Training data privacy protection method suitable for zero-trust distributed model training scene
By dividing clients into groups in federated learning and splitting and combining them in gradients to form obfuscated data packets, the problem of data privacy protection in federated learning is solved, and efficient data privacy protection is achieved without affecting model accuracy.
Patent Information
- Application Number
- CN202411912016.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-24
- Publication Date
- 2025-04-08
AI Technical Summary
In federated learning, participants may snoop on the client’s training data, and existing defense methods can lead to a decrease in model accuracy.
By dividing the client into groups, the gradient of one client in every three clients is divided into two shares and merged with the perturbation of other clients to form obfuscated gradient packets and uploaded to the server for aggregation.
It realizes privacy protection for client data in a zero-trust environment, preventing malicious participants from stealing data through gradient inversion attacks, and avoiding the degradation of model accuracy caused by noise introduction.
Smart Images
Figure CN119783160A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the training field of artificial intelligence models, large language models and other models, and more specifically, to a distributed model training scenario of federated learning, and specifically to a training data privacy protection method suitable for a zero-trust distributed model training scenario. Background Art
[0002] With the booming development of technologies such as artificial intelligence and large models, data and the algorithms or models driven by them have become important resources that cannot be ignored in this era. At present, the amount of data is increasing, but the problem of "data islands" is also becoming more and more serious. For example, in the field of intelligent connected vehicle industry, many well-known car companies have emerged at home and abroad, such as Tesla, BYD, Xiaomi, Ideal, Weilai, etc. Their vehicle platforms are all known for their intelligence, and the intelligent models they rely on require huge amounts of data support. In the field of embodied intelligent robots, robots need the support of large language model capabilities to achieve autonomous decision-making and control of robots, which also requires huge amounts of data support. However, due to the improvement of privacy protection laws and regulations at home and abroad, user privacy and commercial confidentiality requirements, it is difficult for enterprises to exchange original data, and each enterprise provides independent services. It is difficult for overall collaboration and technical level to achieve breakthrough development in a short period of time.
[0003] In order to protect data privacy and solve the problem of "data islands", federated learning was born. Without leaking private data, federated learning can enable different clients to jointly train a global model. The federated learning system consists of multiple clients and a server. Each client will train a model locally based on its own training data. The gradient updates of these models are uploaded to the server and aggregated to jointly train a global model. The server then feeds the global model back to each client for the next training iteration. Since the client only uploads local gradient updates to the server each time, its data privacy is protected. However, federated learning participants are untrustworthy and will snoop on the client's training data, thereby infringing the client's privacy.
[0004] The gradient information uploaded by the client to the server contains the client's private training data information. The malicious server will reconstruct the training data through the uploaded gradient information, which is a gradient inversion attack. Existing defense methods mainly focus on the ideas based on differential privacy and secure aggregation, but existing methods have many limitations. First, the method based on differential privacy will reduce the overall performance of the central server aggregation model by adding noise. For example, the client gradient data is processed by parameter clipping and adding Gaussian noise to limit the gradient size and protect data privacy. However, since the server cannot access the training data, it is impossible to accurately analyze the noise during gradient aggregation and eliminate the impact of adding noise to the gradient on the global model, which reduces its accuracy. Summary of the invention
[0005] In order to solve the technical problem that federated learning participants may snoop on the training data of the client and the existing defense methods will cause the model accuracy to decrease, the present invention provides a training data privacy protection method suitable for zero-trust distributed model training scenarios.
[0006] The present invention is implemented by adopting the following technical solution: a training data privacy protection method suitable for zero-trust distributed model training scenarios, comprising the following steps:
[0007] 1) Generate perturbations: All clients communicate with the server, and the server generates perturbations for each client;
[0008] 2) Client grouping: Every three clients are divided into a group {client A ,client B ,client C}, one of the clients A Its gradient g A Split into two shares client A A share and client A The perturbation ε A Forming Data Packets Sent to another client in the group B and the other share Sent to client C ; Client B polymerization Its gradient g B and the perturbation ε A form And send it to the client C ; Client C Aggregate all received data, its gradient g C and the perturbation ε C Formation A,B,C , and then upload it to the server, as shown in the following formula:
[0009]
[0010] At this point, the precise gradients of the three clients are obfuscated with the gradients of other clients in the group, and no other participant can obtain their precise gradients.
[0011] Furthermore, in the entire system consisting of clients and servers, all clients are divided into multiple groups, and the server aggregates the group gradients of all groups to obtain a global model.
[0012] Furthermore, this method can defend against collusion attacks between untrusted clients: Assume that the client B 、client C The three collude with the server to try to steal the client A The gradient data g A ; The specific process of their conspiracy is as follows:
[0013] ①client C From client B and the server gets the client A a share of and client A The perturbation ε A ;
[0014] ②client B From client C and the server gets the client A Another share of and client A Disturbance
[0015] Moving A ;
[0016] ③The server receives the data from the client B and client C get and
[0017] At this time, the client B 、client C Both the client and the server can calculate by themselves to get A However, in stealing client A During the gradient process, the client B 、client C have exchanged their respective data packets, so that the client C May collude with the server again to obtain the client B ε B , thus obtaining g B ; Therefore, client B Participating in collusion may also leak their own gradients, so this method can avoid the client B 、clientC of conspiracy.
