Model training method and device and terminal equipment
By determining the initial model, security threshold and activation function parameters in neural network model training, and processing input data to generate desensitized output data, the problem of low security of the target neural network is solved and effective protection of the privacy information of the input data is achieved.
Patent Information
- Application Number
- CN202311248206.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-09-25
- Publication Date
- 2025-03-25
AI Technical Summary
The target neural network trained in the prior art has low security and poses a risk of private information leakage.
The target model is obtained by determining the initial model, obtaining the input data, and determining the weight value based on the safety threshold of the neuron and the activation function parameters. The target model is used to process the input data, and the output data is the data after desensitizing the tag data, thereby protecting the privacy information in the input data.
On the basis of keeping the output data with label data characteristics, the information of the input data is protected to avoid private information leakage, and the security of model training is improved.
Smart Images
Figure CN119692410A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of artificial intelligence technology, and in particular to a model training method, apparatus, and terminal device. Background Art
[0002] The neural network model can be used to predict the data to be processed and obtain the prediction results. Before using the neural network model, the neural network model needs to be trained.
[0003] In the related art, model training can be performed in the following manner: obtaining a training data set, the training data set including multiple training data and data results corresponding to each training data. Determining an initial neural network model, and training the initial model using the training data set to obtain a target neural network model. In the above process, the prediction results output by the target neural network may include the user's private information, which may lead to the leakage of the user's private information.
[0004] From the above, it can be seen that the security of the target neural network trained by the above method is relatively low. Summary of the invention
[0005] The embodiments of the present application provide a model training method, apparatus and terminal device to solve the problem of low security of a target neural network obtained through training.
[0006] In a first aspect, an embodiment of the present application provides a model training method, comprising:
[0007] Determine an initial model, wherein the initial model includes a plurality of neurons, and the initial model is used to process input data to obtain label data;
[0008] Get multiple input data;
[0009] Determine the safety threshold and activation function parameters of each neuron;
[0010] According to the multiple input data, as well as the safety threshold and activation function parameters of each neuron, the weight value of each neuron is determined to obtain a target model; the target model is used to process the input data to obtain output data, and the output data is the data after the label data is desensitized.
[0011] In a possible implementation manner, the mutual information between the label data and the input data is greater than or equal to a first threshold;
[0012] The mutual information between the output data and the input data is less than the first threshold;
[0013] The mutual information between the first output data and the second output data is greater than or equal to a second threshold.
[0014] In a possible implementation, the initial model includes multiple network layers, each network layer includes d neurons, and d is a positive integer;
[0015] Determining a weight value of each neuron according to the plurality of input data, and a safety threshold and an activation function parameter of each neuron, including:
[0016] Determine an input feature vector of each input data to obtain multiple input feature vectors, where the dimension of the input feature vector is d;
[0017] Determining a plurality of input feature values of each neuron according to the plurality of input feature vectors;
[0018] For any neuron, the weight value of the neuron is determined according to the safety threshold of the neuron, the activation function parameter and the corresponding multiple input feature values.
[0019] In a possible implementation, determining a plurality of input feature values of each neuron according to the plurality of input feature vectors includes:
[0020] For the i-th neuron of the first layer, determining the i-th eigenvalue in the multiple input eigenvectors as the multiple input eigenvalues of the i-th neuron, where i is an integer between 1 and d;
[0021] For the j-th neuron in the K-th layer, multiple output feature values of the j-th neuron in the K-1-th layer are determined as multiple input feature values of the j-th neuron, where K is an integer greater than 1, and j is an integer between 1 and d.
[0022] In a possible implementation manner, the mutual information between the label data and the input data is determined in the following manner:
[0023] Determining a joint distribution and a marginal distribution of the label data and the input data;
[0024] The relative entropy of the joint distribution and the marginal distribution is determined as the mutual information between the label data and the input data.
[0025] In a possible implementation, the method further includes:
[0026] Determine a first entropy function corresponding to the label data, and determine a second entropy function of the label data under the output characteristic value of each i-th neuron;
[0027] Determine the difference between the first entropy function and the second entropy function as the second mutual information of the i-th neuron;
[0028] According to the second mutual information of the i-th neuron, the correlation between the output feature value of the i-th neuron and the label data is determined.
[0029] In a possible implementation, for any neuron in the target model;
[0030] Under the premise that the mutual information between the input information and the output information of the neuron is less than or equal to the safety threshold corresponding to the neuron, the mutual information between the output information and the label data reaches the maximum.
[0031] In a possible implementation manner, the input data is multimedia data.
[0032] In a second aspect, an embodiment of the present application provides a model training device, the device comprising:
[0033] A first determination module is used to determine an initial model, wherein the initial model includes a plurality of neurons, and the initial model is used to process input data to obtain label data;
[0034] An acquisition module, used for acquiring multiple input data;
[0035] The second determination module is used to determine the safety threshold and activation function parameters of each neuron;
[0036] The third determination module is used to determine the weight value of each neuron according to the multiple input data, the safety threshold and activation function parameters of each neuron to obtain a target model; the target model is used to process the input data to obtain output data, and the output data is the data after the label data is desensitized.
