Federated learning-based crowd-sensing data privacy protection method and storage medium

Abstract

The application discloses a kind of group intelligence perception data privacy protection method and storage medium based on federal learning, in the federal learning process of group intelligence perception, multi-level privacy protection to transmission and aggregation process is realized by double-layer mask and adaptive differential perturbation mechanism, double-layer mask method combines the private mask of equipment and the public mask of server, and multiple encryption is carried out to model parameter, to ensure the security of parameter in transmission process, adaptive differential perturbation mechanism dynamically adjusts noise size according to the change of model, while maintaining model accuracy, protects data privacy.The scheme can effectively solve the privacy protection problem of group intelligence perception data in federal learning.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of privacy data security protection of crowd-sensing, and particularly relates to a crowd-sensing data privacy protection method based on federated learning. BACKGROUND

[0002] With the rapid development of Internet of Things (IoT) and smart devices, crowd-sensing technology provides important support for data collection, sharing and analysis among multiple devices. Smartphones, wearable devices, sensors and other terminals can collect data such as user behavior, health status and environmental information, forming rich data resources and bringing great value to health monitoring, environmental monitoring and other fields. However, these data often contain highly sensitive personal information such as health data and location information, and traditional centralized data upload and processing methods face great challenges in privacy protection. In the application of crowd-sensing, how to effectively protect the privacy data of users while ensuring the value of data and safe sharing has become a problem to be solved.

[0003] Federated learning (FL) as a new distributed machine learning method provides a new processing framework for privacy data protection. Unlike traditional centralized data processing methods, federated learning allows each device to train the model locally, avoiding direct upload of raw data, thereby greatly reducing the risk of privacy leakage. Each device generates model parameter updates through local training and sends these updates to the central server, which aggregates the updated parameters to obtain a global model, achieving the goal of collaborative learning. This mode is particularly effective in crowd-sensing data processing, as it allows data to remain local to the device, ensuring user privacy. However, in practical applications, federated learning still faces some technical challenges in the crowd-sensing environment, particularly in terms of privacy protection during model parameter transmission and aggregation.

[0004] Although federated learning avoids direct upload of raw data, local model parameters may still be intercepted by malicious attackers during transmission, posing a risk of privacy leakage. In addition, during the aggregation process, the central server may infer sensitive information about individual devices by analyzing the model parameters uploaded by the devices. Therefore, in order to truly protect the privacy of data, it is necessary to ensure the security of the transmission process, take multi-level protection measures for model parameters, and prevent the central server from obtaining the privacy information of devices through model updates during the aggregation stage. How to maximize the effectiveness of the model and the accuracy of collaborative learning while ensuring data privacy is a difficult problem to be solved in the process of combining crowd-sensing and federated learning. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art and provide a crowd-sensing data privacy protection method based on federated learning, which can effectively solve the privacy protection problem of crowd-sensing data in federated learning. The double-layer mask and the adaptive differential perturbation mechanism are used to realize multi-level privacy protection in the transmission and aggregation process. The double-layer mask method combines the private mask of the device and the public mask of the server to encrypt the model parameters multiple times, ensuring the security of the parameters during transmission. The adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes of the model, protecting the data privacy while maintaining the model accuracy.

[0006] To achieve the above purpose, the technical scheme adopted by the present application is as follows: a crowd-sensing data privacy protection method based on federated learning, in the federated learning process of crowd-sensing, through double-layer mask and adaptive differential perturbation mechanism to realize multi-level privacy protection in the transmission and aggregation process, double-layer mask method combines the private mask of the device and the public mask of the server to encrypt the model parameters multiple times, ensuring the security of the parameters during transmission, adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes of the model, protecting the data privacy while maintaining the model accuracy. The method specifically includes the following steps: system initialization stage, data acquisition stage of edge intelligent sensing device, training output protection mechanism stage based on double-layer mask, differential perturbation stage of local model, global model aggregation and differential perturbation stage five stages; the method combines edge computing and federated learning, adopts hierarchical federated learning architecture, reduces the transmission and centralized storage of sensing data, effectively reduces the risk of user privacy leakage, and realizes the availability and invisibility of data through the distributed training model of federated learning, and solves the data island problem.

[0007] The system initialization stage includes:

[0008] Step 1-1: Key generation and distribution: when the system is initialized, the parameter server generates a large prime number p and an initial random number r, and generates a symmetric key K using a discrete logarithm-based algorithm. Each edge device u and sensing device v receives key negotiation parameters (such as random number r u and r v ) from the parameter server, and calculates the shared key K u,v to ensure secure communication.

