Data privacy protection method under federated learning framework and medical service system

Abstract

The invention discloses a data privacy protection method under a federated learning framework and a medical service system. The method comprises the steps that a gradient optimization direction classification model is trained, and the gradient optimization direction classification model takes an update gradient of a client local model as input of data and outputs optimization target features corresponding to preset classification; the server sends the aggregated global model and a pre-trained gradient optimization direction classification model to the client; and after each round of model training is completed, each client encrypts model parameters by using homomorphic encryption, uploads the updated model to a server and the like. According to the method, the gradient optimization direction classification model and the homomorphic encryption technology are combined, so that the privacy of the client is protected, and personalized model training and updating of the client are realized. The method not only considers privacy protection, but also considers optimization of model performance, and is a comprehensive solution.

Description

[0001] This application is a divisional application. The application number of the original application is 202411845982.4, the application date is 2024.12.16, and the name of the invention is "A data privacy protection method and medical service system under a federated learning framework" Technical Field

[0002] The present invention relates to the field of federated learning technology, and in particular to a data privacy protection method and a medical service system under a federated learning framework. Background Art

[0003] Federated Learning (FL), as a distributed machine learning paradigm, is centered on allowing multiple clients to jointly train a global model under the coordination of a central server without centralizing their original data sets. However, in the face of significant data heterogeneity, the training efficiency of the global model under the traditional federated learning framework may be seriously impaired. Especially in the medical field, the medical data held by different clients may come from different populations or geographical regions, resulting in significant differences in the statistical characteristics of the data (such as mean and variance). In addition, the data of different clients may contain different feature sets, or even if they contain the same features, the importance and distribution of these features may be different. To address these challenges, researchers have proposed a variety of strategies, including weight adjustment, personalized learning, and data preprocessing, to improve the robustness and efficiency of federated learning in the face of heterogeneous environments. Despite this, these solutions still seem to be unable to deal with the problem of feature distribution shift in medical data, which may lead to slower model convergence or reduced performance. At the same time, existing personalized federated learning methods often fail to fully consider the issue of client medical data privacy protection. Therefore, developing a federated learning solution that can effectively handle data heterogeneity and feature distribution shift problems while ensuring client privacy protection has become an urgent problem to be solved in the current research field. Summary of the invention

[0004] In view of this, the purpose of the present invention is to propose a data privacy protection method and medical service system under the federated learning framework. This solution combines the gradient optimization direction classification model and homomorphic encryption technology to protect the privacy of the client while realizing personalized model training and updating for the client. This method takes into account both privacy protection and optimization of model performance, and is a comprehensive solution.

[0005] According to one aspect of the present invention, a data privacy protection method under a federated learning framework is provided, comprising:

[0006] Training a gradient optimization directional classification model, which takes the updated gradient of the client's local model as data input and outputs the optimization target features corresponding to the preset classification; the server sends the aggregated global model and the pre-trained gradient optimization directional classification model to the client;

[0007] After each round of model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server;

[0008] After at least 60% of the total number of communication rounds, the gradient features updated in each round are input into the gradient optimization direction classification model, and the client optimization target features are output; the target features are encrypted together with the model parameters using homomorphic encryption, the updated model is uploaded to the server and decrypted to obtain the target features, and each client is classified based on the target features to obtain several client groups with the same features, and targeted training is performed for each client group based on the classification results to generate a corresponding personalized model; and the personalized models are distributed according to the client groups;

[0009] After each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server until the end.

