Zero-set differential privacy adaptive federated learning system for Non-IID data

Abstract

The invention provides a zero-set differential privacy self-adaptive federated learning system oriented to Non-IID data. The system comprises a central server and a plurality of clients, the central server maintains a global contribution value list in the federation training process and sends contribution values back to the corresponding clients; according to the contribution values, clients meeting conditions are screened out through a client filtering mechanism and are used for carrying out gradient weighting and generating global model updating; in local model training, each client uses a self-adaptive sliding window mechanism to divide a data set sampling and training range, selects an optimal learning rate through a self-adaptive learning rate selection algorithm, selects a gradient cutting threshold value of each round by using a self-adaptive gradient cutting threshold value mechanism, and performs local model training. And the privacy budget allocated to each round of gradient updating is adaptively adjusted through an adaptive differential privacy federated learning algorithm according to the received contribution value. According to the method, the problem of how to consider both data privacy protection and model precision optimization in a non-independent identically distributed (Non-IID) data environment is effectively solved.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning, and in particular to a zero-centralized differential privacy adaptive federated learning system for Non-IID data. Background Art

[0002] With the rapid development of big data and artificial intelligence technologies, more and more industries rely on data-driven decision-making. However, in this process, data privacy issues have become increasingly prominent. Traditional centralized machine learning methods require uploading data to a central server for training. This model has extremely high privacy risks, especially in highly sensitive fields such as medicine and finance. In order to solve this problem, Federated Learning (FL) came into being. Federated learning allows data to remain locally on distributed clients, and completes training on a central server by aggregating local model updates from each client, thereby achieving joint modeling without sharing the original data.

[0003] Federated learning trains a joint model through multiple clients with different data sets. However, due to the different sources of client data samples, geographical differences, and different collection time windows, these data are usually non-independent and identically distributed (Non-IID). The Non-IID feature not only leads to inconsistent data features or label distribution, but also may cause significant correlation between features. In such a situation, the convergence speed and performance of the model may be significantly affected.

[0004] Although federated learning reduces the direct risk of privacy leakage, it still faces many challenges in practical applications, especially in the Non-IID data scenario. The Non-IID feature can significantly affect the convergence and accuracy of the model, reducing the effectiveness of federated learning. At the same time, the model updates transmitted during the federated learning process may still leak sensitive information about the original data. For this reason, Differential Privacy (DP) has been widely introduced into federated learning as an effective privacy protection technology. However, traditional differential privacy methods perform poorly when processing Non-IID data. Although adding noise can enhance privacy protection, it may also have a significant impact on model accuracy.

[0005] Current research shows that Non-IID data leads to significant differences in client data distribution, and fixed-size privacy noise cannot adapt to this differentiation, which can easily lead to some clients introducing too much noise, thus affecting the accuracy of the global model. In addition, as the training approaches the optimal solution, the gradient value gradually decreases, and more accurate gradient estimation is needed at this time. Excessive noise will significantly reduce model performance. At the same time, the fixed noise allocation mechanism cannot dynamically adjust the differences in the contributions of each client to the global model, thereby limiting the efficiency of model updates.

[0006] Although the addition of differential privacy has alleviated the convergence problem caused by Non-IID to a certain extent, the introduction of noise inevitably affects the accuracy of the model. Taking DPSGD (differential privacy stochastic gradient descent) as an example, although it is widely used in the field of combining deep learning with differential privacy, its adaptability to Non-IID data scenarios is still insufficient. In a Non-IID environment, uniformly adding noise may threaten local data privacy, especially in the process of client transmitting parameters. The fixed noise allocation method relies too much on the preset number of iterations (T): if T is too small, the model stops before reaching the optimal solution; if T is too large, the privacy budget allocated each time is too small, resulting in too much noise covering up useful gradient information. In addition, in the early stages of training, the gradient value is usually large, and the model may still update better parameters despite inaccurate measurements; but when approaching the optimal solution, the gradient decreases, and more accurate gradient measurements are required to optimize model performance.

[0007] On the other hand, in local training of federated learning, the gradient amplitude often has heterogeneity between clients and between training rounds. Setting too low a gradient clipping threshold may lead to loss of gradient information, while too high a threshold may introduce severe noise interference, both of which will significantly damage the utility of the model. In addition, in the early stages of training when the model is far from optimal, it is necessary to allow for greater noise to be added, while as the model gradually converges, smaller noise is required to improve accuracy.

