Joint learning proxy with trusted server

Abstract

Certain aspects of the present disclosure provide techniques and apparatus for proxy joint learning. A set of intermediate activations is received at a trusted server from a node device, wherein the node device generates the set of intermediate activations using a first set of layers of a neural network. One or more weights associated with a second set of layers of the neural network are refined using the intermediate activation set, and one or more weight updates corresponding to the refined one or more weights are sent to a joint learning system.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application serial number 17 / 932,809, filed on September 16, 2022, which is hereby incorporated by reference herein.

[0003] introduction

[0004] Aspects of the present disclosure relate to efficient federated learning.

[0005] Federated learning involves training a machine learning model across multiple decentralized devices that each hold local user data samples without exchanging the data samples themselves. This enables multiple agents to collectively build a common and robust model using a wide variety of data samples from a wide variety of agents without exposing the training data itself. To this end, in conventional federated learning methods, each participating agent uses its local training data to locally train or refine the model, and the weight updates are aggregated and used by the central federated learning agent to generate an updated global model. This allows for enhanced data privacy and data security while protecting data access rights while enabling training using heterogeneous data from multiple agents.

[0006] However, in conventional federated learning, most of the training burden falls on the participating node devices. That is, each individual agent is required to train and refine a local copy of the model, which requires a lot of computing resources. In this way, conventional methods for federated learning are often constrained by the characteristics of the participating devices, especially when the devices are constrained in terms of power or computing resources (e.g., in the case of Internet of Things (IoT) devices, edge processing devices, always-on devices, wearable devices, mobile phones, etc.).

[0007] Therefore, techniques for improved federated learning are needed. Summary of the invention

[0008] One aspect provides a method comprising: receiving an intermediate activation set from a node device at a trusted server, wherein the node device generates the intermediate activation set using a first set of layers of a neural network; using the intermediate activation set to refine one or more weights associated with a second set of layers of the neural network; and sending one or more weight updates corresponding to the refined one or more weights to a federated learning system.

[0009] Another aspect provides a method comprising: receiving at a node device at least a first set of layers of a neural network from a federated learning system; processing local data using the first set of layers to generate an intermediate activation set; and sending the intermediate activation set to a trusted server.

[0010] Other aspects provide processing systems configured to perform the aforementioned methods and those described herein; a non-transitory computer-readable medium comprising instructions that, when executed by a processor of the processing system, cause the processing system to perform the aforementioned methods and those described herein; a computer program product embodied on a computer-readable storage medium, the computer program product comprising code for performing the aforementioned methods and those further described herein; and a processing system comprising components for performing the aforementioned methods and those further described herein.

[0011] The following description and associated drawings set forth in detail certain illustrative features of the one or more aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings depict certain aspects of the one or more aspects and therefore are not to be considered limiting of the scope of the present disclosure.

[0013] Figure 1 Depicted is an example workflow for agents in federated learning.

[0014] Figure 2 Depicted is an example workflow for using a trusted server to enable proxying in federated learning.

[0015] Figure 3 An example flow chart illustrating a method for proxying federated learning at a node device is depicted.

[0016] Figure 4 An example flow chart illustrating a method for proxying federated learning using a trusted server is depicted.

[0017] Figure 5 An example flow chart illustrating a method for performing machine learning using a federated learning agent is depicted.

[0018] Figure 6 An example flow chart illustrating a method for engaging in agent federated learning is depicted.

[0019] Figure 7 An example processing system configured to perform various aspects of the present disclosure is depicted.

[0020] Figure 8 An example processing system configured to perform various aspects of the present disclosure is depicted.

[0021] To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements and features of one aspect may be beneficially incorporated in other aspects without further recitation. DETAILED DESCRIPTION

[0022] Aspects of the present disclosure provide techniques for improved federated learning via a proxy, such as via a trusted server.

[0023] In various aspects described herein, node devices participating in a federated learning process may receive a machine learning model (which is in the process of being trained) from a centralized federated learning system. Each node may then instantiate and use a portion of the model (e.g., the first P layers of a neural network, from the input layer to the branch point) to generate an intermediate set of activations based on one or more local training samples. In one aspect, these intermediate activations may then be sent to one or more trusted servers or systems, which may then use the activations to refine one or more portions of the model.

[0024] In various aspects of the present disclosure, a trusted server or system may be referred to as being "trusted" to a node device because the trusted entity enhances or protects user privacy in some way. For example, a trusted server may be implemented as an edge server on an enterprise premises (e.g., within the same enterprise as the node), a dedicated server (e.g., a server that does not co-host other applications or a server with a private firewall partition), or a server on a trusted third-party server (which may also have limited or no context for the entire training, in addition to the third-party server being proxied to perform specific calculations).

[0025] As used herein, the term "branch point" refers to a point in a model where a node device stops processing a model element (eg, a model layer) and the remaining model elements are "branched" to one or more trusted servers or systems.

[0026] For example, if the branch point is after the Pth layer of the neural network (so the intermediate activations correspond to the outputs of the Pth layer), the trusted server can receive activations from the processing of the first P layers from the node devices and pass these activations through the rest of the model (e.g., from layer P+1 to the output). Once the final model output is obtained, the trusted server can then use backpropagation to refine some or all of the parameters of the model (e.g., weights and / or biases). After performing one or more rounds or one or more epochs of such "proxy" training (using intermediate activations from one or more node devices), the trusted server can provide corresponding weight updates (e.g., updated weights themselves, gradients defining how weights should be updated / changed, etc.) to a federated learning control element (such as a federated learning server or service), which in turn can use the weight updates (in some aspects together with other weights and / or gradients from other nodes and / or trusted servers) to refine the global model. This global model can then be redistributed for the next round of training.

[0027] In some aspects, the trusted server can freeze one or more parts of the model (e.g., the first P layers) during training, thereby refining only the latter (subsequent) parts. On the one hand, the resulting model can still exhibit high accuracy because the first layer generally learns low-level features and is less sensitive to domain shifts between user data (which is the main motivation for federated learning) than later layers. Therefore, distributed or joint training of those first P layers may not necessarily contribute to overall model performance. However, in some aspects, the trusted server can still refine these earlier model parts (e.g., one or more of the first P layers). The trusted server can then send weight updates to the federated learning control element and / or distribute weights and / or gradients to nodes, allowing nodes to update their local copies of the model.

[0028] Advantageously, in various aspects of the present disclosure, node devices may only use a model (or a subset of a model) to process local data, rather than performing actual on-node training that may involve, for example, calculating losses, calculating gradients based on these losses, and the like. Therefore, this proxy federated learning significantly reduces the computational burden on the node (e.g., reduced computation time required, reduced power consumption, reduced memory requirements, etc.). This reduction in on-device processing complexity can beneficially enable a wider range of devices to participate in federated learning, including enabling relatively low-performance devices (e.g., devices with limited computing resources or limited battery life, etc.) to efficiently join federated learning. Because more devices can participate in federated learning according to various aspects described herein, the federated learning process can be improved in various ways, including improving the performance of the resulting model by exposing more node-level data sets to federated training, increasing the speed of training due to more devices participating in parallel, and the like.

