A privacy data publishing method, system and device based on a generative adversarial network

Abstract

This invention provides a method, system, and apparatus for privacy-preserving data publishing based on generative adversarial networks (GANs). It uses the original dataset to be published and a small number of publicly available datasets with similar attributes that have undergone privacy processing as training data. A generator cluster and a discriminator are constructed based on adversarial learning. Random vectors are used as input to the generator cluster to fit published data that conforms to the attributes of the original dataset and meets privacy requirements. During the training of the generator cluster module, the performance of the generators is evaluated using a fitness evaluation function, and generators are retained or eliminated based on the evaluation scores. New generators are then generated through crossover and mutation and added to the cluster for subsequent iterative training. During the joint training of the generator cluster module and the discriminator module, differential privacy technology is used for adaptive gradient pruning and noise introduction to protect sensitive data information. This invention can maintain high utility of the published data while ensuring strong privacy protection.

Description

Technical Field

[0001] This invention relates to the field of privacy data processing technology, and in particular to a method, system, and apparatus for publishing privacy data based on generative adversarial networks. Background Technology

[0002] With the rapid development of information technology, the rapid growth of data has become a severe challenge and a valuable opportunity for many industries. Publishing and sharing this data and applying it to fields such as healthcare and financial analysis can create enormous social benefits. For example, analyzing patient data released by hospitals can help drug research institutions develop drugs to treat intractable diseases; government analysis of resident financial data released by banks can enable more targeted adjustments to economic restructuring. However, this data often contains sensitive personal information, such as patients' medical records and bank customers' payment information. Publishing this data without processing not only threatens users' privacy but also leads to a series of economic losses and legal problems. Therefore, a method for publishing privacy-sensitive data is urgently needed. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method, system, and apparatus for publishing private data based on generative adversarial networks, in order to eliminate or improve one or more defects existing in the prior art and solve the problem that the prior art is unable to maintain privacy and utility while publishing private data.

[0004] One aspect of the present invention provides a method for publishing privacy-preserving data based on generative adversarial networks, the method comprising the following steps:

[0005] Obtain the original dataset to be published and the public dataset. The public dataset has the same data attributes as the original dataset and meets the anonymity requirements for public data publication. The amount of data in the public dataset is smaller than that in the original dataset.

[0006] Construct a generator cluster and a discriminator. Each generator in the generator cluster has the same structure. Each generator takes a uniformly distributed random vector as input and outputs generated data. The discriminator takes the generated data, the original dataset, and the public data as input and outputs a binary classification result indicating whether the data belongs to the generated data.

[0007] In multiple iterations, a binary classification loss is calculated based on the binary classification results. Based on adversarial learning, the generator cluster and the discriminator are alternately trained and updated to minimize this loss. Specifically, the gradient information of the discriminator using publicly available data is clustered, outliers are removed, and an average gradient pruning threshold is calculated. The gradient of the discriminator using real data is pruned and noise perturbation is added based on this average gradient pruning threshold. A fitness evaluation function is constructed to score the generators, and generators are retained or eliminated according to set rules based on their scores. Individual generators in the generator cluster are used as parent generators. In the crossover stage, the parameters of each parent generator are cut and cross-recombined. In the mutation stage, the parameters of each parent generator are perturbed to obtain child generator individuals to expand the generator cluster.

[0008] After reaching the set number of iterations or after the binary classification loss reaches the preset convergence condition, the random vector input to the generator with the highest score outputs the published data and publishes it.

[0009] In some embodiments, the amount of data in the public dataset is 10% to 20% of the original dataset;

[0010] The data attributes of the public dataset and the original dataset are definitions and descriptions of data variables.

[0011] In some embodiments, calculating the binary classification loss based on the binary classification result includes:

[0012] An fitness evaluation function is constructed to score the generator. The optimal generated data output by the generator with the highest score is selected. A first loss function is then calculated by combining the binary classification results of the optimal generated data and the publicly available data in the public dataset, using the discriminator as the comparison. The expression is as follows:

[0013]

[0014] Where m represents the amount of data in the current batch being processed, and z i Represents a random vector. This refers to the generated data. This refers to publicly available data sampled from the aforementioned public dataset. This indicates the recognition result of the discriminator;

[0015] The second loss function for the binary classification results of the optimal generated data and the real data in the original dataset is expressed as:

[0016]

[0017] Where, xi This represents the actual data sampled from the original dataset;

[0018] For each individual generator in the generator cluster, a third loss function is constructed, expressed as:

[0019]

[0020] in, This indicates that the j-th generator is based on the random vector z. i The generated data obtained.

