Data forgetting verification method and device, equipment, medium and product

Abstract

The invention discloses a data forgetting verification method and device, equipment, a medium and a product, and relates to the field of federal learning data forgetting, the method comprises the following steps: obtaining a forgetting request sent by a to-be-forgotten client, the forgetting request comprising a local model stored by the to-be-forgotten client and forgotten content requested by the to-be-forgotten client; in response to a forgetting request sent by a to-be-forgotten client, setting the permission of the local model to be forgotten, clearing forgotten contents in the local model, and generating a global model; and sending the global model to the to-be-forgotten client, and verifying a forgetting result of the global model to obtain a verification result. According to the method, the completion degree of data forgetting can be verified, and an efficient and intuitive effect is achieved.

Description

Technical Field

[0001] The present application relates to the field of federated learning data forgetting, and in particular to a data forgetting verification method, device, equipment, medium and product. Background Art

[0002] Federated learning has emerged as a privacy-preserving distributed collaborative learning framework where all participants can jointly train a powerful model without sharing their private data. A basic requirement of federated learning is to allow participants to join or leave freely without concerns, that is, private data about leaving users should be actively forgotten by the central server.

[0003] At present, the main way for the server to forget data is to inject special marks into the local data of different clients. The server directly identifies and ignores the samples injected with special marks, and then completes the forgetting of data on this basis. After that, the completion of data forgetting is verified to obtain the verification result. However, there is a problem of verification difficulty in data forgetting at present, so there is an urgent need for an efficient and intuitive verification method. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the related art, the purpose of this application is to provide a data forgetting verification method, device, equipment, medium and product, which can verify the completeness of data forgetting and has efficient and intuitive effects.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In the first aspect, the present application provides a data forgetting verification method, which includes: obtaining a forgetting request sent by a to-be-forgotten client, the forgetting request including a local model stored by the to-be-forgotten client and the forgotten content requested by the to-be-forgotten client; responding to the forgetting request sent by the to-be-forgotten client, setting the permission of the local model to forget, and clearing the forgotten content in the local model to generate a global model; sending the global model to the to-be-forgotten client, and verifying the forgetting result of the global model to obtain a verification result.

[0007] Optionally, setting the permissions of the local model to forgotten and clearing the forgotten content in the local model to generate a global model includes: setting the permissions of the local model to forgotten and sending a candidate tag set to the to-be-forgotten client; the to-be-forgotten client is used to globally tag the data corresponding to the forgotten content in the local data to generate a tag data set; and enabling the to-be-forgotten client to train the global model based on the tag data set to obtain a sub-global model; obtaining the sub-global model, and aggregating the sub-global model and the local model based on a preset algorithm to generate the global model.

[0008] Optionally, the forgetting result of the global model is verified to obtain the verification result, including: sending the set of selected marks to the to-be-forgotten client, so that the to-be-forgotten client generates a test data set; obtaining the pre-forgetting prediction result obtained by the to-be-forgotten client based on the test data set and the local model, and the post-forgetting prediction result obtained based on the test data set and the global model; obtaining a global prediction accuracy value based on the pre-forgetting prediction result and the post-forgetting prediction result; verifying the forgetting degree of the global model based on the global prediction accuracy value to obtain a forgetting result.

[0009] Optionally, the forgetting result of the global model is verified to obtain the verification result, including: predicting the locally labeled test samples based on the global model to obtain a local prediction accuracy value; comparing the local prediction accuracy value with the global prediction accuracy value to obtain a prediction accuracy difference.

[0010] Optionally, the local model is a trained model, and the training method of the local model includes: sending the set of candidate tags to all associated target clients; the set of candidate tags is used to enable each of the target clients to globally tag local data, and enable each of the target clients to generate a training data set based on the globally labeled data and local data, and enable each of the target clients to train the stored model based on the training data set to obtain a trained sub-model; wherein the set of candidate tags includes different special tags and the special tags selected by each of the target clients are different; obtaining the trained sub-models of each of the target clients, and aggregating each of the trained sub-models to obtain the local model.

[0011] Optionally, the method further comprises: sending the global model to all associated clients, so that each of the clients updates a local model stored locally to the global model.

[0012] In the second aspect, the present application provides a data forgetting verification device, which includes: a request acquisition module, used to obtain a forgetting request sent by a to-be-forgotten client, the forgetting request including a local model stored by the to-be-forgotten client and the forgotten content requested by the to-be-forgotten client; a response generation module, used to respond to the forgetting request sent by the to-be-forgotten client, set the permission of the local model to forget, and clear the forgotten content in the local model to generate a global model; a sending verification module, used to send the global model to the to-be-forgotten client, and verify the forgetting result of the global model to obtain a verification result.

[0013] In a third aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any one of the above-mentioned data forgetting verification methods.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the above-mentioned data forgetting verification methods.

[0015] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned data forgetting verification methods.