[0037] In a possible implementation manner, the mutual information between the label data and the input data is greater than or equal to a first threshold;
[0038] The mutual information between the output data and the input data is less than the first threshold;
[0039] The mutual information between the first output data and the second output data is greater than or equal to a second threshold.
[0040] In a possible implementation manner, the third determining module is specifically configured to:
[0041] Determine an input feature vector of each input data to obtain multiple input feature vectors, where the dimension of the input feature vector is d;
[0042] Determining a plurality of input feature values of each neuron according to the plurality of input feature vectors;
[0043] For any neuron, the weight value of the neuron is determined according to the safety threshold of the neuron, the activation function parameter and the corresponding multiple input feature values.
[0044] In a possible implementation manner, the third determining module is specifically configured to:
[0045] For the i-th neuron of the first layer, determining the i-th eigenvalue in the multiple input eigenvectors as the multiple input eigenvalues of the i-th neuron, where i is an integer between 1 and d;
[0046] For the j-th neuron in the K-th layer, multiple output feature values of the j-th neuron in the K-1-th layer are determined as multiple input feature values of the j-th neuron, where K is an integer greater than 1, and j is an integer between 1 and d.
[0047] In a possible implementation manner, the third determining module is specifically configured to:
[0048] Determining a joint distribution and a marginal distribution of the label data and the input data;
[0049] The relative entropy of the joint distribution and the marginal distribution is determined as the mutual information between the label data and the input data.
[0050] In a possible implementation, for any neuron in the target model;
[0051] Under the premise that the mutual information between the input information and the output information of the neuron is less than or equal to the safety threshold corresponding to the neuron, the mutual information between the output information and the label data reaches the maximum.
[0052] In a possible implementation manner, the device further includes a fourth determining module.
[0053] Wherein, the fourth determination module is used for:
[0054] Determine a first entropy function corresponding to the label data, and determine a second entropy function of the label data under the output characteristic value of each i-th neuron;
[0055] Determine the difference between the first entropy function and the second entropy function as the second mutual information of the i-th neuron;
[0056] According to the second mutual information of the i-th neuron, the correlation between the output feature value of the i-th neuron and the label data is determined.
[0057] In a possible implementation manner, the input data is multimedia data.
[0058] In a third aspect, an embodiment of the present application provides a terminal device, including:
[0059] at least one processor; and
[0060] a memory communicatively connected to the at least one processor; wherein,
[0061] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform any method described in the first aspect.
[0062] In a fourth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute any one of the methods described in the first aspect.
[0063] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements any method in the first aspect when executed by a processor.
[0064] The model training method, device and terminal device provided in the embodiments of the present application determine an initial model, and the initial model is used to process the input data to obtain label data. Obtain multiple input data. Determine the safety threshold and activation function parameters of each neuron. According to multiple input data, as well as the safety threshold and activation function parameters of each neuron, determine the weight value of each neuron to obtain a target model. The target model is used to process the input data to obtain output data, and the output data is the data after the label data is desensitized. In the above process, since the input data may include the user's privacy information, the target model is used to desensitize the label data, and the output data after desensitization is correlated with the label data. On the basis of maintaining the output data with the data characteristics on the label, the information of the input data is protected. Avoid the leakage of privacy information and improve the security of model training. BRIEF DESCRIPTION OF THE DRAWINGS
[0065] Figure 1 A schematic diagram of an application scenario provided by an embodiment of the present application;
[0066] Figure 2 A flowchart of a model training method provided in an embodiment of the present application;
[0067] Figure 3 A schematic diagram of the structure of the initial model provided in the embodiment of the present application;
[0068] Figure 4 A flowchart of another model training method provided in an embodiment of the present application;
[0069] Figure 5 A schematic diagram of a process for determining input characteristic values and output characteristic values of a neuron provided in an embodiment of the present application;
[0070] Figure 6 A schematic diagram of the model training process provided in the embodiment of the present application;
[0071] Figure 7 A schematic diagram of the structure of a model training device provided in an embodiment of the present application;
[0072] Figure 8 A schematic diagram of the structure of another model training device provided in an embodiment of the present application;
[0073] Fig. 9 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0074] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0075] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.
[0076] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.
[0077] For ease of understanding, below, combined Figure 1 , the application scenarios to which the embodiments of the present application are applicable are described.
[0078] Figure 1This is a schematic diagram of an application scenario provided by an embodiment of the present application. Figure 1 , including a terminal device 101, which can be a computer. The terminal device obtains multiple training data (data 1, data 2, ..., data N), and trains the neural network model through the multiple training data to obtain the prediction results (prediction result 1, prediction result 2, ..., prediction result N) corresponding to each training data. According to the prediction results and the actual results, the target model parameters of the neural network model are determined. According to the target model parameters, the trained target neural network model is determined.
