential privacy injects random noise into the gradients uploaded by the client, so that even if the attacker obtains these gradients, he cannot accurately infer individual data. Despite this, the application of differential privacy technology still faces a trade-off between performance and privacy protection. Too much injected noise will lead to a decline in model performance, while too little injected noise will not effectively protect privacy. Therefore, how to reasonably set the intensity of noise to achieve a balance between privacy protection and model performance is still an important defect in existing technologies.

[0005] In addition, Generative Adversarial Networks (GAN) technology has also been introduced into federated learning to generate virtual data instead of real data or gradients for uploading. Through adversarial training of the generator and the discriminator, GAN can generate virtual data with a distribution similar to that of real data, thereby achieving "masking" of data privacy. However, the application of existing GAN models in federated learning also has limitations. First, the quality of the generated virtual data is unstable, and there may be a large difference between the virtual data and the real data, which affects the training effect of the global model; secondly, the training process of GAN itself is prone to non-convergence or mode collapse, which makes it difficult to ensure the quality of the generated data. Therefore, it is still an unresolved problem to effectively combine GAN technology in federated learning to ensure the quality of virtual data and the privacy protection effect.

[0006] In addition, existing federated learning systems usually treat data from different clients in an equal manner, failing to fully consider the importance of each client's data and the differences in their contributions to the global model. The data uploaded by each client may contribute differently to the optimization of the global model, especially for clients with rich data or more representative data distribution, whose uploaded data should be given higher weights. Therefore, how to dynamically adjust the weight of the data uploaded by each client when the global model is updated to maximize the use of valid data while avoiding excessive reliance on noise data or redundant data is another defect worthy of attention in existing federated learning technology.

[0007] Finally, there are few effective privacy risk detection mechanisms introduced in existing federated learning systems, especially in dealing with reverse inference attacks. Some malicious attackers may perform reverse inference through the data or gradients uploaded by the client, and gradually restore the client's original data. However, existing technologies lack detection and defense methods for this type of attack. Even if differential privacy or homomorphic encryption technology is used, once the potential risk of privacy leakage cannot be detected, the client's data may still be leaked. Therefore, it is necessary to introduce an active reverse inference detection mechanism in the federated learning system to analyze the distribution and similarity of the uploaded data to determine whether the data has a potential risk of leakage, and automatically adjust the generation mode of the client generator when necessary to increase the randomness or noise intensity of the data, thereby reducing the possibility of privacy leakage.

[0008] Therefore, how to provide a privacy-preserving federated learning data processing method is an urgent problem that technicians in this field need to solve. Summary of the invention

[0009] One purpose of the present invention is to propose a method for processing federated learning data based on privacy protection. The present invention combines generative adversarial networks, differential privacy and homomorphic encryption technology, and realizes efficient federated learning training while ensuring data privacy protection through dynamic weight optimization and reverse inference detection mechanism. By generating virtual data to replace real data upload, homomorphic encryption to ensure model updates in an encrypted state, and differential privacy to protect sensitive data, the present invention greatly improves the privacy security of the system. At the same time, high-value data is processed preferentially through a dynamic weight optimization mechanism, and combined with personalized model training, the training efficiency and performance of the global model are significantly improved, with the advantages of strong privacy protection, good training effect and high flexibility.

[0010] A method for processing federated learning data based on privacy protection according to an embodiment of the present invention includes the following steps:

[0011] S1. The client uses local data to train the generator of the generative adversarial network to generate virtual data with a distribution similar to that of local data.

[0012] S2. The client sets three privacy protection levels according to the privacy sensitivity of local data. The first privacy protection level only uploads virtual data. The second privacy protection level uploads virtual data with differential privacy noise processing. The third privacy protection level allows uploading of some real model gradients.

[0013] S3. After receiving virtual data or virtual data processed with differential privacy, the server uses homomorphic encryption technology to perform model update operations in an encrypted state.

[0014] S4. The server uses a dynamic weight optimization mechanism based on the multi-armed bandit algorithm to calculate and dynamically adjust the importance weight of the data uploaded by the client, identify the client data that contributes most to the global model, and obtain the priority processing data set;

[0015] S5. Based on the obtained priority processing data set, the global model is preliminarily updated, and the generated data is analyzed through the reverse inference detection mechanism to determine whether there is a privacy leakage risk. If the reverse inference risk is detected, the server automatically adjusts the client generator to increase the randomness and noise of the generated data;

[0016] S6. The server feeds back the updated global model to the client. After receiving the global model, the client continues personalized model training in combination with local data.

[0017] S7. After completing the personalized model training, the client generates new virtual data and uploads it to the server to participate in the next round of global model training.

