Distributed model parameter privacy protection method, system, medium and program

Abstract

The invention belongs to the technical field of data privacy protection. The distributed model parameter privacy protection method comprises the following steps: acquiring an initial global model of each node; training the initial global model by using the local data of each node to obtain local model update; in the local model updating process, noise data formed by a differential privacy algorithm are introduced, and a local noise gradient is obtained; and in the central server, performing parameter aggregation on the plurality of local noise gradients, and updating global model parameters to obtain a target global model. Differential privacy noise is introduced in local model updating, it is ensured that sensitive information of participants cannot be leaked in the data transmission process, and therefore the potential privacy leakage risk is effectively prevented. The method not only improves the data privacy protection level, but also realizes better balance between performance and privacy protection, and enhances the security and adaptability of distributed learning.

Description

Technical Field

[0001] The present application belongs to the field of data privacy protection technology, and in particular, relates to a distributed model parameter privacy protection method, system, medium and program. Background Art

[0002] The application of existing technologies in distributed learning mainly includes centralized learning, federated learning, and independent application of differential privacy. Although these technologies each have their own advantages, there are still some obvious shortcomings in practical applications. Centralized learning concentrates the data of all participants on a central server for training. The advantage of this method is that it can make full use of a large amount of data for model optimization, thereby improving the accuracy of the model. However, centralized learning also brings significant privacy risks, because the participants need to share their original data, which may lead to the leakage of sensitive information. In addition, centralized learning has very high requirements for bandwidth and storage resources. The transmission of a large amount of data to the central server not only consumes resources, but also increases the cost and time of data transmission. More importantly, the central server becomes a potential risk of single point failure. Once attacked or fails, the operation of the entire system will be seriously affected.

[0003] Federated learning is a distributed learning method that allows each participant to train a model locally and share only model parameters or updates, but not the original data. Although federated learning solves the data privacy problem to a certain extent, it still has some hidden dangers. First, model parameter updates may contain sensitive information about local data, especially when the number of participants is small or the model parameters are complex. In this case, an attacker may infer sensitive information about local data by analyzing the model parameter updates. In addition, federated learning is also subject to security threats such as inference attacks and reverse engineering attacks, which further increase the risk of privacy leakage.

[0004] Differential privacy is a method of protecting privacy by introducing noise into the data, ensuring that any single data point has a negligible impact on the overall statistical results. Although differential privacy can effectively protect data privacy, its independent application also has some limitations. First, the introduction of noise will affect the accuracy of the model, especially when the amount of data is small or the noise is large. In addition, differential privacy is usually applied in a centralized data processing environment. For distributed learning scenarios, additional mechanisms are needed to ensure its effectiveness and applicability.

[0005] In summary, existing technologies have many deficiencies in terms of privacy protection, performance-privacy balance, security, and adaptability. Centralized learning has high privacy risks and consumes a lot of resources; although federated learning avoids data concentration, it does not fully solve the privacy problem of model updates and is vulnerable to various attacks; differential privacy is difficult to play an effective role in a distributed environment when applied independently. Summary of the invention

[0006] Based on this, it is necessary to provide a distributed model parameter privacy protection method, system, medium and program to solve the above technical problems.

[0007] In a first aspect, the present application provides a distributed model parameter privacy protection method, the method comprising:

[0008] Get the initial global model of each node;

[0009] Using the local data of each node, the initial global model is trained to obtain a local model update;

[0010] In the local model update, noise data formed by the differential privacy algorithm is introduced to obtain a local noise gradient;

[0011] In the central server, parameters of the multiple local noise gradients are aggregated, and the global model parameters are updated to obtain the target global model.

[0012] In some practicable manners, the step of training the initial global model using the local data of each node to obtain a local model update includes:

[0013] The node uses the local data as input and forward propagates through the initial global model to obtain a prediction result;

[0014] Calculate a loss function using the prediction result and the true label corresponding to the local data, evaluate the initial global model, and obtain a loss value, wherein the loss value represents the difference between the prediction of the initial global model and the true label;

[0015] According to the loss value, obtaining the parameter gradient of the initial global model;

[0016] The initial global model is updated according to the parameter gradient of the initial global model to obtain the local model update.

[0017] In some practicable manners, the step of obtaining the parameter gradient of the initial global model according to the loss value includes:

[0018] According to the loss value, the gradient of the loss function relative to the initial global model parameters is calculated by the back propagation algorithm Obtaining an adjustment direction of the initial global model;

[0019] According to the adjustment direction of the initial global model, a parameter gradient of the initial global model is formed.