[0008] To solve these problems, we propose a new adaptive gradient clipping and noise reduction method. This method can dynamically adjust the gradient clipping threshold and the privacy budget of each round of gradient update according to the progress of training, and introduces an adaptive sliding window and learning rate mechanism to further improve the training efficiency and model performance of federated learning. Summary of the invention

[0009] The purpose of the present invention is to propose a zero-centralized differential privacy adaptive federated learning system for Non-IID data, which effectively solves the problem of how to balance data privacy protection and model accuracy optimization in a non-independent and identically distributed (Non-IID) data environment.

[0010] To achieve the above object, the technical solution of the present invention is: a zero-centralized differential privacy adaptive federated learning system for Non-IID data, the system comprising a central server and multiple clients;

[0011] The central server is responsible for system initialization and receiving and aggregating gradient updates from each client. The central server maintains a global contribution value list during the federated training process to evaluate the contribution of the local model trained by each client to the global model, and sends the contribution value back to the corresponding client in each round of federated training. The central server selects qualified clients through the client filtering mechanism according to the contribution value of each client for gradient weighting and generates global model updates.

[0012] Each of the clients holds a local, unshared private dataset. During the local model training process, an adaptive sliding window mechanism is used to divide the scope of dataset sampling and training. The optimal learning rate is selected through an adaptive learning rate selection algorithm. The adaptive gradient clipping threshold mechanism is used to select the gradient clipping threshold for each round. The privacy budget allocated to each round of gradient update is adaptively adjusted based on the received contribution value through an adaptive differential privacy federated learning algorithm.

[0013] Preferably, the central server maintains a global contribution value list during the federated training process as follows: in the first round of training, the initialization module requires all clients to participate in generating initial contribution values; in subsequent federated learning rounds, the server recalculates the client's contribution value and updates the contribution value list after the client filtering and gradient aggregation process is completed.

[0014] Preferably, the contribution value of each client The calculation is as follows:

[0015]

[0016] in, is the model update of client i in round t, that is, the model difference transmitted by the client to the server after local training; w t is the global model of the server in round t; F(·) is the global objective function, is to find the dot product of the gradient vector, It is to find the modulus of the gradient vector.

[0017] Preferably, the central server selects the clients that meet the conditions through the client filtering mechanism according to the contribution value of each client, as follows:

[0018] In each round of federated training, the central server receives the gradient updates from the client and calculates the ranking value of the corresponding client:

[0019]

[0020] Among them, Rank i represents the ranking value of client i; o iIndicates the return order of the gradient update submitted by client i to the server; Con i represents the contribution value of client i; c is the scaling factor;

[0021] The server calculates K n After receiving the ranking values ​​of the clients, the ranking values ​​are sorted from high to low, and the last value in the sorting table is compared with the threshold; if it is smaller than the threshold, the server continues to receive gradient updates from other clients, calculates the corresponding ranking value, inserts the appropriate index and deletes the last value in the sorting table until the last value in the sorting table is greater than or equal to the threshold. At this time, K in the sorting table n The client corresponding to the ranking value is the filtered client that meets the conditions.

[0022] Preferably, the adaptive sliding window mechanism is used to divide the range of data set sampling and training, as follows:

[0023] All data samples stored in the client are regarded as an interval. In each round of data training on the client, the sampling range is defined by sliding the window. First, the initial window size is set to |n i |, will |n i |Sampling the samples in the window as the first round of sampling window size, set the window size |n i The timeliness of | is temp. After each temp round of sampling, the window will slide on the interval. As the number of new samples collected increases, the window will give priority to new samples. At the same time, the window size will expand according to the number of new samples collected. The degree of window expansion is determined by the proportional coefficient w'.

[0024] Preferably, temp is set to T / 10 to ensure that each round of samples has sufficient training time, where T represents the number of global aggregation rounds of federated learning.

[0025] Preferably, the method of selecting the optimal learning rate by the adaptive learning rate selection algorithm is as follows:

[0026] There is a problem during the client model training process. In the case of , the updated learning rate η is calculated by the following formula new :

[0027]

[0028] Among them, η old is the learning rate set previously, F i (·) is the objective function of client i, is the model parameter in the tth iteration of client i; repeat this step and continuously reduce the learning rate until Will satisfy ηnew As the initial selected learning rate η t , randomly generated subject to η t A set of random numbers Φ with normal distribution and standard deviation of 0.5 t ; Then the number set Φ t The values ​​in are respectively used to calculate the loss function value. The learning rate corresponding to the minimum loss function value is the optimal learning rate η for the tth iteration. t , the optimal learning rate η t The selection expression is as follows:

[0029]

[0030] Where s represents the random number set Φ t The number of values ​​in , k' is the index of s, and η represents the number set Φ t The value in represents the gradient value of client i in the tth round of local model iteration, F i (·) is the objective function of client i.

