Federal learning-based user data distribution privacy acquisition method

Abstract

The embodiment of the invention relates to the technical field of machine learning, in particular to a federated learning-based user data distribution privacy acquisition method, which comprises the following steps of: deploying an auxiliary data set at a central server and establishing a virtual client cluster to carry out federated learning; obtaining a time sequence matrix based on the accuracy combination of each round of training of the virtual client, and training a pre-constructed inference model by taking the time sequence matrix and data distribution corresponding to the virtual client as a training sample and a training label respectively, and the trained inference model is used to predict the data distribution of the local data of the attacked target client in each category. According to the method, the user data distribution privacy can be obtained while the normal process of federated learning is not influenced, and a new research thought and view are provided for safety protection and privacy protection in federated learning.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of machine learning technology, and in particular to a method for obtaining user data distribution privacy based on federated learning. Background Art

[0002] As a core resource of the digital economy and information society, data is considered to be another important production factor after land, labor, capital, and technology. The importance of data security has become increasingly prominent. Since 2021, my country has successively implemented a number of laws, regulations, and policies related to data security, and the protection of personal privacy data and industry confidential data has been increasingly improved. Traditional machine learning is no longer applicable under the premise of data privacy protection, and various organizations have turned to using federated learning to implement non-interactive machine learning training of data.

[0003] As a distributed machine learning framework, federated learning has great development potential in various distributed scenarios (such as finance, medical care, e-commerce, logistics, etc.). Federated learning does not require the client to upload a large amount of training data to the central server. It only needs to train the model locally and then send the gradient or updated model parameters to the server. After the server performs model aggregation, it will send the next round of models back to the client for training. This training method can not only combine the privacy data of each user for model training to ensure the effectiveness of the model, but also ensure that the user's privacy is not leaked.

[0004] However, there are some potential threats in federated learning. Due to the characteristics of the model training method, the gradient kernel model parameters also contain the user's privacy information. In this way, the server can use the gradient or model parameters uploaded by the user to perform reasoning attacks and attribute inference attacks, thereby obtaining the user's privacy information. At present, there is no detailed study on how the server obtains the privacy of user data distribution in federated learning, so privacy protection in federated learning has not yet been started. Summary of the invention

[0005] In order to solve the above technical problems, the embodiments of the present application propose a method for obtaining the privacy of user data distribution based on federated learning, which can obtain the privacy of user data distribution without affecting the normal process of federated learning, and provide new research ideas and perspectives for security protection and privacy protection in federated learning.

[0006] In order to achieve the above objectives, an embodiment of the present application proposes a method for obtaining user data distribution privacy based on federated learning, and the method comprises the following steps:

[0007] S101, each client trains the global model of federated learning based on its own local data to obtain several user models; wherein the global model and each user model are classification models;

[0008] S102, arbitrarily select a user model as a target user model, take the client corresponding to the target user model as the target client to be attacked, and obtain the target gradient and L2 norm of the target user model;

[0009] S103, collecting data corresponding to each category label to form an auxiliary data set;

[0010] S104, randomly sampling the auxiliary data to obtain a temporary auxiliary data set, and using the temporary auxiliary data set to train the global model to obtain the global gradient and L2 norm of the trained global model;

[0011] S105, setting global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjusting the size of the temporary auxiliary data set based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, thereby obtaining a final adjusted temporary auxiliary data set and its size;

[0012] S106, based on the size of the final adjusted temporary auxiliary data set, the auxiliary data set is randomly sampled into three different data distributions, and the three different data distributions are sampled M times respectively to obtain 3M sampled data sets corresponding to 3M virtual clients; wherein, if this round of training is the first round of training, 3M virtual clients are established;

[0013] S107, aggregating the gradients of each user model to form an updated global model, and sending the updated global model to each virtual client;

[0014] S108, after receiving the updated global model, each virtual client trains the updated global model based on the corresponding sampling data set and records the accuracy of this round of training;

[0015] S109, determining whether the updated global model satisfies the training termination condition. If not, executing S110; if satisfied, executing S111;

[0016] S110, sending the updated global model to each client, and each client trains the updated global model based on its own local data, obtains the latest target gradient and L2 norm of the target user model, and repeats S105 to S109;

[0017] S111, a timing matrix is ​​obtained based on the accuracy of each round of training of the virtual client, and the timing matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model;

[0018] S112, inputting the timing matrix corresponding to the target client into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

[0019] In order to achieve the above-mentioned purpose, an embodiment of the present application also proposes an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for obtaining user data distribution privacy based on federated learning as described in the first aspect above.