[0079] In the above process, the prediction results output by the target neural network are highly correlated with the input data, and the input data contains privacy information, which may lead to the leakage of user privacy information during the training process, making the model training less secure.
[0080] In an embodiment of the present application, an initial model is determined, and the initial model is used to process the input data to obtain label data. A plurality of input data are obtained. The safety threshold and activation function parameters of each neuron are determined. Based on the plurality of input data, the safety threshold and activation function parameters of each neuron, the weight value of each neuron is determined to obtain a target model. The target model is used to process the input data to obtain output data, and the output data is the data after desensitizing the label data. In the above process, since the input data may include the user's privacy information, the target model is used to desensitize the label data, and the output data after desensitization is correlated with the label data. On the basis of maintaining the output data with the data characteristics on the label, the information of the input data is protected. Avoiding the leakage of privacy information improves the security of model training.
[0081] The method shown in the present application is described below through specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be described repeatedly in different embodiments.
[0082] Figure 2 A flow chart of a model training method provided in an embodiment of the present application. Figure 2 , the method may include:
[0083] S201, determine the initial model.
[0084] The execution subject of the embodiment of the present application may be a terminal device, or a model training device arranged in the terminal device. The model training device may be implemented by software, or by a combination of software and hardware. The terminal device may be a computer.
[0085] The initial model includes multiple neurons, and the initial model is used to process the input data to obtain label data.
[0086] The initial model is used to handle the binary classification problem.
[0087] For example, model A is used to process user information to obtain the user type of the user. The user type can be type 1 or type 2. At this time, model A can be determined as the initial model. The input data of the initial model is user information, and the label data is type 1 or type 2.
[0088] The initial model includes multiple network layers, each of which includes d neurons, where d is a positive integer.
[0089] Next, combine Figure 3 , explaining the structure of the initial model. Figure 3 This is a schematic diagram of the structure of the initial model provided in the embodiment of this application. Figure 3 , including an initial model 301. The initial model 301 includes an input layer, at least one hidden layer and an output layer. Each layer includes multiple neurons. Assume that the input privacy data is x=(x1,…,x d ), then it can be determined that the number of neurons in each layer of the network structure in the initial model 301 is d.
[0090] S202: Acquire multiple input data.
[0091] The input data is multimedia data, and the input data includes user data authorized by the user.
[0092] For example, the input data may include text data, audio data, image data, video data, etc.
[0093] S203: Determine the safety threshold and activation function parameters of each neuron.
[0094] The safety threshold of each neuron can be determined according to the privacy protection degree of private data. The higher the privacy protection degree, the smaller the safety threshold of each neuron.
[0095] For example, if the privacy protection level is complete, the safety threshold of the neuron can be 0.
[0096] After the initial model is determined, the activation function parameters can be determined according to the model parameters of the initial model.
[0097] S204: Determine the weight value of each neuron according to the multiple input data, the safety threshold value of each neuron and the activation function parameter to obtain the target model.
[0098] The target model is used to process the input data to obtain output data, and the output data is the data after the label data is desensitized.
[0099] The mutual information between the label data and the input data is greater than or equal to the first threshold; the mutual information between the output data and the input data is less than the first threshold; the mutual information between the first output data and the second output data is greater than or equal to the second threshold.
[0100] The mutual information between the label data and the input data may be determined in the following manner: determining the joint distribution and the marginal distribution of the label data and the input data; and determining the relative entropy of the joint distribution and the marginal distribution as the mutual information between the label data and the input data.
[0101] The mutual information between the output data and the input data may be determined in the following manner: determining the joint distribution and the marginal distribution of the output data and the input data; and determining the relative entropy of the joint distribution and the marginal distribution as the mutual information between the output data and the input data.
[0102] For any neuron in the target model, under the premise that the mutual information between the input information and the output information of the neuron is less than or equal to the safety threshold corresponding to the neuron, and the mutual information between the output information and the label data reaches the maximum.
[0103] The mutual information between the input information and output information of the neuron is less than or equal to the security threshold corresponding to the neuron, so that the correlation between the input information and the output information is small, thereby protecting the privacy information corresponding to the output information to a certain extent. The mutual information between the output information and the label data reaches the maximum, so that the correlation between the output information and the label data is large. Therefore, the target model can maximize the correlation between the output data and the label data at a certain degree of privacy protection (under the total security threshold) for the originally output label data. Without leaking private information, the output data can better reflect the label data.
[0104] For any neuron in the target model, the weight value of the neuron can be determined in the following way according to the neuron's safety threshold, activation function parameters and corresponding multiple input feature values: The weight value of the neuron is determined by the following formula 1:
[0105]
[0106] Among them, α i is the weight value of the i-th neuron; is the safety threshold of the i-th neuron; x i is the input feature value of the i-th neuron; E is the expectation; β i is the activation function parameter of the i-th neuron.