[0010] In the above technical solution, the gradient optimization direction classification model takes the updated gradient of the client local model as input, aiming to output the optimization target features corresponding to the preset classification. This method aims to enable the server to identify and understand the gradient characteristics of each client, and then achieve classification, which is crucial for subsequent personalized model training. In this way, the server can adjust the global model according to the characteristics of the client to achieve better personalized adaptation. Within the framework of federated learning, the server aggregates the global model and sends it to the client together with the pre-trained gradient optimization direction classification model. This process follows the standard process of federated learning, in which the FedAvg algorithm is often used for parameter averaging. This method effectively protects the security of user data because only the update of the model parameters is uploaded to the server, not the original data, thereby reducing the risk of data leakage. After completing each round of model training, the client uses homomorphic encryption technology to encrypt the model parameters and uploads the updated model to the server. This step further protects the client's data privacy, because even if the data is intercepted during transmission, the attacker cannot decrypt the model parameters, thereby ensuring the security of the data. After a certain number of communication rounds, the server takes the gradient features updated in each round of the previous order as input and sends them to the gradient optimization direction classification model to output the client optimization target features. This step uses the gradient features to classify the clients, providing a basis for further personalized model training. Through homomorphic encryption technology, the target features and model parameters are encrypted together, uploaded to the server and decrypted to obtain the target features. Based on the target features, the server classifies the clients to form several client groups with the same features, and conducts targeted training for each client group to generate the corresponding personalized model. This method not only improves the personalization of the model, but also maintains privacy protection. The server distributes personalized models according to the client groups. After completing each subsequent round of personalized model training, each client uses homomorphic encryption technology to encrypt the model parameters and upload them to the server. This step ensures the continuous update and optimization of the model while maintaining the privacy security of the data. This solution combines the gradient optimization direction classification model and homomorphic encryption technology to realize personalized model training and updating for the client while protecting the privacy of the client. This method takes into account the optimization of model performance while considering privacy protection, providing a comprehensive solution.

[0011] In some embodiments, after each round of model training is completed, each client encrypts the model parameters using homomorphic encryption and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, the following steps are also included:

[0012] The model parameters are encrypted by adding Laplace noise, and the formula is as follows;

[0013]

[0014] In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, is the noise drawn from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity.

[0015] In the above technical solution, a privacy protection mechanism combining homomorphic encryption and Laplace noise is adopted to ensure the security of client privacy during the encryption process of model parameters while maintaining the server's effective update capability of the model. Specifically, before the model parameters are homomorphically encrypted, Laplace noise is introduced in this case to achieve privacy protection of the model parameters. By adding Laplace noise to the model parameters, this case can reduce the deviation in the model parameter update process while protecting the client's privacy, thereby enhancing the robustness of the model. The introduction of Laplace noise is based on differential privacy theory, which provides a framework for quantifying the strength of privacy protection and prevents the leakage of sensitive information by introducing randomness in the data. In this solution, the scale of Laplace noise is determined by the privacy budget ε and the sensitivity s, where ε controls the strength of privacy protection and s measures the degree of influence of parameter updates on the model output. Through the carefully designed noise addition process, this case ensures that even if the model parameters are leaked, the attacker cannot accurately infer the client's original data, thereby achieving effective protection of client privacy. In addition, the addition of Laplace noise also helps to reduce overfitting in model parameter updates and improves the generalization ability of the model when facing different data distributions. This mechanism enables the server to effectively aggregate and update the global model without directly accessing the client's original data, thereby optimizing the performance of the model while protecting privacy. By adding Laplace noise to the model parameters before homomorphic encryption, the present invention not only strengthens the protection of client privacy, but also improves the robustness and generalization ability of the model, providing an effective solution for privacy protection in federated learning.

[0016] In some embodiments, after each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, the following steps are also included:

[0017] Calculate the average of the model parameters of the first 40% rounds, and encrypt the model parameters of the current round by adding Laplace noise. The formula is as follows;

[0018]

[0019] In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, A 40％ represents the global average of the first 40% rounds, is the noise extracted from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity; and M is the adjustment value.

[0020] In the above technical solution, this setting method has the following advantages:

[0021] (1) Balance between global and personalized privacy protection: This method combines the global average A of the first 40% rounds 40％ With personalized local data A i , while maintaining global data privacy, it provides customized privacy protection for each client. This strategy allows to preserve certain statistical characteristics of the overall data while protecting individual data privacy, achieving a balance between global and personalized privacy protection.

[0022] (2) Dynamic privacy budget allocation: Parameter M allows the privacy budget to be dynamically adjusted between the global average and personalized data, which enhances the flexibility of privacy protection. By adjusting the value of M, the most suitable balance between privacy protection and data utilization can be found in different application scenarios.

[0023] (3) Strong adaptability: By introducing Laplace noise, the level of privacy protection can be precisely controlled. As the privacy budget ε decreases, the degree of privacy protection increases and the noise increases, thereby more effectively hiding the contribution of individual data to the overall result.

[0024] (4) Trade-off between privacy protection and model performance: In personalized federated learning, this formula allows a trade-off between privacy protection and model performance. By adjusting the parameters M and ε, the accuracy and utility of the model can be improved as much as possible while maintaining privacy.

