Federal category forgetting learning method based on noise adversarial training

Abstract

The invention relates to a federal category forgetting learning method based on noise adversarial training, which belongs to the field of artificial intelligence and comprises four steps of noise adversarial training, calculation of target data influence degree, forgetting training and retraining. Wherein the noise adversarial training is that noise data is trained through error maximization and knowledge distillation to destroy the model classification capability, the calculation of the target data influence degree comes from the gradient of target data on a global model, and the main content of the forgetting training is that the noise data is merged into a residual data set to participate in training. According to the method, a central server is prevented from acquiring local data related information of participants, data privacy is protected, target classification performance is forgotten by pertinently adjusting model parameters, and the retraining speed is increased.

Description

Technical Field

[0001] The invention belongs to the field of artificial intelligence and relates to a federated category forgetting learning method based on noise adversarial training. Background Art

[0002] Federated learning is an emerging distributed learning framework in the field of artificial intelligence. Its learning paradigm of jointly training a shared model with various data parties avoids the direct concentration of data on a central server, which not only ensures privacy security but also solves the problem of data silos. Therefore, it is widely used. The recently enacted privacy law, the General Data Protection Regulation (GDPR), gives users the "right to be forgotten" for their private data, that is, to eliminate the influence or traces of private data in the model. Compared with traditional machine forgetting, federated forgetting is difficult to eradicate the influence of private data in the global model due to its global aggregation and shared training characteristics. At the same time, the central server cannot directly access the local data of the participants, which also brings challenges to the design of federated forgetting learning methods.

[0003] Federated forgetting can be divided into three types according to the forgetting granularity, namely client forgetting, sample forgetting and category forgetting. The main tasks are to eliminate the influence of the entire client data, some client partial samples and all data of some categories in the global model. In the field of federated category forgetting, Tarun et al. proposed a noise forgetting method to destroy the performance of the model's specific target classification by training a series of noise data that maximizes the target classification error. Wang et al. proposed a model pruning-based method that uses the word frequency-inverse document frequency uploaded by the client to evaluate the contribution of the channel to the classification and prune the channel parameters with higher scores. Wu et al. performed gradient ascent training on the local target classification test dataset on the server to achieve the forgetting effect.

[0004] First, during the noise training process, the parameter update direction is unstable and cannot completely eliminate the impact of the target forgotten classification data in the global model. Secondly, due to the overlap of feature spaces between different classification data, the noise training and gradient ascent methods will affect the performance of the original model on the remaining data sets. In addition, the server uses the local data distribution information uploaded by the client to implement the forgetting operation, which will cause privacy leakage risks. Therefore, it is crucial to design a federated category forgetting method that guarantees both efficiency and security. Summary of the invention

[0005] The purpose of the present invention is to propose a federated category forgetting learning method based on noise adversarial training to address the shortcomings of the prior art, so as to achieve comprehensive and effective federated category forgetting, improve the retraining speed, avoid participants from uploading data distribution-related information, and protect user privacy.

[0006] To achieve the above object, the present invention provides a federated category forgetting learning method based on noise adversarial training, comprising the following steps:

[0007] Step 1: The central server trains the noise on the global model to maximize the target forgetting classification error, and uses knowledge distillation to adversarially train subsequent batches of noisy data.

[0008] Step 2: The client uses the data of the local target forgetting classification to calculate its influence on the relative model parameters on the local model.

[0009] Step 3: The client merges the noise data into the local remaining data set for forgetting training.

[0010] In step 4, the entire federated learning system performs a retraining process on the remaining datasets.

[0011] The beneficial effects of the present invention are: (1) the noise data trained adversarially can completely destroy the model's classification ability for the target forgotten classification data, improve the robustness and diversity of the noise, and ensure the forgetting effect; (2) the influence of the forgotten data on the model parameters assists the parameter update in the forgetting training, and specifically adjusts the parameters that are highly correlated with the forgotten data, thereby reducing the impact on the performance of the remaining classification data set in the model; (3) the strategy of sending the training noise from the central server to the client for local forgetting avoids the server from directly or indirectly obtaining information related to the data distribution of the participants, thereby reducing the risk of privacy leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a schematic diagram of the framework of the method of the present invention

[0013] Figure 2 This is a flow chart of the present invention for combating training noise.

[0014] Figure 3 Schematic diagram of the forgetting training process of the present invention DETAILED DESCRIPTION

[0015] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] Example

[0017] like Figure 1 As shown, the present invention proposes a federated category forgetting learning method based on noise adversarial training, which includes the following process:

[0018] Step 1: The central server trains the noise on the global model to maximize the target forgetting classification error, and uses knowledge distillation to adversarially train the subsequent batches of noisy data;

[0019] Step 2: The client uses the data of the local target forgetting classification to calculate its influence on the relative model parameters on the local model;

[0020] Step 3: The client merges the noise data into the local remaining data set for forgetting training;

[0021] In step 4, the entire federated learning system performs a retraining process on the remaining datasets.

