Method and apparatus for enhancing 3GPP systems to support federated learning application intermediate model privacy infringement detection

Abstract

Methods, protocols, systems, and apparatus are described for detecting privacy rule violations for intermediate models in federated learning applications. A method may include receiving a federated learning intermediate model from a network entity, training the federated learning intermediate model using a training data set unique to a WTRU to generate a trained federated learning intermediate model, and determining whether any one or more of the trained federated learning intermediate model and the training dataset indicates one or more privacy violations based on one or more rules associated with the location of the WTRU. Based on whether any one or more of the trained federated learning intermediate model and the training dataset indicates one or more privacy infringements, the method may include sending a message or information to a network entity.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Patent Application No. 63 / 324,435 filed on March 28, 2022 and U.S. Patent Application No. 63 / 436,790 filed on January 3, 2023. The contents of these earlier filed applications are incorporated herein by reference in their entirety for all purposes. Technical Field

[0003] The present disclosure generally relates to methods, systems and / or apparatus for enhancing 3GPP systems.For example, some exemplary embodiments may relate to methods, protocols, apparatus and / or systems for detecting privacy rule violations for intermediate or initial models in federated learning applications. Background Art

[0004] Machine learning (ML) can be considered a field of artificial intelligence (AI) in which algorithms build models based on training data to make predictions without being specifically programmed to do so. Federated learning (FL) can refer to ML techniques that train algorithms across multiple decentralized servers or edge devices that have local data samples that are not shared. Summary of the invention

[0005] Embodiments may be directed to a method implemented in a wireless transmit receive unit (WTRU). The method may include: receiving a federated learning intermediate model or a federated learning initial model from a network entity; training the federated learning intermediate model (or initial model) using a training data set unique to the WTRU to generate a trained federated learning intermediate model (or initial model); and determining whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations based on one or more rules associated with the location of the WTRU. Based on whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations, the method may include sending a message or information to the network entity.

[0006] Embodiments may be directed to a wireless transmit / receive unit (WTRU) comprising circuitry that may include at least one of a transmitter, a receiver, a processor, and / or a memory, the circuitry being configured to: receive a federated learning intermediate model from a network entity, train the federated learning intermediate model using a training data set unique to the WTRU to generate a trained federated learning intermediate model, and determine whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations based on one or more rules associated with a location of the WTRU. Based on whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations, the WTRU may be configured to send a message to the network entity.

[0007] Embodiments may be directed to a method that may be implemented in or by a network entity or node. The method may include: receiving a federated learning model from an application server or other entity; determining whether the federated learning model indicates one or more privacy violations; and sending a message to a plurality of WTRUs or application servers based on whether the federated learning model indicates one or more privacy violations.

[0008] Embodiments may involve a network element or node comprising a circuit, which may include one or more of a transmitter, a receiver, a processor and / or a memory, and the circuit is configured to: receive a federated learning model from an application server or other entity, determine whether the federated learning model indicates one or more privacy violations, and send a message to multiple WTRUs or application servers based on whether the federated learning model indicates one or more privacy violations. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] A more detailed understanding can be obtained from the following detailed description given in the form of examples in conjunction with the accompanying drawings. The figures in these drawings, like the detailed description, are exemplary. Therefore, these figures and detailed description should not be regarded as limiting, and other equally effective examples are possible and likely. In addition, the same reference numerals ("ref.") in the figures ("FIG") represent the same elements, wherein:

[0010] Figure 1A is a system diagram illustrating an exemplary communication system in which one or more disclosed embodiments may be implemented;

[0011] Figure 1B is a diagram showing the Figure 1A A system diagram of an exemplary wireless transmit / receive unit (WTRU) for use within a communication system is shown in FIG.

[0012] Figure 1C is a diagram showing the Figure 1AA system diagram of an exemplary radio access network (RAN) and an exemplary core network (CN) used within a communication system shown in FIG.

[0013] Figure 1D is a diagram showing the Figure 1A A system diagram of another exemplary RAN and another exemplary CN used in a communication system shown in FIG.

[0014] Figure 2 is a signal flow diagram illustrating an intermediate model privacy violation detection process for FL according to an exemplary embodiment;

[0015] Figure 3 It is shown in more detail according to the embodiment Figure 2 A signal flow chart of the interaction between the client-side privacy violation engine 201 and the network-side privacy violation engine 203 in step 6;

[0016] Figure 4 is an exemplary flow chart illustrating a method according to an embodiment; and

[0017] Figure 5 is an exemplary flow chart illustrating a method according to an embodiment. DETAILED DESCRIPTION

[0018] In the following detailed description, many specific details are set forth to provide a thorough understanding of the embodiments and / or examples disclosed herein. However, it should be understood that such embodiments and examples can be practiced without some or all of the specific details set forth herein. In other cases, well-known methods, processes, components, and circuits are not described in detail to avoid confusion in the following description. In addition, the embodiments and examples not specifically described herein can be implemented in place of or in conjunction with the embodiments and other examples explicitly, implicitly, and / or inherently described, disclosed, or otherwise provided (collectively referred to as "provided") herein.

[0019] Exemplary Communication System

[0020] Figure 1A1 is a diagram illustrating an exemplary communication system 100 in which one or more disclosed embodiments may be implemented. The communication system 100 may be a multiple access system that provides content (e.g., voice, data, video, messaging, broadcast, etc.) to multiple wireless users. The communication system 100 may enable multiple wireless users to access such content by sharing system resources (including wireless bandwidth). For example, the communication system 100 may employ one or more channel access methods, such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), single carrier FDMA (SC-FDMA), zero tail unique word DFT-spread OFDM (ZT UW DTS-s OFDM), unique word OFDM (UW-OFDM), resource block filtered OFDM, filter bank multi-carrier (FBMC), etc.

[0021] like Figure 1A As shown, the communication system 100 may include wireless transmit / receive units (WTRUs) 102a, 102b, 102c, 102d, RAN 104 / 113, CN 106 / 115, public switched telephone network (PSTN) 108, Internet 110, and other networks 112, but it should be understood that the disclosed embodiments contemplate any number of WTRUs, base stations, networks, and / or network elements. Each of the WTRUs 102a, 102b, 102c, 102d may be any type of device configured to operate and / or communicate in a wireless environment. By way of example, the WTRUs 102a, 102b, 102c, 102d (any of which may be referred to as a “station” and / or “STA”) may be configured to send and / or receive wireless signals and may include user equipment (UE), a mobile station, a fixed or mobile subscriber unit, a subscription-based unit, a pager, a cellular phone, a personal digital assistant (PDA), a smart phone, a laptop, a netbook, a personal computer, a wireless sensor, a hotspot or Mi-Fi device, an Internet of Things (IoT) device, a watch or other wearable device, a head-mounted display (HMD), a vehicle, a drone, medical devices and applications (e.g., remote surgery), industrial devices and applications (e.g., robots and / or other wireless devices operating in an industrial and / or automated process chain environment), a consumer electronic device, a device operating on a commercial and / or industrial wireless network, etc. Any of the WTRUs 102a, 102b, 102c, and 102d may be interchangeably referred to as a UE.

[0022] The communication system 100 may also include a base station 114a and / or a base station 114b. Each of the base stations 114a, 114b may be of any type configured to wirelessly connect to at least one of the WTRUs 102a, 102b, 102c, 102d to facilitate access to one or more communication networks (e.g., the CN 106 / 115, the Internet 110, and / or other networks 112). For example, the base stations 114a, 114b may be a base transceiver station (BTS), a Node-B, an eNode B, a Home Node B, a Home eNode B, a gNB, an NRNodeB, a site controller, an access point (AP), a wireless router, and the like. Although each of the base stations 114a, 114b is depicted as a single element, it will be appreciated that the base stations 114a, 114b may include any number of interconnected base stations and / or network elements.

[0023] The base station 114a may be part of the RAN 104 / 113, which may also include other base stations and / or network elements (not shown), such as a base station controller (BSC), a radio network controller (RNC), a relay node, etc. The base station 114a and / or the base station 114b may be configured to send and / or receive wireless signals on one or more carrier frequencies, which may be referred to as cells (not shown). These frequencies may be licensed spectrum, unlicensed spectrum, or a combination of licensed spectrum and unlicensed spectrum. A cell may provide coverage for wireless services to a specific geographic area, and the coverage may be relatively fixed or may vary over time. The cell may be further divided into cell sectors. For example, the cell associated with the base station 114a may be divided into three sectors. Therefore, in one embodiment, the base station 114a may include three transceivers, i.e., one transceiver for each sector of the cell. In one embodiment, the base station 114a may employ multiple-input multiple-output (MIMO) technology, and may use multiple transceivers for each sector of the cell. For example, beamforming may be used to send and / or receive signals in a desired spatial direction.

[0024] The base stations 114a, 114b may communicate with one or more of the WTRUs 102a, 102b, 102c, 102d over an air interface 116, which may be any suitable wireless communication link (e.g., radio frequency (RF), microwave, centimeter wave, micrometer wave, infrared (IR), ultraviolet (UV), visible light, etc.). The air interface 116 may be established using any suitable radio access technology (RAT).

[0025] More specifically, as described above, the communication system 100 may be a multiple-access system and may employ one or more channel access schemes such as CDMA, TDMA, FDMA, OFDMA, SC-FDMA, etc. For example, the base station 114a in the RAN 104 / 113 and the WTRUs 102a, 102b, 102c may implement a radio technology such as Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access (UTRA), which may use Wideband CDMA (WCDMA) to establish the air interface 116. WCDMA may include communication protocols such as High Speed ​​Packet Access (HSPA) and / or Evolved HSPA (HSPA+). HSPA may include High Speed ​​Downlink Packet Access (HSDPA) and / or High Speed ​​Uplink Packet Access (HSUPA).