[0018] Optionally, the S1 specifically includes:

[0019] S11. Define the client local dataset as where x i Represents input data, y i represents the corresponding label, and n represents the number of data samples;

[0020] S12, train the generator G(z;θ) on the client G ), the generator G receives random noise z as input, the noise z is sampled from the standard normal distribution z~N(0,1), and the generated virtual data is expressed as where θ G Represents the parameters of the generator;

[0021] S13, discriminator D(x;θ D ) and the generator G(z;θ G ) is optimized through adversarial training. The discriminator D determines whether the input data x comes from the real data set D local Or dummy data generated by the generator where θ D represents the parameters of the discriminator;

[0022] S14, the loss functions of the generator and discriminator include adversarial loss and feature matching loss:

[0023]

[0024] Among them, L(G,D,F) represents the overall loss function of the generator G, the discriminator D and the feature extraction function F, E represents the expected value, and x represents the value from the real data set D local The input data, p data (x) represents the distribution of real data, D(x) represents the output of the discriminator D for x, D(G(z)) represents the output of the discriminator D for the generated data G(z), and p z (z) represents the distribution of random noise z, represents the Euclidean distance between x and the features extracted by the generated data G(z) in the discriminator, and λ represents the weight coefficient;

[0025] S15, the client locally alternately optimizes the parameters θ of the generator G and the discriminator D G and θ D , the generator optimizes the generated virtual data distribution by minimizing the loss of generated data, and the discriminator optimizes by maximizing the ability to distinguish between real data and generated data;

[0026] S16. After the generator G is trained, the client generates a virtual data set based on local data. Where m represents the number of generated virtual data samples.

[0027] Optionally, the S2 specifically includes:

[0028] S21, the client based on the local data set D local Calculate the privacy sensitivity score s for each piece of data:

[0029] s=α·H(x)+β·I(x)+γ·U(x)+δ·R(x);

[0030] Among them, α, β, γ and δ represent adjustment parameters;

[0031]

[0032] Among them, H(x) represents the information entropy of data x, m represents the number of feature dimensions of data x, and p(x i ) represents the probability of the i-th feature of data x;

[0033]

[0034] Among them, I(x) represents the sensitive information strength of data x, N represents the number of sensitive features, and w j represents the weight of the jth sensitive feature, f j (x) represents the sensitivity of the jth sensitive feature;

[0035]

[0036] Among them, U(x) represents the uniqueness of data x, |{x'∈D|x'=x}| represents the number of data samples that are the same as data x, and |D| represents the number of samples in the entire data set;

[0037]

[0038] Among them, R(x) represents the reconstruction risk of data x, M represents the number of features, and r k (x) represents the restoration degree of the kth feature, σ k Indicates the strength of the k-th feature encryption or perturbation;

[0039] S22. The client determines the privacy protection level according to the calculated privacy sensitivity score s:

[0040]

[0041] Among them, P(s) represents the privacy protection level, s1 and s2 represent the preset privacy protection thresholds;

[0042] S23, when P(s)=1, it is at the first privacy protection level, and the client uploads only the generated virtual data, without any real data samples;

[0043] S24, when P(s) = 2, it is in the second privacy protection level. When the client uploads virtual data, it performs differential privacy processing on the local model gradient. The noise added to the gradient comes from the normal distribution N(0,σ 2 ), where σ represents the standard deviation of the noise;

[0044] S25. When P(s)=3, it is at the third privacy protection level. The client allows some real gradients to be uploaded after slight perturbation, and uploads the generated virtual data at the same time.

[0045] Optionally, the S3 specifically includes:

[0046] S31. After receiving the data uploaded by the client, the server performs homomorphic encryption. During the encryption process, the server performs privacy enhancement on the data:

[0047] E(g i )=Enc(g i ·ξ i ,k);

[0048] Among them, g i represents the local gradient of the i-th client, Enc(·,k) represents the homomorphic encryption algorithm based on key k, ξ i Represents the privacy sensitivity weight:

[0049]

[0050] Among them, τ represents the adjustment parameter, s i represents the privacy sensitivity score;

[0051] S32. On the server side, the privacy protection model update formula based on homomorphic encryption is:

[0052]

[0053] Where E(θ′) represents the encrypted parameter update of the global model, E(θ) represents the parameter vector of the current encrypted state of the global model, η represents the learning rate, W represents the number of clients, and E(g i ) represents the homomorphically encrypted gradient vector uploaded by the i-th client, ∥E(g i )∥2 represents the encrypted gradient E(g i ), ∈ represents the smoothness term;

[0054] S33, the updated parameters of the global model remain encrypted, and the server sends the updated global model parameters back to the client in encrypted form;

[0055] S34, after receiving the encrypted global model parameters returned by the server, the client uses the client's decryption key k to decrypt the model parameters;

[0056] S35. The client combines the decrypted global model parameters with the local model, performs personalized training based on local data, and all transmitted data is processed through homomorphic encryption.

