Federal learning method based on local small-batch gradient differential privacy

Abstract

The invention discloses a federated learning method based on local small-batch gradient difference privacy, belongs to the technical field of federated learning, and aims to solve the technical problems that the balance between model precision and privacy protection level exists in federated learning, and the problems that the generalization ability is poor and the accuracy is reduced easily in the training process. And the client performs local model parameter updating through a small-batch gradient descent algorithm based on the accumulated privacy loss threshold, and adjusts the noise intensity added to the local model according to the size of the privacy loss. And after each round of local training is completed, the client uploads the updated local model parameters to the server. And the server performs aggregation calculation according to the local model parameters uploaded by all the clients and the historical parameter information of the global model in the previous round in the aggregation process, and broadcasts the updated global model parameters to each client.

Description

Technical Field

[0001] The present invention belongs to the technical field of federated learning, and specifically is a federated learning method based on local small batch gradient differential privacy. Background Art

[0002] As the demand for data privacy protection continues to increase, federated learning, as an emerging distributed machine learning method, has received widespread attention. Federated learning allows multiple participants to maintain data privacy while calculating and updating models locally, avoiding uploading sensitive data to a central server. Although federated learning has significant advantages in protecting data privacy, it still faces the challenge of balancing model accuracy and privacy protection in practical applications. In traditional centralized learning, all data is concentrated on the server for training, which can improve the accuracy of the model by directly accessing the complete data set. However, federated learning requires that data be kept locally, and only model updates calculated locally are uploaded to the central server. Therefore, how to effectively protect user data privacy while reducing the performance loss caused by privacy protection has become a key issue in federated learning.

[0003] To solve this problem, researchers have focused on using various privacy protection technologies to achieve secure federated learning. These methods can be mainly divided into two categories: cryptographic methods and differential privacy. Cryptographic methods include secure multi-party computing and homomorphic encryption. Secure multi-party computing and homomorphic encryption can provide better security guarantees for federated learning, but the communication overhead and computational complexity are large. Differential privacy mainly adds noise to information, which does not cause large communication overhead and computational complexity. Compared with other methods, it has obvious lightweight advantages.

[0004] Differential privacy can be divided into central differential privacy (GDP) and local differential privacy (LDP). Compared with GDP, LDP provides stronger privacy protection by adding local perturbations before uploading model parameters. Therefore, the LDP method is often used in federated learning. However, in the federated learning method based on local differential privacy, there is a balance problem between privacy protection and model accuracy. Specifically, as the level of privacy protection of sensitive data increases, the model accuracy tends to decrease, and vice versa. Federated learning has a balance problem between model accuracy and privacy protection level, and it is prone to poor generalization ability and reduced accuracy during training, which is a technical problem that needs to be solved. Summary of the invention

[0005] In order to solve the above problems, the purpose of the present invention is to provide a federated learning method based on local small-batch gradient differential privacy to solve the balance problem between model accuracy and privacy protection level in federated learning, and the problems of poor generalization ability and reduced accuracy that easily occur during the training process.

[0006] The present invention provides a federated learning method based on local small batch gradient differential privacy, which is applied between a server and N clients and includes the following steps:

[0007] S1: First, initialize the server, configure the dataset and global model. At the same time, configure a unique client ID, local dataset, and differential privacy library for each client, and initialize the learning parameters. The learning parameters include the learning rate and training batch size for iterative training of the local model. It should be noted that the structure of the global model is the same as that of the local model.

[0008] S2: The server initializes the global model parameters and broadcasts the global model parameters to each client.

[0009] S3: The client updates the local model based on the global model parameters to obtain an updated local model.

[0010] S4: The client divides the local dataset into multiple small batches.

[0011] S5: The client performs selective training on the updated local model based on the local dataset. During iterative training, all samples in the current mini-batch are used, and the local model parameters are updated based on the cumulative privacy loss threshold through the mini-batch gradient descent algorithm. The noise intensity added to the local model is adjusted according to the size of the privacy loss.

[0012] S6: The server performs aggregation calculation based on the local model parameters uploaded by all clients and the historical parameter information of the previous round of global model during the aggregation process to obtain the global model, verifies the global model based on the data set in the server, and broadcasts the corresponding global model parameters to each client.

[0013] S7: Execute steps S3-S7 repeatedly until the global model achieves the desired effect.

[0014] As a preference, the client constructs a cumulative privacy loss threshold based on privacy loss. The cumulative privacy loss threshold calculation formula is as follows:

[0015]

[0016] Preferably, the client iteratively trains the updated local model based on the local data set through a small batch gradient descent algorithm, and obtains the local model represented as:

[0017]

[0018] in, represents the gradient after perturbation of the i-th user G, m represents the dimension of user data, and γ represents the learning rate used in the kth iteration. For convenience in the experiment, it is set to 0.01.

