Privacy-preserving split learning method and device

Abstract

The embodiments of this specification disclose a privacy-protecting split learning method and device. The method is executed by the server, and includes the following steps: first, receiving multiple hidden layer representations from the client, which are obtained by the client locally processing the sample features of multiple training samples using the bottom model; then, inputting the multiple hidden layer representations into the top model deployed by the server respectively to obtain multiple prediction results; then, determining the training loss, which is negatively correlated with the first distance between each prediction result and the corresponding category label, and positively correlated with the second distance between any two hidden layer representations corresponding to the same category label in the multiple hidden layer representations; wherein the training loss is used to train the top model and the bottom model. In this way, the privacy protection strength of the model and user data in split learning can be effectively improved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of machine learning technology, and more particularly to a privacy-preserving split learning and device. Background Art

[0002] In recent years, deep learning models have been widely used in various industries, and have achieved good results in many fields such as image / text classification, recommendation systems, anomaly detection, etc. At the same time, the protection of data privacy is a very serious problem faced in the application of big data and artificial intelligence technology.

[0003] Split learning is a technique to address privacy issues during deep learning model training and inference. Figure 1 As shown in the figure, the deep learning model is split into a bottom model and a top model, which are deployed on the client and server respectively. During the forward propagation process, the client processes the private sample features locally using the bottom model, and then uploads the intermediate results (or intermediate representations, hidden layer representations) to the server, so that the server can use the intermediate results to complete the prediction. As a result, the client only sends the intermediate results to the server, rather than the original feature data, thereby achieving privacy protection for the original training data.

[0004] However, the privacy protection achieved by traditional split learning is difficult to meet the higher requirements in practical applications. Therefore, there is an urgent need for a split learning solution that can better meet the privacy protection needs in practical applications. Summary of the invention

[0005] The embodiments of this specification describe a privacy-preserving split learning method and device, which can better meet the privacy protection needs in practical applications.

[0006] According to a first aspect, a privacy-preserving split learning method is provided, which is executed by a server and includes:

[0007] Receive multiple hidden layer representations from a client, which are obtained by the client locally processing sample features of multiple training samples using a bottom model. Input the multiple hidden layer representations into the top model deployed by the server to obtain multiple prediction results. Determine a training loss, which is negatively correlated with a first distance between each prediction result and a corresponding category label, and positively correlated with a second distance between any two hidden layer representations corresponding to the same category label in the multiple hidden layer representations; wherein the training loss is used to train the top model and the bottom model.

[0008] In one embodiment, determining the training loss includes: determining a first loss term based on the first distance, and determining a second loss term based on the second distance; and performing weighted summation of the first loss term and the second loss term to obtain the training loss.

[0009] Further, in one embodiment, the second distance is a Euclidean distance.

[0010] In another embodiment, the weight corresponding to the second loss term is less than the weight corresponding to the first loss term.

[0011] In one embodiment, after determining the training loss, the method further includes:

[0012] Using the training loss, determine the training gradient for the top model and the return gradient to the bottom model; use the training gradient to update the model parameters of the top model; send the return gradient to the client, so that the client determines the training gradient for the bottom model according to the return gradient, and then uses the training gradient to update the model parameters of the bottom model.

[0013] Further, in one embodiment, the number of the clients is multiple, wherein each client locally deploys the same copy of the bottom model; wherein sending the backtransmitted gradient to the client comprises: sending the backtransmitted gradient to each client respectively.

[0014] In one embodiment, the method involves multiple traversals of a training sample set; the multiple training samples are any batch of samples in multiple batches of samples obtained by sampling the training sample set in any traversal; the sampling is re-executed for different traversals.

[0015] According to a second aspect, a privacy-protecting split learning device is provided, which is integrated in a server. The device includes:

[0016] A representation receiving module is configured to receive multiple hidden layer representations from a client, which are obtained by the client locally processing sample features of multiple training samples using a bottom model; a prediction processing module is configured to input the multiple hidden layer representations into the top model deployed on the server to obtain multiple prediction results; a loss determination module is configured to determine a training loss, which is negatively correlated with a first distance between each prediction result and a corresponding category label, and is positively correlated with a second distance between any two hidden layer representations corresponding to the same category label in the multiple hidden layer representations; wherein the training loss is used to train the top model and the bottom model.