[0025] This scheme provides an effective privacy protection mechanism in personalized federated learning. It can not only improve the accuracy and communication efficiency of the model while protecting individual privacy, but also adapt to different data distribution and attack scenarios, providing a comprehensive solution for privacy protection in personalized federated learning.

[0026] In some embodiments, the gradient optimization direction classification model specifically:

[0027] Obtain gradient feature data of different types of clients and build a data set;

[0028] Construct a neural network model with gradient feature data as data input and client classification as output;

[0029] The constructed neural network model is trained using the constructed data set;

[0030] Based on the trained neural network model, the client optimization target features are predicted.

[0031] In the above technical solution, first, it is necessary to collect gradient feature data from different types of clients. These data may include the size, direction, rate of change of the gradient, etc. These features can reflect the dynamic characteristics of the client model training. (It should be stated that this part needs to be based on the client's provision, which can be historical gradient feature data, or the server can collect it according to the historical training situation, which will not be repeated here). Secondly, the collected gradient data is cleaned and standardized to ensure the quality of the data, eliminate possible noise and outliers, and make the data more suitable for training the neural network model. Thirdly, build a neural network model: design a neural network model with gradient feature data as input and client classification as output. This model can be a simple multi-layer perceptron (MLP) or a more complex structure, such as a convolutional neural network (CNN) or a recurrent neural network (RNN), depending on the nature and complexity of the gradient data. Input layer: The input layer of the model can receive the processed gradient feature data. Hidden layer: As needed, one or more hidden layers can be added to extract nonlinear relationships and complex patterns between features. Output layer: The design of the output layer should match the client classification task. For example, if the task is a binary classification problem, a sigmoid activation function can be used; if it is a multi-classification problem, a softmax activation function can be used. Finally, the neural network model is trained. Loss function: Select a suitable loss function, such as cross entropy loss, to measure the difference between the model prediction and the actual label. Optimizer: Select an optimizer, such as Adam or SGD, to update the weights of the model to minimize the loss function. Training process: Use the constructed dataset to train the neural network model and adjust the model parameters through forward propagation and back propagation algorithms. After the training is completed, the performance of the model is evaluated using the validation set or test set to ensure that the model has good generalization ability. Feature prediction: Use the trained model to predict the gradient features of the new client to determine its optimization target features. According to the prediction results of the model, the client can be classified, and the update strategy of the global model can be adjusted accordingly or personalized model training can be performed. Overall, the gradient optimization direction classification model described provides a mechanism to predict the optimization target features of the client by analyzing its gradient features, thereby achieving more effective personalized federated learning. This approach can improve the efficiency and effectiveness of federated learning systems while protecting client data privacy.

[0032] According to another aspect of the present invention, a medical service system is provided, the system comprising:

[0033] A pre-processing module is configured to train a gradient-optimized directional classification model based on medical data, the gradient-optimized directional classification model uses the updated gradient of the client local model as data input, and outputs the optimized target features corresponding to the preset classification; the server sends the aggregated global model based on medical data and the pre-trained gradient-optimized directional classification model based on medical data to the client;

[0034] The first phase training module is configured such that after each round of model training, each client encrypts the model parameters using homomorphic encryption and uploads the updated model to the server;

[0035] The second-stage training module is configured to, when at least 60% of the total number of communication rounds have passed, input the gradient features updated in each round of the previous sequence into the gradient optimization direction classification model, and output the client optimization target features; encrypt the target features together with the model parameters using homomorphic encryption, upload the updated model to the server and decrypt it to obtain the target features, and classify each client based on the target features to obtain a number of client groups with the same features, perform targeted training for each client group based on the classification results, and generate a corresponding personalized model; and distribute the personalized models according to the client groups;

[0036] In the third stage training module, after each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server until the end.

[0037] In the above technical solution, in order to better use the above method, this application proposes a medical service system, which aims to achieve personalization and optimization of medical services through advanced machine learning technology and privacy protection mechanism. The system includes the following key modules:

[0038] Pre-processing module: In the medical service system, this case trained a gradient optimization direction classification model based on medical data. The model is able to predict its optimization target features based on the updated gradient of the client (i.e., each medical institution or patient). This process is similar to the personalized treatment plan in medical services, where the gradient features can be analogous to the patient's physiological data and treatment response, and the optimization target features correspond to the expected treatment effect or health improvement.