[0016] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0017] The present application provides a data forgetting verification method, device, equipment, medium and product. By responding to the data forgetting request sent by the client to be forgotten, the data to be forgotten is cleared and a global model is generated, which not only achieves the purpose of completely forgetting the data of the exiter, but also can effectively eliminate the influence of the exiter on the local model; the forgetting result of the global model is obtained by sending the global model to the forgetting client; the completion of the data forgetting can be verified through the forgetting result of the global model, which has an efficient and intuitive effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1This is a flow chart of a data forgetting verification method in one embodiment of the present application;

[0020] Figure 2 A schematic diagram of a tag injection and verification process provided by an embodiment of the present application;

[0021] Figure 3 A local marking schematic diagram provided for an embodiment of the present application;

[0022] Figure 4 A schematic diagram of global marking provided in an embodiment of the present application;

[0023] Figure 5 A schematic diagram of a sample data set with partial local markings provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of a globally labeled MNIST dataset provided in an embodiment of the present application;

[0025] Figure 7 A schematic diagram of the training process of a local model provided in one embodiment of the present application;

[0026] Figure 8 A schematic diagram of the functional modules of a data forgetfulness verification device provided in one embodiment of the present application.

[0027] Fig. 9 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0030] In an exemplary embodiment, Figure 1 As shown, a data forgetting verification method is provided, which is executed by a computer device, and can be executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the data forgetting verification method includes the following steps S110 to S130. Among them:

[0031] Step S110, obtaining a forget request sent by the client to be forgotten.

[0032] In an exemplary embodiment, the forget request includes a local model stored by the to-be-forgotten client and the forget content requested by the to-be-forgotten client.

[0033] For example, the forget request received by the server is R i =(D i , S i ), where if S i =U, it means that a data forgetting operation is performed on the local model stored locally on the client that sends the forget request.

[0034] Step S120, in response to the forget request sent by the client to be forgotten, the permission of the local model is set to be forgotten, and the forgotten content in the local model is cleared to generate a global model.

[0035] In an exemplary embodiment, when the server receives S i =U, the server first uses the relevant algorithm to complete the data forgetting, and after completing the data forgetting, generates a new model, namely the global model, and sends the global model to the client, so that the client replaces the local model stored locally with the global model. At this stage, in addition to implementing the data forgetting request, data forgetting verification is also required, that is, the server needs to prove to the client to be forgotten that the forgetting request has been completed.

[0036] It should be noted that the algorithm used for forgetting data collection in the embodiments of the present application is, for example, retraining.

[0037] Also, in the embodiment of the present application, multiple clients (usually devices or sensors) jointly train a global model in the context of federated learning, each client holds its own data, and only shares model updates to a central server. Among them, the local model, global model involved in the embodiment of the present application, and the subsequently trained sub-models and sub-global models involved are all definitions of "forgotten models" at different stages. In federated learning, "forgotten model" usually refers to Federated Unlearning, which is a mechanism that allows the influence of specific users or data sets to be removed from the federated learning model without having to retrain the entire model.

[0038] Step S130, sending the global model to the client to be forgotten, and verifying the forgetting result of the global model to obtain a verification result.

[0039] In combination with the above embodiment, it can be understood that, first, each client sends different requests to the server according to its own data forgetting probability. After receiving the permission setting request submitted by the client, if there is R i =(D f, F) request, the server needs to send a special mark to the relevant client for subsequent data forgetting and verification. Figure 2 As shown, the server needs to provide the corresponding special tag, and the client injects the special tag into part of the local data.

[0040] It should be noted that most of the existing technologies use local labels when constructing special labeling datasets. Local labels have the following characteristics:

[0041] (a) For example Figure 3 As shown in the figure, most of the local marks only exist in the local part or corner of the sample and cannot affect the global effect. When flipping the sample labels, this marking method may result in similar pictures but large label differences. Using the same sample with two types of labels for model training will cause the model's recognition ability to decline both for the sample and the label. If local marks are injected but the sample labels are not flipped, the model with strong learning ability may focus on learning the main features of the sample and ignore the local marks with limited scope. Then, when the model recognizes the samples with and without injected marks, the difference is not much. Although the model performance will not be greatly affected, data forgetting cannot be verified.

[0042] (b) If the labels of the injected labeled samples are modified, the connection between the special labels and the new labels will be weakened and the overall performance of the model will be affected. If the number of samples injected with special labels is too small, for example, a small number of special samples with modified labels are mixed in a large number of original samples, it will be difficult for the model to recognize the relationship between the special labels and the modified labels. These samples injected with special labels are more likely to show noise-like effects when the number is unbalanced. On the contrary, if the number of samples injected with special labels is too large, the artificially set wrong labels are equivalent to introducing wrong information. Then the excessive number of special samples will continue to accumulate the impact on the model, resulting in a decline in the performance of the model.

[0043] Therefore, although local labeling is a more commonly used way to construct a verification data set in data forgetting verification, the verification data set using local labels cannot verify the data forgetting of the model, or introduces erroneous information during the verification process, resulting in a decrease in model performance. Therefore, in order to alleviate the problem of difficulty in data forgetting verification caused by local labeling, the embodiment of the present application globally labels the samples to reduce the introduction of errors and ensure model performance. It should be noted that in order to reduce the introduction of errors, the embodiment of the present application only adds special marks to the samples and does not change the initial labels of the samples. At the same time, in order to ensure model performance, simple and intuitive symbols are used as special marks, such as "cross" marks and "×" marks.

[0044] In a specific embodiment of the present application, the above-mentioned step S130 may include: sending a set of candidate marks to be forgotten to the client to be forgotten, so that the client to be forgotten generates a test data set; obtaining the pre-forgetting prediction result obtained by the client to be forgotten based on the test data set and the local model, and the post-forgetting prediction result obtained based on the test data set and the global model; obtaining a global prediction accuracy value based on the pre-forgetting prediction result and the post-forgetting prediction result; verifying the forgetting degree of the global model based on the global prediction accuracy value to obtain a forgetting result.