[0057] Optionally, the S4 specifically includes:

[0058] S41. The server performs a preliminary evaluation on the data uploaded by each client i and dynamically adjusts the weight of the client using the multi-armed bandit algorithm based on privacy sensitivity:

[0059]

[0060] Among them, ω i represents the weight of the i-th client, represents the instant reward of the i-th client in the t-th round, represents the privacy sensitivity of the i-th client in the t-th round, ranging from T i represents the number of times the i-th client is selected, and T represents the total number of times the server processes all client data;

[0061] S42. Calculation of privacy sensitivity score based on client uploaded data

[0062]

[0063] Among them, ρ represents the adjustment parameter, represents the privacy sensitivity score of the i-th client in the t-th round, and s0 represents the baseline value of privacy sensitivity;

[0064] S43, the server calculates the weight of each client according to ω i Prioritize the uploaded data. The data uploaded by the client with a higher weight has a higher priority in the sorting. The server selects the client data with a higher weight to update the global model.

[0065] S44. After each round of training, the server adjusts the weight of the client based on the performance feedback of the global model:

[0066]

[0067] in, Indicates the improvement of the global model accuracy by the data uploaded by the i-th client, Indicates the accuracy improvement value of the client that has the greatest improvement in the accuracy of the global model in the current round, ∥E(g i)∥2 represents the encrypted gradient norm of the i-th client, Q represents the number of participating clients;

[0068] The above formula introduces the influence of the gradient norm, which is used to reward clients with greater contributions and lower privacy sensitivity, so that clients with larger gradient scales and more significant contributions to the global model receive higher immediate rewards.

[0069] S45. The server sets the minimum threshold value of the weight ω min , used to ensure that each client is selected at least once within a period of time:

[0070]

[0071] Among them, κ represents the balance parameter, ∈ represents the smoothing term;

[0072] The above formula takes into account the combined impact of privacy sensitivity and gradient contribution, ensuring that clients with smaller gradients but lower privacy sensitivity also have the opportunity to receive priority treatment in weight calculation, thus preventing some clients from being ignored for a long time.

[0073] S46, the server dynamically adjusts the weight ω i Select the data sets that are prioritized for processing.

[0074] Optionally, the S5 specifically includes:

[0075] S51. The server receives the virtual data uploaded by the client and performs a preliminary analysis of the privacy leakage risk, and determines whether there is a potential reverse inference risk by calculating the distribution difference of the generated data:

[0076]

[0077] Among them, ΔP represents the client local data distribution p local (x i ) and generate data distribution The average difference, p local (x i ) represents local data x i The distribution of Indicates virtual generated data The distribution of , n represents the number of data samples;

[0078] S52, the server generates the similarity coefficient C between the data and the local data by calculation i , assess the potential risk of virtual data leakage:

[0079]

[0080] Among them, f local,j (x i) represents local data x i The value on the jth feature dimension, Indicates the generated data The value at the jth feature dimension, m represents the number of feature dimensions of the data;

[0081] S53, if the server detects C i Exceeding the preset privacy leakage threshold C th , it is considered that there is a high risk of reverse inference, and the server will trigger the adjustment mechanism of the client generator, which increases the randomness and noise of the data:

[0082]

[0083] in, represents the adjusted virtual data, N(0,σ 2 ) indicates zero mean and variance σ 2 Normally distributed noise;

[0084] S54: The server recalculates the distribution difference ΔP and the similarity coefficient C according to the adjusted virtual data. i , if the adjusted data satisfies C i ≤C th , it is considered that the risk of data privacy leakage has been reduced;

[0085] S55, if after multiple adjustments, C is still detected i >C th , the server increases the noise intensity and requires the client to regenerate data.

[0086] The beneficial effects of the present invention are:

[0087] First, the present invention uses generative adversarial network technology to allow the client to generate virtual data with a similar distribution to local data without uploading real data. Compared with the traditional gradient upload mode, virtual data better protects user privacy and avoids the risk of directly exposing data to the server. In addition, through the adversarial training of the discriminator and the generator, the present invention ensures the quality of virtual data, so that it can be effectively used for the training of the global model, avoiding the problem of unstable virtual data quality or mode collapse. This mode of virtual data generation not only improves the level of privacy protection, but also maintains the effective training of the global model.

[0088] In order to further enhance privacy protection, the present invention combines differential privacy technology and homomorphic encryption technology. The client can select different privacy protection levels according to the privacy sensitivity of local data, ensuring that data with higher sensitivity is uploaded only in a virtual form, or injecting differential privacy noise during the upload process. Through homomorphic encryption technology, the server can directly update the model in the encrypted state of the data without decrypting the data uploaded by the client, further improving the privacy security of the system. This design realizes a highly flexible privacy protection mechanism, which can not only perform efficient model training under the premise of ensuring privacy security, but also adjust the protection strategy according to specific privacy needs to ensure the adaptability of the system in different scenarios.

[0089] The present invention also solves the problem in the prior art that the importance of data uploaded by different clients is difficult to quantify by introducing a dynamic weight optimization mechanism of the multi-armed bandit algorithm. This mechanism allows the server to dynamically adjust the weight of the client-uploaded data according to its contribution to the global model, ensuring that high-quality data is given priority in model updates. This dynamic weight optimization mechanism not only avoids the interference of redundant data on the global model, but also effectively improves the training efficiency of the global model. In addition, for highly privacy-sensitive data, the present invention introduces a privacy penalty coefficient to reduce the weight of this data in the global model update, thereby further reducing the risk of privacy leakage.