[0039] Phase 1 training module: After each round of model training, each client uses homomorphic encryption technology to encrypt the model parameters and upload them to the server. In the medical service system, this step ensures the privacy and security of patient data while allowing medical institutions to share and learn best practices, similar to the sharing mechanism of patient data in telemedicine services.

[0040] Second-stage training module: When the number of communication rounds reaches 60% of the total number of rounds, the system will use the gradient features updated in each round as input and feed them into the gradient optimization direction classification model to output the client's optimization target features. This step is crucial for identifying and adapting to the data characteristics of different clients, and helps deal with data heterogeneity and non-independent and identically distributed (Non-IID) problems.

[0041] Phase 3 training module: After the personalized model training is completed, the client continues to use homomorphic encryption technology to encrypt the model parameters and upload them to the server. This step helps to achieve continuous optimization and personalization of medical services while protecting patient privacy, similar to adjusting treatment plans based on patient feedback in precision medicine.

[0042] Overall, the solution combines the gradient optimization directional classification model and homomorphic encryption technology to achieve personalized and optimized medical services while protecting patient privacy. This approach not only takes into account privacy protection, but also takes into account the optimization of medical service performance, providing a comprehensive solution that aims to improve the efficiency and quality of medical services while ensuring the security and privacy of patient data.

[0043] According to another aspect of the present invention, a data privacy protection device under a federated learning framework includes: at least one processor; and

[0044] a memory communicatively connected to the at least one processor; wherein,

[0045] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor so that the at least one processor can perform the above method.

[0046] In the above technical solution, in order to better run and process the method, the above method is stored in a memory, and the stored method is executed by a processor. It should be noted that the principle and effect of each step have been described above and will not be described in detail here.

[0047] According to another aspect of the present invention, a computer-readable storage medium is provided, storing a computer program, wherein the computer program implements the above method when executed by a processor.

[0048] In the above technical solution, in order to better run and use the method, the above method is stored in a computer-readable storage medium, and the above method is implemented by a processor. It should be noted that the principle and effect of each step have been described above and will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 It is a flow chart of an embodiment of a method for protecting data privacy under a federated learning framework of the present invention;

[0051] Figure 2 It is a structural diagram of an embodiment of a medical service system of the present invention. DETAILED DESCRIPTION

[0052] The present invention will be further described in detail below in conjunction with the accompanying drawings and examples. It is particularly noted that the following examples are only used to illustrate the present invention, but are not intended to limit the scope of the present invention. Similarly, the following examples are only partial embodiments of the present invention rather than all embodiments, and all other embodiments obtained by those of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0053] The present invention provides a data privacy protection method and medical service system under the federated learning framework. The scheme combines the gradient optimization direction classification model and homomorphic encryption technology to protect the privacy of the client while realizing personalized model training and updating for the client. This method takes into account both privacy protection and optimization of model performance, and is a comprehensive solution.

[0054] Embodiment 1

[0055] See also Figure 1 , a data privacy protection method under a federated learning framework, including:

[0056] S1. Train a gradient optimization direction classification model, which takes the updated gradient of the client local model as data input and outputs the optimization target features corresponding to the preset classification; the server sends the aggregated global model and the pre-trained gradient optimization direction classification model to the client;

[0057] In this embodiment, the gradient optimization direction classification model is specifically:

[0058] A. Obtain gradient feature data of different types of clients and build a data set;

[0059] B. Construct a neural network model with gradient feature data as data input and client classification as output;

[0060] C. Use the constructed data set to train the constructed neural network model;

[0061] D. Based on the trained neural network model, predict the client optimization target features.