[0045] For example, Table 1:

[0046] 1 <![CDATA[D m ←Sampler(D) / / Sample data to create a marking dataset]]> 2 <![CDATA[D m ←Concat(D m ,m) / / modify the images with marker m]]> 3 <![CDATA[Mo←Train(D m ,D) / / train a model with dataset D and Dm]]> 4 <![CDATA[acc←Pred(Mo,D m )]]> 5 <![CDATA[Mo'←MU(D f ) / / unlearn the original model Mo]]> 6 <![CDATA[acc'←Pred(Mo′,D m )]]> 7 If acc-acc>ε:return true / / verification is successful

[0047] In steps 1-3 of Table 1, after selecting a special tag, the client selects some local data to add the special tag, then mixes the labeled samples with the local samples to obtain training samples, and uses the training samples to train the local model until the prediction performance of the local model for the labeled samples tends to be stable. By covering the training samples established by the global special tags, the relationship between the global tags and the labels can be established in the iterative training of the local model, which can improve the model's recognition ability for special tags and avoid the degradation of model performance caused by incorrect labels.

[0048] Afterwards, the server receives the local models uploaded by multiple clients, selects appropriate algorithms (e.g., edAvg and model substitution) to aggregate and obtain the global model. After the aggregation is completed, the server sends the global model to each client. As shown in step 4 of Table 1, after receiving the global model, the client replaces the local model stored locally with the global model to obtain the currently stored local model, and uses the currently stored local model to predict the labeled samples to obtain the prediction result P a .

[0049] When the client needs to forget data, the client sends R to the server. i =(D f , U) format of forget request, where D f Represents the local model currently stored by the client, and U represents setting the permission of the local model to forget and performing data forgetting. As shown in step 5 of Table 1, after receiving the forget request, the server uses the retraining or cancellation learning algorithm to promptly clear the information related to the local model and complete the data forgetting.

[0050] When D f After completing data forgetting, the server sends a new global model to the requesting client. The requesting client predicts the labeled samples based on the new global model and reports the prediction result P b And the prediction result P before the data is forgotten aFor comparison, as shown in steps 6-7 in Table 1, if the prediction result P b And the prediction result P a If there is a clear gap between the two, then the server should treat the forgotten client's local model D f Data forgetting was performed.

[0051] It should be noted that when the server sends a special tag to the client, in order to further reduce the introduction of errors, different special tags need to be provided to different clients, that is, clients connected to the same central server use different special tags when marking local data. In addition, the data marked by the client with a special tag is the data that the client needs to forget.

[0052] Implementing the above-mentioned steps S110 to S130, by responding to the data forgetting request sent by the client to be forgotten, clearing the data to be forgotten and generating a global model, not only achieves the purpose of completely forgetting the data of the withdrawn person, but also can effectively eliminate the influence of the withdrawn person on the local model; the forgetting result of the global model is obtained by sending the global model to the client with forgetting; the forgetting result of the global model can be used to verify the completion of data forgetting, which has an efficient and intuitive effect.

[0053] In an exemplary embodiment of the present application, in order to highlight the superiority of using global labeling in the embodiment of the present application, globally labeled test samples and locally labeled test samples can be used to verify the forgetting degree of the local model of the client to be forgotten. The above step S130 may include: predicting the locally labeled test samples based on the global model to obtain a local prediction accuracy value; comparing the local prediction accuracy value with the global prediction accuracy value to obtain a prediction accuracy difference.

[0054] Understandably, in order to evaluate the performance of the backdoor attack verification mechanism in data forgetting, three datasets, MNIST, FMNIST and SVHN, are selected to verify the degree of forgetfulness of the local model of the client to be forgotten. Among them, MNIST (Modified National Institute of Standards and Technology) is a handwritten digit dataset containing 70,000 28x28 pixel grayscale images, of which 60,000 are used for training and 10,000 are used for testing. These images cover handwritten digits from 0 to 9. FMNIST (Fashion-MNIST); Fashion-MNIST is an image dataset that replaces the MNIST dataset, containing 70,000 28x28 pixel grayscale images, of which 60,000 are used for training and 10,000 are used for testing. These images cover 10 different categories of clothing and accessories, such as T-shirts, pants, shoes, etc. SVHN (StreetView House Numbers) is a digital dataset extracted from Google Street View images, containing 600,000 2x32 pixel color images, of which 73,257 are used for training and 26,032 are used for testing. The numbers in these images usually appear on house numbers with complex and diverse backgrounds.

[0055] It should be noted that in the verification-related operations of data forgetting, special tags need to be injected into the local data set of the client that makes the forgetting request, and then the marked data is mixed with part of the original data to train the local model. The embodiment of the present application sets local tags and global tags for comparative analysis.

[0056] In addition, this example embodiment performs data forgetting on the local model, and verifies the degree of forgetting of the global model after the data forgetting is completed. The initial FedAvg model involved later is a global model aggregated by the FedAvg method, the initial model is obtained by training the initial FedAvg model, the initial replacement model is a global model aggregated by the acquisition model replacement method, and the retrained model is a global model generated by aggregating after data forgetting using the retraining algorithm.

