A differential privacy-oriented federated learning privacy budget customization method

Abstract

The application discloses a differential privacy-oriented federal learning privacy budget customization method and belongs to the technical field of federal learning and privacy protection, and comprises the following steps: S1, a server end initializes a global model to obtain an initial local model, and simultaneously, the server end runs a DQN model, acquires privacy budgets customized for each client, and distributes the privacy budgets to various clients; S2, local model training; S3, customized differential privacy noise adding; S4, perturbed model uploading; S5, global model aggregation; after receiving the perturbed model uploaded by the client, the server end aggregates the global model; S6, global model distribution and updating; the server end distributes the new global model and the new privacy budget to various clients, and then repeats the above steps until a suitable model is obtained. The application adopts the above-mentioned differential privacy-oriented federal learning privacy budget customization method, guarantees privacy security, and improves the precision of the federal learning model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning and privacy protection, and particularly relates to a differential privacy-oriented federated learning privacy budget customization method. BACKGROUND

[0002] With the increase of sensitive data exchange in the Internet, the demand for privacy protection of users is growing rapidly, and users are more sensitive to the behavior of training artificial intelligence models using personal privacy. In machine learning, an effective, reliable and secure method for protecting user privacy is crucial to maintaining trust and participation. Therefore, a federated learning framework is proposed, which is a distributed framework that allows users to train locally using their own data and only needs to upload local model parameters, thereby reducing the transmission of private data and largely avoiding the leakage of private data. However, studies have shown that there are powerful privacy attack methods that can infer user privacy information from the local model uploaded by the user. In response to this problem, the commonly used privacy protection methods in the industry are differential privacy, homomorphic encryption and multi-party secure computation.

[0003] Among them, the homomorphic encryption scheme usually uses an encryption algorithm with homomorphism to encrypt the local model information uploaded by the user. The homomorphic encryption algorithm allows the client to operate on the original data by operating on the encrypted data without knowing the original data, for example, the multiplication of encrypted data corresponds to the addition of the original data. Therefore, the server can aggregate the model under the condition of model data encryption to obtain the global model. Multi-party secure computation is to design a clever and complex protocol to calculate the model aggregation result in the process of interaction between the user and the server. Because the calculation process is that the user calculates part of the process and then gives it to the server, the server calculates another part and then gives it to the user, and the user continues to operate, and so on. Therefore, the server cannot obtain all the process data, thereby avoiding the leakage of privacy.

[0004] Unlike the above two mathematical methods which are complex and have huge computational overhead, differential privacy protects the privacy of users by adding noise to the local model uploaded by the user. Because the noise added by differential privacy is random, the attacker cannot obtain effective rules after obtaining the uploaded model, thereby achieving privacy protection. Differential privacy has the advantages of simplicity, efficiency, small computational overhead and easy implementation, and is widely used.

[0005] However, the addition of noise can cause the global model accuracy of federated learning to decrease. The existing differential privacy method is mostly static budget allocation, lacks personalized customization for different user needs, and is prone to adding too much privacy, which can cause the model accuracy to decrease significantly or adding too little noise, which can cause the privacy protection ability to be insufficient. That is, the current differential privacy method is difficult to balance the privacy requirement of the user and the model accuracy requirement of federated learning. SUMMARY

[0006] The purpose of the present application is to provide a differential privacy-oriented federated learning privacy budget customization method, which can improve the precision of the federated learning model while ensuring privacy security.

[0007] To achieve the above purpose, the present application provides a differential privacy-oriented federated learning privacy budget customization method, which comprises the following steps:

[0008] S1, the server initializes the global model to obtain the initial local model, and at the same time, the server runs the DQN model to obtain the privacy budget customized for each client, and distributes the privacy budget to each client;

[0009] S2, local model training, each client uses local data to train the model to obtain an updated local model;

[0010] S3, customized differential privacy noise addition, each client adds noise to the updated local model according to the privacy budget distributed by the server to obtain a perturbed model;

[0011] S4, perturbed model uploading, the client uploads the perturbed model to the server and updates its own information to update the privacy budget of the server;

[0012] S5, global model aggregation, after receiving the perturbed model uploaded by the client, the server aggregates the global model; at the same time, according to the information uploaded by the client, the privacy budget of the client is recalculated;

[0013] S6, global model distribution and update, the server distributes the new global model and the new privacy budget to each client, and then repeats the above steps S1-S6 until a suitable model is obtained or the stop condition is met.

