Federal learning privacy budget customization method for differential privacy

Abstract

The invention discloses a federated learning privacy budget customization method oriented to differential privacy, and belongs to the technical field of federated learning and privacy protection, and the method comprises the following steps: S1, a server initializes a global model to obtain an initial local model, operates a DQN model at the same time, obtains a privacy budget customized for each client, and stores the privacy budget in a database; the privacy budget is distributed to each client; s2, training a local model; s3, carrying out customized differential privacy noise addition; s4, uploading the disturbance model; s5, global model aggregation: after the server side receives the disturbance model uploaded by the client side, performing global model aggregation; and S6, global model distribution and updating: the server side distributes the new global model and the new privacy budget to each client side, and then the above steps are repeated until a proper model is obtained. According to the federated learning privacy budget customization method for differential privacy, privacy security is guaranteed, and meanwhile, the precision of a federated learning model is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning and privacy protection, and in particular to a federated learning privacy budget customization method oriented to differential privacy. Background Art

[0002] With the increase in the exchange of sensitive data on the Internet, users' demand for privacy protection is growing rapidly, and users are more sensitive to the use of personal privacy to train artificial intelligence models. In machine learning, effective, reliable and secure methods to protect user privacy are essential to maintaining trust and participation. As a result, the federated learning framework was proposed. This distributed framework allows users to use their own data for local training. They only need to upload local model parameters, thereby reducing the transmission of private data and largely avoiding the leakage of private data. However, studies have shown that there are powerful privacy attack methods that can infer users' private information through local models uploaded by users. To address this issue, the commonly used privacy protection methods in the industry include differential privacy, homomorphic encryption and multi-party secure computing.

[0003] Among them, homomorphic encryption schemes usually use homomorphic encryption algorithms to encrypt local model information uploaded by users. Homomorphic encryption algorithms allow clients to perform operations on original data by performing operations on encrypted data without knowing the original data. For example, the multiplication of encrypted data corresponds to the addition of original data. Therefore, the server can aggregate the model while encrypting the model data to obtain a global model. Multi-party secure computing calculates the model aggregation results during the interaction between users and servers through cleverly designed and complex protocols. Since the calculation process is that the user calculates a part and then gives it to the server, the server calculates the other part and gives it to the user, and the user continues to calculate, and the cycle repeats. Therefore, the server cannot obtain all the process data, thereby avoiding privacy leakage.

[0004] Different from the above two complex and computationally expensive mathematical methods, differential privacy protects user privacy by adding noise to the local model uploaded by the user. Because the noise added by differential privacy is random, the attacker cannot obtain effective rules after obtaining the uploaded model, thereby achieving privacy protection. Differential privacy has the advantages of simplicity, high efficiency, low computational overhead, and easy implementation, and is widely used.

[0005] However, the addition of noise will lead to a decrease in the accuracy of the global model of federated learning. Most of the existing differential privacy methods are static budget allocations, lacking personalized customization for different user needs, and are prone to adding too much privacy, resulting in a significant decrease in model accuracy, or adding too little noise, resulting in insufficient privacy protection. In other words, the current differential privacy methods are difficult to balance the privacy requirements of users and the accuracy requirements of federated learning models. Summary of the invention

[0006] The purpose of this invention is to provide a privacy budget customization method for federated learning oriented to differential privacy, which improves the accuracy of the federated learning model while ensuring privacy security.

[0007] To achieve the above objectives, the present invention provides a privacy budget customization method for federated learning oriented to differential privacy, comprising the following steps:

[0008] S1. The server initializes the global model to obtain the initial local model. At the same time, the server runs the DQN model to obtain the privacy budget customized for each client and distribute the privacy budget to each client.

[0009] S2: Local model training: Each client uses local data to train the model and obtain an updated local model.

[0010] S3, customized differential privacy noise addition: each client adds noise to the updated local model according to the privacy budget distributed by the server to obtain a perturbation model;

[0011] S4, perturbation model upload, the client uploads the perturbation model to the server and updates its own information so that the server can update the privacy budget;

[0012] S5, global model aggregation. After receiving the perturbation model uploaded by the client, the server aggregates the global model. At the same time, the client's privacy budget is recalculated based on the information uploaded by the client.

[0013] S6: Global model distribution and update: The server distributes the new global model and the new privacy budget to each client, and then repeats the above steps S1-S6 until a suitable model is obtained or the stopping condition is met.