[0031] Preferably, the adaptive gradient clipping threshold mechanism is used to select the gradient clipping threshold for each round as follows:

[0032] For the i-th client, the L2 norm of the gradient mean after noise perturbation in the previous round multiplied by the constant α is used as the clipping threshold of the current round, where α is a fixed clipping coefficient; the clipping threshold of the i-th client in the t-th round is The calculation is as follows:

[0033]

[0034]

[0035] in is the training sample of client i in round t, is the number of training samples of client i in the tth round, is the kth training sample x in client i k The gradient calculated in the previous round, is the privacy budget allocated to client i in the last round of gradient update.

[0036] Preferably, the adaptively adjusting the privacy budget allocated to each round of gradient update by the adaptive differential privacy federated learning algorithm according to the received contribution value is specifically:

[0037] Client i sets an initial allocated privacy budget according to the received contribution value in the tth iteration And the privacy budget growth rate γ, the higher the contribution value, the larger the privacy budget is set;

[0038] If the initial allocated privacy budget is too small, resulting in the calculated Then more privacy budget is allocated to the current gradient update of client i. The newly allocated privacy budget is obtained by the following formula:

[0039]

[0040] The improved zCDP-based gradient averaging algorithm is used to calculate the gradient of the superimposed new perturbation, and the accuracy of the perturbed gradient is gradually improved without discarding the original perturbation gradient until the perturbed gradient does not affect the convergence of the model, that is,

[0041]

[0042] Preferably, the improved zCDP-based gradient averaging algorithm is used to calculate the gradient of the superimposed new disturbance, and the accuracy of the perturbed gradient is gradually improved without discarding the original perturbed gradient, until the perturbed gradient does not affect the convergence of the model. Specifically,

[0043] Used at the tth local model iteration on client i As the privacy budget of zCDP, the gradient Perform noise perturbation, the gradient after perturbation is S t :

[0044]

[0045] in, is the L2 sensitivity of the objective function gradient of client i. If S t The estimate of is not precise enough, that is Allocate more privacy budget Used for gradient perturbation and to calculate the gradient of the budget added relative to the last allocated budget The disturbance S' t :

[0046]

[0047] The privacy budget allocated using the new privacy budget is calculated by taking the weighted average of the perturbation gradients calculated twice before using the following formula: Perturbation The gradient after

[0048]

[0049] The calculated As the new round of perturbation gradient S t, repeat the above steps and continue to add privacy budget until the perturbed gradient does not affect the convergence of the model, that is,

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] (1) Stronger privacy protection: This paper uses zCDP (zero centralized differential privacy) technology, which has tighter privacy guarantees and more flexible privacy budget management capabilities. Compared with traditional differential privacy methods, it can better control privacy loss, especially in multiple rounds of training.

[0052] (2) Adaptive noise mechanism: By adaptively adjusting the contribution value of the client, the noise addition scale of each client is dynamically changed. This adaptive noise mechanism helps to reduce the impact of noise on model accuracy, thereby improving the accuracy and convergence speed of the model in the Non-IID data environment.

[0053] (3) Privacy budget optimization: We propose an adaptive privacy budget allocation mechanism that flexibly allocates the privacy budget as the gradient is updated during training. This avoids the excessive noise problem caused by the use of a fixed privacy budget in traditional federated learning and ensures appropriate privacy protection and model accuracy in different rounds.

[0054] (4) Gradient clipping optimization: An adaptive gradient clipping threshold is used to adjust the clipping threshold of the current round according to the gradient perturbation of the previous round. This helps to avoid model performance degradation caused by excessive or insufficient clipping.

[0055] (5) Sliding window and learning rate mechanism: In order to further improve the performance of the model, an adaptive sliding window and learning rate optimization strategy is proposed. The adaptive sliding window mechanism improves the probability of learning new features and reduces redundant calculations. The adjustment of the adaptive learning rate ensures that the model can more accurately approach the optimal solution in the later stages of training.

