Privacy-protecting machine learning model training method and device
By transforming the intermediate features on the client and restoring the reverse model, combined with the update of sample loss, the privacy leakage problem caused by data reconstruction in split learning is solved, and effective protection of data privacy and efficient model training are achieved.
Patent Information
- Application Number
- CN202411547313.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-03-04
AI Technical Summary
In split learning, participants reversely reconstruct the calculation results through data reconstruction technology, resulting in data privacy leakage.
On the client, the transformed features are generated by inputting the original sample into the bottom model and transforming the input feature protection network. Then, the transformed features are sent to the server for model update, and the transformed features are input into the reverse model for restoration, and the sample loss is calculated to update the feature protection network.
Effectively protect the privacy of client data, reduce the probability of reconstructing original samples on the server side, and maintain the efficiency of model training.
Smart Images
Figure CN119558425A_ABST
Abstract
Description
Technical Field
[0001] One or more embodiments of the present specification relate to the field of machine learning technology, and in particular, to a privacy-preserving machine learning model training method and apparatus. Background Art
[0002] Split Learning is a distributed machine learning method that splits the structure of a machine learning model so that different participants (such as different devices or institutions) each own a part of the model. During the training process, each participant only performs forward or backward propagation calculations on the local part of the model and passes the calculation results to the next participant. In this way, multiple participants can jointly train a model without the need to centralize data such as samples to a central location, thereby protecting the privacy of the data to a certain extent.
[0003] However, in split learning, some participants will use data reconstruction technology to reversely reconstruct the calculation results sent by other participants to restore the original data, which will still lead to data privacy leakage. Summary of the invention
[0004] In view of this, one or more embodiments of this specification provide the following technical solutions:
[0005] According to a first aspect of one or more embodiments of this specification, a privacy-preserving machine learning model training method is proposed, wherein the machine learning model includes a bottom model deployed on a client and a top model deployed on a server. The method is applied to the client, and when each round of iterative training of the machine learning model is performed, the method includes:
[0006] Inputting the original sample into the bottom model to obtain the first type of intermediate features output by the bottom model;
[0007] Inputting the first type of intermediate features into a feature protection network to transform the first type of intermediate features to obtain transformed features output by the feature protection network;
[0008] Inputting the transformed features into a trained inverse model to restore the transformed features through the inverse model to obtain an inverse sample output by the inverse model;
[0009] Calculating the sample loss caused by the intermediate feature transformation based on the reverse sample and the original sample, and updating the feature protection network with the goal of increasing the sample loss;
[0010] Sending the transformed features to a server side, so that the server side inputs the transformed features into the top model to obtain a predicted label of the original sample;
[0011] A bottom gradient sent by a server is received, and the bottom model is updated based on the bottom gradient, where the bottom gradient is calculated by the server based on the predicted label and the sample label of the original sample.
[0012] Optionally, when performing each round of iterative training on the machine learning model, the following steps are further included:
[0013] Calculating feature loss caused by intermediate feature transformation based on the transformed features and the first type of intermediate features;
[0014] The process of updating the feature protection network with the goal of increasing the sample loss includes:
[0015] The feature protection network is updated with the goal of increasing the sample loss while reducing the feature loss.
[0016] Optionally, the training process of the inverse model includes:
[0017] Before iteratively training the machine learning model, inputting the original sample into a bottom model that has not yet started training, to obtain a second type of intermediate features output by the bottom model for training the inverse model;
[0018] The second type of intermediate features is used as input of the inverse model, and the original samples are used as labels to train the inverse model.
[0019] Optionally, when performing each round of iterative training on the machine learning model, the following steps are further included:
[0020] Determine whether the number of rounds of this iterative training meets the inverse model update conditions;
[0021] When the number of rounds meets the inverse model update condition, the original sample is input into the bottom model in the current client to obtain the third type of intermediate features for updating the inverse model, and the inverse model is updated based on the third type of intermediate features for updating the inverse model.
[0022] Optionally, after the feature protection network completes this round of update, the method further includes:
[0023] Testing the characteristic protection network using preset restrictions;
[0024] When the feature protection network fails the test, the feature protection network is updated again after the gradient used in the current round of updating of the feature protection network is trimmed.
[0025] Optionally, the process of testing the feature protection network using preset restriction items includes:
[0026] Inputting a test sample used to test the feature protection network into the feature protection network that has completed this round of update, and obtaining a test result corresponding to the test sample;
[0027] Calculating the difference between the test sample and the corresponding test result, and calculating the difference variance and the difference mean;
[0028] Determine whether the variance of the difference is less than the variance limit, and determine whether the mean of the difference is less than the mean limit;
[0029] When the difference variance is not less than the variance limit, or the difference mean is not less than the mean limit, it is determined that the feature protection network fails the test.
