Federal learning model training method and system based on differential privacy image noise addition

Abstract

The invention discloses a federated learning model training method and system based on differential privacy image noise addition. The method comprises the following steps: S1, initializing an evaluation network, a target network and hyper-parameters; s2, initializing a global model and parameters; s3, acquiring a selected client and a privacy budget; s4, the selected client performs local training and uploads the disturbance gradient to the central server; s5, the central server aggregates the disturbance gradient of the client to obtain an updated global model and a reward corresponding to the current state; s6, the next state of federated learning is obtained, and the evaluation network and the target network are updated; s7, repeatedly executing the steps S3 to S6 until the set number of global iterations is reached; and S8, updating the exploration rate and repeatedly executing the steps S2 to S7 until the set federal learning times are reached. The invention provides a dynamic differential privacy method in combination with a federal learning framework, which can improve the image recognition rate while ensuring the privacy of the user.

Description

Technical Field

[0001] The present invention belongs to the technical field of data privacy protection, and specifically relates to a federated learning model training method and system based on differential privacy image noising. Background Art

[0002] With the rapid development of artificial intelligence technology, image recognition has been widely used in security monitoring, medical diagnosis, autonomous driving and other fields. However, in practical applications, image data often contains sensitive information of users, such as facial features, geographic location, etc. Directly using these raw data for model training may lead to serious privacy leakage problems. To address this challenge, Differential Privacy (DP) has been introduced into machine learning as a powerful privacy protection mechanism, which can effectively protect user data privacy without sacrificing model performance.

[0003] Previous differential privacy image noise addition methods used the same privacy budget to add noise to the training image data each time for each training to protect user privacy. However, noise may significantly reduce the training effect of the model, thereby affecting the final recognition accuracy. Therefore, how to improve the image recognition rate while ensuring privacy has become an urgent problem to be solved. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a federated learning model training method and system based on differential privacy image noise. The technical problem to be solved by the present invention is achieved through the following technical solutions: The present invention provides a federated learning model training method based on differential privacy image noise, comprising: S1: Initialize the evaluation network, target network and related hyperparameters; S2: Initialize the global model and its parameters of the federated learning system on the central server, and broadcast the global model to all clients; S3: Get the selected clients and the allocated privacy budget based on the current state of the federated learning system and the target network; S4: training the local model using the local data set on the selected client, and uploading the perturbation gradient to the central server; S5: Aggregating the perturbation gradients from the selected clients at the central server to obtain an updated global model and a reward corresponding to the current state; S6: updating the evaluation network and the target network; S7: Repeat S3 to S6 until the global iteration number set by federated learning is reached. n ; S8: Update the exploration rate and repeat S2 to S7 until the set number of federated learning is reached. E .

[0005] Another aspect of the present invention provides a federated learning model training system based on differential privacy image noising, comprising a central server and multiple clients connected to the central server, for executing the federated learning model training method based on differential privacy image noising described in any of the above embodiments.

[0006] Compared with the prior art, the present invention has the following beneficial effects: The present invention is based on the federated learning model training method of differential privacy image noising. Before each training, different privacy budgets are used to process the client's local image training data, and suitable clients with different data distributions are selected to participate in federated learning. While ensuring user privacy, the image recognition rate is improved. Specifically, it has the following advantages: (1) Collaborative training under the federated learning framework: Combining the advantages of federated learning, a distributed training system is built, allowing multiple clients to independently train models locally and synchronize local updates to the central server through secure aggregation. In this process, the data of all participants is retained locally and will not be uploaded to the central server (cloud), thereby reducing the risk of data leakage.

[0007] (2) Efficient privacy protection: A dynamic differential privacy method is adopted to reduce the risk of image data leakage from model gradients due to inference attacks by adding noise to image pixels, thereby further strengthening the privacy protection of user data.

[0008] (3) Optimized noise addition strategy: Dynamically adjust the noise addition intensity according to the sensitivity of the image content and the distribution of image data to ensure that the impact on model performance is minimized while protecting privacy. Specifically, the present invention designs an intelligent noise generation algorithm that can adaptively select appropriate noise parameters (i.e., privacy budget), which not only ensures the effectiveness of privacy protection but also improves the accuracy of image recognition.