[0020] In order to achieve the above-mentioned purpose, an embodiment of the present application also proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a method for obtaining user data distribution privacy based on federated learning as described above.

[0021] The embodiment of the present application proposes a method for obtaining the distributed privacy of user data based on federated learning, which successfully simulates a distributed reasoning attack to explore the potential threats of such attacks and has at least the following beneficial effects.

[0022] First, this application can accurately predict the distribution information of the user's local training data. By analyzing the generalization performance of each category of the model and then using the inference model to capture the timing information in the training rounds, this application can accurately predict the distribution of the client's training data. This shows that the gradient information uploaded by users in federated learning will leak their own data distribution privacy to the central server, revealing the privacy loopholes in federated learning. The prediction method based on timing information can more accurately fit the distribution of training data, which indicates that timing information will leak more user privacy. This has important inspiration for the study of attack and defense mechanisms in federated learning, and provides new ideas and perspectives for the security and privacy research of federated learning.

[0023] Second, the attack method designed by this application can accurately infer the distribution of user data. This application explores the relationship between the user upload gradient and the size of the user's local data, and estimates the approximate size of the client training data based on this relationship. The virtual client training data generated based on this simulates the real client as much as possible. Based on the discovery that the number of training data in each category of the user has a great influence on the generalization performance of its corresponding category, this application uses an inference model to capture the timing information of the changes in generalization performance in the training rounds, accurately infers the distribution information of the user's local data, and combines the inferred training data size to estimate the amount of data in each category.

[0024] Optionally, collect data corresponding to each category label to form an auxiliary dataset, including:

[0025] The data corresponding to each category label of the classification task undertaken by the global model are crawled from the Internet and collected from the real world to form an auxiliary dataset.

[0026] Optionally, the target gradient is denoted by The L2 norm of the target gradient is calculated by the following formula:

[0027]

[0028] Among them, d represents the total dimension of the target gradient, Represents the value of the i-th dimension of the target gradient, Represents the L2 norm of the target gradient;

[0029] The global gradient is denoted as The L2 norm of the global gradient is calculated by the following formula:

[0030]

[0031] in, Represents the value of the i-th dimension of the global gradient, Represents the L2 norm of the global gradient.

[0032] Optionally, global upper and lower bounds are set based on the L2 norm of the target gradient, which is achieved by the following formula:

[0033]

[0034]

[0035] Among them, ∈ is the preset fluctuation constant, δ1 represents the global lower bound, and δ2 represents the global upper bound;

[0036] The size of the temporary auxiliary dataset is continuously adjusted based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, and the final adjusted temporary auxiliary dataset and its size are obtained, including:

[0037] judge Is it satisfied?

[0038] like Dissatisfied Then adjust the size of the temporary auxiliary dataset, use the adjusted temporary auxiliary dataset to train on the global model, obtain the latest global gradient and its L2 norm, and determine the latest global gradient L2 norm Is it satisfied? Among them, if Then expand the size of the temporary auxiliary data set, if Then reduce the size of the temporary auxiliary data set;

[0039] like satisfy Then the final adjusted temporary auxiliary data set and its size are obtained, and the size of the final adjusted temporary auxiliary data set is recorded as N.

[0040] Optionally, the three different data distributions are independent and identically distributed, non-independent and identically distributed based on imbalanced number of categories, and non-independent and identically distributed based on imbalanced category distribution;

[0041] In the independent and identical distribution, the proportion of data on each category label is in the interval [0.9N / C, 1.1N / C], N represents the size of the final adjusted temporary auxiliary data set, and C represents the total number of categories;

[0042] In a non-IID based on an imbalanced number of categories, data only exists on X category labels and does not exist on the remaining category labels;

[0043] In the non-independent and identically distributed (NIID) method based on imbalanced category distribution, the Dirichlet distribution partitioning method is used to divide the data, and the coefficient α is used to control the degree of non-independent and identically distributed (α={0.5,1.2}).