[0030] According to a second aspect of one or more embodiments of this specification, a privacy-protecting machine learning model training device is provided, wherein the machine learning model includes a bottom model deployed on a client and a top model deployed on a server. The device is applied to the client, and when each round of iterative training of the machine learning model is performed, the device includes:
[0031] An intermediate feature prediction module, inputting the original sample into the bottom model to obtain the first type of intermediate features output by the bottom model;
[0032] an intermediate feature transformation module, inputting the first type of intermediate features into a feature protection network to transform the first type of intermediate features to obtain transformed features output by the feature protection network;
[0033] A reverse sample restoration module, inputting the transformed features into a trained reverse model to restore the transformed features through the reverse model to obtain reverse samples output by the reverse model;
[0034] A protection network updating module calculates the sample loss caused by the intermediate feature transformation based on the reverse sample and the original sample, and updates the feature protection network with the goal of increasing the sample loss;
[0035] The bottom model update module sends the transformed features to the server side so that the server side inputs the transformed features into the top model to obtain the predicted label of the original sample, and receives the bottom gradient sent by the server side, and updates the bottom model based on the bottom gradient, wherein the bottom gradient is calculated by the server side based on the predicted label and the sample label of the original sample.
[0036] According to a third aspect of one or more embodiments of this specification, an electronic device is proposed, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor implements the steps of the aforementioned method by running the executable instructions.
[0037] According to a fourth aspect of one or more embodiments of the present specification, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the aforementioned method are implemented.
[0038] According to a fifth aspect of one or more embodiments of the present specification, a computer program product is proposed, comprising a computer program / instruction, which implements the steps of the aforementioned method when executed by a processor.
[0039] It can be seen from the above embodiments that, in this specification, when performing each round of iterative training on the machine learning model, the client can input the original sample into the locally deployed bottom model to obtain the first type of intermediate features, and then the first type of intermediate features can be input into the feature protection network to transform the intermediate features to obtain the transformed features. Then, on the one hand, the transformed features are sent to the server to perform the current round of iterative updates of the machine learning model, and on the other hand, the transformed features are input into the trained inverse model to obtain the inverse samples through feature restoration, and the feature protection network is updated by increasing the sample loss between the inverse samples and the original samples.
[0040] By adopting the above implementation method, the feature protection network is updated by increasing the sample loss between the reverse sample and the original sample, so that the difference between the reverse sample obtained after the transformation feature is reconstructed and restored and the original sample is greater. After the server receives the transformed feature transformed by the feature protection network, the probability of restoring the original sample is greatly reduced, thereby effectively protecting the data privacy in the client. At the same time, the privacy protection method of using the feature protection network to transform the first type of intermediate features has a low computational overhead, which can ensure the training efficiency of the machine learning model. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 It is a schematic diagram of the architecture of a privacy-preserving machine learning model training system provided by an exemplary embodiment.
[0042] Figure 2 It is a flowchart of a privacy-preserving machine learning model training method provided by an exemplary embodiment.
[0043] Figure 3 It is a flowchart of a method for training an inverse model provided by an exemplary embodiment.
[0044] Figure 4 It is a flowchart of a method for testing a feature protection network using preset restriction items provided by an exemplary embodiment.
[0045] Figure 5It is a flowchart of another privacy-preserving machine learning model training method provided by an exemplary embodiment.
[0046] Figure 6 It is a block diagram of a privacy-preserving machine learning model training method provided by an exemplary embodiment.
[0047] Figure 7 It is a structural schematic diagram of a device provided by an exemplary embodiment.
[0048] Figure 8 It is a block diagram of a privacy-preserving machine learning model training device provided by an exemplary embodiment. DETAILED DESCRIPTION
[0049] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.
[0050] Split Learning is a distributed machine learning method that splits the structure of a machine learning model so that different participants (such as different devices or institutions) each own a part of the model. During the training process, each participant only performs forward or backward propagation calculations on the local part of the model and passes the calculation results to the next participant. In this way, multiple participants can jointly train a model without the need to centralize data such as samples to a central location, thereby protecting the privacy of the data to a certain extent.
[0051] However, in split learning, some participants will use data reconstruction technology to reversely reconstruct the calculation results sent by other participants to restore the original data, which will still lead to data privacy leakage.
[0052] Taking the case where the participants of split learning are the client and the server, the part of the machine learning model deployed in the client can be called the bottom model, and the other part of the machine learning model deployed on the server can be called the top model. The client can input sample data into the bottom model, and then pass the intermediate features output by the bottom model to the server, which inputs the intermediate features into the top model to obtain the prediction result of the sample data output by the top model, and performs back propagation based on the difference between the prediction result and the sample label to update the model.
[0053] During this process, the server can reconstruct the client's sample data based on the intermediate features. For example, the server can train an inverse model that is opposite to the bottom model, and then input the intermediate features into the inverse model to restore the sample data in the client, which may lead to data privacy leakage.
