Confusion clustering federal learning method and system for protecting preference privacy of client
By introducing obfuscated clustered federated learning methods in federated learning, the client sends local updates to multiple clusters, solving the problem of clustered identity inference preference for privacy and achieving effective protection of client-preferred privacy.
Patent Information
- Application Number
- CN202411826732.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2025-04-04
AI Technical Summary
In the prior art, it is difficult to effectively protect the client's data distribution preference privacy in federated learning. Especially in clustered federated learning, an attacker or server can infer its data distribution preference through the client's clustered identity, resulting in privacy leakage.
A confusing cluster federated learning method is proposed. The client can spontaneously send local updates to multiple clusters, so that the server cannot directly infer its preferences through the cluster to which the client belongs. This method includes steps such as server initialization, client local update and cluster identity generation, homomorphic encryption and model aggregation, and client reconstruction accurate clustering models.
Effectively protect client preference privacy, prevent preference analysis attacks, and do not rely on trusted third parties, and can achieve privacy protection while maintaining model performance.
Smart Images
Figure CN119761461A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the fields of privacy protection and federated learning, and in particular to a confusion clustering federated learning method and system for protecting client preference privacy. Background Art
[0002] Federated learning, as a distributed machine learning method, allows multiple clients to collaboratively train machine learning models under the coordination of a server without storing data in a central server, effectively reducing the risk of privacy leakage. However, a major challenge of federated learning in practice is the statistical heterogeneity of client data. Since the data is generated by each client, the data distribution varies depending on the client's personal preferences. Local training on heterogeneous data can lead to local optimal deviations, and the differences in model updates between clients increase. Aggregating these model updates may offset each other, resulting in degraded model performance.
[0003] Existing solutions introduce the cluster federated learning (CFL) framework to address the data heterogeneity problem in federated learning. Specifically, cluster federated learning groups clients with similar data distribution into a cluster and performs federated learning training within the cluster. Ultimately, cluster federated learning trains a personalized model for each cluster. However, in cluster federated learning, attackers or servers can easily obtain the cluster identity of the client and analyze the client's data distribution preference. For example, in an image classification task, a cluster federated learning server publishes a set of training tasks to identify images with different labels, such as cars, buildings, food, etc. Clients whose data distribution is biased towards car images will be assigned to the same cluster. Therefore, an honest and curious cluster federated learning server can easily infer that all clients in the same cluster prefer car-related images, resulting in privacy leakage.
[0004] To address the above issues, existing anonymous federated learning methods based on onion routing attempt to protect the client identity and avoid direct association between it and model parameters or data clustering. However, due to the communication characteristics of iterative model updates, the client's anonymity is vulnerable to traffic analysis attacks. In addition, some defense measures use secure aggregation technology to prevent the server from inferring the client's data distribution preferences from model parameters. Although the server cannot directly infer the client's privacy preferences through model parameters, it can still bypass these defenses by combining traffic analysis with the reasoning ability of clustering information to infer the client's data distribution preferences. Summary of the invention
[0005] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a confused clustering federated learning method in which a client can spontaneously send local updates to multiple clusters, so that the aggregation server of federated learning cannot directly infer the preference of the client through the cluster to which the client belongs, and at the same time rebuild the clustering model to prevent performance degradation.
[0006] In order to solve the above technical problems, the technical solution proposed in the present invention is: a confusion clustering federated learning method for protecting the privacy of client preferences, comprising the following steps:
[0007] S1, the server is initialized according to the number of clusters of the task;
[0008] S2, the server sends the privacy threshold and the model, public key and address of each cluster to the client;
[0009] S3, after receiving the clustering model and other parameters, the client determines the true cluster identity and updates the model locally using local data;
[0010] S4, the client generates multiple indistinguishable obfuscated cluster identities according to the obfuscation ratio;
[0011] S5, the client homomorphically encrypts the local model and identifier, and sends it and the obfuscated cluster identity to the server;
[0012] S6, the server aggregates the client local models in the same cluster according to the obfuscated cluster identity, and sums the identifiers in the encrypted domain;
[0013] S7, the server sends the aggregated confusion clustering model and confusion coefficient matrix to the client;
[0014] S8, the client establishes a non-homogeneous linear equation and reconstructs the clustering model by calculating and solving it;
[0015] S9, judging whether the reconstructed accurate clustering model meets the preset conditions, if yes, the learning process ends, otherwise jumps to S3 for the next round of training.
[0016] Furthermore, the initialization of the server in step S1 includes: the server pre-trains a model for each cluster using public data according to the number of clusters of the published task. And generate a public key dpk j and address dsk j , and then determine the confusion ratio p. At the same time, the server also sets a privacy threshold T.