[0021] In some embodiments, the fitness evaluation function expression is:

[0022]

[0023] Among them, V val This represents the verification function. This represents the generated data obtained by mapping the random vector z to the i-th generator; the verification function calculates the accuracy, recall, F1 score and / or Kappa coefficient of the generated data corresponding to each generator as a score.

[0024] In some embodiments, the gradient information of the discriminator involving the publicly available data is clustered, outliers are removed, an average gradient clipping threshold is calculated, and the gradient of the discriminator involving the real data is clipped and noise perturbation is added based on the average gradient clipping threshold, including:

[0025] According to the first loss function Calculate the discriminator gradient v using publicly available data from the publicly available dataset. t-pub The gradient clustering extracts outliers and calculates the average gradient clipping threshold C. s ;

[0026] The gradient of the discriminator, which uses the real data, is clipped according to the average gradient clipping threshold, as expressed in the following way:

[0027]

[0028] Among them, v t-pri Indicates the gradient before pruning. Indicates the gradient after pruning;

[0029] Add noise perturbation to the clipped gradient, expressed as:

[0030]

[0031] in, This represents the gradient after the perturbation. Let σ represent the noise sampled from a Gaussian distribution, where σ represents the noise scale and I is the identity matrix.

[0032] In some embodiments, a fitness evaluation function is constructed to score the generator, and the generator is retained or eliminated according to a set rule based on the score. This includes: sorting the generators in the generator cluster from high to low according to the score, and eliminating a set proportion of the generator individuals with lower scores.

[0033] In some embodiments, individual generators in the generator cluster are used as parent generators. In the crossover stage, the parameters of each parent generator are cut and cross-recombined. In the mutation stage, the parameters of each parent generator are perturbed to obtain child generator individuals to expand the generator cluster. This includes:

[0034] Obtain the first parent generator and the second parent generator, expand the first parameter of the first parent generator and the second parameter of the second parent generator into a one-dimensional vector and align them;

[0035] During the crossover phase, multiple split points are generated based on a random function. The aligned first and second parameters are cut and cross-recombined with reference to the split points to obtain the third and fourth parameters.

[0036] During the mutation phase, multiple random points are generated based on a random function. Random Gaussian noise is added to the positions corresponding to the random points on the third and fourth parameters to obtain a new first and second generation generator. The random Gaussian noise uses hyperparameters to control the noise amplitude.

[0037] On the other hand, the present invention also provides a privacy data publishing system based on generative adversarial networks, the system comprising:

[0038] The data publishing subsystem is used to execute the above-mentioned privacy data publishing method based on generative adversarial networks, generate publishing data for the target privacy data, and publish it.

[0039] The access control subsystem is used to authenticate pre-registered administrators, data publishers, and data users; receive download requests from data users for the published data and forward them to the data publisher; receive feedback from the data publisher regarding the approval or rejection of the download request, configure the data user's permissions based on the feedback results, and provide the data user with a download link or return a download rejection message according to the permissions.

[0040] On the other hand, the present invention also provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0041] On the other hand, the present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described method.

[0042] The beneficial effects of the present invention are at least as follows:

[0043] The privacy-preserving data publishing method, system, and apparatus based on generative adversarial networks (GANs) of this invention use the original dataset to be published and a small number of publicly available datasets with similar attributes that have undergone privacy processing as training data. A generator cluster and a discriminator are constructed based on adversarial learning. Random vectors are used as input to the generator cluster to fit published data that conforms to the attribute characteristics of the original dataset and meets privacy requirements. During the training of the generator cluster module, the performance of the generators is evaluated using a fitness evaluation function, and generators are retained or eliminated based on the evaluation scores. New generators are then generated through crossover and mutation and added to the cluster for subsequent iterative training. During the joint training of the generator cluster module and the discriminator module, differential privacy technology is used for adaptive gradient pruning and noise introduction to protect sensitive data information. This invention can maintain high utility of the published data while ensuring strong privacy protection.

[0044] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0045] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0046] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0047] Figure 1 This is a flowchart illustrating a privacy data publishing method based on generative adversarial networks according to an embodiment of the present invention.

