Federal learning model based on local differential privacy and transfer learning technology

Abstract

The invention relates to the field of local differential privacy and transfer learning, in particular to a scheme for realizing federated learning privacy protection by utilizing transfer learning based on parameter sharing and a PM perturbation mechanism. According to the scheme, privacy protection in the federal learning process can be realized, and meanwhile, the backbone model of the client is migrated and pruned, so that the communication overhead of training is greatly reduced under the condition that the model precision is not reduced. Firstly, aiming at the problem of high communication overhead caused by complexity and resource density of a deep learning model, a part of model parameters are allowed to be shared among a plurality of clients by utilizing the thought of transfer learning, and the model parameters form a shared encoder and freeze the shared encoder so as not to participate in a federated learning aggregation process. The residual network layers form a predictor, pruning is carried out on the predictor, the pruned predictor is updated, and finally the pruned part is recovered to be the model parameters before training. For the privacy leakage problem existing in the FL, a client can set an integral privacy budget according to the privacy protection requirement of the client, distribute the privacy budget of each round of training by adopting a dynamic privacy budget distribution method, and perform segmentation disturbance on a recovered predictor through a segmentation mechanism by using the privacy budget, so that the privacy leakage problem of the predictor is solved. And the client uploads the disturbed predictors to the central server, and the server aggregates the received predictors through a FedAvg algorithm and broadcasts the aggregated predictors to the client for the next round of training.

Description

Technical Field

[0001] The present invention relates to the field of local differential privacy and transfer learning, and specifically to a solution for implementing privacy protection in federated learning by utilizing transfer learning based on parameter sharing and PM perturbation mechanism. Background Art

[0002] In recent years, with the rapid development of artificial intelligence technology, machine learning has shown great potential and value in the fields of autonomous driving, face recognition, data mining, etc. However, data privacy and security issues have increasingly become key factors restricting its application [1]. Traditional centralized machine learning training requires the centralized storage and processing of large amounts of data, which not only increases the risk of data leakage, but also violates the principles of data sovereignty and privacy protection. To address this problem, federated learning (FL) was first proposed by Google in 2016 [2]. Federated learning is a distributed machine learning technology that allows multiple participants to jointly train a high-precision global model through collaborative learning while maintaining data locality. Federated learning not only promotes data sharing and knowledge integration across devices, enabling the model to better adapt to diverse data distributions and thus improve its generalization ability, but also significantly enhances client privacy protection [3]. Although FL has achieved success in practical applications, it still faces many severe challenges [4]. A significant challenge comes from the complexity and resource intensity of deep learning models, which leads to huge communication overhead. Existing studies have shown [5] that the local model parameters uploaded by the client in federated learning will leak their privacy. Protecting the client's privacy while achieving efficient model training is another key challenge of current federated learning. Transfer learning is a promising machine learning method for transferring knowledge in different fields with different probability distributions [6]. The idea of ​​transfer learning is introduced into the privacy protection of federated learning, which ensures privacy protection while greatly reducing resource consumption. Differential privacy (DP) has now become a mainstream privacy protection mechanism in FL. It is a strict privacy protection technology that prevents attackers from accessing personal information through publicly available data or service interfaces. The principle of DP is to introduce a certain degree of uncertainty noise into the model parameters published by the client, mask the model parameter information held by each client, and prevent the client data parameters from being attacked by attackers using member inference. Privacy protection technology based on DP can be achieved by adding random noise without additional communication overhead. The method combining transfer learning and local differential privacy provides a high-efficiency and strong privacy protection solution for the actual deployment of federated learning.

[0003] In order to cope with challenges such as high communication overhead and privacy leakage risks, many researchers have carried out extensive research work. Yu et al. [7] proposed an innovative federated learning method SPATL, which solved privacy protection challenges such as high communication cost, limited resources and data heterogeneity through parameter selection agent, model splitting and gradient control mechanism, achieved reduced communication overhead, accelerated model inference and stable training process, and provided results that are superior to existing technologies. Tang et al. [8] proposed a privacy protection framework that combines federated learning and transfer learning for wind power prediction. By designing a hybrid model with a series architecture as the backbone model and a two-stage training strategy of pre-training and personalized fine-tuning based on federated learning, an accurate and personalized wind turbine prediction model is established without leaking the original data. Tu et al. [9] proposed an innovative dynamic layer sharing mechanism FedDL, which intelligently constructs a shared model architecture by deeply analyzing the similarities between client model weights. This process adopts an iterative and bottom-up approach to effectively integrate local models. FedDL uses this dynamic sharing strategy to not only ensure the high accuracy of the model, but also significantly improve the rate of model convergence. Dong et al.