[0056] (6) Client screening mechanism: The client screening mechanism based on contribution value helps to filter out clients with low contribution to the global model in federated learning, accelerates the convergence process of the model, and reduces unnecessary communication overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a schematic diagram of the AdaZcdpFed system framework of the present invention;

[0058] Figure 2 Schematic diagram of adaptive data sampling of the client of the present invention. DETAILED DESCRIPTION

[0059] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0060] Aiming at the privacy protection and data heterogeneity problems in federated learning, this paper proposes a federated learning framework with higher privacy, robustness and convergence. Inspired by the theories of differential privacy (DP) and zero centralized differential privacy (zCDP), this paper combines the strategies of adaptive noise injection, adaptive gradient clipping and dynamic privacy budget allocation, thereby improving the learning performance and efficiency of the model while protecting privacy.

[0061] The core technical design of the present invention revolves around the following key features: (1) Through the adaptive zero-centralized differential privacy mechanism, the privacy of uploaded gradients is guaranteed during the federated learning process, while reducing the impact of noise on model performance; (2) By utilizing the statistical characteristics of non-independent and identically distributed (Non-IID) data distribution, a weight-layered client-side gradient screening algorithm is designed to enhance the convergence of the system; (3) Through the dynamic allocation of the privacy budget, the balance between privacy protection and model training quality is ensured in multiple rounds of iterations.

[0062] To achieve the above objectives, the present invention specifically designs the following technical solutions: First, the present invention utilizes gradient clipping and noise injection mechanism combined with zero-centered differential privacy to construct an adaptive noise addition strategy, which dynamically adjusts the noise size according to the model gradient change, so as to maximize the retention of gradient information while protecting privacy. Secondly, the present invention innovatively proposes an adaptive gradient screening algorithm based on the local model contribution value, which significantly improves the model convergence speed under Non-IID data distribution by screening the uploaded gradients of participating nodes. Finally, the present invention designs a privacy budget dynamic allocation algorithm, which flexibly adjusts the privacy budget consumption according to the importance of the task and the model training stage, thereby improving the overall training efficiency and performance.

[0063] Compared with the existing technology, the present invention not only solves the problem of decreased convergence caused by data heterogeneity in the traditional federated learning framework, but also significantly improves the privacy protection capability of the system, providing an efficient and secure solution for application scenarios with high data sensitivity (such as medical and financial fields).

[0064] 1. System Model

[0065] The framework of the adaptive zero-centralized differential privacy federated learning system of the present invention is as follows: Figure 1 As shown, the system proposed by the present invention is composed of the following entities:

[0066] Central Server: The central server is a parameter aggregator responsible for system initialization and receiving and aggregating gradient updates from various clients. It weights the gradients of each client according to the privacy budget and contribution value uploaded by the client to generate a global model update. In this process, the central server screens the clients to ensure that contributing clients are given priority for model updates. The edge server is also responsible for dynamically adjusting the privacy budget of each client and automatically optimizing model training and convergence speed based on the training effect and contribution value.

[0067] Client: Each client holds a local, unshared private dataset that may contain sensitive information. The client performs local model training. Before training, the client receives the parameters of the privacy protection mechanism from the central server and performs privacy protection on the local gradient according to the adaptive zero centralized differential privacy (zCDP) algorithm. After local training, the client generates gradient updates and transmits them to the central server. During each local training, the client performs noise perturbation on the gradient according to the allocated privacy budget to ensure privacy protection.

[0068] 2. Adaptive Zero-Centralized Differential Privacy Federated Learning Algorithm (AdaZcdpFed)

[0069] The client selection of AdaZcdpFed changes over time based on the data distribution of each client. Since the model training of the client is highly correlated with the client's local dataset, which means that the local model usually has poor classification ability for unknown categories, it is necessary to screen out clients with good performance. AdaDpFed generates contribution values ​​by calculating the performance difference between the global model and the local optimal model of each client in each round, and then applies it to adaptive perturbations and client filtering. At the beginning of federated training, all clients perform initialization operations, initialize local models using the stochastic gradient descent algorithm and upload gradients. The server then builds a list of initial contribution values. These values ​​can effectively measure the client's contribution to training the global optimal model, and the server uses these values ​​to adjust the scale of noise addition. The server executes a client screening algorithm. The server gives priority to reliable and high-performance clients, and it filters out clients with too high a Non-IID degree because these clients will slow down the convergence of this round of training. The server screens out K nclients that meet the conditions, and stop receiving gradient updates. The server aggregates gradients to generate a new global model and updates the contribution value list. The higher the contribution value, the larger the privacy budget required. The client sets the privacy budget according to its own privacy needs, and adaptively adjusts the privacy budget allocated to each round of gradient updates during the training process to improve the accuracy of the client training model. The client needs to clip the gradient in each round of model training, set the gradient clipping threshold according to the L2 norm of the differential privacy mean gradient of the previous round, control the sensitivity of the gradient, and ensure that when a single sample is added or removed, its impact on gradient aggregation is within a controllable range. This solution takes into account that if the client uses random sampling at a constant ratio, it may not be able to fully learn the characteristics of new samples. In addition, repeated training of expired samples will waste computing resources and make it difficult to promote model optimization. Therefore, the present invention adopts an adaptive sliding window mechanism to reduce the sampling probability of old samples and increase the sampling probability of new samples. The entire federated learning training process will be combined with the above modules. T Finally, the global optimal model is output.