[0054] In related technologies, in order to address the privacy leakage risks brought about by such data reconstruction, the client can add differential privacy noise to the intermediate features, or use cryptographic technology to encrypt the intermediate features to prevent data reconstruction on the server side.
[0055] However, for the method of adding differential privacy noise, the privacy budget may have multiple possibilities as the data distribution and model architecture change. At the same time, the privacy budget may also change over time, making it difficult to determine the privacy budget.
[0056] For the method of encrypting intermediate features, the operation time of cryptographic technology is too long, which will lead to low model training efficiency.
[0057] This specification provides a privacy-preserving machine learning model training solution that can effectively protect the data privacy of the participants in split learning. At the same time, the computational overhead is small and will not affect the efficiency of model training.
[0058] Figure 1 FIG. 1 is a schematic diagram of an architecture of a privacy-preserving machine learning model training system provided by an exemplary embodiment, and the system may include a server-side device and a client-side device. Figure 1 As shown, the system specifically includes a server 11, a network 12, and several electronic devices, such as a PC (Personal Computer) 13, a mobile phone 14, and the like.
[0059] The server 11 is a server-side device, which may be a physical server including an independent host, or the server 11 may be a virtual server carried by a host cluster. During the model training process, the top model in the machine learning model to be trained may be deployed in the server 11.
[0060] PC 13 and mobile phone 14 are only some types of devices that can be used on the client side. In fact, the client side device can also be an IoT device, a specific computing node, etc., and its physical carrier may also be a physical server. This specification does not impose any special restrictions on this. The client side can deploy the bottom model in the machine learning model to be trained.
[0061] As for the network 12 for interaction between electronic devices such as PC 13 and mobile phone 14 and server 11, it is possible to select a wired or wireless network to achieve communication based on the communication mode supported by the corresponding electronic device, and this specification does not limit this. For example, PC 13 can support both wired and wireless communication, so it can use a wired or wireless network to achieve communication as needed, while mobile phone 14 usually only supports wireless communication, so it can use a wireless network to achieve communication.
[0062] In this specification, the machine learning model to be trained can be a neural network model. Taking the example of dividing the machine learning model to be trained into two parts, the two parts can be respectively referred to as the bottom model and the top model. Among them, the bottom model is the lightweight model of the two and can be deployed in the client. The top model is the more complex model of the two and can be deployed in the server.
[0063] In this specification, the segmentation method of the machine learning model can be determined based on the architecture and hierarchy of the model. The processing and implementation of this part can refer to the relevant technology.
[0064] In this specification, the client holds the original samples and corresponding labels used to train the machine learning model. The original samples are usually the user's private data and need to be protected.
[0065] For example, the machine learning model to be trained may be an image classification model, which can be applied in the medical field, and specifically can be used to predict diseases based on images such as chest X-rays and fundus photographs. The original samples held by the client may be images such as chest X-rays and fundus photographs of patients.
[0066] For another example, the machine learning model to be trained may also be a natural language processing model, which can be applied in the field of government affairs, and specifically can be used to develop an intelligent question-answering system, etc. The original sample held by the client may be the user's historical consultation data.
[0067] For another example, the machine learning model to be trained may also be a risk assessment model, which can be applied in the financial field, specifically, can be used to identify potential risks based on historical transaction data, etc. The original sample held by the client may be the user's historical transaction data.
[0068] The following embodiments of this specification are explained by dividing the machine learning model to be trained into two parts, the bottom model and the top model. It should be noted that the model training method provided in this specification does not limit the number of parts of the machine learning model. In other examples, the number of bottom models can be multiple, that is, multiple clients and one server jointly train the machine learning model; or, the number of top models can also be multiple, that is, one client and multiple servers jointly train the machine learning model; or, there can be multiple bottom models and multiple top models at the same time, that is, multiple clients and multiple servers jointly train the machine learning model.
[0069] Figure 2 It is a flowchart of a privacy-preserving machine learning model training method provided by an exemplary embodiment.
[0070] Figure 2 The privacy-preserving machine learning model training method shown can be applied in a client, and when each round of iterative training of the machine learning model is performed, the following steps are included:
[0071] Step 202: input the original sample into the bottom model to obtain the first type of intermediate features output by the bottom model.
[0072] In this specification, when training a machine learning model, the client may first obtain the original samples and sample labels used to train the machine learning model. When each round of iterative training of the machine learning model is performed, the obtained original samples may be input into the bottom model to obtain the intermediate features output by the bottom model. In this example, the intermediate features output by the bottom model in this step for training the machine learning model may be referred to as first-class intermediate features.
[0073] Step 204: input the first type of intermediate features into a feature protection network to transform the first type of intermediate features to obtain transformed features output by the feature protection network.
[0074] In this specification, a feature protection network can be deployed in the client, and the feature protection network can perform feature transformation on the first type of intermediate features to hinder data reconstruction on the server. Specifically, the first type of intermediate features output by the bottom model can be input into the feature protection network to obtain the output of the feature protection network, which is called the transformed feature.