[0062] In this embodiment, the optimization target features of the client are predicted by the gradient optimization direction classification model, which helps to identify and adapt to the data characteristics of different clients, and can perform personalized model adjustments according to the gradient characteristics of the client. In this way, the system can better handle the problem of data heterogeneity. At the same time, classifying the clients and generating corresponding personalized models can reduce the impact of feature distribution offset on model performance. First, gradient feature data needs to be collected from different types of clients. These data may include the size, direction, rate of change of the gradient, etc., and these features can reflect the dynamic characteristics of client model training. (It should be stated that this part needs to be based on the client, which can be historical gradient feature data, or the server side can be collected according to historical training conditions, which will not be repeated here). Secondly, the collected gradient data is cleaned and standardized to ensure the quality of the data, eliminate possible noise and outliers, and make the data more suitable for training neural network models. Again, build a neural network model: design a neural network model with gradient feature data as input and client classification as output. This model can be a simple multi-layer perceptron (MLP) or a more complex structure such as a convolutional neural network (CNN) or a recurrent neural network (RNN), depending on the nature and complexity of the gradient data. Input layer: The input layer of the model is able to receive the processed gradient feature data. Hidden layer: One or more hidden layers can be added as needed to extract nonlinear relationships and complex patterns between features. Output layer: The design of the output layer should match the client classification task. For example, if the task is a binary classification problem, a sigmoid activation function can be used; if it is a multi-classification problem, a softmax activation function can be used. Finally, train the neural network model. Loss function: Choose a suitable loss function, such as cross entropy loss, to measure the difference between the model prediction and the actual label. Optimizer: Choose an optimizer, such as Adam or SGD, to update the model weights to minimize the loss function. Training process: Use the constructed dataset to train the neural network model and adjust the model parameters through forward propagation and backpropagation algorithms. After training, use the validation set or test set to evaluate the performance of the model to ensure that the model has good generalization ability. Feature prediction: Use the trained model to predict the gradient features of new clients to determine their optimization target features. Based on the prediction results of the model, clients can be classified, and the update strategy of the global model can be adjusted accordingly or personalized model training can be performed. Overall, the gradient optimization direction classification model provides a mechanism to predict the optimization target features of the client by analyzing its gradient features, thereby achieving more effective personalized federated learning. This approach can improve the efficiency and effectiveness of the federated learning system while protecting the data privacy of the client.It should be noted that the above steps are only a possible solution proposed in this embodiment. The specific training and construction methods can be set according to actual needs and are not limited in this embodiment.

[0063] S2. After each round of model training, each client uses homomorphic encryption to encrypt the model parameters and uploads the updated model to the server. It should be stated that homomorphic encryption technology belongs to the existing technology and will not be described in detail here. Please refer to the existing technology such as: CN119011114A A homomorphic encryption federated learning method based on polynomial decomposition problem, etc., which will not be described in detail here.

[0064] In this embodiment, S2, after each round of model training is completed, each client encrypts the model parameters using homomorphic encryption and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, it also includes:

[0065] The model parameters are encrypted by adding Laplace noise, and the formula is as follows;

[0066]

[0067] In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, is the noise extracted from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity. Before the model parameters are encrypted using homomorphic encryption, the model parameters are encrypted by adding Laplace noise. This method can protect the privacy of the client while allowing the server to perform effective model updates. By adding Laplace noise, the deviation of model parameters can be reduced and the robustness of the model can be improved while protecting privacy. It should be stated that this technology is a differential privacy technology. The specific implementation method can refer to the prior art, which will not be described in detail here. Please refer to the prior art such as: CN119047542A Federated learning method, system and device based on differential privacy and multi-feature processing, etc., which will not be described in detail here.

[0068] S3. After at least 60% of the total number of communication rounds, the gradient features updated in each round are input into the gradient optimization direction classification model, and the client optimization target features are output; the target features are encrypted together with the model parameters using homomorphic encryption, the updated model is uploaded to the server and decrypted to obtain the target features, and each client is classified based on the target features to obtain a number of client groups with the same features, and targeted training is performed for each client group based on the classification results to generate a corresponding personalized model; and the personalized models are distributed according to the client groups;

[0069] In this embodiment, the node "60%" is selected for the following considerations:

[0070] (1) Model convergence: In the federated learning framework, model convergence and accuracy are key indicators for evaluating model performance. As the number of communication rounds increases, the model gradually converges to a more accurate state during training, which is reflected in the steady improvement of accuracy. The choice of performing relevant operations when the number of communication rounds reaches 60% is a balance point based on experimental results. At this time, the model has undergone sufficient training rounds and exhibits good convergence, while retaining the necessary rounds for subsequent personalized model training and optimization.

[0071] (2) Communication efficiency and cost: Communication cost is a major constraint in federated learning. Reducing the number of rounds of model aggregation or compressing the communication content of each round of model aggregation can improve communication efficiency to a certain extent, but it may affect the accuracy and convergence speed of the model. Choosing to operate at 60% of the number of communication rounds aims to reduce subsequent communication overhead while ensuring model performance, thereby improving training efficiency.