[0070] 3. Client contribution value

[0071] In order to ensure that the added noise is adaptive and reasonable, we first need to evaluate the contribution of the local model trained by each client to the global model. Considering that the local models trained by each client are quite different, the performance difference between the global model in each round and the local optimal model of each client is used as the contribution value of the client. The calculation is as follows:

[0072]

[0073] in, is the model update of client i in round t, that is, the model difference transmitted by the client to the server after local training; w t is the global model of the server in round t; F(·) is the global objective function, is to find the dot product of the gradient vector, The contribution value of each client can reflect the difference in data distribution between a single client and the federated learning system, that is, the contribution of the local optimal model of the client to the global optimal model.

[0074] The server needs to maintain a global contribution value list. In the first round of training, the initialization module requires all clients to participate in generating initial contribution values. In subsequent rounds of federated learning, since the sample pool of each client will change over time, the server will recalculate the client's contribution value and update the contribution value list after the client filtering and gradient aggregation processes are completed, and then send the updated contribution value back to the corresponding client to adaptively adjust the noise scale.

[0075] 4. Client filtering

[0076] The present invention proposes a client filtering mechanism to select more reliable and efficient clients to accelerate the iteration process. The mechanism uses the contribution value of the server to select clients that are more useful for global model updates, and the selection of thresholds can balance training efficiency and model performance. The server quickly sorts and filters the clients according to the contribution value of each client and the preset threshold. The server uses the client filtering mechanism, which will filter out clients with too high Non-IID degree because these clients will slow down the convergence speed of this round. The preset threshold in the client filtering mechanism is highly correlated with the contribution value. The client filtering mechanism is different from the random sampling K n clients or aggregate the fastest K n The server combines the received client updates with the corresponding client contribution value and update speed to generate a ranking value. The specific ranking value of each client can be calculated using the following formula:

[0077]

[0078] Among them, Rank i Represents the ranking value of client i, which is used to determine whether the client meets the screening conditions; o i Indicates the return order of the gradient update submitted by client i to the server; Con i represents the specific contribution value of client i; c is the scaling factor, which is used to adjust the sensitivity of the screening. After the server calculates the ranking values ​​of each client, it sorts the ranking values ​​from high to low and compares the last value of the sorting table with the threshold. If the value is smaller than the threshold, the server will continue to receive gradient updates from the client, calculate the corresponding ranking value, insert the appropriate index and delete the last value of the sorting table until the last value of the sorting table is greater than or equal to the threshold.

[0079] 5. Adaptive sliding window

[0080] The present invention proposes to use an adaptive sliding window mechanism to divide the range of sampling and training. The initial size is determined by a predefined training set. Each time the client receives a new model from the server, it will adaptively adjust the window size according to the number of new samples added. All samples stored by the client are regarded as an interval, and the sampling range is defined by a sliding window. First, the initial window size is set to |n i |, use it as the first round of sampling window size to sample the data, and set |n in each round i |The timeliness is temp. By adjusting the size of temp, you can control the time when the window starts sliding. Set temp to T / 10 to ensure that each round of samples has enough training time, where T represents the number of global aggregation rounds of federated learning. After each temp round of sampling, the window will slide on the interval. As the number of new samples collected increases, the window will give priority to new samples. At the same time, the window size will expand according to the number of new samples collected. The specific window expansion degree is determined by the proportional coefficient w'. The adaptive sliding window data sampling of the client is as follows Figure 2 shown.