[0048] Figure 2 This is a schematic diagram of the model structure used in the privacy data publishing method based on generative adversarial networks according to an embodiment of the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0050] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0051] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0052] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0053] Privacy-preserving data publishing technologies offer a solution to the privacy leakage problem during data publishing. In recent years, differential privacy technology has provided a standard privacy model for privacy-preserving data publishing. Unlike partition-based privacy models, differential privacy offers a rigorous and quantifiable method for protecting sensitive personal data. Differential privacy satisfies privacy requirements by adding a suitable amount of noise to the statistical results while ensuring that a single individual record in the dataset does not significantly affect the statistical results. Therefore, even if an attacker obtains information about all records in the dataset except for one, differential privacy can still prevent the attacker from inferring the sensitive information of the individual corresponding to that record. However, given the need for strong privacy guarantees, existing privacy-preserving data publishing methods for relational datasets are sensitive to data dimensionality and value range, and the utility of the published data needs improvement.

[0054] One aspect of the present invention provides a method for publishing privacy-preserving data based on generative adversarial networks, such as... Figure 1 As shown, the method includes the following steps S101 to S104:

[0055] Step S101: Obtain the original dataset to be published and the public dataset. The public dataset has the same data attributes as the original dataset and meets the anonymity requirements for public data. The amount of data in the public dataset is smaller than that in the original dataset.

[0056] Step S102: Construct a generator cluster and a discriminator. Each generator in the generator cluster has the same structure. Each generator takes a uniformly distributed random vector as input and outputs generated data. The discriminator takes the generated data, the original dataset, and the public data as input and outputs a binary classification result indicating whether the data belongs to the generated data.

[0057] Step S103: During multiple iterations, the binary classification loss is calculated based on the binary classification results. Based on adversarial learning, the generator cluster and discriminator are alternately trained and updated to minimize the binary classification loss. Specifically, the gradient information of the discriminator using public data is clustered, outliers are removed, and an average gradient pruning threshold is calculated. The gradients of the discriminator using real data are pruned and noise perturbations are added based on the average gradient pruning threshold. A fitness evaluation function is constructed to score the generators. Based on the generators' scores, generators are retained or eliminated according to set rules. Individual generators in the generator cluster are used as parent generators. In the crossover stage, the parameters of each parent generator are cut and cross-recombined. In the mutation stage, the parameters of each parent generator are perturbed to obtain child generator individuals to expand the generator cluster.

[0058] Step S104: After reaching the set number of iterations or the binary classification loss reaches the preset convergence condition, input the random vector into the generator with the highest score to output and publish the data.

[0059] In step S101, the objective of this invention is to train a generator through adversarial learning to generate published data with the same attribute information as the original dataset to be published and in compliance with privacy requirements, based on uniformly distributed random vectors. The data attributes of the public dataset and the original dataset are defined descriptions of data variables. Therefore, the original dataset to be published is introduced for the generator to learn attribute features, while the public dataset is introduced for learning privacy features. In practical applications, publicly available datasets that meet privacy requirements are relatively few; therefore, their data volume will be smaller than that of the original dataset to be published. To meet fitting requirements, the data volume of the public dataset can be set to 10%–20% of the original dataset. Depending on the specific application scenario, the data volume of the public dataset can be adjusted, and is not limited to 10%–20%.

[0060] In step S102, the generator cluster consists of multiple generators with identical structures. The generator structure may include an input layer, a fully connected layer, a transposed convolutional layer, a batch normalization layer, and an output layer. The discriminator can employ models such as logistic regression, decision trees, support vector machines, or multilayer perceptrons. The generator takes random vectors as input and outputs generated data that fits the original data release features and meets privacy release requirements. The core function of the discriminator is to identify whether the input data is generated data, and the output is a binary classification result.

[0061] In step S103, as Figure 2 As shown, the binary classification loss used in the training process of the generator and discriminator comprises three parts. First, a first loss function is constructed based on the recognition results between the generated data and the public data. Its main function is to minimize the distribution difference between the generated data and the public data, ensuring that the data generated by the generator meets privacy requirements. Second, a second loss function is constructed based on the recognition results between the generated data and the original data. Its main function is to minimize the distribution difference between the generated data and the original data, aiming to maintain the utility of the generated data. Finally, a third loss function is constructed based on the recognition results of the generated data from all generators in the generator cluster, aiming to improve the overall generation efficiency and accuracy.

