A federated learning method, device and medium by combining differential privacy noise shares

Abstract

The application discloses a kind of federal learning methods, device and medium by combining differential privacy noise share, it is related to data privacy protection technical field, mainly includes the following steps: each client broadcasts the public key in respective key pair through server;Random seed is generated based on key agreement function between any two clients, and same pseudo-random number generator is constructed based on random seed;Each client determines Gaussian noise share according to the number of successful client broadcast public key;Based on Gaussian noise share and pseudo-random number generator, each client adds noise to the model confusion of local model after training;Each client uploads the local model after confusion to server for model aggregation, and the aggregated model is distributed as the global model of next round.The application effectively confuses privacy information by combining Gaussian mechanism with multi-party computation and encryption, and effectively eliminates Gaussian noise.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data privacy protection, and particularly includes a federated learning method, device and medium by combining differential privacy noise shares. BACKGROUND

[0002] With the proliferation of terminal devices such as smartphones and Internet of Things (IoT) sensors, large amounts of data are constantly being collected, which can be used to support mobile and wireless applications such as soft keyboards and smart home management platforms. However, due to privacy regulations, data ownership issues, and high costs of data transmission, traditional centralized machine learning methods are often impractical in these scenarios. The emergence of federated learning (FL) provides a promising solution, which allows model training using decentralized data while protecting privacy. In FL, each participating client trains a model locally on their own data and only shares model updates (i.e., parameter changes) with a central server for aggregation. This process ensures that the original data remains on the client devices, reducing privacy risks. Despite retaining the original data at the clients, FL is still vulnerable to privacy breaches such as gradient inversion and membership inference attacks. Gradient inversion, however, allows adversaries to recover private images from model gradients, while membership inference can determine whether a particular data sample belongs to a specific client. To reduce these risks, secure aggregation protocols have been introduced, combining encryption and multi-party computation (MPC) techniques such as SecAgg. These methods use MPC to distribute encrypted shares of model updates among participants, obscuring individual updates. Encryption also ensures the correctness of the aggregation result in the event of client withdrawal. However, MPC and encryption introduce significant communication and computational overheads, respectively, making secure aggregation impractical on resource-constrained devices such as smartphones and IoT sensors. In contrast, differential privacy (DP) FL, which can also be considered a form of secure aggregation, provides a less resource-intensive approach by adding random noise to individual model updates. However, DP adding noise does not completely ensure the accuracy of the aggregation result. Moreover, using DP mechanisms in secure aggregation involves a trade-off between privacy protection levels and model accuracy. For most applications, any decrease in model accuracy is unacceptable, meaning that simply applying DP in FL is not a viable solution. SUMMARY

[0003] To address the efficiency challenges in secure aggregation, we propose a noise-based secure aggregation federated learning (FedNSA) protocol that integrates encryption, MPC, and DP, i.e., a federated learning method by combining differential privacy noise shares, which includes the following steps in each round of iterative learning:

[0004] S1: Each client receives the global model generated by the server, and generates a local model based on the received global model;

[0005] S2: Each client generates a key pair based on a key agreement protocol, and broadcasts the public key in the respective key pair through the server;

[0006] S3: Any two clients generate the same random seed based on a key agreement function, and construct the same pseudo-random number generator based on the random seed;

[0007] S4: Based on the local model generated by the server in the current round, each client trains the local model based on its own private data set;

[0008] S5: Each client determines the Gaussian noise share according to the number of successfully broadcasted public keys;

[0009] S6: Based on the Gaussian noise share and the pseudo-random number generator, each client adds noise to its trained local model to perform model confusion;

[0010] S7: Each client uploads the confused local model to the server for model aggregation, and distributes the aggregated model as the global model in the next round, entering the next round.

[0011] Further, the S1 step further comprises the following steps:

[0012] S0: According to the current client connected to the server, the interaction of the self-defined noise variance between the clients is performed.