[0019] Preferably, the server performs aggregation calculation based on the local model parameters uploaded by all clients and the historical parameter information of the previous round of global model in the aggregation process, and the obtained global model is expressed as:

[0020]

[0021] Among them, w t is the global model of the current round t, w t+1 To update the global model after aggregating the next round of t+1 client gradients, is the average value of all client gradient parameters, and α is the learning rate of the update algorithm.

[0022] Preferably, the global model is a network structure built based on a convolutional neural network (CNN), comprising two network units. Each network unit consists of a convolutional layer, a ReLU layer, and a maximum pooling layer. The maximum pooling layer is followed by two fully connected layers, and finally outputs the result through a Softmax layer. A federated learning method based on local mini-batch gradient differential privacy of the present invention has the following advantages:

[0023] 1. The concept of privacy loss cost is introduced. Through the mini-batch gradient descent algorithm based on the cumulative privacy loss threshold, a group of gradient means uploaded by users are randomly selected in each round as the server parameters for the new round, which reduces the amount of noise injection and effectively improves the model accuracy, achieving a balance between privacy protection efficiency and accuracy.

[0024] 2. An improved weighted aggregation algorithm is proposed, which uses historical information and client relevance to assign weights, effectively improving the model accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0026] Figure 1 A flowchart of a federated learning method based on local small-batch gradient differential privacy is implemented. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] See also Figure 1 , the present invention provides a technical solution:

[0029] Example:

[0030] The present invention provides a federated learning method based on local small batch gradient differential privacy, which is applied between a server and N clients. The method includes the following seven steps.

[0031] S1: First, initialize the server, configure the dataset and global model. At the same time, configure a unique client ID, local dataset, and differential privacy library for each client, and initialize the learning parameters. The learning parameters include the learning rate and training batch size for iterative training of the local model. It should be noted that the structure of the global model is the same as that of the local model.

[0032] S2: The server initializes the global model parameters and broadcasts the global model parameters to each client.

[0033] S3: The client updates the local model based on the global model parameters to obtain an updated local model.

[0034] S4: The client divides the local dataset into multiple small batches.

[0035] S5: The client performs selective training on the updated local model based on the local dataset. During iterative training, all samples in the current mini-batch are used, and the local model parameters are updated based on the cumulative privacy loss threshold through the mini-batch gradient descent algorithm. The noise intensity added to the local model is adjusted according to the size of the privacy loss.

[0036] S6: The server performs aggregation calculation based on the local model parameters uploaded by all clients and the historical parameter information of the previous round of global model during the aggregation process to obtain the global model, verifies the global model based on the data set in the server, and broadcasts the corresponding global model parameters to each client.

[0037] S7: Execute steps S3-S7 repeatedly until the global model achieves the desired effect.

[0038] In step S1 of this embodiment, an initial global model is configured in the server, and the global model is broadcast to each client. The client uses the global model sent by the server as a local model.

[0039] In terms of model selection, federated learning usually adopts a lightweight network structure because lightweight networks have a smaller number of parameters, which helps to improve the real-time performance of the federated learning system. The global model is built based on a convolutional neural network (CNN) and contains two network units. Each network unit consists of a convolution layer, a ReLU activation layer, and a maximum pooling layer. The maximum pooling layer is followed by two fully connected layers, and the results are finally output through the Softmax layer. Specifically, the convolution layer uses a 3×3 convolution kernel with a step size of 1 and a padding of 1; the maximum pooling layer uses a 2×2 pooling window with a step size of 1.

[0040] In step S5, the client uses all samples in the current small batch of the local dataset to perform local differential privacy on the updated local model. The local small batch gradient differential privacy algorithm includes local training and adding noise. The process of the local small batch gradient differential privacy algorithm is as follows:

[0041] The specific definition of local differential privacy is as follows:

[0042] For a random algorithm M, the same result a is output under any two records a and a′ * :

[0043] Pr[M(a)=a * ]≤e ε ·Pr[M(a′)=a * ]

[0044] Then the random algorithm M is said to satisfy ε-local differential privacy. Where ε is the privacy protection budget and Pr[·] is the probability of an event occurring. Local differential privacy protects the user's privacy by ensuring the output similarity of any two records.

[0045] When executing this step in this embodiment, the privacy loss needs to be calculated first, and the cumulative privacy loss before calculating the gradient is determined by the cumulative privacy loss threshold. The purpose of introducing the cumulative privacy loss threshold is to measure the degree of data privacy leakage in each iteration process, so as to achieve more effective privacy protection.

[0046] For two adjacent datasets d, d′∈D and a mapping mechanism M, the privacy loss of the mapping mechanism M at the output o is:

[0047]

[0048] Among them, aux represents the auxiliary input variables and.

[0049] The differential privacy mechanism in each iteration is closely related to the parameter values ​​of the weight coefficients of each layer of the neural network. Therefore, under a given mapping mechanism M, the privacy loss in the λth iteration is:

[0050]

[0051] Furthermore, the loss boundary value of the mapping mechanism M is:

[0052]

[0053] The total privacy loss bound can be expressed as:

[0054]

[0055] For the client, the loss function of the local model is expressed as:

[0056]

[0057]

[0058] Among them, λ is the regularization factor, <x i ,y i > is the data of randomly selected users.