[0090] In order to deal with reverse inference attacks, the present invention designs a reverse inference detection mechanism. By analyzing the distribution and similarity coefficient of the data uploaded by the client, it can determine in real time whether the generated data has a potential privacy leakage risk. Once the risk is detected, the system will automatically adjust the client's generator to increase the randomness or noise of the generated data to ensure that the similarity between the generated data and the real data is reduced. This mechanism not only enhances the system's defense capabilities against potential attacks, but also ensures that data privacy is more comprehensively protected in high-risk situations.

[0091] In addition, through the introduction of personalized model training, the present invention allows the client to combine local data and global models for personalized optimization, so that each client can not only participate in the training of the global model, but also maintain adaptability to local data. This combination of personalization and global collaborative optimization solves the problem that the global model in traditional federated learning is difficult to adapt to individual differentiated data, and improves the flexibility and accuracy of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0093] Figure 1This is an overall flow chart of a privacy-preserving federated learning data processing method proposed by the present invention;

[0094] Figure 2 A flowchart of dynamically setting the privacy protection level of a privacy protection-based federated learning data processing method proposed by the present invention;

[0095] Figure 3 A schematic diagram of selecting and prioritizing data sets for a privacy-preserving federated learning data processing method proposed in the present invention. DETAILED DESCRIPTION

[0096] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0097] refer to Figure 1-3 , a method for processing federated learning data based on privacy protection, comprising the following steps:

[0098] S1. The client uses local data to train the generator of the generative adversarial network to generate virtual data with a distribution similar to that of local data.

[0099] S2. The client sets three privacy protection levels according to the privacy sensitivity of local data. The first privacy protection level only uploads virtual data. The second privacy protection level uploads virtual data with differential privacy noise processing. The third privacy protection level allows uploading of some real model gradients.

[0100] S3. After receiving virtual data or virtual data processed with differential privacy, the server uses homomorphic encryption technology to perform model update operations in an encrypted state.

[0101] S4. The server uses a dynamic weight optimization mechanism based on the multi-armed bandit algorithm to calculate and dynamically adjust the importance weight of the data uploaded by the client, identify the client data that contributes most to the global model, and obtain the priority processing data set;

[0102] S5. Based on the obtained priority processing data set, the global model is preliminarily updated, and the generated data is analyzed through the reverse inference detection mechanism to determine whether there is a privacy leakage risk. If the reverse inference risk is detected, the server automatically adjusts the client generator to increase the randomness and noise of the generated data;

[0103] S6. The server feeds back the updated global model to the client. After receiving the global model, the client continues personalized model training in combination with local data.

[0104] S7. After completing the personalized model training, the client generates new virtual data and uploads it to the server to participate in the next round of global model training.

[0105] In this implementation, S1 specifically includes:

[0106] S11. Define the client local dataset as where x i Represents input data, y i represents the corresponding label, and n represents the number of data samples;

[0107] S12, train the generator G(z;θ) on the client G ), the generator G receives random noise z as input, the noise z is sampled from the standard normal distribution z~N(0,1), and the generated virtual data is expressed as where θ G Represents the parameters of the generator;

[0108] S13, discriminator D(x;θ D ) and the generator G(z;θ G ) is optimized through adversarial training. The discriminator D determines whether the input data x comes from the real data set D local Or dummy data generated by the generator where θ D represents the parameters of the discriminator;

[0109] S14, the loss functions of the generator and discriminator include adversarial loss and feature matching loss:

[0110]

[0111] Among them, L(G,D,F) represents the overall loss function of the generator G, the discriminator D and the feature extraction function F, E represents the expected value, and x represents the value from the real data set D local The input data, p data (x) represents the distribution of real data, D(x) represents the output of the discriminator D for x, D(G(z)) represents the output of the discriminator D for the generated data G(z), and p z (z) represents the distribution of random noise z, represents the Euclidean distance between x and the features extracted by the generated data G(z) in the discriminator, and λ represents the weight coefficient;

[0112] S15, the client locally alternately optimizes the parameters θ of the generator G and the discriminator D G and θ D , the generator optimizes the generated virtual data distribution by minimizing the loss of generated data, and the discriminator optimizes by maximizing the ability to distinguish between real data and generated data;

[0113] S16. After the generator G is trained, the client generates a virtual data set based on local data. Where m represents the number of generated virtual data samples.