[0009] (4) Enhanced image recognition performance: By introducing technologies such as multi-task learning and transfer learning, not only the model performance of a single client is improved, but also knowledge sharing between different clients is promoted, so that the image recognition ability of the entire system is improved. In particular, for small samples or low-quality images, the method of the present invention can achieve better generalization performance through global collaboration.

[0010] (5) Flexible application scenario adaptation: It is applicable to a variety of image recognition tasks, such as face recognition, object detection, medical image analysis, etc., and is especially suitable for fields with strict requirements on privacy protection. In addition, the method and system can also flexibly adjust the privacy protection level according to the needs of specific application scenarios to achieve a balance between performance and privacy.

[0011] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flowchart of a federated learning model training method based on differential privacy image noising provided by an embodiment of the present invention; Figure 2 It is a detailed flowchart of a federated learning model training method based on differential privacy image noising provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0013] In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following is a detailed description of a federated learning model training method and system based on differential privacy image noising proposed in accordance with the present invention, in combination with the accompanying drawings and specific implementation methods.

[0014] The above and other technical contents, features and effects of the present invention are clearly presented in the following detailed description of the specific implementation modes in conjunction with the accompanying drawings. Through the description of the specific implementation modes, the technical means and effects adopted by the present invention to achieve the predetermined purpose can be more deeply and specifically understood. However, the attached drawings are only for reference and explanation purposes and are not used to limit the technical solutions of the present invention.

[0015] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants are intended to cover non-exclusive inclusion, so that an article or device including a series of elements includes not only those elements, but also other elements that are not explicitly listed. In the absence of more restrictions, the elements defined by the statement "including one..." do not exclude the existence of other identical elements in the article or device including the elements.

[0016] Embodiment 1 See also Figure 1 and Figure 2 , an embodiment of the present invention provides a federated learning model training method based on differential privacy image noising, the federated learning model training method comprising: S1: Initialize the evaluation network, target network and related hyperparameters.

[0017] Specifically, step S1 of this embodiment includes: S1.1: The network will be evaluated Parameters and the target network Parameters Randomly initialized to equal parameters, the network will be evaluated Parameters and target network Parameters Initialized to the same value.

[0018] S1.2: Initialize relevant hyperparameters, including discount factors , Soft Update Parameters , Exploration Rate , minimum exploration rate , exploration rate decay factor , evaluate the network learning rate and replay buffer . Preferably, the exploration rate The initial value can be 1, the minimum exploration rate The value can be 0.01~0.1.

[0019] S2: Initialize the global model and its parameters of the federated learning system on the central server, and broadcast the global model to all clients.

[0020] Specifically, build a federated learning system: including a central server and N The number of clients can be set according to actual needs and is not limited here.

[0021] Furthermore, the client needs to initialize the local model and training parameters of federated learning. Each client needs to initialize a local training dataset containing multiple images of the target category and label the target of each image.

[0022] It should be noted that according to the characteristics of federated learning, the entire federated learning process is divided into time slots, each time slot Indicates Round of global iteration, i.e. Due to the limitation of communication bandwidth, each global iteration can only N Select from a collection of clients Clients, allocate privacy budgets.

[0023] S3: Get the selected clients and the allocated privacy budget based on the current state of the federated learning system and the target network.

[0024] Furthermore, a decimal is randomly generated in the range (0,1), and the value of the decimal is compared with the exploration rate The value of is compared; if the decimal value is less than the exploration rate The value of , then randomly generates the first The action of the global iteration ,in, Represents the client In the Is it selected in the global iteration? If so, ,otherwise , Represents the client In the The privacy budget allocated in the global iteration, Represents the set of clients. When the decimal value is less than the exploration rate The privacy budget is randomly allocated when the value of is, for example, in the first round, the exploration rate The initial value of is 1, and the randomly generated decimal must be smaller than the exploration rate The initial value of , so the first round of actions is randomly generated ,in, Represents the client Was he selected in the first round? If so, ,otherwise , Indicates the client selected in the first round The allocated privacy budget.

[0025] If the decimal value is greater than or equal to the exploration rate , according to the current state and the target network, the selected client and the allocated privacy budget are obtained. Specifically, the current state Input to the target network In the target network Output multiple probabilities according to the current state, the number of probabilities is equal to the number of actions, and the largest forward probability is selected using the Top-k technique. The actions corresponding to the probability , the current action The corresponding client is taken as the selected client, where Represents the client In the The local loss function value in the global iteration, Represents the client In the The total privacy budget remaining in the global iteration.