[0107] The model training method provided in the embodiment of the present application determines the initial model. Determine the label data corresponding to the initial model. Determine the security threshold and activation function parameters of each neuron. According to the label data, the security threshold and activation function parameters of each neuron, determine the weight value of each neuron to obtain the target model. In the above process, since the target model is used to process the input data to obtain the output data, the output data is the data after the label data is desensitized. The desensitization process can be performed by the above formula 1, and the mutual information between the output information and the label data is maximized under the premise that the mutual information between the input information and the output information of the neuron is less than or equal to the security threshold corresponding to the neuron. In the above process, since the input data may include the user's privacy information, the target model is used to desensitize the label data, and the output data after the desensitization process is correlated with the label data. On the basis of keeping the output data having the data characteristics on the label, the information of the input data is protected. Avoid the leakage of privacy information and improve the security of model training.
[0108] Based on any of the above embodiments, Figure 4 , the detailed process of model training is explained.
[0109] Figure 4 A flowchart of another model training method provided in an embodiment of the present application. Figure 4 , the method comprising:
[0110] S401, determine the initial model.
[0111] It should be noted that the execution process of S401 can refer to S201 and will not be repeated here.
[0112] S402: Acquire multiple input data.
[0113] The input data can be private data generated during a historical period.
[0114] The input data and feature information must satisfy the following relationship: private data x = (x1,…,x d )=yβ+ε, where the label data y∈{-1,1} is a binary classification label. For a given vector, ε~N(0,I d ) is the d-dimensional standard Gaussian noise.
[0115] S403: Determine the safety threshold and activation function parameters of each neuron.
[0116] When determining the safety threshold of each neuron, a total safety threshold can be set. The sum of the safety thresholds of each neuron is equal to the total safety threshold.
[0117] For example, the initial model includes d neurons. Then R1+…+R d =R. Where R1 is the safety threshold of the first neuron; R d is the safety threshold of the dth neuron; R is the total safety threshold.
[0118] S404: Determine an input feature vector for each input data to obtain multiple input feature vectors.
[0119] The dimension of the input feature vector is d.
[0120] S405: Determine multiple input feature values of each neuron according to the multiple input feature vectors.
[0121] The multiple input eigenvalues of each neuron can be determined according to the multiple input eigenvectors in the following manner: for the i-th neuron in the first layer, the i-th eigenvalue in the multiple input eigenvectors is determined as the multiple input eigenvalues of the i-th neuron, where i is an integer between 1 and d; for the j-th neuron in the K-th layer, the multiple output eigenvalues of the j-th neuron in the K-1-th layer are determined as the multiple input eigenvalues of the j-th neuron, where K is an integer greater than 1 and j is an integer between 1 and d.
[0122] Next, combine Figure 5 , the process of determining the input eigenvalues and output eigenvalues of a neuron is explained. Figure 5 Schematic diagram of the process of determining the input characteristic value and output characteristic value of a neuron provided in an embodiment of the present application. Figure 5 , including the initial model 501. The initial model 501 includes d neurons. The private data is x=(x1,…,x d ), we can determine the characteristic values of the sample privacy data as x1,…,x d . The first eigenvalue x1 among the d eigenvalues is determined as the input eigenvalue of the first neuron. The input eigenvalue is processed by the first neuron to obtain output information t1. The second eigenvalue x2 among the d eigenvalues is determined as the input eigenvalue of the second neuron. The input eigenvalue is processed by the second neuron to obtain output information t2. And so on, the input eigenvalue and output information of each neuron are obtained.
[0123] It should be noted that if the d neurons of the initial model 501 are located in the first layer of the network, the input feature values are x1,…,x d If the d neurons of the initial model 501 are located in other network layers, the input feature values are the d feature values output by the previous network layer.
[0124] S406: For any neuron, determine the weight value of the neuron according to the safety threshold of the neuron, the activation function parameter and the corresponding multiple input feature values.
[0125] In order to perform privacy protection on input data, the mutual information between the input data and output data of the target model needs to be less than or equal to the total security threshold, and the mutual information between the output data and the label data needs to be maximized. Since it is difficult to solve the optimal joint distribution of the target model, a Markov chain can be introduced so that the output eigenvalue of any neuron is only related to the input eigenvalue, thereby decomposing the solution of the target model into the solution for each neuron. That is, when the mutual information between the input eigenvalue and the output eigenvalue of the neuron is less than or equal to the security threshold corresponding to the neuron, and the mutual information between the output eigenvalue and the label information is maximized, when the input data is processed by the target model to obtain the output data, the correlation between the input data and the output data is less than the total security threshold, and the mutual information between the output data and the label data is maximized.