[0014] Preferably, step S1 specifically includes: the server randomly initializes the global model, and distributes the initialized global model to each client, and each client uses the initialized global model as its own initial local model.

[0015] Preferably, the core of the DQN model in step S1 is the Bellman update equation, which is used to iteratively improve the Q-value function. The Bellman update equation of the Q-value function is:

[0016]

[0017] Among them, γ represents the discount rate that controls future rewards, which is a number between 0 and 1; s represents the user's public non-private information; a represents the privacy budget customized by a client; s′ represents the user's public non-private information in the next state; a' represents the client-customized privacy budget in the next state; R represents the function related to the accuracy and privacy of the DQN model, specifically:

[0018] R = αA + (1-α)P;

[0019] Among them, α represents the score weight. The larger the α value is, the more important the accuracy is in the task. A represents the accuracy score of the DQN model. P represents the privacy score of the DQN model.

[0020] Preferably, in step S3, a Gaussian mechanism is used to add noise to the updated local model, that is, the noise added to the model satisfies a quasi-normal distribution, and the disturbance model is expressed as:

[0021] P=g+N(0,σ 2 );

[0022] Where P represents the perturbation model after adding noise; g represents the updated local model; N(0,σ 2 ) represents Gaussian noise, where σ satisfies:

[0023]

[0024] Among them, Δf represents sensitivity, which is used to measure the sensitivity of the algorithm to changes in a single sample in the data set; ε represents the privacy budget to measure the level of noise used; δ represents the probability of privacy failure.

[0025] Preferably, a privacy evaluation system is also included, specifically:

[0026] The privacy requirements of each client are classified into the following categories: S = {s1, s2, s3, …, s n}, the higher the level, the higher the privacy requirement. Therefore, the privacy loss is expressed as:

[0027]

[0028] Among them, p i represents the privacy loss of client i, p i The larger the value, the worse the privacy; ∈ i represents the privacy budget customized by client i; s i represents the level of client i; function f p (∈ i) is expressed as:

[0029]

[0030] Among them, the constant C is related to different task requirements;

[0031] Finally, the privacy score is as follows:

[0032]

[0033] in, Indicates the privacy score, with a value range of 0-1. The larger the value, the better the privacy of the scheme, and the more it can meet the user's privacy requirements.

[0034] Therefore, the present invention adopts the above-mentioned federated learning privacy budget customization method for differential privacy, and the technical effects are as follows:

[0035] (1) Personalized privacy protection: Traditional differential privacy federated learning methods usually use fixed or static privacy budgets and cannot be dynamically adjusted according to the privacy requirements of different users. The present invention customizes the privacy budget for each client through the DQN network, so that the privacy protection strategy can be dynamically adjusted according to the specific needs of each client, which can not only meet the needs of users with high privacy requirements, but also provide higher model accuracy for users with lower privacy requirements.

[0036] (2) Improve model accuracy: By tailoring the privacy budget for each client, the present invention can minimize noise interference while meeting the requirements of differential privacy protection, thereby improving the overall accuracy of the federated learning model. Clients with high privacy budgets can provide more useful model updates, resulting in a more accurate global model.

[0037] (3) Dynamic privacy budget update mechanism (wider applicability and more flexible): The present invention has a dynamic privacy budget update mechanism, and the server can continuously adjust the privacy budget of each client according to the public information uploaded by the client. This can not only continuously optimize the privacy protection strategy of model training, but also adaptively adjust the privacy budget according to the real-time information of the client.

[0038] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flowchart of an embodiment of a method for customizing a privacy budget for federated learning oriented to differential privacy of the present invention;

[0040] Figure 2 This is a comparison chart of the accuracy of an embodiment of a privacy budget customization method for federated learning oriented to differential privacy of the present invention;

[0041] Figure 3 This is a privacy comparison chart of an embodiment of a privacy budget customization method for federated learning oriented to differential privacy of the present invention. DETAILED DESCRIPTION

[0042] The technical solution of the present invention is further described below through the accompanying drawings and embodiments.

[0043] Unless otherwise defined, technical or scientific terms used in the present invention shall have the common meanings understood by one having ordinary skills in the field to which the present invention belongs.