[0026] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a radio technology such as Evolved UMTS Terrestrial Radio Access (E-UTRA), which may establish the air interface 116 using Long Term Evolution (LTE) and / or LTE-Advanced (LTE-A) and / or LTE-Advanced Pro (LTE-A Pro).

[0027] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement a wireless technology such as NR wireless access, which may establish the air interface 116 using New Radio (NR).

[0028] In an embodiment, the base station 114a and the WTRUs 102a, 102b, 102c may implement multiple radio access technologies. For example, the base station 114a and the WTRUs 102a, 102b, 102c may implement LTE radio access and NR radio access simultaneously, for example using dual connectivity (DC) principles. Thus, the air interface used by the WTRUs 102a, 102b, 102c may be characterized by multiple types of radio access technologies and / or transmissions to / from multiple types of base stations (e.g., eNBs and gNBs).

[0029] In other embodiments, the base station 114a and the WTRUs 102a, 102b, 102c may implement wireless technologies such as IEEE 802.11 (i.e., Wireless Fidelity (WiFi)), IEEE 802.16 (i.e., Worldwide Interoperability for Microwave Access (WiMAX)), CDMA2000, CDMA2000 1X, CDMA2000 EV-DO, Interim Standard 2000 (IS-2000), Interim Standard 95 (IS-95), Interim Standard 856 (IS-856), Global System for Mobile Communications (GSM), Enhanced Data rates for GSM Evolution (EDGE), GSM EDGE (GERAN), etc.

[0030] Figure 1A The base station 114b in may be a wireless router, a home Node B, a home eNode B, or an access point, and may utilize any suitable RAT to facilitate wireless connectivity in a local area (e.g., a business location, a residence, a vehicle, a campus, an industrial facility, an air corridor (e.g., for use by drones), a road, etc.). In one embodiment, the base station 114b and the WTRUs 102c, 102d may implement a wireless technology such as IEEE 802.11 to establish a wireless local area network (WLAN). In an embodiment, the base station 114b and the WTRUs 102c, 102d may implement a wireless technology such as IEEE 802.15 to establish a wireless personal area network (WPAN). In another embodiment, the base station 114b and the WTRUs 102c, 102d may utilize a cellular-based RAT (e.g., WCDMA, CDMA2000, GSM, LTE, LTE-A, LTE-A Pro, NR, etc.) to establish a picocell or a femtocell. As Figure 1A As shown, base station 114b may be directly connected to Internet 110. Therefore, base station 114b may not need to access Internet 110 through CN 106 / 115.

[0031] The RAN 104 / 113 may communicate with the CN 106 / 115, which may be any type of network configured to provide voice, data, applications and / or Voice over Internet Protocol (VoIP) services to one or more of the WTRUs 102a, 102b, 102c, 102d. The data may have different quality of service (QoS) requirements, such as different throughput requirements, latency requirements, fault tolerance requirements, reliability requirements, data throughput requirements, mobility requirements, etc. The CN 106 / 115 may provide call control, billing services, mobile location-based services, prepaid calls, Internet connectivity, video distribution, etc., and / or perform advanced security functions, such as user authentication. Although Figure 1AAlthough not shown, it will be appreciated that the RAN 104 / 113 and / or the CN 106 / 115 may be in direct or indirect communication with other RANs that employ the same RAT as the RAN 104 / 113 or a different RAT. For example, in addition to being connected to the RAN 104 / 113, which may be employing NR radio technology, the CN 106 / 115 may also be in communication with another RAN (not shown) that employs GSM, UMTS, CDMA 2000, WiMAX, E-UTRA, or WiFi radio technology.

[0032] The CN 106 / 115 may also serve as a gateway for the WTRUs 102a, 102b, 102c, 102d to access the PSTN 108, the Internet 110, and / or other networks 112. The PSTN 108 may include a circuit-switched telephone network that provides plain old telephone service (POTS). The Internet 110 may include a global system of interconnected computer networks and devices that use common communication protocols, such as TCP, User Datagram Protocol (UDP), and / or IP in the Transmission Control Protocol (TCP) / IP Internet Protocol Suite. The networks 112 may include wired and / or wireless communication networks owned and / or operated by other service providers. For example, the networks 112 may include another CN connected to one or more RANs, which may use the same RAT as the RAN 104 / 113 or a different RAT.

[0033] Some or all of the WTRUs 102a, 102b, 102c, 102d in the communication system 100 may include multi-mode capabilities (e.g., the WTRUs 102a, 102b, 102c, 102d may include multiple transceivers for communicating with different wireless networks via different wireless links). Figure 1A The WTRU 102c shown in FIG. 1 may be configured to communicate with the base station 114a (which may employ a cellular-based radio technology) and the base station 114b (which may employ an IEEE 802 radio technology).

[0034] Figure 1B is a system diagram illustrating an exemplary WTRU 102. Figure 1B As shown, the WTRU 102 may include, among other things, a processor 118, a transceiver 120, a transmit / receive element 122, a speaker / microphone 124, a keyboard 126, a display / touchpad 128, non-removable memory 130, removable memory 132, a power source 134, a global positioning system (GPS) chipset 136, and / or other peripherals 138. It will be appreciated that the WTRU 102 may include any sub-combination of the foregoing elements while remaining consistent with an embodiment.

[0035] The processor 118 may be a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors associated with a DSP core, a controller, a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) circuit, any other type of integrated circuit (IC), a state machine, etc. The processor 118 may perform signal coding, data processing, power control, input / output processing, and / or any other functionality that enables the WTRU 102 to operate in a wireless environment. The processor 118 may be coupled to the transceiver 120, which may be coupled to the transmit / receive element 122. Although Figure 1B The processor 118 and the transceiver 120 are depicted as separate components, but it will be appreciated that the processor 118 and the transceiver 120 may be integrated into an electronic package or chip.

[0036] The transmit / receive element 122 may be configured to transmit or receive signals to or from a base station (e.g., base station 114a) via the air interface 116. For example, in one embodiment, the transmit / receive element 122 may be an antenna configured to transmit and / or receive RF signals. In one embodiment, the transmit / receive element 122 may be an emitter / detector configured to transmit and / or receive IR, UV, or visible light signals. In another embodiment, the transmit / receive element 122 may be configured to transmit and / or receive both RF and light signals. It should be appreciated that the transmit / receive element 122 may be configured to transmit and / or receive any combination of wireless signals.

[0037] although Figure 1B 102 as a single element, but the WTRU 102 may include any number of transmit / receive elements 122. More specifically, the WTRU 102 may employ MIMO technology. Thus, in an embodiment, the WTRU 102 may include two or more transmit / receive elements 122 (e.g., multiple antennas) for transmitting and receiving wireless signals over the air interface 116.

[0038] The transceiver 120 may be configured to modulate signals to be transmitted by the transmit / receive element 122 and to demodulate signals received by the transmit / receive element 122. As described above, the WTRU 102 may have multi-mode capabilities. Thus, the transceiver 120 may include multiple transceivers to enable the WTRU 102 to communicate via multiple RATs (e.g., NR and IEEE 802.11).

[0039] The processor 118 of the WTRU 102 may be coupled to a speaker / microphone 124, a keyboard 126, and / or a display / touchpad 128 (e.g., a liquid crystal display (LCD) display unit or an organic light emitting diode (OLED) display unit), and may receive user input data therefrom. The processor 118 may also output user data to the speaker / microphone 124, the keyboard 126, and / or the display / touchpad 128. In addition, the processor 118 may access information from and store data in any type of suitable memory (e.g., a non-removable memory 130 and / or a removable memory 132). The non-removable memory 130 may include a random access memory (RAM), a read-only memory (ROM), a hard disk, or any other type of memory storage device. The removable memory 132 may include a subscriber identity module (SIM) card, a memory stick, a secure digital (SD) memory card, and the like. In other embodiments, the processor 118 may access information from and store data in a memory that is not physically located on the WTRU 102, such as on a server or a home computer (not shown).

[0040] The processor 118 may receive power from the power source 134 and may be configured to distribute the power to and / or control the power to the other components in the WTRU 102. The power source 134 may be any device suitable for powering the WTRU 102. For example, the power source 134 may include one or more dry cell batteries (e.g., nickel-cadmium (NiCd), nickel-zinc (NiZn), nickel-metal hydride (NiMH), lithium-ion (Li-ion), etc.), solar cells, fuel cells, etc.

[0041] The processor 118 may also be coupled to the GPS chipset 136, which may be configured to provide location information (e.g., longitude and latitude) regarding the current location of the WTRU 102. The WTRU 102 may receive location information from a base station (e.g., base stations 114a, 114b) over the air interface 116 and / or determine its location based on time information of signals received from two or more nearby base stations in addition to or in lieu of the information from the GPS chipset 136. It will be appreciated that the WTRU 102 may acquire location information by any suitable location-determination method while remaining consistent with an embodiment.

[0042] The processor 118 may also be coupled to other peripherals 138, which may include one or more software and / or hardware modules that provide additional features, functionality, and / or wired or wireless connectivity. For example, the peripherals 138 may include an accelerometer, an electronic compass, a satellite transceiver, a digital camera (for photos and / or video), a universal serial bus (USB) port, a vibration device, a television transceiver, a hands-free headset, module, a frequency modulation (FM) radio unit, a digital music player, a media player, a video game player module, an Internet browser, a virtual reality and / or augmented reality (VR / AR) device, an activity tracker, etc. The peripheral device 138 may include one or more sensors, which may be one or more of a gyroscope, an accelerometer, a Hall effect sensor, a magnetometer, a direction sensor, a proximity sensor, a temperature sensor, a time sensor, a geolocation sensor, an altimeter, a light sensor, a touch sensor, a magnetometer, a barometer, a gesture sensor, a biometric sensor, and / or a humidity sensor.

