Privacy protection joint training platform based on split learning
By introducing a joint privacy protection training platform and differential privacy technology based on split learning in traditional centralized learning methods, the shortcomings of traditional methods in data privacy protection and model performance improvement are solved, and effective data privacy protection and model performance improvement are achieved, which are suitable for multiple industries.
Patent Information
- Application Number
- CN202411741730.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-04-11
AI Technical Summary
Traditional centralized learning methods have shortcomings in data privacy protection, and it is difficult to improve the learning effect and prediction accuracy of models while ensuring data privacy, especially when the amount of data is limited.
Using a joint training platform for privacy protection based on split learning, we use the model to divide the model into two parts, share training tasks between the participants' local and central servers, share only model parameters or intermediate activation values, avoid raw data transmission, and introduce differential privacy technology in gradient updates to protect data privacy by adding random noise.
Effectively protect user privacy, avoid data leakage and privacy violations, improve the learning effect and prediction accuracy of the model, and is suitable for multiple industries, especially in areas such as medical care and finance that require high privacy protection.
Smart Images
Figure CN119808139A_ABST
Abstract
Description
Technical Field
[0001] The present invention mainly relates to the fields of artificial intelligence and image detection, and in particular to an image detection method based on split learning and differential privacy technology. Background Art
[0002] As the demand for data privacy protection increases, traditional centralized learning methods face the risk of data leakage and privacy violation. Split learning, as an emerging distributed learning method, allows participants to jointly train models without sharing original data, thereby effectively protecting data privacy. By distributing data across different devices or locations, split learning can train models locally and only share model parameters or gradient information, thereby avoiding direct contact with sensitive data.
[0003] At the same time, differential privacy technology provides a theoretical basis for data protection. Differential privacy protects user privacy by adding random noise during model training to ensure that the impact of any single data point on the model output is limited. However, the implementation of differential privacy often leads to a decrease in model performance, especially when the amount of data is limited.
[0004] Research combining split learning and differential privacy technology has gradually attracted attention, aiming to improve the learning effect and prediction accuracy of the model while ensuring data privacy. Research and application in this field can help to safely use big data in multiple industries, especially in fields such as medicine and finance that have high requirements for privacy protection. Summary of the invention
[0005] The present invention provides a privacy-preserving joint training platform based on split learning, which aims to solve the problem of data privacy protection in multi-party collaboration, especially in the field of skin health detection. By dividing the model into two parts, the first half is trained locally by the participating party, and the second half is aggregated on the central server. The participating parties only need to share model parameters or intermediate activation values, avoiding the transmission of original data, thereby effectively protecting user privacy. In addition, the platform introduces differential privacy technology, which limits the impact of a single data point on the model output by adding random noise to the gradient, thereby ensuring the compliance of data use. The platform is flexible and scalable, suitable for multiple fields such as medical care and finance, and has promoted the development of joint learning technology.
[0006] The purpose of the present invention can be achieved by the following technical solutions:
[0007] Step S1: data preprocessing, including data collection, standardization and data division;
[0008] Step S2: Model training, training the model on multiple devices using a split learning method, the method including model initialization, parameter update and differential privacy addition, using differential privacy technology to add noise to the model parameter update during the model training process to ensure user data privacy;
[0009] Step S3: Model validation, through various performance evaluation methods, evaluate the accuracy and robustness of the model to ensure its performance on unseen data;
[0010] Step S4: Skin health prediction, applying the trained model to new skin images and outputting skin health detection results.
[0011] Further, step S1 includes:
[0012] Step S1.1: Data collection, obtaining skin image data from the public dataset HAM10000, which contains multiple types of skin lesion images;
[0013] Step S1.2: Data standardization: standardize the images from different sources in the dataset, including: scaling the images to a uniform size; converting the images into PyTorch tensors; and finally Standardization is performed, where output c is the pixel value of the standardized image in channel c; input c is the pixel value of the original image in channel c; mean c is the mean of channel c; std c is the standard deviation of channel c;
[0014] Step S1.3: Data division: divide the processed data set into training set D train and the test set D test , specifically including: training set Used for model training; test set Used for parameter adjustment, model selection, and final performance evaluation to ensure the generalization ability of the model.