[0062] This process requires introducing a fitness function, using the best-performing data from the generator with the highest score in the generator cluster to calculate the loss. In some embodiments, the fitness evaluation function is expressed as:

[0063]

[0064] Among them, V val This represents the verification function. This represents the generated data obtained by mapping the random vector z to the i-th generator; the validation function calculates the accuracy, recall, F1 score and / or Kappa coefficient of the generated data for each generator as a score.

[0065] Based on this, in some embodiments, the binary classification loss is calculated according to the binary classification result, including steps S201 to S203:

[0066] Step S201: Construct a fitness evaluation function to score the generator, select the optimal generated data output by the generator with the highest score, and calculate the first loss function by combining the binary classification results of the optimal generated data and the publicly available data in the public dataset with the discriminator's analysis. The expression is:

[0067]

[0068] Where m represents the amount of data in the current batch being processed, and z i Represents a random vector. This refers to the generated data. This refers to publicly available data sampled from a public dataset. This indicates the recognition result of the discriminator.

[0069] Step S202: The second loss function for the binary classification results of the optimal generated data and the real data in the original dataset is expressed as:

[0070]

[0071] Where, x i This represents the actual data obtained by sampling from the original dataset.

[0072] Step S203: Construct a third loss function for each individual generator in the generator cluster, with the expression:

[0073]

[0074] in, This indicates that the j-th generator is based on a random vector z. i The generated data obtained.

[0075] Furthermore, during the parameter update process for the generator and discriminator, adaptive gradient pruning and noise introduction are performed based on differential privacy technology to protect sensitive data information. The method of setting the gradient pruning threshold based on a small portion of public data is based on the following idea: as training progresses, the gradient of network information will gradually decrease, thus becoming more sensitive to the pruning threshold. The average threshold of the current batch is adaptively calculated through clustering. On the one hand, this can solve the problem of inaccurate pruning; on the other hand, outliers can be removed during the clustering process, thereby avoiding their impact on the threshold calculation.

[0076] In some embodiments, the gradient information of the discriminator involving publicly available data is clustered, outliers are removed, an average gradient clipping threshold is calculated, and the gradient of the discriminator involving real data is clipped and noise perturbation is added based on the average gradient clipping threshold, including steps S301 to S303:

[0077] Step S301: Based on the first loss function Calculate the discriminator gradient v using publicly available data from the public dataset. t-pub Gradient clustering is used to extract outliers and calculate the average gradient clipping threshold C. s .

[0078] Step S302: Prune the gradient of the discriminator involving real data according to the average gradient pruning threshold, expressed as:

[0079]

[0080] Among them, v t-pri Indicates the gradient before pruning. This represents the gradient after pruning.

[0081] Step S303: Add noise perturbation to the clipped gradient, expressed as:

[0082]

[0083] in, This represents the gradient after the perturbation. Let σ represent the noise sampled from a Gaussian distribution, where σ represents the noise scale and I is the identity matrix.

[0084] Furthermore, for existing generators in the generator cluster, a fitness evaluation function is used to score them, and generators with lower scores are eliminated while generators with higher scores are retained. In some embodiments, a fitness evaluation function is constructed to score the generators, and the generators are retained or eliminated according to the scores and set rules, including: sorting the generators in the generator cluster from highest to lowest score, and eliminating a set proportion of generator individuals with lower scores.

[0085] Furthermore, for individual generators within the generator cluster, parameter crossover and mutation are used to expand the cluster to meet the needs of cluster size. The size of the generator cluster can be adaptively adjusted according to data size or accuracy requirements.

[0086] In some embodiments, individual generators in the generator cluster are used as parent generators. In the crossover stage, the parameters of each parent generator are cut and cross-recombined. In the mutation stage, the parameters of each parent generator are perturbed to obtain child generator individuals to expand the generator cluster. This includes steps S401 to S403:

[0087] Step S401: Obtain the first parent generator and the second parent generator, expand the first parameter of the first parent generator and the second parameter of the second parent generator into a one-dimensional vector and align them.

[0088] Step S402: In the crossover phase, multiple split points are generated based on a random function. The first and second parameters are cut and cross-recombined with reference to the split points to obtain the third and fourth parameters.