[0114] In this implementation, S2 specifically includes:

[0115] S21, the client based on the local data set D local Calculate the privacy sensitivity score s for each piece of data:

[0116] s=α·H(x)+β·I(x)+γ·U(x)+δ·R(x);

[0117] Among them, α, β, γ and δ represent adjustment parameters;

[0118]

[0119] Among them, H(x) represents the information entropy of data x, m represents the number of feature dimensions of data x, and p(x i ) represents the probability of the i-th feature of data x;

[0120]

[0121] Among them, I(x) represents the sensitive information strength of data x, N represents the number of sensitive features, and w j represents the weight of the jth sensitive feature, f j (x) represents the sensitivity of the jth sensitive feature;

[0122]

[0123] Among them, U(x) represents the uniqueness of data x, |{x'∈D|x'=x}| represents the number of data samples that are the same as data x, and |D| represents the number of samples in the entire data set;

[0124]

[0125] Among them, R(x) represents the reconstruction risk of data x, M represents the number of features, and r k (x) represents the restoration degree of the kth feature, σ k Indicates the strength of the k-th feature encryption or perturbation;

[0126] S22. The client determines the privacy protection level according to the calculated privacy sensitivity score s:

[0127]

[0128] Among them, P(s) represents the privacy protection level, s1 and s2 represent the preset privacy protection thresholds;

[0129] S23, when P(s)=1, it is at the first privacy protection level, and the client uploads only the generated virtual data, without any real data samples;

[0130] S24, when P(s) = 2, it is in the second privacy protection level. When the client uploads virtual data, it performs differential privacy processing on the local model gradient. The noise added to the gradient comes from the normal distribution N(0,σ 2 ), where σ represents the standard deviation of the noise;

[0131] S25. When P(s)=3, it is at the third privacy protection level. The client allows some real gradients to be uploaded after slight perturbation, and uploads the generated virtual data at the same time.

[0132] In this implementation, S3 specifically includes:

[0133] S31. After receiving the data uploaded by the client, the server performs homomorphic encryption. During the encryption process, the server performs privacy enhancement on the data:

[0134] E(g i )=Enc(g i ·ξ i ,k);

[0135] Among them, g i represents the local gradient of the i-th client, Enc(·,k) represents the homomorphic encryption algorithm based on key k, ξ i Represents the privacy sensitivity weight:

[0136]

[0137] Among them, τ represents the adjustment parameter, s i represents the privacy sensitivity score;

[0138] S32. On the server side, the privacy protection model update formula based on homomorphic encryption is:

[0139]

[0140] Where E(θ′) represents the encrypted parameter update of the global model, E(θ) represents the parameter vector of the current encrypted state of the global model, η represents the learning rate, W represents the number of clients, and E(g i ) represents the homomorphically encrypted gradient vector uploaded by the i-th client, ∥E(g i )∥2 represents the encrypted gradient E(g i), ∈ represents the smoothness term;

[0141] S33, the updated parameters of the global model remain encrypted, and the server sends the updated global model parameters back to the client in encrypted form;

[0142] S34, after receiving the encrypted global model parameters returned by the server, the client uses the client's decryption key k to decrypt the model parameters;

[0143] S35. The client combines the decrypted global model parameters with the local model, performs personalized training based on local data, and all transmitted data is processed through homomorphic encryption.

[0144] In this implementation manner, the S4 specifically includes:

[0145] S41. The server performs a preliminary evaluation on the data uploaded by each client i and dynamically adjusts the weight of the client using the multi-armed bandit algorithm based on privacy sensitivity:

[0146]

[0147] Among them, ω i represents the weight of the i-th client, represents the instant reward of the i-th client in the t-th round, represents the privacy sensitivity of the i-th client in the t-th round, ranging from T i represents the number of times the i-th client is selected, and T represents the total number of times the server processes all client data;

[0148] S42. Calculation of privacy sensitivity score based on client uploaded data

[0149]

[0150] Among them, ρ represents the adjustment parameter, represents the privacy sensitivity score of the i-th client in the t-th round, and s0 represents the baseline value of privacy sensitivity;

[0151] S43, the server calculates the weight of each client according to ω i Prioritize the uploaded data. The data uploaded by the client with a higher weight has a higher priority in the sorting. The server selects the client data with a higher weight to update the global model.

[0152] S44. After each round of training, the server adjusts the weight of the client based on the performance feedback of the global model:

[0153]

[0154] in, Indicates the improvement of the global model accuracy by the data uploaded by the i-th client, Indicates the accuracy improvement value of the client that has the greatest improvement in the accuracy of the global model in the current round, ∥E(g i )∥2 represents the encrypted gradient norm of the i-th client, Q represents the number of participating clients;

[0155] The above formula introduces the influence of the gradient norm, which is used to reward clients with greater contributions and lower privacy sensitivity, so that clients with larger gradient scales and more significant contributions to the global model receive higher immediate rewards.

[0156] S45. The server sets the minimum threshold value of the weight ω min , used to ensure that each client is selected at least once within a period of time:

[0157]

[0158] Among them, κ represents the balance parameter, ∈ represents the smoothing term;

[0159] The above formula takes into account the combined impact of privacy sensitivity and gradient contribution, ensuring that clients with smaller gradients but lower privacy sensitivity also have the opportunity to receive priority treatment in weight calculation, thus preventing some clients from being ignored for a long time.