[0017] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method provided in the first aspect.

[0018] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0019] In summary, the above method and device disclosed in the embodiments of this specification can effectively prevent attackers from stealing parameters of the top model deployed on the server, and prevent attackers from illegally obtaining the prediction results of samples, thereby better meeting the privacy protection needs in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A schematic diagram of the general implementation framework of split learning technology;

[0022] Figure 2 A schematic diagram of the training architecture of the privacy-preserving split learning solution disclosed in the embodiments of this specification;

[0023] Figure 3 A schematic diagram of the interaction between two parties in the process of executing the split learning method disclosed in the embodiment of this specification;

[0024] Figure 4 This is a functional structure diagram of a split learning device integrated in a server according to an embodiment of this specification. DETAILED DESCRIPTION

[0025] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0026] As mentioned above, the privacy protection strength of traditional split learning is difficult to meet the higher requirements in practical applications. Specifically, the forward propagation of a typical two-layer split learning model can be expressed as the following function:

[0027] Y=F(G(X)) (1)

[0028] Among them, Y represents the model prediction result, F represents the top model, G represents the bottom model, and X represents the sample features in the input G.

[0029] It should be understood that the top model F and the bottom model G are obtained by splitting the complete business prediction model or deep neural network. The bottom model G usually contains the shallow layers of the deep neural network, such as convolutional layers, embedding layers or simple fully connected layers. The number of layers and complexity of the bottom model are usually low to ensure that the computing resources of the client, such as smartphones, IoT devices and other user-side devices with limited resources, are sufficient to complete the task; the top model runs on the server side (or service side) of the model service provider, such as cloud servers, edge computing servers, etc. The top model contains the latter layers of the deep neural network, which are usually more complex fully connected layers, attention layers, etc., responsible for extracting high-level features from the intermediate results G(X) and outputting the final prediction results Y.

[0030] like Figure 1 As shown in the figure, in the training phase of split learning, the forward propagation process includes: the client uses the bottom model G to process the training data to obtain the intermediate representation H = G (X), and then sends H to the server of the model service provider through network transmission to calculate the model prediction result Y = F (X). Furthermore, conventionally, the server only calculates the classification loss through the prediction result and sample label, and then only uses the classification loss for back propagation, thereby completing the parameter adjustment and update of the top model and the bottom model.

[0031] It should be understood that in the inference phase of split learning, the trained model will be used to perform the above forward propagation process. The server will then send the most likely category in the predicted result Y to the user as the classification result.

[0032] The above traditional split learning faces an attack problem with a high risk of privacy leakage. The attacker can steal the entire model through the bottom model (usually the trained bottom model used in the inference stage) and a small number of labeled samples. The reason why this attack is feasible is that the intermediate result H generated by the bottom model itself has been separated from the model prediction result Y or the actual label of the sample. A large number of studies on deep learning hidden layers have shown that the same category, that is, the same The corresponding hidden layer features show a clustering effect. Therefore, the attacker only needs to obtain a small number of samples of a specific category to train a model that predicts Y through H. This attack behavior steals the private resources of the model owner, that is, the top model, and also allows the attacker to easily steal the labels corresponding to the user's input data, posing a threat to user privacy.

[0033] In order to deal with the above-mentioned attack behaviors, the applicant proposed an improved split learning scheme, which achieves the purpose of disturbing the hidden layer representation H by adding repulsion between the hidden layer representations of similar samples. The specific way of adding repulsion is reflected in the loss function, which can be expressed as:

[0034] NewLoss=Loss+αR(H) (2)

[0035] Where Loss represents the prediction result Y based on the model and the corresponding classification label The determined prediction loss (or classification loss) and the α parameter are used to control the proportion of the repulsion loss R(H) in the training loss NewLoss.