[0020] In some practicable manners, the step of introducing noise data formed by a differential privacy algorithm in the local model update to obtain a local noise gradient includes:

[0021] According to the privacy protection requirements of the node, a privacy budget and a sensitivity are obtained;

[0022] Determining a noise distribution according to the privacy budget and the sensitivity;

[0023] Obtaining noise data according to the noise distribution;

[0024] The noise data is added to the gradient of the initial global model to obtain a local noise gradient; wherein the calculation formula of the local noise gradient is:

[0025]

[0026] in, represents the local noise gradient, represents the gradient of the initial global model, represents the Laplace noise operator, and ε represents the privacy budget.

[0027] In some practicable manners, the step of introducing noise data formed by a differential privacy algorithm in the local model update to obtain a local noise gradient includes:

[0028] According to the parameter gradient of the initial global model, a local noise gradient is obtained by adding Gaussian noise; wherein the calculation formula of the local noise gradient is:

[0029] Δθ i '=Δθ i +N(0,σ 2 );

[0030] Among them, Δθ i ' represents the local noise gradient, Δθ i represents the parameter gradient of the initial global model, N(0,σ 2 ) represents Gaussian noise.

[0031] In some practicable manners, the step of aggregating parameters of the plurality of local noise gradients on the central server, updating the global model parameters, and obtaining the target global model includes:

[0032] In the central server, the local noise gradient of each node is parameter aggregated to obtain the gradient update of the global model parameters, wherein the calculation formula of the gradient of the global model is:

[0033]

[0034] Among them, Δθ global represents the gradient of the global model, and N represents the number of nodes involved in the training;

[0035] The target global model is obtained according to the gradient update of the global model parameters, wherein the parameter calculation formula of the target global model is:

[0036] θ←θ-ηΔθ global ;

[0037] Wherein, θ represents the parameters of the target global model, and η represents the learning rate.

[0038] In some practicable manners, the step of aggregating parameters of the plurality of local noise gradients on the central server, updating the global model parameters, and obtaining the target global model includes:

[0039] Acquire the encrypted local noise gradient, wherein the encrypted local noise gradient indicates that the node encrypts the local noise gradient using an encryption algorithm before sending the local noise gradient;

[0040] Performing parameter aggregation on the encrypted local noise gradient to obtain the parameter-aggregated local noise gradient;

[0041] On the central server, the local noise gradient of parameter aggregation is input into the noise data formed by the differential privacy algorithm to obtain a server noise gradient;

[0042] The server noise gradient is used to update the global model parameters to obtain a target global model.

[0043] In a second aspect, the present application provides a distributed model parameter privacy protection system, which is applied to the aforementioned distributed model parameter privacy protection method, and the system includes:

[0044] Node unit, used to obtain the initial global model of each node;

[0045] The node unit is further used to train the initial global model using the local data of each node to obtain a local model update;

[0046] The node unit is further used to introduce noise data formed by the differential privacy algorithm in the local model update to obtain a local noise gradient;

[0047] The central server unit is used to perform parameter aggregation on the multiple local noise gradients at the central server, update the global model parameters, and obtain the target global model.

[0048] In a third aspect, the present application provides a computer storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned distributed model parameter privacy protection method.

[0049] In a fourth aspect, the present application provides a computer program, characterized in that when the computer program is executed by a processor, it implements the steps of the aforementioned distributed model parameter privacy protection method.

[0050] Beneficial effects: The present application provides a distributed model parameter privacy protection method, which obtains the initial global model of each node; uses the local data of each node to train the initial global model to obtain a local model update; in the local model update, introduces noise data formed by the differential privacy algorithm to obtain a local noise gradient; on the central server, performs parameter aggregation on multiple local noise gradients, updates the global model parameters, and obtains the target global model. Through the above method, combined with differential privacy and federated learning, a framework for secure joint modeling is implemented without sharing local data. Specifically, the present application introduces differential privacy noise in the local model update to ensure that the sensitive information of the participants will not be leaked during the data transmission process, thereby effectively preventing potential privacy leakage risks. This method not only improves the level of data privacy protection, but also achieves a better balance between performance and privacy protection, and enhances the security and adaptability of distributed learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the conventional technology, the drawings required for use in the embodiments or the conventional technology descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 The present invention is a flowchart of a distributed model parameter privacy protection method in one embodiment.

[0053] Figure 2 A logical diagram of a distributed model parameter privacy protection method in one embodiment.

[0054] Figure 3 A schematic diagram of a distributed model parameter privacy protection method in an embodiment. DETAILED DESCRIPTION

[0055] In order to facilitate understanding of the present application, the present application will be described more fully below with reference to the relevant drawings. Embodiments of the present application are provided in the drawings. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The term "and / or" used herein includes any and all couplings of one or more related listed items.

[0057] It can be understood that the terms "first", "second", etc. used in the present application can be used in this article to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from another element.