[0044] Embodiment 1

[0045] like Figure 1 As shown, the present invention provides a privacy budget customization method for federated learning oriented to differential privacy, comprising the following steps:

[0046] S1. The server randomly initializes the global model and distributes it to each client. Each client uses the initialized global model as its initial local model. At the same time, the server runs the DQN model, obtains the privacy budget customized for each client, and distributes the privacy budget to each client.

[0047] The core of the DQN model is the Bellman update equation, which is used to iteratively improve the Q-value function. The Bellman update equation of the Q-value function is:

[0048]

[0049] Among them, γ represents the discount rate that controls future rewards, which is a number between 0 and 1; s represents the user's public non-private information; a represents the privacy budget customized by a client; s′ represents the user's public non-private information in the next state; a' represents the client-customized privacy budget in the next state; R represents the function related to the accuracy and privacy of the DQN model, specifically:

[0050] R = αA + (1-α)P;

[0051] Among them, α represents the score weight; A represents the accuracy score of the DQN model; and P represents the privacy score of the DQN model.

[0052] In addition, the target network structure is set up, and the target network will periodically update the parameters in the network instead of updating in real time, which makes the parameter update process of the network more stable. By inputting the client's non-private information into the network as the state, the network generates a customized privacy budget, and the privacy budget interacts with the environment to generate feedback rewards, thereby adjusting the network's strategy for generating a privacy budget. This process is repeated, and finally a satisfactory privacy budget customization model is obtained.

[0053] S2. Local model training: Each client uses local data to perform model training to obtain an updated local model. The method used for model training can be arbitrary.

[0054] S3, customized differential privacy noise addition. Each client adds noise to the updated local model according to the privacy budget distributed by the server to obtain a perturbation model. The Gaussian mechanism is used to add noise to the updated local model, that is, the noise added to the model satisfies the quasi-normal distribution. The perturbation model is expressed as:

[0055] P=g+N(0,σ 2 );

[0056] Where P represents the perturbation model after adding noise; g represents the updated local model; N(0,σ 2 ) represents Gaussian noise, where σ satisfies:

[0057]

[0058] Among them, Δf represents sensitivity, which is used to measure the sensitivity of the algorithm to changes in a single sample in the data set. It indicates the maximum possible change in the output result of the function if the input data set changes slightly. In layman's terms, there are now two data sets, 0, 1, 2 and 0, 2, 5. The largest difference between the two data sets is 5-0=5, and Δf here will be set to 5. After adding noise, others will not be able to effectively distinguish between 0 and 5, which has the largest difference, thereby confusing the audience and protecting privacy.

[0059] ε represents the privacy budget, which measures the level of noise used; δ represents the probability of privacy failure, which is an important parameter in differential privacy. It allows the system to violate the strict conditions of differential privacy with a very small probability, thereby allowing the impact of noise on data accuracy to be reduced while controlling privacy. In practical applications, it is set to a very small value to ensure that the possibility of privacy leakage is almost negligible.

[0060] S4, perturbation model upload, the client uploads the perturbation model to the server and updates its own information so that the server can update the privacy budget;

[0061] S5, global model aggregation. After receiving the perturbation model uploaded by the client, the server aggregates the global model and recalculates the client's privacy budget based on the information uploaded by the client. Because the client uses a customized privacy budget for noise addition, that is, adding a customized level of noise, the accuracy of the model can be maximized while ensuring the privacy of the client.

[0062] The information uploaded by the client is public information in the relevant field. For example, in the field of Internet of Vehicles, it can be public information such as vehicle types such as private cars, taxis, buses, etc. that does not involve personal privacy.

[0063] S6: Global model distribution and update: The server distributes the new global model and the new privacy budget to each client, and then repeats the above steps S1-S6 until a suitable model is obtained or the stopping condition is met.

[0064] In order to quantitatively evaluate the privacy of the method, a privacy evaluation system is also included, specifically:

[0065] First, the data in the local model training set in step S2 is classified, that is, the privacy requirements of each client are manually classified S = {s1, s2, s3, ..., s n}, the higher the level, the higher the privacy requirement. Therefore, the privacy loss is expressed as:

[0066]

[0067] Among them, p i represents the privacy loss of client i, p i The larger the value, the worse the privacy; ∈ i represents the privacy budget customized by client i; s i represents the level of client i; function f p (∈ i ) is expressed as:

[0068]

[0069] Among them, the constant C is related to different task requirements;

[0070] Finally, the privacy score is as follows:

[0071]

[0072] in, Indicates the privacy score, with a value range of 0-1. The larger the value, the better the privacy of the scheme, and the more it can meet the user's privacy requirements.