[0009] Step 1-2: Device registration and authentication: the parameter server assigns a unique identity ID i to each device, and uses a hash function H to encrypt the device identity to ensure the security of identity verification; the server generates a private mask θ i and a coefficient vector λ i for each device, and transmits them to each device after encryption.

[0010] Steps 1-3: Model Parameter Initialization: Upon system startup, the central server sets the initial global model parameters ω0, which can be a zero vector or a small random value to ensure the stability of the model's initial state. The initial model parameters ω0 are distributed to all edge nodes and sensing devices. This ensures that the model parameters of the entire system remain consistent in the initial state, facilitating subsequent collaborative training and model updates.

[0011] The data acquisition phase of the edge intelligent sensing device specifically involves: in this phase, we need to collect data from the edge intelligent device and send it to the border gateway. After collection is complete, the edge intelligent device can go offline and then perform other tasks. The border gateways store the data for aggregation.

[0012] The training output protection mechanism based on double-layer masking specifically includes the following stages:

[0013] Step 2-1: Each sensing device generates a personal random mask vector θ at the start of training. i This mask is used to protect the privacy of the device's local training output data. θ i It is an n-dimensional column vector with values ​​in the range [0,1]. The device will... i After normalization, the coefficient vector λ is obtained. i and use symmetric encryption on θ i and λ i They are encrypted and then sent to the edge server.

[0014] Step 2-2: The edge server receives the encrypted mask vector θ from each device. i and coefficient vector λ i The server then constructs a common coefficient matrix P from these vectors. The server verifies the linear independence of these vectors and checks the linear independence of these vectors to ensure that the constructed matrix is ​​full rank.

[0015] When the coefficient matrix reaches full rank, a common mask Λ and an inverse matrix P are generated. -1 The ciphertext is encrypted using a symmetric encryption algorithm. The encrypted public mask Λ is then distributed to each participating sensing device through a secure communication channel. The sensing devices decrypt the ciphertext to obtain the public mask and coefficient matrix.

[0016] Steps 2-3: In each round of training in federated learning, the perception device i will be based on the local dataset D i Perform local training and generate a partial model output Y. i k Each sensing device i has a local dataset D. i The device transmits data to the local model, and through forward propagation of the local model, the device obtains a corresponding partial model output.

[0017] In each round of training, the sensing device performs the above process on multiple input samples, resulting in a series of partial model outputs. These partial model outputs are combined to form a partial model output matrix Y. i k .

[0018] Steps 2-4: To protect data privacy, the device outputs the partial model matrix Y... i k Before sending to the edge server, perform a test on matrix Y. i k Encryption is performed. After receiving the public mask, each sensing device outputs Y to its local model. i k Divide the data into blocks, and denote the resulting sub-blocks as Y. i k,j For each sub-block Y i k,j Device application private mask θ i The device performs double encryption using a public mask Λ. After completing the encryption process for all sub-blocks, the device outputs the encrypted data Q. i Send to the edge server.

[0019] Steps 2-5: Mask Removal and Model Restoration: The edge server receives the encrypted sub-block data Q sent by the device. i Then, using the inverse matrix P -1 The common mask Λ is used to remove the mask from each sub-block, gradually restoring the model output. The edge server obtains the model's output Y. i k Then, the output components are used as inputs to complete the training of the neural network.

[0020] The differential perturbation stage of the local model is specifically as follows:

[0021] Step 3-1: Local model parameter initialization: At the beginning of each training round, the edge server initializes the local model parameters ω0 for each participating device. These parameters will be optimized through gradient updates during training.

[0022] Step 3-2: Gradient Calculation and Pruning: After each device i completes the training output of a portion of the model, the corresponding local gradient is calculated. To prevent gradient leakage, the device first prunes the calculated gradients. The purpose of pruning is to ensure that the magnitude of the gradient does not exceed a preset threshold C, thereby limiting the impact of abnormal gradients on model updates and reducing the possibility of privacy leaks.

[0023] Step 3-3: Adding adaptive differential privacy perturbation: After pruning, to protect the privacy of the gradient, each device will add an adaptive differential privacy perturbation on the local gradient. For each device, the standard deviation σ of the noise will be dynamically adjusted according to the update speed of the model, so that the size of the noise will be adjusted according to the change rate of the model, when the model parameters change rapidly, the noise increases, and vice versa, to improve the effect of privacy protection and avoid excessive influence on the model accuracy.

[0024] Step 3-4: Local model parameter update: After adding noise, the device updates the local model parameters using the perturbed gradient.

[0025] Step 3-5: Local model parameter upload: After each round of training, the device sends the updated local model parameters to the central cloud server, and the central server aggregates the local models of each edge server.