[0013] Further, in the S5 step, the determination of the Gaussian noise share specifically comprises the following steps:

[0014] Each client generates |U2|-1 Gaussian noise shares with a variance of for each client in the set U2 and all other clients.

[0015] Further, the variance is determined by the following formula:

[0016]

[0017] In the formula, is the total Gaussian noise quota of client u, is the total Gaussian noise quota of client v, and |U2| is the modulus of the client set U2.

[0018] Further, in the S3 step, the generation of the same random seed between two clients is represented by the following formula:

[0019] τ u,v =f(pKey u ,sKey v )=f(pKey v ,sKey u )=τ v,u

[0020] wherein τ u,v is a random seed generated by the client v receiving the public key pKey u of the client u, τ v,u is a random seed generated by the client u receiving the public key pKey v of the client v, f() is a key agreement function, sKey v is the private key of the client v, and sKey u is the private key of the client u.

[0021] Further, in the S6 step, the obfuscated model is obtained by the following formula:

[0022]

[0023] wherein M is the obfuscated model, Δ u is the trained local model, Z u,v is the Gaussian noise share allocated by the client u to the client v, G() is a pseudo-random number generator, σ is the noise variance between the client u and the client v, and L is the size of the model parameters.

[0024] Further, in the S7 step, the model aggregation is represented by the following formula:

[0025]

[0026] wherein w t+1 is the global model of the next round after aggregation, w t is the global model of the current round before aggregation, U3 is the set of clients successfully participating in model aggregation, |U3| is the modulus of the client set U3, and M is the obfuscated model.

[0027] The application also includes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the federated learning method through combination of differential privacy noise shares.

[0028] It also includes a device for processing data, comprising:

[0029] a memory having a computer program stored thereon;

[0030] a processor for executing a computer program in the memory to implement the steps of the federated learning method by combining differential privacy noise shares.

[0031] Compared with the prior art, the present application has at least the following beneficial effects:

[0032] (1) The federated learning method by combining differential privacy noise shares, device and medium, combines Gaussian mechanism with multi-party computation and encryption, effectively confuses the privacy information through the Gaussian mechanism, and ensures that the Gaussian noise can be perfectly eliminated in the aggregation process through multi-party computation and encryption;

[0033] (2) Since only public keys need to be exchanged between clients, the communication overhead can be greatly reduced;

[0034] (3) Based on Gaussian noise shares and noise allocation for random number generators, the computational overhead is small, and since the noise will be eliminated in the aggregation process, the accuracy of the model will not be compromised. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 is a step diagram of a federated learning method by combining differential privacy noise shares;

[0036] Figure 2 is a noise elimination schematic diagram. DETAILED DESCRIPTION

[0037] The following is a specific embodiment of the present application and further describes the technical solutions of the present application in combination with the drawings, but the present application is not limited to these embodiments.

[0038] In order to better understand the present application, the present embodiment briefly introduces the preparatory knowledge of the key technical points FL and DP in the federated learning method by combining differential privacy noise shares proposed by us.

[0039] Federated learning (FL) can enable multiple clients to jointly solve a machine learning problem under the coordination of a central server. Suppose there is a client set U with a size of N, and each client i has a private local data set D i . The federated learning problem can be formalized as minimizing the sum of a random function, defined as where w ∈ R L represents the parameters of the global model, l i (w) is the weight parameter of client i, which is used to specify the relative influence of each client. The general experience is to set where |D| = ∑ i |D i|.

[0040] To complete the training of w, federated learning iteratively performs the following steps for T rounds. In the t-th round, the steps are as follows: (1) The global model w t is distributed to each client from the central server. (2) Each client i obtains a local model w i by training the global model w t using its local dataset D i. (3) The central server collects all the local models w t+1 trained by the online clients and aggregates them on the server to obtain a new global model w . This update equation is t where U t+1 is the set of clients that successfully uploaded their local models at the t-th iteration. (4) Finally, the updated global model w is redistributed to the clients to start the (t+1)-th iteration.