[0017] Furthermore, the method of generating indistinguishable cluster identities in step S4 includes: the client maps the target cluster address and the public keys of other clusters into binary bits and compares them respectively, and prevents clients with the same cluster identity from generating the same cluster identity set.
[0018] Furthermore, after the step S4 generates multiple indivisible cluster identities, it is also necessary to check whether the current cluster identity set can protect the client privacy. If the number of cluster identities does not reach the privacy threshold, the cluster identity is regenerated, and an encrypted identifier is generated based on the client's cluster identity.
[0019] Furthermore, the method for aggregating the confusion clustering model by the server in step S6 includes: the server assigns model updates to different confusion clusters according to the confusion cluster identity of the client, and performs confusion aggregation on all model updates in the same cluster to obtain a confusion model. At the same time, the server also needs to aggregate the identifier of each confusion cluster to obtain a confusion coefficient matrix.
[0020] Furthermore, after the server performs the confusion clustering model aggregation in step S6, the server also needs to aggregate the identifier of each confusion cluster. The server can determine the number of real clients in the confusion cluster and the number of misjudged clients assigned to other clusters, thereby determining the confusion coefficient matrix.
[0021] Furthermore, the method for the client to reconstruct the accurate clustering model in step S8 includes: the client establishes a non-homogeneous linear equation according to the aggregation formula and the confusion coefficient matrix of the confusion clustering model, and obtains the accurate clustering model by solving the linear equation group.
[0022] Furthermore, in step S1, the obfuscation ratio p can be dynamically adjusted to meet different privacy utility considerations, and the server can adjust p at any time by generating public keys and addresses of different lengths.
[0023] Compared with the prior art, the advantages of the present invention are:
[0024] 1. This paper proposes a framework for obfuscated clustering federated learning that protects the privacy of client preferences. It solves the privacy leakage problem of preference analysis attacks caused by the exposure of client cluster identities in clustering federated learning, and does not need to rely on a trusted third party.
[0025] 2. The present invention designs and implements a method for generating indistinguishable cluster identities. The client can randomly generate multiple cluster identities and send them to the server, so that attackers cannot perform preference analysis on the client through the cluster identities.
[0026] 3. The present invention designs and implements a clustering model reconstruction method. A non-homogeneous set of equations is constructed using a confusion coefficient matrix and a confusion clustering model, and the solution is used to obtain an accurate reconstructed model, which greatly improves the model performance compared to the confusion clustering model. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] Figure 1 It is a schematic diagram of a flow chart of a specific embodiment of the present invention.
[0028] Figure 2 It is a schematic diagram of the accuracy of preference analysis attack according to a specific embodiment of the present invention.
[0029] Figure 3 The figure compares the model accuracy of the specific embodiment of the present invention with the existing solutions (IFCA, FedProx).
[0030] Figure 4 The following is a comparison of the convergence curves of the specific embodiment of the present invention and the existing solution model in uniform clustering.
[0031] Figure 5 It is the computational cost of each method under different parameters of the specific embodiment of the present invention. DETAILED DESCRIPTION
[0032] The present invention is further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.
[0033] like Figure 1 As shown, the obfuscated clustering federated learning framework for protecting client preference privacy in this embodiment includes a client and a server. The client is mainly responsible for using the obfuscated clustering model sent by the server to rebuild an accurate model to eliminate interference, identify the cluster in which it is located and train it on the local data set, generate multiple indivisible cluster identities and send its local model to these clusters. The server is mainly responsible for initializing the model, address and public key for each cluster, setting a privacy threshold, and performing obfuscated aggregation on the local model.
[0034] In this example, in the initialization step, the server generates a public key dpk for each cluster using formula (1) j and an address dsk j .
[0035]
[0036] where g is a generator of a cyclic group G with prime order q, and x l ∈Z ( ,and For l∈[n], the length of the public key and address and the confusion ratio p=2 -n Related.
[0037] In this example, the aggregation server also sets a privacy threshold T, and the client needs to generate at least T cluster identities. Then, the aggregation server publishes the address, public key, and initialized model of each cluster to all clients.
[0038] In this embodiment, an indistinguishable cluster identity generation method is also included. In each round t, client i uses formula (2) to find the model with the minimum loss to estimate its cluster identity
[0039]
[0040] Among them, F i (·) is the loss function of client i. If the true cluster identity has changed compared with the previous round, client i will and Generate its indistinguishable cluster identity set CI i . Otherwise, it will retain the clustering identity from the previous round.
[0041] In this embodiment, for each generation of a cluster identity by each client, the client first generates a private random number r and calculates u←g r This r and u are used to prevent The same set of cluster identities is generated by the clients of . The algorithm loops through each cluster j in the range [k]. If H:G→{0,1} is modeled as a random oracle, the client will determine whether it belongs to cluster j according to formula (3).