[0026] It should be noted that the target network The number of output probabilities is equal to the number of actions. For example, if there are 10 clients and each client has 10 different levels of privacy budgets, there will be 100 different tuple pairs. Each tuple pair includes a client number and a privacy budget. The number of probabilities is 100, that is, each probability corresponds to a tuple pair.

[0027] S4: Training the local model using the local data set on the selected client, and uploading the perturbation gradient to the central server.

[0028] Step S4 of this embodiment specifically includes: S4.1: The selected client obtains the current global model and the allocated privacy budget , and the global model The parameters of are assigned to the local model, where Indicated in A local model on a client.

[0029] S4.2: Select a predetermined amount of local image training data from the local image training dataset, based on the allocated privacy budget A Gaussian mechanism is used to generate differential privacy noise of a corresponding degree and added to the local image training data to obtain the noisy local image training data: ; in, Indicates the number of the current local image training data m Line n The pixel value of the column, Represents the number of local image training data after adding noise m Line n The pixel value of the column, It means that the mean is 0 and the variance is Gaussian noise with Gaussian distribution.

[0030] S4.3: Using the noised local image training data to train the local model on the current client Perform training and obtain local loss value and the corresponding perturbation gradient , and the perturbation gradient Upload to the central server.

[0031] S4.4: The client receives the allocated privacy budget Get the current remaining overall privacy budget : ; in, Represents the client The initial overall privacy budget is , in order to simulate the real environment where different users have different privacy requirements, each client starts Each has its own initial overall privacy budget Represents the client In the m The privacy budget allocated in the global iteration.

[0032] S5: Aggregate the perturbation gradients from the selected clients at the central server to obtain an updated global model and a reward corresponding to the current state.

[0033] This step specifically includes: S5.1: The central server aggregates the perturbation gradients from all selected clients to obtain an updated global model : , in, Indicates The global model in the global iteration, Indicates The global model in the global iteration, is the learning rate, is the total number of local image training data in the selected client, Indicates The number of local image training data of each client, Indicates the number of selected clients.

[0034] S5.2: The central server obtains the reward corresponding to the current state: , in, Indicates The reward in the global iteration, , To fix the hyperparameters, Right now, is the proportional coefficient, which is a hyperparameter. It increases linearly with the excess value of the overall privacy budget.

[0035] S6: Obtain the next state of federated learning, and update the evaluation network and the target network.

[0036] Step S6 of this embodiment includes: S6.1: Switch the federated learning system to the next state And the tuple Stored to the replay buffer Among them, They represent the execution of the federated learning system The state, action, and reward of the global iteration, Indicates that the federated learning system executes The state of the next global iteration.

[0037] S6.2: From the replay buffer Randomly select b Tuples As a sample, and according to the discount factor and evaluate the network learning rate The evaluation network is evaluated using the stochastic gradient descent method. The parameters of are trained and updated to obtain the updated evaluation network.

[0038] Specifically, determine the replay buffer Tuples stored in Is the number greater than or equal to the preset extraction number? b , if so, then from the replay buffer Randomly select b Tuples As a sample, and according to the discount factor and evaluate the network learning rate The evaluation network is evaluated using the stochastic gradient descent method. The parameters of the evaluation network are trained and updated to obtain an updated evaluation network; if not, the evaluation network is not trained. Perform training updates and keep the current evaluation network unchanged. In practice, b Set it according to actual needs, for example, it can be 16, 32, 64, 128, etc.

[0039] S6.3: Update the target network parameters according to the soft update principle: ,in, Indicates soft update parameters.

[0040] S7: Repeat steps S3 to S6 until the set global iteration number is reached. n .

[0041] Specifically, return to step S3, randomly generate a decimal in the range (0,1), and compare the value of the decimal with the exploration rate If the decimal value is less than the current exploration rate The value of , then randomly generate actions ,in, Represents the client In the Is it selected in the round? If so, then ,otherwise , Indicates Round selected client The allocated privacy budget; if the decimal value is greater than or equal to the exploration rate , according to the current state and target network, the selected client and the allocated privacy budget are obtained. For the specific process, please refer to step S3, which will not be repeated here. After the above steps, the first After the global iteration, the updated global network, evaluation network and target network are obtained by repeating the iteration. The global network after iterations.

[0042] S8: Update the exploration rate and repeat steps S2 to S7 until the set number of federated learning is reached. E .