[0058] Some terms involved in this application are explained below to facilitate understanding of this application:

[0059] Differential Privacy: Differential privacy is a data privacy protection technology that introduces random noise into the data analysis process to ensure that any single data point has minimal impact on the analysis results, thereby protecting personal data privacy. Even if an attacker obtains the analysis results, it is impossible to accurately infer the specific information of the individual.

[0060] Federated Learning: Federated learning is a distributed machine learning method that allows multiple participants to train models locally and share only model parameters or updates, not raw data. The central server is responsible for aggregating the model updates of each participant to generate a global model.

[0061] Model Parameters: Model parameters are the values ​​learned by a machine learning model during training that describe the structure and behavior of the model. For example, in a neural network, model parameters include weights and biases.

[0062] Local Model Update: Local model update means that the participants train the model on their local dataset and generate model parameter updates. These updates will be sent to the central server for aggregation.

[0063] Noise: In differential privacy, noise refers to random values ​​added to data or model parameters to mask the specific contribution of individual data and prevent privacy leakage.

[0064] Parameter Aggregation: Parameter aggregation refers to the process in which the central server merges the model parameter updates uploaded by each participant in federated learning to generate a global model.

[0065] Privacy Protection Parameters: Privacy protection parameters are parameters used to adjust the strength of privacy protection in the differential privacy mechanism, usually including noise amplitude, privacy budget, etc.

[0066] The fedag aggregation method is an aggregation strategy in federated learning that performs weighted aggregation based on the importance of data. In federated learning, since participating clients may have different amounts and distributions of data, fedag optimizes the update of the global model by considering the importance of data, thereby improving the performance of the model on the overall dataset.

[0067] Currently, there are significant deficiencies in privacy protection technology in distributed learning, especially in intelligent applications. Although existing methods can partially protect the privacy of data transmission, it is difficult to completely prevent the risk of sensitive information leakage during the model parameter update process, and there is a lack of targeted and comprehensive solutions.

[0068] Therefore, this application aims to propose an innovative solution to the problem of model parameter protection in distributed learning by combining advanced differential privacy technology in federated learning to ensure the security and confidentiality of model privacy during the training process.

[0069] It should be noted that the core idea of ​​differential privacy in this application is to ensure that adding or removing a single data point does not significantly affect the output, thereby protecting the privacy of individual data. The definition is as follows:

[0070] Pr[A(D 1 )∈S]≤e ε Pr[A(D 2 )∈S]

[0071] Among them, A is a random algorithm, D 1 and D 2 are two data sets that differ by only one data point, S is an arbitrary result set, ∈ is the privacy budget, indicating the degree of privacy leakage, and e is a constant.

[0072] Differential privacy implementation methods include Laplace Mechanism and Gaussian Mechanism. Among them, Laplace Mechanism ensures privacy by adding Laplace distribution noise:

[0073]

[0074] Among them, Δf is the sensitivity, which represents the maximum impact of the change of any data point in the data set on the function f.

[0075] like Figure 1 and Figure 2 As shown, the first aspect of the present application provides a distributed model parameter privacy protection method, the method comprising:

[0076] S100, obtaining an initial global model of each node.

[0077] Specifically, each node represents a client, using a smartphone, a sensor, etc. The initial global model can be a global model with initial parameters issued by a central server, and this global model can be a deep neural network model (DNN). Next, the initial global model can be trained at the node using the data that the node has. It should be noted that each node has some local data belonging to the node, and these local data packets contain private data belonging to the node. Therefore, the local data is trained at the initial global model of the node, which can avoid the information leakage caused by the transmission of local data to the central server.

[0078] S200, using the local data of each of the nodes to train the initial global model to obtain a local model update.

[0079] Specifically, obtaining a local model update includes the following steps:

[0080] S201, the node uses the local data as input, forward propagates through the initial global model, and obtains a prediction result.

[0081] Specifically, after the local data is input into the initial global model, the purpose of forward propagation is to evaluate the initial global model using the local data of the node and generate a prediction result. It should be noted that the local data of the node may not have participated in the training of the initial global model before. At this time, the parameters of the initial global model are fixed, and the local data is forward propagated through the initial global model. According to the architecture and learning tasks (such as classification, regression, etc.) of the initial global model, the input local data is processed and the output of each layer is calculated. Finally, the output is the prediction result of the initial global model for this batch of data.

[0082] S202, using the prediction result and the true label corresponding to the local data, calculate the loss function, evaluate the initial global model, and obtain the loss value.

[0083] The loss value represents the difference between the prediction of the initial global model and the true label.

[0084] Specifically, the purpose of obtaining the loss value is to evaluate the accuracy of the initial global model prediction and determine the difference between the initial global model prediction and the actual label (true label). Further, the loss function is applied to compare the predicted results and the true labels corresponding to the local data. The loss function varies depending on the task type. For example, cross entropy loss is commonly used for classification problems, and mean square error may be used for regression problems. The loss value is a quantitative measure of model performance, reflecting the prediction error of the initial global model on the current data set.