[0057] In the global labeling method, in order not to significantly affect the performance of the model, the labels of the labeled data are not changed, but the global radiation of special labels is relied on to force the local model to establish prior knowledge of special labels. Figure 4 As shown, "cross" and "×" marks are used for global marking, where "cross" and "×" can significantly change the pixel representation of the original sample, making it more difficult for the model to learn the sample.

[0058] In the local labeling method, two types of local labels are set. The initial sample and the sample after injection labeling are Figure 5 As shown, the first column is the original sample and the original label, the second column is the local label of the unchanged label, and the third column in the figure is the local label of the changed label.

[0059] When injecting local marks to carry out data forgetting verification, we first select some samples from the MNIST, FMNIST and SVHN data sets respectively, and then set a pixel block in the upper left corner as a special mark, and train these samples injected with special marks together with the original samples.

[0060] Specifically, we analyze the data forgetting of federated learning under the multi-round iteration mechanism and ORAFL mechanism, and use FedAvg and model replacement to aggregate the local models of each client. Then, we record the prediction accuracy of the aggregated global model for the labeled data set (a special data set with labels injected into the sample) before and after data forgetting.

[0061] Furthermore, for the data forgetting verification of multi-round iterative federated learning, the forgetting method of data forgetting under the multi-round iterative federated learning mechanism is retraining. The user injects three types of tags through the client: local tags of changed labels, local tags of unchanged labels, and global tags to construct a labeled data set and verify data forgetting.

[0062] First, the labels of the labeled samples were manually modified, and then the prediction results of the global model on the labeled test set before and after data forgetting were recorded. The experimental results are shown in Table 2:

[0063] Table 2

[0064] Dataset Initial FedAvg Model Initial alternative model Retraining the model Model accuracy difference MNIST 12.7％ 15.7％ 12.4％ +0.3％+3.3％ FMNIST 16.4％ 18.6％ 10.5％ +5.9％+8.1％ SVHN 9.0％ 20.4％ 8.0％ +1.0％+12.4％

[0065] The results show that the prediction accuracy of the model for the labeled test set is very low, and the prediction accuracy before data forgetting is between 9.0% and 20.4%. Analysis shows that local labels have little effect on the main body of the picture, so when the model extracts features and learns the labeled pictures, the main information it recognizes is still the connection between the main body of the picture and the label. Because the labels of the labeled samples are artificially modified, the number of labeled samples with modified labels is too small compared to other samples with real labels. The model cannot effectively establish the relationship between the label and the new label. At this time, the prediction results of these labeled samples are more inclined to the prediction of the unlabeled case, so the prediction accuracy is extremely low, not exceeding 10%. At the same time, the difference in prediction accuracy of the model before and after data forgetting is also very low, with a minimum of 0.3% and a maximum of 12.4%. Therefore, the local labeling method of changing labels cannot effectively authenticate the model data forgetting.

[0066] Table 3

[0067] Dataset Initial FedAvg Model Initial alternative model Retraining the model Model accuracy difference MNIST 97.3％ 95.5％ 95.4％ +1.9％+0.1％ FMNIST 83.7％ 83.4％ 82.7％ +1.0％+0.7％ SVHN 86.2％ 87.0％ 83.6％ +2.6％+3.4％

[0068] As shown in Table 3, when no additional adjustment is made to the labels of the labeled samples, the prediction results of the global model on the labeled test set before and after data forgetting are still recorded. It is found that the prediction accuracy is relatively high, and the accuracy on the three data sets can reach 97%, 83% and 86%, respectively. However, the difference in prediction accuracy before and after data forgetting is very small, maintaining between 0.1% and 3.4%, and the change range is very small, which still cannot meet the verification requirements. Similar to the case of label change, local labels have little effect on the original samples. Whether before or after data forgetting, the model's recognition of local labels is very limited. Therefore, the model's prediction of labeled samples is based on the learning of other normal samples, and the original labels of labeled samples can be identified more accurately. At the same time, because there is too little knowledge about the labels, the removal of the labels will not have a significant impact on the prediction effect of the model. The difference in prediction before and after data forgetting does not exceed 3.4%. Therefore, the local labeling method of injecting unchanged labels is also difficult to effectively verify the cancellation of model learning.

[0069] It can be seen from the results in Tables 2 and 3 that in the local labeling verification method, whether or not the original labels of the labeled samples are modified, the effect of conducting multiple rounds of iterative federated learning data forgetting verification is not significant enough and it is difficult to meet the verification requirements of data forgetting.

[0070] Table 4

[0071]

[0072] Table 4 shows the experimental results of using the global labeling method to verify data forgetting under the multi-round iterative federated learning mechanism. In the environment of federated learning with 10 clients, the FedAvg method is used for model aggregation. The feasibility of the global labeling method is verified by recording the difference in prediction accuracy of the global model for the test set and the labeled test set before and after data forgetting.

[0073] As shown in Table 4, before and after data forgetting, when the global model predicts the test set, the prediction accuracy decreases slightly, and the accuracy changes between 0.22% and 1.24%. When predicting the labeled test set with special tags, the difference in accuracy is 10.50%, 16.95% and 13.0%, respectively, and the difference in prediction accuracy is quite obvious. The prediction difference results on the labeled data set can reach up to 105 times, 24.21 times and 5 times of the local tagging method with unchanged labels. Even compared with the results of the local tagging method with changed labels, the difference results of the global tagging method can reach up to 35 times, 2.87 times and 13 times of the former. The results show that even after multiple rounds of iterative federated learning training, the role of global tagging in the global model has not been diluted to a large extent, and the accuracy before the model data forgetting remains at a high level. Moreover, the prediction differences of the model for the labeled data set before and after data forgetting are all above 10%, which is quite significant. The difference results of the global tagging method can reach an average of 53.03 times that of the local tagging method. Therefore, the global labeling method has a more significant verification effect than the local labeling method in data forgetting verification under a multi-round iterative mechanism.