[0041] Differential privacy (DP) is a paradigm that provides a rigorous mathematical foundation for quantifying and managing privacy risks associated with analyzing datasets containing sensitive information. It is defined as follows: A randomized mechanism M: X → R, whose domain is X and whose range is R, satisfies (ε, δ)-differential privacy if for all measurable sets and for any two neighboring databases D, D' ∈ X, have Pr[M(D) ∈ S] ≤ e ∈ Pr[M(D') ∈ S] + δ.

[0042] Here, ε is the privacy budget, which represents the distinguishable bound on all outputs on neighboring databases D and D'. δ represents the probability that two neighboring outputs of databases D and D' cannot be bounded by ε after using the algorithm M. Intuitively, a differential privacy mechanism M with a smaller privacy budget ε provides stronger privacy protection, and vice versa.

[0043] The Gaussian mechanism is a popular differential privacy mechanism that has been widely used in federated learning. It can be defined as follows.

[0044] Theorem under the Gaussian mechanism, let ε ∈ (0, 1). Given a dataset D and a query input w, a Gaussian mechanism satisfying (ε, δ)-differential privacy twists the query result by M G (w, ε) = q(w, D) + Z. Here is a Gaussian noise term following a Gaussian distribution . Here is an identity matrix of dimension L, and σ satisfies σ ≥ cΔq2 / ε, where c 2> 2ln(1.25 / δ). is the L2-sensitivity of q(w, D).

[0045] In federated learning (FL), the local model to be returned to the server can be regarded as the query result of the query function q(·). In practice, Gaussian noise Z can be generated by a pseudo-random generator, and the generation function is Z=G(τ,σ,L), τ is the seed of generating random numbers, and each client u independently generates Z according to its own privacy budget constraint.

[0046] The Gaussian mechanism is widely used in federated learning to achieve secure aggregation. This mechanism is applied to distort the local model update process of the client. The specific process is as follows, the client u generates Z u After local training, the local model is added to the model parameter change before being returned to the model parameter change, that is, The client u will Return to the server. Remove the model update distorted by its direct aggregation to obtain w t+1 =w t + Where, Z u Is independently generated by the client, Cannot be eliminated by the server, resulting in impaired model accuracy.

[0047] On the basis of the above, in order to solve the pain points of federated learning, such as Figure 1 As shown in the figure, the federated learning method for combining differential privacy noise shares proposed by the application includes the following steps in each round of iterative learning:

[0048] S0: According to the current client connected with the server, the interaction of self-defined noise variance between clients is carried out;

[0049] S1: Each client receives the global model generated by the server, and generates a local model based on the received global model;

[0050] S2: Each client generates a key pair based on a key agreement protocol, and broadcasts the public key in the respective key pair through the server;

[0051] S3: Any two clients generate the same random seed based on a key agreement function, and construct the same pseudo-random number generator based on the random seed;

[0052] S4: Based on the local model distributed and generated by the server in this round, each client trains the local model based on the respective private data set;

[0053] S5: Each client determines the Gaussian noise share according to the number of successfully broadcasted public keys;

[0054] S6: Based on the Gaussian noise share and pseudo-random number generator, each client performs model obfuscation by adding noise to its trained local model.

[0055] S7: Each client uploads the obfuscated local model to the server for model aggregation, and distributes the aggregated model as the global model for the next round to enter the next round.

[0056] In the present invention, it is mainly based on a Gaussian mechanism with two stages. These two stages can be roughly described as an initialization stage and a training stage. In the initialization stage, the client interacts with the customized noise variance according to the client currently connected to the server. In the training stage, each client generates a new public key in each training round and distributes these keys to other clients by running the key agreement protocol (DHKA, Diffie-Hellman). Based on the interacted key, the client u generates a random seed To generate U noise shares. It should be noted here that client u and client v generate the same noise share locally This allows the noise to be eliminated during aggregation.