[0126] Formula 1 can be obtained as follows:
[0127] Condition 1: In I(x i ;t i )≤R i In the case of i ) reaches its maximum;
[0128] Condition 2: t i |x i ~N(α i tanh(β i x i ),1);
[0129] Among them, x i is the input feature value of the i-th neuron; t i is the output characteristic value of the i-th neuron; I(x i ;t i ) is the first mutual information of the i-th neuron; R i is the safety threshold of the i-th neuron; y is the label data; I(y; t i ) is the second mutual information; α i is the weight value of the i-th neuron; tanh(β i x i ) is the activation function of the i-th neuron; N(a,b) is a Gaussian distribution with mean a and variance b. The first mutual information is the mutual information between the input eigenvalue and the output eigenvalue of the i-th neuron, and the second mutual information is the mutual information between the label data and the output eigenvalue of the i-th neuron.
[0130] Since the mutual information of the ith neuron is a function related to the weight value of the ith neuron. The mutual information expression of the ith neuron is relatively complex, and it is difficult to obtain the weight value of the ith neuron based on the mutual information expression of the ith neuron. Therefore, under the above conditions, the mutual information expression of the ith neuron is inequality scaled. Using a relatively simple expression of the weight value of the ith neuron, the expression of the weight value of the ith neuron is made greater than or equal to the mutual information expression of the ith neuron, and equal to the safety threshold of the ith neuron. In this way, the weight value of the ith neuron can be obtained on the basis of satisfying the above conditions.
[0131] The mutual information expression of the i-th neuron can be inequality scaled by the following formula 2:
[0132]
[0133] Among them, x i is the input feature value of the i-th neuron; t i is the output characteristic value of the i-th neuron; I(x i ;t i ) is the first mutual information of the i-th neuron; E is the expectation; R i is the safety threshold of the i-th neuron; α i is the weight value of the i-th neuron; tanh(β i x i ) is the activation function of the ith neuron. The first mutual information is the mutual information between the input eigenvalue and the output eigenvalue of the ith neuron.
[0134] By solving Formula 2, the optimal weight value of the i-th neuron under the corresponding safety threshold can be obtained as shown in Formula 1.
[0135] Compared with other weight values, the optimal weight value can make the output data of the target model closest to the true result under the corresponding safety threshold of the i-th neuron, that is, the output data has the highest accuracy.
[0136] S407: Determine the target model according to the weight value of each neuron.
[0137] It is determined that the target model includes multiple neurons, and the weight value of each neuron is obtained according to the above method.
[0138] For example, the initial model includes 8 neurons. The weight value of each neuron obtained according to the above method can be shown in Table 1:
[0139] Table 1
[0140] Neurons Weight value The first neuron 0.25 The second neuron 0.10 The third neuron 0.32 The fourth neuron 0.08 The fifth neuron 0.13 The sixth neuron 0.47 The 7th neuron 0.56 Neuron 8 0.35
[0141] The target model is determined to include 8 neurons, and the weight value of each neuron is shown in Table 1.
[0142] After determining the target model, the mutual information between the output feature value of each neuron and the label data can be determined according to the weight value of each neuron, so as to determine the correlation between the output information of each neuron and the label data.
[0143] The mutual information between the output characteristic value of each neuron and the label data can be determined in the following manner: determine the first entropy function corresponding to the label data, and determine the second entropy function of the label data under the output characteristic value of each i-th neuron; determine the difference between the first entropy function and the second entropy function as the second mutual information of the i-th neuron; and determine the correlation between the output characteristic value of the i-th neuron and the label data based on the second mutual information of the i-th neuron.
[0144] For any i-th neuron, the mutual information between the i-th neuron output information and the label data can be determined by the following formula 3:
[0145]
[0146]
[0147] in,
[0148]
[0149]
[0150] In the above formula, y is the label data; t i is the output characteristic value of the i-th neuron; I(y; t i ) is the second mutual information of the i-th neuron; x i is the input feature value of the i-th neuron; h(t i ) is the entropy function corresponding to the output eigenvalue of the i-th neuron; h(t i |y) is the entropy function under the output eigenvalue of the i-th neuron; β i is the parameter of the activation function of the i-th neuron; tanh(β i x i ) is the activation function of the i-th neuron; α i is the weight value of the ith neuron.
[0151] The correlation between the output data of the target model and the label data can be determined based on the second mutual information of each neuron, thereby determining whether the output data after desensitization processing can have the characteristics of the label data.