[10] proposed a personalized and adaptive differentially private federated meta-learning mechanism PADP-FedMeta, which introduced federated meta-learning to mitigate the negative impact of Non-IID on model accuracy and significantly improved the convergence speed of adaptive privacy parameters. Liu et al.

[11] proposed a secure and reliable federated learning algorithm that integrates hybrid differential privacy. By distinguishing the privacy requirements of the client and analyzing the convergence and privacy boundaries of the algorithm, it introduced adaptive gradient clipping and improved synthesis technology to effectively reduce the negative impact of noise and clipping. Wei et al.

[12] proposed an innovative gradient leakage resilience method, which enhanced the privacy protection of distributed SGD in federated learning through adaptive noise injection and trend tracking, while optimizing model accuracy and attack resilience. [1]Wen J, Zhang Z, Lan Y, et al. A survey on federated learning: challenges and applications [J]. International Journal of Machine Learning and Cybernetics, 2023, 14(2): 513-535. [2]McMahan B,Moore E,Ramage D,et al.Communication-efficient learningof deep networks from decentralized data[C] / / Artificial intelligence andstatistics.PMLR,2017:1273-1282. [3]Ezzeldin,Y.H.;Yan,S.;He,C.;Ferrara,E.;and Avestimehr,A.S.2023.Fairfed:Enabling group fairness in federated learning.In Proceedingsof the AAAI Conference on Artificial Intelligence,volume 37,7494–7502. [4]Guendouzi B S,Ouchani S,Assaad H E L,et al.A systematic review offederated learning:Challenges,aggregation methods,and development tools[J].Journal of Network and Computer Applications,2023:103714. [5]Zhu L,Liu Z,Han S.Deep leakage from gradients[J].Advances inneural information processing systems,2019,32. [6]Tan,Y.;Liu,Y.;Long,G.;Jiang,J.;Lu,Q.;and Zhang,C.2023.Federatedlearning on non-iid graphs via structural knowledge sharing.In Proceedingsofthe AAAI conference on artificial intelligence,volume 37,9953–9961. [7]Yu S,Nguyen P,Abebe W,et al.Spatl:Salient parameter aggregationand transfer learning for heterogeneous federated learning[C] / / SC22:International Conference for High Performance Computing,Networking,Storageand Analysis.IEEE,2022:1-14. [8]Tang Y,Zhang S,Zhang Z.A privacy-preserving framework integratingfederated learning and transfer learning for wind power forecasting[J].Energy,2024,286:129639. [9]Tu,L.;Ouyang,X.;Zhou,J.;He,Y.;and Xing,G.2021.Feddl:Federatedlearning via dynamic layer sharing for human activity recognition.InProceedings of the 19th ACM Conference on Embedded Networked Sensor Systems,15–28.

[10] Dong F,Ge X,Li Q,et al.PADP-FedMeta:A personalized and adaptivedifferentially private federated meta learning mechanism for AIoT[J].Journalof Systems Architecture,2023,134:102754.

[11] Liu W,Cheng J,Wang X,et al.Hybrid differential privacy basedfederated learning for Internet of Things[J].Journal of Systems Architecture,2022,124:102418.

[12] Wei W, Liu L, Zhou J, et al.Securing distributed sgd against gradient leakage threats[J].IEEE Transactions on Parallel and DistributedSystems,2023,34(7):2040-2054. Summary of the invention

[0004] The purpose of the present invention is to design a federated learning model based on local differential privacy and transfer learning technology, which can reduce communication overhead and not reduce model accuracy while performing federated learning privacy protection. Specifically, in view of the problem of high communication overhead caused by the complexity and resource intensity of deep learning models, we use the idea of ​​transfer learning to allow multiple clients to share a part of model parameters. These model parameters form a shared encoder and freeze it, and do not participate in the federated learning aggregation process. The remaining network layers form a predictor, the predictor is pruned, the pruned predictor is updated, and finally the pruned part is restored to the model parameters before training. In view of the privacy leakage problem existing in FL, the client can set an overall privacy budget according to its own privacy protection needs, and use a dynamic privacy budget allocation method to allocate the privacy budget for each round of training. The privacy budget is used to perturb the restored predictor in segments through a segmentation mechanism. The client uploads the perturbed predictor to the central server, and the server aggregates the received predictor through the FedAvg algorithm and broadcasts it to the client.