[0026] The global model aggregation and differential perturbation stage is specifically:

[0027] Step 4-1: Receive local model parameters: After each round of training, the central cloud server receives the local model parameters uploaded by all participating devices Each device sends the local model parameters that have been differentially perturbed and updated to the central cloud server, preparing for aggregation.

[0028] Step 4-2: Global model parameter aggregation: After receiving the encrypted model parameters from each device, the central server first needs to decode these encrypted models. The decoding process removes the private mask θ i of each device, and after decoding, the server obtains the local model parameters ω i of all devices, and then aggregates the global model. To improve the efficiency of model aggregation, the server uses the weighted average method to aggregate the local models of each device.

[0029] Step 4-3: Adaptive noise addition: After global model aggregation, to protect the privacy of the global model, the server needs to add adaptive noise to the aggregated global model parameters ω global The adaptive differential privacy mechanism adjusts the noise standard deviation σ global to ensure that more noise is added when the model changes rapidly, and less noise is added when the model tends to be stable, and then adds Gaussian noise to the global model parameters.

[0030] Step 4-4: Global model release: After adding differential privacy noise, the central server releases the protected global model Publish to all devices. Each device downloads the global model and uses it as the starting model for the next round of local training until the model converges or the number of iterations reaches.

[0031] The privacy protection method comprises three entities of a center cloud server, an edge server and a sensing device.

[0032] The sensing device is a data collector and local training executor, usually a smartphone, a wearable device or an Internet of Things terminal, which is responsible for data collection, local model training and user privacy protection on the device side and uploads encrypted model parameters.

[0033] The edge server aggregates data, manages models and masks between the sensing device and the center cloud server, provides localized processing support, reduces transmission costs and improves privacy protection, and the edge server layer is deployed near the sensing device to reduce delay, while working collaboratively with the cloud server to cooperatively execute local model training of federated learning.

[0034] The center cloud server is the core coordinator of the whole system, responsible for data aggregation, model aggregation, privacy protection and global model publishing, etc. It is the center node of federated learning, which aggregates model updates from each edge server and updates the global model.

[0035] A storage medium, the storage medium stores at least one instruction, the instruction is loaded and executed by the processor to realize the privacy protection method.

[0036] The advantages of the present application are: 1. The present application uses a layered federated learning architecture. The present application adopts a layered architecture, combines sensing devices, edge nodes and center servers, and makes data be efficiently processed in different levels. The introduction of the edge node not only reduces the computing pressure of the center server, but also can preliminarily aggregate the model parameters of multiple sensing devices, greatly reducing the data transmission amount. In addition, the edge node will perform additional encryption processing before the data is transmitted to the center server, further enhancing the security of the data. This layered architecture design significantly improves the scalability of the system, while improving the data transmission efficiency and privacy protection capability.

[0037] 2、The application uses federal learning to realize data visibility but unavailability. Through the federal learning framework, collaborative learning among multiple devices is realized without uploading original data. After local model training, each device only uploads the updated model parameters to the upper node or central server, avoiding the leakage of original data. The introduction of federal learning enables each device to share the advantages of global models, improving the accuracy of data analysis and model training, and meeting the needs of efficient collaborative learning of crowd-sensing data. Under this architecture, the system can realize joint modeling of multi-source data on the basis of protecting user privacy, providing an innovative solution for the safe sharing of privacy-sensitive data.

[0038] 3、The application uses a multi-layer privacy protection mechanism. The application adopts a multi-layer privacy protection mechanism, and applies double-layer masking and multiple encryption technologies in the data transmission and model aggregation process. The private mask generated by the device end is combined with the public mask of the server end to ensure double encryption of the model parameters during transmission, thereby reducing the risk of privacy leakage. At the same time, adaptive differential perturbation dynamically adjusts the noise size according to the model update, ensuring privacy while maintaining model accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0039] The content expressed by each figure in the specification of the application and the marks in the figures are briefly described as follows:

[0040] Figure 1 It is a schematic diagram of the principle architecture of the privacy protection method of the application.

[0041] Figure 2 It is a flow chart of the crowd-sensing data privacy protection method based on federal learning of the application. DETAILED DESCRIPTION

[0042] The specific embodiments of the application are further described in detail below by comparing the figures and describing the optimal embodiments.