[0015] Further, step S2 includes:
[0016] Step S2.1: Model initialization, initializing model parameters on multiple devices, including selecting a suitable deep learning model architecture, such as the initial parameter θ0 of the model; configuring training hyperparameters, such as learning rate η, batch size B, and number of training rounds E;
[0017] Step S2.2: split learning training process under privacy protection, specifically including the training process on the client and server sides and the addition of noise;
[0018] Step S2.3: Monitor the training process and monitor the loss function L(θ; D train ), L(θ; D test ) and accuracy Acc(θ; D train ), Acc9θ; D test ) in order to judge the convergence of the model, including: recording the loss value and accuracy of each training round; adjusting the learning rate η and other hyperparameters according to the monitoring results to optimize the training effect;
[0019] Step S2.4: Determine the termination condition. During the training process, determine whether to stop training according to the preset termination condition. Specifically, when the performance of the validation set fails to improve within several rounds, stop training to prevent overfitting; when the maximum number of training rounds E is reached, terminate the training process.
[0020] Further, step S2.2 includes:
[0021] Step S2.2.1: Forward propagation, forward propagation is performed on the client, and the activation value of each layer is calculated until the last layer of the client is reached;
[0022] Step S2.2.2: Send activation information, sending the output activation information of the last layer of the client to the server;
[0023] Step S2.2.3: Server-side forward propagation: The server continues forward propagation and calculates the loss;
[0024] Step S2.2.4: Server-side back propagation, the server performs back propagation and calculates the gradient Then the gradient information is sent back to the client;
[0025] Step S2.2.5: Noise addition on the server side. After back propagation on the server side, noise is added to the gradient after gradient clipping, and the noisy gradient is calculated: in is the clipped gradient, is the added random noise, which has a mean of 0 and a variance of σ 2 C 2 is a Gaussian distribution of , where σ is the standard deviation, C is the crop size, and I is the gradient dimension. Average gradient after adding noise to the server side;
[0026] Step S2.2.6: Server-side model parameter update: in Indicates the current server-side model parameters. Indicates the updated server-side model parameters;
[0027] Step S2.2.7: Client back propagation: The client uses the received gradient information for back propagation to complete the training of the entire model;
[0028] Step S2.2.8: Client-side noise addition, after client-side backpropagation, add noise to the model parameter update and calculate the noisy gradient: The meaning of the parameters is the same as that of the server, except that the parameters are owned by the client.
[0029] Step S2.2.9: Client model parameter update, using the gradient after adding noise to update the client model parameters: The meaning of the parameters is the same as that on the server.
[0030] Further, step S3 includes:
[0031] Step S3.1: Cross-validation, set the validation set D val Divide into k subsets {D val,1 ,D val,2 ,…,D val,k}, perform k training and validation, specifically including: each time select a subset as the validation set and the remaining k-1 subsets as the training set D train,k =D val \D val,i , to evaluate the generalization ability of the model;
[0032] Step S3.2: Performance evaluation, using a variety of evaluation indicators to evaluate the performance of the model on the validation set, including: Accuracy: Among them, TP (True Positives) are true positive examples, TN (True Negatives) are true negative examples, FP (False Positives) are false positive examples, and FN (False Negatives) are false negative examples. Recall: Precision:
[0033] Step S3.3: Hyperparameter tuning: According to the results of cross-validation, adjust the model's hyperparameters (such as learning rate η, batch size B, and number of training rounds E) to optimize model performance, specifically including: selecting the hyperparameter combination that performs best on the validation set;
[0034] Step S3.4: Final evaluation, after model training and validation, using the test set D test The final model is evaluated and the final performance indicators are calculated to confirm the effectiveness of the model and ensure the performance of the model on unseen data.
[0035] Further, step S4 includes:
[0036] Step S4.1: Input image processing, convert the new skin image x new The specific processing process is consistent with the table conversion process in data preprocessing, that is, scaling the images to a uniform size, then converting the images into PyTorch tensors, and finally following Standardization is performed, where output c is the pixel value of the standardized image in channel c; input c is the pixel value of the original image in channel c; mean c is the mean of channel c; std c is the standard deviation of channel c;
[0037] Step S4.2: Model inference: Input the processed image x′ into the trained model for inference and calculate the output lesion type probability distribution P(y|x ′ ; θ), where y represents the lesion type and θ is the trained model parameter;
[0038] Step S4.3: Result output, determine the final prediction result based on the output probability distribution of the model By formula The lesion type with the highest probability is selected as the prediction result. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] Figure 1 This is the overall work flow chart of this joint training platform.
[0040] Figure 2The schematic diagram of the differential privacy split learning method is shown. The attacker cannot attack the model in three aspects: first, when attacking from the intermediate data, the original data cannot be restored; second, when attacking from the client or server, due to the introduction of differential privacy protection, the attacker cannot obtain valuable information.
[0041] Figure 3 This is a graph of the training results related to the joint training platform. The values in the graph are the test accuracy. DETAILED DESCRIPTION
[0042] In order to make the technical solutions in the present invention better understood by the persons skilled in the art, the technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments.