[0014] Preferably, step S1 is specifically: the server randomly initializes the global model, and distributes the initialized global model to each client, and each client takes the initialized global model as its initial local model.

[0015] Preferably, the core of the DQN model in step S1 is the Bellman update equation, which is used to iteratively improve the Q value function. The Bellman update equation of the Q value function is:

[0016]

[0017] wherein, γ represents the discount rate of the future reward, which is a number between 0-1; s represents the public non-private information of the user; a represents the privacy budget customized by the client; s' represents the public non-private information of the user in the next state; a' represents the privacy budget customized by the client in the next state; R represents a function related to the accuracy and privacy of the DQN model, and specifically:

[0018] R = αA + (1-α)P;

[0019] wherein, α represents the score weight, and the greater the value of α represents the greater importance of the accuracy in the task; A represents the DQN model accuracy score; P represents the DQN model privacy score.

[0020] Preferably, a Gaussian mechanism is used in step S3 to add noise to the updated local model, that is, the noise added to the model satisfies the quasi-normal distribution, and the perturbed model is represented as:

[0021] P = g + N(0,σ 2 );

[0022] wherein, P represents the perturbed model after adding noise; g represents the updated local model; N(0,σ 2 ) represents Gaussian noise, wherein σ satisfies:

[0023]

[0024] wherein, Δf represents the sensitivity, which is used to measure the sensitivity of the algorithm to the change of a single sample in the data set; ε represents the privacy budget level of using noise; δ represents the privacy failure probability.

[0025] Preferably, it also includes a privacy evaluation system, specifically:

[0026] The privacy requirements of each client are classified as S = {s1, s2, s3, …, s n}, and the higher the level, the higher the privacy requirement. Therefore, the privacy loss is represented as:

[0027]

[0028] wherein, p i represents the privacy loss of the client i, and the greater the value of p i represents the worse privacy; ∈ i represents the privacy budget customized by the client i; s i represents the level of the client i; and f p (∈ iis represented as:

[0029]

[0030] wherein the constant C is related to different task requirements;

[0031] Finally, the privacy score is derived as follows:

[0032]

[0033] wherein, represents the privacy score, and the value range is 0-1, The greater the value, the better the privacy of the scheme, and the better the privacy requirements of the user can be met.

[0034] Therefore, the application adopts the above-mentioned differential privacy-oriented federated learning privacy budget customization method, and the technical effects are as follows:

[0035] (1) Personalized privacy protection: traditional differential privacy federated learning methods usually use fixed or static privacy budgets, which cannot be dynamically adjusted according to the privacy requirements of different users. The application customizes privacy budgets for each client through the DQN network, so that the privacy protection strategy can be dynamically adjusted according to the specific needs of each client, both meeting the privacy requirements of users and providing higher model accuracy for users with lower privacy requirements.

[0036] (2) Improve model accuracy: by customizing privacy budgets for each client, the application maximizes the reduction of noise interference while meeting the requirements of differential privacy protection, thereby improving the overall accuracy of the federated learning model. Clients with high privacy budgets can provide more useful model updates, resulting in more accurate global models.

[0037] (3) Dynamic privacy budget updating mechanism (more widely applicable and more flexible): The application has a dynamic privacy budget updating mechanism, and the server can continuously adjust the privacy budgets of each client according to the public information uploaded by the client. This not only continuously optimizes the privacy protection strategy of model training, but also adaptively adjusts the privacy budget according to the real-time information of the client.

[0038] The technical solutions of the application will be further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is a flowchart of an embodiment of the differential privacy-oriented federated learning privacy budget customization method of the application;

[0040] Figure 2 is an accuracy comparison chart of an embodiment of the differential privacy-oriented federated learning privacy budget customization method of the application;

[0041] Figure 3 is a privacy comparison chart of an embodiment of a differential privacy-oriented federated learning privacy budget customization method of the present application. DETAILED DESCRIPTION

[0042] The technical solutions of the present application are further described below through the drawings and examples.

[0043] Unless otherwise defined, the technical terms or scientific terms used in the present application shall have the usual meanings understood by those skilled in the art to which the present application belongs.

