Verifiable federated learning method supporting model pruning

Abstract

The invention provides a verifiable federated learning method supporting model pruning, which is a federated learning method supporting model pruning result verification on the basis of protecting user privacy and verifying model aggregation. According to the method, a zero-knowledge profs protocol is used, credible verification of the pruning process is achieved for the first time, and meanwhile any original information related to pruned parameters does not need to be provided. In addition, the invention concerns an edge training client with heterogeneous performance, allowing the user to autonomously select the required pruning rate and dynamically adjust the pruning rate in different rounds to adapt to its performance. By ingeniously combining the homomorphic Hash technology and the commitment scheme, the verification of the aggregation result is realized, and the privacy of the heterogeneous edge client is protected through the heterogeneous mask technology under the condition that the cloud server does not need to carry out additional calculation.

Description

Technical Field

[0001] Based on the federated learning technology, the present invention studies a verifiable federated learning method that supports model pruning and heterogeneous edge clients. The present invention belongs to the field of federated learning, and specifically relates to technologies such as key negotiation and zero-knowledge proof. Background Art

[0002] Federated learning, as a machine learning paradigm that can complete tasks without exposing user privacy, has attracted significant attention in an era of increasing emphasis on privacy. In recent years, many related studies and methods have been proposed, which have greatly promoted the development of this field. Federated learning is designed in a form that does not require direct data exchange or collection, thereby protecting user privacy. In addition, this approach enables multiple participants to jointly train machine learning models, allowing all parties to achieve better models than training alone.

[0003] Machine learning techniques that rely on large-scale data have experienced rapid growth in artificial intelligence applications such as computer vision, natural language processing, and recommendation systems. These systems are able to perform complex tasks and profoundly affect people's lives. To address the privacy issues associated with training on large-scale datasets, federated learning techniques encrypt local models before uploading them to the cloud, ensuring that cloud servers cannot access the data or models of individual devices. The global aggregated model protected by the mask is then downloaded to the client device. This is a promising solution to the data island problem. In practice, "lazy" servers are a common phenomenon because they try to minimize expenses and save costs, which provides an incentive to falsify aggregate results. To solve this problem, researchers have proposed verifiable federated learning and have made significant progress. In this approach, while protecting the user's local privacy, each client can have a way to verify the correctness of the aggregated results, thereby greatly enhancing the reliability of the system. In addition, some solutions can defend against potential attacks through technical means, ensuring that the privacy of honest users remains safe even in the case of collusion between servers. This has an important impact in practical scenarios.

[0004] However, in the current era of artificial intelligence with large models, existing verifiable federated learning solutions still face some important challenges, such as insufficient support for heterogeneous edge computing and model pruning. For edge clients with limited resources, neural network pruning techniques, including removing unimportant weights, can significantly reduce the parameters of the network, reduce storage requirements, improve inference computing performance, and maintain high accuracy. In existing studies, comparisons between sparse large models and dense small models with the same number of parameters show that sparse large models generally outperform dense small models in tasks related to image and speech processing. Therefore, it is both necessary and practical to study verifiable federated learning solutions that support model pruning.

[0005] One concern is that there is a lack of a method to verify the pruning process performed on the server in existing research, which may occur in a distributed learning environment. In order to reduce costs, the server may prune the model incorrectly, which will undoubtedly lead to a significant decrease in training performance. As an honest user, there is an urgent need for a method to verify the pruning results on the server to ensure that individuals obtain the desired training model. It is worth noting that through the model pruning process, the pruned information is usually discarded, which poses challenges in establishing trust in the pruning results. In addition, in distributed learning, the computing power of edge clients may vary, which often means that users want to train models with different numbers of parameters according to their specific circumstances. In addition, the client may expect an adjustable pruning ratio, which means not only the ability to try to obtain the best sparsity, but also the opportunity to train every parameter in the original model. Summary of the invention

[0006] The main content of this invention is to support model pruning and a verifiable federated learning solution for heterogeneous edges. Currently, there is no method provided to users to verify the server pruning results, which is a very meaningful challenge in the common lazy server scenario. In addition, support for heterogeneous edges is also the focus of this solution. Dynamically adjusting the pruning rate in different rounds to adapt to the specific performance of edge devices is also a very meaningful work. To achieve this research, the following main problems need to be solved, which are the content of this invention:

[0007] (1) Based on commitment and homomorphic hashing technology, this paper proposes a heterogeneous delayed verification scheme that supports verifying the aggregation results of various edge models. In addition, for parameters that have not been trained by any participant in certain rounds, the scheme realizes on-demand verification of their correctness without incurring additional overhead.