[0044] Optionally, the training termination conditions include a first condition and a second condition, the first condition being that the performance of the global model reaches a specified expected target, and the second condition being that the loss function of the global model converges. If both the first condition and the second condition are not met, S110 is executed; if either of the first condition and the second condition is met, S111 is executed.

[0045] Optionally, the pre-built inference model is an LSTM model based on a temporal attention mechanism, and the LSTM model based on a temporal attention mechanism consists of a bidirectional LSTM layer, an attention mechanism layer, a fully connected layer, and a normalization layer;

[0046] The bidirectional LSTM layer is used to learn the forward and backward dependencies of the input sequence;

[0047] The attention mechanism layer is used to calculate the attention weight of each hidden state, perform weighted average on each hidden state, obtain the context vector and input it into the fully connected layer;

[0048] The fully connected layer is used to make predictions based on the context vector, and after normalization by the normalization layer, the predicted distribution is output.

[0049] Optionally, the timing matrix corresponding to the kth virtual client is recorded as A k , whose dimensions are C represents the total number of categories, E represents the total number of training rounds, and the data distribution corresponding to the kth virtual client is Based on the accuracy of each round of training of the virtual client, a time series matrix is ​​obtained. The time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model, including:

[0050] Initialize the model parameters h0 and c0 of the inference model, and calculate the output of the hidden state and long-term memory unit in turn according to the current training round. The calculation formula is:

[0051]

[0052] Among them, h t represents the calculated hidden state, c t represents the computed output of the long-term memory unit, represents the generalized performance data of the recorded virtual client;

[0053] The importance of each hidden state is calculated by the attention mechanism layer t , e t =v T tanh(W h h t +b h ), where W h 、b h and v are both learnable parameters;

[0054] For t Normalize and get the attention weight ρ of the hidden state t ,

[0055] Take the weighted average of each hidden state to get the context vector f,

[0056] The fully connected layer is used to make predictions based on f, and after normalization by the normalization layer, the output prediction distribution l k ;

[0057] Based on l k and The loss value is calculated, the inference model is iteratively trained, and the model parameters of the inference model are updated until the inference model converges to obtain a trained inference model. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the related technologies, the drawings required for use in the embodiments of the present application or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 is a flowchart of a method for obtaining user data distribution privacy based on federated learning provided in one embodiment of the present application;

[0060] Figure 2 is a schematic diagram of the structure of an inference model provided in one embodiment of the present application;

[0061] Figure 3 It is a comparison chart of the training results of OURS and various traditional technologies in a simulation experiment based on a non-independent and identically distributed scenario with imbalanced category distribution, provided in one embodiment of the present application;

[0062] Figure 4 It is a structural schematic diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. In the various embodiments of the present application, many technical details are proposed in order to make the reader better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can also be implemented. The division of the following embodiments is only for the convenience of description, and the specific implementation mode of the present application should not constitute any limitation. The various embodiments can be combined with each other and referenced to each other under the premise of no contradiction.

[0064] An embodiment of the present application proposes a method for obtaining the privacy of user data distribution based on federated learning. The implementation details of the method for obtaining the privacy of user data distribution based on federated learning proposed in this embodiment are described in detail below. The following content is only the implementation details provided for the convenience of understanding and is not necessary for the implementation of this solution.

[0065] The specific process of the method for obtaining user data distribution privacy based on federated learning proposed in this embodiment can be as follows: Figure 1 As shown, including:

[0066] S101, each client trains the global model of federated learning based on its own local data to obtain several user models, wherein the global model and each user model are classification models.

[0067] In the specific implementation, federated learning requires a central server and several clients to participate. The central server holds the global model of federated learning, and each client needs to train its own user model. At the beginning of federated learning, each client trains the global model of federated learning based on its own local data to obtain several user models. It is worth noting that both the global model and each user model are classification models that perform classification tasks.

[0068] S102, arbitrarily select a user model as a target user model, take the client corresponding to the target user model as the target client to be attacked, and obtain the target gradient and L2 norm of the target user model.

[0069] In the specific implementation, the central server needs to arbitrarily select a user model from each user model as the target user model, which means that the client corresponding to the target user model will be the target client to be attacked. The central server needs to obtain the target gradient and its L2 norm of the target user model from the target client.