[0043] The WTRU 102 may include a full-duplex radio in which transmission and reception of some or all signals (e.g., associated with specific subframes for both uplink (e.g., for transmission) and downlink (e.g., for reception)) may be concurrent and / or simultaneous. The full-duplex radio may include an interference management unit 139 to reduce and / or substantially eliminate self-interference through hardware (e.g., chokes) or through signal processing by a processor (e.g., a separate processor (not shown) or through the processor 118). In an embodiment, the WTRU 102 may include a half-duplex radio in which transmission and reception of some or all signals (e.g., associated with specific subframes for both uplink (e.g., for transmission) or downlink (e.g., for reception)) may be concurrent and / or simultaneous.

[0044] Figure 1C 1 is a system diagram showing the RAN 104 and the CN 106 according to an embodiment. As described above, the RAN 104 may employ an E-UTRA radio technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 104 may also be in communication with the CN 106.

[0045] The RAN 104 may include eNode-Bs 160a, 160b, 160c, though it will be appreciated that the RAN 104 may include any number of eNode-Bs while remaining consistent with an embodiment. The eNode-Bs 160a, 160b, 160c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In one embodiment, the eNode-Bs 160a, 160b, 160c may implement MIMO technology. Thus, for example, the eNode-B 160a may use multiple antennas to transmit wireless signals to and / or receive wireless signals from the WTRU 102a.

[0046] Each of the eNode-Bs 160a, 160b, 160c may be associated with a particular cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, user scheduling in uplink (UL) and / or downlink (DL), etc. Figure 1C As shown, eNode-Bs 160a, 160b, 160c may communicate with each other via an X2 interface.

[0047] Figure 1C The illustrated CN 106 may include a mobility management entity (MME) 162, a serving gateway (SGW) 164, and a packet data network (PDN) gateway (or PGW) 166. While each of the above elements are depicted as being part of the CN 106, it should be understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0048] The MME 162 may be connected to each of the eNode-Bs 162a, 162b, 162c in the RAN 104 via an S1 interface and may serve as a control node. For example, the MME 162 may be responsible for authenticating users of the WTRUs 102a, 102b, 102c, bearer activation / deactivation, selecting a particular serving gateway during an initial attach of the WTRUs 102a, 102b, 102c, etc. The MME 162 may provide a control plane function for switching between the RAN 104 and other RANs (not shown) that employ other wireless technologies, such as GSM and / or WCDMA.

[0049] The SGW 164 may be connected to each of the eNode Bs 160a, 160b, 160c in the RAN 104 via an S1 interface. The SGW 164 may generally route and forward user data packets to / from the WTRUs 102a, 102b, 102c. The SGW 164 may perform other functions, such as anchoring the user plane during inter-eNode B handovers, triggering paging when the WTRUs 102a, 102b, 102c have DL data, managing and storing the contexts of the WTRUs 102a, 102b, 102c, and the like.

[0050] The SGW 164 may be connected to the PGW 166, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks, such as the Internet 110, to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices.

[0051] The CN 106 may facilitate communications with other networks. For example, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to circuit-switched networks, such as the PSTN 108, to facilitate communications between the WTRUs 102a, 102b, 102c and traditional land-line communications devices. For example, the CN 106 may include, or may be in communication with, an IP gateway, such as an IP Multimedia Subsystem (IMS) server, that serves as an interface between the CN 106 and the PSTN 108. In addition, the CN 106 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired and / or wireless networks that are owned and / or operated by other service providers.

[0052] although Figures 1A-1D WTRUs are described in the EMBODIMENTS as wireless terminals, but in certain representative embodiments, it is contemplated that such terminals may communicate with a communication network using (eg, temporarily or permanently) a wired communication interface.

[0053] In a representative embodiment, the other network 112 may be a WLAN.

[0054] A WLAN in infrastructure basic service set (BSS) mode may have an access point (AP) for a BSS and one or more stations (STAs) associated with the AP. The AP may have access or an interface to a distribution system (DS) or another wired / wireless network that transmits a communication stream to and / or out of the BSS. A communication stream from outside the BSS and destined for a STA may be reached by the AP and may be transmitted to the STA. A communication stream from a STA to a destination outside the BSS may be sent to the AP for transmission to the corresponding destination. A communication stream between STAs within a BSS may be sent by the AP, for example, where a source STA may send a communication stream to the AP, and the AP may transmit the communication stream to a target STA. A communication stream between STAs within a BSS may be considered and / or referred to as a peer-to-peer communication stream. A peer-to-peer communication stream may be sent between a source and a target STA (e.g., directly between them) using a direct link setup (DLS). In certain representative embodiments, the DLS may use 802.11e DLS or 802.11z tunnel DLS (TDLS). A WLAN using an independent BSS (IBSS) mode may not have an AP, and STAs (eg, all STAs) within or using the IBSS may communicate directly with each other. The IBSS communication mode is sometimes referred to herein as an "ad-hoc" communication mode.

[0055] When using the 802.11ac infrastructure mode of operation or a similar mode of operation, the AP may send a beacon on a fixed channel (e.g., a primary channel). The primary channel may be a fixed width (e.g., a 20 MHz wide bandwidth) or a width dynamically set through signaling. The primary channel may be an operating channel of the BSS, and the STA may use the primary channel to establish a connection with the AP. In certain representative embodiments, carrier sense multiple access with collision avoidance (CSMA / CA) may be implemented, such as in an 802.11 system. For CSMA / CA, a STA (e.g., each STA) (including the AP) may listen to the primary channel. If the primary channel is listened / detected and / or determined to be busy by a particular STA, the particular STA may exit. One STA (e.g., only one station) may transmit at any given time in a given BSS.

[0056] A high throughput (HT) STA may communicate using a 40 MHz wide channel, for example, by combining a primary 20 MHz channel with an adjacent or non-adjacent 20 MHz channel to form a 40 MHz wide channel.

[0057] Very high throughput (VHT) STA can support 20MHz, 40MHz, 80MHz and / or 160MHz wide channels. 40MHz and / or 80MHz channels can be formed by combining continuous 20MHz channels. A 160MHz channel can be formed by combining 8 continuous 20MHz channels or combining two discontinuous 80MHz channels, which can be called an 80+80 configuration. For the 80+80 configuration, the data can be passed through a segment parser after channel coding, which can divide the data into two streams. Each stream can be subjected to inverse fast Fourier transform (IFFT) processing and time domain processing respectively. The stream can be mapped onto two 80MHz channels, and the data can be sent by the transmitting STA. At the receiver of the receiving STA, the operation for the above-mentioned 80+80 configuration can be reversed, and the combined data can be sent to the medium access control (MAC).

[0058] 802.11af and 802.11ah support operating modes below 1 GHz. The channel operating bandwidths and carriers in 802.11af and 802.11ah are reduced relative to those used in 802.11n and 802.11ac. 802.11af supports 5 MHz, 10 MHz, and 20 MHz bandwidths in the TV White Space (TVWS) spectrum, while 802.11ah uses non-TVWS spectrum to support 1 MHz, 2 MHz, 4 MHz, 8 MHz, and 16 MHz bandwidths. According to a representative embodiment, 802.11ah may support meter type control / machine type communications, such as MTC devices in macro coverage areas. MTC devices may have certain functions, such as limited functions, including support for (e.g., only support for) certain and / or limited bandwidths. MTC devices may include batteries with battery life above a threshold (e.g., to maintain very long battery life).

[0059] The WLAN system may support multiple channels and channel bandwidths, such as 802.11n, 802.11ac, 802.11af, and 802.11ah, including channels that may be designated as primary channels. The bandwidth of the primary channel may be equal to the maximum common operating bandwidth supported by all STAs in the BSS. The bandwidth of the primary channel may be set and / or limited by the STA that supports the minimum bandwidth operating mode among all STAs in operation in the BSS. In the example of 802.11ah, for STAs (e.g., MTC type devices) that support (e.g., only support) 1MHz mode, the width of the primary channel may be 1MHz, even if the AP and other STAs in the BSS support 2MHz, 4MHz, 8MHz, 16MHz, and / or other channel bandwidth operating modes. Carrier sensing and / or network allocation vector (NAV) settings may depend on the state of the primary channel. If the primary channel is busy, for example, due to a STA (supporting only 1MHz operating mode) transmitting to the AP, the entire available band may be considered busy, even if most of the band remains idle and may be available.

[0060] In the United States, the available frequency band that 802.11ah can use is 902MHz to 928MHz. In South Korea, the available frequency band is 917.5MHz to 923.5MHz. In Japan, the available frequency band is 916.5MHz to 927.5MHz. The total bandwidth available for 802.11ah is 6MHz to 26MHz, depending on the country code.

[0061] Figure 1D 1 is a system diagram showing the RAN 113 and the CN 115 according to an embodiment. As described above, the RAN 113 may employ NR wireless technology to communicate with the WTRUs 102a, 102b, 102c over the air interface 116. The RAN 113 may also communicate with the CN 115.

[0062] The RAN 113 may include gNBs 180a, 180b, 180c, though it will be appreciated that the RAN 113 may include any number of gNBs while remaining consistent with an embodiment. The gNBs 180a, 180b, 180c may each include one or more transceivers for communicating with the WTRUs 102a, 102b, 102c over the air interface 116. In an embodiment, the gNBs 180a, 180b, 180c may implement MIMO technology. For example, the gNBs 180a, 180b may utilize beamforming to transmit signals to and / or receive signals from the gNBs 180a, 180b, 180c. Thus, for example, the gNB 180a may use multiple antennas to transmit wireless signals to and / or receive wireless signals from the WTRU 102a. In an embodiment, the gNBs 180a, 180b, 180c may implement carrier aggregation techniques. For example, the gNB 180a may send multiple component carriers to the WTRU 102a (not shown). A subset of these component carriers may be located on an unlicensed spectrum, while the remaining component carriers may be located on a licensed spectrum. In an embodiment, the gNBs 180a, 180b, 180c may implement coordinated multi-point transmission (CoMP) techniques. For example, the WTRU 102a may receive coordinated transmissions from gNB 180a and gNB 180b (and / or gNB 180c).