[0085] It should be noted that the true label can be a pre-labeled local data using a tool or an expert, so that the true label can be compared with the predicted result.

[0086] S203: Obtain the parameter gradient of the initial global model according to the loss value.

[0087] Specifically, the parameter gradient of the initial global model is obtained, that is, the purpose of calculating the gradient is to determine how to adjust the model parameters to reduce the loss value, that is, to optimize the initial global model.

[0088] Exemplarily, obtaining the parameter gradient of the initial global model may further include the following steps:

[0089] S2031, according to the loss value, calculate the gradient ▽L of the loss function relative to the initial global model parameter through a back propagation algorithm i , obtain the adjustment direction of the initial global model;

[0090] S2032: Form a parameter gradient of the initial global model according to the adjustment direction of the initial global model.

[0091] Specifically, the gradient of the loss function with respect to the model parameters is calculated through the back-propagation algorithm. This process starts from the output layer and goes backwards through each layer, applying the chain rule to calculate the gradient of each parameter. The gradient represents the slope of the loss function in the parameter space, pointing in the direction of increasing loss.

[0092] S204: Update the initial global model according to the parameter gradient of the initial global model to obtain the local model update.

[0093] Specifically, the purpose of updating the initial global model and obtaining the local model update is to reduce the prediction error by adjusting the model parameters and optimize the initial global model so as to obtain the final local model update. Exemplarily, an optimization algorithm (such as gradient descent, Adam, RMSprop, etc.) is used to update the parameters of the initial global model according to the calculated gradient. The update rule is usually: new parameter value = old parameter value - learning rate × gradient. This process may include learning rate adjustment strategies, such as learning rate decay or using momentum. The updated initial global model is the local model update of the node, and these updates will be used to improve the initial global model.

[0094] S300, in the local model update, introducing noise data formed by the differential privacy algorithm to obtain a local noise gradient.

[0095] Specifically, obtaining the local noise gradient may include the following steps:

[0096] S301, obtaining a privacy budget and a sensitivity according to the privacy protection requirement of the node.

[0097] Specifically, the protection requirements of the node can be set as needed. In this way, according to the privacy protection requirements, the privacy budget and sensitivity can be obtained, where the privacy budget is a metric that indicates how much privacy is willing to sacrifice to obtain the usefulness of the data. The smaller ∈, the stronger the privacy protection, but it may affect the accuracy of the model. Sensitivity is the maximum output change of a query or function on adjacent data sets. It measures the impact of changes in a single data point on the query results. Therefore, it is necessary to find a balance between privacy protection and model effect.

[0098] S302: Determine noise distribution according to the privacy budget and the sensitivity.

[0099] Specifically, the purpose of determining the noise distribution is to select a suitable noise distribution according to the privacy budget and sensitivity so as to minimize the impact on model performance while protecting privacy. The noise distribution may include Laplace distribution and Gaussian distribution. In step S303, the Laplace distribution is used for illustration. For example, when selecting the noise distribution, if the privacy budget is 0.1 and the sensitivity is 0.5, the Laplace distribution can be selected, and its scale parameter is set to Δ = sensitivity / ∈ = 0.5 / 0.1 = 5, so that the generated noise data will meet the expected privacy protection effect.

[0100] S303: Obtain noise data according to the noise distribution.

[0101] Specifically, noise data is generated according to the selected noise distribution. If Laplace distribution is used, a random number generator can be used to generate multiple noise data samples from the Laplace distribution, for example, 10 samples are generated and stored in an array for subsequent addition to the gradient of the initial global model.

[0102] S304, adding the noise data to the gradient of the initial global model to obtain a local noise gradient; wherein the calculation formula of the local noise gradient is:

[0103]

[0104] in, represents the local noise gradient, represents the gradient of the initial global model, represents the Laplace noise operator, and ε represents the privacy budget.

[0105] Furthermore, in distributed learning, in order to further protect the privacy of the initial global model parameters, deep neural network (DNN) and differential privacy technology are combined. Differential privacy ensures that personal data will not be leaked by introducing noise during data processing.

[0106] Specifically, obtaining the local noise gradient may also include the following steps:

[0107] According to the parameter gradient of the initial global model, a local noise gradient is obtained by adding Gaussian noise; wherein the calculation formula of the local noise gradient is:

[0108] Δθ i '=Δθ i +N(0,σ 2 );

[0109] Among them, Δθ i ' represents the local noise gradient, Δθ i represents the parameter gradient of the initial global model, N(0,σ 2 ) represents Gaussian noise.

[0110] For example, after obtaining the parameter gradient of the initial global model, the Gaussian mechanism can be used to form noise. Next, the obtained Gaussian noise can be added to the parameter gradient to obtain the local gradient.