[0074] In the scenario of federated learning, some samples are selected to inject global tags, local tags with unchanged labels, and local tags with changed labels, and model training is performed on this basis. The accuracy of the global model on different data sets before and after the learning is cancelled is recorded. In addition, the global tagging method is used to verify data forgetting. Compared with the other two tagging methods, the model accuracy before and after data forgetting can show a significant difference in both the labeled training set and the labeled test set, which can effectively complete the verification of learning cancellation. Therefore, in the scenario of data forgetting in federated learning, compared with traditional local tagging, the use of global tagging can achieve efficient and significant verification.

[0075] Furthermore, the data forgetting verification of the client part is carried out by using the change label local marking, the unchanged label local marking and the global marking method. The data forgetting method used is retraining.

[0076] Tables 5 and 6 record the verification results of partial data forgetting of a single client by constructing a labeled dataset using two methods, local labeling with changed labels and local labeling with unchanged labels.

[0077] Table 5

[0078] Dataset Initial Model Retraining the model Model accuracy difference MNIST 4.0％ 3.0％ +1.0％ FMNIST 1.2％ 0.70％ +0.5％ SVHN 10.10％ 2.30％ +6.8％

[0079] As shown in Table 5, the prediction accuracy of the model for the dataset with changed labels is very low, even lower than the accuracy of random prediction (10%). At the same time, the difference in model prediction accuracy before and after data forgetting is very small, 1.0%, 0.5% and 6.8% respectively. This is because only a small number of samples are injected with local labels, and the number of samples with changed labels is much smaller than the number of original samples. Therefore, the model learns more from the original label samples, and it is difficult to establish the connection between the local label samples and the changed labels. It is more inclined to output the original labels when predicting. The results show that the prediction accuracy of the local labeling method with changed labels is low for labeled data, and the difference is between 0.5% and 6.8%, which is not obvious enough, and the verification effect is poor.

[0080] Table 6

[0081] Dataset Initial Model Retraining the model Model accuracy difference MNIST 92.50％ 93.30％ -0.90％ FMNIST 79.80％ 78.70％ +1.10％ SVHN 89.90％ 87.80％ +2.10％

[0082] As shown in Table 6, the prediction accuracy of the global model for the unchanged label local labeled data set is very high, but the difference before and after data forgetting is still very low, 0.90%, 1.10% and 2.10% respectively. The change range is very small and it is difficult to play an effective verification role. This is because the impact of local labels on samples is too small, and the labels of labeled samples are not changed. The model learns only the connection between the sample body and the original label during training. Then the model's prediction of labeled samples before and after data forgetting is similar to the prediction result on ordinary samples, so the accuracy is high. However, because of this, the removal of local labels does not affect the model's prediction of labeled data sets, so the difference in prediction results is small.

[0083] From the above data, it can be seen that it is difficult to achieve effective verification of partial data forgetting of a single client using the local labeling method. The difference in the model's prediction accuracy for the labeled data set before and after data forgetting is too small and not significant enough. Verification using the local labeling method still has the problem of verification difficulties.

[0084] Global labeling is used again for data forgetting verification; Tables 7 and 8 are the relevant results of the global labeling method, which are the prediction accuracy of the global model on the test set and the prediction accuracy on the labeled test set, respectively.

[0085] Table 7

[0086] Dataset Markerless Model Initial Model Retraining the model Difference (initial model and unlabeled model) MNIST 96.72％ 96.01％ 94.98％ -0.71％ FMNIST 85.24％ 84.61％ 85.70％ -0.63％ SVHN 88.36％ 89.44％ 89.54％ +1.08％

[0087] First, in order to verify that global labeling does not have a significant impact on model performance, the prediction results of the training model without labeling are recorded. As shown in Table 7, after the global labeling is injected into the local data set of the client, the difference in prediction accuracy between the unlabeled model and the labeled model is very small, within 1.0%, indicating that global labeling does not affect model performance too much. This is because global labeling does not modify the label of the sample, so it does not introduce erroneous information. At the same time, the global nature of the labeling increases the difficulty of the model to identify features, which can be regarded as a random erasure data enhancement to improve the generalization ability of the model.

[0088] Table 8

[0089] Dataset Initial Model Retraining the model Model accuracy difference MNIST 84.90％ 36.60％ +48.30％ FMNIST 56.90％ 37.10％ +19.80％ SVHN 77.50％ 20.30％ +57.20％

[0090] As shown in Table 8, before and after data forgetting, the prediction accuracy of the model for the labeled test set differed by 19.80%, 48.30% and 57.20% respectively. Compared with the multi-round iteration mechanism, the effect of using the global labeling method to verify partial data forgetting of the client is more obvious. The model prediction difference results on the labeled test set reached 4.6 times, 2.85 times and 4.4 times of the multi-round iteration difference results. This is because in the multi-round iteration environment, the local models of each client need to be aggregated to generate a global model. In this aggregation and multi-round iteration process, the recognition effect of the global model for special tags will be diluted. However, in the process of data forgetting of a single client, the recognition of the tag will not be diluted, and the difference in the recognition of the tag before and after data forgetting is more significant. At the same time, the difference results of the global labeling method reached 48.3 times, 39.6 times and 8.4 times of the difference results of the local labeling method with changed labels, and 53.67 times, 18 times and 27.23 times of the difference results of the local labeling method with unchanged labels. Therefore, when forgetting part of the data of a single client, using global labeling can obtain more significant verification results than local labeling.