[0072] (3) Data heterogeneity and non-independent identically distributed (Non-IID) problems: In federated learning, especially in the medical service system, the data of different clients may have significant differences in feature distribution and category distribution. Operating at 60% of the communication rounds can ensure that the system has collected enough data and gradient information to more accurately identify and adapt to the data characteristics of different clients, which helps to effectively deal with data heterogeneity and non-IID problems.

[0073] (4) Privacy protection and data security: The application of homomorphic encryption technology allows necessary calculations to be performed while protecting privacy. The operation is performed at 60% of the communication rounds, aiming to reduce the communication burden caused by frequent model updates and aggregation while protecting privacy, thereby improving the efficiency of data processing.

[0074] In summary, the choice of operating at 60% of the total communication rounds is based on multiple considerations such as model convergence, communication efficiency, data heterogeneity processing, and privacy protection. This time point is a more reasonable balance point obtained from the experiment, which aims to improve model performance and training efficiency while protecting privacy, and provides a comprehensive solution for federated learning.

[0075] S4. After each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server until the end.

[0076] In this embodiment, the gradient optimization direction classification model takes the updated gradient of the client local model as input and outputs the optimization target features corresponding to the preset classification. This method can help the server understand the gradient characteristics of each client and classify them accordingly. Classification helps the subsequent personalized model training, so that the server can adjust the global model according to the characteristics of the client. The server aggregates the global model and sends it to the client together with the pre-trained gradient optimization direction classification model. This step is a standard process in federated learning, in which the FedAvg algorithm is often used for parameter averaging. This method can protect the security of user data because only the update of the model parameters is uploaded, not the original data. After each round of model training, the client encrypts the model parameters using homomorphic encryption and uploads the updated model to the server. This method can protect the data privacy of the client because even if the data is intercepted during transmission, the attacker cannot decrypt the model parameters. After a certain number of communication rounds, the server inputs the gradient features updated in each round of the previous order into the gradient optimization direction classification model and outputs the client optimization target features. This step uses gradient features to classify clients, which helps further personalized model training. Homomorphic encryption is used to encrypt the target features and model parameters together, and then the target features are obtained by decrypting them after uploading them to the server. Based on the target features, each client is classified to obtain several client groups with the same features. Based on the classification results, targeted training is performed for each client group to generate the corresponding personalized model. This method can improve the personalization of the model while maintaining privacy protection. The server distributes personalized models according to client groups. After each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload them to the server. This step ensures the continuous update and optimization of the model while maintaining the privacy security of the data. Overall, this solution combines the gradient optimization direction classification model and homomorphic encryption technology to achieve personalized model training and updating for the client while protecting the client's privacy. This method takes into account both privacy protection and model performance optimization, and is a comprehensive solution.

[0077] In this embodiment, S4, after each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, the following steps are also included:

[0078] According to the segmentation of the total number of communication rounds, the average value of the model parameters of each segment position is calculated, and the model parameters of the current round are encrypted by adding Laplace noise. The formula is as follows;

[0079]

[0080] In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, A 40％ represents the global average of the first 40% rounds, is the noise extracted from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity; and M is the adjustment value.

[0081] In the above technical solution, this setting method has the following advantages:

[0082] (1) Balancing global and personalized privacy protection: By combining A 40％ (global average of the first 40% of rounds) and A i (Personalized local data), this formula can provide personalized privacy protection for each client while protecting global data. This method allows to preserve some statistical characteristics of the overall data while protecting the privacy of individual data, thus achieving a balance between global and personalized privacy protection.

[0083] (2) Dynamic privacy budget allocation: Parameter M allows the privacy budget to be dynamically adjusted between the global average and personalized data, making privacy protection more flexible. By adjusting the value of M, the most suitable balance between privacy protection and data utilization can be found in different application scenarios.

[0084] (3) Strong adaptability: This formula introduces Laplace noise The level of privacy protection can be precisely controlled. The smaller the ε value, the higher the privacy protection and the greater the noise, thus better hiding the contribution of individual data to the overall result.

[0085] (4) Trade-off between privacy protection and model performance: In personalized federated learning, this formula allows a trade-off between privacy protection and model performance. By adjusting the parameters M and ε, the accuracy and utility of the model can be improved as much as possible while maintaining privacy.

[0086] In summary, this formula provides an effective privacy protection mechanism in personalized federated learning, which can improve the accuracy and communication efficiency of the model while protecting individual privacy, and adapt to different data distributions and attack scenarios.