[0063] The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using transmissions associated with scalable parameter sets. For example, OFDM symbol spacing and / or OFDM subcarrier spacing may vary for different transmissions, different cells, and / or different portions of the wireless transmission spectrum. The WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using subframes or transmission time intervals (TTIs) of varying or scalable lengths (e.g., containing varying numbers of OFDM symbols and / or varying absolute times of varying length).

[0064] The gNBs 180a, 180b, 180c may be configured to communicate with the WTRUs 102a, 102b, 102c in a standalone configuration and / or a non-standalone configuration. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c without accessing other RANs (e.g., the eNode-Bs 160a, 160b, 160c). In a standalone configuration, the WTRUs 102a, 102b, 102c may use one or more of the gNBs 180a, 180b, 180c as mobility anchors. In a standalone configuration, the WTRUs 102a, 102b, 102c may communicate with the gNBs 180a, 180b, 180c using signals in unlicensed bands. In a non-standalone configuration, the WTRU 102a, 102b, 102c may communicate / connect with the gNB 180a, 180b, 180c while also communicating / connecting with another RAN (e.g., the eNode-B 160a, 160b, 160c). For example, the WTRU 102a, 102b, 102c may implement the DC principle to communicate with one or more gNBs 180a, 180b, 180c and one or more eNode-Bs 160a, 160b, 160c substantially simultaneously. In a non-standalone configuration, the eNode-B 160a, 160b, 160c may serve as a mobility anchor for the WTRU 102a, 102b, 102c, while the gNB 180a, 180b, 180c may provide additional coverage and / or throughput to the serving WTRU 102a, 102b, 102c.

[0065] Each of the gNBs 180a, 180b, 180c may be associated with a specific cell (not shown) and may be configured to handle radio resource management decisions, handover decisions, user scheduling in uplink (UL) and / or downlink (DL), network slicing support, dual connectivity, interworking between NR and E-UTRA, routing user plane data to a user plane function (UPF) 184a, 184b, routing control plane information to an access and mobility management function (AMF) 182a, 182b, etc. Figure 1D As shown, gNBs 180a, 180b, and 180c may communicate with each other via the Xn interface.

[0066] Figure 1DThe CN 115 shown in FIG. 1 may include at least one AMF 182a, 182b, at least one UPF 184a, 184b, at least one session management function (SMF) 183a, 183b, and possible data networks (DNs) 185a, 185b. Although each of the above elements is depicted as part of the CN 115, it is understood that any of these elements may be owned and / or operated by an entity other than the CN operator.

[0067] The AMF 182a, 182b may be connected to one or more gNBs 180a, 180b, 180c in the RAN 113 via an N2 interface and may serve as a control node. For example, the AMF 182a, 182b may be responsible for authenticating users of the WTRU 102a, 102b, 102c, supporting network slicing (e.g., handling different packet data unit (PDU) sessions with different requirements), selecting a specific SMF 183a, 183b, managing registration areas, terminating non-access stratum (NAS) signaling, mobility management, etc. The AMF 182a, 182b may use network slicing to customize CN support for the WTRU 102a, 102b, 102c based on the type of service used by the WTRU 102a, 102b, 102c. For example, different network slices may be established for different use cases, such as services relying on ultra-reliable low latency (URLLC) access, services relying on enhanced massive mobile broadband (eMBB) access, services for machine type communication (MTC) access, etc. The AMF a82a, 182b may provide a control plane function for switching between the RAN 113 and other RANs (not shown) that employ other wireless technologies (e.g., LTE, LTE-A, LTE-A Pro) and / or non-3GPP access technologies (e.g., WiFi).

[0068] The SMF 183a, 183b may be connected to the AMF 182a, 182b in the CN 115 via the N11 interface. The SMF 183a, 183b may also be connected to the UPF 184a, 184b in the CN 115 via the N4 interface. The SMF 183a, 183b may select and control the UPF 184a, 184b and configure the routing of the communication flow through the UPF 184a, 184b. The SMF 183a, 183b may perform other functions, such as managing and allocating UE IP addresses, managing PDU sessions, controlling policy enforcement and QoS, providing downlink data notification, etc. The PDU session type may be IP-based, non-IP-based, Ethernet-based, etc.

[0069] The UPF 184a, 184b may be connected to one or more gNBs 180a, 180b, 180c in the RAN 113 via an N3 interface, which may provide the WTRUs 102a, 102b, 102c with access to packet-switched networks (e.g., the Internet 110) to facilitate communications between the WTRUs 102a, 102b, 102c and IP-enabled devices. The UPF 184, 184b may perform other functions, such as routing and forwarding packets, enforcing user plane policies, supporting multi-homed PDU sessions, handling user plane QoS, buffering downlink packets, providing mobility anchoring, etc.

[0070] The CN 115 may facilitate communications with other networks. For example, the CN 115 may include or may communicate with an IP gateway (e.g., an IP Multimedia Subsystem (IMS) server) that serves as an interface between the CN 115 and the PSTN 108. In addition, the CN 115 may provide the WTRUs 102a, 102b, 102c with access to other networks 112, which may include other wired and / or wireless networks owned and / or operated by other service providers. In an embodiment, the WTRUs 102a, 102b, 102c may be connected to a local data network (DN) 185a, 185b through the UPF 184a, 184b via an N3 interface with the UPF 184a, 184b and an N6 interface between the UPF 184a, 184b and the DN 185a, 185b.

[0071] Given that Figures 1A-1D as well as Figures 1A-1D In accordance with the corresponding description of the present invention, one or more or all functions described herein for one or more of the WTRU 102a-d, base station 114a-b, eNode-B 160a-c, MME 162, SGW 164, PGW 166, gNB 180a-c, AMF 182a-b, UPF 184a-b, SMF 183a-b, DN 185a-b and / or any other devices described herein may be performed by one or more simulation devices (not shown). The simulation device may be one or more devices configured to simulate one or more or all functions described herein. For example, the simulation device may be used to test other devices and / or simulate network and / or WTRU functions.

[0072] The simulation device may be designed to perform one or more tests on other devices in a laboratory environment and / or in an operator network environment. For example, one or more simulation devices may perform one or more or all functions while being fully or partially implemented and / or deployed as part of a wired and / or wireless communication network to test other devices within the communication network. One or more simulation devices may perform one or more or all functions while being temporarily implemented / deployed as part of a wired and / or wireless communication network. The simulation device may be directly coupled to another device for testing and / or may use over-the-air wireless communications to perform testing.

[0073] One or more simulation devices can perform one or more (including all) functions without being implemented / deployed as part of a wired and / or wireless communication network. For example, the simulation device can be used for testing scenarios in a test lab and / or undeployed (e.g., testing) a wired and / or wireless communication network to implement testing of one or more components. One or more simulation devices can be test devices. The simulation device can use direct RF coupling and / or wireless communication via RF circuits (e.g., which can include one or more antennas) to send and / or receive data.

[0074] Representative process for achieving privacy protection in federated learning

[0075] Federated Learning (FL) enables multiple participants (e.g., multiple WTRUs) to build artificial intelligence machine learning (AIML) learning models without sharing their private training data with each other. For example, multiple WTRUs can jointly train WTRU-based applications without revealing the interactions of the individual participants. The federated model is then created by aggregating the model updates submitted by the participants. To protect the confidentiality of the training data, the application server (AS) is designed not to see how these updates are generated.

[0076] Federated learning is susceptible to privacy attacks, such as model extraction or inference attacks, whereby model updates may leak information about a participant's training data to an adversarial participant.

[0077] Membership inference attack is a type of inference attack used to infer details of training data, which illegally obtains information by checking whether certain data exists in the training set. The attacker abuses the global model to obtain information about other users' training data. In this case, information about the training data set is inferred by guessing and training a prediction model to predict the original training data.

[0078] Inadvertent data leakage and reconstruction through inference is a scenario where updates or gradients from a client leak unexpected information at the central server. Malicious / curious clients can use the global model and parameters to reconstruct the training data of other clients.

[0079] In the federated learning training model, the AS selects a group of WTRUs / devices to participate in a distributed training session. A training session may include multiple training cycles. For each cycle, the selected WTRUs receive intermediate models from the server, train them using the WTRU environment attributes, and then submit the trained intermediate models back to the application server. The application server may then aggregate all intermediate models received from all WTRUs and generate a new model for the next FL cycle.

[0080] Therefore, when participating WTRUs submit intermediate trained models to the application server, the trained models must be reviewed to avoid potential privacy violations.

[0081] The threats introduced by federated learning may be more serious than those of regular AIML because, as part of the federated learning process, federated learning clients can access the intermediate models they receive and submit updates to be aggregated into the global model, whereas regular / non-FL AIML clients previously only acted as passive data providers. The intermediate models and trained models received from the application server (AS) may contain private information that may violate privacy laws or regulations.

[0082] The exemplary embodiments described herein provide methods, apparatus, systems, and techniques for detecting privacy violations in intermediate models received by WTRUs participating in FL, dynamically evaluating privacy violations integrated in intermediate models submitted by WTRUs participating in FL, and / or evaluating and reviewing FL intermediate models using AIML and privacy regulations, laws, and privacy policies.

[0083] According to some embodiments, the intermediate FL models received and submitted by the participating WTRUs may be dynamically evaluated to ensure that there are no potential privacy violations of the merged AIML model when the intermediate models are integrated into the merged AIML model. The data used to perform the privacy evaluation may come from the intermediate models received by the FL client, the training models and / or the training data submitted by the WTRU.

[0084] In an exemplary embodiment, privacy violation detection may be performed before the WTRU receives the intermediate model to start the next round of FL training, and privacy violation detection may be performed again immediately after the WTRU submits the trained intermediate model back to the application server. For example, the client privacy engine may continue to process the training data set as it is ready for training.