[0005] The objective of the present invention is achieved through the following technical solutions: A federated learning model based on local differential privacy and transfer learning technology, the technology comprising: Step 1: In the initialization phase, the server initializes the global model and sends it to the client; Step 2: In the parameter selection phase, each client chooses its own overall privacy budget ε total and dynamic privacy budget Step 3: In the model pruning and updating phase, the client divides the local backbone model into a shared encoder and a predictor, prunes the predictor, then updates it using the mask generated by the shared encoder, and finally restores the predictor; Step 4: In the PM perturbation phase, the client uses the selected dynamic privacy budget to perform PM perturbations on the updated and recovered predictor, and then sends the perturbed predictor to the central server; Step 5: In the model aggregation phase, the central server performs FedAvg aggregation on the received noisy predictors and sends the aggregation results to the client for the next round of training. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0007] Figure 1 This is a system model diagram of a federated learning model based on local differential privacy and transfer learning technology according to an embodiment of the present invention; Figure 2 Schematic diagram of the model accuracy of the MNIST and CIFAR10 datasets under different shared encoder layers n in the embodiment of the present invention. Figure 2 It can be seen that the larger the number of shared encoder layers n, the lower the accuracy of the model; Figure 3 This is a schematic diagram showing how the accuracy of an embodiment of the present invention changes with the number of training rounds when the number of shared encoder layers n=0.25N. DETAILED DESCRIPTION

[0008] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, which does not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0009] Figure 1 A system model diagram of a federated learning model based on local differential privacy and transfer learning technology provided in an embodiment of the present invention, wherein the steps include:

[0010] System entities: C clients participating in federated learning and a service center;

[0011] Step 1: In the system initialization phase, the server initializes a global model w0 and then sends it to all clients. The clients use the local dataset D i Train the global model w0 to obtain the backbone model of the initial round of clients

[0012] Step 2: In the parameter selection phase, each client chooses its own overall privacy budget ε total and dynamic privacy budget At the beginning of each round of training, the client obtains the privacy budget allocated by the generalization through the dynamic privacy budget allocation method. GetGlobalAccuracy(·) is used to obtain the accuracy of the global model obtained by the client from the server during model training. The difference between the current round of global model training accuracy and the previous round of model training accuracy is judged to determine whether to increase the privacy budget. Privacy budget ε t The dynamic selection mechanism is: in Indicates the global accuracy of this round, represents the global accuracy of the previous round, λ>1 represents the growth rate, ε t represents the privacy budget of round t, ε max represents the maximum privacy budget. When the difference in model training accuracy is less than the threshold τ, the privacy budget increases by λ times. When the privacy budget is greater than ε max , it will not increase any more until the overall privacy budget is exhausted.

[0013] Step 3: In the model pruning and recovery phase, the backbone model w of each client is divided into a shared encoder w e and the client-specific predictor w p Among them, the shared encoder w e It consists of the first n layers of the backbone model and a client-specific predictor w p It is composed of the remaining Nn layers of the backbone model, where n is an adjustable hyperparameter and N represents the total number of layers of the backbone model. For each client, the predictor is evaluated by L1-norm The importance score of the channel in each layer is calculated, and the smallest ρ ratio model is deleted to achieve model pruning. The pruning operation is: ⊙ represents element-by-element multiplication, M i is a binary mask matrix used to determine the channels to prune. The client then uses local data D specific to each client i Perform a forward pass on the shared encoder to generate the embedding e i . Then use the embedding i Update each pruned predictor The update operation is: η is the learning rate, l i is the loss function of client i, is a predictor variable The local gradient of . Finally, the model parameters need to be restored before aggregation. The restoration operation is:

[0014] Step 4: In the PM perturbation phase, PM is used to perturb the parameters of client i after the update and recovery in the t+1th round according to the selected privacy budget: Where PM(·) represents PM disturbance, represents the privacy budget of client i in the tth round update, M i represents the binary mask matrix of the channel to be pruned by client i, ε0 represents the minimum value of the privacy budget in each training round, preventing the perturbation gradient from being unable to be obtained by using a too small privacy budget; ε max It represents the maximum value of the privacy budget, which prevents the dynamic privacy budget method from allocating too large a privacy budget in each round, thus leading to the premature end of training. After T rounds of training, the sum of each client’s dynamic privacy budget is smaller than the client’s global privacy budget: in, represents the privacy budget of client i in the tth round of training, represents the global privacy budget of client i.

[0015] Step 5: In the model aggregation phase, client i adds the noisy predictor Sent to the central server, the central server adds noise to the predictor FedAvg aggregation is performed as follows: Among them, D i represents the local dataset of client i, and D represents the union of all client datasets. Finally, the server aggregates the results The results are broadcast to each client, and the client conducts the next round of training based on the aggregated results until the model accuracy converges.