[0043] Specifically, after completing a federated learning n After global iterations, determine the exploration rate Whether the preset minimum exploration rate is reached , if so, keep the exploration rate unchanged, if not, then use the exploration rate decay factor Exploration Rate Update and get the updated exploration rate: ; in, represents the updated exploration rate.

[0044] Exploration Rate The specific mathematical form can be expressed as: .

[0045] It should be noted that during the execution of the above method, the parameters E (Number of federated learning) actually represents the number of times federated learning is repeated, for example E =100, indicating that federated learning was performed 100 times. The reason for repeated execution is to evaluate the network Provide enough samples for training. And the parameters n It represents the number of global iterations of each federated learning, for example n =200, indicating that each federated learning performed 200 global iterations. The value is still relatively large in the early stage, and Most of them are randomly generated to explore possible situations in a federated learning environment and provide sample training and evaluation networks . After that, the exploration rate As the number of federated learning executions increases, it continues to decrease until it decreases to the pre-set minimum exploration rate. . To the end (i.e. E When performing federated learning, and Almost all of them are from the target network Generate, at this time and This is the desired client selection and privacy budget allocation strategy.

[0046] After the training is completed, the global network after the last federated learning has the best recognition performance, so the trained global model can be used to recognize the input image and obtain the recognition result.

[0047] Another aspect of the present invention also provides a federated learning model training system based on differential privacy image noising, including a central server and multiple clients connected to the central server, for the federated learning model training method based on differential privacy image noising.

[0048] This paper proposes a dynamic differential privacy method in combination with the federated learning framework. Different privacy budgets are used to process image data before each training, and suitable clients with different data distributions are selected to participate in federated learning. This method improves the image recognition rate while ensuring user privacy. The method has the following advantages: (1) Collaborative training under the federated learning framework: Combining the advantages of federated learning, a distributed training system is built to allow multiple clients to independently train models on local data and synchronize local updates to the central server through secure aggregation. In this process, the data of all participants is retained locally and will not be uploaded to the central server (cloud), thereby reducing the risk of data leakage.

[0049] (2) Efficient privacy protection: A dynamic differential privacy method is adopted to reduce the risk of image data leakage from model gradients due to inference attacks by adding noise to image pixels, thereby further strengthening the privacy protection of user data.

[0050] (3) Optimized noise addition strategy: Dynamically adjust the noise addition intensity according to the sensitivity of the image content and the distribution of image data to ensure that the impact on model performance is minimized while protecting privacy. Specifically, the present invention designs an intelligent noise generation algorithm that can adaptively select appropriate noise parameters (i.e., privacy budget), which not only ensures the effectiveness of privacy protection but also improves the accuracy of image recognition.

[0051] (4) Enhanced image recognition performance: By introducing technologies such as multi-task learning and transfer learning, not only the model performance of a single client is improved, but also knowledge sharing between different clients is promoted, so that the image recognition ability of the entire system is improved. Especially for small samples or low-quality images, this method can achieve better generalization performance through global collaboration.

[0052] (5) Flexible application scenario adaptation: It is applicable to a variety of image recognition tasks, such as face recognition, object detection, medical image analysis, etc., and is especially suitable for those fields with strict requirements on privacy protection. In addition, the method and system can also flexibly adjust the privacy protection level according to the needs of specific application scenarios to achieve a balance between performance and privacy.

[0053] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A federated learning model training method based on differential privacy image noising, characterized in that: include: S1: Initialize the evaluation network, target network and related hyperparameters; S2: Initialize the global model and its parameters of the federated learning system on the central server, and broadcast the global model to all clients; S3: Get the selected clients and the allocated privacy budget based on the current state of the federated learning system and the target network; S4: training the local model using the local data set on the selected client, and uploading the perturbation gradient to the central server; S5: Aggregating the perturbation gradients from the selected clients at the central server to obtain an updated global model and a reward corresponding to the current state; S6: updating the evaluation network and the target network; S7: Repeat S3 to S6 until the global iteration number set by federated learning is reached. n ; S8: Update the exploration rate and repeat S2 to S7 until the set number of federated learning is reached. E .

2. The method for training a federated learning model based on differential privacy image noising according to claim 1, characterized in that: The S1 includes: S1.1: The network will be evaluated Parameters and the target network Parameters Randomly initialized to equal parameters; S1.2: Initialize relevant hyperparameters, including discount factors , Soft Update Parameters , Exploration Rate , minimum exploration rate , exploration rate decay factor , evaluate the network learning rate and replay buffer .