[0085] In some exemplary embodiments, privacy violation and threat detection on the intermediate model may be performed in parallel.

[0086] According to an embodiment, the privacy analysis engine may (but not necessarily) be placed on both the WTRU side and the network side. According to an embodiment, the privacy analysis engine may perform one or more of the following tasks:

[0087] 1. Privacy violation detection can be performed on the intermediate model trained by WTRU with the assistance of AI engine, privacy policy and regulations to check for potential privacy violations. This detection can be performed as a collaboration between the client-side privacy engine and the network-side privacy engine.

[0088] 2. The WTRU training dataset and the trained intermediate model may be used as input to a client privacy engine, which may, for example, use a white-box approach to perform privacy violation detection using dynamic policies and inputs from the network. In one embodiment, the network may optionally request and / or receive the location of the WTRU from the WTRU, and may send relevant privacy laws, regulations, and / or rules to the WTRU (e.g., to the client privacy engine), which may be based on the location of the WTRU and used to detect possible privacy violations. To save memory and help detect any privacy violations as early as possible, the training dataset may be filtered and continuously reviewed as it becomes available before being used to train the model.

[0089] 3. The network-side privacy engine may perform privacy violation detection on the source intermediate model to be sent to the WTRU, and / or may perform privacy violation detection on the trained intermediate model trained by the WTRU and returned to the AS.

[0090] 4. The inputs to the network-side privacy engine may include intermediate models, privacy policies, laws and / or regulations.

[0091] For example, a black box approach may be used to input these. In addition, the WTRU may provide some trusted samples (e.g., a small test data set) to the network-side privacy engine so that it can validate the intermediate model, for example, in the case of reinforcement learning. Samples from the WTRU reflected in the AIML training model may be collected and sent to the network-side privacy engine along with the trained intermediate model.

[0092] 5. With the help of advanced AIML algorithms (such as reinforcement learning or supervised learning) and more powerful computing resources, the network-side privacy engine can detect privacy violations in training models (training models sent from the network to the WTRU) and training models (training models returned from the WTRU to the network that should be integrated into the global model). For example, the network-side privacy engine can dynamically feed back privacy violation detection to the client-side privacy engine based on the privacy violation detection results.

[0093] It should be noted that the "white box method" discussed herein may refer to a method in which the privacy engine (e.g., the client-side privacy engine) knows the input (e.g., training vector) used for ML training. The "black box method" discussed herein may refer to a method in which the privacy engine (e.g., the network-side privacy engine) only has a trained model and does not know the input or training vector.

[0094] Figure 2 is a signal flow diagram illustrating an intermediate model privacy violation detection process for FL according to an exemplary embodiment. It is worth noting that Figure 2 An example of privacy violation detection is shown, and other embodiments or examples described elsewhere herein are contemplated. Figure 2 modifications or changes to the process.

[0095] In step 0, the WTRU-side privacy violation engine 201 and the network-side privacy violation detection engine 203 at the WTRU 200 are prepared and configured for FL. AIML can be used for the privacy violation detection engine. However, this is not Figure 2 , since it can be assumed that such training has been performed before.

[0096] In step 1, the federated learning application server sends the intermediate AIML model to the WTRU (eg, WTRU 200) that has been selected as a FL candidate for the next round of FL.

[0097] In step 2, the network-side privacy violation engine 203 evaluates whether the intermediate model has potential privacy violations before sending the intermediate model to the WTRU 200 selected for FL.

[0098] Although Figure 2 Not shown, but if such a violation is detected, the network-side privacy violation engine may reject the intermediate model and may notify the AS that the intermediate model may have (e.g., may contain or indicate) a privacy violation. If the AS receives a rejection from the privacy violation detection engine 203, the AS may choose to roll back to a previous aggregate model that passed the test and use the previous model with a different set of participants / WTRUs to generate a new aggregate model that may pass the privacy violation screening.

[0099] In certain embodiments, the network-side privacy violation detection engine 203 may process: signaling flows to enable communication with the AS and network entities and the WTRU; and / or user plane flows, ie, the intermediate model provided by the AS for the FL.

[0100] In one embodiment, the network-side privacy engine may divide its functions into a signaling part and a user plane part. The signaling function may communicate with the user plane level functions, which may be co-located or close to the serving user plane function (UPF) of the corresponding WTRU. Since the user plane flow is in the path between the WTRU and the UPF, the UP function can easily perform black box violation detection.

[0101] return Figure 2 ,On the other hand, if no privacy violation is detected in step 2, then in step 3, the network-side privacy violation engine sends the intermediate model to the candidate WTRUs for FL.

[0102] Next, in step 4, the WTRU client starts FL training using the received intermediate model.

[0103] Next, in step 5, the client-side privacy engine 201 receives the completed training model from the WTRU.

[0104] In step 6, after the AIML client completes FL training, the client-side privacy violation detection engine 201 collaborates with the network-side privacy engine 203 to detect any privacy violations in the training dataset used for FL training and the trained intermediate model. For example, in some embodiments, the network-side privacy engine 203 may request and / or receive the location of the WTRU 200 so that it can send the WTRU privacy laws, regulations, and / or rules related to the jurisdiction (e.g., geographic) location of the WTRU. The details of step 6 are as follows: Figure 3 As shown, a more detailed explanation will be given in conjunction with this figure.

[0105] Assuming that no privacy violation is detected in step 6 , the completed intermediate model is sent to AS 205 in step 7 .

[0106] Otherwise, the network-side privacy engine 203 may send a rejection message to the AS 205 with an error code indicating that the trained intermediate model has (e.g., includes or indicates) a privacy violation ( Figure 2 As discussed further below, the privacy violation detection result may be used for WTRU selection for the next FL period.

[0107] Finally, in step 8, the AS 205 collects all intermediate models from all WTRUs participating in this FL session and aggregates them into a global model (or another intermediate model for the next round of FL training).

[0108] As mentioned above, Figure 3 is shown in more detail Figure 2The signal flow chart of the interaction between the client-side privacy violation engine 201 and the network-side privacy violation engine 203 in step 6 is shown in FIG. Figure 3 One example according to certain embodiments is shown, but other embodiments or examples described elsewhere herein are contemplated. Figure 3 modifications or changes to the process.

[0109] In step 1, after the AIML client completes FL training, the client privacy engine in the WTRU 201 carries the trained intermediate model and the authorization token to request the network-side privacy violation engine 203 to start privacy violation detection. When the WTRU is selected to participate in FL, the AS uses the authorization token to authorize the WTRU FL training. When the network-side privacy violation engine receives the authorization token, it may first verify the token, for example, before starting to process the trained intermediate model from the WTRU.

[0110] In step 2, the network-side privacy violation engine 203 performs privacy violation detection using the trained model and the privacy policy, rules and / or regulations. The network-side privacy violation detection can be performed using a black-box algorithm without the need for training data from the WTRU to protect the privacy of the WTRU training data. With the greater computing power from the network and advanced AIML algorithms, the engine 203 can detect more advanced privacy violations or threats compared to the resource-limited client-side privacy engine 201.

[0111] The network-side privacy engine 203 can process privacy violation detection for the trained model to be sent back to the AS by the WTRU, for example, including: signaling flows to enable communication with the AS, network entities and the WTRU; and / or user plane flows, i.e., the intermediate model of the FL provided by the AS.

[0112] In one embodiment, the network privacy engine may separate the functionality into a signaling portion and a user plane portion. The signaling functionality communicates with the user plane level functionality, which may be co-located or close to the serving UPF for the corresponding WTRU. Since the user plane flow is in the path between the WTRU and the UPF, the UP functionality can easily perform black box violation detection.

[0113] In step 3, the network-side privacy engine 203 sends additional information to the client-side privacy violation engine 201, such as one or more privacy regulations, privacy laws, updated privacy policies, and / or AIML models to be used by the client-side privacy engine. For example, in an embodiment, the network-side privacy violation engine 203 may optionally request and / or receive the location of the WTRU 200 from the WTRU 200. Based on the location of the WTRU 200, the network-side privacy violation engine 203 may send the appropriate privacy laws, regulations, and / or rules to be used to detect possible privacy violations to the WTRU 200 (e.g., to the client-side privacy engine 201) in step 3. Therefore, the WTRU 200 can understand the appropriate privacy laws, regulations, and / or rules currently applicable based on its location. Send information updated due to the violation detection result of the network privacy engine (e.g., only information).

[0114] In step 4, the client privacy violation engine 201 further uses the training dataset and the information received from the network-side privacy violation engine 203 to perform privacy violation detection on the training dataset and the trained model using a white-box approach. Since the training dataset is subjected to privacy violation detection when it is generated, this step uses the pre-configured information and updated parameters received in the above step 3 to perform (e.g., only perform) detection on the trained model.

[0115] Finally, in step 5, the client-side privacy violation engine 201 sends a privacy violation check complete message to the network-side privacy violation engine 203. If the trained intermediate model contains (e.g., indicates or includes) any privacy violations, the client-side privacy violation engine 201 should reject the model by sending a rejection message to the network-side privacy violation engine and not sending the intermediate model to the AS. In this case, the AS may decide not to select the WTRU in future FL cycles.

[0116] On the other hand, if the trained intermediate model does not contain (e.g., does not indicate or include) any privacy violations, the client privacy violation engine should send an approval message that includes the trained federated learning intermediate learning model.

[0117] If both client and network privacy violation detection are completed without detecting a privacy violation, the network-side privacy violation engine 203 may forward the intermediate model to the AS.