[0087] In this example, the global average of the first 40% rounds is selected for the following reasons:

[0088] In this example, the parameter M plays a decisive role, which adjusts the current round model parameter A i With the global average A 40％The relative weight in the final update value. Specifically, when the value of M is large, the contribution of the model parameters of the current round to the final update value is more significant; on the contrary, when M is small, the influence of the global average is more prominent. By fine-tuning the value of M, a delicate balance can be achieved between the stability and adaptability of the model. A larger value of M can prompt the model to respond quickly to new data, but it may be accompanied by an increase in model volatility; while a smaller value of M enhances the stability of the model, but may slow down the model's adaptation to new data. This trade-off is crucial to improving the level of user privacy protection. Furthermore, calculating the average value of the model parameters for the first 40% of the rounds can be regarded as an initialization or smoothing mechanism for the model parameters. This average value provides a relatively stable starting point, which helps the model converge faster in subsequent training. The introduction of the parameter M enables the model to flexibly adjust its dependence on the global average in subsequent training. When the client model has converged well, the value of M can be appropriately reduced so that the model relies more on the data of the previous round for update, and reduces its dependence on the personalized learning parameters of the current client, thereby protecting the client's data privacy. By combining the global average of the first 40% of rounds, the impact of single-round data fluctuations on the global model can be reduced, thereby improving the stability and robustness of the model. In the framework of differential privacy, the privacy budget ε is a limited resource. By accumulating noise in the first 40% of rounds, the privacy budget can be allocated more effectively, making the privacy cost of each round more balanced. The 40% ratio and parameter M provide an effective mechanism in the personalized federated learning scheme to balance global and local information, protect privacy, reduce communication burden, and improve model stability and convergence speed. This approach not only takes into account privacy protection, but also takes into account the optimization of model performance, providing a comprehensive solution for personalized federated learning.

[0089] Embodiment 2

[0090] See also Figure 2 , a medical service system, the system comprising:

[0091] A pre-processing module is configured to train a gradient-optimized directional classification model based on medical data, the gradient-optimized directional classification model uses the updated gradient of the client local model as data input, and outputs the optimized target features corresponding to the preset classification; the server sends the aggregated global model based on medical data and the pre-trained gradient-optimized directional classification model based on medical data to the client;

[0092] The first phase training module is configured such that after each round of model training, each client encrypts the model parameters using homomorphic encryption and uploads the updated model to the server;

[0093] The second-stage training module is configured to, when at least 60% of the total number of communication rounds have passed, input the gradient features updated in each round of the previous sequence into the gradient optimization direction classification model, and output the client optimization target features; encrypt the target features together with the model parameters using homomorphic encryption, upload the updated model to the server and decrypt it to obtain the target features, and classify each client based on the target features to obtain a number of client groups with the same features, perform targeted training for each client group based on the classification results, and generate a corresponding personalized model; and distribute the personalized models according to the client groups;

[0094] In the third stage training module, after each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server until the end.

[0095] In this embodiment, in order to better use the above method, the present application proposes a medical service system. Pre-processing module: In the medical service system, training a gradient optimization direction classification model based on medical data can help the system predict its optimization target features based on the updated gradient of the client (i.e., each medical institution or patient). This is similar to the personalized treatment plan in medical services, where the gradient features can be regarded as the patient's physiological data and treatment response, and the optimization target features are the expected treatment effects or health improvements. First-stage training module: After each round of model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload them to the server. In the medical service system, this can ensure the privacy and security of patient data, while allowing medical institutions to share and learn best practices, similar to patient data sharing in telemedicine services. Second-stage training module: When the number of communication rounds reaches 60% of the total number of rounds, the system will input the gradient optimization direction classification model based on the gradient features updated in each round of the previous order, and output the client's optimization target features. Third-stage training module: After the personalized model training is completed, the client continues to encrypt the model parameters and upload them to the server using homomorphic encryption technology. This helps to achieve continuous optimization and personalization of medical services while protecting patient privacy, similar to adjusting treatment plans based on patient feedback in precision medicine. Overall, this solution achieves personalization and optimization of medical services while protecting patient privacy by combining the gradient optimization directional classification model and homomorphic encryption technology. This approach takes into account both privacy protection and the optimization of medical service performance, and is a comprehensive solution.