[0075] In this specification, the feature protection network may adopt a convolutional neural network (CNN), which can ensure that the shapes of its input data and output data are consistent. Of course, the feature protection network may also adopt a fully connected network or other network structure, and this specification does not impose any special restrictions on this.
[0076] Step 206: input the transformed features into the trained inverse model to restore the transformed features through the inverse model to obtain inverse samples output by the inverse model.
[0077] In this specification, the inverse model can be pre-trained in the client, and the inverse model can be understood as the reverse model of the bottom model, which is used for data reconstruction and can restore features to samples. The inverse model can be trained based on the original samples and the intermediate features output by the bottom model, and the specific training process will be described in detail in subsequent embodiments.
[0078] Based on the aforementioned step 204, after the transformed features are obtained through the feature protection network, the transformed features can be input into the trained inverse model to restore the transformed features through the inverse model, and the restored samples output by the inverse model can be called inverse samples.
[0079] Step 208: Calculate the sample loss caused by the intermediate feature transformation based on the reverse sample and the original sample, and update the feature protection network with the goal of increasing the sample loss.
[0080] In this specification, the feature protection network may be iteratively trained during the iterative training of the machine learning model.
[0081] In this example, the sample loss between the reverse sample and the original sample can be calculated, and the sample loss represents the degree of difference between the reverse sample obtained by reconstructing and restoring the first type of intermediate features after feature transformation and the original sample. The greater the sample loss, the greater the difference between the reverse sample and the original sample, the lower the probability of reconstructing and restoring the original sample on the server side, and the better the protection effect of the feature protection network. The smaller the sample loss, the smaller the difference between the reverse sample and the original sample, the higher the probability of reconstructing and restoring the original sample on the server side, and the worse the protection effect of the feature protection network.
[0082] In this example, the loss function may be constructed with the goal of increasing the sample loss, and the feature protection network may be reversely updated based on the constructed loss function. For example, the loss function may be constructed with the goal of maximizing the sample loss, so that the effect of the feature protection network is optimal.
[0083] Step 210, sending the transformed features to the server side, so that the server side inputs the transformed features into the top model to obtain the predicted label of the original sample; receiving the bottom gradient sent by the server side, and updating the bottom model based on the bottom gradient, wherein the bottom gradient is calculated by the server side based on the predicted label and the sample label of the original sample.
[0084] In this specification, based on the aforementioned step 204, after the transformation feature is obtained through the feature protection network, the transformation feature can be sent to the server side for iterative training of the top model. Specifically, after receiving the transformation feature, the server side inputs the transformation feature into the local top model to obtain the predicted label of the original sample output by the top model. Then, the loss function of the machine learning model can be determined based on the difference between the sample label corresponding to the original sample and the predicted label, the top model can be updated in reverse, and the bottom gradient that needs to be passed to the client can be obtained.
[0085] After receiving the bottom gradient, the client can reversely update the bottom model deployed thereon to complete this round of iterative training of the machine learning model.
[0086] It is worth noting that after obtaining the transformed features output by the feature protection network, this specification does not limit the execution order between the aforementioned steps 206 and 210. In other examples, step 210 may be executed first to send the transformed features to the server to perform this round of iterative updates of the machine learning model, and then steps 206-208 may be executed to perform this round of iterative updates of the feature protection network. Alternatively, steps 206 and 210 may be executed simultaneously to perform this round of iterative updates of the machine learning model and this round of iterative updates of the feature protection network in parallel.
[0087] It can be seen from the above description that in this specification, when each round of iterative training of the machine learning model is performed, the client can input the original sample into the locally deployed bottom model to obtain the first type of intermediate features, and then the first type of intermediate features can be input into the feature protection network to transform the intermediate features to obtain the transformed features. Then, on the one hand, the transformed features are sent to the server to perform the current round of iterative updates of the machine learning model, and on the other hand, the transformed features are input into the trained inverse model to obtain the inverse samples through feature restoration, and the feature protection network is updated by increasing the sample loss between the inverse samples and the original samples.
[0088] By adopting the above implementation method, the feature protection network is updated by increasing the sample loss between the reverse sample and the original sample, so that the difference between the reverse sample obtained after the transformation feature is reconstructed and restored and the original sample is greater. After the server receives the transformed feature transformed by the feature protection network, the probability of restoring the original sample is greatly reduced, thereby effectively protecting the data privacy in the client. At the same time, the privacy protection method of using the feature protection network to transform the first type of intermediate features has a low computational overhead, which can ensure the training efficiency of the machine learning model.
[0089] In another embodiment of the present specification, based on the use of a feature protection network to transform intermediate features to achieve data privacy protection, in order to ensure that the intermediate feature transformation does not damage the accuracy of the machine learning model training task, restrictions on feature loss can be added when updating the feature protection network.