[0118] According to some exemplary embodiments, the methods, systems, devices and techniques disclosed herein may be implemented in a 3GPP network function, for example, by mapping a client privacy violation engine, a network side privacy violation engine, messages and routing mechanisms, etc. to a 3GPP network function. In an embodiment, the AS may request analysis from a network data analysis function (NWDAF) (or through an NEF), such as a specific UPF, a data network access identifier (DNAI), a single network slice selection assistance information (S-NSSAI) or even a WTRU ID / group ID. The client privacy engine and the network privacy engine may be each sub-function of the NWDAF, and they may communicate with each other through a service-based architecture (SBA) interface (SBI). For example, in some embodiments, private policies and private provisions may come from a policy control function (PCF), and settings and configurations may come from a unified data repository (UDR).

[0119] 3GPP defines a service-based architecture (SBA) in which the control plane functions and common data repository of the 5G network are provided by a set of interconnected network functions (NFs), each of which has authorization to access each other's services. In an embodiment, the 3GPP SBA can be extended from the core network to the client privacy violation engine 201 and the network-side privacy violation engine 203, which can be represented by SBA functions. In such an embodiment, the client privacy violation engine 201 and the network-side privacy violation engine 203 can interact through the SBA bus. For example, Figure 2 The signaling represented by steps 1, 3 and 5 can be transmitted via the SBA bus.

[0120] For example, the network privacy violation detection engine may process: signaling flows for communicating with the AS, network entities, and the WTRU; and / or user plane flows including an intermediate model for the FL provided by the AS.

[0121] In such an embodiment, the network-side privacy violation engine may separate the functionality into a signaling part and a user plane part. The signaling function may communicate with the user plane level function, which may be co-located or close to the serving UPF for the corresponding WTRU. Since the user plane flow is in the path between the WTRU and the UPF, the UP function is able to easily perform black box violation detection.

[0122] Figure 4 An example flow chart of a method for detecting privacy rule or regulatory violations in a federated learning model according to some exemplary embodiments is shown. In some embodiments, Figure 4 The method may be performed by a WTRU (e.g., Figure 2 and / or Figure 3 In other exemplary embodiments, Figure 4 The method may be performed, for example, by one or more other network elements or network entities.

[0123] like Figure 4 As shown in the example of , the method may include receiving a federated learning intermediate model or an initial model from a network entity at 405. For example, in an exemplary embodiment, the network entity may be or may include an AS, or may be another 3GPP or core network node. As shown at 410, the method may include training the federated learning intermediate model using a training data set unique to the WTRU to generate a trained federated learning intermediate model.

[0124] like Figure 4 As further shown in the example, at 415, the method may include determining, based on one or more rules associated with the location of the WTRU, whether any one or more of (i) a trained federated learning intermediate model and / or (ii) a training data set indicates or contains one or more privacy violations.

[0125] According to some embodiments, the one or more rules associated with the location of the WTRU may include at least one of a privacy policy, a privacy law, and / or a privacy regulation.In an embodiment, the rules associated with the location of the WTRU may be received from a network entity.

[0126] Based on whether any one or more of the trained federated learning intermediate model and / or the training data set indicates one or more privacy violations, the method may include sending a message or information to a network entity at 420 .

[0127] In one embodiment, determination 415 may include determining that any one or more of the trained federated learning intermediate model (or initial model) and / or the training data set does not contain or indicate one or more privacy violations. When it is determined that the trained federated learning intermediate model and / or the training data set does not indicate a privacy violation, the message or information sent may include or indicate the trained federated learning intermediate (or initial) model. In other words, according to an embodiment, when it is determined that the trained federated learning intermediate model and / or the training data set does not contain or indicate a privacy violation, the message or information sent may include or indicate the trained federated learning (intermediate or initial) model.

[0128] In one embodiment, determination 415 may include determining whether any one or more of the trained federated learning intermediate model (or initial model) and / or the training data set indicates or includes one or more privacy violations. When it is determined that the trained federated learning intermediate (or initial) model and / or the training data set does indicate or include a privacy violation, the message sent may then include or may indicate that the trained federated learning intermediate model is rejected. In other words, according to an embodiment, in the event that it is determined that the trained federated learning intermediate model and / or the training data set does in fact include or indicate a privacy violation, the message or information sent may then indicate that the trained federated learning (intermediate or initial) model is rejected.

[0129] In a representative embodiment, determining 415 whether any one or more of the trained federated learning intermediate model and the training dataset indicates one or more privacy violations may include: (i) sending a request to a network entity to perform privacy violation detection on the trained intermediate model, wherein the request includes or indicates an authorization token; (ii) receiving additional information from a network-side privacy violation engine, wherein the additional information includes or indicates at least one of privacy regulations, privacy laws, updated privacy policies, and / or AIML models; and (iii) determining whether any one or more of the trained federated learning intermediate model and / or the training dataset indicates one or more privacy violations based on the additional information.

[0130] In an exemplary embodiment, determination 415 may include using a white-box approach by the WTRU's client privacy violation engine to determine whether any one or more of the trained federated learning intermediate model (or initial model) and / or the training data set indicates one or more privacy violations.

[0131] According to some embodiments, although Figure 4 Not shown in the example of , the method may optionally include receiving a request for the WTRU's location from a network entity and sending the WTRU's location to the network entity.

[0132] In an embodiment, the method may further include iteratively performing the receiving, training, determining, and sending steps until the training session of the federated learning intermediate model is completed.

[0133] It should be noted that Figure 4 is an example provided according to some embodiments. However, Figure 4 The steps shown in should not be interpreted as mandatory steps for implementing the exemplary embodiments. For example, it should be understood that Figure 4 The method may be modified or combined with other examples or embodiments described elsewhere herein.

[0134] Figure 5An example flow chart of a method for detecting privacy rule or regulatory violations, such as in a federated learning model, according to some exemplary embodiments is shown. In some embodiments, Figure 5 The method may be performed by a network entity or a network node or implemented in a network entity or a network node. For example, in an embodiment, Figure 5 The method may be executed by a network (NW) side privacy engine and / or AS, such as Figure 2 or Figure 3 It should be noted that the NW-side privacy engine can be implemented in a variety of network elements or entities. In other exemplary embodiments, Figure 5 The method may be performed by other network elements or network entities / entities, such as a 3GPP or core network node.

[0135] like Figure 5 As shown in the example of , the method may include receiving a federated learning model at 505. For example, in one embodiment, the federated learning model may be received from an application server or other similar entity or server. In an embodiment, Figure 5 The method may include, at 510, determining whether the federated learning model includes, contains, and / or indicates one or more privacy violations.

[0136] Based on whether the federated learning model indicates one or more privacy violations, the method may include sending a message or information to the plurality of WTRUs or the application server as shown at 515. For example, in one embodiment, determining 510 may include or result in determining that the federated learning model does not indicate one or more privacy violations, and in this case, sending 515 may include sending a message including or indicating the federated learning model to the plurality of WTRUs. In another embodiment, determining 510 may include or result in determining that the federated learning model indicates or includes one or more privacy violations, and in this case, sending 515 may include sending a message to the application server that may include or indicate that the federated learning model includes or indicates a privacy violation.

[0137] In some embodiments, the method may optionally include receiving trained federated learning models from multiple WTRUs and aggregating the trained federated learning models to generate a new federated learning model.

[0138] According to an embodiment, the method may optionally include sending configuration information to the WTRU, wherein the configuration information includes at least one of a privacy policy, a privacy law, and / or a privacy regulation.

[0139] In an embodiment, the method may optionally include sending a request for the location of one or more WTRUs.

[0140] According to an embodiment, the configuration information may include at least one of a privacy policy, a privacy law, and / or a privacy regulation based on the location of the one or more WTRUs.

[0141] In some exemplary embodiments, determining 510 may include determining, by the NW-side privacy violation engine, whether any one or more of the trained federated learning intermediate model and / or the training dataset indicates one or more privacy violations, such as using a black-box approach.

[0142] According to an embodiment, the steps of determining whether the federated learning model indicates or contains one or more privacy violations, sending a message, and receiving a trained federated learning model from the WTRU may be performed iteratively until the training session of the federated learning intermediate model is completed. For example, the training session may be considered completed after a certain number of (e.g., predefined) iterations or when the federated learning model reaches a certain (e.g., predefined) performance threshold.

[0143] It should be noted that Figure 5 is an example of a method provided according to some embodiments. However, Figure 5 The steps shown in should not be interpreted as mandatory steps for implementing the exemplary embodiments. For example, it should be understood that Figure 5 The method may be modified or combined with other examples or embodiments described elsewhere herein.

[0144] in conclusion

[0145] Although features and elements are provided above in specific combinations, it will be understood by those of ordinary skill in the art that each feature or element can be used alone or in any combination with other features and elements. The present disclosure is not limited to the specific embodiments described in this application, which are intended to illustrate multiple aspects. It will be understood by those of ordinary skill in the art that many modifications and changes can be made without departing from its spirit and scope. Unless expressly provided, any element, action or instruction used in the description of this application should not be interpreted as being essential or indispensable to the present invention. In addition to those listed herein, those of ordinary skill in the art will understand from the foregoing description that functionally equivalent methods and devices within the scope of the present disclosure. Such modifications and changes are intended to fall within the scope of the appended claims. The present disclosure is limited only by the terms of the appended claims and the full range of equivalents enjoyed by such claims. It should be understood that the present disclosure is not limited to a particular method or system.

[0146] For simplicity, the foregoing embodiments are discussed with respect to the terminology and structure of infrared-enabled devices (i.e., infrared transmitters and receivers). However, the embodiments discussed are not limited to these systems, but may be applied to other systems using other forms of electromagnetic waves or non-electromagnetic waves (e.g., sound waves).