[0096] Embodiment 3

[0097] A data privacy protection device under a federated learning framework includes: at least one processor; and

[0098] a memory communicatively connected to the at least one processor; wherein,

[0099] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in one of the embodiments.

[0100] In the above technical solution, in order to better run and process the method described in one of the embodiments, the above method is stored in a memory, and a processor is used to execute the stored method. It should be noted that the principle and effect of each step have been described above and will not be described in detail here.

[0101] Embodiment 4

[0102] A computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the method described in one of the embodiments is implemented.

[0103] In the above technical solution, in order to better run and use the method described in one of the embodiments, the above method is stored in a computer-readable storage medium, and the above method is implemented using a processor. It should be noted that the principle and effect of each step have been described above and will not be described in detail here.

[0104] The above descriptions are only some embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any equivalent device or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data privacy protection method under a federated learning framework, characterized in that: The method comprises: Training a gradient optimization directional classification model, which takes the updated gradient of the client's local model as data input and outputs the optimization target features corresponding to the preset classification; the server sends the aggregated global model and the pre-trained gradient optimization directional classification model to the client; After each round of model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server; After at least 60% of the total number of communication rounds, the gradient features updated in each round are input into the gradient optimization direction classification model, and the client optimization target features are output; the target features are encrypted together with the model parameters using homomorphic encryption, the updated model is uploaded to the server and decrypted to obtain the target features, and each client is classified based on the target features to obtain several client groups with the same features, and targeted training is performed for each client group based on the classification results to generate a corresponding personalized model; and the personalized models are distributed according to the client groups; After each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server until the end; After each round of model training, each client uses homomorphic encryption to encrypt the model parameters and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, the following steps are also required: The model parameters are encrypted by adding Laplace noise, and the formula is as follows; In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, is the noise drawn from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity; After each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, the following steps are also included: According to the segmentation of the total number of communication rounds, the average value of the model parameters of each segment position is calculated, and the model parameters of the current round are encrypted by adding Laplace noise. The formula is as follows; In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, A 40％ represents the global average of the first 40% rounds, is the noise extracted from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity; and M is the adjustment value.

2. A medical service system, characterized in that: Based on the method described in any one of claims 1 to 4, the system comprises: A pre-processing module is configured to train a gradient-optimized directional classification model based on medical data, the gradient-optimized directional classification model uses the updated gradient of the client local model as data input, and outputs the optimized target features corresponding to the preset classification; the server sends the aggregated global model based on medical data and the pre-trained gradient-optimized directional classification model based on medical data to the client; The first phase training module is configured such that after each round of model training, each client encrypts the model parameters using homomorphic encryption and uploads the updated model to the server; The second-stage training module is configured to, when at least 60% of the total number of communication rounds have passed, input the gradient features updated in each round of the previous sequence into the gradient optimization direction classification model, and output the client optimization target features; encrypt the target features together with the model parameters using homomorphic encryption, upload the updated model to the server and decrypt it to obtain the target features, and classify each client based on the target features to obtain a number of client groups with the same features, perform targeted training for each client group based on the classification results, and generate a corresponding personalized model; and distribute the personalized models according to the client groups; In the third phase, after each round of personalized model training, each client uses homomorphic encryption to encrypt the model parameters and upload the updated model to the server until the end. After each round of model training, each client uses homomorphic encryption to encrypt the model parameters and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, the following steps are also required: The model parameters are encrypted by adding Laplace noise, and the formula is as follows; In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, is the noise drawn from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity; After each round of personalized model training is completed, each client uses homomorphic encryption to encrypt the model parameters and uploads the updated model to the server. Before encrypting the model parameters using homomorphic encryption, the following steps are also included: According to the segmentation of the total number of communication rounds, the average value of the model parameters of each segment position is calculated, and the model parameters of the current round are encrypted by adding Laplace noise. The formula is as follows; In the formula, represents the model parameters after adding noise, A i represents the model parameters before adding noise, A 40％ represents the global average of the first 40% rounds, is the noise extracted from the Laplace distribution, ε represents the privacy budget of the current round of federated learning; s represents the sensitivity; and M is the adjustment value.

3. A data privacy protection device under a federated learning framework, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, wherein the instructions are executed by the at least one processor to enable the at least one processor to perform the method as claimed in claim 1 .

4. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method described in claim 1 is implemented.

Images