[0073] In this embodiment, the solution of the present invention is run in the Internet of Vehicles and the vehicle speed is predicted. The model accuracy comparison diagram with the ordinary federated learning solution (no noise is added) and the traditional differential privacy federated learning solution (fixed amount of noise is added) is as follows: Figure 2 shown.

[0074] Figure 2 PerFL is the solution of the present invention, S-FL is a solution without adding noise, and DP-FL is a solution with adding fixed noise. It can be seen that the solution of the present invention is between the other two solutions. S-FL has a higher accuracy rate because it does not add noise, but the solution lacks a privacy protection mechanism. Therefore, when the privacy protection mechanism is used, the solution of the present invention is better than the solution with adding fixed noise.

[0075] In addition, a privacy comparison chart is obtained based on the designed privacy score calculation method, such as Figure 3 As shown, RN-FL is adding random noise. In general, the scheme of the present invention is ahead of the schemes of adding fixed noise and random noise in terms of privacy.

[0076] Therefore, the present invention adopts the above-mentioned federated learning privacy budget customization method for differential privacy, which improves the accuracy of the federated learning model while ensuring privacy security.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A privacy budget customization method for federated learning for differential privacy, characterized in that: The following steps are involved: S1. The server initializes the global model to obtain the initial local model. At the same time, the server runs the DQN model to obtain the privacy budget customized for each client and distribute the privacy budget to each client. S2: Local model training: Each client uses local data to train the model and obtain an updated local model. S3, customized differential privacy noise addition: each client adds noise to the updated local model according to the privacy budget distributed by the server to obtain a perturbation model; S4, perturbation model upload, the client uploads the perturbation model to the server and updates its own information so that the server can update the privacy budget; S5, global model aggregation. After receiving the perturbation model uploaded by the client, the server aggregates the global model. At the same time, the client's privacy budget is recalculated based on the information uploaded by the client. S6. Global model distribution and update: The server distributes the new global model and the new privacy budget to each client, and then repeats the above steps S1-S6 until a suitable model is obtained or the stopping condition is met.

2. According to a differential privacy-oriented federated learning privacy budget customization method according to claim 1, it is characterized in that: Step S1 is specifically as follows: the server randomly initializes the global model and distributes the initialized global model to each client, and each client uses the initialized global model as its own initial local model.

3. The method for customizing privacy budget for federated learning based on differential privacy according to claim 2, characterized in that: The core of the DQN model in step S1 is the Bellman update equation, which is used to iteratively improve the Q-value function. The Bellman update equation of the Q-value function is: Among them, γ represents the discount rate that controls future rewards, which is a number between 0 and 1; s represents the user's public non-private information; a represents the privacy budget customized by a client; s′ represents the user's public non-private information in the next state; a′ represents the client-customized privacy budget in the next state; R represents the function related to the accuracy and privacy of the DQN model, specifically: R = αA + (1-α)P; Among them, α represents the score weight; A represents the accuracy score of the DQN model; and P represents the privacy score of the DQN model.

4. The method for customizing privacy budget for federated learning based on differential privacy according to claim 3, characterized in that: In step S3, the Gaussian mechanism is used to add noise to the updated local model, that is, the noise added to the model satisfies the quasi-normal distribution, and the perturbation model is expressed as: P=g+N(0,σ 2 ); Where P represents the perturbation model after adding noise; g represents the updated local model; N(0, σ 2 ) represents Gaussian noise, where σ satisfies: Among them, Δf represents sensitivity, which is used to measure the sensitivity of the algorithm to changes in a single sample in the data set; ε represents the privacy budget to measure the level of noise used; δ represents the probability of privacy failure.

5. The method for customizing privacy budget for federated learning based on differential privacy according to claim 4, characterized in that: It also includes a privacy evaluation system, specifically: The privacy requirements of each client are classified into different levels S = {s1, s2, s3, ..., s n }, the higher the level, the higher the privacy requirement. Therefore, the privacy loss is expressed as: Among them, p i represents the privacy loss of client i; ∈ i represents the privacy budget customized by client i; s i represents the level of client i; function f p (∈i) is expressed as: Among them, the constant C is related to different task requirements; Finally, the privacy score is as follows: in, Indicates the privacy score, ranging from 0 to 1.

Images