[0081] 6. Adaptive Learning Rate

[0082] The present invention proposes an adaptive learning rate selection algorithm. As the number of iterations increases, the optimization of the model gradually approaches the optimal value. At this time, the gradient changes less and less, and the learning rate should also be gradually reduced to more finely adjust the model parameters. During the model training process of the client, as the number of training iterations increases, an excessively high learning rate may cause the gradient to be in an upward direction, and there is still The situation that the gradient cannot converge to the optimal value is directly related to the learning rate, so the present invention uses the method of adaptively selecting the learning rate to optimize the selection of the optimal value of the model gradient. The present invention optimizes the learning rate by utilizing the nonlinear characteristics of the tanh function, and adaptively adjusts the learning rate by combining the change value of the loss function to optimize the convergence process of the model training. The specific learning rate change is obtained by the following formula:

[0083]

[0084] Among them, η old is the learning rate set previously, F i (·) is the objective function of client i, is the model parameter in the tth iteration of client i; repeat this step and continuously reduce the learning rate until

[0085] At the same time, in order to make full use of the privacy budget of each round, the present invention designs the selection of learning rate in more detail. new As the learning rate ηt After that, randomly generate t A set of random numbers Φ with normal distribution and standard deviation of 0.5 t ; Then the number set Φ t The values ​​in are used to calculate the loss function value. The learning rate corresponding to the minimum loss function value is the optimal learning rate η for the tth iteration. t The optimal learning rate η t The selection process can be derived from the following formula:

[0086]

[0087] Where s represents the random number set Φ t The number of values ​​in , k' is the index of s, and η represents the number set Φ t The value in represents the gradient value of client i in the tth round of local model iteration, F i (·) is the objective function of client i.

[0088] 7. Adaptive gradient clipping threshold

[0089] The present invention proposes an adaptive gradient clipping threshold mechanism. For the i-th client, the L2 norm of the gradient mean after noise perturbation in the previous round multiplied by a constant α is used as the clipping threshold of the current round, where α is a fixed clipping coefficient. The clipping threshold of the i-th client in the t-th round The definition is as follows:

[0090]

[0091] in is the training sample of client i in round t, is the number of training samples of client i in the tth round, is the kth training sample x in client i k The gradient calculated in the previous round, is the privacy budget allocated to client i in the last round of gradient update. The present invention uses the above method to select the clipping threshold for each round, thereby achieving the purpose of adaptive threshold.

[0092] 8. Adaptive Privacy Budget Allocation Based on zCDP Gradient Averaging

[0093] The present invention improves the gradient averaging technology into zCDP gradient averaging suitable for zCDP, and applies the zCDP gradient averaging technology to adaptive privacy budget allocation, so that it can be used to improve the accuracy of perturbation gradients under the differential privacy framework.

[0094] At the beginning of the model iteration, a smaller privacy budget is allocated for perturbed gradients. If it is found that the perturbed gradient makes the model convergence worse, the privacy budget is continued to be allocated, and the gradient perturbed by the newly allocated privacy budget is calculated using zCDP gradient averaging. The privacy budget is repeatedly added until the perturbed gradient does not affect the convergence of the model, thereby reducing the impact of noise and improving the accuracy of the perturbed gradient while protecting the privacy of the gradient. By using zCDP gradient averaging to calculate the gradient after superimposing the new perturbation, the accuracy of the perturbed gradient can be gradually improved without discarding the original perturbed gradient, thereby improving the computational efficiency. The detailed process is as follows.

[0095] Assume that at the tth local model iteration on client i, As the privacy budget of zCDP, the gradient Perform noise perturbation, the gradient after perturbation is S t :

[0096]

[0097] in, is the L2 sensitivity of the objective function gradient of client i. If S t The estimate of is not precise enough, that is Allocate more privacy budget Used for gradient perturbation and to calculate the gradient of the budget added relative to the last allocated budget The disturbance S' t :

[0098]

[0099] The privacy budget allocated using the new privacy budget is calculated by taking the weighted average of the perturbation gradients calculated twice before using the following formula: Perturbation The gradient after

[0100]

[0101] The calculated As the new round of perturbation gradient S t , repeat the above steps and continue to add privacy budget until the perturbed gradient does not affect the convergence of the model, that is,