[0029] Example workflow for agents in federated learning

[0030] Figure 1 An example workflow 100 for proxying in federated learning is depicted. In this context, proxying refers to the sharing of training responsibilities between one or more nodes and one or more trusted servers, compared to conventional arrangements where a federated learning server interacts with nodes without a trusted server carrying some of the computational load.

[0031] As illustrated, the federated learning server 105 can distribute the model 110 to one or more trusted servers 125 and one or more participating nodes 115. Although the illustrated example depicts the federated learning server 105 distributing the model 110 directly to the nodes 115, in some aspects, the federated learning server 105 can instead distribute the model 110 to the trusted servers 125, which can in turn distribute the model to the nodes 115 using the trusted servers 125 as proxies. Figure 1 A single trusted server 125 and node 115 is depicted in FIG. 1 for conceptual clarity, but any number of trusted servers may be present to process data on behalf of any number of nodes.

[0032] In general, the federated learning server 105 receives model updates from participating entities and uses the model updates to refine or update the global machine learning model. This updated global model can then be redistributed between participating entities, thereby initiating a subsequent round of training. In general, the federated learning server 105, the node 115, and the trusted server 125 can each be implemented using hardware, software, or a combination of hardware and software. In addition, although depicted as discrete components for conceptual clarity, in some aspects, some of the components (such as the federated learning server 105 and the trusted server 125) can be implemented as discrete components or as part of one or more larger systems. For example, in one aspect, the federated learning server 105 and the trusted server 125 can operate on the same device or as part of the same cloud service. In one such aspect, an appropriate firewall can be used to ensure that intermediate activations remain private on a trusted server.

[0033] Model 110 generally represents a machine learning model and may correspond to any architecture, including a neural network, a decision tree, etc. In one aspect, model 110 is generally associated with a set of one or more trainable parameters (e.g., weights and / or biases in a neural network) that are refined during a federated learning process.

[0034] In a conventional federated learning system, each participating node instantiates a local copy of the model and refines this local copy using local training data. For example, in the case of a neural network, each node passes a training sample through the model (called a forward pass) to generate an output inference. This inference can then be compared to the true value label for the training sample to calculate the loss, and the loss can be used to refine the model parameters via back propagation (called a back propagation). In a conventional system, each node then sends the updated parameters (or gradients) to a federated learning server, which aggregates or aggregates the updated parameters (or gradients) and updates the global model. The updated global model is then redistributed, and the process continues until a certain termination point.

[0035] As discussed above, these conventional methods place a significant computational burden of training on the nodes, which limits which devices can participate in conventional federated learning. However, in aspects of the present disclosure, the trusted server 125 can act as a proxy for one or more nodes 115, enabling each node to participate (using the node's own local data) using significantly reduced computational resources.

[0036] In the illustrated aspect, node 115 can process local training data using a defined portion of model 110, such as the first P layers. In some aspects, the portion is defined based on a branch point, where the layers before the branch are located in a first portion (also referred to as an initial or input portion), and the layers after the branch are located in a second portion (also referred to as a later portion, an output portion, or a final portion). For example, if the branch point is after layer P, the first or initial portion includes layers 1 to P (or 0 to P, depending on whether 0 indexing is used), and the second or output portion includes layers P+1 to the final layer.

[0037] The output of the indicated layer (at the branch point) produces a set of intermediate activations that are typically internal to the model and would normally be processed using a later portion of the model 110 to generate output inferences. However, in the illustrated example, these intermediate activations 120 are sent from the node 115 to a trusted server 125.

[0038] In some aspects, node 115 may refrain from using the remainder of model 110 to process these activations. That is, node 115 may refrain from generating output inferences and use only the first portion to generate activations. In at least one aspect, node 115 may receive only the first portion of model 110 (e.g., the first P layers). In some aspects, node 115 may receive the entire model 110, but discard the second portion (e.g., from layer P+1 to the output layer), or refrain from using the second portion during the training phase (but may use the full model during inference after training is complete). In this way, the amount of resources required by node 115 may be substantially reduced because node 115 may only use a subset of model 110 to perform a forward pass (and does not need to use the remaining layers or perform a backward pass).

[0039] Although not illustrated in the depicted example, in some aspects, the node 115 may first encrypt the intermediate activations 120 before sending the encrypted intermediate activations to the trusted server 125, as discussed in more detail below. In the illustrated example, the trusted server 125 receives the intermediate activations 120 (decrypting them when applicable) and uses the intermediate activations to generate a set of updated parameters 130 (or, in some implementations, to generate gradients for updating the parameters). As discussed above, although a single node 115 is depicted for conceptual clarity, in some aspects, the trusted server 125 may receive activations from multiple nodes 115. In such an aspect, the updated parameters 130 (or gradients) may be generated based on activations from multiple nodes. In at least one aspect, as discussed in more detail below, the trusted server 125 may selectively use or discard activations from each node (e.g., by discarding activations that appear to be outliers).

[0040] In at least one aspect, to update parameters 130, trusted server 125 instantiates a local copy of model 110 and processes each set of intermediate activations 120 using a defined second (or next (subsequent)) portion of model 110. For example, if intermediate activations 120 correspond to outputs from the Pth layer of model 110, trusted server 125 can provide the intermediate activations as inputs to the P+1 layer (and on next (subsequent) layers) to generate output inferences from model 110.

[0041] In one aspect, the trusted server 125 can then compare the output inference (generated based on the intermediate activations 120) to the true value (provided by the node 115) to generate a loss, which can then be used to refine one or more parameters of the model 110. In one aspect, the trusted server 125 uses back-propagation to iteratively calculate a set of gradients for refining the parameters of each layer of the model 110, starting with the output layer and moving toward the input layer. In at least one aspect, the trusted server 125 refines only the layers after the branch point. That is, the first part of the model 110 can remain fixed, while the latter part is refined based on the intermediate activations 120 from the node 115.

[0042] In one such aspect, the first portion of the model 110 can be frozen or can be trained separately (e.g., by the federated learning server 105). In at least one aspect, the first portion of the model is pre-trained (e.g., before initiating the federated learning process). Alternatively, in some aspects, the trusted server 125 can also refine the first portion of the model. For example, the trusted server 125 can calculate gradients and / or updated parameters for the initial layer and send these gradients and / or parameters to the federated learning server 105 and / or to the nodes 115 to update their local models.

[0043] In some aspects, the trusted server 125 may perform multiple training epochs using the intermediate set of activations 120. That is, the trusted server 125 may perform a first training epoch using the intermediate activations 120 (e.g., using a first set of hyperparameters for the first epoch), and then perform a second (or subsequent) epoch using the same activations 120 again (e.g., using a new set of hyperparameters or weights). Advantageously, if the first set of layers is fixed, the trusted server 125 may perform multiple training epochs without requiring any additional input from the node 115.