[0043] The embodiment is used for solving the privacy protection problem existing in the learning processing of federated learning in crowd sensing data, and a crowd sensing data privacy protection method based on federated learning is designed and provided, which combines edge computing and federated learning, adopts a hierarchical federated learning architecture, reduces the transmission and centralized storage of sensing data, and effectively reduces the risk of user privacy leakage. It adopts a multi-layer privacy protection mechanism, realizes multiple privacy protection in the transmission and aggregation process through double-layer masking and adaptive differential perturbation, and realizes the use of data and invisibility through the distributed training model of federated learning, and solves the data island problem. In the federated learning process of crowd sensing, the double-layer masking and adaptive differential perturbation mechanism realize multi-level privacy protection in the transmission and aggregation process, the double-layer masking method combines the private mask of the device and the public mask of the server, and multiple encryption is performed on the model parameters to ensure the security of the parameters in the transmission process, and the adaptive differential perturbation mechanism dynamically adjusts the noise size according to the change of the model, while protecting the data privacy, the model accuracy is maintained. The specific scheme is as follows:

[0044] As shown in Figure 1 A crowd sensing data privacy protection method based on federated learning includes three entities of a center cloud server, an edge server and a sensing device.

[0045] The sensing device is the executor of data collection and local training, and is usually a smart phone, a wearable device or an Internet of Things terminal. It is responsible for data collection, local model training and protection of user privacy and uploading of encrypted model parameters at the device end.

[0046] The edge server performs data aggregation, model management and mask management between the sensing device and the center cloud server, provides local processing support, reduces transmission cost and improves privacy protection, and the edge server layer is deployed near the sensing device to reduce delay, and cooperates with the cloud server to cooperatively execute local model training of federated learning.

[0047] The center cloud server is the core coordinator of the whole system, and is responsible for key tasks such as data summarization, model aggregation, privacy protection and global model release. It is the center node of federated learning, summarizes the model updates from each edge server, and updates the global model.

[0048] The crowd sensing data privacy protection method based on federated learning provided by the application has the execution process as shown in Figure 2 The method includes a system initialization stage, a data collection stage of an edge intelligent sensing device, a training output protection mechanism stage based on double-layer masking, a differential perturbation stage of a local model, a global model aggregation and differential perturbation stage. The five stages of the method are as follows:

[0049] 1. The system initialization phase specifically includes:

[0050] Step 1-1: Key Generation and Distribution: During system initialization, the parameter server generates a large prime number p and an initial random number r, and uses an algorithm based on discrete logarithms to generate a symmetric key K:

[0051] K = g r modp

[0052] Here, g is a primitive root used as the basis for key generation, and mod is the modulo operation. The parameter server initializes the encryption protocol by generating some basic mathematical parameters (e.g., large prime numbers, random numbers, etc.) and generates all the parameters required for key negotiation. These parameters are then sent to each participating device through a secure channel. Each edge server u and sensing device v communicate with each other via the received key negotiation parameters (e.g., random number r). u and r v ) Calculate the shared key K u,v To ensure secure communication, this key negotiation ensures confidentiality during data transmission.

[0053]

[0054] Step 1-2: Device Registration and Authentication: The parameter server assigns a unique identification ID to each sensing device. i The device identifier is encrypted using a hash function H to ensure secure authentication. K... i It is the device key, ID i It is a unique identifier for the device.

[0055] H(ID i = hash(ID) i ‖K i )

[0056] The parameter server generates a private mask θ for each sensing device. i and coefficient vector λ i These masks θ i and coefficient vector λ i Used to protect device data privacy. Private mask θ i and coefficient vector λ i Data is encrypted before being transmitted to the device, ensuring the secure transfer of private information. We set...

[0057] θ i =rand(0,1) n

[0058] Where rand is a random number generator used to generate random values, and n is the size of the generated random vector.

[0059] Steps 1-3: Model Parameter Initialization: Upon system startup, the central server sets the initial global model parameters ω0, which can be a zero vector or a small random value to ensure the stability of the model's initial state. The initial model parameters ω0 are distributed to all edge nodes and sensing devices. This ensures that the model parameters of the entire system remain consistent in the initial state, facilitating subsequent collaborative training and model updates.

[0060] 2. The data acquisition phase of edge intelligent sensing devices specifically includes:

[0061] The data acquisition phase of the edge intelligent sensing device specifically involves the following steps: In this phase, the edge intelligent sensing device is responsible for collecting environmental data and sending it to the border gateway. After completing data acquisition, the edge intelligent device can choose to go offline or switch to other tasks without continuously waiting for further processing. For the border gateways, they store the received data, preparing it for subsequent data aggregation processing. Simultaneously, each edge server downloads an initial global model from the cloud to update the model after data aggregation, thereby achieving distributed collaborative learning.

[0062] 3. The training output protection mechanism based on double-layer masking specifically includes the following stages:

[0063] Step 2-1: Each sensing device generates a personal random mask θ at the start of training. i This mask is used to protect the privacy of the device's local training output data. θ i It is an n-dimensional column vector with values ​​in the range [0,1]. The device will... i After normalization, the coefficient vector λ is obtained. i To ensure that the generated mask has consistent strength across devices, symmetric encryption is used for θ. i and λ i Encryption. The specific normalization formula is as follows:

[0064]

[0065] Where, ||θ i ||2 represents the coefficient vector θ i The L2 norm is used to ensure the uniformity and stability of the mask. Then, a personal random mask θ is applied. i and coefficient vector λ i Send to the edge server.