[0008] (2) Using the zero-knowledge range proof protocol, the present invention innovatively designs a verification scheme for the model pruning phase. This scheme enables users to verify the correctness of the model pruning operation performed by the server without providing detailed information about the pruned parameters.

[0009] (3) By introducing the global residual model, users can select the model pruning ratio as needed and dynamically adjust the required pruning ratio in different training rounds. In addition, through heterogeneous masking, the present invention ensures that the local parameters of edge users remain confidential during the federated learning process.

[0010] Compared with the prior art, the present invention has the following obvious advantages and beneficial effects:

[0011] First, compared with traditional federated learning methods, the present invention supports users to verify the pruning results.

[0012] Secondly, for edge clients with heterogeneous performance, the present invention supports them to have different pruning rates and can adjust the pruning ratio in different rounds.

[0013] Finally, the present invention realizes the verification of heterogeneous edge aggregation results on the basis of protecting user privacy.

[0014] Experiments have confirmed that the invention can achieve the design goals with acceptable costs, is feasible and has important application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 System architecture diagram

[0016] Figure 2 Schematic diagram of pruning scheme DETAILED DESCRIPTION

[0017] According to the above description, the following is a specific implementation process, but the scope of protection of this patent is not limited to this implementation process.

[0018] Step 1: Global Presets

[0019] In the initial phase, the trusted authority (TA) performs global setup, generates various necessary public parameters and assigns keys to each customer. In addition, the initial trained model is provided to users in the first round of training. All participants receive the same initial trained model with a complete global structure, where the dimension of the parameter vector is denoted as t. Starting from the second round, users will perform local training using the model pruned according to their specific needs.

[0020] After obtaining information about the client, the trusted authority initializes the public parameters required for homomorphic hashing, Bulletproofs, and commitment schemes. In addition, it generates a public-private key pair (PKi ,SK i ), used to protect user privacy, where PK i Represents user P i The public key, SK i Represents user P i It is worth noting that the global setup is only performed once throughout the training task, thus avoiding any additional overhead.

[0021] Step 2: Commitment and Mask

[0022] In the kth round, after using the training model After local training, each client P i Has a local parameter vector To ensure user privacy and verify aggregation results, P i The first round of training model is given by TA, and the subsequent ones are given by the server after pruning.

[0023] Step 2.1: Commitment

[0024] In the kth round, before masking, each customer P i Perform homomorphic hashing on the original parameter vector and use a uniformly drawn from random space Make a promise to the hash result after multiplication aggregation. After the promise is completed, the promise string Passed by the server to other clients.

[0025] Step 2.2: Mask

[0026] By broadcasting the public key to other users through the cloud server, each customer can generate a pair of symmetric seeds s i,j =Agree(SK i ,PK j ), where i≠j, is used to cover local privacy. Agree() represents the Diffie-Hellman key agreement algorithm.

[0027] In the context of model pruning, each user may be trained on a different set of parameters. Using the weight mask set M, each participant can determine whether other users have trained on a specific parameter dimension d in this round of training. For clarity, the present invention will refer to user P as i The set of parameter vector dimensions for the current round of training is represented as Under these conditions, P i The masking of the trained parameter dimension d will utilize the random seed communicated with other users who have trained dimension d in this round, as follows:

[0028]

[0029] Where PRG represents a pseudo-random generator. i [d] represents the d-th dimension of the local parameter vector, Represents the d-th dimension of the encrypted parameter vector.

[0030] This heterogeneous masking approach ensures correct aggregation while avoiding additional masking of untrained dimensions and reducing client overhead. and the pruning rate for the next round Can be determined by the user.