[0160] S46, the server dynamically adjusts the weight ω i Select the data sets that are prioritized for processing.

[0161] In this implementation manner, S5 specifically includes:

[0162] S51. The server receives the virtual data uploaded by the client and performs a preliminary analysis of the privacy leakage risk, and determines whether there is a potential reverse inference risk by calculating the distribution difference of the generated data:

[0163]

[0164] Among them, ΔP represents the client local data distribution p local (x i ) and generate data distribution The average difference, p local (x i ) represents local data x i The distribution of Indicates virtual generated data The distribution of , n represents the number of data samples;

[0165] S52, the server generates the similarity coefficient C between the data and the local data by calculation i , assess the potential risk of virtual data leakage:

[0166]

[0167] Among them, f local,j (x i ) represents local data x i The value on the jth feature dimension, Indicates the generated data The value at the jth feature dimension, m represents the number of feature dimensions of the data;

[0168] S53, if the server detects C i Exceeding the preset privacy leakage threshold C th , it is considered that there is a high risk of reverse inference, and the server will trigger the adjustment mechanism of the client generator, which increases the randomness and noise of the data:

[0169]

[0170] in, represents the adjusted virtual data, N(0,σ 2 ) indicates zero mean and variance σ 2 Normally distributed noise;

[0171] S54: The server recalculates the distribution difference ΔP and the similarity coefficient C according to the adjusted virtual data. i , if the adjusted data satisfies C i ≤C th , it is considered that the risk of data privacy leakage has been reduced;

[0172] S55, if after multiple adjustments, C is still detected i >C th , the server increases the noise intensity and requires the client to regenerate data.

[0173] Embodiment 1:

[0174] In order to verify the feasibility of the present invention in implementation, the present invention is applied to a large hospital network system, which is composed of multiple branches across the country, and each branch has independent medical data. These branches hope to jointly train a diagnostic model through federated learning to improve the accuracy of identifying patient symptoms. However, directly uploading these medical data to the central server will face great privacy issues, especially for sensitive medical records, medical history and other data. Therefore, the hospital system introduced the method described in the present invention, generating virtual data through a generative adversarial network, and combining differential privacy and homomorphic encryption technology to ensure that the model training is completed without data leakage.

[0175] The local medical data of each branch is divided into three privacy sensitivity levels. First, for the most sensitive data (such as patients' personal identification information), virtual data generation technology is used to completely avoid uploading real data. By training a generative adversarial network, the branch generates virtual data similar to the actual data distribution based on local data. Secondly, for medium-sensitive data, the hospital system uses differential privacy technology to add noise to the uploaded data to ensure that even if the data is intercepted, the original data cannot be restored. For data with lower privacy sensitivity (such as general medical records), branches are allowed to upload some real model gradients that have been lightly perturbed for global model training. This strategy ensures that different types of data can still participate in model optimization while their privacy is effectively protected.

[0176] During the entire training process, the server uses homomorphic encryption technology to encrypt the uploaded data to avoid leaking any valuable data information during transmission. The server dynamically calculates the weight of data from different branches, evaluates the contribution of each branch's data to the global model based on the multi-armed bandit algorithm, assigns different weights, and prioritizes data with greater contributions. After the training is completed, the server analyzes the uploaded virtual data through the reverse inference detection mechanism to determine whether there is a risk of privacy leakage. Once it is found that the generated data may have a reverse inference risk, the system will automatically adjust the generator's generation mode to increase noise or data randomness, thereby ensuring the security of data privacy.

[0177] Five branches of hospitals across the country participated in the experiment, each with historical medical records and personal health data of more than 10,000 patients. The experiment lasted for 6 months. Table 1 below shows the specific experimental data.

[0178] Table 1 Experimental data of privacy protection and model training of branch hospitals in intelligent medical system

[0179]

[0180]

[0181] Branch A has 30,000 historical records. Due to the high privacy sensitivity of its data, virtual data generation technology was used to avoid directly uploading real data. Since virtual data generation made a small contribution in the early stage, the weight of Branch A was 0.15 in the first three months, but as the stability of generator training improved, the weight increased to 0.28 in the last three months, proving that the effect of virtual data generation gradually improved. During the entire experiment, no privacy leakage risk was detected.

[0182] Branch B has 20,000 pieces of data and uses differential privacy technology for data protection. The branch added noise to the uploaded data, and the standard deviation of the noise was 0.5. Because the data was relatively stable, its weight was 0.20 in the first three months, and the weight was slightly increased to 0.25 in the last three months, and no risk of privacy leakage or reverse inference was detected.

[0183] Branch C has 50,000 historical records and is less sensitive to privacy, so it is allowed to upload some real gradient data that has been slightly perturbed. In the first three months, the data of Branch C contributed more to the global model, with a weight of 0.35, and then decreased to 0.33 in the last three months. This shows that although uploading real data increases the contribution, it may also cause certain risks. Therefore, in the later model optimization process, the weight adjustment is more balanced.