3. The method for training a federated learning model based on differential privacy image noising according to claim 2, characterized in that: The S3 includes: A random decimal is generated in the range (0,1), and the value of the decimal is compared with the exploration rate 's values ​​for comparison; If the decimal value is less than the exploration rate The value of , then randomly generates the first The action of the global iteration ,in, Represents the client In the Is it selected in the global iteration? If so, ,otherwise , Represents the client In the The privacy budget allocated in the global iteration, Represents a collection of clients; If the value of the decimal is greater than or equal to the exploration rate , the current state Input to the target network In the target network Output multiple probabilities according to the current state, the number of probabilities is equal to the number of actions, and the largest forward probability is selected using the Top-k technique. The probability of the action , the current action The corresponding client is taken as the selected client, where Represents the client In the The local loss function value in the global iteration, Represents the client In the The total privacy budget remaining in the global iteration.

4. The method for training a federated learning model based on differential privacy image noising according to claim 3, characterized in that: The S4 includes: S4.1: The selected client obtains the current global model and the allocated privacy budget , and the global model Assign the parameters of to the local model; S4.2: Select a predetermined amount of local image training data from the local image training dataset, based on the allocated privacy budget A Gaussian mechanism is used to generate differential privacy noise of a corresponding degree and added to the local image training data to obtain the noisy local image training data: ； in, Indicates the number of the current local image training data m Line n The pixel value of the column, Represents the number of local image training data after adding noise m Line n The pixel value of the column, It means that the mean is 0 and the variance is Gaussian noise with Gaussian distribution; S4.3: Using the noised local image training data to train the local model on the current client Perform training and get the local loss value and the corresponding perturbation gradient , and the perturbation gradient Uploading to the central server; S4.4: The client receives the allocated privacy budget Get the current remaining overall privacy budget : ； in, Represents the client The initial overall privacy budget is Represents the client In the m The privacy budget allocated in the global iteration.

5. The method for training a federated learning model based on differential privacy image noising according to claim 4, characterized in that: The S5 includes: S5.1: The central server aggregates the perturbation gradients from all selected clients to obtain an updated global model : ； in, Indicates The global model in the global iteration, Indicates The global model in the global iteration, is the learning rate, Indicates the total number of local image training data in the selected client. Indicates The number of local image training data of each client, Indicates the number of selected clients; S5.2: The central server obtains the reward corresponding to the current state: ； in, , To fix the hyperparameters, is the proportionality coefficient.

6. The method for training a federated learning model based on differential privacy image noising according to claim 5, characterized in that: The S6 includes: S6.1: Switch the federated learning system to the next state And the tuple Stored to the replay buffer Among them, They represent the execution of the federated learning system The state, action, and reward of the global iteration, Indicates that the federated learning system executes The state of the next global iteration; S6.2: From the replay buffer Randomly select b Tuples As a sample, and according to the discount factor and evaluate the network learning rate The evaluation network is evaluated using the stochastic gradient descent method. The parameters of the network are trained and updated to obtain an updated evaluation network; S6.3: Update the parameters of the target network according to the soft update principle: .

7. The method for training a federated learning model based on differential privacy image noising according to claim 6, characterized in that: The S6.2 includes: Determine the replay buffer Tuples stored in Is the number greater than or equal to the preset extraction number? b , if so, then from the replay buffer Randomly select b Tuples As a sample, and according to the discount factor and evaluate the network learning rate The evaluation network is evaluated using the stochastic gradient descent method. The parameters of the training are updated to obtain an updated evaluation network; if not, the evaluation network is kept The parameters remain unchanged.

8. The method for training a federated learning model based on differential privacy image noising according to claim 1, characterized in that: Updates to exploration rate, including: After completing a federated learning n After global iterations, determine the exploration rate Whether the preset minimum exploration rate is reached , if so, keep the exploration rate unchanged, if not, then use the exploration rate decay factor Exploration Rate Update and get the updated exploration rate: ； in, represents the updated exploration rate.

9. A federated learning model training system based on differential privacy image noising, characterized in that: It comprises a central server and a plurality of clients connected to the central server, and is used to execute the federated learning model training method based on differential privacy image noising as described in any one of claims 1 to 8.

Images