Federal learning method and apparatus by combining differential privacy noise shares, and medium

Abstract

The invention discloses a federal learning method and device by combining differential privacy noise shares and a medium, and relates to the technical field of data privacy protection, mainly comprising the following steps: each client broadcasts a public key in a respective key pair through a server; the same random seed is generated between any two clients based on the key negotiation function, and the same pseudo-random number generator is constructed based on the random seed; each client determines a Gaussian noise share according to the number of clients successfully broadcasted by the public key; based on a Gaussian noise share and a pseudo-random number generator, each client carries out model confusion under noise addition on a local model trained by the client; and each client uploads the confused local model to a server for model aggregation, and the aggregated model is distributed as a global model of the next round. According to the method, the privacy information is effectively confused by combining a Gaussian mechanism with multi-party calculation and encryption, and Gaussian noise is effectively eliminated.

Description

Technical Field

[0001] The present invention relates to the technical field of data privacy protection, and specifically includes a federated learning method, device and medium by combining differential privacy noise shares. Background Art

[0002] With the proliferation of end devices such as smartphones and Internet of Things (IoT) sensors, a large amount of data is continuously collected, which can be used to support mobile and wireless applications such as soft keyboards and smart home management platforms. However, due to privacy regulations, data ownership issues, and the high cost of data transmission, traditional centralized machine learning methods are often impractical in these scenarios. The emergence of federated learning (FL) provides a promising solution, which allows model training with decentralized data while preserving privacy. In FL, each participating client trains a model locally on its own data and only shares the model updates (i.e., parameter changes) with a central server for aggregation. This process ensures that the original data remains on the client device, reducing privacy risks. Despite retaining the original data on the client, FL is still vulnerable to privacy leakage threats such as gradient reversal and membership inference attacks. However, gradient reversal allows an adversary to recover private images from model gradients, while membership inference can determine whether a specific data sample belongs to a specific client. To mitigate these risks, secure aggregation protocols have been introduced, combining encryption and multi-party computation (MPC) techniques, such as SecAgg. These methods use MPC to distribute encrypted shares of model updates among participants, obfuscating individual updates. Encryption also ensures the correctness of the aggregation results in the event of client exits. However, MPC and encryption introduce significant communication and computational overheads, respectively, making secure aggregation impractical on resource-constrained devices such as smartphones and IoT sensors. In contrast, differential privacy (DP) FL, which can also be viewed as a form of secure aggregation, provides a less resource-intensive approach by adding random noise to individual model updates. However, DP adding noise does not fully ensure the accuracy of the aggregation results. In addition, using DP mechanisms in secure aggregation involves a trade-off between the level of privacy protection and model accuracy. For most applications, any degradation in model accuracy is unacceptable, which means that simply applying DP in FL is not a viable solution. Summary of the invention

[0003] To address the efficiency challenge in secure aggregation, we propose a Federated Learning with Noise-Based Secure Aggregation (FedNSA) protocol, which integrates encryption, MPC, and DP. It is a federated learning method that combines differential privacy noise shares. Each round of iterative learning includes the following steps:

[0004] S1: Each client receives the global model generated by the server, and generates a local model based on the received global model;

[0005] S2: Each client generates a key pair based on the key agreement protocol and broadcasts the public key in its key pair through the server;

[0006] S3: Any two clients generate the same random seed based on the key agreement function and build the same pseudo-random number generator based on the random seed;

[0007] S4: Based on the local model distributed and generated by the server in this round, each client trains the local model based on its own private dataset;

[0008] S5: Each client determines the Gaussian noise share according to the number of clients that successfully broadcast the public key;

[0009] S6: Based on the Gaussian noise share and the pseudo-random number generator, each client performs model confusion by adding noise to its trained local model;

[0010] S7: Each client uploads the obfuscated local model to the server for model aggregation, and distributes the aggregated model as the global model for the next round to enter the next round.

[0011] Furthermore, the step S1 further includes the following steps:

[0012] S0: Interact with clients to customize noise variance based on the clients currently connected to the server.

[0013] Furthermore, in the step S5, determining the Gaussian noise share specifically includes the following steps:

[0014] Each client broadcasts the successful client set U according to the public key 2 , generating |U for it and all other clients 2 |-1 variance is Gaussian noise share.

[0015] Furthermore, the variance Determined by the following formula:

[0016]

[0017] In the formula, is the total Gaussian noise quota for client u, is the total Gaussian noise quota of client v, |U 2 |Set U for the client 2 Model.