[0044] In at least one aspect, if trusted server 125 also updates the first portion of model 110, the trusted server can send weight updates (e.g., updated weights themselves and / or weight gradients) to nodes 115 after each epoch. Each node 115 can then use this updated model to generate a new intermediate activation set 120 that is returned to trusted server 125 for the next epoch.

[0045] Regardless of the specific method used by the trusted server 125, as illustrated, the trusted server 125 then returns a set (or gradient set) of updated parameters 130 to the federated learning server 105. As in conventional federated learning, the federated learning server 105 can then aggregate the parameters 130 received from each participating trusted server 125 and / or node 115 and update the global model. In some aspects, as discussed above, the federated learning server 105 keeps the initial portion of the model fixed during this update. In other aspects, the federated learning server 105 can also refine the initial portion of the model. This updated model 110 can then be distributed to the trusted servers 125 and nodes 115 again, thereby implementing a subsequent round or iteration of training.

[0046] In some aspects, the branch points used in workflow 100 can be derived in a variety of ways, including through offline training and / or online training, or based on a previous federated learning process. In some aspects, branch points are determined based on the computational cost of processing data at one or more layers of the model, the transmission cost of sending intermediate activations (e.g., 120) output by one or more layers, and the training cost of updating parameters of one or more layers and / or the privacy level associated with each set of activations from each layer. For example, the system can use a cost function that seeks to minimize the aggregated computational cost and transmission cost while maximizing privacy gains (e.g., where activations from subsequent layers of the model tend to have higher privacy than earlier layers).

[0047] In at least one aspect, the branch point is determined using the following equation 1, where P is the branch point, E is the number of training epochs in the joint learning process (e.g., iterations of forward pass and backward pass), λ M , A and λ W is a weight term (discussed in more detail below, M l is the computational cost of processing data using layer l, A l is the cost of sending the activations output by layer l, W l is the training (e.g. computational) cost of updating the parameters of layer l, and G lis the level of privacy associated with keeping activations output by layer 1 private and external to the node (rather than sending the activations to a trusted server 125).

[0048]

[0049] It is worth noting that, as discussed above, if node 115 does not perform parameter updates itself, then W may be omitted when seeking to minimize the burden on node 115. l Item. Additionally, in some aspects, the trusted server 125 can use a single set of activations to perform multiple epochs of training, as discussed above. In this aspect, E can also be omitted (or can be set based on the number of epochs for which the node will provide input). In general, the computational cost of processing data is related to or proportional to P, so that deeper branch points produce increased computational cost on the node. Additionally, the privacy level is generally directly related to or proportional to P, where deeper branch points produce increased privacy for the node. The transmission cost varies at least in part based on the size of the output activations from each layer. In this way, the best branch points can be identified and used in the federated learning process.

[0050] In some aspects, the weight term λ M , A and λ W Can be defined or derived by one or more components of workflow 100 (e.g., by federated learning server 105, by trusted server 125, and / or by node 115) using offline training or online training, or can be otherwise defined (e.g., by an administrator) as a hyperparameter for the agent training process.

[0051] In one aspect, after the federated learning process has been completed, the node 115 and / or the trusted server 125 can receive a final copy of the global model. Each entity can then use these trained models to perform runtime inferences. For example, the node 115 can use the trained model to process new data samples to generate output inferences and (depending on the specific deployment) use these inferences for a variety of tasks. In some aspects, this proxy federated learning may be particularly beneficial for nodes that are optimized or otherwise well suited for inference but cannot perform training as efficiently.

[0052] Example workflow for federated learning of agents

[0053] Figure 2 Describes the use of a trusted server (such as Figure 1 125 ) (eg, in conjunction with a federated learning server 105 and / or node 115 ) to implement an example workflow 200 for an agent in federated learning.

[0054] In the illustrated workflow 200, at block 202, the federated learning server 105 (eg, Figure 1 The federated learning server 105 of FIG. 1 distributes the current version of the global model to nodes 115 (e.g., to Figure 1 Although not included in the illustrated example, in some aspects, the federated learning server 105 may similarly distribute the current version of the model to the trusted server 125.

[0055] At block 205, a node device (such as Figure 1 Node 115 of ) uses one or more initial layers of the received machine learning model to generate an intermediate activation set (e.g., up to and / or through a branch point at or after layer P). In some aspects, as discussed above, branch points are defined before starting the joint learning workflow 200.

[0056] In general, generating intermediate activations may include processing one or more training samples as input to the model and extracting intermediate activations output by the layer immediately before the branch point. As discussed above, in some aspects, node 115 may suppress further processing of the intermediate activations. That is, node 115 may suppress the use of the intermediate activations as input to the next layer, thereby reducing the computational cost on node 115. In some aspects, block 205 may include generating a single set of intermediate activations (using a single data sample) or generating multiple intermediate activations (e.g., using multiple data samples). That is, node 115 may process multiple input samples sequentially or in parallel to generate a corresponding set of intermediate activations for each respective input sample.

[0057] In general, intermediate activations are considered more secure and private than the original input data. That is, given the intermediate activations, it may be difficult or impossible to derive the original input data. Additionally, in some aspects, intermediate activations from deeper layers in the model may generally be more secure or private than intermediate activations from earlier layers in the model (e.g., closer to the input layer). However, in some aspects, it may still be possible to derive some original information from the activations.

[0058] In the illustrated example, at block 210, node 115 optionally encrypts the set of intermediate activations to further ensure privacy and data security. In general, any suitable encryption method may be used, including, for example, 1280-bit RSA public key encryption, 128-bit AES encryption standards, signing the activations with ECDSA under a 256-bit NIST curve, etc. In some aspects, node 115 may use a transient session key (as opposed to a permanent encryption key) such that the intermediate activations can no longer be decrypted once training is complete.

[0059] In some aspects of the present disclosure, dashed outlines are used to represent optional method steps. For example, blocks 210 and 220 may be considered optional. Similarly, Figure 3 Box 325 and Figure 4 Block 415 may be considered optional in some respects.

[0060] At block 215, node 115 sends these (possibly encrypted) intermediate activations to a trusted server such as Figure 1 In general, sending the intermediate activations may include any suitable sending technique and may include sending over one or more networks, including a wired network, a wireless network, or a combination of a wired network and a wireless network. In at least one aspect, node 115 uses the Internet to send the intermediate activations. Although not depicted in the illustrated example, in some aspects, node 115 may additionally send an (optionally encrypted) truth label for each set of activations.

[0061] At block 220 , the trusted server 125 optionally decrypts the intermediate activation (and in some aspects the ticket).

[0062] At box 225, the trusted server 125 trains one or more subsequent layers of the model (eg, a set of layers starting after the branch point and continuing through to the output of the model).