[0090] Specifically, on the basis of calculating the sample loss, the feature loss caused by the intermediate feature transformation can be calculated based on the transformed features output by the feature protection network and the corresponding first-category intermediate features. The feature loss represents the degree of difference between the transformed features and the first-category intermediate features. The larger the feature loss, the larger the difference between the transformed features and the first-category intermediate features. The server-side use of the transformed features to iteratively train the machine learning model will lead to a decrease in the accuracy of the training task. The smaller the feature loss, the smaller the difference between the transformed features and the first-category intermediate features. The server-side use of the transformed features to iteratively train the machine learning model will be closer to the training effect of directly using the first-category intermediate features for iterative training, and will not significantly reduce the accuracy of the training task.
[0091] In this example, a loss function can be constructed with the goal of increasing the aforementioned sample loss while reducing the feature loss, and the feature protection network can be reversely updated based on the constructed loss function. For example, the loss function can be constructed with the goal of maximizing the sample loss while minimizing the feature loss, so that the effect of the feature protection network is optimized while ensuring the accuracy of the machine learning model training task.
[0092] In another embodiment of the present specification, the client may pre-train the inverse model before iterative training of the machine learning model to implement subsequent updates of the feature protection network. Figure 3 , the training method of the inverse model may include the following steps:
[0093] Step 302: input the original sample into the bottom model that has not yet started training, and obtain the second type of intermediate features output by the bottom model for training the inverse model.
[0094] In this specification, before performing iterative training of the machine learning model, the client may first train an inverse model based on the original samples.
[0095] Specifically, the client can input the original sample into the bottom model that has not yet started training to obtain the intermediate features output by the bottom model. The intermediate features are used to train the inverse model. For ease of distinction, the intermediate features output by the bottom model in this step are called second-category intermediate features.
[0096] Step 304: Use the second type of intermediate features as input of the inverse model, and use the original samples as labels to train the inverse model.
[0097] In this specification, the inverse model is the inverse model of the bottom model. When training the inverse model, the second-class intermediate features can be used as input to obtain the restoration result of the second-class intermediate features output by the inverse model. Then, the original sample can be used as a label, and a loss function can be constructed based on the difference between the restoration result and the original sample. The inverse model can be updated in reverse with the goal of minimizing the constructed loss function, so that the restoration result of the inverse model is closer to the original sample.
[0098] In this specification, the inverse model can be implemented using a reconstruction network of any structure, such as a deconvolution network.
[0099] In this specification, after the inverse model is trained, iterative training of the machine learning model can be started, for example, the aforementioned Figure 2 The method shown iteratively trains the machine learning model.
[0100] It is worth noting that as the machine learning model is iteratively trained, the parameters of the bottom model in the client will be updated with the iterative training, which will in turn affect the accuracy of the reverse model. To ensure the accuracy of the reverse model, the reverse model that has been trained can be updated.
[0101] In one example, the client can update the reverse model after each round of iterative update of the bottom model (also each round of iterative update of the machine learning model). That is, each time the bottom model is iteratively updated, the reverse model is also iteratively updated accordingly.
[0102] In another example, to ensure the training efficiency of the machine learning model, the inverse model update condition can also be set, and the inverse model is updated when the number of rounds of this iterative training meets the inverse model update condition. The number of iterations refers to the number of iterations of the machine learning model, which is also the number of iterations of the bottom model in the client.
[0103] The inverse model update condition may be every preset number of iterations. For example, the inverse model update condition may be every 20 rounds of iterative training, etc. For another example, the inverse model update condition may also be that the number of rounds of this iterative training is a multiple of 20, etc.
[0104] In this example, updating the inverse model after a certain number of iterative training rounds can achieve a balance between the accuracy of the inverse model and the training efficiency.
[0105] In this specification, when updating the inverse model, similar to the first training, the original sample can be input into the bottom model in the current client, and the bottom model has been updated during the iterative training process. Through the current bottom model, the intermediate features of its output can be obtained, and the intermediate features are used to update the previously trained inverse model. For the sake of distinction, the intermediate features used to update the inverse model are called third-class intermediate features. Then, the client can update the inverse model based on the third-class intermediate features. Specifically, the third-class intermediate features can be used as input to obtain the restored results of the third-class intermediate features output by the inverse model, and then the original sample can be used as a label, and a loss function can be constructed based on the difference between the restored result and the original sample, and the inverse model can be reversely updated with the goal of minimizing the constructed loss function.
[0106] In another embodiment of the present specification, in order to ensure that the feature transformation of the feature protection network interferes as little as possible with the accuracy of the machine learning model training task, the client may also test the feature protection network after completing the update.
[0107] Similar to the update of the reverse model, the client may test the feature protection network after each round of feature protection network update, or may test the feature protection network after a preset number of iterations. This specification does not impose any special restrictions on this.