[0018] Furthermore, in the step S3, the generation of the same random seed between two clients is expressed as the following formula:

[0019] τ u,v =f(pKey u ,sKey v )=f(pKey v ,sKey u )=τ v,u

[0020] In the formula, τ u,v The client v receives the public key pKey of the client u u The generated random seed, τ v,u The client u receives the public key pKey of the client v v The generated random seed, f() is the key negotiation function, sKey v is the private key of client v, sKey u The private key of client u.

[0021] Furthermore, in step S6, the obfuscated model is obtained by the following formula:

[0022]

[0023] In the formula, is the confused model, Δ u is the trained local model, Z u,v is the Gaussian noise share allocated by client u to client v, G() is a pseudo-random number generator, is the noise variance between client u and client v, and L is the size of the model parameters.

[0024] Furthermore, in step S7, model aggregation is expressed as the following formula:

[0025]

[0026] In the formula, w t+1 is the global model of the next round after aggregation, w t is the global model of the current round before aggregation, U 3 is the set of clients that successfully participated in the model aggregation, |U 3 |Set U for the client 3 The model, The model after confusion.

[0027] The present invention also includes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the federated learning method by combining differential privacy noise shares.

[0028] Also included is a device for processing data, comprising:

[0029] a memory having a computer program stored thereon;

[0030] A processor is used to execute the computer program in the memory to implement the steps of the federated learning method by combining differential privacy noise shares.

[0031] Compared with the prior art, the present invention has at least the following beneficial effects:

[0032] (1) The federated learning method, device and medium of the present invention, which combines the Gaussian mechanism with multi-party computing and encryption, effectively obfuscates the private information through the Gaussian mechanism, while the multi-party computing and encryption ensure that the Gaussian noise can be perfectly eliminated during the aggregation process;

[0033] (2) Since clients only need to exchange public keys, communication overhead can be greatly reduced;

[0034] (3) Based on the Gaussian noise share and the noise distribution for the random number generator, the computational overhead is small. At the same time, since the noise will be eliminated in the aggregation process, it will not damage the accuracy of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A diagram of the steps of a federated learning method by combining differentially private noise shares;

[0036] Figure 2 Schematic diagram of noise elimination. DETAILED DESCRIPTION

[0037] The following are specific embodiments of the present invention and the accompanying drawings to further describe the technical solution of the present invention, but the present invention is not limited to these embodiments.

[0038] In order to better understand the present invention, this embodiment first briefly introduces the preliminary knowledge of the key technical points FL and DP in the proposed federated learning method by combining differential privacy noise shares.

[0039] Federated learning (FL) enables multiple clients to jointly solve a machine learning problem under the coordination of a central server. Assume that there is a client set U of size N, and each client i has a private local dataset D i The federated learning problem can be formalized as minimizing the sum of a random function, defined as where w∈R of length L L represents the parameters of the global model, l i(w) is the weight parameter for client i, which specifies the relative influence of each client. A general rule of thumb is to set Where |D|=∑ i |D i |.

[0040] To complete the training of w, federated learning iteratively performs the following steps T rounds. In the tth round, the steps are as follows: (1) By w t The global model represented by is distributed from the central server to each client. (2) Each client i uses its local dataset D i Train the global model w t To get the local model To reduce the number of communication rounds, each client can perform multiple rounds of training locally. (3) The central server collects the local models trained by all online clients and aggregates them on the server to obtain a new global model w t+1 The update equation is Among them U t ∈U represents the set of clients that successfully uploaded their local models at iteration t. (4) Finally, the updated global model w t+1 is redistributed to the client to start the (t+1)th iteration.

[0041] Differential privacy (DP) is a paradigm that provides a rigorous mathematical foundation for quantifying and managing the privacy risks associated with analyzing datasets containing sensitive information. It is defined as follows: A random mechanism M:X→R, with domain X and range R, satisfies (∈,δ)-differential privacy if for all measurable sets And for any two adjacent databases D, D′∈X, Pr[M(D)∈S]≤e ∈ Pr[M(D′)∈S]+δ.

[0042] Here, ∈ is the privacy budget, which represents the distinguishable bounds of all outputs on adjacent databases D and D′. δ represents the probability that two adjacent outputs of databases D and D′ cannot be bounded by ∈ after using algorithm M. Intuitively, a differential privacy mechanism M with a smaller privacy budget ∈ provides stronger privacy protection, and vice versa.

[0043] The Gaussian mechanism is a popular differential privacy mechanism that has been widely used in federated learning. It can be defined as follows.