[0152] The model training method provided in the embodiment of the present application determines the initial model. Obtain multiple input data. Determine the security threshold and activation function parameters of each neuron. Determine the input feature vector of each input data to obtain multiple input feature vectors. According to the multiple input feature vectors, determine the multiple input feature values of each neuron. For any neuron, determine the weight value of the neuron according to the security threshold, activation function parameters and corresponding multiple input feature values of the neuron. Determine the target model according to the weight value of each neuron. In the above process, since the target model is used to process the input data to obtain the output data, the output data is the data after the label data is desensitized. In the above process, since the input data may include the user's privacy information, the target model is used to desensitize the label data. The desensitization process can be constrained by the above conditions one and two, so that the mutual information between the input information and the output information of the neuron is less than or equal to the security threshold corresponding to the neuron. The mutual information between the output information and the label data reaches the maximum. There is a correlation between the output data after desensitization and the label data. And the optimal weight value can make the output data accuracy of the target model the highest when the correlation between the input data and the output data is less than the corresponding security threshold. On the basis of maintaining the characteristics of the label data, the input data is protected to avoid the leakage of private information and improve the security of model training.
[0153] Based on any of the above embodiments, Figure 6 , the model training process is illustrated with examples.
[0154] Figure 6 This is a schematic diagram of the model training process provided in the embodiment of this application. Figure 6 , including a terminal device 601. The terminal device 601 may be a computer. An initial model is set in the terminal device 601, and the initial model includes 4 neurons. The initial model is used to determine the user type of the user, and the user type may be a high-income type or a low-income type.
[0155] The terminal device 601 obtains input data x=(x1, x2, x3, x4). Among them, x1 is the user's occupational characteristics, x2 is the user's income characteristics, x3 is the user's gender, and x4 is the user's age. Assume that the label data y is a high-income type or a low-income type. The input data x and the characteristic information must satisfy the following relationship: x=(x1,…,x d )=yβ+ε, where the label data y∈{-1,1} is a binary classification label. For a given vector, ε~N(0,I d ) is the d-dimensional standard Gaussian noise.
[0156] The terminal device 601 determines the safety threshold and activation function parameters of each neuron as shown in Table 2:
[0157] Table 2
[0158] Neurons Safety threshold Activation function parameters The first neuron <![CDATA[R1]]> <![CDATA[β1]]> The second neuron <![CDATA[R2]]> <![CDATA[β2]]> The third neuron <![CDATA[R3]]> <![CDATA[β3]]> The fourth neuron <![CDATA[R4]]> <![CDATA[β4]]>
[0159] Assuming the total safety threshold is 5, then R1+R2+R3+R4=5 must be satisfied.
[0160] Terminal device 601 determines the first eigenvalue x1 among the four eigenvalues as the input eigenvalue of the first neuron. The input eigenvalue is processed by the first neuron to obtain the output eigenvalue t1. The second eigenvalue x2 among the four eigenvalues is determined as the input eigenvalue of the second neuron. The input eigenvalue is processed by the second neuron to obtain the output eigenvalue t2. The third eigenvalue x3 among the four eigenvalues is determined as the input eigenvalue of the third neuron. The input eigenvalue is processed by the third neuron to obtain the output eigenvalue t3. The fourth eigenvalue x4 among the four eigenvalues is determined as the input eigenvalue of the fourth neuron. The input eigenvalue is processed by the fourth neuron to obtain the output eigenvalue t4.
[0161] The terminal device 601 determines the weight value of the first neuron according to the safety threshold and activation function parameters of the first neuron shown in Table 2 above by using Formula 1:
[0162]
[0163] in, is the activation function of the first neuron; R1 is the safety threshold of the first neuron; x1 is the input feature value of the first neuron; E is the expectation; is the activation function of the first neuron.
[0164] The terminal device 601 determines the weight value of each neuron by the above method according to the safety threshold and activation function of each neuron shown in Table 2, which can be specifically shown in Table 3:
[0165] Table 3
[0166] Neurons Weight value The first neuron <![CDATA[α1]]> The second neuron <![CDATA[α2]]> The third neuron <![CDATA[α3]]> The fourth neuron <![CDATA[α4]]>
[0167] The terminal device 601 determines that the target model includes 4 neurons, and the weight value of each neuron is specifically shown in Table 3.
[0168] After determining the target model, for any i-th neuron, the terminal device 601 can determine the mutual information between the i-th neuron output information and the label data by using Formula 3, so as to determine the correlation between each neuron output information and the label data.
[0169] The model training method provided in the embodiment of the present application determines the initial model. Obtain multiple input data. Determine the security threshold and activation function parameters of each neuron. Determine the input feature vector of each input data to obtain multiple input feature vectors. According to the multiple input feature vectors, determine the multiple input feature values of each neuron. For any neuron, determine the weight value of the neuron according to the security threshold, activation function parameters and corresponding multiple input feature values of the neuron. Determine the target model according to the weight value of each neuron. In the above process, since the target model is used to process the input data to obtain the output data, the output data is the data after the label data is desensitized. In the above process, since the input data may include the user's privacy information, the target model is used to desensitize the label data, and the output data after the desensitization is correlated with the label data. And the optimal weight value can make the output data output by the target model the most accurate when the correlation between the input data and the output data is less than the corresponding security threshold. On the basis of maintaining the characteristics of the label data, the input data is protected. Avoid the leakage of privacy information and improve the security of model training.