[0059] In each iteration, the client randomly selects a group of users G and performs iterative training of the local model through a small batch gradient descent algorithm. The local model update formula is as follows:

[0060]

[0061] in, represents the gradient after perturbation of the i-th user G, m represents the dimension of user data, and γ represents the learning rate used in the kth iteration. For convenience in the experiment, it is set to 0.01.

[0062] When perturbing the gradient, the gradient needs to be preprocessed. If the gradient is greater than 1, the user needs to set it to 1, and if it is less than -1, it needs to be set to -1 before perturbing it.

[0063] This embodiment uses a local small batch gradient differential privacy algorithm for local model training. First, the cumulative privacy loss threshold is calculated. If the cumulative privacy loss threshold is small enough, no local training is required. Otherwise, a group of users G is randomly selected to train the local model of this group of users. Finally, in order to protect the client's privacy data, Gaussian noise is added for perturbation. In this way, the balance between privacy level and model performance can be effectively solved, which can not only meet the client's privacy requirements, but also improve the model accuracy.

[0064] In step S6, the server calculates the local model parameters w based on the local model parameters uploaded by all clients. t And the historical parameter information of the previous round of global model in the aggregation process is aggregated and calculated to obtain the global model w t+1 It is expressed as:

[0065]

[0066] in, is the average value of all client gradient parameters, and α is the learning rate of the update algorithm.

[0067] The client loads the new global model w again t+1 .

[0068] Each time the server completes the aggregation calculation of the global model, it will verify the global model based on the data set in the server. If the verification result does not meet the requirements, the server will broadcast the global model parameters to each client and continue model training; if the verification result meets the requirements, the server will broadcast the global model parameters to each client and stop model training.

[0069] The method of this embodiment introduces the concept of privacy loss cost. Through a small batch gradient descent algorithm based on a cumulative privacy loss threshold, a group of user-uploaded gradient means are randomly selected in each round as the server parameters for the new round, thereby reducing the amount of noise injection. At the same time, this embodiment proposes an improved weighted aggregation algorithm that uses historical information and client relevance to assign weights. While achieving privacy protection, this embodiment effectively improves the model accuracy and achieves a balance between privacy protection efficiency and model accuracy.

[0070] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. A federated learning method based on local mini-batch gradient differential privacy, characterized in that: Applied between a server and N clients, the method includes the following steps: S1: First, initialize the server, configure the dataset and global model; at the same time, configure a unique client ID, local dataset, and differential privacy library for each client, and initialize the learning parameters; the learning parameters include the learning rate and training batch size for iterative training of the local model; it should be noted that the structure of the global model is the same as that of the local model; S2: The server initializes the global model parameters and broadcasts the global model parameters to each client; S3: The client updates the local model based on the global model parameters to obtain an updated local model; S4: The client divides the local dataset into multiple small batches; S5: The client performs selective training on the updated local model based on the local data set. During iterative training, all samples in the current mini-batch are used, and the local model parameters are updated based on the cumulative privacy loss threshold through the mini-batch gradient descent algorithm. The noise intensity added to the local model is adjusted according to the size of the privacy loss. S6: The server performs aggregation calculation based on the local model parameters uploaded by all clients and the historical parameter information of the global model in the previous round during the aggregation process to obtain a global model, verifies the global model based on the data set in the server, and broadcasts the corresponding global model parameters to each client; S7: Execute steps S3-S7 repeatedly until the global model achieves the desired effect.

2. The federated learning method based on local mini-batch gradient differential privacy according to claim 1, characterized in that: The client constructs a cumulative privacy loss threshold based on privacy loss. The calculation formula for the cumulative privacy loss threshold is as follows:

3. The federated learning method based on local mini-batch gradient differential privacy according to claim 2, characterized in that: The client iteratively trains the updated local model based on the local data set using a small batch gradient descent algorithm, and the local model is represented as: in, represents the gradient after perturbation of the i-th user G, m represents the dimension of user data, and γ represents the learning rate used in the kth iteration; for convenience in the experiment, it is set to 0.

01.

4. The federated learning method based on local random differential privacy according to claim 3, characterized in that: The server performs aggregation calculation based on the local model parameters uploaded by all clients and the historical parameter information of the previous round of global model during the aggregation process. The resulting global model is expressed as: Among them, w t is the global model of the current round t, w t+1 To update the global model after aggregating the next round of t+1 client gradients, is the average value of all client gradient parameters, and α is the learning rate of the update algorithm.

5. The federated learning method based on local random differential privacy according to claim 1, characterized in that: The global model is a network structure built based on a convolutional neural network (CNN), which contains two network units; each network unit consists of a convolutional layer, a ReLU layer and a maximum pooling layer; the maximum pooling layer is followed by two fully connected layers, and finally the result is output through a Softmax layer.

Images