[0063] In some aspects, as discussed above, the trusted server 125 trains the latter part of the model by processing each set of intermediate activations using the latter part to generate an output inference. This output is then compared to the true value label to generate a loss. The parameters of the latter part of the model can then be refined based on the generated loss. In at least one aspect, as discussed above, the trusted server 125 only trains this subsequent part of the model (e.g., after the branch point at layer P), thereby fixing the initial part of the model. In other aspects, the trusted server 125 can similarly refine the initial part of the model.

[0064] After this phase of training (which may involve using one or more sets of activations from one or more nodes 115 during one or more epochs) is complete, at block 230, the trusted server 125 sends parameter updates, such as trained parameters (e.g., weights and / or biases) and / or gradients, to the federated learning server (e.g., Figure 1 Although not included in the illustrated example, in some aspects, the trusted server 125 may encrypt the parameters and / or gradients before sending the encrypted parameters and / or gradients to the federated learning server 105.

[0065] At block 235, the federated learning server 105 aggregates the parameter updates (e.g., updated parameters and / or gradients) received from each participating trusted server 125 and / or node (in the case where any node device is using more conventional federated learning to update its own weights), and uses the aggregated updates to update the global model. In general, if training is still ongoing, the federated learning server 105 can then distribute this updated global model (e.g., to trusted servers 125 and nodes 115) to start a new federated learning round (e.g., again using the same workflow 200).

[0066] Example method for proxying federated learning at a node device

[0067] Figure 3 An example flow chart illustrating a method 300 for proxying federated learning at a node device is depicted. In some aspects, the method 300 is performed by, for example, Figure 1 and / or Figure 2 The node device of node 115 executes.

[0068] At block 305, the node receives a current version of the machine learning model trained during the federated learning process. In various aspects, the current version of the machine learning model can be obtained from a federated learning service (e.g. Figure 1 The federated learning server 105 receives this model. In some aspects, receiving the machine learning model can include receiving the entire model or only a subset of the model. For example, a node can receive only the initial part of the model (e.g., only through the branch point at layer P). This can reduce the transmission cost of distributing the model and reduce memory and storage requirements on the node.

[0069] At block 310, the node retrieves one or more samples of local training data. As discussed above, training data may generally include one or more samples (also referred to as examples) each having a corresponding label or true value. In the illustrated example, the training data is referred to as "local" to indicate that this data is local to the node, because the node does not need to (and does not) send input examples to the federated learning system or trusted server. Instead, these examples can remain secure and private on the node (or within the node's local network).

[0070] At block 315, the node generates an intermediate activation set based on the training example. As discussed above, this may generally include processing the example using one or more initial layers of a neural network model.

[0071] At block 320, the node determines whether one or more termination criteria are satisfied. In general, such termination criteria may include a wide variety of considerations, including determining whether there are any additional training examples to process, determining whether a defined number of examples have been evaluated (thereby generating a defined number of intermediate activation sets), determining whether a defined amount of time has been spent, etc. If the criteria are not satisfied, the method 300 returns to block 310, where the node retrieves another training sample to generate another set of intermediate activations.

[0072] If at block 320 the node determines that the termination criteria are met, the method 300 proceeds to block 325 where the node may optionally encrypt the intermediate activations, as discussed above. Although the intermediate activations are generally more secure and private than the original training samples, encryption may be used to further enhance data security for agent federated learning.

[0073] At block 330, the node then sends the (possibly encrypted) intermediate activations to a trusted server, as discussed above. In one aspect, method 300 can be repeated by a node any number of times. For example, for each round of federated learning (e.g., whenever the federated learning system distributes an updated global model), method 300 can be used by each node to generate new activations for that round. These new activations can be generated using the same training data from previous rounds, using new training data, or using a mix of old and new data.

[0074] Although not depicted in method 300 for conceptual clarity, in some aspects, once the federated learning process has completed, the node can additionally receive the final global model. Subsequently, as discussed above, the node can instantiate this model and use it for runtime inference. In this way, the node can participate in and contribute to the federated learning process with reduced computational expense, thereby enabling the training of an improved global model that the node can use for future processing.

[0075] It should be noted that Figure 3 This is merely one example of a method, and other methods including fewer, additional, or alternative steps are possible consistent with the present disclosure.

[0076] Example method for proxying federated learning using a trusted server

[0077] Figure 4 An example flow chart illustrating a method 400 for proxying federated learning using a trusted server is depicted. In some aspects, the method 400 is performed by a trusted server, such as Figure 1 and / or Figure 2 The trusted server 125.

[0078] At block 405, the trusted server receives a current version of a machine learning model trained using a federated learning process. In various aspects, the current version of the machine learning model can be obtained from a federated learning system (e.g., Figure 1 In some aspects, receiving the machine learning model may include receiving the entire model or only a subset of the model. For example, if the initial portion of the model remains fixed during training, the trusted server may receive only the latter portion of the model (e.g., only from the branch point at layer P to the output layer). This may reduce the cost of sending the distributed model and reduce memory and storage requirements on the trusted server.

[0079] At block 410, the trusted server receives one or more sets of intermediate activations from one or more nodes. As discussed above, these intermediate activations are generated by each node by processing local training data using an initial portion of the model.

[0080] At block 415, the trusted server may optionally decrypt the received activation if it is encrypted.

[0081] At box 420, the trusted server may optionally evaluate the intermediate activations received from each node to determine if there are any outliers. For example, if the trusted server receives intermediate activations from one or more nodes, the trusted server may compare the intermediate activations across multiple nodes, compare statistics derived from the intermediate activations from multiple nodes, and / or compare the intermediate activations (or statistics) from one or more nodes with historical statistics or activations to determine whether any of the nodes transmits an abnormal batch or an outlier batch of activations. In conventional systems, outlier filtering can only be performed by a federated learning server (e.g., after the data has been used by the node to train a local model). Therefore, by performing outlier detection at the trusted server (before using the activations to refine the model), the system is able to prevent wasting computing resources on outlier data. In the illustrated example, if any activation is determined to be an outlier, method 400 continues to box 425, where the trusted server optionally discards the outlier intermediate activation.

[0082] At block 420, for any activations determined not to be outliers (or if such outlier filtering is not used), method 400 continues to block 430. At block 430, the trusted server generates a respective output inference for each respective set of (non-outlier) intermediate activations. For example, as discussed above, the trusted server may process each set of intermediate activations as input to the second portion of the machine learning model.

[0083] At block 435, the trusted server may then refine the machine learning model based on the generated outputs (which may include refining only a portion of the model). For example, in one aspect, the trusted server may compare each generated output inference to a corresponding true value (provided by the node) for the set of activations used to generate the inference. This allows the trusted server to generate a loss that can be used to refine the model (e.g., via backpropagation). In general, the model may be refined separately for each set of intermediate activations (e.g., using stochastic gradient descent) or based on batches of intermediate activations (e.g., using batch gradient descent).

[0084] In some aspects, as discussed above, refining the machine learning model includes refining only a second, later, or final portion of the model. For example, if the model is a neural network with L layers, activations can be generated by nodes using layers 1 to P, and outputs can be generated by the trusted server using layers P+1 to L. The trusted server can then use backpropagation to refine the weights or biases of layers P+1 to L.