[0018] In the present invention, every three clients are divided into a group, and the gradient data of one client is dynamically divided into two shares and merged with the gradient information uploaded to the server by other clients in the group to confuse the gradient data uploaded by this small group of clients. The gradient of the group is formed by aggregating the local gradients of all clients in the group. In particular, in order to prevent malicious participants from obtaining the gradient of a specific client by collusion, the present invention establishes the above-mentioned checks and balances rules between the gradient aggregation rules, and protects the privacy of client data information by adding disturbances to the gradient. If someone wants to reveal the gradient of others, their own gradient will also be exposed.
[0019] Beneficial effects of the present invention: In a zero-trust federated learning scenario without trusted participants, the present invention achieves data privacy protection for the client. That is, by splitting the gradient uploaded by the client, no client and server can obtain the precise gradient of other clients, thus achieving obfuscation of client data, thereby preventing malicious participants from launching gradient inversion attacks based on client gradient information and infringing on the privacy of client training data, and without introducing external noise, it will not affect the accuracy of the model. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] Figure 1 Schematic diagram of client-side gradient splitting and group aggregation. DETAILED DESCRIPTION
[0021] In federated learning, multiple clients jointly train a global model with the help of a central aggregation server (referred to as the server). Each client does not directly upload their training data to the server. Instead, they train locally based on their own data to obtain local gradient updates, which are then uploaded to the server for aggregation of the global model. In the absence of trusted participants such as servers and clients, the present invention achieves privacy protection of client training data by grouping the client groups participating in federated learning and aggregating their gradients within the group, i.e., it is not known to other participants.
[0022] The specific implementation modes of the present invention are further described in detail below in conjunction with the accompanying drawings.
[0023] The present invention groups the clients, aggregates the group gradients and uploads them to the central server to update the global model. The specific process of the present invention is as follows:
[0024] 1) Generate perturbations: All clients communicate with the server, and the server generates perturbations for each client.
[0025] 2) Client grouping: Every three clients are divided into a group {client A ,clientB ,client C}, as attached Figure 1 As shown. One of the clients A Its gradient g A Split into two shares client A A share and client A The perturbation ε A Forming Data Packets Sent to another client in the group B and the other share Send to client C .client B polymerization Its gradient g B and the perturbation ε A form And send it to the client C .client C Aggregate all received data, its gradient g C and the perturbation ε C Formation A,B,C , and then upload it to the server, as shown in the following formula:
[0026]
[0027] At this point, the precise gradients of the three clients are obfuscated with the gradients of other clients in the group, and no other participant can obtain their precise gradients. In the entire system, all clients are divided into multiple groups, and the server aggregates the group gradients of these groups to obtain the global model.
[0028] In particular, the present invention can defend against collusion attacks between untrusted clients. For example, assuming that client B 、client C The three collude with the server to try to steal the client A The gradient data g A The specific process of their conspiracy is as follows:
[0029] ①client C From client B and the server gets the client A a share of and client A The perturbation ε A .
[0030] ②clientB From client C and the server gets the client A Another share of and client A The perturbation ε A .
[0031] ③The server receives the data from the client B and client C get and
[0032] At this time, the client B 、client C Both the client and the server can calculate by themselves to get A However, in stealing client A During the gradient process, the client C May collude with the server again to obtain the client B ε B , thus obtaining g B Therefore, the client B Participating in collusion may also leak one's own gradient. In order not to expose one's own gradient, the client B Will not be willing to C Collusion with the server. Through the above checks and balances, the present invention effectively ensures that there will be no collusion attacks between clients in a group.
Claims
1. A training data privacy protection method suitable for zero-trust distributed model training scenarios, characterized by: The steps include: 1) Generate perturbations: All clients communicate with the server, and the server generates perturbations for each client; 2) Client grouping: Every three clients are divided into a group {client A ,client B ,client C }, one of the clients A Its gradient g A Split into two shares client A A share and client A The perturbation ε A Forming Data Packets Sent to another client in the group B and the other share Sent to client C ; Client B polymerization Its gradient g B and the perturbation ε A form And send it to the client C ; Client C Aggregate all received data, its gradient g C and the perturbation ε C Formation A,B,C , and then upload it to the server, as shown in the following formula: At this point, the precise gradients of the three clients are obfuscated with the gradients of other clients in the group, and no other participant can obtain their precise gradients.
2. A training data privacy protection method suitable for a zero-trust distributed model training scenario as claimed in claim 1, characterized in that: In the entire system consisting of clients and servers, all clients are divided into multiple groups, and the server aggregates the group gradients of all groups to obtain a global model.
3. A training data privacy protection method suitable for a zero-trust distributed model training scenario as described in claim 1 or 2, characterized in that: This method can defend against collusion attacks between untrusted clients: Assume that the client B 、client C The three collude with the server to try to steal the client A The gradient data g A ; The specific process of their conspiracy is as follows: ①client C From client B and the server gets the client A a share of and client A The perturbation ε A ; ②client B From client C and the server gets the client A Another share of and client A The perturbation ε A ; ③The server receives the data from the client B and client C get and At this time, the client B 、client C Both the client and the server can calculate by themselves to get A However, in stealing client A During the gradient process, the client B 、client C have exchanged their respective data packets, so that the client C May collude with the server again to obtain the client B ε B , thus obtaining g B ; Therefore, client B Participating in collusion may also leak their own gradients, so this method can avoid the client B 、client C of conspiracy.