[0089] Step S403: In the mutation stage, multiple random points are generated based on a random function. Random Gaussian noise is added to the positions corresponding to the random points on the third and fourth parameters to obtain a new first generation generator and a second generation generator. The random Gaussian noise uses hyperparameters to control the noise amplitude.

[0090] On the other hand, the present invention also provides a privacy data publishing system based on generative adversarial networks, the system comprising:

[0091] The data publishing subsystem is used to execute the privacy data publishing method based on generative adversarial networks described in steps S101 to S104 above, and to generate and publish the target privacy data.

[0092] The access control subsystem is used to authenticate pre-registered administrators, data publishers, and data users; receive download requests from data users for published data and forward them to the data publisher; receive feedback from the data publisher regarding the approval or rejection of download requests, configure permissions for data users based on the feedback, and provide download links to data users or return a message indicating that download is denied according to their permissions.

[0093] The data publishing subsystem and the access control subsystem can be deployed on cloud servers or distributed clustered blockchain networks.

[0094] On the other hand, the present invention also provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0095] On the other hand, the present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described method.

[0096] The present invention will now be described with reference to a specific embodiment:

[0097] This embodiment provides a method and system for publishing privacy-preserving data. Based on generative adversarial networks, a generator that has undergone final training generates data for publication, and the system completes the data publication and usage. The technical solutions of various specific embodiments of this application are described below.

[0098] In a first aspect, the present invention provides a method for publishing privacy-protected data, referring to... Figure 1 The generative adversarial network includes a generator network cluster and a discriminator network, and the method includes the following steps:

[0099] S2: Use the original sensitive dataset and the public dataset as training datasets to train the generator cluster module and the discriminator module;

[0100] Set the generator cluster size to s, and initialize each generator G in the generator cluster. i The network parameters are determined by inputting a uniformly distributed random vector z (usually random noise following a Gaussian distribution) into the optimal individual G in the generator cluster module. best In the middle, obtain the generated data G of the current iteration. best (z);

[0101] Combine the generated data from the current iteration of the generator with the publicly available data extracted from the public dataset. The input is fed into the discriminator network D of the generative adversarial network;

[0102] The discriminator determines whether the input data to the network is generated data or publicly available data based on a binary classification method. According to the discriminator's objective, the objective function can be expressed as:

[0103]

[0104] Where m represents the amount of data in the current batch being processed, and z i Represents a random vector. This refers to the generated data. This refers to publicly available data sampled from a public dataset. This indicates the recognition result of the discriminator.

[0105] The generated data output by the current iteration of the generator is compared with the real data extracted from the original sensitive dataset. The input is fed into the discriminator network of the generative adversarial network;

[0106] The discriminator determines whether the input data to the network is generated data or real data based on a binary classification method. According to the discriminator's objective, the objective function can be expressed as:

[0107]

[0108] Where, x i This represents the actual data obtained by sampling from the original dataset.

[0109] The gradient information of the discriminator, which is based on real data, is calculated using the discriminator loss function of the generative adversarial network.

[0110] The generator network cluster is updated based on the updated discriminator network, resulting in an updated generator cluster for the next iteration. The objective function for each individual generator in the generator cluster is:

[0111]

[0112] in, This indicates that the j-th generator is based on a random vector z. i The generated data obtained.

[0113] S3: During the training of the generator cluster module, the performance of the generator is evaluated by the fitness evaluation function, and the generator is retained or eliminated based on the evaluation score. Then, new generators are generated through crossover and mutation and added to the cluster for subsequent iterative training.

[0114] Specifically, in the current iteration, the generator's performance score in terms of the quality and diversity of the generated data is calculated using the fitness function formula. The fitness function formula is expressed as:

[0115]

[0116] Among them, V val This represents the verification function. This represents the generated data obtained by mapping the i-th generator to the random vector z; the validation function calculates the accuracy, recall, F1 score, and / or Kappa coefficient of each generator's generated data as a score. It aims to evaluate the data quality of the generated data and is obtained through training on an external validation set. Specifically, during the parameter warm-up stage of the generative adversarial network, public data is introduced to train the classifier model. Because the classifier... The training data does not involve sensitive data, therefore the training process is free from privacy concerns, providing a highly accurate standard for evaluating the generated data. Subsequently, with the help of a classifier... The above verification function V was designed and implemented. val Similar to the data quality assessment method in EAGAN, the verification function V... val The input is the generator cluster Each individual network For the same random sample z mapped to different data samples, the output is determined by the classifier. The average classification accuracy is calculated after class mapping of the samples. Furthermore, the evaluation function F(·) ensures fairness in the competition, and each individual generator network... The only difference is the network parameters; for the same input data, there is no difference in fit due to different network depths.