[0085] In this process, the first set of layers (eg, layers 1 to P) may be frozen or fixed. In other aspects, the trusted server may also refine the first set of layers, as discussed above.

[0086] After the model has been refined using the received set of intermediate activations, method 400 continues to block 440. At block 440, the trusted server determines whether one or more termination criteria are satisfied. In general, such termination criteria may include a wide variety of considerations, including determining whether there are any additional activations to process, determining whether a defined number of activations have been processed, determining whether a defined amount of time has elapsed, and the like.

[0087] In some aspects, the criteria include determining whether one or more training epochs remain. That is, as discussed herein, the trusted server may process all of the received intermediate activations as part of one training epoch and then process the received intermediate activations again as part of a second (or subsequent) epoch.

[0088] If the criteria are not met, the method 400 returns to block 430 where the trusted server generates one or more new output inferences by processing the received activations using the model. If the criteria are met, the method 400 continues to block 445.

[0089] At box 445, the trusted server sends the parameter updates (e.g., updated weights and / or biases, gradients, etc.) determined at box 435 to the federated learning server. As discussed above, this parameter update may include parameter updates for a subset of the model (e.g., for a secondary layer, a subsequent layer, or an output layer) without any updates for the first or initial portion. As discussed above, the federated learning system may then aggregate or otherwise aggregate the parameter updates to update the global model. As discussed above, sending parameter updates may generally include sending the updated parameters themselves, and additionally or alternatively sending the gradients calculated at box 435, thereby allowing the federated learning system to aggregate (possibly using weighted averages or aggregations) these gradients to update the global model.

[0090] Although not included in the illustrated example, in some aspects, as discussed above, the trusted server may refine the entire model (rather than just the second portion of the model) at block 435. In one such aspect, the trusted server may send weight updates to the nodes, allowing each node to generate one or more new activation sets.

[0091] Additionally, although not depicted in method 400 for conceptual clarity, in some aspects, once the federated learning process has completed, the trusted server can additionally receive the final global model. Subsequently, as discussed above, the trusted server can instantiate this model and use it for runtime inference. In this way, the trusted server can act as a proxy for the node in the federated learning process, thereby reducing the computational cost for the node and enabling the training of an improved global model that the trusted server and other servers can use for future processing.

[0092] It should be noted that Figure 4 This is merely one example of a method, and other methods including fewer, additional, or alternative steps are possible consistent with the present disclosure.

[0093] Example method for using a federated learning agent for machine learning

[0094] Figure 5 An example flow chart illustrating a method 500 for performing machine learning using a federated learning agent is depicted. In some aspects, the method 500 is performed by a trusted server such as Figure 1 The trusted server 125.

[0095] At block 505, an intermediate activation set is received at a trusted server from a node device, wherein the node device generates the intermediate activation set using a first set of layers of a neural network.

[0096] At block 510, the set of intermediate activations is used to refine one or more weights associated with a second set of layers of the neural network.

[0097] At block 515 , one or more weight updates corresponding to the refined one or more weights are sent to the federated learning system.

[0098] In some aspects, method 500 also includes receiving an updated version of the neural network from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the one or more weight updates.

[0099] In some aspects, the received intermediate activation set is encrypted, and method 500 further includes decrypting the intermediate activation set prior to refining the one or more weights.

[0100] In some aspects, the neural network includes L layers, the first set of layers corresponds to an initial set of layers from layer 1 to layer P, and the second set of layers corresponds to a final set of layers from layer P+1 to layer L.

[0101] In some aspects, P is selected using a cost function based on one or more of: the computational cost of processing input data at each layer in the neural network, the transmission cost of transmitting intermediate activations associated with each layer in the neural network, or the privacy level associated with the intermediate activations associated with each layer in the neural network.

[0102] In some aspects, the first set of layers is frozen while the second set of layers is refined.

[0103] In some aspects, refining one or more weights associated with the second set of layers includes performing a plurality of training epochs using the intermediate activation sets.

[0104] In some aspects, the method 500 further includes: receiving a second set of intermediate activations from a second node device; determining that the intermediate activations in the second set are outliers; and discarding the second set of intermediate activations.

[0105] It should be noted that Figure 5 This is merely one example of a method, and other methods including fewer, additional, or alternative steps are possible consistent with the present disclosure.

[0106] Example method for participating in federated learning of agents

[0107] Figure 6 An example flow chart illustrating a method 600 for participating in agent federated learning is depicted. In some aspects, the method 600 is performed by, for example, Figure 1 The node device of node 115 executes.

[0108] At block 605 , at least a first set of layers of a neural network is received at a node device from a federated learning system.

[0109] At block 610 , local data is processed using a first set of layers to generate an intermediate set of activations.

[0110] At block 615, the intermediate activation set is sent to the trusted server.

[0111] In some aspects, a node device receives a neural network comprising a first set of layers and a second set of layers, and the node device generates the intermediate set of activations using only the first set of layers.

[0112] In some aspects, method 600 further includes receiving an updated version of the neural network from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the set of intermediate activations.

[0113] In some aspects, method 600 also includes: processing local data using a first set of layers of an updated version of the neural network to generate a new set of intermediate activations; and sending the new set of intermediate activations to the trusted server.

[0114] In some aspects, method 600 also includes processing the local data using the updated version of the neural network to generate inferences.

[0115] In some aspects, method 600 further includes encrypting the intermediate activation set before sending the encrypted set to the trusted server.

[0116] It should be noted that Figure 6 This is merely one example of a method, and other methods including fewer, additional, or alternative steps are possible consistent with the present disclosure.

[0117] Example Processing System for Federated Learning of Agents

[0118] In some respects, reference Figures 1 to 6 The described workflows, techniques, and methods may be implemented on one or more devices or systems. Figure 7 An example processing system 700 is depicted that is configured to perform various aspects of the present disclosure, including, for example, Figures 1 to 3 and Figure 6 In one aspect, the processing system 700 may correspond to a node device participating in a federated learning, such as Figure 1 Node 115. In at least some aspects, as discussed above, the operations described below with respect to processing system 700 can be distributed across any number of devices.

[0119] The processing system 700 includes a central processing unit (CPU) 702, which may be a multi-core CPU in some examples. Instructions executed at the CPU 702 may be loaded, for example, from a program memory associated with the CPU 702 or may be loaded from a memory partition (e.g., memory 724).

[0120] The processing system 700 also includes additional processing components tailored for specific functions, such as a graphics processing unit (GPU) 704 , a digital signal processor (DSP) 706 , a neural processing unit (NPU) 708 , a multimedia processing unit 710 , and wireless connectivity components 712 .