[0184] Branch D and Branch E have 60,000 and 40,000 data respectively. They use hybrid virtual data and differential privacy to protect data. The weight of Branch D was 0.30 in the early stage and increased to 0.32 in the later stage. However, during the whole experiment, one reverse inference attack was detected. The server solved this problem by increasing the noise intensity to 0.7. The weight of Branch E increased from 0.25 in the first three months to 0.27 in the last three months. It also detected a reverse inference risk and took the same adjustment measures.

[0185] It can be seen from the experimental results that the privacy protection mechanism described in the present invention can effectively reduce the risk of data leakage. In the scenario of highly privacy-sensitive data, the secure transmission of data is achieved through virtual data generation and differential privacy technology. At the same time, the multi-armed bandit algorithm dynamically adjusts the contribution of each branch data to the global model, so that different types of data are reasonably optimized and processed in training.

[0186] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for processing federated learning data based on privacy protection, characterized in that: The steps include: S1. The client uses local data to train the generator of the generative adversarial network to generate virtual data with a distribution similar to that of local data. S2. The client sets three privacy protection levels according to the privacy sensitivity of local data. The first privacy protection level only uploads virtual data. The second privacy protection level uploads virtual data with differential privacy noise processing. The third privacy protection level allows uploading of some real model gradients. S3. After receiving virtual data or virtual data processed with differential privacy, the server uses homomorphic encryption technology to perform model update operations in an encrypted state. S4. The server uses a dynamic weight optimization mechanism based on the multi-armed bandit algorithm to calculate and dynamically adjust the importance weight of the data uploaded by the client, identify the client data that contributes most to the global model, and obtain the priority processing data set; S5. Based on the obtained priority processing data set, the global model is preliminarily updated, and the generated data is analyzed through the reverse inference detection mechanism to determine whether there is a privacy leakage risk. If the reverse inference risk is detected, the server automatically adjusts the client generator to increase the randomness and noise of the generated data; S6. The server feeds back the updated global model to the client. After receiving the global model, the client continues personalized model training in combination with local data. S7. After completing the personalized model training, the client generates new virtual data and uploads it to the server to participate in the next round of global model training.

2. The method for processing data in federated learning based on privacy protection according to claim 1, characterized in that: The S1 specifically includes: S11. Define the client local dataset as where x i Represents input data, y i represents the corresponding label, and n represents the number of data samples; S12, train the generator G(z;θ) on the client G ), the generator G receives random noise z as input, the noise z is sampled from the standard normal distribution z~N(0,1), and the generated virtual data is expressed as where θ G Represents the parameters of the generator; S13, discriminator D(x;θ D ) and the generator G(z;θ G ) is optimized through adversarial training. The discriminator D determines whether the input data x comes from the real data set D local Or dummy data generated by the generator where θ D represents the parameters of the discriminator; S14, the loss functions of the generator and discriminator include adversarial loss and feature matching loss: Among them, L(G,D,F) represents the overall loss function of the generator G, the discriminator D and the feature extraction function F, E represents the expected value, and x represents the value from the real data set D local The input data, p data (x) represents the distribution of real data, D(x) represents the output of the discriminator D for x, D(G(z)) represents the output of the discriminator D for the generated data G(z), and p z (z) represents the distribution of random noise z, represents the Euclidean distance between x and the features extracted by the generated data G(z) in the discriminator, and λ represents the weight coefficient; S15, the client locally alternately optimizes the parameters θ of the generator G and the discriminator D G and θ D , the generator optimizes the generated virtual data distribution by minimizing the loss of generated data, and the discriminator optimizes by maximizing the ability to distinguish between real data and generated data; S16. After the generator G is trained, the client generates a virtual data set based on local data. Where m represents the number of generated virtual data samples.

3. The method for processing data in federated learning based on privacy protection according to claim 1, characterized in that: The S2 specifically includes: S21, the client based on the local data set D local Calculate the privacy sensitivity score s for each piece of data: s=α·H(x)+β·I(x)+γ·U(x)+δ·R(x); Among them, α, β, γ and δ represent adjustment parameters; Among them, H(x) represents the information entropy of data x, m represents the number of feature dimensions of data x, and p(x i ) represents the probability of the i-th feature of data x; Among them, I(x) represents the sensitive information strength of data x, N represents the number of sensitive features, and w j represents the weight of the jth sensitive feature, f j (x) represents the sensitivity of the jth sensitive feature; Among them, U(x) represents the uniqueness of data x, |{x'∈D|x'=x}| represents the number of data samples that are the same as data x, and |D| represents the number of samples in the entire data set; Among them, R(x) represents the reconstruction risk of data x, M represents the number of features, and r k (x) represents the restoration degree of the kth feature, σ k Indicates the strength of the k-th feature encryption or perturbation; S22. The client determines the privacy protection level according to the calculated privacy sensitivity score s: Among them, P(s) represents the privacy protection level, s1 and s2 represent the preset privacy protection thresholds; S23, when P(s)=1, it is at the first privacy protection level, and the client uploads only the generated virtual data, without any real data samples; S24, when P(s) = 2, it is in the second privacy protection level. When the client uploads virtual data, it performs differential privacy processing on the local model gradient. The noise added to the gradient comes from the normal distribution N(0,σ 2 ), where σ represents the standard deviation of the noise; S25. When P(s)=3, it is at the third privacy protection level. The client allows some real gradients to be uploaded after slight perturbation, and uploads the generated virtual data at the same time.