[0066] Step 2-2: The edge server receives the encrypted mask vector θ from each device. i and coefficient vector λ iand construct these vectors into a common coefficient matrix P, ensuring that the data blocks of each device are independently protected. The edge server uses all the coefficient vectors uploaded by the devices λ1, λ2, 2λ k The common coefficient matrix P is constructed as follows:

[0067] (1) Take the coefficient vector λ i of each device as a row vector P of the matrix;

[0068] (2) Combine the coefficient vectors of all devices together to form a matrix P, with each row corresponding to the coefficient vector of a device, and the number of columns of the matrix consistent with the dimension of each coefficient vector.

[0069] For example, assuming there are k devices, and the coefficient vector λ i of each device is λ i1 , λ i2 , 2λ in , then the common coefficient matrix P will be a k × n matrix:

[0070]

[0071] where each row λ i is the coefficient vector of device i. The edge server will verify the linear independence of these vectors to check the linear independence of these vectors to ensure that the constructed matrix is full rank. The coefficient matrix P constructed by these vectors satisfies the specific rank condition, ensuring that the data can be restored by matrix inversion when the mask is removed.

[0072] The edge server first checks whether the received coefficient vector is linearly independent of the vectors in the existing coefficient matrix P, which is a matrix that stores the coefficient vectors of all devices. Whenever a new device uploads its coefficient vector λ i , the edge server compares it with the existing coefficient vectors. If the new coefficient vector λ i is linearly independent of the vectors in the current coefficient matrix P, the edge server will gradually accumulate it into the existing coefficient matrix P, expanding the rank of the matrix. And gradually accumulate the private mask θ i , generate the public mask Λ. When the coefficient matrix reaches full rank, generate the public mask Λ and the inverse matrix P -1 , and encrypt it using a symmetric encryption algorithm. The encrypted public mask Λ is distributed to each participating sensing device through a secure communication channel, ensuring the security of transmission. The public mask Λ is defined as:

[0073]

[0074] This process ensures that the generation of the public mask Λ fully considers the individual private masks of all devices, thus providing global protection. The sensing device decrypts the ciphertext to obtain the public mask and the coefficient matrix.

[0075] Steps 2-3: In each round of training in federated learning, the perception device i will be based on the local dataset D i Perform local training and generate a partial model output Y. i k Each sensing device i has a local dataset D. i It contains multiple data samples {x1, x2, x3, ..., x}. n These data samples are used to train a local model and generate intermediate outputs. The device will input sample x. n The data is passed to the local model, and through forward propagation of the local model, the device obtains a corresponding partial model output. It represents the local model's response to the input sample x. n The intermediate results or feature representations are usually the activation results of an intermediate layer in the model.

[0076] In each training round, the device performs the above process on multiple input samples, resulting in a series of partial model outputs. These partial model outputs are combined to form a partial model output matrix Y. i k ,Right now:

[0077]

[0078] Steps 2-4: To protect data privacy, the sensing device outputs the partial model matrix Y... i k Before sending to the edge server, perform a test on matrix Y. i k Encryption is performed. After receiving the common mask Λ, each sensing device outputs Y to its local model. i k Divide the data into blocks and output the model matrix Y based on the number of data samples. i k The output is divided into j sub-blocks by uniformly dividing the data line by line, thus reducing the risk of exposing a single data point. The resulting sub-blocks are denoted as Y. i k,j For each sub-block Y i k,j Device application private mask θ i Double encryption is performed using the public mask Λ, with the specific formula as follows:

[0079]

[0080] Where P is the common coefficient matrix, and after the sensing device completes the encryption processing of all sub-blocks, it outputs the encrypted data. Send to the edge server.

[0081] Steps 2-5: Mask Removal and Model Restoration: The edge server receives the encrypted sub-block data Q sent by the sensing device. i Then, using the inverse matrix P -1 The common mask Λ is used to remove the mask from each sub-block, gradually restoring the model output. The decoding formula is as follows:

[0082]

[0083] Among them, Y i k,j For model output, P -1 It is the inverse of the common coefficient matrix. The encrypted output data of the sensing device, Λ is the common mask, and θ is the encrypted output data. i The private mask θ is used. The edge server first removes the device's private mask θ. i Then through the inverse matrix P -1 Decrypt and remove the common mask Λ to restore the device's original model output Q. i Finally, all sub-blocks are recombined into the complete output Y. i k This is used for subsequent model aggregation. The edge server obtains the model's output Y... i k Then, the output components are used as inputs to complete the training of the neural network.