[0102] 9. Adaptive Differential Privacy

[0103] This paper proposes an adaptive differential privacy federated learning algorithm, which can automatically set the privacy budget required by the client according to the privacy requirements of the client. During the iterative process of training the local model, the client adaptively adjusts the privacy budget allocated to each round of gradient update. The algorithm improves the accuracy of the client training model by more reasonably allocating the privacy budget. First, the client sets the privacy budget according to its respective contribution value. The higher the contribution value, the larger the privacy budget that needs to be set. Then, during the model iteration process, the client adaptively adjusts the privacy budget allocated to each round of gradient update according to the privacy budget set by each client. The specific method of adaptively allocating the privacy budget is that the client sets an initial allocated privacy budget. As well as the privacy budget growth rate γ, as the iteration process increases, due to the initial allocation of privacy budget Small, so that too much noise disturbance is added to the gradient update, resulting in the calculated That is, the gradient is in the ascending direction. At this time, more privacy budget is allocated to the client's current gradient update. The newly allocated privacy budget can be obtained by the following formula:

[0104]

[0105] Since the current privacy budget is a function of the previous privacy budget Adding the newly allocated privacy budget In order to improve the computational efficiency, the present invention uses the improved zCDP-based gradient averaging algorithm to calculate the gradient of the superimposed new disturbance, and gradually improves the accuracy of the perturbed gradient without discarding the original perturbed gradient, until the perturbed gradient does not affect the convergence of the model, that is, The present invention utilizes the above-mentioned adaptive privacy budget allocation method to train the client local model until the client local model converges or the privacy budget set by the client is exhausted.

[0106] In summary, the present invention proposes a federated learning framework based on adaptive zero centralized differential privacy (zCDP), which aims to effectively solve the problem of how to balance data privacy protection and model accuracy optimization in a non-independent and identically distributed (Non-IID) data environment. First, this framework ensures the privacy protection of client data through dynamic privacy budget allocation and gradient clipping mechanism, while reducing the impact of privacy noise on model accuracy. The system proves that the framework can be trained on multiple distributed devices and is suitable for distributed learning scenarios with privacy protection requirements. Secondly, this framework provides an efficient gradient aggregation mechanism that can reduce communication overhead and improve the training effect of the global model. During the model training process, by adaptively adjusting the privacy budget, the system can flexibly adjust the noise according to the progress of training, optimize the accuracy and convergence speed of the model. Third, this framework supports dynamic selection of clients and weighted model update mechanism, which effectively avoids the negative impact of low-contribution clients on model training. Fourth, the system provides flexible privacy protection settings, so that the system can achieve higher model performance and training efficiency while maintaining strong privacy protection.

[0107] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. Zero-centralized differential privacy adaptive federated learning system for Non-IID data, characterized by: The system includes a central server and a plurality of clients; The central server is responsible for system initialization and receiving and aggregating gradient updates from each client. The central server maintains a global contribution value list during the federated training process to evaluate the contribution of the local model trained by each client to the global model, and sends the contribution value back to the corresponding client in each round of federated training. The central server selects the clients that meet the conditions through the client filtering mechanism according to the contribution value of each client for gradient weighting and generates a global model update; Each of the clients holds a local, unshared private dataset. In the process of executing local model training, an adaptive sliding window mechanism is used to divide the scope of dataset sampling and training, the optimal learning rate is selected through an adaptive learning rate selection algorithm, and the adaptive gradient clipping threshold mechanism is used to select the gradient clipping threshold for each round. The privacy budget allocated to each round of gradient update is adaptively adjusted according to the received contribution value through an adaptive differential privacy federated learning algorithm.

2. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 1, characterized in that: The central server maintains the global contribution value list during the federated training process as follows: in the first round of training, the initialization module requires all clients to participate in generating initial contribution values; in subsequent federated learning rounds, the server recalculates the client's contribution value and updates the contribution value list after the client filtering and gradient aggregation process is completed.

3. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 2, characterized in that: Contribution value of each client The calculation is as follows: in, is the model update of client i in round t, that is, the model difference transmitted by the client to the server after local training; w t is the global model of the server in round t; F(·) is the global objective function, is to find the dot product of the gradient vector, It is to find the modulus of the gradient vector.

4. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 3, characterized in that: The central server selects the clients that meet the conditions through the client filtering mechanism according to the contribution value of each client, as follows: In each round of federated training, the central server receives the gradient updates from the client and calculates the ranking value of the corresponding client: Among them, Rank i represents the ranking value of client i; o i Indicates the return order of the gradient update submitted by client i to the server; Con i represents the contribution value of client i; c is the scaling factor; The server calculates K n After receiving the ranking values ​​of the clients, the ranking values ​​are sorted from high to low, and the last value in the sorting table is compared with the threshold; if it is smaller than the threshold, the server continues to receive gradient updates from other clients, calculates the corresponding ranking value, inserts the appropriate index and deletes the last value in the sorting table until the last value in the sorting table is greater than or equal to the threshold. At this time, K in the sorting table n The client corresponding to the ranking value is the filtered client that meets the conditions.

5. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 1, characterized in that: The adaptive sliding window mechanism is used to divide the range of data set sampling and training, as follows: All data samples stored in the client are regarded as an interval. In each round of data training on the client, the sampling range is defined by sliding the window. First, the initial window size is set to |n i |, will |n i |Sampling the samples in the window as the first round of sampling window size, set the window size |n i The timeliness of | is temp. After each temp round of sampling, the window will slide on the interval. As the number of new samples collected increases, the window will give priority to new samples. At the same time, the window size will expand according to the number of new samples collected. The degree of window expansion is determined by the proportional coefficient w'.

6. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 5, characterized in that: Set temp to T / 10 to ensure that each round of samples has sufficient training time, where T represents the number of global aggregation rounds of federated learning.

7. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 1, characterized in that: The optimal learning rate selected by the adaptive learning rate selection algorithm is specifically: There is a problem during the client model training process. In the case of , the updated learning rate η is calculated by the following formula new : Among them, η old is the learning rate set previously, F i (·) is the objective function of client i, is the model parameter in the tth iteration of client i; repeat this step and continuously reduce the learning rate until Will satisfy η new As the initial selected learning rate η t , randomly generated subject to η t A set of random numbers Φ with normal distribution and standard deviation of 0.5 t ; Then the number set Φ t The values ​​in are respectively used to calculate the loss function value. The learning rate corresponding to the minimum loss function value is the optimal learning rate η for the tth iteration. t , the optimal learning rate η t The selection expression is as follows: Where s represents the random number set Φ t The number of values ​​in , k' is the index of s, and η represents the number set Φ t The value in represents the gradient value of client i in the tth round of local model iteration, F i (·) is the objective function of client i.

8. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 1, characterized in that: The adaptive gradient clipping threshold mechanism is used to select the gradient clipping threshold for each round as follows: For the i-th client, the L2 norm of the gradient mean after noise perturbation in the previous round multiplied by the constant α is used as the clipping threshold of the current round, where α is a fixed clipping coefficient; the clipping threshold of the i-th client in the t-th round is The calculation is as follows: in is the training sample of client i in round t, is the number of training samples of client i in the tth round, is the kth training sample x in client i k The gradient calculated in the previous round, is the privacy budget allocated to client i in the last round of gradient update.

9. The zero-centralized differential privacy adaptive federated learning method for Non-IID data according to claim 1, characterized in that: The privacy budget allocated to each round of gradient update is adaptively adjusted according to the received contribution value through the adaptive differential privacy federated learning algorithm as follows: Client i sets an initial allocated privacy budget according to the received contribution value in the tth iteration And the privacy budget growth rate γ, the higher the contribution value, the larger the privacy budget is set; If the initial allocated privacy budget is too small, resulting in the calculated Then more privacy budget is allocated to the current gradient update of client i. The newly allocated privacy budget is obtained by the following formula: The improved zCDP-based gradient averaging algorithm is used to calculate the gradient of the superimposed new perturbation, and the accuracy of the perturbed gradient is gradually improved without discarding the original perturbation gradient until the perturbed gradient does not affect the convergence of the model, that is, 10. The zero-centralized differential privacy adaptive federated learning system for Non-IID data according to claim 9, characterized in that: The improved zCDP-based gradient averaging algorithm is used to calculate the gradient of the superimposed new disturbance, and the accuracy of the perturbed gradient is gradually improved without discarding the original perturbed gradient, until the perturbed gradient does not affect the convergence of the model. Specifically: Used at the tth local model iteration on client i As the privacy budget of zCDP, the gradient Perform a noise perturbation, and the gradient after the perturbation is S t : in, is the L2 sensitivity of the objective function gradient of client i. If S t The estimate of is not precise enough, that is Allocate more privacy budget Used for gradient perturbation and to calculate the gradient of the budget added relative to the last allocated budget The disturbance S' t : The privacy budget allocated using the newly allocated privacy budget is calculated by taking the weighted average of the perturbation gradients calculated twice before using the following formula: Perturbation The gradient after The calculated As the new round of perturbation gradient S t , repeat the above steps and continue to add privacy budget until the perturbed gradient does not affect the convergence of the model, that is,

Images