[0121] An NPU, such as NPU 708, is generally a dedicated circuit configured to implement control and arithmetic logic for executing machine learning algorithms, such as algorithms for processing artificial neural networks (ANNs), deep neural networks (DNNs), random forests (RFs), etc. An NPU is sometimes alternatively referred to as a neural signal processor (NSP), a tensor processing unit (TPU), a neural network processor (NNP), an intelligence processing unit (IPU), a vision processing unit (VPU), or a graphics processing unit.

[0122] NPUs, such as NPU 708, are configured to accelerate the execution of common machine learning tasks, such as image classification, machine translation, object detection, and various other predictive models. In some examples, multiple NPUs may be instantiated on a single chip, such as a system on a chip (SoC), while in other examples, the NPU may be part of a dedicated neural network accelerator.

[0123] The NPU can be optimized for training or inference, or in some cases configured to balance performance between the two. For NPUs that can perform both training and inference, the two tasks can generally still be performed independently.

[0124] NPUs designed to accelerate training are generally configured to accelerate the optimization of new models, which is a highly computationally intensive operation that involves inputting an existing data set (usually labeled or tagged), iterating on the data set, and then adjusting model parameters (such as weights and biases) to improve model performance. Generally speaking, optimization based on error prediction involves passing back through the layers of the model and determining the gradient to reduce the prediction error.

[0125] NPUs designed to accelerate inference are generally configured to operate on complete models. Therefore, such NPUs can be configured to input new data fragments and quickly process this fragment through the trained model to generate model output (e.g., inference). In some aspects, node devices are optimized for efficient inference and may not be as efficient for training models. Therefore, proxying the federated learning process via a trusted server can produce significant improvements.

[0126] In one specific implementation, the NPU 708 is part of one or more of the CPU 702 , the GPU 704 , and / or the DSP 706 .

[0127] In some examples, wireless connectivity component 712 may include, for example, subcomponents for third generation (3G) connectivity, fourth generation (4G) connectivity (e.g., 4G LTE), fifth generation connectivity (e.g., 5G or NR), Wi-Fi connectivity, Bluetooth connectivity, and other wireless data transmission standards. Wireless connectivity component 712 is further connected to one or more antennas 714.

[0128] The processing system 700 may also include one or more sensor processing units 716 associated with any manner of sensors, one or more image signal processors (ISPs) 718 associated with any manner of image sensors, and / or a navigation processor 720, which may include satellite-based positioning system components (e.g., GPS or GLONASS) and inertial positioning system components.

[0129] The processing system 700 may also include one or more input and / or output devices 722, such as a screen, a touch-sensitive surface (including a touch-sensitive display), physical buttons, speakers, microphones, and the like.

[0130] In some examples, one or more of the processors of processing system 700 may be based on the ARM or RISC-V instruction set.

[0131] The processing system 700 also includes a memory 724, which represents one or more static and / or dynamic memories, such as dynamic random access memory, flash-based static memory, etc. In this example, the memory 724 includes computer-executable components that can be executed by one or more of the aforementioned processors of the processing system 700.

[0132] In particular, in this example, memory 724 includes an inference component 724A and an encryption component 724B. Memory 724 also includes a set of model parameters 724C, local data 724D, and a set of one or more encryption keys 724E. Model parameters 724C may generally correspond to parameters of all or a portion of a machine learning model trained using a federated learning process. Local data 724D generally corresponds to local training data used by the node, and encryption key 724E may generally be used to encrypt activations if desired. The depicted components, as well as other components not depicted, may be configured to perform various aspects of the techniques described herein. Although not shown for conceptual clarity, Figure 7 Although depicted as discrete components in FIG. 7 , the inference component 724A and the encryption component 724B may be implemented jointly or separately in various aspects.

[0133] Processing system 700 also includes inference circuitry 726 and encryption circuitry 727. The depicted circuits, as well as other circuits not depicted, may be configured to perform various aspects of the techniques described herein.

[0134] For example, the inference component 724A and the inference circuit 726 may be used to generate intermediate activations during the training process and / or to generate output inferences after the model is trained, as described above with reference to Figures 1 to 3 and / or Figure 6 The encryption component 724B and the encryption circuit 727 may be used to optionally encrypt the intermediate activation before sending the encrypted intermediate activation, as described above with reference to Figure 2 , Figure 3 and / or Figure 6 discussed.

[0135] Although for the sake of clarity Figure 7 Although depicted as separate components and circuits, the inference circuit 726 and the encryption circuit 727 may be implemented together or separately in other processing devices of the processing system 700, such as within the CPU 702, GPU 704, DSP 706, NPU 708, etc.

[0136] In general, the processing system 700 and / or its components may be configured to perform the methods described herein.

[0137] It is worth noting that in other aspects, aspects of the processing system 700 may be omitted, such as where the processing system 700 is a server computer, etc. For example, in other aspects, the multimedia processing unit 710, the wireless connectivity component 712, the sensor processing unit 716, the ISP 718, and / or the navigation processor 720 may be omitted. Furthermore, aspects of the processing system 700 may be distributed among multiple devices.

[0138] Example Processing System for Federated Learning of Agents

[0139] In some respects, reference Figures 1 to 6 The described workflows, techniques, and methods may be implemented on one or more devices or systems. Figure 8 An example processing system 800 is depicted that is configured to perform various aspects of the present disclosure, including, for example, Figure 1 , Figure 2 and Figures 4 to 5 In one aspect, the processing system 800 may correspond to a trusted server, such as Figure 1 800. In at least some aspects, as discussed above, the operations described below with respect to the processing system 800 may be distributed across any number of devices.

[0140] The processing system 800 generally includes a central processing unit (CPU) 802, a graphics processing unit (GPU) 804, a digital signal processor (DSP) 806, a neural processing unit (NPU) 808, a multimedia processing unit 810, a wireless connection component 812, one or more sensor processing units 816 associated with any manner of sensor, one or more image signal processors (ISP) 818 associated with any manner of image sensor, a navigation processor 820, and one or more input and / or output devices 822. These components can be generally related to Figure 7 The corresponding components in are the same or similar.

[0141] The processing system 800 also includes a memory 824, which represents one or more static and / or dynamic memories, such as dynamic random access memory, flash-based static memory, etc. In this example, the memory 824 includes computer-executable components that can be executed by one or more of the aforementioned processors of the processing system 800.

[0142] In particular, in this example, memory 824 includes a decryption component 824A and a training component 824B. Memory 824 also includes a set of model parameters 824C, intermediate activations 824D, and a decryption key 824E. Model parameters 824C may generally correspond to parameters of all or a portion of a machine learning model trained using a federated learning process. Intermediate activations 824D may generally correspond to activations received from one or more nodes as part of an agent federated learning process, and decryption key 824E may be used to decrypt any encrypted activations (as appropriate). The depicted components, as well as other components not depicted, may be configured to perform various aspects of the techniques described herein. Although not shown for conceptual clarity, Figure 8 Although depicted as discrete components in FIG. 8 , the decryption component 824A and the training component 824B may be implemented jointly or separately in various aspects.