[0108] In this example, the client can use preset restrictions to test the feature protection network. If the feature protection network passes the test, it can be said that the feature transformation of the feature protection network has little interference with the accuracy of the machine learning model training task, and the next round of iterative training can continue. If the feature protection network fails the test, it can be said that the feature transformation of the feature protection network has a certain interference with the accuracy of the machine learning model training task. In order to reduce the interference, the gradient clipping technology can be used to clip the gradient used in the current round of updating of the feature protection network and then update the feature protection network again, that is, continue to update the feature protection network based on the feature protection network that has been updated in this round.
[0109] Please refer to Figure 4 The process of the client testing the characteristic protection network using the preset restriction items may include the following steps:
[0110] Step 402: input the test sample used to test the feature protection network into the feature protection network that has completed this round of update, and obtain the test result corresponding to the test sample.
[0111] In this embodiment, the intermediate features can be used as test samples for testing the feature protection network. For example, the first type of intermediate features output by the customer base model can be used as test samples for testing the feature protection network. These test samples can then be input into the feature protection network that has been updated in this round to obtain the test results output by the feature protection network, which are the transformed features.
[0112] Step 404, calculating the difference between the test sample and the corresponding test result, and calculating the difference variance and the difference mean.
[0113] Based on the above step 402, after obtaining the test result output by the feature protection network, the difference between the test result and the test sample can be calculated, that is, the difference between the transformed feature and the intermediate feature can be calculated. Then, based on the difference, the difference mode and the difference mean are calculated. For example, the difference variance can be calculated using the Var function, and the difference mean can be calculated using the mean function.
[0114] Step 406, determining whether the difference variance is less than the variance limit, and determining whether the difference mean is less than the mean limit.
[0115] Based on the above step 404, after the difference variance and the difference mean are calculated, it can be determined whether the difference variance is less than the variance limit, and whether the difference mean is less than the mean limit. The variance limit and the mean limit can be preset by a technician, for example, the variance limit can be set to 1, the mean limit can be set to 0.5, etc.
[0116] Step 408: When the difference variance is not less than the variance limit, or the difference mean is not less than the mean limit, it is determined that the feature protection network fails the test.
[0117] In this embodiment, when the difference variance is not less than the variance limit, it means that the difference between the intermediate feature and the transformed feature is relatively dispersed and the uncertainty is large, and it can be determined that the feature protection network has not passed the test. When the difference mean is not less than the mean limit, it means that the difference between the intermediate feature and the transformed feature is generally large, and it can also be determined that the feature protection network has not passed the test. In other words, when any of the items is not satisfied, it can be determined that the feature protection network has not passed the test. Only when the difference variance is less than the variance limit and the difference mean is also less than the mean limit, can it be determined that the feature protection network has passed the test.
[0118] The following uses the process of iterative training of a machine learning model as an example to illustrate the privacy-preserving machine learning model training method provided in this specification.
[0119] Please refer to Figure 5 and Figure 6The privacy-preserving machine learning model training method can be applied to a client and includes the following steps:
[0120] Step 502: input the original sample into the bottom model to obtain the first type of intermediate features output by the bottom model.
[0121] Step 504: input the first type of intermediate features into a feature protection network to transform the first type of intermediate features to obtain transformed features output by the feature protection network.
[0122] In this embodiment, assuming that x is the original sample, f(·) is the bottom model, z is the first type of intermediate feature output after the original sample x is processed by the bottom model in step 502, m(·) represents the feature protection network, and z′ represents the transformed feature output after the feature protection network performs feature transformation on the first type of intermediate feature z. Then, step 502 and step 504 can be expressed as the following formula:
[0123] z=f(x),z′=m(z)
[0124] Step 506: input the transformed features into the trained inverse model to restore the transformed features through the inverse model to obtain inverse samples output by the inverse model.
[0125] In this embodiment, it is assumed that f -1 (·) is the trained inverse model, x′ represents the inverse sample output by the inverse model, that is, x′=f -1 (z′).
[0126] Step 508: Calculate the sample loss caused by the intermediate feature transformation based on the reverse sample and the original sample.
[0127] In this embodiment, the sample loss may be calculated using the following formula based on a mean square error algorithm:
[0128]
[0129] in, Represents the sample loss, n is the number of samples, and the argmax function is used to find the parameter value that maximizes the given function.
[0130] Step 510: Calculate feature loss caused by intermediate feature transformation based on the transformed features and the first type of intermediate features.
[0131] In this embodiment, the feature loss may be calculated using the following formula based on the cosine similarity algorithm:
[0132]
[0133] in, Represents the feature loss, and the argmin function is used to find the parameter value that minimizes the given function.
[0134] Step 512: Update the feature protection network with the goal of maximizing the sample loss while minimizing the feature loss.
[0135] In this embodiment, a total loss value of sample loss and feature loss may be calculated by weighted aggregation, and then the feature protection network may be reversely updated based on the total loss value.