[0042]
[0043] In this embodiment, all clusters are checked, and the client starts to check whether the cluster identity of the current round can protect its privacy. i |If the privacy threshold T is not reached, the client will select a new random number to regenerate the cluster identity until the privacy requirement is met.
[0044] In this embodiment, the client uses a homomorphic encryption algorithm to encrypt its local model and uses formula (4) to convert the client's cluster identity Generate an encrypted identifier
[0045]
[0046] HE(·) indicates homomorphic encryption. The value of is 1, and the rest are 0. These identifiers will be used to count the number of clients in each cluster for use in cluster model reconstruction.
[0047] In this embodiment, the client sends the encrypted local model parameters, the encrypted identifier, and the cluster identity set to the server. Without any additional information, the aggregation server cannot distinguish CI i The client's local model will be assigned to the cluster identity in CI i Clustering in .
[0048] In this embodiment, the obfuscation ratio p is fixed during the training process, and the privacy protection algorithm can be formalized. In fact, p can be adjusted dynamically to meet different privacy utility considerations. The server can adjust p at any time by generating public keys and addresses of different lengths.
[0049] In this embodiment, a confusion clustering model aggregation method is also included. After all clients send their model update messages to the server, the server starts to aggregate the models based on the client's identity set. Confused clusters are constructed, and the local models and their identifiers of each cluster are aggregated. The server first distributes model updates to different clusters according to the client's cluster identity. After confusion, each cluster contains not only the local models that truly belong to the cluster, but also some local models from other clusters. For the jth confused cluster G j , the server uses formula (5) to confuse the clustering model in the homomorphic encryption domain Perform aggregation.
[0050]
[0051] The indicator function I(j∈CI i ) means that if element j exists in the set CI i Its value is 1, otherwise its value is 0.
[0052] In this embodiment, the server also needs to aggregate the identifiers of each obfuscated cluster. By summing the k identifiers in the obfuscated cluster, the server can determine the number of real clients in the cluster and the number of misjudged clients assigned to other clusters. For the bth encrypted identifier of the ath obfuscated cluster, use formula (6) for aggregation.
[0053]
[0054] These identifiers form a confusion coefficient matrix H k×k ={x a,b},(a,b=1,2,...,k), where x a,b Represents clustering The number of clients in the confusion cluster G a The aggregation result is represented as HE(H k×k ). The server will encrypt the obfuscated model The size of the confusion cluster And the encrypted confusion coefficient matrix HE(H k×k ) is sent to all clients.
[0055] In this embodiment, a clustering model reconstruction method is also included. Since the confusion model cannot be used directly, the client needs to reconstruct the accurate model before the next round of training. The confusion model can be expressed as:
[0056]
[0057] in For an accurate model, To confuse to cluster G j From clustering The number of local models.
[0058] In this embodiment, based on formula (7), the expressions of all the confusion models are combined to form a linear equation system with the accurate model as the unknown quantity:
[0059]
[0060] Among them, H k×k is a confusion coefficient matrix, is the confusion model matrix, is the accurate model matrix. Through the above equation, the problem of reconstructing the clustering model can be transformed into solving a non-homogeneous linear equation system. Solving equation (8) is the reconstructed clustering model
[0061] In this embodiment, the technical solution is verified by simulation experiments, and PyTorch is used for model training. In the simulation experiment, the system consists of 1 aggregation server and 120 client devices. Each client iterates locally on its own training data set for 5 times in each round of training. In this embodiment, different models are used for testing for different data sets. For MNIST and Fashion MNIST, a fully connected neural network with two fully connected layers and one hidden layer is used. For CIFAR-10, a convolutional neural network with two convolutional layers and three fully connected layers is used. For Texas100, an MLP model is used. The data sets are all set to be non-independent and identically distributed, in which all labels of the data sets are divided into several label sets, where each cluster corresponds to a label set. The training data in the same label set are randomly assigned to the client. In uniform clustering, each label set has the same size, and each cluster has an equal number of clients. In non-uniform clustering, the data set labels can be arbitrarily partitioned, and the client allocation is based on the ratio between the label sets.
[0062] In this simulation experiment, the defensive performance of this technical solution against preference analysis attacks was tested. Figure 2 As shown in the figure, under different confusion ratios, cluster numbers and privacy thresholds, the defense performance of preference analysis attacks will be affected to a certain extent, but the attacker's preference analysis accuracy remains at a low level, and the highest preference analysis success probability is still below 0.40. This proves that this technical solution has a high effectiveness against preference analysis attacks.