[0031] Step 3: Aggregation and Pruning

[0032] Step 3.1: Aggregation

[0033] In the kth round, after receiving the encrypted local parameters uploaded by all users, the server performs global aggregation. After aggregation, the extra mask will be perfectly offset, thus obtaining the correct aggregation result:

[0034]

[0035] Where P represents the client set. k is the result vector after aggregation.

[0036] For dimensions that have not been trained by any user in this round, the server uses the current global remaining model Finally, a global model m is generated for the next round of training. k+1 .

[0037] Step 3.2: Pruning

[0038] Based on the pruning rate required by the user, the server i Model m trained in the k+1th round k+1 Perform verifiable model pruning. For each user P i , the server is based on Perform model pruning to generate the next round of pruning model Obtain the importance score vector of pruned parameters. The upper bound of the range proof is the minimum importance score of the unpruned parameters, expressed as ε. Use the Bulletproofs zero-knowledge proof protocol to generate the corresponding proof. It is worth noting that the present invention improves the Bulletproofs protocol to enable it to support arbitrary proof upper bounds. Specifically, for 0≤v <b≤2 n , we can get v∈[0,2 n ) and v∈[b-2 n,b). Based on this, any upper bound proof can be transformed into two standard range proofs

[0039] v a =v

[0040] v b =v-b+2 n

[0041] Both values ​​are in the range [0,2 n ), where n is an integer power of 2, v a and v b This is the value that can be proved using the Bulletproofs standard range after the above calculation.

[0042] During the proof process, the aggregate proof method of the Bulletproofs protocol will be used to uniformly prove that the m values ​​in the importance score vector of the pruned parameters are in the range of [0,ε]. By filling in 0 elements, the value of m is guaranteed to be an integer power of 2 to meet the requirements of the proof protocol.

[0043] After completing pruning for all users, the global remaining model for the next round of recovery is generated based on the pruning model with the lowest pruning rate:

[0044]

[0045] Here It represents the pruning model with the lowest pruning rate in the k+1 round, which retains the most parameters.

[0046] This design ensures that every parameter has a chance to be trained and supports users to independently select the pruning rate required for each round.

[0047] Step 4: Verification

[0048] After receiving the aggregated and pruned model, each user verifies the aggregated result using the Bulletproofs protocol. Afterwards, the decommitment string is broadcasted. in, User P i The random number used for commitment in round k, is the hash result of the original parameter vector.

[0049] After receiving the decommitment strings from all users, P i The correctness of each user's hash value is verified using the previously received commitment. After that, all user hash values ​​of round k are aggregated by dimension multiplication to generate a vector h stored locally. Each dimension d in h will be determined based on the training results of round k. Specifically, if in round k, any user After training dimension d, update Otherwise, it remains unchanged. Here h[d] represents the d-th dimension element of the locally stored vector h.

[0050] Afterwards Represents user P i The parameter set in the k+1 round of training, P i Verify whether

[0051]

[0052] Here, g d is a public parameter used to perform hash calculation on d-dimensional parameters. User P i In the d-dimensional parameters in the next round of training parameter vector, these two parameters are exponentially operated.

[0053] This heterogeneous delayed verification scheme ensures that even if some dimensions are not trained by any user in some rounds, when training is needed, users can still effectively verify the correctness of the parameters on these dimensions. Even if the aggregation occurs several rounds ago, no additional calculation is required. Therefore, the present invention realizes the verification support of the aggregation results after pruning for heterogeneous edge clients.