[0022] like Figure 2 As shown, the specific process of step 1 is:

[0023] Step 11: The central server receives the forget request from the client and determines the specific label set {y0,y1,…,y c}, where c represents the number of target forgotten classification labels;

[0024] Step 12, initialize the number of target classification noises N participating in forgetting training, the noise training batch size batch, the noise data list nl, and the number of single batch noise training rounds epochs;

[0025] Step 13, fix the global model parameters as the teacher model T, and initialize a convolutional neural network with a smaller scale than the global model as the student model S;

[0026] Step 14, according to the noise batch size batch described in step 12, initialize the batch noise data X, whose shape is (batch,*dim), wherein the value of dim is the same as the input data shape of the global model, and pass the noise data parameters to the optimizer as the optimization object;

[0027] Step 15: Input the noise data X described in step 14 into the output of the global model and the target forgotten classification y i Calculate the negative of the loss value - L CE (T(X),y i ) as the first part of the target loss, where the L CE is the cross entropy loss function, and the noise parameter is calculated to obtain the regularization term ||w X||2 is used as the second part of the target loss, where ||·||2 represents the calculation method of the two norm. If the noise currently involved in the training is not the first batch, the output distribution difference value of the noise on the teacher-student model described in step 13 is calculated and the negative value is obtained to obtain -KL(T(X), S(X)) as the third part of the loss, where KL represents the Kullback-Leibler divergence. The final optimization goal is -L CE (T(X),y i )+||w X ||2-KL(T(X),S(X)), after the number of epochs described in step 12, the training of the batch of noise X is completed. This operation can quickly give the noise the ability to destroy the performance of the target classification, and obtain greater forgetting performance with less training cost;

[0028] Step 16, insert the noise X described in step 15 into the noise data list nl described in step 12, and use knowledge distillation to transfer the knowledge of all noises in nl in the teacher model T to the student model S. This operation can effectively act on the third part of the target loss described in step 15, so that the noise data parameters of subsequent batches are adjusted to other directions that destroy the target classification ability of the model during the training process. This adversarial training method improves the robustness and diversity of the noise and ensures that the forgetting performance of the noise is more in-depth and sufficient;

[0029] Step 17, repeating steps 14 to 16 until the length of the noise data list nl reaches the target classification noise quantity N described in step 12;

[0030] Step 18, sending the noise data list nl of the training completed in step 17 to the client. This operation transfers the forgetting training process from the central server to the data participants, which not only fully utilizes the computing power resources of the server to train the noise, but also ensures the privacy and security of the participants' forgetting process.

[0031] The specific process of step 2 is:

[0032] Step 21: The local client separates the forgotten training set d corresponding to the target forgotten classification from the local data set D according to the target forgotten classification described in step 11. f The remaining dataset D corresponding to the remaining categories r ;

[0033] Step 22, initialize a key-value pair data structure variable param_dict, traverse the local model M parameter list, use the parameter name string as the key, and initialize the tensor with the same shape as the parameter name and set to 0 as the value;

[0034] Step 23, fix the local model M parameters and traverse the forgotten training set D described in step 21 f , input the local model M to calculate the cross entropy loss, back-propagate to obtain the gradient, and accumulate the gradient to the key-value pair variable param_dict described in step 22;

[0035] Step 24, traverse the key-value pair variable param_dict described in step 23, take the absolute value of each tensor value independently, flatten and sort, set the element values ​​of the first half of the sort to 0, and the element values ​​of the latter half to 1, and then reshape them into their original tensor shapes, and save the key-value pair variables as the influence of the forgotten data relative to the model parameters. The above operation quickly calculates the approximate influence of each client to adapt to the local data distribution, ensuring that the subsequent forgetting training customized destroys the target forgetting classification performance in the local model, improves the forgetting efficiency, and can also ensure the forgetting effect in the non-independent and identically distributed federated learning scenario.

[0036] like Figure 3 As shown, the specific process of step 3 is:

[0037] Step 31: The client forgets the training set D according to step 21. f , calculate the proportion of each forgotten classification data in the label set described in step 11 to the local training data set, mark the classification whose proportion is less than the restriction condition as "not participating in forgetting training", mark the classification whose proportion is greater than the restriction condition as "participating in forgetting training", and calculate the target noise quantity t participating in forgetting training;

[0038] Step 32: The client receives the noise data list nl described in step 18, traverses nl, and merges the noise data in the list labeled as "participating in forgetting training" described in step 31 into the remaining data set D described in step 21. r , if the number of noises involved in the merger is less than the target noise number t described in step 31, continue to traverse nl from the beginning until its number reaches t;

[0039] Step 33, train the local model M using the merged data set described in step 32, and after back-propagation to obtain the gradient grad, multiply the gradient and the influence degree param_dict described in step 24 by the tensor corresponding to the parameter name name, that is, grad[name]*param_dict[name], and then update the parameters. The influence degree enables the noise to make targeted adjustments to the parameters of the local model M, that is, only the parameters that are sensitive to the forgotten data will be updated, which ensures that the local model M effectively forgets the target forgotten data set D r , and reduces the remaining dataset D for the local model M r Destruction of classification performance.