[0111] S400, at the central server, performing parameter aggregation on the plurality of local noise gradients, updating the global model parameters, and obtaining a target global model.

[0112] Specifically, obtaining the target global model may include the following steps:

[0113] S401, at the central server, the local noise gradient of each node is parameter aggregated to obtain the gradient update of the global model parameter, wherein the calculation formula of the gradient of the global model is:

[0114]

[0115] Among them, Δθ global represents the gradient of the global model, and N represents the number of nodes involved in the training;

[0116] S402, obtaining the target global model according to the gradient update of the global model parameters, wherein the parameter calculation formula of the target global model is:

[0117] θ←θ-ηΔθ global ;

[0118] Wherein, θ represents the parameters of the target global model, and η represents the learning rate.

[0119] Specifically, each node uses local data to train the deep neural network (initial global model) locally and calculates the gradient update of the loss function to the initial global model parameters. To ensure privacy, each node performs differential privacy processing on the gradient and adds noise before sending the initial global model parameter update. Specifically, node i calculates the gradient update Δθ of the initial global model parameters i After that, by adding Gaussian noise N(0, σ 2 ), so that the updated gradient meets the differential privacy requirements, that is, Δθi'=Δθi+N(0,σ 2 ).

[0120] Next, each node sends the gradient after adding noise to the central server. The central server aggregates the gradients of all nodes and calculates the global gradient update. The formula is:

[0121]

[0122] Finally, the central server updates the model parameters based on the aggregated global gradients:

[0123] θ←θ-ηΔθ global

[0124] The updated model parameters are then sent back to each node to start the next round of training.

[0125] Through the above process, it is possible to implement deep neural network model training combined with differential privacy, effectively protecting the privacy of local data of each node in distributed learning. This method is particularly important in intelligent applications. The training of deep neural network models usually involves a large amount of sensitive data, such as tactical information, intelligence analysis, etc. By combining differential privacy and deep neural networks, it can be ensured that these sensitive data will not be leaked during the training process. At the same time, this method can also improve the efficiency of distributed learning, because each node only needs to pass the processed gradient update without passing the original data, thereby reducing communication overhead.

[0126] In addition, deep neural network model training combined with differential privacy can also enhance the robustness of the system. Even if the data of a certain node is attacked or leaked, due to the introduction of noise in the deep neural network model training process, it is difficult for the attacker to infer the detailed information of the global model through the data of a single node, thereby improving the security of the entire system.

[0127] In summary, deep neural network model training combined with differential privacy technology can not only protect local data privacy in distributed learning, but also improve the security and robustness of the system. This application is of great significance in intelligent applications, and can ensure efficient model training and application without leaking sensitive data, supporting key tasks such as intelligent training, combat and decision-making.

[0128] In one embodiment, the step of aggregating parameters of the plurality of local noise gradients and updating the global model parameters to obtain the target global model on the central server includes:

[0129] S403: Obtain the encrypted local noise gradient.

[0130] The encrypted local noise gradient indicates that the node encrypts the local noise gradient using an encryption algorithm before sending the local noise gradient.

[0131] Specifically, before the local noise gradient is transmitted to the central server, in order to avoid data leakage during the transmission process, the encryption processing is performed at the node. The specific encryption method can be a symmetric encryption key and an asymmetric encryption key, for example, the encryption algorithm is AES (symmetric encryption algorithm) and RSA (asymmetric encryption algorithm). In other words, the node first encrypts the noise gradient using a selected encryption algorithm (such as AES, RSA, etc.). The encryption process requires a key, which can be a symmetric key or an asymmetric key, depending on the selected encryption algorithm. This application does not limit the encryption algorithm. Among them, the symmetric encryption algorithm uses the same key for encryption and decryption, while the asymmetric encryption algorithm uses a pair of public and private keys, where the public key is used for encryption and the private key is used for decryption.

[0132] S404, performing parameter aggregation on the encrypted local noise gradient to obtain the parameter-aggregated local noise gradient.

[0133] Specifically, after receiving the encrypted gradients sent by all nodes, the central server needs to perform parameter aggregation on these encrypted gradients. The central server first needs to decrypt each encrypted gradient using the corresponding decryption key. After decryption, the server aggregates the gradients of all nodes, such as calculating a weighted average, to update the global model.

[0134] S405, at the central server, the local noise gradient of parameter aggregation is input into the noise data formed by the differential privacy algorithm to obtain the server noise gradient.

[0135] Specifically, in order to further enhance privacy protection, the central server may add differential privacy noise to the aggregated gradient. The method of adding is similar to the aforementioned differential noise introduction method, which will not be described here. According to the privacy requirements of the global model, the central server can determine the appropriate privacy budget and sensitivity parameters. Based on these privacy budgets and sensitivity parameters, the central server generates Gaussian or Laplace noise and adds it to the aggregated gradient.