[0091] Furthermore, for the data forgetting verification of ORAFL, two very simple global tags were set up, taking the MNIST dataset as an example, and some samples were selected from the original dataset for tag injection. MNIST is a handwritten digit recognition dataset, in which the samples are relatively simple numbers, and the main content of the samples is basically located in the center of the picture. The injection of global tags can effectively mask the original content, increasing the difficulty of the model to learn the labeled samples.

[0092] Table 9

[0093] Dataset Initial FedAvg Model Initial alternative model Retraining the model Model accuracy difference MNIST 12.6％ 20.0％ 11.2％ +1.4％ / +7.8％ FMNIST 13.4％ 23.1％ 10.4％ +3.0％ / +12.7％ SVHN 12.4％ 18.0％ 8.8％ +3.6％ / +9.2％

[0094] As shown in Table 9, local labels with changed labels are injected into some samples, and then the prediction results of the global model on the labeled test set before and after data forgetting are recorded. The results show that the prediction accuracy of the model on the labeled test set is relatively low. The prediction accuracy of the model on the labeled data set before data forgetting is 20.0%, 23.1% and 18.0% respectively. The difference in prediction accuracy of the model on the labeled data set before and after data forgetting can reach up to 7.8%, 12.7% and 9.2% at most. This is because the number of samples with artificially modified labels is too small, which makes it difficult for the model to effectively establish the connection between the modified labels and samples during the training process, so the prediction accuracy is low, which is equivalent to random prediction, not reliable enough, and difficult to be used as an effective verification method.

[0095] Table 10

[0096] Dataset Initial FedAvg Model Initial alternative model Retraining the model Model accuracy difference MNIST 97.2％ 97.6％ 96.8％ +0.4％ / +0.8％ FMNIST 85.6％ 84.2％ 86.8％ -1.2％ / -2.6％ SVHN 86.4％ 84.6％ 84.4％ +2.0％ / -0.2％

[0097] As shown in Table 10, after injecting local labels with unchanged labels into the samples, the prediction accuracy of the models obtained by mixed training with the original samples is very high for the labeled data set, but the difference is not obvious, ranging from 0.2% to 2.6%. The influence of local labels on samples is weak, and the main knowledge learned by the model is still the connection between the sample body and the label. Therefore, whether to remove the label does not affect the prediction ability of the model. When the model predicts the labeled test set, it mainly makes inferences based on the characteristics of the sample body. However, the difference in prediction before and after data forgetting is too low to be used as an effective verification method.

[0098] The feasibility of the global marking method is verified as shown in Table 11:

[0099] Table 11

[0100]

[0101] As shown in Table 11, the table records the prediction accuracy of the global model on the test set with and without adding labels, as well as the prediction accuracy of the model on the test set after data forgetting. The results show that the prediction accuracy of the global model obtained by using FedAvg and model substitution is slightly different from that of the unlabeled case on the test set, with the difference between 0.93% and 1.18%, indicating that the mixed injection of local labeled samples for model training has little effect on the accuracy of the model. Moreover, when the model after data forgetting predicts the test data set again, the change in prediction accuracy on the test set does not exceed 1.50%, indicating that using the global labeling method for data forgetting does not have a significant impact on model performance.

[0102] Table 12

[0103] Dataset Initial FedAvg Model Initial alternative model Retraining the model Model accuracy difference MNIST 70.3％ 76.8％ 63.2％ +7.1％ / +13.6％ FMNIST 66.8％ 70.4％ 60.8％ +6.0％ / +9.6％ SVHN 32.8％ 38.8％ 28.4％ +4.4％ / +10.4％

[0104] As shown in Table 12, on the corresponding labeled test set, the prediction accuracy after data forgetting was 5% to 10% different when using the model before and after data forgetting and compared with the initial global model obtained by FedAvg aggregation. Compared with the initial global model obtained by model replacement, the prediction accuracy of the model after learning was cancelled was 9.6% to 13.6%. The difference of the model replacement method was 3.6 to 6.5 percentage points higher than that of the FedAvg method. This is because the model replacement method is equivalent to expanding the weight of the local model corresponding to the labeled data set in the aggregation process, increasing the influence of the labeled data on the global model. Therefore, the global model obtained by the model replacement method will be more sensitive to the performance of the labeled data before and after data forgetting, and the difference will be greater. When using the FedAvg aggregation algorithm, the difference results of the global labeling method are 17.75 times, 5 times and 2.2 times of the local labeling method with unchanged labels, and 5.1 times, 2.0 times and 1.22 times of the difference results of the local labeling method with changed labels. When the same model replacement method is used, the difference results of the global labeling method are 17 times, 3.7 times, and 52 times that of the local labeling method with unchanged labels, and 1.7 times, 0.75 times, and 1.13 times that of the local labeling method with changed labels. Therefore, even if data forgetting is performed under the ORAFL mechanism, the verification results of the global labeling method are more significant than those of the local labeling method.