[0044] Theorem under Gaussian mechanism, let ∈∈(0,1). Given a dataset D and a query input w, a Gaussian mechanism that satisfies (∈,δ)-differential privacy is implemented by M G (w,∈)=q(w,D)+Z distorts the query result. Here It follows a Gaussian distribution Here is the identity matrix of dimension L, and σ satisfies σ ≥ cΔq 2 / ∈, where c 2 >2ln(1.25 / δ). is the L2-sensitivity of q(w,D).

[0045] In federated learning (FL), the local model to be returned to the server can be regarded as the query result of the query function q(·). In practice, Gaussian noise Z can be generated by a pseudo-random generator with the generation function Z = G(τ,σ,L), where τ is the seed for generating random numbers, and each client u generates Z independently according to its own privacy budget constraint.

[0046] The Gaussian mechanism is widely used in federated learning to achieve secure aggregation. This mechanism is applied to distort the client's local model update process. The specific process is as follows: Z generated by client u u Added to the model parameter changes after local training and before returning to the local model, i.e. Client u will Return to the server. The model update with its direct aggregation distortion removed is w t+1 =w t + Among them, Z u It is generated independently by the client. It cannot be eliminated by the server, resulting in loss of model accuracy.

[0047] On the basis of the above, in order to solve the pain points of federated learning, such as Figure 1 As shown, the present invention proposes a federated learning method by combining differential privacy noise shares, which includes the following steps in each round of iterative learning:

[0048] S0: According to the client currently connected to the server, the client interacts with the customized noise variance;

[0049] S1: Each client receives the global model generated by the server, and generates a local model based on the received global model;

[0050] S2: Each client generates a key pair based on the key agreement protocol and broadcasts the public key in its key pair through the server;

[0051] S3: Any two clients generate the same random seed based on the key agreement function and build the same pseudo-random number generator based on the random seed;

[0052] S4: Based on the local model distributed and generated by the server in this round, each client trains the local model based on its own private dataset;

[0053] S5: Each client determines the Gaussian noise share according to the number of clients that successfully broadcast the public key;

[0054] S6: Based on the Gaussian noise share and the pseudo-random number generator, each client performs model confusion by adding noise to its trained local model;

[0055] S7: Each client uploads the obfuscated local model to the server for model aggregation, and distributes the aggregated model as the global model for the next round to enter the next round.

[0056] In the present invention, it is mainly based on a Gaussian mechanism with two stages. These two stages can be roughly described as an initialization stage and a training stage. In the initialization stage, the custom noise variance is interacted between clients according to the client currently connected to the server. In the training stage, each client generates a new public key in each training round and distributes these keys to other clients by running a key agreement protocol (DHKA, Diffie-Hellman). Based on the interacted key, client u generates a random seed To generate U noise shares. It should be noted here that client u and client v generate the same noise share locally So that this noise share can be eliminated during aggregation.

[0057] Specifically, the complete process of federated noise-safe aggregation to assemble noise from noise shares during the training phase is as follows:

[0058] 1. First, at the beginning of training, the server generates the initial global model w 0 And distribute it to all clients participating in this round of training. Here we use U 1 Represents the collection of clients participating in this phase.

[0059] 2. Perform random seed negotiation based on the client currently connected to the server. Client u generates its own key pair (pKey u ,sKey u ). The client u then reports its public key pKey to the server u After receiving the public keys uploaded by each client, the server broadcasts these public keys in the federated learning system so that each client can obtain the public key of any other client. Here, we define the set of clients that successfully upload public keys as U 2Then, based on the key negotiation protocol, client u can obtain the public key pKey of client v. v , generate a client-to-client key pair (pKey v ,sKey u ), accordingly, client v can obtain the public key pKey of client u u , generate a client-to-client key pair (pKey u ,sKey v ). Based on the inter-client key pair, client u and client v can generate the same random seed through the key agreement function, namely:

[0060] τ u,v =f(pKey u ,sKey v )=f(pKey v ,sKey u )=τ v,u

[0061] In the formula, τ u,v The client v receives the public key pKey of the client u u The generated random seed, τ v,u The client u receives the public key pKey of the client v v The generated random seed, f() is the key negotiation function, sKey v is the private key of client v, sKey u The private key of client u.

[0062] Then client u and client v can use it to generate Gaussian noise for the random number generator.

[0063] 3. Each client trains its own local model. Each client u trains its local model on its private dataset And get the updated local model here, is the global model w distributed from the server at iteration t t A copy of .

[0064] 4. Each client adds noise camouflage to its locally trained data. In this stage, client u first broadcasts the successful client set U according to the public key. 2 , generate |U 2 |-1The variance is The Gaussian noise share of client u to client v is obtained by the following formula:

[0065]

[0066] In the formula, is the total Gaussian noise quota for client u, is the total Gaussian noise quota of client v, |U 2 |Set U for the client 2 The modulus of these Gaussian noise shares is defined as Z u,v .