[0136] The total loss value can be calculated using the following formula:
[0137]
[0138] in, Represents the total loss value, and α is an adjustable hyperparameter used to adjust the balance between privacy protection effect and model training accuracy. The larger α is, the greater the impact of sample loss on the feature protection network, and the better the privacy protection effect of the feature protection network. The smaller α is, the greater the impact of feature loss on the feature protection network, and the higher the accuracy of the machine learning model training task. In practical applications, the requirements for privacy protection and training accuracy can be dynamically set according to the scenarios in which the machine learning model is applied.
[0139] Step 514, sending the transformed features to the server side, so that the server side inputs the transformed features into the top model to obtain the predicted label of the original sample, and receives the bottom gradient sent by the server side, and updates the bottom model based on the bottom gradient, and the bottom gradient is calculated by the server side based on the predicted label and the sample label of the original sample.
[0140] At this point, a round of iterative training of the machine learning model can be completed. When the number of iterative training rounds reaches the preset iterative statement, or the machine learning model converges, it can be confirmed that the machine learning model training is completed.
[0141] From the above description, it can be seen that this specification updates the feature protection network by increasing the sample loss between the reverse sample and the original sample and reducing the feature loss between the transformed feature and the first category of intermediate features, which can make the difference between the reverse sample and the original sample obtained after reconstructing and restoring the transformed feature greater. After receiving the transformed feature transformed by the feature protection network, the probability of restoring the original sample on the server side is greatly reduced, thereby effectively protecting the data privacy in the client. At the same time, it can also make the difference between the transformed features sent to the server side and the first category of intermediate features smaller, which can effectively ensure the training effect of the machine learning model. In addition, the method of using the feature protection network to perform feature transformation on the first category of intermediate features, which takes into account both privacy protection and model training accuracy, has low computational overhead, which can ensure the training efficiency of the machine learning model.
[0142] Figure 7 is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 7 At the hardware level, the device includes a processor 702, an internal bus 704, a network interface 706, a memory 708, and a non-volatile memory 710, and may also include hardware required for other functions. One or more embodiments of this specification may be implemented based on software, such as the processor 702 reading the corresponding computer program from the non-volatile memory 710 into the memory 708 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.
[0143] Please refer to Figure 8 The privacy-preserving machine learning model training device 800 can be applied to Figure 7 In the device shown in the figure, the technical solution of this specification is implemented. The machine learning model includes a bottom model deployed on the client and a top model deployed on the server. When each round of iterative training of the machine learning model is performed, the privacy-protecting machine learning model training device may include:
[0144] The intermediate feature prediction module 801 inputs the original sample into the bottom model to obtain the first type of intermediate features output by the bottom model;
[0145] An intermediate feature transformation module 802, inputting the first type of intermediate features into a feature protection network to transform the first type of intermediate features to obtain transformed features output by the feature protection network;
[0146] The reverse sample restoration module 803 inputs the transformed features into the trained reverse model to restore the transformed features through the reverse model to obtain reverse samples output by the reverse model;
[0147] A protection network updating module 804 calculates the sample loss caused by the intermediate feature transformation based on the reverse sample and the original sample, and updates the feature protection network with the goal of increasing the sample loss;
[0148] The bottom model update module 805 sends the transformed features to the server side so that the server side inputs the transformed features into the top model to obtain the predicted label of the original sample, and receives the bottom gradient sent by the server side, and updates the bottom model based on the bottom gradient, and the bottom gradient is calculated by the server side based on the predicted label and the sample label of the original sample.
[0149] Optionally, when performing each round of iterative training on the machine learning model, the protection network update module 804 further includes:
[0150] Calculating feature loss caused by intermediate feature transformation based on the transformed features and the first type of intermediate features;
[0151] The feature protection network is updated with the goal of increasing the sample loss while reducing the feature loss.
[0152] Optionally, the training process of the inverse model includes:
[0153] Before iteratively training the machine learning model, inputting the original sample into a bottom model that has not yet started training, to obtain a second type of intermediate features output by the bottom model for training the inverse model;
[0154] The second type of intermediate features is used as input of the inverse model, and the original samples are used as labels to train the inverse model.
[0155] Optionally, the device also includes a reverse model update module 806. When performing each round of iterative training on the machine learning model, the reverse model update module 806 determines whether the number of rounds of this iterative training meets the reverse model update condition; when the number of rounds meets the reverse model update condition, the original sample is input into the bottom model in the current client to obtain the third type of intermediate features for updating the reverse model, and the reverse model is updated based on the third type of intermediate features for updating the reverse model.
[0156] Optionally, the device also includes a protection network testing module 807. After the feature protection network completes this round of update, the protection network testing module 807: uses preset restriction items to test the feature protection network; if the feature protection network fails the test, the gradient used in the current round of update of the feature protection network is trimmed and the feature protection network is updated again.