[0043] Embodiment 1:
[0044] This embodiment is a privacy-preserving joint training platform based on split learning, which includes the following steps:
[0045] Step S1: data preprocessing, specifically including data collection, standardization and data division; in the present invention, the data set uses the public data set HAM10000, which contains about 10,000 skin images, covering various types of skin lesions.
[0046] Step S1.1: Data collection, obtaining skin image data from the public dataset HAM10000, which contains multiple types of skin lesion images.
[0047] Step S1.2: Data standardization: standardize the images from different sources in the dataset, including: scaling the images to a uniform size of 64×64 pixels; then converting the images into PyTorch tensors, which can convert the image pixel value range from [0, 255] to [0, 1]. Finally, we set the mean and standard deviation of each channel to 0.5, and use the formula Change the image pixel value range to [-1, 1].
[0048] Step S1.3: Data division: divide the processed data set into a training set and a test set. Specifically, the training set is used for model training (accounting for 80%, a total of 8,000 images), and the test set is used for parameter adjustment, model selection, and final performance evaluation (accounting for 20%, a total of 2,000 images) to ensure the generalization ability of the model.
[0049] Step S2: Model training, using a split learning method to train the model on multiple devices. The method includes model initialization, parameter update, and differential privacy addition. Differential privacy technology is used to add noise to the model parameter update during the model training process to ensure user data privacy;
[0050] Step S2.1: Model initialization, initializing model parameters on multiple devices, specifically including selecting a suitable deep learning model architecture, specifically including selecting a suitable deep learning model architecture, such as the initial parameter θ0 of the model; configuring training hyperparameters, such as learning rate η=0.001, batch size B=64 and number of training rounds E=100.
[0051] Step S2.2: The split learning training process under privacy protection specifically includes the training process on the client and server sides and the addition of noise.
[0052] Step S2.2.1: Forward propagation, forward propagation is performed on the client, calculating the activation value of each layer until the last layer of the client is reached.
[0053] Step S2.2.2: Send activation information, and send the output activation information of the last layer of the client to the server.
[0054] Step S2.2.3: Server-side forward propagation. The server continues forward propagation and calculates the loss.
[0055] Step S2.2.4: Server-side back propagation, the server performs back propagation and calculates the gradient The gradient information is then sent back to the client.
[0056] Step S2.2.5: Noise addition on the server side. After back propagation on the server side, noise is added to the gradient after gradient clipping, and the noisy gradient is calculated: in is the clipped gradient, is the added random noise, which has a mean of 0 and a variance of σ 2 C 2 Gaussian distribution of , where σ is the standard deviation, C is the crop size, which is set to 1 in this embodiment, and I is the target dimension. Average gradient after adding noise to the server.
[0057] Step S2.2.6: Server-side model parameter update, using the gradient after adding noise to update the server-side model parameters:
[0058] Step S2.2.7: Client back propagation: The client uses the received gradient information for back propagation to complete the training of the entire model.
[0059] Step S2.2.8: Client-side noise addition, after client-side backpropagation, add noise to the model parameter update and calculate the noisy gradient: The meaning of the parameters is the same as that on the server, except that the parameters are owned by the client.
[0060] Step S2.2.9: Client model parameter update, using the gradient after adding noise to update the client model parameters: The meaning of the parameters is the same as that on the server.
[0061] Step S2.3: Monitor the training process and monitor the loss function L(θ; D train ), L(θ; D test ) and accuracy Acc(θ; D train ), Acc(θ; D test ) to determine the convergence of the model, including: recording the loss value and accuracy of each training round; adjusting the learning rate η and other hyperparameters according to the monitoring results to optimize the training effect. We use CrossEntropyLoss as the loss function;
[0062] Step S2.4: determine the termination condition, during the training process, determine whether to stop the training according to the preset termination condition, specifically including: when the performance of the verification set fails to improve within several rounds, stop the training to prevent overfitting; in this embodiment, when the number of training rounds reaches 86, the training process is terminated.
[0063] Step S3: Model validation, using various performance evaluation methods to evaluate the accuracy and robustness of the model to ensure its performance on unseen data;
[0064] Step S3.1: Cross-validation, set the validation set D val Divided into 5 subsets {D val,1 ,D val,2 ,…,D val,5}, and conduct 5 training and validation, including: each time selecting a subset as the validation set and the remaining 4 subsets as the training set D train,5 =D val \D val,i , to evaluate the generalization ability of the model;
[0065] Step S3.2: Performance evaluation, using a variety of evaluation indicators to evaluate the performance of the model on the validation set, including: Accuracy: Among them, TP (True Positives) are true positive examples, TN (True Negatives) are true negative examples, FP (False Positives) are false positive examples, and FN (False Negatives) are false negative examples.