[0143] Processing system 800 also includes decryption circuitry 826 and training circuitry 827. The depicted circuits, as well as other circuits not depicted, may be configured to perform various aspects of the techniques described herein.

[0144] For example, the decryption component 824A and the decryption circuit 826 may be used to decrypt the intermediate activation generated by the node device, as described above with reference to Figure 2 and / or Figures 4 to 5 The training component 824B and the training circuit 827 may be used to refine all or part of the machine learning model based on these activations, as described above with reference to Figure 1 to Figure 2 and / or Figures 4 to 5 discussed.

[0145] Although for the sake of clarity Figure 8 Although depicted as separate components and circuits, the decryption circuit 826 and the training circuit 827 may be implemented together or separately in other processing devices of the processing system 800, such as within the CPU 802, GPU 804, DSP 806, NPU 808, etc.

[0146] In general, the processing system 800 and / or its components may be configured to perform the methods described herein.

[0147] It is worth noting that in other aspects, aspects of the processing system 800 may be omitted, such as where the processing system 800 is a server computer, etc. For example, in other aspects, the multimedia processing unit 810, the wireless connectivity component 812, the sensor processing unit 816, the ISP 818, and / or the navigation processor 820 may be omitted. Furthermore, aspects of the processing system 800 may be distributed among multiple devices.

[0148] Sample Clauses

[0149] Clause 1: A method comprising: receiving an intermediate activation set from a node device at a trusted server, wherein the node device uses a first set of layers of a neural network to generate the intermediate activation set; using the intermediate activation set to refine one or more weights associated with a second set of layers of the neural network; and sending one or more weight updates corresponding to the refined one or more weights to a federated learning system.

[0150] Clause 2: The method of clause 1, further comprising: receiving an updated version of the neural network from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the one or more weight updates.

[0151] Clause 3: A method according to any of clauses 1 to 2, wherein the received intermediate activation set is encrypted, the method further comprising: decrypting the intermediate activation set before refining the one or more weights.

[0152] Clause 4: A method according to any one of clauses 1 to 3, wherein: the neural network comprises L layers, the first set of layers corresponds to an initial set of layers from layer 1 to layer P, and the second set of layers corresponds to a final set of layers from layer P+1 to layer L.

[0153] Clause 5: A method according to any one of clauses 1 to 4, wherein P is selected using a cost function based on one or more of: the computational cost of processing input data at each layer in the neural network, the transmission cost of transmitting intermediate activations associated with each layer in the neural network, or the privacy level associated with the intermediate activations associated with each layer in the neural network.

[0154] Clause 6: The method of any of clauses 1 to 5, wherein the first set of layers is frozen and the second set of layers is refined.

[0155] Clause 7: The method of any of clauses 1 to 6, wherein refining the one or more weights associated with the second set of layers comprises performing a plurality of training epochs using the intermediate activation set.

[0156] Clause 8: The method of any one of clauses 1 to 7, further comprising: receiving a second set of intermediate activations from a second node device; determining that the second set of intermediate activations is an outlier; and discarding the second set of intermediate activations.

[0157] Clause 9: A method comprising: receiving at a node device at least a first set of layers of a neural network from a federated learning system; processing local data using the first set of layers to generate an intermediate activation set; and sending the intermediate activation set to a trusted server.

[0158] Clause 10: The method of clause 9, wherein: the node device receives the neural network comprising the first set of layers and a second set of layers, and the node device generates the intermediate activation set using only the first set of layers.

[0159] Clause 11: The method of any one of clauses 9 to 10, further comprising: receiving an updated version of the neural network from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the intermediate activation set.

[0160] Clause 12: The method of any one of clauses 9 to 11, further comprising: processing local data using the first set of layers of the updated version of the neural network to generate a new set of intermediate activations; and sending the new set of intermediate activations to the trusted server.

[0161] Clause 13: The method of any one of clauses 9 to 12, further comprising: processing local data using the updated version of the neural network to generate inferences.

[0162] Clause 14: The method of any one of clauses 9 to 13, further comprising: encrypting the intermediate activation set before sending the intermediate activation set to the trusted server.

[0163] Clause 15: A system comprising: a memory including computer executable instructions; and one or more processors configured to execute the computer executable instructions and cause a processing system to perform the method according to any one of clauses 1 to 14.

[0164] Clause 16: A system comprising: means for performing the method according to any one of clauses 1 to 14.

[0165] Clause 17: A non-transitory computer readable medium comprising: computer executable instructions that, when executed by one or more processors of a processing system, cause the processing system to perform the method of any one of clauses 1 to 14.

[0166] Clause 18: A computer program product embodied on a computer readable storage medium, the computer program product comprising code for performing the method according to any one of clauses 1 to 14.

[0167] Additional considerations

[0168] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. The examples discussed herein are not limited to the scope, applicability or aspects set forth in the claims. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects. For example, without departing from the scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various examples may omit, replace or add various procedures or components as appropriate. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted or combined. In addition, the features described for some examples may be combined in some other examples. For example, any number of aspects set forth herein may be used to implement a device or practice method. In addition, the scope of the present disclosure is intended to cover such devices or methods practiced using other structures, functionality or structures and functionality that are supplementary or alternative to the various aspects of the present disclosure set forth herein. It should be understood that any aspect of the disclosure disclosed herein may be embodied by one or more elements of the present invention.

[0169] As used herein, the word “exemplary” means “serving as an example, instance, or illustration.” Any aspect described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects.

[0170] As used herein, a phrase referring to "at least one of" a list of items refers to any combination of those items (including single members). For example, "at least one of a, b, or c" is intended to cover a, b, c, ab, ac, bc, and abc, as well as any combination with multiple identical elements (e.g., aa, aaa, aab, aac, abb, acc, bb, bbb, bbc, cc, and ccc, or any other ordering of a, b, and c).

[0171] As used herein, the term "determining" encompasses a wide variety of actions. For example, "determining" may include calculating, computing, processing, deriving, investigating, searching (e.g., searching in a table, database, or other data structure), ascertaining, and the like. Furthermore, "determining" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), and the like. Furthermore, "determining" may include resolving, selecting, choosing, establishing, and the like.

[0172] As used herein, in the context of sharing electronic signals and data between the various elements described herein, the term "connected to" generally refers to data communication between the corresponding elements connected to each other. In some cases, the elements can be directly connected to each other, such as via one or more conductive traces, lines or other conductive carriers that can carry signals and / or data between the corresponding elements directly connected to each other. In other cases, the elements can be indirectly connected to each other, such as via one or more data buses or similar shared circuits and / or integrated circuit elements for conveying signals and data between the corresponding elements indirectly connected to each other.

[0173] The method disclosed herein includes one or more steps or actions for implementing the method. The steps and / or actions of the method can be interchangeable with each other without departing from the scope of the claims. In other words, unless a specific order of steps or actions is specified, the order and / or use of specific steps and / or actions can be modified without departing from the scope of the claims. In addition, the various operations of the method described above can be performed by any appropriate component capable of performing the corresponding function. The component may include various hardware and / or software components and / or modules, including but not limited to circuits, application specific integrated circuits (ASICs) or processors. In general, in the case of operations illustrated in the accompanying drawings, those operations may have corresponding corresponding components with similar numbers plus functional components.