[0147] It should also be understood that the terminology used herein is used only to describe specific embodiments and is not intended to be limiting. As used herein, the term "video" or the term "image" may refer to any of a snapshot, a single image, and / or a plurality of images displayed over time. As another example, when referred to herein, the term "user equipment" and its abbreviation "UE", the term "remote" and / or the term "head-mounted display" or its abbreviation "HMD" may refer to or include (i) a wireless transmit and / or receive unit (WTRU); (ii) any one of a plurality of embodiments of a WTRU; (iii) a wireless and / or wired (e.g., bindable) device configured with some or all of the structure and functionality of a WTRU; (iii) a wireless and / or wired device configured with less than all of the structure and functionality of a WTRU; or (iv) the like. References herein Figures 1A-1D Details of an example WTRU are provided, which may represent any WTRU described herein. As another example, various embodiments disclosed herein above and below are described as using a head mounted display. One of ordinary skill in the art will recognize that devices other than head mounted displays may be used, and that some or all of the present disclosure and various disclosed embodiments may be modified accordingly without undue experimentation. Examples of such other devices may include drones or other devices configured to stream information for providing an adapted reality experience.

[0148] In addition, the methods provided herein can be implemented in a computer program, software, or firmware, which are incorporated into a computer-readable medium for execution by a computer or processor. Examples of computer-readable media include electronic signals (transmitted via a wired or wireless connection) and computer-readable storage media. Examples of computer-readable storage media include, but are not limited to, read-only memory (ROM), random access memory (RAM), registers, caches, semiconductor storage devices, magnetic media (e.g., internal hard disks and removable disks), magneto-optical media, and optical media (e.g., CD-ROM disks and digital versatile disks (DVDs)). A processor associated with software can be used to implement a radio frequency transceiver for use in a WTRU, UE, terminal, base station, RNC, MME, EPC, AMF, or any host.

[0149] Variations of the above methods, devices, and systems are possible without departing from the scope of the present invention. In view of the wide variety of embodiments that can be applied, it should be understood that the illustrated embodiments are merely examples and should not be considered to limit the scope of the following claims. For example, embodiments provided herein include handheld devices that can include or be used with any suitable voltage source (e.g., a battery, etc.) that provides any suitable voltage.

[0150] In addition, in the embodiments provided above, processing platforms, computing systems, controllers and other devices including processors are mentioned. These devices may include at least one central processing unit ("CPU") and memory. According to the practice of those skilled in the art of computer programming, a variety of CPUs and memories may perform references to symbolic representations of actions and operations or instructions. These actions and operations or instructions may be referred to as "execution", "computer execution" or "CPU execution".

[0151] Those of ordinary skill in the art will appreciate that the actions and symbolic representations of operations or instructions include the manipulation of electrical signals by the CPU. The electrical system represents data bits, which may result in the ultimate transformation or reduction of electrical signals and the maintenance of data bits at memory locations in the memory system, thereby reconfiguring or otherwise changing the operation of the CPU, as well as other processing of signals. The memory locations where data bits are maintained are physical locations having specific electrical, magnetic, optical, or organic properties corresponding to or representing data bits. It should be understood that the embodiments are not limited to the above-mentioned platforms or CPUs, and other platforms and CPUs may also support the provided methods.

[0152] The data bits may also be stored on computer-readable media, including magnetic disks, optical disks, and any other volatile (e.g., random access memory (RAM)) or non-volatile (e.g., read-only memory (ROM)) mass storage systems that can be read by the CPU. The computer-readable media may include cooperating or interconnected computer-readable media that reside entirely on the processing system or distributed among multiple interconnected processing systems that may be local or remote to the processing system. It should be understood that the embodiments are not limited to the above-mentioned memories, and other platforms and memories may support the provided methods.

[0153] In an illustrative embodiment, any operations, processes, etc. described herein may be implemented as computer-readable instructions stored on a computer-readable medium. The computer-readable instructions may be executed by a processor of a mobile unit, a network element, and / or any other computing device.

[0154] There is little distinction between hardware and software implementations of aspects of the system. The use of hardware or software is often (but not always, as the choice between hardware and software may become important in certain circumstances) a design choice that represents a trade-off between cost and efficiency. There may be a variety of carriers (e.g., hardware, software, and / or firmware) to implement the processes and / or systems and / or other techniques described herein, and the preferred carrier may vary depending on the environment in which the processes and / or systems and / or other techniques are deployed. For example, if the implementer determines that speed and accuracy are critical, the implementer may choose a hardware and / or firmware-based carrier. If flexibility is critical, the implementer may choose a software-based implementation. Alternatively, the implementer may choose some combination of hardware, software, and / or firmware.

[0155] The foregoing detailed description has been described by using block diagrams, flow charts and / or examples to illustrate various embodiments of the device and / or process. As long as these block diagrams, flow charts and / or examples include one or more functions and / or operations, it will be understood by those of ordinary skill in the art that each function and / or operation in these block diagrams, flow charts or examples can be implemented individually and / or collectively by a variety of hardware, software, firmware or almost any combination. In an embodiment, several parts of the subject matter described herein can be implemented by application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs) and / or other integrated formats. However, it will be recognized by those of ordinary skill in the art that certain aspects of the embodiments disclosed herein can be implemented in whole or in part in an integrated circuit equivalently, as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g., as one or more programs running on one or more microprocessors), as firmware, or as almost any combination thereof, and according to the present disclosure, designing circuits and / or writing software and / or firmware codes are completely within the skill range of those of ordinary skill in the art. Furthermore, one of ordinary skill in the art will recognize that the mechanisms of the subject matter described herein can be distributed as a program product in various forms, and that the illustrative embodiments of the subject matter described herein are applicable to the particular type of signal-bearing media used to actually perform the distribution. Examples of signal-bearing media include, but are not limited to, the following: recordable type media, such as floppy disks, hard drives, CDs, DVDs, digital tapes, computer memory, etc.; and transmission type media, such as digital and / or analog communication media (e.g., fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).

[0156] Those of ordinary skill in the art will recognize that it is common in the art to describe devices and / or processes in the manner described herein and then use engineering practices to integrate the devices and / or processes into data processing systems. That is, at least a portion of the devices and / or processes described herein can be integrated into data processing systems through reasonable experiments. Those of ordinary skill in the art will recognize that a typical data processing system can generally include a system unit housing, a video display device, a memory (e.g., volatile and non-volatile memory), a processor (e.g., a microprocessor and a digital signal processor), a computing entity (e.g., an operating system, a driver, a graphical user interface, and an application), one or more interactive devices (e.g., a touch pad or screen) and / or a control system including a feedback loop and a control motor (e.g., feedback for sensing position and / or velocity, a control motor for moving and / or adjusting components and / or quantities). A typical data processing system can be implemented using any suitable commercially available components, such as components commonly found in data computing / communication and / or network computing / communication systems.

[0157] The subject matter described herein sometimes shows different components contained in or connected to different other components.It should be understood that the architecture depicted in this way is only an example, and many other architectures that realize the same function can actually be realized.In a conceptual sense, any component arrangement that realizes the same function is effectively "associated", so that the required function can be realized.Therefore, any two components combined to realize a specific function herein can be regarded as "associated" to each other, so as to realize the required function, regardless of the architecture or intermediate components.Similarly, any two components so associated can also be regarded as "operably connected" or "operably coupled" to each other to realize the required function, and any two components that can be so associated can also be regarded as "operably coupled" to each other to realize the required function.Specific examples of operable coupling include but are not limited to physically matchable and / or physically interacting components and / or wirelessly interactable and / or wirelessly interacting components and / or logically interacting and / or logically interacting components.

[0158] With respect to the use of almost any plural and / or singular terms herein, one of ordinary skill in the art can translate the plural to the singular and / or the singular to the plural, depending on the context and / or application. For clarity, various singular / plural arrangements may be expressly set forth herein.

[0159] One of ordinary skill in the art will understand that, in general, the terms used herein, especially in the appended claims (e.g., the bodies of the appended claims), are generally intended to be "open" terms (e.g., the term "comprising" should be interpreted as "including but not limited to", the term "having" should be interpreted as "having at least", the term "including" should be interpreted as "including but not limited to", etc.). One of ordinary skill in the art will also understand that if an introduced claim item is intended to be a specific number, such intent will be expressly stated in the claim, and if no such statement is made, such intent does not exist. For example, when only one item is intended, the term "single" or similar language may be used. To aid understanding, the following appended claims and / or the description herein may include the use of the introductory phrases "at least one" and "one or more" to introduce claim items. However, the use of such phrases should not be construed as implying that the introduction of claim recitations by the indefinite article "a" or "an" will limit any particular claim including such introduced claim recitations to embodiments containing only one such recitation, even if the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "a" or "an" (e.g., "a" and / or "an" should be construed as "at least one" or "one or more"). The same is true for the use of definite articles used to introduce claim recitations. Furthermore, even if a specific number of introduced claim recitations is explicitly recited, one of ordinary skill in the art will recognize that such recitation should be interpreted as indicating at least that number (e.g., the mere recitation of "two recitations" without other modifiers means at least two recitations, or two or more recitations). In addition, where a convention similar to "at least one of A, B, and C, etc." is used, such a convention is generally intended to be understood by a person of ordinary skill in the art (e.g., "a system having at least one of A, B, and C" would include but is not limited to systems having A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). Where a convention similar to "at least one of A, B, or C, etc." is used, such a convention is generally intended to be understood by a person of ordinary skill in the art (e.g., "a system having at least one of A, B, or C" would include but is not limited to systems having A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). A person of ordinary skill in the art would further understand that virtually any disjunctive word and / or phrase representing two or more alternative terms, whether in the specification, claims, or drawings, should be understood to contemplate the possibility of including one, either, or both of the terms. For example, the phrase "A or B" would be understood to include the possibility of "A" or "B" or "A and B".Furthermore, as used herein, the term "any" followed by a listing of multiple items and / or multiple categories of items is intended to include "any," "any combination," "any plurality," and / or "any combination of plurality" of items and / or categories of items, alone or in combination with other items and / or other categories of items. Furthermore, as used herein, the term "set" is intended to include any number of items, including zero. Furthermore, as used herein, the term "number" is intended to include any number, including zero. Also, as used herein, the term "plurality" is intended to be synonymous with "plurality."