[0040] The specific process of step 4 is as follows:

[0041] The client uploads the local model after forgetting training in step 33 to the server for aggregation, and then sends it back to the client. r The subsequent federated learning process is carried out on the dataset and retrained until the model is fitted. Since noise destroys the model's ability to classify the forgotten dataset while largely retaining the memory of the remaining dataset, the subsequent retraining efficiency will be greatly improved.

[0042] Therefore, this method completes the implementation of federated category forgetting learning based on noise adversarial training.

Claims

1. A federated category forgetting learning method based on noise adversarial training, characterized in that: The method comprises the following steps: Step 1: The central server trains the noise on the global model to maximize the target forgetting classification error, and uses knowledge distillation to adversarially train the subsequent batches of noisy data; Step 2: The client uses the data of the local target forgetting classification to calculate its influence on the relative model parameters on the local model; Step 3: The client merges the noise data into the local remaining data set for forgetting training; In step 4, the entire federated learning system performs a retraining process on the remaining datasets.

2. The method for federated category forgetting learning based on noise adversarial training according to claim 1, characterized in that: The step 1 specifically comprises the following steps: Step 11, the central server receives the forget request from the client and determines the target forgotten classification in the classification task; Step 12, initialize the target forgotten classification noise quantity, noise batch size, noise data list and single batch noise training round number; Step 13, fix the global model parameters as the teacher model, and initialize a convolutional neural network with a smaller scale than the global model as the student model; Step 14, according to the noise batch size described in step 12, initialize the batch of noise data with the same shape as the model input, and pass the noise data parameters to the optimizer as the optimization object; Step 15, input the noise described in step 14 into the global model to calculate the loss, use the noise parameters to calculate the regularization term, and use the noise in the output of the teacher-student model described in step 13 to calculate the distribution difference. These three items constitute the target loss. After the single batch noise training rounds described in step 12, the training of the batch noise is completed; Step 16, inserting the trained noise described in step 15 into the noise data list described in step 12, and using knowledge distillation to transfer the knowledge of all noises in the noise data list in the teacher model to the student model; Step 17, repeating steps 14 to 16 until the length of the noise list reaches the target forgotten classification noise quantity described in step 12; Step 18: Send the noise data list described in step 17 to the client.

3. The method for federated category forgetting learning based on noise adversarial training according to claim 2, characterized in that: In step 15, the cross entropy loss calculated by the output of the noise input global model and the target forgetting classification is taken negative as the first part of the target loss; the L2 norm of the noise weight is taken as the second part of the target loss; if the noise currently participating in the training is not the first batch, the output distribution difference value of the noise on the teacher-student model is taken negative as the third part of the target loss.

4. The method for federated category forgetting learning based on noise adversarial training according to claim 3, characterized in that: The step 2 comprises the following steps: Step 21, the client separates the forgotten training set corresponding to the target forgotten classification and the remaining training set corresponding to the remaining classification from the local data set according to the target forgotten classification; Step 22, initialize a key-value pair data structure variable, traverse the local model parameter list, set the parameter name string as the variable key, and initialize a tensor with the same shape as the parameter name and set to zero as the value; Step 23, fix the local model parameters, traverse the forgotten training set described in step 21, input the local model to calculate the cross entropy loss, back-propagate to obtain the gradient, and accumulate the gradient to the key-value pair variable described in step 22; Step 24, traverse the key-value pair variables described in step 23, take the absolute value of each tensor value independently, flatten and sort, set the element values ​​of the first half of the sort to 0, and set the element values ​​of the second half to 1, and then reshape them into their original tensor shapes, and save the key-value pair variables as the influence of the forgotten data relative to the model parameters.

5. The method for federated category forgetting learning based on noise adversarial training according to claim 4, characterized in that: The step 3 comprises the following steps: Step 31, the client calculates the proportion of the data contained in each target forgotten classification in step 11 in the local training data set according to the forgotten training set in step 21, marks the classification whose proportion is less than the restriction as "not participating in forgetting training", marks the classification whose proportion is greater than the restriction as "participating in forgetting training", and calculates the number of target noises participating in forgetting training; Step 32, the client receives the noise data described in step 18, and merges the noise data into the remaining data set described in step 21 according to the label classification and target noise quantity described in step 31; Step 33, use the merged data set described in step 32 to train the local model. After back-propagating the gradient, the gradient is multiplied bit by bit with the tensor corresponding to the parameter name according to the influence degree described in step 24, and then the parameters are updated.

6. The method for federated category forgetting learning based on noise adversarial training according to claim 5, characterized in that: In step 32, after receiving the noise from the central server, only the noise data of the classification marked as "participating in forgetting training" is merged with the remaining data set. When the number of noises is less than the target number of noises, the noise data is continued to be traversed from the beginning and merged into the remaining data set until the number of noises in the merged data set reaches the target number of noises.

7. The method for federated category forgetting learning based on noise adversarial training according to claim 6, characterized in that: In step 4, the client uploads the local model after forgetting training in step 33 to the server for aggregation, and then sends it back to the client, performs subsequent federated learning process on the remaining data set in step 21, and retrains until the model is fitted.

Images