[0057] Specifically, the complete process of federated noise-safe aggregation for noise assembly from noise shares during the training phase is as follows:

[0058] 1. First, at the beginning of training, the server generates the initial global model w0 and distributes it to all clients participating in this round of training. Here we use U1 to represent the set of clients participating in this stage.

[0059] 2. Based on the client currently connected to the server, a random seed is negotiated. The client u generates its own key pair (pKey u ,sKey u ). The client u then reports its public key pKey to the server. u After receiving the public keys uploaded by each client, the server broadcasts these public keys in the federated learning system so that each client can obtain the public key of any other client. Here, we define the set of clients that successfully upload public keys as U2. Then, based on the key agreement protocol, client u can obtain the public key of client v based on its public key pKey. v , generate a key pair between clients (pKey v ,sKey u ), accordingly, the client v can use the public key pKey of the client u u , generate a key pair between clients (pKey u ,sKey vBased on the inter-client key pair, client u and client v can generate the same random seed through the key agreement function, namely:

[0060] τ u,v =f(pKey u ,sKey v )=f(pKey v ,sKey u )=τ v,u

[0061] Where, τ u,v The public key pKey of client u is received by client v u The generated random seed, τ v,u The public key pKey of client v is received by client u v The generated random seed, f() is the key negotiation function, sKey v The private key of client v, sKey u The private key of client u.

[0062] Then client u and client v can use it to generate Gaussian noise for the random number generator.

[0063] 3. Each client trains its own local model. Each client u trains its local model on its private dataset And get the updated local model here, is the global model w distributed from the server at iteration t t A copy of .

[0064] 4. Each client adds noise disguise to its locally trained data. In this stage, client u first generates |U2|-1 based on the client set U2 that has successfully broadcast the public key. The Gaussian noise share of client u to client v is obtained by the following formula:

[0065]

[0066] Where, is the total Gaussian noise quota for client u, is the total Gaussian noise quota of client v, |U2| is the modulus of the client set U2, and the set of these Gaussian noise shares is defined as Z u,v .

[0067] Client u can then obfuscate updates to its local model as follows:

[0068]

[0069] where, is the obfuscated model, Δ u is the trained local model, Z u,v is the share of Gaussian noise assigned to client v by client u, G() is a pseudo-random number generator, is the noise variance between client u and client v, L is the size of the model parameters.

[0070] Here, let denote the total Gaussian noise added by client u to protect its model information. And let be set to so that Z u satisfies the privacy budget requirement of client u and facilitates controlling the number of rounds each client participates in training under the privacy budget control.

[0071] 5. The server aggregates the model data from each client. Here, we define the set of clients that successfully obfuscate their model data by adding noise and successfully upload to the server as U3. Then, without considering the case of clients dropping out, the aggregated model is obtained by

[0072]

[0073] where w t+1 is the global model after aggregation for the next round, w t is the global model before aggregation for the current round, and |U3| is the modulus of the client set U3. is the obfuscated model. Then, we can go back to step 2 to negotiate the random seed to start a new round of learning.

[0074] To better understand how the noise is eliminated, we give a simple example in Figure 2 In this example, there are only two clients (Participant 1 and Participant 2), which can generate the same Gaussian noise based on the key agreement protocol according to the exchanged public key and their own private key. For client 2, it will use negative noise to distort its model update. In this way, the noise disappears when aggregated on two clients. However, this simple example is vulnerable to collusion attacks because there are only two clients. When there are N > > 1 clients, each client generates N-1 shares of Gaussian noise, which means that client v only knows part of the noise information of client u (for simplicity, we do not consider the case of disconnection here). This case is very resistant to collusion attacks unless the attacker can control the majority of clients in the system.