[0084] After receiving information from the edge server, the sensing device updates the local neural network parameters using the following formula.

[0085]

[0086] Where, ω k Let represent the local model parameters of the current sensing device in the k-th iteration, and η be the learning rate, used to control the step size of parameter updates. This is the gradient calculated by the sensing device at step t of the current iteration. After receiving the system initialization parameters, the sensing device trains the model based on local training data. During training, the sensing device calculates the gradient. This reflects the trend of the loss function changing with respect to the parameters. The local model parameters ω of the current device. k According to the stochastic gradient descent method, the model is updated by subtracting the gradient value controlled by the learning rate to minimize the loss function and thus gradually optimize the model performance. When the model converges, the sensing device inputs data and sends the results to the edge server, which then feeds the results back to the sensing device.

[0087] 4. The differential perturbation phase of the local model is specifically:

[0088] Step 3-1: Local model parameter initialization: At the beginning of each round of training, the edge server initializes the local model parameters ω0 for each participating sensing device, which will be optimized through gradient update during the training process;

[0089] Step 3-2: Gradient calculation and clipping: After each sensing device i completes the training output of the partial model, the corresponding local gradient is calculated The gradient is used to update the local model parameters. In order to prevent gradient leakage, the sensing device first clips the calculated gradient, and the clipping formula is:

[0090]

[0091] where, is the gradient calculated by the sensing device at the t-th step of the current iteration, C is the threshold for gradient clipping (cutting threshold, is an adjustment factor. If the size of the gradient exceeds the threshold C, the gradient is limited within the range of C through proportional scaling; if the gradient is less than C, it remains unchanged. The purpose of clipping is to ensure that the size of the gradient does not exceed the preset threshold C, thereby limiting the influence of abnormal gradient on model update and reducing the possibility of privacy leakage;

[0092] Step 3-3: Add adaptive differential privacy perturbation: After clipping, in order to protect the privacy of the gradient, each sensing device will add adaptive differential privacy perturbation to the local gradient. Unlike traditional fixed noise, an adaptive noise mechanism based on model update rate is introduced here. Specifically, for each device, the standard deviation σ of the noise will be dynamically adjusted according to the update speed of the model:

[0093]

[0094] where, σ i is the standard deviation of the noise added by sensing device i in the current training round, σ base is the basic noise standard deviation, △ω i represents the model parameter change amount of sensing device i between the last round and the current round, △t is the time interval, and η is the adjustment coefficient. In this way, the size of the noise will be adjusted according to the change rate of the model, and when the model parameters change rapidly, the noise increases, and vice versa, to improve the effect of privacy protection and avoid excessive impact on model accuracy.

[0095] Step 3-4: Local model parameter update: After adding noise, the sensing device updates the local model parameters using the perturbed gradient, and the update formula is:

[0096]

[0097] Here denotes the Gaussian noise with mean 0 and variance η is the adjustment coefficient, is the gradient calculated by the perception device at the current iteration step t, denotes the local model parameters of device i after the update at the t+1 round, denotes the local model parameters of perception device i at the t round.

[0098] Step 3-5: Local model parameter upload: After each round of training, the perception device sends the updated local model parameters to the central cloud server, and the central server aggregates the local models of each edge server.

[0099] 5. The global model aggregation and differential perturbation stage is specifically:

[0100] Step 4-1: Receive local model parameters: After each round of training, the central cloud server receives the local model parameters uploaded by all participating devices Each perception device sends the updated local model parameters after differential perturbation to the central cloud server, preparing for aggregation.

[0101] Step 4-2: Global model parameter aggregation: After receiving the encrypted model parameters from each device, the central server first needs to decode these encrypted models. The decoding process removes the private mask θ i of each device:

[0102]

[0103] After decoding, the server obtains the local model parameters ω i of all devices, and then aggregates the global model. To improve the efficiency of model aggregation, the server uses the weighted average method to aggregate the local models of each device. The aggregation formula is:

[0104]

[0105] where α i denotes the weight of device D i , the weight can be determined according to the training data volume, model performance or other factors of each device, n is the n devices participating in training, and ω global is the local model parameters of device Di after decoding.