[0067] Client u can then obfuscate updates to its local model as follows:

[0068]

[0069] In the formula, is the confused model, Δ u is the trained local model, Z u,v is the Gaussian noise share allocated by client u to client v, G() is a pseudo-random number generator, is the noise variance between client u and client v, and L is the size of the model parameters.

[0070] Here, order represents the total Gaussian noise added by client u to protect its model information. Set to Then Z u It satisfies the privacy budget requirements of client u and facilitates controlling the number of training rounds that each client participates in under the privacy budget control.

[0071] 5. The server aggregates the model data of each client. Here, we define the set of clients whose model data is successfully obfuscated by adding noise and successfully uploaded to the server as U 3 Then, without considering the client disconnection, the aggregated model is obtained by the following formula:

[0072]

[0073] In the formula, w t+1 is the global model of the next round after aggregation, w t is the global model of the current round before aggregation, |U 3 |Set U for the client 3 The model, is the confused model. Then, we can return to step 2 for random seed negotiation to start a new round of learning.

[0074] To better understand how noise is removed, we Figure 2A simple example is given in . In this example, there are only two clients (Participant1 and Participant2), which can generate the same Gaussian noise based on the exchanged public keys and their own private keys based on the key agreement protocol. For client 2, it will use the negative noise to distort its model update. In this way, the noise disappears when aggregated on the two clients. However, this simple example is vulnerable to collusion attacks because there are only two clients. When there are N>>1 clients, each client generates N-1 Gaussian noise shares, which means that client v only knows the noise information of client u (To simplify the problem, disconnection is not considered here.) This situation is highly resistant to collusion attacks unless the attacker can control the majority of clients in the system.

[0075] Based on the theory proposed by the present invention, it is assumed that the model uploaded by client u is updated to Then, for the tth learning round, the global model obtained by the server through aggregation is:

[0076]

[0077] By deducing this formula, it can be proved that all noises in the aggregation step can be perfectly offset by each other without causing any loss in model accuracy.

[0078] Ignoring the privacy budget (∈ u ,δ u )set up Details, only assuming If the value of is known, according to the Federal Noise Security Aggregation (FedNSA) protocol, Known as well as Z u The variance of is derived as follows:

[0079]

[0080] Where Var() is the variance function. Here, the equality holds because each noise contribution Z u,v are generated independently, so their total variance is equal to the sum of their individual variances. u,v It follows a Gaussian distribution with a mean of 0, so it is easy to deduce that Z u It follows a Gaussian distribution with a mean of 0. Therefore, the noise term Z u It can be guaranteed at least for client u (∈ u ,δ u)-Differential privacy. Although this way of calculating the privacy budget may increase the variance of the noise, it strengthens the privacy protection. In addition, since the noise is almost perfectly eliminated, its impact on the convergence of the model is actually negligible.

[0081] Then, under this learning method, assuming that there exists |U c |(Use U c represents the set of colluding clients) clients are conducting collusion attacks, let represents the proportion of colluding clients in the system. Then, the impact of collusion can be quantified as follows.

[0082] For client u, when faced with a request from the server and |U c | collusion attack of colluded clients. Since each noise share follows a Gaussian distribution, even if |U is removed c | noise shares, the sum of the remaining noise shares still obeys the Gaussian distribution. And due to the theorem under the Gaussian mechanism, it can be concluded that where c 2 >2ln(1.25 / δ u ). Therefore, when the noise variance is reduced to its original value When it is (1-k) times, it satisfies - Differential privacy, which also produces a variance of Therefore, if in the federated noise security aggregation, only a certain system parameter k (that is, the proportion of clients participating in the collusion attack) needs to be set in advance, then each benign client u can set (1-k)∈ u Set as the privacy budget to ensure that (∈ u ,δ u )-Differential privacy. The specific size of the system parameter k is set based on assumptions. The larger the parameter, the more collusion clients can be resisted, but the greater the disturbance to the model caused by disconnection, so a trade-off needs to be made.

[0083] Of course, in federated learning with resource-constrained devices, it is not uncommon for clients to be offline. d Represents the set of disconnected clients in the aggregation. The impact of client disconnection on model accuracy is defined as follows.

[0084] make represents the proportion of disconnected clients. Since all noise shares can be offset during aggregation, the number of disconnected clients U d The expected total noise becomes:

[0085]

[0086] If U d From U 2Uniformly selected in, it can be inferred that the expectation of the variance can be expressed as It is λ times the total noise variance. Therefore, in expectation, 1-λ times the noise variance can be eliminated.