[0075] Based on the theory proposed in the present application, it is assumed that the model update uploaded by the client u is Then, for the t-th learning round, the global model obtained by the server through aggregation is:

[0076]

[0077] Through the derivation of the formula, it can be proved that all the noises can be perfectly offset in the aggregation step, without causing the model accuracy to be impaired.

[0078] In the case of ignoring the privacy budget (ε u , δ u ) setting , only assuming that the value of is known, according to the federated noise-safe aggregation (FedNSA) protocol, known and the variance of Z u is derived as follows:

[0079]

[0080] In the formula, Var() is the variance function. Here, the equation is established because each noise share Z u,v is independently generated, so their total variance is equal to the sum of the respective variances. At the same time, each Z u,v obeys a Gaussian distribution with a mean of 0, and it is easy to derive that Z u obeys a Gaussian distribution with a mean of 0. Therefore, the noise term Z u can at least guarantee (ε u , δ u )-differential privacy for the client u. Although this way of calculating the privacy budget may increase the variance of the noise, it strengthens the privacy protection. In addition, since the noise is almost perfectly eliminated, its impact on model convergence is actually negligible.

[0081] Then, under this learning method, assuming that there are |U c | (denoted as U c ) clients in collusion attack, let represent the proportion of colluding clients in the system. Then, the impact of collusion can be quantified as follows.

[0082] For the client u, when facing collusion attacks from the server and |U c | colluding clients. Since each noise share obeys a Gaussian distribution, even if |U c | noise shares are removed, the sum of the remaining noise shares still obeys a Gaussian distribution. And due to the theorem under the Gaussian mechanism, it can be concluded that where c 2 2ln(1.25 / δ u ). Thus, when the noise variance is reduced to (1-k) times of its original value , it satisfies -differential privacy, which also generates noise with variance . Therefore, if in federated noise secure aggregation, only a certain system parameter k (that is, the proportion of clients participating in collusion attacks) is set in advance, then each benign client u can set (1-k) ∈ u as the privacy budget to ensure (∈ u , δ u )-differential privacy. The specific size of the system parameter k is set based on assumptions. The larger this parameter is, the more collusion clients it can resist, but the greater the disturbance to the model when it drops out, which needs to be weighed.

[0083] Of course, in federated learning with resource-constrained devices, client dropouts are not uncommon. Let U d represent the set of dropped clients in aggregation. The impact of client dropout on model accuracy is as follows.

[0084] Let represent the proportion of dropped clients. Since all noise shares can be canceled out when aggregated, the expected total noise of the dropped client U d becomes:

[0085]

[0086] If U d is uniformly selected from U2, it can be inferred that the expected variance can be represented as which is λ times the total noise variance. Therefore, 1-λ times of the noise variance can be eliminated in expectation.

[0087] In practice, the proportion of dropped clients is limited, and the noise between clients is independent, so there is no need to generate any additional overhead for client recovery. Therefore, the impact of U d can be controlled within a certain range.

[0088] The application also provides a computer readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the federated learning method by combining differential privacy noise shares.

[0089] Also includes a device for processing data, comprising:

[0090] a memory having a computer program stored thereon;

[0091] A processor configured to execute a computer program in the memory to implement the steps of the federated learning method by combining differential privacy noise shares.

[0092] In summary, the federated learning method by combining differential privacy noise shares, the device and the medium, combine the Gaussian mechanism with multi-party computation and encryption, effectively confuse the privacy information through the Gaussian mechanism, and the multi-party computation and encryption ensure that the Gaussian noise can be perfectly eliminated in the aggregation process.

[0093] Since only public keys need to be exchanged between clients, the communication overhead can be greatly reduced. Based on the Gaussian noise share and the noise allocation for the random number generator, the computational overhead is small, and since the noise will be eliminated in the aggregation process, the accuracy of the model will not be compromised.

[0094] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present application are only used to explain the relative positional relationship, movement condition, etc. between components in a certain posture (as shown in the drawings), and if the certain posture changes, the directional indications will also change accordingly.