[0117] Based on the performance scores, the individual generators in the generator cluster are sorted, and the generators with better performance are retained while the generators with poor performance are removed; the selection process can be represented as follows:

[0118]

[0119] The crossover and mutation phase is the phase that generates new individuals. After the selection phase, which involves screening and elimination, the remaining generator cluster is... Each individual generator Both can serve as parent generators, and parent generators exchange "genes," i.e., parameter information, to produce new generator individuals. Assume the two selected parent generators are... and As can be seen from the above-described construction stages of the generator population, the generator individual is actually a solution for neural network parameter selection. During the crossover stage, the algorithm will... and The parameter (θ) α and θ βExpanding to a one-dimensional vector, a network parameter split point is generated by a random function, and the parameter information θ is processed. α and θ β By performing cutting and cross-combination, two new sub-generators were generated. and and add it to the generator cluster. In the middle stage, after the crossover stage, another step that heuristically modifies the generator network parameter information is the mutation stage. The initial work in the mutation stage is the same as in the crossover stage: the network parameter information is unfolded and a random point is generated. Then, the network parameter information at this random point is perturbed within a small range by adding random Gaussian noise λN(0,1), where λ represents the noise amplitude hyperparameter adjusted according to the network parameter information.

[0120] After the above stages, new generator network individuals are obtained; these generator network individuals are added to the generator cluster, and the process of generating new generator individuals is repeated until the number of generator clusters reaches a preset scale.

[0121] S4: During the joint training of the generator cluster module and the discriminator module, adaptive gradient pruning and noise introduction are performed based on differential privacy technology to protect sensitive data information. Specifically:

[0122] According to the first loss function Calculate the discriminator gradient v using publicly available data from the public dataset. t-pub Gradient clustering is used to extract outliers and calculate the average gradient clipping threshold C. s .

[0123] In this embodiment, the method of setting the gradient pruning threshold based on a small portion of publicly available data is based on the following idea: as training progresses, the gradient of network information will gradually decrease, thus becoming more sensitive to the pruning threshold. The average threshold of the current batch is adaptively calculated through clustering. On the one hand, this can solve the problem of inaccurate pruning; on the other hand, outliers can be removed during the clustering process, thereby avoiding their impact on the threshold calculation.

[0124] The gradient of the discriminator, which involves real data, is clipped according to the gradient clipping threshold, as follows:

[0125]

[0126] Among them, v t-pri Indicates the gradient before pruning. This represents the gradient after pruning.

[0127] The discriminator update parameters are obtained by perturbing the clipped gradient with noise sampled from a Gaussian distribution. The perturbed gradient information is represented as follows:

[0128]

[0129] in, This represents the gradient after the perturbation. Let σ represent the noise sampled from a Gaussian distribution, where σ represents the noise scale and I is the identity matrix.

[0130] S5: Input the random vector into the trained generator network G best Obtain the expected amount of generated data as the published data.

[0131] In a second aspect, the present invention provides a privacy-preserving data publishing system based on generative adversarial networks, the system comprising a permission management system module and a data publishing system module:

[0132] The system includes three types of users: administrators, data publishers, and data users.

[0133] The data publishing system module is configured so that after the data publisher logs into the system, they upload raw sensitive data. The system then matches publicly available data based on the attributes of the sensitive data. Upon successful matching, the data publisher configures data publishing-related information, including parameters for the generator network cluster, the discriminator network cluster, differential privacy processing, and the final published data. After configuring these parameters, the publisher submits the publishing task. Once the training and publishing process is complete, the publisher confirms the data information and submits a data description, thus completing the data publishing process. Furthermore, during the data publishing process, the data publisher can manage the task by selecting "wait," "restart," or "delete" based on the task status.

[0134] The access control system module is configured so that after the data publisher completes data publishing, the data user logs into the system to view the published data information. After confirming the description information, the data user sends a data download request to the system. The data publisher logs into the system and processes the download request, either approving or rejecting it. Subsequently, the data user confirms their data usage rights based on the processing feedback. Users with data usage rights can then download and use the data. Furthermore, the system has a function for managing and revoking permissions.