[0070] In an example, the target gradient of the target user model can be written as The L2 norm of the target gradient is calculated by the following formula:

[0071]

[0072] Among them, d represents the total dimension of the target gradient, Represents the value of the i-th dimension of the target gradient, Represents the L2 norm of the target gradient;

[0073] S103, collecting data corresponding to each category label to form an auxiliary data set.

[0074] In the specific implementation, after obtaining the target gradient and its L2 norm of the target user model, the central server needs to build an auxiliary dataset, which is achieved by collecting data corresponding to each category label.

[0075] In one example, the central server needs to crawl the Internet and collect data from the real world that corresponds to each category label of the classification task undertaken by the global model to form an auxiliary dataset.

[0076] S104, randomly sampling the auxiliary data to obtain a temporary auxiliary data set, and using the temporary auxiliary data set to train the global model to obtain the global gradient and L2 norm of the trained global model.

[0077] In the specific implementation, after the server obtains Gou Jian's knife auxiliary data set, it also needs to randomly sample the auxiliary data to obtain a temporary auxiliary data set (the scale of the temporary auxiliary data set is smaller than the auxiliary data set), and use the temporary auxiliary data set to train on the global model to obtain the global gradient and L2 norm of the trained global model.

[0078] In an example, the global gradient of the trained global model can be written as The L2 norm of the global gradient is calculated by the following formula:

[0079]

[0080] in, Represents the value of the i-th dimension of the global gradient, Represents the L2 norm of the global gradient.

[0081] S105, setting global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjusting the size of the temporary auxiliary dataset based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, thereby obtaining the final adjusted temporary auxiliary dataset and its size.

[0082] In the specific implementation, after the server obtains the global gradient and its L2 norm of the trained global model, it is necessary to set global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjust the size of the temporary auxiliary data set based on the L2 norm of the global gradient and the global upper and lower bounds (expand or reduce the amount of data in the temporary auxiliary data set) until the L2 norm of the global gradient is between the global upper and lower bounds, and obtain the final adjusted temporary auxiliary data set and its size.

[0083] In one example, the global upper and lower bounds are set based on the L2 norm of the target gradient, which is implemented by the following formula:

[0084]

[0085] Among them, ∈ is the preset fluctuation constant, δ1 represents the global lower bound, and δ2 represents the global upper bound. So far, the central server has obtained a constraint condition, namely the L2 norm of the global gradient Should satisfy

[0086] It is understandable that the central server needs to judge Is it satisfied?

[0087] like Dissatisfied Then adjust the size of the temporary auxiliary dataset, use the adjusted temporary auxiliary dataset to train on the global model, obtain the latest global gradient and its L2 norm, and determine the latest global gradient L2 norm Is it satisfied? Among them, if Then expand the size of the temporary auxiliary data set, if The size of the temporary auxiliary dataset is reduced.

[0088] like satisfy Then the final adjusted temporary auxiliary data set and its size are obtained, and the size of the final adjusted temporary auxiliary data set is recorded as N.

[0089] S106, based on the size of the final adjusted temporary auxiliary data set, the auxiliary data set is randomly sampled into three different data distributions, and the three different data distributions are sampled M times respectively to obtain 3M sampled data sets to correspond to 3M virtual clients, where if this round of training is the first round of training, 3M virtual clients are established.

[0090] In the specific implementation, after obtaining the final adjusted size N of the temporary auxiliary data set, the central server needs to randomly sample the auxiliary data set into three different data distributions based on N. The three different data distributions are sampled M times respectively to obtain 3M sampled data sets to correspond to 3M virtual clients. In the first round of federated learning, the central server will establish 3M virtual clients for subsequent training.

[0091] In one example, M is generally set to 1200, that is, three different data distributions are sampled 1200 times respectively, and 3600 sample data sets are obtained to correspond to 3600 virtual clients.

[0092] In one example, three different data distributions are independent and identically distributed, non-independent and identically distributed based on imbalanced number of categories, and non-independent and identically distributed based on imbalanced category distribution.

[0093] In the independent and identically distributed, the proportion of data on each category label is in the interval [0.9N / C, 1.1N / C], N represents the size of the final adjusted temporary auxiliary dataset, and C represents the total number of categories.