4. The method for processing data in federated learning based on privacy protection according to claim 1, characterized in that: The S3 specifically includes: S31. After receiving the data uploaded by the client, the server performs homomorphic encryption. During the encryption process, the server performs privacy enhancement on the data: E(g i )=Enc(g i ·ξ i ,k); Among them, g i represents the local gradient of the i-th client, Enc(·,k) represents the homomorphic encryption algorithm based on key k, ξ i Represents the privacy sensitivity weight: Among them, τ represents the adjustment parameter, s i represents the privacy sensitivity score; S32. On the server side, the update formula of the privacy protection model based on homomorphic encryption is: Where E(θ′) represents the encrypted parameter update of the global model, E(θ) represents the parameter vector of the current encrypted state of the global model, η represents the learning rate, W represents the number of clients, and E(g i ) represents the homomorphically encrypted gradient vector uploaded by the i-th client, ∥E(g i )∥2 represents the encrypted gradient E(g i ), ∈ represents the smoothness term; S33, the updated parameters of the global model remain encrypted, and the server sends the updated global model parameters back to the client in encrypted form; S34, after receiving the encrypted global model parameters returned by the server, the client uses the client's decryption key k to decrypt the model parameters; S35. The client combines the decrypted global model parameters with the local model, performs personalized training based on local data, and all transmitted data is processed through homomorphic encryption.

5. The method for processing data in federated learning based on privacy protection according to claim 1, characterized in that: The S4 specifically includes: S41. The server performs a preliminary evaluation on the data uploaded by each client i and dynamically adjusts the weight of the client using the multi-armed bandit algorithm based on privacy sensitivity: Among them, ω i represents the weight of the i-th client, represents the instant reward of the i-th client in the t-th round, represents the privacy sensitivity of the i-th client in the t-th round, ranging from T i represents the number of times the i-th client is selected, and T represents the total number of times the server processes all client data; S42. Calculation of privacy sensitivity score based on client uploaded data Among them, ρ represents the adjustment parameter, represents the privacy sensitivity score of the i-th client in the t-th round, and s0 represents the baseline value of privacy sensitivity; S43, the server calculates the weight of each client according to ω i Prioritize the uploaded data. The data uploaded by the client with a higher weight has a higher priority in the sorting. The server selects the client data with a higher weight to update the global model. S44. After each round of training, the server adjusts the weight of the client based on the performance feedback of the global model: in, Indicates the improvement of the global model accuracy by the data uploaded by the i-th client, Indicates the accuracy improvement value of the client that has the greatest improvement in the accuracy of the global model in the current round, ∥E(g i )∥2 represents the encrypted gradient norm of the i-th client, Q represents the number of participating clients; S45. The server sets the minimum threshold value of the weight ω min , used to ensure that each client is selected at least once within a period of time: Among them, κ represents the balance parameter, ∈ represents the smoothing term; S46, the server dynamically adjusts the weight ω i Select the data sets that are prioritized for processing.

6. The method for processing data in federated learning based on privacy protection according to claim 1, characterized in that: The S5 specifically includes: S51. The server receives the virtual data uploaded by the client and performs a preliminary analysis of the privacy leakage risk, and determines whether there is a potential reverse inference risk by calculating the distribution difference of the generated data: Among them, ΔP represents the client local data distribution p local (x i ) and generate data distribution The average difference, p local (x i ) represents local data x i The distribution of Indicates virtual generated data The distribution of , n represents the number of data samples; S52, the server generates the similarity coefficient C between the data and the local data by calculation i , assess the potential risk of virtual data leakage: Among them, f local,j (x i ) represents local data x i The value on the jth feature dimension, Indicates the generated data The value at the jth feature dimension, m represents the number of feature dimensions of the data; S53, if the server detects C i Exceeding the preset privacy leakage threshold C th , it is considered that there is a high risk of reverse inference, and the server will trigger the adjustment mechanism of the client generator, which increases the randomness and noise of the data: in, represents the adjusted virtual data, N(0,σ 2 ) indicates zero mean and variance σ 2 Normally distributed noise; S54: The server recalculates the distribution difference ΔP and the similarity coefficient C according to the adjusted virtual data. i , if the adjusted data satisfies C i ≤C th , it is considered that the risk of data privacy leakage has been reduced; S55, if after multiple adjustments, C is still detected i >C th , the server increases the noise intensity and requires the client to regenerate data.

Images