[0170] Based on any of the above embodiments, the process of desensitizing the input data of the i-th neuron may be, but is not limited to, implemented in the following manner.
[0171] For the output data of the i-th neuron, the following conditions are passed:
[0172]
[0173] stI(x i ;t i )≤R i
[0174] Design the i-th neuron to satisfy
[0175] Among them, x i is the input feature value of the i-th neuron; t i is the output characteristic value of the i-th neuron; I(x i ;t i ) is the first mutual information of the i-th neuron; R i is the safety threshold of the i-th neuron; y is the label data; I(y; t i ) is the second mutual information; sign(x i ) is the activation function, the operation is XOR and the noise is Bernoulli distribution (Q i ~Bern(q i ),q i ∈[0,1]).
[0176] Step 1: Distribute the noise q to the i-th neuron i Solution
[0177] Due to t i and sign(x i ) is a jointly symmetric Bernoulli distribution, when 0≤R i ≤log2, the optimal noise distribution q under the safety constraint can be obtained. i :
[0178] log2-H(q i )=R i
[0179] Among them, H(q i )=-q i logq i -(1-q i )log(1-q i ).
[0180] Step 2: Neural network learning accuracy solution and performance simulation
[0181] Substitute the noise distribution obtained in step 2 into I(y; t i ) is calculated with precision and the analytical solution is
[0182] I(y;t i )=log2-H(p i (1-q i )+q i (1-p i )),
[0183] Among them, p i =P(sign(x i )=1|y=-1).
[0184] In the above process, the noise distribution and activation function are changed, thereby changing the structure of neurons in the target model. The target model is used to desensitize the label data, and the output data after desensitization is correlated with the label data. And the optimal noise distribution can make the output data output by the target model have the highest accuracy when the correlation between the input data and the output data is less than the corresponding security threshold. On the basis of maintaining the characteristics of the label data, the input data is protected. Avoiding the leakage of privacy information improves the security of model training.
[0185] Figure 7 This is a schematic diagram of the structure of a model training device provided in an embodiment of the present application. Figure 7 , the model training device 10 may include:
[0186] A first determination module 11 is used to determine an initial model, wherein the initial model includes a plurality of neurons, and the initial model is used to process input data to obtain label data;
[0187] An acquisition module 12, used for acquiring a plurality of input data;
[0188] A second determination module 13, used to determine the safety threshold and activation function parameters of each neuron;
[0189] The third determination module 14 is used to determine the weight value of each neuron according to the multiple input data, the safety threshold and activation function parameters of each neuron to obtain a target model; the target model is used to process the input data to obtain output data, and the output data is the data after the label data is desensitized.
[0190] In a possible implementation manner, the mutual information between the label data and the input data is greater than or equal to a first threshold;
[0191] The mutual information between the output data and the input data is less than the first threshold;
[0192] The mutual information between the first output data and the second output data is greater than or equal to a second threshold.
[0193] In a possible implementation manner, the third determining module 14 is specifically configured to:
[0194] Determine an input feature vector of each input data to obtain multiple input feature vectors, where the dimension of the input feature vector is d;
[0195] Determining a plurality of input feature values of each neuron according to the plurality of input feature vectors;
[0196] For any neuron, the weight value of the neuron is determined according to the safety threshold of the neuron, the activation function parameter and the corresponding multiple input feature values.
[0197] In a possible implementation manner, the third determining module 14 is specifically configured to:
[0198] For the i-th neuron of the first layer, determining the i-th eigenvalue in the multiple input eigenvectors as the multiple input eigenvalues of the i-th neuron, where i is an integer between 1 and d;
[0199] For the j-th neuron in the K-th layer, multiple output feature values of the j-th neuron in the K-1-th layer are determined as multiple input feature values of the j-th neuron, where K is an integer greater than 1, and j is an integer between 1 and d.
[0200] In a possible implementation manner, the third determining module 14 is specifically configured to:
[0201] Determining a joint distribution and a marginal distribution of the label data and the input data;
[0202] The relative entropy of the joint distribution and the marginal distribution is determined as the mutual information between the label data and the input data.
[0203] In a possible implementation, for any neuron in the target model;
[0204] Under the premise that the mutual information between the input information and the output information of the neuron is less than or equal to the safety threshold corresponding to the neuron, the mutual information between the output information and the label data reaches the maximum.
[0205] In a possible implementation, the input data is multimedia data. Exemplarily, the multimedia data includes at least one of images, videos, texts, and audios.
[0206] The model training device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.
[0207] Figure 8 A schematic diagram of the structure of another model training device provided in an embodiment of the present application. Figure 7 Based on the examples shown, please see Figure 8 , the model training device 10 also includes a fourth determination module 15.