[0174] The following claims are not intended to be limited to the various aspects shown herein, but should be given the full scope consistent with the language of the claims. Within the claims, unless otherwise specified, the reference to the singular element is not intended to mean "one and only one", but "one or more". Unless otherwise specified, the term "some" refers to one or more. No claim element should be interpreted according to the provisions of 35 U.S.C. § 112 (f), unless the phrase "parts for..." is used to expressly record the element, or in the case of a method claim, the phrase "step for..." is used to record the element. All structural and functional equivalents of the elements of the various aspects described throughout the present disclosure that are known or will be known later to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be covered by the claims. In addition, nothing disclosed herein is intended to be dedicated to the public, regardless of whether such disclosure is explicitly recorded in the claims.

Claims

1. A processor-implemented method, comprising: receiving, at a trusted server, an intermediate activation set from a node device, wherein the node device generates the intermediate activation set using a first set of layers of a neural network; using the set of intermediate activations to refine one or more weights associated with a second set of layers of the neural network; as well as One or more weight updates corresponding to the refined one or more weights are sent to the federated learning system.

2. The processor-implemented method of claim 1 , further comprising: An updated version of the neural network is received from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the one or more weight updates.

3. The processor-implemented method of claim 1 , wherein the received intermediate activation set is encrypted, the method further comprising: The intermediate activation set is decrypted prior to refining the one or more weights.

4. The processor-implemented method of claim 1 , wherein: The neural network includes L layers, The first set of layers corresponds to an initial set of layers from layer 1 to layer P, and The second set of layers corresponds to the final set of layers from layer P+1 to layer L.

5. The processor-implemented method of claim 4, wherein P is selected using a cost function based on one or more of: the computational cost of processing the input data at each layer in the neural network, Send the cost of sending the intermediate activations associated with each layer in the neural network, or A privacy level associated with the intermediate activations associated with each layer in the neural network. The processor-implemented method of claim 1 , wherein the first set of layers is frozen and the second set of layers is refined.

7. The processor-implemented method of claim 1 , wherein refining the one or more weights associated with the second set of layers comprises performing a plurality of training epochs using the intermediate activation sets.

8. The processor-implemented method of claim 1 , further comprising: receiving a second set of intermediate activations from a second node device; determining that said second set of intermediate activations are outliers; as well as The second set of intermediate activations is discarded.

9. A processor-implemented method comprising: receiving, at a node device, at least a first set of layers of a neural network from a federated learning system; processing the local data using the first set of layers to generate an intermediate set of activations; as well as The intermediate activation set is sent to a trusted server.

10. The processor-implemented method of claim 9, wherein: The node device receives the neural network including the first set of layers and the second set of layers, and The node device generates the intermediate active set using only the first set of layers.

11. The processor-implemented method of claim 9, further comprising: An updated version of the neural network is received from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the set of intermediate activations.

12. The processor-implemented method of claim 11 , further comprising: processing local data using the first set of layers of the updated version of the neural network to generate a new set of intermediate activations; as well as The new intermediate activation set is sent to the trusted server.

13. The processor-implemented method of claim 11 , further comprising: Local data is processed using the updated version of the neural network to generate inferences.

14. The processor-implemented method of claim 9, further comprising: The intermediate activation set is encrypted before being sent to the trusted server.

15. A system comprising: a memory including computer executable instructions; and a processor configured to execute the computer-executable instructions and cause the system to perform operations comprising: receiving, at a trusted server, an intermediate activation set from a node device, wherein the node device generates the intermediate activation set using a first set of layers of a neural network; using the intermediate set of activations to refine one or more weights associated with a second set of layers of the neural network; and One or more weight updates corresponding to the refined one or more weights are sent to the federated learning system.

16. The system of claim 15, wherein the operations further comprise: An updated version of the neural network is received from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the one or more weight updates.

17. The system of claim 15, wherein the received intermediate activation set is encrypted, the operations further comprising: The intermediate activation set is decrypted prior to refining the one or more weights.

18. The system of claim 15, wherein: The neural network includes L layers, The first set of layers corresponds to an initial set of layers from layer 1 to layer P, and The second set of layers corresponds to the final set of layers from layer P+1 to layer L.

19. The system of claim 18, wherein P is selected using a cost function based on one or more of: the computational cost of processing the input data at each layer in the neural network, Send the cost of sending the intermediate activations associated with each layer in the neural network, or A privacy level associated with the intermediate activations associated with each layer in the neural network.

20. The system of claim 15, wherein the first set of layers is frozen and the second set of layers is refined.

21. The system of claim 15, wherein refining the one or more weights associated with the second set of layers comprises performing a plurality of training epochs using the intermediate activation sets.

22. The system of claim 15, the operations further comprising: receiving a second set of intermediate activations from a second node device; determining that said second set of intermediate activations are outliers; as well as The second set of intermediate activations is discarded.

23. One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors of a processing system, cause the processing system to perform operations comprising: receiving, at a trusted server, an intermediate activation set from a node device, wherein the node device generates the intermediate activation set using a first set of layers of a neural network; using the set of intermediate activations to refine one or more weights associated with a second set of layers of the neural network; as well as One or more weight updates corresponding to the refined one or more weights are sent to the federated learning system.

24. The one or more non-transitory computer readable media of claim 23, the operations further comprising: An updated version of the neural network is received from the federated learning system, wherein the updated version of the neural network is generated based at least in part on the one or more weight updates.

25. The one or more non-transitory computer-readable media of claim 23, wherein the received intermediate activation set is encrypted, the operations further comprising: The intermediate activation set is decrypted prior to refining the one or more weights.

26. The one or more non-transitory computer readable media of claim 23, wherein: The neural network includes L layers, The first set of layers corresponds to an initial set of layers from layer 1 to layer P, and The second set of layers corresponds to the final set of layers from layer P+1 to layer L.

27. The one or more non-transitory computer-readable media of claim 26, wherein P is selected using a cost function based on one or more of: the computational cost of processing the input data at each layer in the neural network, Send the cost of sending the intermediate activations associated with each layer in the neural network, or A privacy level associated with the intermediate activations associated with each layer in the neural network.

28. The one or more non-transitory computer-readable media of claim 23, wherein the first set of layers is frozen and the second set of layers is refined.

29. The one or more non-transitory computer-readable media of claim 23, wherein refining the one or more weights associated with the second set of layers comprises performing a plurality of training epochs using the intermediate activation sets.

30. The one or more non-transitory computer readable media of claim 23, the operations further comprising: receiving a second set of intermediate activations from a second node device; determining that said second set of intermediate activations are outliers; as well as The second set of intermediate activations is discarded.

Images