[0136] S406: Using the server noise gradient, update the global model parameters to obtain a target global model.

[0137] Specifically, the noisy gradients generated by the server are used to update the global model. The central server uses the noisy aggregated gradients to update the parameters of the global model. The updated model parameters can be encrypted again and then distributed to each node for the next round of training.

[0138] It should be noted that for the central server, differential privacy is performed again, and the local noise gradient is encrypted before transmission. Multiple encryption algorithms can be configured. Next, the keys are cached at the node and the central server respectively, and the gradient data from the node to the central server and from the central server to the node are labeled. The cached key to be used by the receiver is determined based on the label. In this way, the overhead of key interaction during the encryption and decryption process can be simplified.

[0139] Example

[0140] This application provides a distributed model parameter privacy protection method, including the following aspects:

[0141] Optimizing Differential Privacy for Privacy-Preserving Federated Learning:

[0142] Optimized Differential Privacy (ODP) is a method that is able to extract valuable information while ensuring the privacy of individual data points. The proposed global model is validated using the MNIST dataset and analyzed using the Fedag aggregator. Differential Privacy (DP) and Federated Learning (FL) Optimization by Changing Noise and Delta Values. This application analyzes the use of differential privacy FL and federated learning DP to achieve high privacy in machine learning. Specifically, varying the noise and delta value (delta value) while keeping the epsilon value (ε) unchanged is expected to identify the best configuration that maximizes privacy without affecting the accuracy of the global model.

[0143] Preprocessing:

[0144] The MNIST dataset is a collection of handwritten digit images used for training and testing ML models. These images are preprocessed using various conventional techniques such as grayscale conversion, pixel value normalization, and data augmentation to ensure consistency and accuracy. This enhances the robustness and generalization performance of the global model. The preprocessed images are then used to train and evaluate machine learning models, making the MNIST dataset a highly preferred choice for evaluating the effectiveness of various machine learning algorithms.

[0145] (ε)-Differential Privacy and (ε,δ)-Differential Privacy:

[0146] DP is a privacy-preserving technique defined by two terms: (ε)-DP and (ε,δ)-DP. The former is a stricter definition that does not allow any leakage, while the latter is a more practical definition that allows a small amount of accidental leakage. In this application, the MNIST dataset is used, which can contain 50,000 images for training and 10,000 images for testing, and is divided into 10 separate clients. In order to preserve privacy, Laplace noise is introduced into the mean of the dataset, denoted as xi to include Laplace noise, using the following formula:

[0147] y=μ+Lap(b);

[0148] Where μ represents the actual average height of the dataset and b = 1 / ε. Here, Lap(b) represents a random variable drawn from a Laplace distribution with scale b. The value of δ should be less than the inverse of the dataset size to prevent privacy violations. When the Gaussian mechanism is used, the (ε)-DP term cannot guarantee privacy, so the (ε,δ)-DP term is introduced. For any particular data point X i The probability of being disclosed is given by:

[0149] P i |≤t]=2×exp(-ε×t)≤δ;

[0150] The purpose is to prove that this expression is less than or equal to δ. To achieve this goal, we can take the natural logarithm (ln) of both sides of the equation, because the ln function is monotonically increasing:

[0151] ln(2×exp(-ε×t))≤ln(δ);

[0152] ln(2)+ln(exp(-ε×t))≤ln(δ);

[0153] ln(2)-εt≤ln(δ);

[0154] Isolate t:

[0155]

[0156] but:

[0157]

[0158] This shows that for a given expression Pr[yx i |=t], if t is Within the range, the probability is indeed less than or equal to δ, a particular data point X is disclosed i The probability of t being a privacy parameter is limited by the desired privacy parameter δ. Where t is the sensitivity of the data and δ is the desired privacy parameter. Keeping ε fixed at 0.5, the average height of the Laplace noise can be varied in different experiments, such as 1.2, 2.0, 4.0, and 8.0. In addition, the value of δ can be changed between 1e-5 and 1e-3. If ε = 0.5 and δ = 10 -6 , then the value of b is b = 2 × 10 -4 The Laplace noise added to the mean height will be within the range of ±b, ensuring that the probability of any single data point being revealed is less than 10 -6 .

[0159] In this application, FL and DP-FL are implemented using MLP models on the MNIST dataset, where Laplace noise is added to the global model update to ensure privacy and security. SGD optimizer (Stochastic Gradient Descent) and fedag aggregation method are used with hyperparameters. Federated differential privacy is effective in achieving better privacy and security while maintaining model accuracy. The use of fedag aggregation method also helps in achieving better concurrency of the model.

[0160] Overall, the results demonstrate the effectiveness of federated differential privacy (FL) for training models in a distributed and privacy-preserving manner using Laplace noise.