[0160] In addition, where features or aspects of the disclosure are described in terms of Markush groups, those skilled in the art will recognize that the disclosure is also thereby described in terms of any individual member or subgroup of members of the Markush group.

[0161] It will be understood by those of ordinary skill in the art that all ranges disclosed herein also encompass any possible sub-ranges and combinations of sub-ranges thereof for any purpose, such as in providing a written description. Any listed range can be easily understood to fully describe and be able to decompose the same range into at least equal halves, thirds, quarters, fifths, tenths, etc. As a non-limiting example, each range discussed herein can be easily decomposed into a lower third, a middle third, and an upper third, etc. It will also be understood by those of ordinary skill in the art that all languages, such as "at most", "at least", "greater than", "less than", etc., include the listed numbers and refer to the ranges that can be subsequently decomposed into sub-ranges as described above. Finally, it will be understood by those of ordinary skill in the art that a range includes each individual member. Therefore, for example, a group having 1-3 units refers to a group having 1, 2, or 3 units. Similarly, a group having 1-5 units refers to a group having 1, 2, 3, 4, or 5 units, and so on.

[0162] Furthermore, the claims should not be read as limited to the order or elements provided unless otherwise stated. Furthermore, the use of the term "means for" in any claim is intended to invoke 35 U.S.C. § 112, or means-plus-function claim format, any claim not using the term “means for…” is not intended to have such an intent.

[0163] Suitable processors include, for example, a general purpose processor, a special purpose processor, a conventional processor, a digital signal processor (DSP), a plurality of microprocessors, one or more microprocessors in association with a DSP core, a controller, a microcontroller, an application specific integrated circuit (ASIC), an application specific standard product (ASSP), a field programmable gate array (FPGA) circuit, any other type of integrated circuit (IC), and / or a state machine.

[0164] The WTRU may be coupled to hardware and / or software-implemented modules, including software-defined radio (SDR), and other components, such as cameras, video camera modules, video phones, speaker phones, vibration devices, speakers, microphones, television transceivers, hands-free headsets, keyboards, module, a frequency modulation (FM) wireless unit, a near field communication (NFC) module, a liquid crystal display (LCD) display unit, an organic light emitting diode (OLED) display unit, a digital music player, a media player, a video game player module, an Internet browser and / or any wireless local area network (WLAN) or ultra-wideband (UWB) module).

[0165] Although various embodiments have been described in the form of communication systems, it is contemplated that these systems can be implemented in software on a microprocessor / general purpose computer (not shown). In certain embodiments, one or more functions of various components can be implemented in software controlling a general purpose computer.

[0166] Furthermore, although the invention has been illustrated and described herein with reference to specific embodiments, the invention is not limited to the details shown. Rather, various modifications may be made to the details without departing from the invention within the scope and range of equivalents of the claims.

Claims

1. A method, implemented in a wireless transmit receive unit (WTRU), comprising: receiving a federated learning intermediate model from a network entity; training the federated learning intermediate model using a training dataset unique to the WTRU to generate a trained federated learning intermediate model; determining whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations based on one or more rules associated with the location of the WTRU; as well as A message is sent to the network entity based on whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations.

2. The method according to claim 1, wherein: The determining includes: determining that any one or more of the trained federated learning intermediate model and the training data set do not indicate one or more privacy violations; and The message includes the trained federated learning intermediate model.

3. The method according to claim 1, wherein: The determining includes: determining that any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations; and The message includes an indication that the trained federated learning intermediate model was rejected.

4. The method of any one of claims 1-3, wherein the one or more rules associated with the location of the WTRU include at least one of a privacy policy, a privacy law, and a privacy regulation.

5. The method according to any one of claims 1 to 4, further comprising: receiving a request for a location of the WTRU from the network entity; as well as The location of the WTRU is sent to the network entity.

6. The method according to any one of claims 1 to 5, further comprising: The rule associated with the location of the WTRU is received from the network entity.

7. The method of any one of claims 1-6, wherein determining whether any one or more of the trained federated learning intermediate model and the training dataset indicates one or more privacy violations comprises: Sending a request to the network entity to perform privacy violation detection on the trained federated learning intermediate model, wherein the request includes an authorization token; receiving additional information from a network-side privacy violation engine, the additional information comprising at least one of a privacy regulation, a privacy law, an updated privacy policy, and an AIML model; and A determination is made based on the additional information whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations.

8. The method of any one of claims 1-7, wherein the determining comprises determining, by a client-side privacy violation engine, using a white-box approach whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations.

9. The method according to any one of claims 1-8, further comprising iteratively performing the steps of receiving, training, determining and sending until a training session for the federated learning intermediate model is completed.

10. A wireless transmit / receive unit (WTRU), comprising: A circuit comprising at least one of a transmitter, a receiver, a processor, and a memory, the circuit being configured to: receiving a federated learning intermediate model from a network entity; training the federated learning intermediate model using a training dataset unique to the WTRU to generate a trained federated learning intermediate model; determining whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations based on one or more rules associated with the location of the WTRU; and A message is sent to the network entity based on whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations.

11. The WTRU of claim 10, wherein: The determining includes determining that any one or more of the trained federated learning intermediate model and the training data set do not indicate one or more privacy violations; and The message includes the trained federated learning intermediate model.

12. The WTRU of claim 10 wherein: The determining includes determining that any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations; and The message includes an indication that the trained federated learning intermediate model was rejected.

13. The WTRU of any one of claims 10-12, wherein the one or more rules associated with the location of the WTRU include at least one of a privacy policy, a privacy law, and a privacy regulation.

14. The WTRU of any one of claims 10-13, configured to: receiving a request for the location of the WTRU from the network entity; and The location of the WTRU is sent to the network entity.

15. The WTRU of any one of claims 10-14, configured to: The rule associated with the location of the WTRU is received from the network entity.

16. The WTRU of any one of claims 10-15, wherein to determine whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations, the WTRU is configured to: Sending a request to the network entity to perform privacy violation detection on the trained federated learning intermediate model, wherein the request includes an authorization token; receiving additional information from a network-side privacy violation engine, the additional information comprising at least one of a privacy regulation, a privacy law, an updated privacy policy, and an AIML model; and A determination is made based on the additional information whether one or more of the trained federated learning intermediate model and the training dataset indicates one or more privacy violations.

17. A WTRU according to any one of claims 10-16, wherein the determination includes using a white-box approach by a client-side privacy violation engine of the WTRU to determine whether one or more of the trained federated learning intermediate model and the training data set indicate one or more privacy violations.

18. The WTRU of any one of claims 10-7, configured to: The steps of receiving, training, determining and sending are iteratively performed until a training session for the federated learning intermediate model is completed.

19. A method comprising: Receiving, by the network entity, the federated learning model from the application server; determining, by the network entity, whether the federated learning model indicates one or more privacy violations; as well as A message is sent to a plurality of WTRUs or to the application server based on whether the federated learning model indicates one or more privacy violations.

20. The method of claim 19, wherein: The determining includes determining that the federated learning model does not indicate one or more privacy violations; and The sending includes sending a message including the federated learning model to the plurality of WTRUs.

21. The method of claim 19, wherein: The determining includes determining that the federated learning model indicates one or more privacy violations; and The sending includes sending a message to the application server including an indication that the federated learning model indicates a privacy violation.

22. The method according to claim 20, further comprising: receiving a trained federated learning model from the plurality of WTRUs; as well as The trained federated learning models are aggregated to generate a new federated learning model.

23. The method according to any one of claims 19 to 22, further comprising: Configuration information is sent to the WTRU, wherein the configuration information includes at least one of a privacy policy, a privacy law, and a privacy regulation.

24. The method according to any one of claims 19 to 23, further comprising: A request is sent for the location of one or more of the WTRUs.

25. The method of claim 23, wherein the configuration information comprises at least one of a privacy policy, a privacy law, and a privacy regulation based on the location of the one or more WTRUs.

26. A method according to any one of claims 19-25, wherein the determination includes using a black box approach by a network-side privacy violation engine to determine whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations.

27. The method according to any one of claims 19-26, further comprising iteratively performing the steps of determining, sending, and receiving until a training session for the federated learning intermediate model is completed.

28. A network element comprising: A circuit comprising at least one of a transmitter, a receiver, a processor, and a memory, the circuit being configured to: receiving a federated learning model from an application server; determining whether the federated learning model indicates one or more privacy violations; and Based on whether the federated learning model indicates one or more privacy violations, messages are sent to a plurality of WTRUs or application servers.

29. The network element of claim 28, wherein: The determining includes determining that the federated learning model does not indicate one or more privacy violations; and The sending includes sending a message including the federated learning model to the plurality of WTRUs.

30. The network element of claim 28, wherein: The determining includes determining that the federated learning model indicates one or more privacy violations; and The sending includes sending a message including an indication that the federated learning model indicates a privacy violation to the application server.

31. The network element of claim 29, configured to: receiving a trained federated learning model from the plurality of WTRUs; and The trained federated learning models are aggregated to generate a new federated learning model.

32. The network element according to any one of claims 28 to 31, configured to: Configuration information is sent to the WTRU, wherein the configuration information includes at least one of a privacy policy, a privacy law, and a privacy regulation.

33. The network element according to any one of claims 28 to 32, configured to: A request is sent for the location of one or more of the WTRUs.

34. The network element of claim 32, wherein the configuration information comprises at least one of a privacy policy, a privacy law, and a privacy regulation based on the location of the one or more WTRUs.

35. The network element of any one of claims 28-34, wherein the determining comprises determining, by a network-side privacy violation engine, using a black-box approach whether any one or more of the trained federated learning intermediate model and the training data set indicates one or more privacy violations.

36. The network element according to any one of claims 28 to 35, configured to: The steps of determining, sending, and receiving are iteratively performed until a training session for the federated learning intermediate model is completed.

Images