[0036] It should be noted that the intermediate representation repulsion is inspired by the Coulomb repulsion of like charges in electromagnetism. Specifically, for any two hidden layer representations H i , H j , if its corresponding category y i ,y j If the same, the repulsive force generated and H i , H j The distance between them is negatively correlated, that is, the larger the distance between the hidden layer representations of the same category, the smaller the repulsion; the smaller the distance, the greater the repulsion. For example, R(H) in formula (1) can be calculated using the following formula:

[0037]

[0038] Where H refers to the set of intermediate representations corresponding to a batch of training samples, and ‖·‖ represents the Euclidean distance.

[0039] Therefore, in the improved split learning scheme, by designing a loss function based on the repulsion of privacy representations, the distance between similar privacy representations can be increased, weakening or breaking the clustering effect presented by the hidden layer representations, thereby effectively resisting the above-mentioned attacks and achieving privacy protection for the top model parameters and user data labels in the model service provider.

[0040] Figure 2 Schematic diagram of the training architecture of the privacy-preserving split learning solution disclosed in the embodiments of this specification. Figure 2 As shown, the bottom model G (deployed on the client) processes the original training data X to obtain the hidden layer representation H = G (X). Furthermore, on the one hand, the repulsion loss R (H) is determined based on the hidden layer representation H table. For example, R (H) is calculated using the above formula (3). On the other hand, the top model F (deployed on the server) processes the hidden layer representation H to obtain the model prediction result Y = F (X). The model prediction result Y is used to combine the corresponding true label Determine the prediction loss Loss. Then, based on the repulsion loss R(H) and the prediction loss Loss, the above formula (2) is used to calculate and obtain the total loss (or training loss).

[0041] The following introduces Figure 2 Show the specific interactive steps of solution design.

[0042] Figure 3 Schematic diagram of the interaction between two parties in the process of executing the split learning method disclosed in the embodiment of this specification, where the two parties are the client and the server. Figure 3 As shown, the training phase of split learning consists of the following interacting steps:

[0043] In step S310, the client locally processes the sample features X of multiple training samples using the bottom model G to obtain corresponding multiple hidden layer representations H.

[0044] It should be understood that the sample features and sample labels of the training samples are adapted to the specific business scenarios. For example, in the recommendation scenario, the sample features include at least the user's features, including static features (such as address, occupation, etc.) and network behavior features (such as browsing history, etc.), and further, the object features of the behavior object, such as product features or advertising features. The sample label can indicate whether the user performs the target behavior on the predetermined object, such as purchasing goods, clicking on advertisements, etc. For another example, in the risk control scenario, the sample features can include user features, such as static features and transaction and payment records, etc. The sample label can indicate the user's risk level or risk category, such as low, medium, high risk, or risky and no risk.

[0045] The sample features of the training samples can be collected locally by the client. For the sample labels, the client can also collect them together and send them to the server in advance, or the server can collect them by itself. It should be understood that the data related to the user in this article is collected and used after the user confirms the authorization.

[0046] The above-mentioned multiple training samples can be a batch of training samples sampled from a local training sample set. Furthermore, the number of a batch of training samples can be as large as possible, so that the subsequent calculation of repulsion loss is more accurate. In addition, preferably, for the training sample set, each time a batch of samples is sampled, the training sample set is rearranged and then the next batch is sampled; and / or, in multiple traversals of the training sample set, each traversal needs to resample the training sample set, so that the batch division of samples is different for each traversal. In this way, the repulsion between each pair of similar samples can be calculated.

[0047] Specifically, in this step, the client can use the bottom model G to process the sample features X of each training sample in the current batch of training samples. i , thus obtaining the hidden layer representation H of the corresponding output i =g(X i ). It can be understood that the hidden layer representation H of a single training sample i Can be a vector or a matrix.

[0048] From the above, the client can obtain multiple hidden layer representations H = {H i}.

[0049] Step S320: the client sends multiple hidden layer representations H to the server.

[0050] In step S330, the server uses the locally deployed top model F to process multiple hidden layer representations H respectively to obtain corresponding multiple prediction results Y=F(h).