[0135] For comparison, the widely used real-world dataset Adult was used for experimental validation. The Adult dataset contains 48,842 U.S. Census records.

[0136] This method is evaluated following standard practices for data publishing tasks, namely, measuring the utility of the published data through the effectiveness of machine learning. This embodiment first trains a predictive model using the published data, and then tests the trained predictive model on a real test set. Higher accuracy of the predictive model indicates better data usability.

[0137] Table 1 shows the algorithm performance parameters of four typical prediction models (logistic regression (LR), decision tree (DT), support vector machine (SVM), and multi-layer perception (MLP)) on the Adult dataset.

[0138] Table 1. Accuracy parameters of different prediction models on the Adult dataset.

[0139]

[0140] It can be observed that the proposed method DP-RGAN and its weakened version DP-RGAN- have good performance in data publishing tasks, specifically:

[0141] (1) DP-RGAN has shown the best performance among various prediction models. After optimization by two methods, gradient clustering pruning based on a small portion of publicly available data and generator parameter selection based on genetic algorithm, the data released by DP-RGAN is close to the NonPrivate version without privacy noise, and is also better than the method of calculating the average gradient pruning threshold based on a small portion of publicly available data.

[0142] (2) DP-RGAN also showed good performance, outperforming other benchmark algorithms for differential privacy noise processing. Although DP-RGAN is not as good as DP-RGAN because the generator parameter selection strategy based on genetic algorithm is removed in DP-RGAN, it can be proven that the proposed strategy can fully capture the distribution characteristics of relational data under a certain privacy budget, thereby improving the utility of published data.

[0143] This embodiment provides a system architecture diagram of the data publishing system. The system adopts a web system architecture design, with the interaction layer, service layer, and data management layer arranged from top to bottom. The system has three types of users: data publishers, data users, and system administrators. System administrators are primarily responsible for user maintenance and optimization. Data publishers upload and publish data through the data publishing module and configure relevant parameters for privacy protection. Data users log in to the system, select data of interest, submit a usage request, and can only download the data and perform subsequent data analysis after the data publisher approves it.

[0144] Corresponding to the above method, the present invention also provides an apparatus / system including a computer device, the computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the apparatus / system performs the steps of the method as described above.

[0145] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0146] In summary, the privacy-preserving data publishing method, system, and apparatus based on generative adversarial networks described in this invention use the original dataset to be published and a small number of publicly available datasets with similar attributes that have undergone privacy processing as training data. A generator cluster and a discriminator are constructed based on adversarial learning. Random vectors are used as input to the generator cluster to fit published data that conforms to the attribute characteristics of the original dataset and meets privacy requirements. During the training of the generator cluster module, the performance of the generators is evaluated using a fitness evaluation function, and generators are retained or eliminated based on the evaluation scores. New generators are then generated through crossover and mutation and added to the cluster for subsequent iterative training. During the joint training of the generator cluster module and the discriminator module, differential privacy technology is used for adaptive gradient pruning and noise introduction to protect sensitive data information. This invention can maintain high utility of the published data while ensuring strong privacy protection.

[0147] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0148] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0149] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0150] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for publishing privacy-preserving data based on generative adversarial networks, characterized in that, The method includes the following steps: Obtain the original dataset to be published and the public dataset, wherein the public dataset has the same data attributes as the original dataset and meets the anonymity requirements for public data publication; Construct a generator cluster and a discriminator. Each generator in the generator cluster has the same structure. Each generator takes a uniformly distributed random vector as input and outputs generated data. The discriminator takes the generated data, the original dataset, and the public data as input and outputs a binary classification result indicating whether the data belongs to the generated data. In multiple iterations, a binary classification loss is calculated based on the binary classification results. Based on adversarial learning, the generator cluster and the discriminator are alternately trained and updated to minimize this loss. Specifically, the gradient information of the discriminator using publicly available data is clustered, outliers are removed, and an average gradient pruning threshold is calculated. The gradient of the discriminator using real data is pruned and noise perturbation is added based on this average gradient pruning threshold. A fitness evaluation function is constructed to score the generators, and generators are retained or eliminated according to set rules based on their scores. Individual generators in the generator cluster are used as parent generators. In the crossover stage, the parameters of each parent generator are cut and cross-recombined. In the mutation stage, the parameters of each parent generator are perturbed to obtain child generator individuals to expand the generator cluster. After reaching the set number of iterations or after the binary classification loss reaches the preset convergence condition, the random vector input to the generator with the highest score outputs the published data and publishes it.