[0066] Step S3.3: Hyperparameter tuning. According to the verification results, adjust the model's hyperparameters (such as learning rate η, batch size B, and number of training rounds E) to optimize model performance. Specifically, select the hyperparameter combination that performs best on the verification set. After tuning, the optimal learning rate η is 0.001, the optimal batch size B is 64, and the optimal number of training rounds E is 100.
[0067] Step S3.4: Final evaluation, after model training and validation are completed, the final model is evaluated using the test set and the final performance indicators are calculated to confirm the effectiveness of the model and ensure the performance of the model on unseen data.
[0068] Step S4: Skin health prediction, applying the trained model to new skin images, outputting the prediction results of lesion types, and providing corresponding diagnostic suggestions;
[0069] Step S4.1: Input image processing, specifically including: scaling the image to a uniform size of 64×64 pixels; then converting the image to a PyTorch tensor, which can convert the image pixel value range from [0, 255] to [0, 1]. Finally, we set the mean and standard deviation of each channel to 0.5, using the formula Change the image pixel value range to [-1, 1].
[0070] Step S4.2: Model inference: input the processed image into the trained model for inference and calculate the output lesion type probability distribution P(y|x ′ ; θ), where y represents the lesion type and θ is the trained model parameter.
[0071] Step S4.3: Model inference, the processed image x ′ Input into the trained model for inference and calculate the output lesion type probability distribution P(y|x ′ ; θ), where y represents the lesion type. There are 7 lesion types, namely, actinic keratosis, basal cell carcinoma, benign keratotic lesions, cutaneous fibroma, melanoma, melanocytic nevus, and vascular lesions, and θ is the trained model parameter.
[0072] Figure 3 The performance of split learning, federated learning, split learning using differential privacy, and federated learning on different datasets is demonstrated, where ε is the privacy budget parameter in differential privacy.
[0073] It can be seen from the above technical solutions that the present invention has the following advantages: by adopting split learning and differential privacy technology, it can effectively protect the user's personal health data, avoid data leakage and privacy infringement, and meet the requirements of modern data protection regulations. Secondly, the split learning method allows multiple devices to train models in parallel, making full use of distributed computing resources, thereby improving the efficiency and speed of model training. At the same time, combined with the deep learning model, the present invention can automatically learn and extract effective features, improve the accuracy of skin lesion detection, and reduce the influence of human factors. In addition, the flexibility of the system enables it to adapt to different data sources and devices, and is easy to apply in various environments. By introducing cross-validation and multiple performance evaluation indicators, the performance of the model on unseen data is ensured, thereby enhancing the robustness and generalization ability of the model. Finally, the present invention is not only suitable for skin health detection, but can also be promoted and applied to other fields such as medical image analysis and financial data protection. It has high social and economic value. At the same time, its implementation plan is clear and clear, which is convenient for deployment and promotion in practical applications, and reduces the threshold for technical implementation.
[0074] For those skilled in the art, the present invention is not limited to the exemplary details of the above embodiments. The protection scope of the present invention should be limited by the scope of the appended claims rather than the above embodiments. Any equivalent changes made according to the technical solution of the present invention should fall within the protection scope of the present invention.
Claims
1. A privacy-preserving joint training platform based on split learning, characterized in that: The following steps are involved: Step S1: data preprocessing, including data collection, standardization and data division; Step S2: Model training, training the model on multiple devices using a split learning method, the method including model initialization, parameter update and differential privacy addition, using differential privacy technology to add noise to the model parameter update during the model training process to ensure user data privacy; Step S3: Model validation, through various performance evaluation methods, evaluate the accuracy and robustness of the model to ensure its performance on unseen data; Step S4: Skin health prediction, applying the trained model to new skin images and outputting skin health detection results.
2. According to claim 1, a privacy-preserving joint training platform based on split learning is characterized by: In step S1, data preprocessing includes the following steps: Step S1.1: Data collection, obtaining skin image data from the public dataset HAM10000, which contains multiple types of skin lesion images; Step S1.2: Data standardization: standardize the images from different sources in the dataset, including: scaling the images to a uniform size; converting the images into PyTorch tensors; and finally Standardization is performed, where output c is the pixel value of the standardized image in channel c; input c is the pixel value of the original image in channel c; mean c is the mean of channel c; std c is the standard deviation of channel c; Step S1.3: Data division: divide the processed data set into training set D train and the test set D test , specifically including: training set Used for model training; test set Used for parameter adjustment, model selection, and final performance evaluation to ensure the generalization ability of the model.