[0087] In practice, the proportion of disconnected clients is limited, and the noise between clients is independent, so there is no need to incur any additional overhead for client recovery. d The impact can be controlled within a certain range.

[0088] The present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the federated learning method by combining differential privacy noise shares.

[0089] Also included is a device for processing data, comprising:

[0090] a memory having a computer program stored thereon;

[0091] A processor is used to execute the computer program in the memory to implement the steps of the federated learning method by combining differential privacy noise shares.

[0092] In summary, the federated learning method, device and medium described in the present invention, which combines differential privacy noise shares, effectively obfuscates private information through the Gaussian mechanism by combining the Gaussian mechanism with multi-party computing and encryption, while multi-party computing and encryption ensure that the Gaussian noise can be perfectly eliminated during the aggregation process.

[0093] Since only public keys need to be exchanged between clients, communication overhead can be greatly reduced. Based on Gaussian noise shares and noise distribution for random number generators, the computational overhead is small, and since the noise will be eliminated during the aggregation process, the accuracy of the model will not be compromised.

[0094] It should be noted that all directional indications in the embodiments of the present invention (such as up, down, left, right, front, back, etc.) are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0095] In addition, in the present invention, descriptions such as "first", "second", "one", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0096] In the present invention, unless otherwise clearly specified and limited, the terms "connection", "fixation", etc. should be understood in a broad sense. For example, "fixation" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0097] In addition, the technical solutions between the various embodiments of the present invention can be combined with each other, but it must be based on the fact that ordinary technicians in the field can implement it. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

Claims

1. A federated learning method by combining differential privacy noise shares, characterized in that Each round of iterative learning includes the following steps: S1: Each client receives the global model generated by the server, and generates a local model based on the received global model; S2: Each client generates a key pair based on the key agreement protocol and broadcasts the public key in its key pair through the server; S3: Any two clients generate the same random seed based on the key agreement function and build the same pseudo-random number generator based on the random seed; S4: Based on the local model distributed and generated by the server in this round, each client trains the local model based on its own private dataset; S5: Each client determines the Gaussian noise share according to the number of clients that successfully broadcast the public key; S6: Based on the Gaussian noise share and the pseudo-random number generator, each client performs model confusion by adding noise to its trained local model; S7: Each client uploads the obfuscated local model to the server for model aggregation, and distributes the aggregated model as the global model for the next round to enter the next round.

2. The method for federated learning by combining differential privacy noise shares as claimed in claim 1, characterized in that: The S1 step also includes the following steps: S0: Interact with clients to customize noise variance based on the clients currently connected to the server.

3. The method for federated learning by combining differential privacy noise shares as claimed in claim 2, characterized in that: In the step S5, determining the Gaussian noise share specifically includes the following steps: Each client generates a variance of |u2|-1 for the client set U2 that successfully broadcasts the public key and all other clients. Gaussian noise share.

4. The method for federated learning by combining differential privacy noise shares as claimed in claim 3, characterized in that: variance Determined by the following formula: In the formula, is the total Gaussian noise quota for client u, is the total Gaussian noise quota of client v, and |U2| is the modulus of the client set U2.

5. The method for federated learning by combining differential privacy noise shares as claimed in claim 1, characterized in that: In the S3 step, the generation of the same random seed between two clients is expressed as the following formula: t u,v =f(pKey u ,sKey v )=f(pKey v ,sKey u )=t v,u In the formula, τ u,v The client v receives the public key pKey of the client u u The generated random seed, τ v,u The client u receives the public key pKey of the client v v The generated random seed, f() is the key negotiation function, sKey v is the private key of client v, sKey u The private key of client u.

6. A method for federated learning by combining differential privacy noise shares as claimed in claim 5, characterized in that: In step S6, the obfuscated model is obtained by the following formula: In the formula, is the confused model, Δ u is the trained local model, Z u,v is the Gaussian noise share allocated by client u to client v, G() is a pseudo-random number generator, is the noise variance between client u and client v, and L is the size of the model parameters.

7. The method for federated learning by combining differential privacy noise shares as claimed in claim 1, characterized in that: In step S7, the model aggregation is expressed as the following formula: In the formula, w t+1 is the global model of the next round after aggregation, w t is the global model of the current round before aggregation, U3 is the client set that successfully participates in model aggregation, |U3| is the model of client set U3, The model after confusion.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the federated learning method described in any one of claims 1 to 7 are implemented.

9. A device for processing data, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the federated learning method according to any one of claims 1 to 7.

Images