[0095] In addition, the descriptions such as "first", "second", "one" and the like in the present application are only for the purpose of description, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "a plurality of" is at least two, such as two, three, etc., unless otherwise specifically limited.

[0096] In the present application, unless otherwise specifically defined and limited, the terms "connection", "fixing" and the like should be understood broadly, for example, "fixing" can be fixed connection, or detachable connection, or integral; can be mechanical connection, or electrical connection; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of two elements or the interaction relationship between two elements, unless otherwise specifically limited. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0097] In addition, the technical solutions of each embodiment of the present application can be combined with each other, but it must be based on the fact that a person skilled in the art can realize it, when the combination of technical solutions appears contradictory or unachievable, it should be considered that the combination of technical solutions does not exist, nor within the scope of protection required by the present application.

Claims

1. A federated learning method by combining differential privacy noise shares, characterized in that, In each iteration of the iterative learning, the following steps are included: S1: Each client receives the global model generated by the server, and generates a local model based on the received global model; S2: Each client generates a key pair based on a key agreement protocol, and broadcasts the public key in the respective key pair through the server; S3: Any two clients generate the same random seed based on a key agreement function, and construct the same pseudo-random number generator based on the random seed; S4: Based on the local model distributed and generated by the server in the current round, each client trains the local model based on the respective private data set; S5: Each client determines the Gaussian noise share according to the number of successfully broadcasted public keys; S6: Based on the Gaussian noise share and the pseudo-random number generator, each client adds noise to the trained local model for model confusion; S7: Each client uploads the confused local model to the server for model aggregation, and distributes the aggregated model as the global model in the next round to enter the next round.

2. The federated learning method of combining differential privacy noise shares of claim 1, wherein, The S1 step further includes the following step: S0: According to the current client connected to the server, the interaction of custom noise variance between clients is performed.

3. The federated learning method of combining differential privacy noise shares of claim 2, wherein, In the S5 step, the determination of the Gaussian noise share specifically includes the following steps: Each client broadcasts a set of successful clients U2 according to the public key, and generates |u2| - 1 shares of Gaussian noise for each of the other clients. Each client broadcasts a set of successful clients U2 according to the public key, and generates |u2| - 1 shares of Gaussian noise for each of the other clients.

4. The federated learning method of combining differential privacy noise shares of claim 3, wherein, variance is determined by the formula: wherein is the total Gaussian noise quota for client u, is the total Gaussian noise quota for client v, |U2| is the modulus of the client set U2.

5. The federated learning method of combining differential privacy noise shares of claim 1, wherein, In the S3 step, the generation of the same random seed between two clients is represented by the following formula: τ u,v = f(pKey u , sKey v ) = f(pKey v , sKey u ) = τ v,u where τ u,v is the public key of client u received by client v u is the random seed generated by client u v,u is the public key of client v received by client u v is the random seed generated by client v, f() is the key agreement function, sKey v is the private key of client v, sKey u is the private key of client u.

6. The federated learning method of combining differential privacy noise shares of claim 5, wherein, In the S6 step, the confused model is obtained by the following formula: wherein is the obfuscated model, Δ u is the trained local model, Z u,v is the share of Gaussian noise assigned to client u for client v, G() is a pseudo-random number generator, is the noise variance between client u and client v, L is the size of the model parameters.

7. The federated learning method of combining differential privacy noise shares of claim 1, wherein, In the S7 step, the model aggregation is represented by the following formula: In the formula, w t+1 is the global model of the next round after aggregation, w t is the global model of the current round before aggregation, U3 is the set of clients that successfully participate in model aggregation, |U3| is the modulus of the client set U3, is the obfuscated model.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to realize the steps of the federated learning method in any one of claims 1 to 7.

9. An apparatus for processing data, the apparatus comprising: Comprise: A memory having a computer program stored thereon; A processor for executing the computer program in the memory to realize the steps of the federated learning method in any one of claims 1 to 7.

Images