[0063] This technical solution is compared with the existing federated learning solutions IFCA and FedProx, with default parameters: the number of clusters is 5, the number of clients is 120, the confusion ratio is 0.5, and the privacy threshold is 2. Figure 3 It can be seen that on different data sets, this technical solution has higher model accuracy than FedProx. Compared with the defenseless clustering federated learning IFCA, the maximum difference in model accuracy is only 0.74% in the case of uniform clustering, and the maximum difference in model accuracy is only 3.32% in the case of non-uniform clustering. Figure 4 As shown in the figure, the convergence curves of this technical solution and IFCA are similar. This proves that this technical solution can achieve privacy protection while having little impact on the model and maintaining a high model accuracy.
[0064] In this simulation experiment, the computational overhead of each method under different parameters is also calculated. Taking the Texas100 dataset as an example, the overhead is mainly affected by the confusion ratio p, the privacy threshold T, the number of clusters k, and the number of clients N. Figure 5As shown in the figure, the cluster identity generation time of each client does not exceed 0.2s, and the cluster model reconstruction time does not exceed 0.4s. The model aggregation of the server is performed in the CKKS homomorphic encryption domain, and the average aggregation cost of each local model is 0.03s. This proves that the computational cost of this technical solution is small.
[0065] The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope of the technical solution of the present invention.
Claims
1. A method and system for confounding clustering federated learning that protects client preference privacy, characterized in that: The steps include: S1, the server is initialized according to the number of clusters of the task; S2, the server sends the privacy threshold and the model, public key and address of each cluster to the client; S3, after receiving the clustering model and other parameters, the client determines the true cluster identity and updates the model locally using local data; S4, the client generates multiple indistinguishable obfuscated cluster identities according to the obfuscation ratio; S5, the client homomorphically encrypts the local model and identifier, and sends it and the obfuscated cluster identity to the server; S6, the server aggregates the client local models in the same cluster according to the obfuscated cluster identity, and sums the identifiers in the encrypted domain; S7, the server sends the aggregated confusion clustering model and confusion coefficient matrix to the client; S8, the client establishes a non-homogeneous linear equation and reconstructs the clustering model by calculating and solving it; S9, judging whether the reconstructed accurate clustering model meets the preset conditions, if yes, the learning process ends, otherwise jumps to S3 for the next round of training.
2. According to claim 1, the method and system for confounding clustering federated learning for protecting client preference privacy is characterized in that: The initialization of the server in step S1 includes: the server pre-trains a model for each cluster using public data according to the number of clusters of the published task And generate a public key dpk j and address dsk j , and then determine the confusion ratio p. At the same time, the server also sets a privacy threshold T.
3. The method and system for confounding clustering federated learning for protecting client preference privacy according to claim 2, characterized in that: The method of generating indistinguishable cluster identities in step S4 includes: the client maps the target cluster address and the public keys of other clusters into binary bits and compares them respectively, and prevents clients with the same cluster identity from generating the same cluster identity set.
4. The method and system for confounding clustering federated learning for protecting client preference privacy according to claim 3, characterized in that: After the step S4 generates multiple indivisible cluster identities, it is also necessary to check whether the current cluster identity set can protect the client privacy. If the number of cluster identities does not reach the privacy threshold T, the cluster identity is regenerated and an encrypted identifier is generated based on the client's cluster identity.
5. According to claim 4, the method and system for confounding clustering federated learning for protecting client preference privacy is characterized in that: The method for aggregating the confusion clustering models by the server in step S6 includes: the server assigns model updates to different confusion clusters according to the confusion cluster identities of the clients, performs confusion aggregation on all model updates in the same cluster to obtain a confusion model, and the server also needs to aggregate the identifiers of each confusion cluster to obtain a confusion coefficient matrix.
6. The method and system for obfuscated clustering federated learning for protecting client preference privacy according to claim 5, characterized in that: After the server performs the confusion clustering model aggregation in step S6, the server also needs to aggregate the identifier of each confusion cluster. The server can determine the number of real clients in the confusion cluster and the number of misjudged clients assigned to other clusters, thereby determining the confusion coefficient matrix.
7. The method and system for obfuscated clustering federated learning for protecting client preference privacy according to claim 6, characterized in that: The method for the client to reconstruct the accurate clustering model in step S8 includes: the client establishes a non-homogeneous linear equation according to the aggregation formula and the confusion coefficient matrix of the confusion clustering model, and obtains the accurate clustering model by solving the linear equation group.
8. The method and system for obfuscated clustering federated learning for protecting client preference privacy according to claim 2, characterized in that: In step S1, the obfuscation ratio p can be dynamically adjusted to meet different privacy utility considerations, and the server can adjust p at any time by generating public keys and addresses of different lengths.