[0044] Example 1

[0045] As shown in Figure 1 , the present application provides a differential privacy-oriented federated learning privacy budget customization method, comprising the following steps:

[0046] S1, the server side randomly initializes a global model, and distributes the initialized global model to each client, and each client takes the initialized global model as its initial local model. At the same time, the server side runs the DQN model to obtain the privacy budget customized for each client, and distributes the privacy budget to each client.

[0047] The core of the DQN model is the Bellman update equation, which is used to iteratively improve the Q value function. The Bellman update equation of the Q value function is:

[0048]

[0049] Where, γ represents the discount rate of future rewards, which is a number between 0-1; s represents the user's public non-private information; a represents the privacy budget customized for each client; s' represents the user's public non-private information in the next state; a' represents the privacy budget customized for each client in the next state; R represents a function related to the accuracy and privacy of the DQN model, specifically:

[0050] R = αA + (1-α)P;

[0051] Where, α represents the score weight; A represents the DQN model accuracy score; P represents the DQN model privacy score.

[0052] In addition, a target network structure is set, and the target network updates the parameters in the network periodically instead of in real time, so that the parameter updating process of the network is more stable. By inputting the non-private information of the client into the network as the state, the network generates a customized privacy budget, and the privacy budget interacts with the environment to generate a feedback reward, so as to adjust the strategy of the network for generating the privacy budget. In this way, a satisfactory privacy budget customization model is finally obtained.

[0053] S2, local model training, each client uses local data to train the model to obtain an updated local model, wherein the method used for model training can be arbitrary.

[0054] S3, customized differential privacy noise adding, each client adds noise to the updated local model according to the privacy budget distributed by the server end to obtain a perturbed model; wherein the Gaussian mechanism is used to add noise to the updated local model, that is, the noise added to the model satisfies the normal distribution, and the perturbed model is represented as:

[0055] P=g+N(0,σ 2 );

[0056] Wherein, P represents the perturbed model after adding noise; g represents the updated local model; N(0,σ 2 ) represents Gaussian noise, wherein σ satisfies:

[0057]

[0058] Wherein, Δf represents the sensitivity, which is used to measure the sensitivity of the algorithm to the change of a single sample in the data set, that is, the maximum possible change of the output result of the function if the input data set changes slightly. In a popular way, there are two data sets 0, 1, 2 and 0, 2, 5. The maximum difference between the two data sets is 5-0=5. Here, Δf will be set to 5. After adding noise, others cannot effectively distinguish even the largest difference between 0 and 5, so as to confuse and protect privacy.

[0059] E represents the privacy budget, which measures the level of noise used; δ represents the privacy failure probability, which is an important parameter in differential privacy, which allows the system to violate the strict conditions of differential privacy at a very small probability, so as to reduce the influence of noise on data accuracy while controlling privacy. In practical application, it is set to a very small number to ensure that the possibility of privacy leakage can be ignored.

[0060] S4, perturbed model uploading, the client uploads the perturbed model to the server end and updates the information to update the privacy budget of the server end;

[0061] S5, global model aggregation, after the server receives the perturbed model uploaded by the client, the global model is aggregated; at the same time, according to the information uploaded by the client, the privacy budget of the client is recalculated. Among them, because the client uses a customized privacy budget for noise addition, that is, a customized level of noise is added, so the accuracy of the model can be maximized as much as possible while ensuring the privacy of the client.

[0062] The information uploaded by the client is public information in the relevant field, for example, in the field of Internet of Vehicles, it can be public information such as private cars, taxis and buses that do not involve personal privacy.

[0063] S6, global model distribution and update, the server distributes the new global model and the new privacy budget to each client, and then repeats the above steps S1-S6 until a suitable model is obtained or the stop condition is met.

[0064] In order to quantitatively evaluate the privacy of the method, a set of privacy evaluation system is also included, which is specifically:

[0065] First, the data in the local model training set in step S2 is classified, that is, the privacy requirements of each client are manually classified S={s1,s2,s3,…,s n The higher the level, the higher the privacy requirement, and thus the privacy loss is represented as:

[0066]

[0067] Among them, p i represents the privacy loss of client i, p i The larger the value, the worse the privacy; ∈ i represents the privacy budget customized by client i; s i represents the level of client i; the function f p (∈ i ) is represented as:

[0068]

[0069] Among them, the constant C is related to different task requirements;

[0070] Finally, the privacy score is as follows:

[0071]

[0072] Among them, represents the privacy score, the value range is 0-1, The larger the value, the better the privacy of the scheme, the better the user's privacy requirements can be met.