[0105] In another exemplary embodiment of the present application, the training method of the local model includes steps S210 to S220, wherein:

[0106] Step S210, sending a candidate tag set to all associated target clients; the candidate tag set is used to enable each target client to globally tag local data, and enable each target client to generate a training data set based on the globally labeled data and local data, and enable each target client to train the stored model based on the training data set to obtain a trained sub-model; wherein the candidate tag set includes different special tags and each target client selects a different special tag;

[0107] Step S220, obtaining the trained sub-models of each target client, and aggregating the trained sub-models to obtain a local model.

[0108] Understandable, such as Figure 7 As shown in the figure, in the VeriMU mechanism, the training process of the local model is divided into three stages: data processing stage, training stage and data forgetting stage.

[0109] The first stage is the data processing stage. The server receives multiple model submission requests from various clients. The format of the i-th model submission request is R i =(D i , S i ). Among them, D i is the local model provided by the i-th client, S i are the potential usage permissions of each local model, for example: (1) S i =T This request indicates that the local model involved can be used permanently, without the potential need for data forgetting.

[0110] (2)S i =FThis request indicates that the local model involved may need to forget data in the future, so the client data sending the request needs to be specially processed to facilitate the subsequent data forgetting and verification process.

[0111] When the server receives a request with authority F, it sends the set of candidate tags to the client to be forgotten. The client to be forgotten selects a special tag from the set and generates data containing the special tag. Specifically, first, the client to be forgotten selects a certain proportion of data from the local data set, and combines it with the special tag without changing the original data label to generate a training data set.

[0112] It should be noted that the client to be forgotten records the locally stored client to be forgotten, but at the same time ensures that these special data will not be leaked. In addition, different clients that need to forget data should select different tags. Therefore, when the client to be forgotten selects a tag r from the tag set to be selected, the server should update the tag set to be selected, that is, D R →D R \r.

[0113] The second stage is the model training stage. Different clients train local models based on local data and upload the trained models to the server. After the server receives the trained local models submitted by all clients, it aggregates the trained models into a global model and then sends it to the client again. Taking SISA as an example, in the model training stage, the client's local data can be divided into different data blocks, and then different sub-models are trained based on different data blocks. Finally, these sub-models are aggregated to obtain the final global model.

[0114] When the model training is completed, the server will send the final global model to each client. During the operation of the model, there may be a client request to forget the data. Therefore, the server will continuously receive requests in the following format, where the request includes the following situations:

[0115] (1)Si =T, indicating that the local model permissions of the client that sent the request will be adjusted from temporary to permanent. At this time, the client provides a new model permission adjustment request to the server, indicating that the local client corresponding to it will not make data forgetting requests in the future.

[0116] (2)S i =U, indicating that the local model of the client sending the request is subjected to a data forgetting operation. Different unlearning algorithms are used to forget the local model of the client sending the request, and verification is performed after the data forgetting is completed.

[0117] (3)S i =D, indicating that the local model of the client that sent the request will exit the subsequent training, but no additional cancellation of learning is required. If the subsequent model still needs to be trained, this local model will no longer be used for iterative training, and no additional processing is required for the current model.

[0118] The third stage: data forgetting stage. When the server receives the forgetting request, it first uses the relevant algorithm to complete the data forgetting, and then sends the model after the data forgetting to the client again. In this stage, in addition to implementing the data forgetting request, data forgetting verification is also required, that is, the server needs to prove to the forgetting client that the client's forgetting request has been completed.

[0119] It should be noted that, through the iterative cycle of the above-mentioned data processing stage, training stage and data forgetting stage, the local models of all clients are updated.

[0120] In another exemplary embodiment of the present application, in order to facilitate subsequent updating of local models by each client, the embodiment of the present application also includes: sending a global model to all associated clients so that each client updates the local model to the global model.

[0121] It should be noted that the server sends the newly generated global model to each client, and each client replaces the stored local model with the global model to update the local model of each client.

[0122] Based on the same inventive concept, the embodiment of the present application also provides a data forgetfulness verification device for implementing the data forgetfulness verification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data forgetfulness verification device embodiments provided below can refer to the limitations of the data forgetfulness verification method above, and will not be repeated here.

[0123] In an exemplary embodiment, Figure 8A data forgetting verification device is provided as shown, and the data forgetting verification device 800 includes: a request acquisition module 810, a response generation module 820 and a sending verification module 830, wherein:

[0124] The request acquisition module 810 is used to acquire a forget request sent by a to-be-forgotten client, where the forget request includes a local model stored by the to-be-forgotten client and forget content requested by the to-be-forgotten client;

[0125] The response generation module 820 is used to respond to the forget request sent by the client to be forgotten, set the permission of the local model to be forgotten, and clear the forgotten content in the local model to generate a global model;

[0126] The sending verification module 830 is used to send the global model to the client to be forgotten, and verify the forgetting result of the global model to obtain a verification result.

[0127] Among them, implementing this implementation method can respond to the data forgetting request sent by the client to be forgotten, clear the data to be forgotten and generate a global model, which not only achieves the purpose of completely forgetting the data of the withdrawn person, but also can effectively eliminate the influence of the withdrawn person on the local model; by sending the global model to the client to be forgotten, the forgetting result of the global model is obtained; the forgetting result of the global model can be used to verify the completion of data forgetting, which has an efficient and intuitive effect.