[0051] Step S340: The server determines the training loss NewLoss, which is consistent with each prediction result Y i and the corresponding category label And, is positively correlated with the second distance between any two hidden layer representations corresponding to the same category label in the multiple hidden layer representations H.

[0052] It should be noted that the "first" in the above-mentioned "first distance", the "second" in the "second distance", and similar terms elsewhere in the text are all for the purpose of distinguishing similar things and do not have other limiting functions such as sorting.

[0053] Specifically, in this step, a first loss term Loss, or prediction loss or classification loss, may be determined based on the first distance. For example, a cross entropy loss or a square error loss may be calculated based on multiple prediction results and corresponding multiple category labels as the first loss term.

[0054] The second loss term R(H), or repulsive force loss, is determined based on the second distance. The repulsive force loss is negatively correlated with the second distance. Exemplarily, the repulsive force loss can be calculated using the above formula (3), or the following formula (4) or (5):

[0055]

[0056] Furthermore, the prediction loss Loss and the repulsion loss R(H) can be weighted and summed to obtain the total training loss NewLoss. It should be understood that the weights used in the weighted summation are all positive numbers, and the weight corresponding to the prediction loss Loss is greater than the weight corresponding to the repulsion loss R(H).

[0057] For example, the above formula (2) can be used for calculation, where the parameter α is used to control the magnitude of the repulsion, and its value range is (0, 1), for example, α = 0.001. It can be understood that by selecting and adjusting the value of α based on experience, the magnitude of the repulsion in the training loss can be moderate, sufficient to produce a good privacy protection effect, while ensuring that the effect of the original classification task is close to lossless.

[0058] Therefore, by adding repulsion to the representation of samples of the same type, the distance between samples of the same type can be increased, making it difficult for attackers to use sample representations to steal models.

[0059] From the above, the server can determine the training loss, which is used to subsequently update the top model and the bottom model, specifically involving steps S350, S360, S370 and S380 shown below. It should be noted that the execution of the following steps can be implemented using existing technologies and will not be further expanded.

[0060] In step S350, the server uses the training loss to determine the first training gradient for the top model and the feedback gradient to be fed back to the bottom model.

[0061] Step S360: The server sends the returned gradient to the client.

[0062] Step S370: The server updates the model parameters of the top model using the first training gradient.

[0063] In step S380, the client determines a second training gradient for the bottom model according to the returned gradient, and uses the second training gradient to update the model parameters of the bottom model.

[0064] From the above, any iterative training of the top model and the bottom model can be completed.

[0065] It should be noted that the above mainly uses the number of clients as 1 to illustrate the improved split learning scheme. In fact, the number of clients can also be multiple, for example, it can be multiple smart terminals. At this time, a copy of the bottom model is deployed in each of the multiple clients, so that the server can process the hidden layer representations from multiple clients separately in step S330, and then the server determines the training loss based on the prediction results, sample labels and hidden layer representations corresponding to all training samples from multiple clients in step S340. After that, the server will provide the return gradients to multiple clients separately in step S370, so that multiple clients can update their local bottom models.

[0066] In summary, the privacy-preserving split learning method disclosed in the embodiments of this specification can effectively resist attackers from stealing parameters of the top model deployed on the server, and resist attackers from illegally obtaining the prediction results of samples, thereby better meeting the privacy protection needs in practical applications.

[0067] Corresponding to the above split learning method, the embodiments of this specification also disclose a corresponding split learning device. Figure 4 Schematic diagram of the functional structure of the split learning device integrated in the server disclosed in the embodiment of this specification. Figure 4 As shown, the device 400 includes:

[0068] The representation receiving module 410 is configured to receive multiple hidden layer representations from the client, which are obtained by the client locally processing the sample features of multiple training samples using the bottom model. The prediction processing module 420 is configured to input the multiple hidden layer representations into the top model deployed by the server to obtain multiple prediction results. The loss determination module 430 is configured to determine the training loss, which is negatively correlated with the first distance between each prediction result and the corresponding category label, and positively correlated with the second distance between any two hidden layer representations corresponding to the same category label in the multiple hidden layer representations; wherein the training loss is used to train the top model and the bottom model.