3. The privacy-preserving joint training platform based on split learning according to claim 1, characterized in that: In step S2, model training includes the following steps: Step S2.1: Model initialization, initializing model parameters on multiple devices, including selecting a suitable deep learning model architecture, such as the initial parameter θ0 of the model; configuring training hyperparameters, such as learning rate η, batch size B, and number of training rounds E; Step S2.2: split learning training process under privacy protection, specifically including the training process on the client and server sides and the addition of noise; Step S2.3: Monitor the training process and monitor the loss function L(θ; D train ), L(θ; D test ) and accuracy Acc(θ; D train ), Acc(θ; D test ) in order to judge the convergence of the model, including: recording the loss value and accuracy of each training round; adjusting the learning rate η and other hyperparameters according to the monitoring results to optimize the training effect; Step S2.4: Determine the termination condition. During the training process, determine whether to stop training according to the preset termination condition. Specifically, when the performance of the validation set fails to improve within several rounds, stop training to prevent overfitting; when the maximum number of training rounds E is reached, terminate the training process.
4. The privacy-preserving joint training platform based on split learning according to claim 3, characterized in that: In step S2.2, the split learning training includes the following steps: Step S2.2.1: Forward propagation, forward propagation is performed on the client, and the activation value of each layer is calculated until the last layer of the client is reached; Step S2.2.2: Send activation information, sending the output activation information of the last layer of the client to the server; Step S2.2.3: Server-side forward propagation: The server continues forward propagation and calculates the loss; Step S2.2.4: Server-side back propagation, the server performs back propagation and calculates the gradient Then the gradient information is sent back to the client; Step S2.2.5: Noise addition on the server side. After back propagation on the server side, noise is added to the gradient after gradient clipping, and the noisy gradient is calculated: in is the clipped gradient, is the added random noise, which has a mean of 0 and a variance of σ 2 C 2 is a Gaussian distribution of , where σ is the standard deviation, C is the crop size, and I is the gradient dimension. Average gradient after adding noise to the server side; Step S2.2.6: Server-side model parameter update: in Indicates the current server-side model parameters. Indicates the updated server-side model parameters; Step S2.2.7: Client back propagation: The client uses the received gradient information for back propagation to complete the training of the entire model; Step S2.2.8: Client-side noise addition, after client-side backpropagation, add noise to the model parameter update and calculate the noisy gradient: The meaning of the parameters is the same as that of the server, except that the parameters are owned by the client. Step S2.2.9: Client model parameter update, using the gradient after adding noise to update the client model parameters: The meaning of the parameters is the same as that on the server.
5. The privacy-preserving joint training platform based on split learning according to claim 1, characterized in that: In step S3, model validation includes the following steps: Step S3.1: Cross-validation, set the validation set D val Divide into k subsets {D val,1 ,D val,2 ,…,D val,k }, perform k training and validation, specifically including: each time select a subset as the validation set and the remaining k-1 subsets as the training set D train,k =D val \D val,i , to evaluate the generalization ability of the model; Step S3.2: Performance evaluation, using a variety of evaluation indicators to evaluate the performance of the model on the validation set, including: Accuracy: Among them, TP (True Positives) is a true positive example, TN (True Negatives) is a true negative example, FP (False Positives) is a false positive example, and FN (False Negatives) is a false negative example; Recall: Precision: Step S3.3: Hyperparameter tuning: According to the results of cross-validation, adjust the model's hyperparameters (such as learning rate η, batch size B, and number of training rounds E) to optimize model performance, specifically including: selecting the hyperparameter combination that performs best on the validation set; Step S3.4: Final evaluation, after model training and validation, using the test set D test The final model is evaluated and the final performance indicators are calculated to confirm the effectiveness of the model and ensure the performance of the model on unseen data.
6. A privacy-preserving joint training platform based on split learning according to claim 1, characterized in that: In step S4, skin health prediction includes the following steps: Step S4.1: Input image processing, convert the new skin image x new The specific processing process is consistent with the table conversion process in data preprocessing, that is, scaling the images to a uniform size, then converting the images into PyTorch tensors, and finally following To standardize, output c is the pixel value of the standardized image in channel c; input c is the pixel value of the original image in channel c; mean c is the mean of channel c; std c is the standard deviation of channel c; Step S4.2: Model inference, input the processed image x′ into the trained model for inference, and calculate the output lesion type probability distribution P(y|x′; θ), where y represents the lesion type and θ is the trained model parameter; Step S4.3: Result output, determine the final prediction result based on the output probability distribution of the model By formula The lesion type with the highest probability is selected as the prediction result.