[0208] Wherein, the fourth determining module 15 is used for:
[0209] Determine a first entropy function corresponding to the label data, and determine a second entropy function of the label data under the output characteristic value of each i-th neuron;
[0210] Determine the difference between the first entropy function and the second entropy function as the second mutual information of the i-th neuron;
[0211] According to the second mutual information of the i-th neuron, the correlation between the output feature value of the i-th neuron and the label data is determined.
[0212] The model training device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.
[0213] Fig. 9This is a schematic diagram of the structure of the terminal device provided in the embodiment of the present application. Fig. 9 The terminal device 20 may include: a memory 21 and a processor 22. Exemplarily, the memory 21 and the processor 22 are interconnected via a bus 23.
[0214] The memory 21 is used to store program instructions;
[0215] The processor 22 is used to execute the program instructions stored in the memory, so as to enable the terminal device 20 to execute the method shown in the above method embodiment.
[0216] The terminal device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.
[0217] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above method.
[0218] The embodiment of the present application may also provide a computer program product, including a computer program, which can implement the above method when executed by a processor.
[0219] All or part of the steps of the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (ROM), random access memory (RAM), flash memory, hard disk, solid state drive, magnetic tape, floppy disk, optical disc and any combination thereof.
[0220] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0221] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0222] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0223] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
[0224] In the present application, the term "include" and its variations may refer to non-restrictive inclusion; the term "or" and its variations may refer to "and / or". The terms "first", "second", etc. in the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In the present application, "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previously associated objects are in an "or" relationship.
Claims
1. A model training method, characterized in that: include: Determine an initial model, wherein the initial model includes a plurality of neurons, and the initial model is used to process input data to obtain label data; Get multiple input data; Determine the safety threshold and activation function parameters of each neuron; According to the multiple input data, as well as the safety threshold and activation function parameters of each neuron, the weight value of each neuron is determined to obtain a target model; the target model is used to process the input data to obtain output data, and the output data is the data after the label data is desensitized.
2. The method according to claim 1, characterized in that The mutual information between the label data and the input data is greater than or equal to a first threshold; The mutual information between the output data and the input data is less than the first threshold; The mutual information between the first output data and the second output data is greater than or equal to a second threshold.
3. The method according to claim 1 or 2, characterized in that: The initial model includes multiple network layers, each network layer includes d neurons, and d is a positive integer; Determining a weight value of each neuron according to the plurality of input data, and a safety threshold and an activation function parameter of each neuron, including: Determine an input feature vector of each input data to obtain multiple input feature vectors, where the dimension of the input feature vector is d; Determining a plurality of input feature values of each neuron according to the plurality of input feature vectors; For any neuron, the weight value of the neuron is determined according to the safety threshold of the neuron, the activation function parameter and the corresponding multiple input feature values.
4. The method according to claim 3, characterized in that Determining a plurality of input feature values of each neuron according to the plurality of input feature vectors includes: For the i-th neuron of the first layer, determining the i-th eigenvalue in the multiple input eigenvectors as the multiple input eigenvalues of the i-th neuron, where i is an integer between 1 and d; For the j-th neuron in the K-th layer, multiple output feature values of the j-th neuron in the K-1-th layer are determined as multiple input feature values of the j-th neuron, where K is an integer greater than 1, and j is an integer between 1 and d.
5. The method according to claim 2, characterized in that: The mutual information between the label data and the input data is determined in the following manner: Determining a joint distribution and a marginal distribution of the label data and the input data; The relative entropy of the joint distribution and the marginal distribution is determined as the mutual information between the label data and the input data.
6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Determine a first entropy function corresponding to the label data, and determine a second entropy function of the label data under the output characteristic value of each i-th neuron; Determine the difference between the first entropy function and the second entropy function as the second mutual information of the i-th neuron; According to the second mutual information of the i-th neuron, the correlation between the output feature value of the i-th neuron and the label data is determined.
7. The method according to any one of claims 1 to 6, characterized in that: For any neuron in the target model; Under the premise that the mutual information between the input information and the output information of the neuron is less than or equal to the safety threshold corresponding to the neuron, the mutual information between the output information and the label data reaches the maximum.
8. The method according to any one of claims 1 to 7, characterized in that: The input data is multimedia data.
9. A model training device, characterized in that: The device comprises: A first determination module is used to determine an initial model, wherein the initial model includes a plurality of neurons, and the initial model is used to process input data to obtain label data; An acquisition module, used for acquiring multiple input data; The second determination module is used to determine the safety threshold and activation function parameters of each neuron; The third determination module is used to determine the weight value of each neuron according to the multiple input data, the safety threshold and activation function parameters of each neuron to obtain a target model; the target model is used to process the input data to obtain output data, and the output data is the data after the label data is desensitized.
10. A terminal device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 8.
11. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: in, The computer instructions are used to make a computer execute the method according to any one of claims 1 to 8.