[0157] Optionally, the process of the protection network testing module 807 testing the characteristic protection network using preset restriction items includes:
[0158] Inputting a test sample used to test the feature protection network into the feature protection network that has completed this round of update, and obtaining a test result corresponding to the test sample;
[0159] Calculating the difference between the test sample and the corresponding test result, and calculating the difference variance and the difference mean;
[0160] Determine whether the variance of the difference is less than the variance limit, and determine whether the mean of the difference is less than the mean limit;
[0161] When the difference variance is not less than the variance limit, or the difference mean is not less than the mean limit, it is determined that the feature protection network fails the test.
[0162] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the method described in any of the above embodiments by running the executable instructions.
[0163] Based on the same concept as the above method, this specification also provides a computer-readable storage medium on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in any of the above embodiments are implemented.
[0164] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.
Claims
1. A privacy-preserving machine learning model training method, wherein the machine learning model comprises a bottom model deployed on a client and a top model deployed on a server. The method is applied to the client, and during each round of iterative training of the machine learning model, the method comprises: Inputting the original sample into the bottom model to obtain the first type of intermediate features output by the bottom model; Inputting the first type of intermediate features into a feature protection network to transform the first type of intermediate features to obtain transformed features output by the feature protection network; Inputting the transformed features into a trained inverse model to restore the transformed features through the inverse model to obtain an inverse sample output by the inverse model; Calculating the sample loss caused by the intermediate feature transformation based on the reverse sample and the original sample, and updating the feature protection network with the goal of increasing the sample loss; Sending the transformed features to a server side, so that the server side inputs the transformed features into the top model to obtain a predicted label of the original sample; A bottom gradient sent by a server is received, and the bottom model is updated based on the bottom gradient, where the bottom gradient is calculated by the server based on the predicted label and the sample label of the original sample.
2. The method according to claim 1, when performing each round of iterative training on the machine learning model, further comprising: Calculating feature loss caused by intermediate feature transformation based on the transformed features and the first type of intermediate features; The process of updating the feature protection network with the goal of increasing the sample loss includes: The feature protection network is updated with the goal of increasing the sample loss while reducing the feature loss.
3. According to the method of claim 1, the training process of the inverse model comprises: Before iteratively training the machine learning model, inputting the original sample into a bottom model that has not yet started training, to obtain a second type of intermediate features output by the bottom model for training the inverse model; The second type of intermediate features is used as input of the inverse model, and the original samples are used as labels to train the inverse model.
4. The method according to claim 3, when performing each round of iterative training on the machine learning model, further comprises: Determine whether the number of rounds of this iterative training meets the inverse model update conditions; When the number of rounds meets the inverse model update condition, the original sample is input into the bottom model in the current client to obtain the third type of intermediate features for updating the inverse model, and the inverse model is updated based on the third type of intermediate features for updating the inverse model.
5. The method according to any one of claims 1 to 4, further comprising: after the feature protection network completes this round of update: Testing the characteristic protection network using preset restrictions; When the feature protection network fails the test, the feature protection network is updated again after the gradient used in the current round of updating of the feature protection network is trimmed.
6. The method according to claim 5, wherein the process of testing the characteristic protection network using preset restriction items comprises: Inputting a test sample used to test the feature protection network into the feature protection network that has completed this round of update, and obtaining a test result corresponding to the test sample; Calculating the difference between the test sample and the corresponding test result, and calculating the difference variance and the difference mean; Determine whether the variance of the difference is less than the variance limit, and determine whether the mean of the difference is less than the mean limit; When the difference variance is not less than the variance limit, or the difference mean is not less than the mean limit, it is determined that the feature protection network fails the test.
7. A privacy-preserving machine learning model training device, the machine learning model comprising a bottom model deployed on a client and a top model deployed on a server, the device being applied to the client, and during each round of iterative training of the machine learning model, comprising: An intermediate feature prediction module, inputting the original sample into the bottom model to obtain the first type of intermediate features output by the bottom model; an intermediate feature transformation module, inputting the first type of intermediate features into a feature protection network to transform the first type of intermediate features to obtain transformed features output by the feature protection network; A reverse sample restoration module, inputting the transformed features into a trained reverse model to restore the transformed features through the reverse model to obtain reverse samples output by the reverse model; A protection network updating module calculates the sample loss caused by the intermediate feature transformation based on the reverse sample and the original sample, and updates the feature protection network with the goal of increasing the sample loss; The bottom model update module sends the transformed features to the server side so that the server side inputs the transformed features into the top model to obtain the predicted label of the original sample, and receives the bottom gradient sent by the server side, and updates the bottom model based on the bottom gradient, wherein the bottom gradient is calculated by the server side based on the predicted label and the sample label of the original sample.
8. An electronic device, comprising: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method according to any one of claims 1 to 6 by executing the executable instructions.
9. A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.