[0161] like Figure 3As shown, differential privacy is adopted by introducing different noise and delta values ​​while keeping the epsilon value fixed. DP is a privacy-preserving method that protects sensitive information by calculating random noise on the data, ensuring the accuracy of statistical analysis while opposing the privacy of user data points. By varying the noise and delta values, efforts are made to strike a balance between accuracy and privacy. To ensure appropriate privacy protection, statistical measures are used to analyze the amount of privacy loss and ensure that the delta value is set appropriately to maintain the desired level of privacy. Overall, this application can focus on developing effective FL privacy protection techniques to enable the analysis of sensitive data while opposing the privacy of specific users.

[0162] In summary, the distributed model parameter privacy protection method provided by this application has the following advantages:

[0163] This application achieves a better balance between protecting data privacy and global model performance by combining differential privacy and federated learning methods. The details are as follows:

[0164] Differences and advantages from centralized learning:

[0165] Centralized learning relies on centralizing the data of all participants to a central server for training. Although this method can optimize the model using a large amount of data, it also has significant privacy risks and resource consumption issues. Participants need to upload raw data to the central server, which may lead to the leakage of sensitive information, and large amounts of data transmission consume bandwidth and storage resources. In addition, the central server has the potential risk of becoming a single point of failure. Once a failure or attack occurs, the operation of the entire system will be seriously affected.

[0166] In contrast, this application uses federated learning to enable each participant to train the model locally and only share model parameter updates without sharing the original data. This not only greatly reduces the risk of data privacy leakage, but also reduces the bandwidth and storage resource consumption of data transmission, reducing system costs. In addition, the distributed approach avoids the single point failure problem of the central server and improves the robustness and reliability of the system.

[0167] Differences and advantages over traditional federated learning:

[0168] Although traditional federated learning avoids data centralization, model parameter updates may still contain sensitive information about local data. Attackers can infer local data by analyzing these updates, especially when there are fewer participants or the model parameters are more complex, this risk is more significant.

[0169] Based on traditional federated learning, this application introduces differential privacy noise in local model updates to ensure that even if the model parameters are intercepted, the detailed information of the original data cannot be inferred. It effectively prevents inference attacks and reverse engineering attacks, and further improves the level of privacy protection. The model parameters add noise during transmission and aggregation, preventing the leakage of sensitive information and improving the overall security of the system.

[0170] Differences and advantages compared to independent application of differential privacy:

[0171] Differential privacy techniques are usually applied in centralized data processing environments to protect privacy by introducing noise into the data. However, this approach may lead to performance loss, especially when the data volume is small or the noise is large, the accuracy of the global model will be affected. In addition, the application of differential privacy in distributed environments requires additional mechanisms to ensure its effectiveness and applicability.

[0172] This application combines differential privacy with federated learning. Through an optimized differential privacy mechanism, the impact on model accuracy is minimized while ensuring data privacy, achieving an optimal balance between privacy protection and global model performance. Adjustable privacy protection parameters are provided to allow flexible adjustment according to the needs of different application scenarios, ensuring optimal performance in different application scenarios.

[0173] The protection purpose of this application is:

[0174] 1. Protect the data privacy of participants: Ensure that participants can safely participate in joint modeling without sharing original data to prevent data privacy leakage.

[0175] 2. Ensure the security of global model parameter transmission: Ensure the security of global model parameter updates during federated learning to prevent the leakage of sensitive information during transmission.

[0176] 3. Improve the security and adaptability of distributed learning: Improve the security and adaptability of distributed learning in various complex environments, and ensure that data privacy can be effectively protected in a variety of application scenarios.

[0177] 4. Optimize the relationship between model performance and privacy protection: Achieve an optimal balance between privacy protection and global model performance, ensuring that high global model accuracy is maintained while ensuring privacy.

[0178] Through the above-mentioned innovations and protection purposes, this application aims to achieve safe and efficient joint modeling without sharing local data, and to improve the level of privacy protection of model parameters in distributed learning.

[0179] In a second aspect, the present application provides a distributed model parameter privacy protection system, which is applied to the aforementioned distributed model parameter privacy protection method, and the system includes:

[0180] Node unit, used to obtain the initial global model of each node;

[0181] The node unit is further used to train the initial global model using the local data of each node to obtain a local model update;

[0182] The node unit is further used to introduce noise data formed by the differential privacy algorithm in the local model update to obtain a local noise gradient;

[0183] The central server unit is used to perform parameter aggregation on the multiple local noise gradients at the central server, update the global model parameters, and obtain the target global model.

[0184] In a third aspect, the present application provides a computer storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned distributed model parameter privacy protection method.

[0185] In a fourth aspect, the present application provides a computer program, characterized in that when the computer program is executed by a processor, it implements the steps of the aforementioned distributed model parameter privacy protection method.