2. The privacy data publishing method based on generative adversarial networks according to claim 1, characterized in that... The amount of data in the public dataset is smaller than that in the original dataset; The data attributes of the public dataset and the original dataset are definitions and descriptions of data variables.

3. The privacy data publishing method based on generative adversarial networks according to claim 1, characterized in that, The binary classification loss is calculated based on the binary classification results, including: An fitness evaluation function is constructed to score the generator. The optimal generated data output by the generator with the highest score is selected. A first loss function is then calculated by combining the binary classification results of the optimal generated data and the publicly available data in the public dataset, using the discriminator as the comparison. The expression is as follows: Where m represents the amount of data in the current batch being processed, and z i Represents a random vector. This refers to the generated data. This refers to publicly available data sampled from the aforementioned public dataset. This indicates the recognition result of the discriminator; The second loss function for the binary classification results of the optimal generated data and the real data in the original dataset is expressed as: Where, x i This represents the actual data sampled from the original dataset; For each individual generator in the generator cluster, a third loss function is constructed, expressed as: in, This indicates that the j-th generator is based on the random vector z. i The generated data obtained.

4. The privacy data publishing method based on generative adversarial networks according to claim 3, characterized in that, The fitness evaluation function is expressed as follows: Among them, V val This represents the verification function. This represents the generated data obtained by mapping the random vector z to the i-th generator; the verification function calculates the accuracy, recall, F1 score and / or Kappa coefficient of the generated data corresponding to each generator as a score.

5. The privacy data publishing method based on generative adversarial networks according to claim 1, characterized in that, The gradient information of the discriminator using the publicly available data is clustered, outliers are removed, an average gradient clipping threshold is calculated, and the gradient of the discriminator using the real data is clipped and noise perturbation is added based on the average gradient clipping threshold, including: According to the first loss function Calculate the discriminator gradient v using publicly available data from the publicly available dataset. t-pub The gradient clustering extracts outliers and calculates the average gradient clipping threshold C. s ; The gradient of the discriminator, which uses the real data, is clipped according to the average gradient clipping threshold, as expressed in the following way: Among them, v t-pri Indicates the gradient before pruning. This represents the gradient after pruning. Add noise perturbation to the clipped gradient, expressed as: in, This represents the gradient after the perturbation. Let σ represent the noise sampled from a Gaussian distribution, where σ represents the noise scale and I is the identity matrix.

6. The privacy data publishing method based on generative adversarial networks according to claim 4, characterized in that, A fitness evaluation function is constructed to score the generator, and the generator is retained or eliminated according to the score and a set rule. This includes: sorting the generators in the generator cluster from high to low according to the score, and eliminating a set proportion of the generator individuals with lower scores.

7. The privacy data publishing method based on generative adversarial networks according to claim 4, characterized in that, Using individual generators in the generator cluster as parent generators, the parameters of each parent generator are cut and cross-recombined in the crossover stage, and the parameters of each parent generator are perturbed in the mutation stage to obtain child generator individuals to expand the generator cluster, including: Obtain the first parent generator and the second parent generator, expand the first parameter of the first parent generator and the second parameter of the second parent generator into a one-dimensional vector and align them; During the crossover phase, multiple split points are generated based on a random function. The aligned first and second parameters are cut and cross-recombined with reference to the split points to obtain the third and fourth parameters. During the mutation phase, multiple random points are generated based on a random function. Random Gaussian noise is added to the positions corresponding to the random points on the third and fourth parameters to obtain a new first and second generation generator. The random Gaussian noise uses hyperparameters to control the noise amplitude.

8. A privacy-preserving data publishing system based on generative adversarial networks, characterized in that, The system includes: A data publishing subsystem is used to execute the privacy data publishing method based on generative adversarial networks as described in any one of claims 1 to 7, to generate and publish target privacy data; The access control subsystem is used to authenticate pre-registered administrators, data publishers, and data users; receive download requests from data users for the published data and forward them to the data publisher; receive feedback from the data publisher regarding the approval or rejection of the download request, configure the data user's permissions based on the feedback results, and provide the data user with a download link or return a download rejection message according to the permissions.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 7.

Images