Claims

1. A verifiable federated learning method that supports model pruning, characterized by: The three participants are the trusted authority (TA), the cloud server (Cloud Server) and the clients (Clients). The trusted authority initializes the system, provides the initial training model, generates relevant public parameters, and assigns public-private key pairs to each participant. Subsequently, it will remain offline unless a dispute occurs. The tasks of the cloud server include model pruning, aggregating mask parameters and supporting communication between clients. Before uploading the training results, each client will apply a mask to protect personal privacy. The client has the ability to verify the correctness of the pruning and aggregation results. The specific steps are as follows: Step 1: Global Presets In the initial stage, the trusted authority (TA) performs global setup, generates various public parameters and assigns keys to each customer; the initial training model is provided to users in the first round of training; all participants receive the same initial training model with a complete global structure, where the dimension of the parameter vector is denoted as t; starting from the second round, users will use the pruned model for local training; After obtaining information about the client, the trusted authority initializes the public parameters required for homomorphic hashing, Bulletproofs, and commitment schemes; In addition, it generates a public-private key pair (PK i ,SK i ), used to protect user privacy, where PK i Represents user P i The public key, SK i Represents user P i It is worth noting that the global setting is only performed once in the entire training task; Step 2: Commitment and Mask In the kth round, after using the training model After local training, each client P i Has a local parameter vector P i Commitment and masking are performed; the first round of training model is given by TA, and the subsequent ones are given by the cloud server after pruning; Step 2.1: Commitment In the kth round, before masking, each customer P i Perform homomorphic hashing on the original parameter vector and use a uniformly drawn from random space Make a promise to the hash result after multiplication aggregation; when the promise is completed, the promise string Passed by the server to other clients; Step 2.2: Mask By broadcasting the public key to other users through the cloud server, each customer can generate a pair of symmetric seeds s i,j =Agree(SK i ,PK j ), where i≠j, is used to cover local privacy; Agree() represents the Diffie-Hellman key negotiation algorithm; In the context of model pruning, each user may be trained on a different set of parameters; using the weight mask set M, each participant can determine whether other users have trained on parameter dimension d in this round of training; i The set of parameter vector dimensions for the current round of training is represented as Under these conditions, P i The masking of the trained parameter dimension d will utilize the random seed communicated with other users who have trained dimension d in this round, as follows: Where PRG represents a pseudo-random generator; x i [d] represents the d-th dimension of the local parameter vector, Represents the dth dimension of the encrypted parameter vector; send and the pruning rate for the next round Step 3: Aggregation and Pruning Step 3.1: Aggregation In the kth round, after receiving the encrypted local parameters uploaded by all users, the server performs global aggregation; after aggregation, the additional mask will be perfectly offset, thus obtaining the correct aggregation result: Where P represents the client set; x k is the result vector after aggregation; For dimensions that have not been trained by any user in this round, the server uses the current global remaining model Restore; generate the global model m for the next round of training k+1 ; Step 3.2: Pruning Based on the pruning rate required by the user, the server i Model m trained in the k+1th round k+1 Perform verifiable model pruning; for each user P i , the server is based on Perform model pruning to generate the next round of pruning model Obtain the importance score vector of pruned parameters; the upper bound of the range proof is the minimum importance score of the unpruned parameters, expressed as ε; use the Bulletproofs zero-knowledge proof protocol to generate the corresponding proof; For 0≤v <b≤2 n , we get v∈[0,2 n ) and v∈[b-2 n ,b);Convert any upper bound proof into two standard range proofs; v a =v v b =v-b+2 n Both values ​​are in the range [0,2 n ), where n is an integer power of 2, v a and v b It is the value that can be proved using the Bulletproofs standard range after the above calculation; Use the aggregate proof method of the Bulletproofs protocol to uniformly prove that the m values ​​in the importance score vector of the pruned parameters are in the range [0, ε]. By filling 0 elements, ensure that the value of m is an integer power of 2 to meet the requirements of the proof protocol; After completing pruning for all users, the global remaining model for the next round of recovery is generated based on the pruning model with the lowest pruning rate: Here represents the pruning model with the lowest pruning rate in round k+1, which retains the most parameters; Step 4: Verification After receiving the aggregated and pruned model, each user uses the Bulletproofs protocol to verify the aggregated result; then, the decommitment string is broadcasted in, User P i The random number used for commitment in round k, is the hash result of the original parameter vector; After receiving the decommitment strings from all users, P i Use the previously received commitment to verify the correctness of each user's hash value; then, aggregate all user hash values ​​of round k by dimensional multiplication to generate a vector h stored locally; each dimension d in h will be determined based on the training situation of round k; specifically, if in round k, any user After training dimension d, update Otherwise, remain unchanged; here h[d] represents the d-th dimension element of h; Afterwards Represents user P i The parameter set in the k+1 round of training, P i Verify whether Here, g d is a public parameter used to perform hash calculation on d-dimensional parameters. User P i In the d-dimensional parameters in the next round of training parameter vector, these two parameters are exponentially operated.

Images