[0186] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0187] The various embodiments in the present disclosure are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0188] The protection scope of the present disclosure is not limited to the above-mentioned embodiments. Obviously, those skilled in the art can make various changes and modifications to the present disclosure without departing from the scope and spirit of the present disclosure. If these changes and modifications fall within the scope of the claims of the present disclosure and their equivalents, the intention of the present disclosure also includes these changes and modifications.

Claims

1. A distributed model parameter privacy protection method, characterized in that: Methods include: Get the initial global model of each node; Using the local data of each node, the initial global model is trained to obtain a local model update; In the local model update, noise data formed by the differential privacy algorithm is introduced to obtain a local noise gradient; In the central server, parameters of the multiple local noise gradients are aggregated, and the global model parameters are updated to obtain the target global model.

2. The distributed model parameter privacy protection method according to claim 1, characterized in that: The step of training the initial global model using the local data of each node to obtain a local model update comprises: The node uses the local data as input and forward propagates through the initial global model to obtain a prediction result; Calculate a loss function using the prediction result and the true label corresponding to the local data, evaluate the initial global model, and obtain a loss value, wherein the loss value represents the difference between the prediction of the initial global model and the true label; According to the loss value, obtaining the parameter gradient of the initial global model; The initial global model is updated according to the parameter gradient of the initial global model to obtain the local model update.

3. The distributed model parameter privacy protection method according to claim 2, characterized in that: The step of obtaining the parameter gradient of the initial global model according to the loss value comprises: According to the loss value, the gradient of the loss function relative to the initial global model parameters is calculated by the back propagation algorithm Obtaining an adjustment direction of the initial global model; According to the adjustment direction of the initial global model, a parameter gradient of the initial global model is formed.

4. The distributed model parameter privacy protection method according to claim 3, characterized in that: The step of introducing noise data formed by a differential privacy algorithm in the local model update to obtain a local noise gradient includes: According to the privacy protection requirements of the node, a privacy budget and a sensitivity are obtained; Determining a noise distribution according to the privacy budget and the sensitivity; Obtaining noise data according to the noise distribution; The noise data is added to the gradient of the initial global model to obtain a local noise gradient; wherein the calculation formula of the local noise gradient is: in, represents the local noise gradient, represents the gradient of the initial global model, represents the Laplace noise operator, and ε represents the privacy budget.

5. The distributed model parameter privacy protection method according to claim 3, characterized in that: The step of introducing noise data formed by a differential privacy algorithm in the local model update to obtain a local noise gradient includes: According to the parameter gradient of the initial global model, a local noise gradient is obtained by adding Gaussian noise; wherein the calculation formula of the local noise gradient is: Among them, Δθ i ' represents the local noise gradient, Δθ i represents the parameter gradient of the initial global model, N(0,σ 2 ) represents Gaussian noise.

6. The distributed model parameter privacy protection method according to claim 5, characterized in that: The step of aggregating parameters of the plurality of local noise gradients on the central server, updating the global model parameters, and obtaining the target global model comprises: In the central server, the local noise gradient of each node is parameter aggregated to obtain the gradient update of the global model parameters, wherein the calculation formula of the gradient of the global model is: Among them, Δθ global represents the gradient of the global model, and N represents the number of nodes involved in the training; The target global model is obtained according to the gradient update of the global model parameters, wherein the parameter calculation formula of the target global model is: Wherein, θ represents the parameters of the target global model, and η represents the learning rate.

7. The distributed model parameter privacy protection method according to claim 1, characterized in that: The step of aggregating parameters of the plurality of local noise gradients on the central server, updating the global model parameters, and obtaining the target global model comprises: Acquire the encrypted local noise gradient, wherein the encrypted local noise gradient indicates that the node encrypts the local noise gradient using an encryption algorithm before sending the local noise gradient; Performing parameter aggregation on the encrypted local noise gradient to obtain the parameter-aggregated local noise gradient; On the central server, the local noise gradient of parameter aggregation is input into the noise data formed by the differential privacy algorithm to obtain a server noise gradient; The server noise gradient is used to update the global model parameters to obtain a target global model.

8. A distributed model parameter privacy protection system, characterized in that: The distributed model parameter privacy protection method applied to any one of claims 1 to 7, the system comprising: Node unit, used to obtain the initial global model of each node; The node unit is further used to train the initial global model using the local data of each node to obtain a local model update; The node unit is further used to introduce noise data formed by the differential privacy algorithm in the local model update to obtain a local noise gradient; The central server unit is used to perform parameter aggregation on the multiple local noise gradients at the central server, update the global model parameters, and obtain the target global model.

9. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the distributed model parameter privacy protection method described in any one of claims 1 to 7 are implemented.

10. A computer program, characterized in that When the computer program is executed by a processor, the steps of the distributed model parameter privacy protection method described in any one of claims 1 to 7 are implemented.

Images