[0128] As an optional implementation, the response generation module 820 is also used to set the permissions of the local model to forgotten, and send a candidate tag set to the client to be forgotten; the candidate tag set is used to enable the client to be forgotten to globally tag the data corresponding to the forgotten content in the local data, and generate a labeled data set; and enable the client to be forgotten to train the global model based on the labeled data set to obtain a sub-global model; obtain the sub-global model, and aggregate the sub-global model and the local model based on a preset algorithm to generate a global model.

[0129] As an optional implementation, the sending verification module 830 is also used to send a candidate mark set to the client to be forgotten, so that the client to be forgotten generates a test data set; obtains the pre-forgetting prediction result obtained by the client to be forgotten based on the test data set and the local model, and the post-forgetting prediction result obtained based on the test data set and the global model; obtains a global prediction accuracy value based on the pre-forgetting prediction result and the post-forgetting prediction result; verifies the forgetting degree of the global model based on the global prediction accuracy value to obtain a forgetting result.

[0130] As an optional implementation, the sending verification module 830 is also used to predict the locally labeled test samples based on the global model to obtain a local prediction accuracy value; compare the local prediction accuracy value with the global prediction accuracy value to obtain a prediction accuracy difference.

[0131] As an optional implementation, the above-mentioned local model is a trained model, and the data forgetting verification device 800 is also used to send a candidate tag set to all associated target clients; the candidate tag set is used to enable each target client to globally tag the local data, and enable each target client to generate a training data set based on the globally labeled data and the local data, and enable each target client to train the stored model based on the training data set to obtain a trained sub-model; wherein the candidate tag set includes different special tags and the special tags selected by each target client are different; the trained sub-models of each target client are obtained, and each trained sub-model is aggregated to obtain a local model.

[0132] As an optional implementation, the data forgetting verification device 800 is also used to send the global model to all associated clients, so that each client updates the local model to the global model.

[0133] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data forgetting verification data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data forgetting verification method is implemented.

[0134] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0135] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0136] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0137] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0138] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0139] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0140] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0141] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0142] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A data forgetting verification method, characterized in that: The data forgetting verification method comprises: Obtaining a forget request sent by a to-be-forgotten client, wherein the forget request includes a local model stored by the to-be-forgotten client and forget content requested by the to-be-forgotten client; In response to the forget request sent by the to-be-forgotten client, the permission of the local model is set to be forgotten, and the forgotten content in the local model is cleared to generate a global model; The global model is sent to the client to be forgotten, and the forgetting result of the global model is verified to obtain a verification result.

2. The data forgetting verification method according to claim 1, characterized in that: The step of setting the permission of the local model to forgotten, clearing the forgotten content in the local model, and generating a global model includes: The permission of the local model is set to be forgotten, and a candidate tag set is sent to the to-be-forgotten client; the candidate tag set is used to enable the to-be-forgotten client to globally tag the data corresponding to the forgotten content in the local data to generate a tag data set; and the to-be-forgotten client trains the global model based on the tag data set to obtain a sub-global model; The sub-global model is obtained, and the sub-global model and the local model are aggregated based on a preset algorithm to generate the global model.

3. The data forgetting verification method according to claim 2, characterized in that: The verifying the forgetting result of the global model to obtain a verification result includes: Sending the to-be-forgotten tag set to the to-be-forgotten client, so that the to-be-forgotten client generates a test data set; Obtaining a pre-forgetting prediction result obtained by the to-be-forgotten client based on the test data set and the local model, and a post-forgetting prediction result obtained based on the test data set and the global model; Based on the pre-forgetting prediction result and the post-forgetting prediction result, a global prediction accuracy value is obtained; The forgetting degree of the global model is verified based on the global prediction accuracy value to obtain a forgetting result.

4. The data forgetting verification method according to claim 2, characterized in that: The verifying the forgetting result of the global model to obtain the verification result further comprises: Predicting the locally labeled test samples based on the global model to obtain a local prediction accuracy value; The local prediction accuracy value is compared with the global prediction accuracy value to obtain a prediction accuracy difference.

5. The data forgetting verification method according to claim 1, characterized in that: The local model is a trained model, and the training method of the local model includes: The tag set to be selected is sent to all associated target clients; the tag set to be selected is used to enable each target client to globally tag local data, and to enable each target client to generate a training data set based on the globally labeled data and local data, and to enable each target client to train the stored model based on the training data set to obtain a trained sub-model; wherein the tag set to be selected includes different special tags and the special tags selected by each target client are different; The trained sub-models of each of the target clients are obtained, and each of the trained sub-models is aggregated to obtain the local model.

6. The data forgetting verification method according to claim 1, characterized in that: The method comprises: The global model is sent to all associated clients, so that each of the clients updates the local model to the global model.

7. A data forgetting verification device, characterized in that: The data forgetting verification device comprises: A request acquisition module, used to acquire a forget request sent by a to-be-forgotten client, wherein the forget request includes a local model stored by the to-be-forgotten client and forget content requested by the to-be-forgotten client; A response generation module, used to respond to the forget request sent by the to-be-forgotten client, set the permission of the local model to be forgotten, and clear the forgotten content in the local model to generate a global model; The sending verification module is used to send the global model to the client to be forgotten, and verify the forgetting result of the global model to obtain a verification result.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the data forgetting verification method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the data forgetting verification method described in any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data forgetting verification method described in any one of claims 1 to 6 are implemented.

Images