[0069] In one design, the loss determination module 430 is specifically configured to: determine a first loss term based on the first distance, and determine a second loss term based on the second distance; and perform weighted summation of the first loss term and the second loss term to obtain the training loss.

[0070] Further, in a design example, the second distance is a Euclidean distance.

[0071] In another design example, the weight corresponding to the second loss term is smaller than the weight corresponding to the first loss term.

[0072] In one design, the device 400 further includes:

[0073] The gradient determination module 440 is configured to use the training loss to determine the training gradient for the top model and the feedback gradient to the bottom model. The model update module 450 is configured to use the training gradient to update the model parameters of the top model. The gradient feedback module 460 sends the feedback gradient to the client, so that the client determines the training gradient for the bottom model according to the feedback gradient, and then uses the training gradient to update the model parameters of the bottom model.

[0074] Furthermore, in a design example, the number of the clients is multiple, wherein each client locally deploys the same copy of the bottom model; wherein the gradient feedback module 460 is specifically configured to send the feedback gradient to each client respectively.

[0075] In one design, the method involves multiple traversals of a training sample set; the multiple training samples are any batch of samples in multiple batches of samples obtained by sampling the training sample set in any traversal; the sampling is re-executed for different traversals.

[0076] It should be noted that the description of the above-mentioned device 400 can also refer to the above-mentioned introduction to the split learning method.

[0077] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute Figure 3 The method described.

[0078] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, Figure 3 The method described.

[0079] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0080] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A privacy-preserving split learning method, executed by a server, comprising: Receiving a plurality of hidden layer representations from a client, which are obtained by the client locally processing sample features of a plurality of training samples using a bottom model; Inputting the multiple hidden layer representations into the top model deployed on the server side respectively to obtain multiple prediction results; Determine a training loss that is negatively correlated with a first distance between each prediction result and the corresponding category label, and is positively correlated with a second distance between any two hidden layer representations corresponding to the same category label in the multiple hidden layer representations; wherein the training loss is used to train the top model and the bottom model.

2. The method according to claim 1, wherein: Determining the training loss involves: determining a first loss term based on the first distance, and determining a second loss term based on the second distance; The first loss term and the second loss term are weightedly summed to obtain the training loss.

3. The method according to claim 2, wherein: The second distance is the Euclidean distance.

4. The method according to claim 2, wherein: The weight corresponding to the second loss term is smaller than the weight corresponding to the first loss term.

5. The method according to claim 1, wherein: After determining the training loss, the method further comprises: Determine a training gradient for the top model and a return gradient to the bottom model using the training loss; Updating model parameters of the top model using the training gradients; The returned gradient is sent to the client, so that the client determines the training gradient for the bottom model according to the returned gradient, and then uses the training gradient to update the model parameters of the bottom model.

6. The method according to claim 5, wherein the number of the clients is multiple, wherein each client locally deploys the same copy of the bottom model; wherein, Sending the returned gradient to the client includes: The returned gradient is sent to each of the clients respectively.

7. The method according to claim 1, wherein: The method involves multiple traversals of a training sample set; the multiple training samples are any batch of samples in multiple batches of samples obtained by sampling the training sample set in any traversal; the sampling is re-executed for different traversals.

8. A privacy-preserving split learning device, integrated in a server, comprising: A representation receiving module, configured to receive a plurality of hidden layer representations from a client, which are obtained by the client locally processing sample features of a plurality of training samples using a bottom model; A prediction processing module, configured to input the multiple hidden layer representations into the top model deployed on the server, respectively, to obtain multiple prediction results; A loss determination module is configured to determine a training loss, which is negatively correlated with a first distance between each prediction result and a corresponding category label, and is positively correlated with a second distance between any two hidden layer representations corresponding to the same category label in the multiple hidden layer representations; wherein the training loss is used to train the top model and the bottom model.

9. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device comprising a memory and a processor, wherein: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images