[0106] Step 4-3: Adaptive noise addition: After the global model is aggregated, in order to protect the privacy of the global model, the center server needs to add noise to the aggregated global model parameters ω global . Here, an adaptive differential privacy mechanism is used, that is, the size of the noise is dynamically adjusted according to the changes of the model update. The adaptive differential privacy mechanism adjusts the noise standard deviation σ according to the change rate of the global model global to ensure that more noise is added when the model changes rapidly, and the noise is reduced when the model tends to be stable. The specific formula is:

[0107] σ global = σ0×exp(-η·Δω)

[0108] where Δω represents the difference between the current round global model and the last round global model, η is the adjustment parameter, and σ0 is the basic noise standard deviation. The added Gaussian noise will disturb the global model parameters, protecting privacy while minimizing the impact on model performance;

[0109]

[0110] where ω global is the decoded local model parameter of device Di, is the added Gaussian noise, and ω is the global model parameter after adding noise.

[0111] Step 4-4: Global model release: After adding differential privacy noise, the center server will release the protected global model to all devices. Each device downloads the global model and uses it as the starting model for the next round of local training until the model converges or the number of iterations reaches the limit.

[0112] The above scheme protects the privacy of data in the process of federated learning of crowd sensing data processing, and can effectively solve the privacy protection problem of crowd sensing data in federated learning. Through the double-layer mask and adaptive differential perturbation mechanism, multi-level privacy protection is realized in the transmission and aggregation process. The double-layer mask method combines the private mask of the device and the public mask of the server to encrypt the model parameters multiple times, ensuring the security of the parameters during transmission, and the adaptive differential perturbation mechanism dynamically adjusts the noise size according to the changes of the model, protecting the privacy of the data while maintaining the accuracy of the model. This method uses double-layer mask technology and adaptive differential privacy mechanism to ensure the security and privacy of data transmission and aggregation process. The layered architecture performs preliminary data processing on the edge server, reducing the pressure on the center server and effectively improving the data transmission efficiency. The federated learning mode trains the model locally, avoiding the upload of raw data, ensuring data usability and invisibility, while solving the data island problem, achieving efficient collaboration and privacy protection.

[0113] Obviously, the specific implementation of the present application is not limited by the above-mentioned manner, as long as various non-essential improvements are made by adopting the method concept and technical solutions of the present application, which are within the protection scope of the present application.

Claims

1. A method for protecting the privacy of crowd-sensing data based on federated learning, characterized in that: In the federated learning process of crowd-aware sensing, multi-layered privacy protection for transmission and aggregation is achieved through a two-layer mask and an adaptive differential perturbation mechanism. The two-layer mask method combines the device's private mask and the server's public mask to perform multiple encryptions on the model parameters, ensuring the security of the parameters during transmission. The adaptive differential perturbation mechanism dynamically adjusts the noise level according to changes in the model, maintaining model accuracy while protecting data privacy. The method includes five stages: system initialization, data acquisition from edge intelligent sensing devices, training output protection mechanism based on two-layer mask, differential perturbation of local models, and global model aggregation and differential perturbation. The training output protection mechanism based on double-layer masking includes the following stages: Step 2-1: Each sensing device generates a personal random mask vector at the start of training. The mask vector Used to protect the privacy of the device's local training output data. It is an n-dimensional column vector with a value range between [0,1]. The device will... The coefficient vector is obtained after normalization. and use symmetric encryption pairs and They are encrypted and then sent to the edge server; Step 2-2: The edge server receives the encrypted mask vectors from each device. sum coefficient vector And these vectors are constructed into a common coefficient matrix. The server will verify the linear independence of the vectors to ensure that the constructed matrix is ​​full rank. When the coefficient matrix reaches full rank, a common mask is generated. and inverse matrix It is then encrypted using a symmetric encryption algorithm, and the resulting public mask is... The encrypted message is distributed to each participating sensing device through a secure communication channel. The sensing device decrypts the ciphertext to obtain the public mask and coefficient matrix. Steps 2-3: In each round of training in federated learning, the sensing device Based on local dataset Perform local training and generate partial model output. Each sensing device Have a local dataset The device transmits data to the local model, and through forward propagation of the local model, the device obtains a corresponding partial model output. ; In each round of training, the sensing device performs the training process on multiple input samples, obtaining a series of partial model outputs; these partial model outputs are combined to form a partial model output matrix. ; Steps 2-4: The device outputs the partial model matrix. Before sending to the edge server, the matrix Encryption is performed; after each sensing device receives the public mask, it outputs the local model... Divide the data into blocks, and denote the resulting sub-blocks as follows: For each sub-block Device application private mask and public mask Double encryption is performed; after completing the encryption process for all sub-blocks, the device outputs the encrypted data. Send to the edge server; Steps 2-5: Mask Removal and Model Restoration: The edge server receives encrypted sub-block data sent by the device. Then, using the inverse matrix and public mask The mask is removed from each sub-block, and the model output is gradually restored; the edge server obtains the model output. Then, the output components are used as inputs to complete the training of the neural network.