[0016] As described above, the federated learning model based on local differential privacy and transfer learning technology proposed in the present invention can achieve privacy protection in the federated learning process, and migrate and prune the backbone model of the client, greatly reducing the communication overhead of training while ensuring that the model accuracy is not reduced.

Claims

1. A federated learning model based on local differential privacy and transfer learning technology, characterized in that: The techniques include: Step 1: In the initialization phase, the server initializes the global model and sends it to the client; Step 2: In the parameter selection phase, each client chooses its own overall privacy budget ε total and dynamic privacy budget Step 3: In the model pruning and updating phase, the client divides the local backbone model into a shared encoder and a predictor, prunes the predictor, then updates it using the mask generated by the shared encoder, and finally restores the predictor; Step 4: In the PM perturbation phase, the client uses the selected dynamic privacy budget to perform PM perturbations on the updated and recovered predictor, and then sends the perturbed predictor to the central server; Step 5: In the model aggregation phase, the central server performs FedAvg aggregation on the received noisy predictors and sends the aggregation results to the client for the next round of training.

2. The federated learning model based on local differential privacy and transfer learning technology according to claim 1 is characterized in that: The process of step 1 is specifically as follows: The server initializes a global model w0 and sends it to all clients. The clients use the local dataset D i Train the global model w0 to obtain the backbone model of the initial round of clients 3. The federated learning model based on local differential privacy and transfer learning technology according to claim 1 is characterized in that: The process of step 2 is specifically as follows: Each client chooses its own overall privacy budget ε total and dynamic privacy budget At the beginning of each round of training, the client obtains the privacy budget allocated by the generalization through the dynamic privacy budget allocation method. GetGlobalAccuracy(·) is used to obtain the accuracy of the global model obtained by the client from the server during model training. The difference between the current round of global model training accuracy and the previous round of model training accuracy is judged to determine whether to increase the privacy budget. Privacy budget ε t The dynamic selection mechanism is: in Indicates the global accuracy of this round, represents the global accuracy of the previous round, λ>1 represents the growth rate, ε t represents the privacy budget of round t, ε max represents the maximum privacy budget. When the difference in model training accuracy is less than the threshold τ, the privacy budget increases by λ times. When the privacy budget is greater than ε max , it will not increase any more until the overall privacy budget is exhausted.

4. The federated learning model based on local differential privacy and transfer learning technology according to claim 1 is characterized in that: The process of step 3 is specifically as follows: Split each client’s backbone model w into a shared encoder w e and the client-specific predictor w p Among them, the shared encoder w e It consists of the first n layers of the backbone model and a client-specific predictor w p It is composed of the remaining Nn layers of the backbone model, where n is an adjustable hyperparameter and N represents the total number of layers of the backbone model. For each client, the predictor is evaluated by L1-norm The importance score of the channel in each layer is calculated, and the smallest ρ ratio model is deleted to achieve model pruning. The pruning operation is: ⊙ represents element-by-element multiplication, M i is a binary mask matrix used to determine the channels to prune. The client then uses local data D specific to each client i Perform a forward pass on the shared encoder to generate the embedding e i . Then use the embedding i Update each pruned predictor The update operation is: η is the learning rate, l i is the loss function of client i, is a predictor variable The local gradient of . Finally, the model parameters need to be restored before aggregation. The restoration operation is:

5. The federated learning model based on local differential privacy and transfer learning technology according to claim 1 is characterized in that: The process of step 4 is specifically as follows: Use PM to perturb the parameters of client i after updating and recovering in round t+1 according to the selected privacy budget: Where PM(·) represents PM disturbance, represents the privacy budget of client i in the tth round update, M i represents the binary mask matrix of the channel to be pruned by client i, ε0 represents the minimum value of the privacy budget in each training round, preventing the perturbation gradient from being unable to be obtained by using a too small privacy budget; ε max It represents the maximum value of the privacy budget, which prevents the dynamic privacy budget method from allocating too large a privacy budget in each round, thus leading to the premature end of training. After T rounds of training, the sum of each client’s dynamic privacy budget is smaller than the client’s global privacy budget: in, represents the privacy budget of client i in the tth round of training, represents the global privacy budget of client i.

6. The federated learning model based on local differential privacy and transfer learning technology according to claim 1, characterized in that: The process of step 5 is specifically as follows: Client i adds the noisy predictor Sent to the central server, the central server adds noise to the predictor Perform FedAvg aggregation as follows: Among them, D i represents the local dataset of client i, and D represents the union of all client datasets. Finally, the server aggregates the results The results are broadcast to each client, and the client conducts the next round of training based on the aggregated results until the model accuracy converges.

Images