[0073] The scheme of the present application is run in the Internet of Vehicles in this embodiment, and the prediction of vehicle speed is carried out, wherein a comparison chart of model accuracy of the scheme of the present application, a common federated learning scheme (without adding noise) and a traditional differential privacy federated learning scheme (adding fixed noise) is as shown in Figure 2

[0074] Figure 2 In the figure, PerFL is the scheme of the present application, S-FL is the scheme without adding noise, and DP-FL is the scheme adding fixed noise. It can be seen that the scheme of the present application is between the other two schemes. S-FL has higher accuracy because it does not add noise, but the scheme lacks a privacy protection mechanism. Therefore, in the case of using the same privacy protection mechanism, the scheme of the present application is superior to the scheme adding fixed noise.

[0075] In addition, a privacy comparison chart is obtained according to the designed privacy score calculation method, as shown in Figure 3 In general, the scheme of the present application is superior to the schemes adding fixed noise and random noise in terms of privacy.

[0076] Therefore, the present application adopts the above-mentioned differential privacy federated learning privacy budget customization method, which improves the accuracy of the federated learning model while ensuring privacy security.

[0077] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application but not to limit it, although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that: it can still modify or equivalently replace the technical solutions of the present application, and these modifications or equivalent replacements also cannot make the modified technical solutions deviate from the spirit and scope of the technical solutions of the present application.​

Claims

1. A federated learning privacy budget customization method for differential privacy, characterized in that, The method comprises the following steps: S1, the server initializes a global model to obtain an initial local model, and the server runs a DQN model to obtain a privacy budget customized for each client and distribute the privacy budget to each client; S2, local model training, each client uses local data to train the model to obtain an updated local model; S3, customized differential privacy noise adding, each client adds noise to the updated local model according to the privacy budget distributed by the server to obtain a perturbed model; S4, perturbed model uploading, the client uploads the perturbed model to the server and updates its own information to update the privacy budget of the server; S5, global model aggregation, after receiving the perturbed model uploaded by the client, the server aggregates the global model; at the same time, according to the information uploaded by the client, the privacy budget of the client is recalculated; S6, global model distribution and update, the server distributes the new global model and the new privacy budget to each client; Repeat steps S1-S6 until a suitable model is obtained or a stop condition is met; The core of the DQN model in step S1 is the Bellman update equation, which is used to iteratively improve the Q value function. The Bellman update equation for the Q value function is: ； where, denotes the discount rate that controls future rewards, is a number between 0-1; denotes the user's public non-private information; denotes the client's customized privacy budget; denotes the user's public non-private information in the next state; denotes the client's customized privacy budget in the next state; denotes a function related to the accuracy of the DQN model and privacy, specifically: ； wherein, represents a score weight; represents a DQN model accuracy score; represents a privacy score of the DQN model; In step S3, Gaussian mechanism is used to add noise to the updated local model, that is, the noise added to the model satisfies the normal distribution, and the perturbed model is represented as: ； wherein, denotes the perturbed model after adding noise; denotes the updated local model; denotes the Gaussian noise, wherein satisfies: ； wherein, represents a sensitivity, which measures how sensitive the algorithm is to changes in individual samples in the dataset; represents a privacy budget, which measures the level of noise used; represents a privacy failure probability; It also includes a privacy evaluation system, which is as follows: Ranking privacy requirements for each client The higher the rank, the higher the privacy requirement, whereby the privacy loss is expressed as: ； in, Represents the client loss of privacy; Represents the client Customized privacy budget; Represents the client Level of function Expressed as: ； wherein the constant associated with different task requirements; Finally, the privacy score is as follows: ； wherein, represents a privacy score, with a value range of 0-1.

2. The differential privacy-oriented federated learning privacy budget customization method according to claim 1, characterized in that, Step S1 is: the server randomly initializes a global model and distributes the initialized global model to each client, and each client takes the initialized global model as its initial local model.

Images