2. The data privacy protection method for crowd-aware perception based on federated learning as described in claim 1, characterized in that: The system initialization phase includes: Step 1-1: Key Generation and Distribution: During system initialization, the parameter server generates a large prime number. and initial random number A symmetric key K is generated using an algorithm based on discrete logarithms. Each edge device u and sensing device v receives key negotiation parameters through a parameter server and calculates the shared key. To ensure secure communication; Step 1-2: Device Registration and Authentication: The parameter server assigns a unique identifier to each device. and using hash functions Device identifiers are encrypted to ensure secure authentication; the server generates a private mask for each device. sum coefficient vector And it is transmitted to various devices after being encrypted; Steps 1-3: Model Parameter Initialization: When the system starts, the central cloud server sets the initial global model parameters. Initial model parameters It will be distributed to all edge nodes and sensing devices.

3. A data privacy protection method for crowd-aware perception based on federated learning as described in claim 1 or 2, characterized in that: The data acquisition phase of the edge intelligent sensing device includes: acquiring data from the edge intelligent device and sending it to the border gateway. After the acquisition is completed, the edge intelligent device goes offline. For the border gateway, they store the data for aggregation.

4. A data privacy protection method for crowd-aware perception based on federated learning as described in claim 1 or 2, characterized in that: The differential perturbation stage of the local model includes: Step 3-1: Local Model Parameter Initialization: At the beginning of each training round, local model parameters are initialized for each participating device. The local model parameters will be optimized through gradient updates during training; Step 3-2: Gradient Calculation and Clipping: For each sensing device After completing the training output of part of the model, calculate the corresponding local gradient. The edge server first prunes the calculated gradients so that the gradient size does not exceed a preset threshold C. Step 3-3: Add Adaptive Differential Privacy Perturbation: After pruning, the edge server adds an adaptive differential privacy perturbation to the local gradient of each device; for each device, the standard deviation of the noise is... The noise level will be dynamically adjusted according to the model's update speed. When the model parameters change rapidly, the noise will increase, and vice versa. Steps 3-4: Local model parameter update: After adding noise, the edge server uses the perturbed gradient to update the local model parameters; Steps 3-5: Upload local model parameters: After each round of training, the edge server sends the updated local model parameters to the central cloud server, which then aggregates the local models from each edge server.

5. A data privacy protection method for crowd-aware perception based on federated learning as described in claim 1 or 2, characterized in that: The global model aggregation and differential perturbation stage includes: Step 4-1: Receive Local Model Parameters: After each training round, the central cloud server receives the local model parameters uploaded by all edge servers. The edge server sends the local model parameters, which have been differentiated and updated, to the central cloud server in preparation for aggregation. Step 4-2: Global Model Parameter Aggregation: The central cloud server receives encrypted model parameters from various edge servers. Next, these encryption models need to be decoded; the decoding process involves removing the private mask of each device. After decoding, the central cloud server obtains the local model parameters of all edge servers. Then, the global model is aggregated; Step 4-3: Adaptive Noise Addition: After global model aggregation, the central cloud server adds noise to the aggregated global model parameters. Adding adaptive noise, the adaptive differential privacy mechanism adjusts the noise standard deviation based on the rate of change of the global model. This is to ensure that more noise is added when the model changes rapidly, and less noise is added when the model tends to stabilize, and then Gaussian noise is added. Add to global model parameters; Step 4-4: Global Model Deployment: After adding differential privacy noise, the central cloud server will deploy the protected global model. The global model is published to all edge servers; each edge server downloads the global model and uses it as the starting model for the next round of local training until the model converges or the number of iterations is reached.

6. The data privacy protection method for crowd-aware perception based on federated learning as described in claim 5, characterized in that: In step 4-2, the central cloud server uses a weighted average method to aggregate the local models of each device.

7. A data privacy protection method for crowd-aware perception based on federated learning as described in claim 1 or 2, characterized in that: The data privacy protection method for crowd-aware perception based on federated learning includes three entities: a central cloud server, an edge server, and a sensing device. The sensing device is the executor of data collection and local training, and is responsible for data collection, local model training, protecting user privacy, and uploading encrypted model parameters at the device end. The edge server performs data aggregation, model management, and mask management between the sensing device and the central cloud server, and provides localized processing support. The edge server layer is deployed close to the sensing device and works in collaboration with the central cloud server to jointly execute local model training of federated learning. The central cloud server is the core coordinator of the entire system, responsible for data aggregation, model aggregation, privacy protection, and global model publishing. As the central node of federated learning, it aggregates model updates from various edge servers and updates the global model.

8. A storage medium, characterized in that: The storage medium stores at least one instruction, which is loaded and executed by a processor to implement the method as described in any one of claims 1-7.

Images