[0094] In a non-IID based on an imbalanced number of categories, the data only exists on X category labels and does not exist on the remaining category labels.

[0095] In the non-independent and identically distributed (NIID) method based on imbalanced category distribution, the Dirichlet distribution partitioning method is used to divide the data, and the coefficient α is used to control the degree of non-independent and identically distributed (α={0.5,1.2}).

[0096] S107, aggregating the gradients of each user model to form an updated global model, and sending the updated global model to each virtual client.

[0097] In the specific implementation, after obtaining the sampled data set for this round of federated learning training, the central server needs to aggregate the gradients of each user model to form an updated global model, and then send the updated global model to each virtual client for training.

[0098] S108, after receiving the updated global model, each virtual client trains the updated global model based on the corresponding sampling data set and records the accuracy of this round of training.

[0099] In the specific implementation, after receiving the updated global model, each virtual client will train the updated global model based on the corresponding federated learning sampling data set of this round of training, and record the accuracy of this round of training.

[0100] S109, determining whether the updated global model satisfies the training termination condition. If not, executing S110; if satisfied, executing S111.

[0101] In the specific implementation, after each virtual client completes this round of training, the central server needs to determine whether the updated global model meets the training termination conditions, that is, whether the federated learning meets the termination conditions. If the training termination conditions are not met, the next round of federated learning training will continue. If the training termination conditions are met, the federated learning will be exited.

[0102] In one example, the training termination conditions include a first condition and a second condition, the first condition being that the performance of the global model reaches a specified expected target, and the second condition being that the loss function of the global model converges. If both the first condition and the second condition are not met, S110 is executed; if either of the first condition and the second condition is met, S111 is executed.

[0103] S110, sending the updated global model to each client, and each client trains the updated global model based on its own local data, obtains the latest target gradient and L2 norm of the target user model, and repeats S105 to S109.

[0104] In the specific implementation, after the central server determines that the updated global model does not meet the training termination conditions, it needs to send the updated global model to each client, and each client trains the updated global model based on its own local data to obtain the latest target gradient and L2 norm of the target user model, and then repeats S105 to S109 to perform a new round of federated learning training.

[0105] S111, a timing matrix is ​​obtained based on the accuracy combination of each round of training of the virtual client, and the timing matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model.

[0106] In the specific implementation, after completing federated learning, the central server needs to obtain a timing matrix based on the accuracy combination of each round of training of the virtual client, and use the timing matrix and data distribution corresponding to each virtual client as training samples and training labels to train the pre-built inference model.

[0107] In one example, the pre-built inference model is an LSTM model based on the temporal attention mechanism, and its model structure can be as follows Figure 2 As shown in the figure, it is composed of a bidirectional LSTM layer, an attention mechanism layer, a fully connected layer, and a normalization layer. The bidirectional LSTM layer is used to learn the forward and backward dependencies of the input sequence. The attention mechanism layer is used to calculate the attention weights of each hidden state, perform weighted average on each hidden state, obtain the context vector and input it into the fully connected layer. The fully connected layer is used to make predictions based on the context vector, and after normalization by the normalization layer, the predicted distribution is output.

[0108] In an example, the timing matrix corresponding to the kth virtual client is A k , whose dimensions are C represents the total number of categories, E represents the total number of training rounds, and the data distribution corresponding to the kth virtual client is When the central server trains the pre-built inference model, it first needs to initialize the model parameters h0 and c0 of the inference model, and calculate the output of the hidden state and long-term memory unit in sequence according to the current training round. The calculation formula is:

[0109]

[0110] Among them, h trepresents the calculated hidden state, c t represents the computed output of the long-term memory unit, Represents generalized performance data for a recorded virtual client.

[0111] Next, the attention mechanism layer calculates the importance of each hidden state e t , e t =v T tanh(W h h t +b h ), where W h 、b h and v are learnable parameters.

[0112] After that, t Normalize and get the attention weight ρ of the hidden state t , T represents the total number of time steps.

[0113] Then, the hidden states are weighted averaged to obtain the context vector f.

[0114] Next, the fully connected layer is used to make predictions based on f, and after normalization by the normalization layer, the output prediction distribution l k .

[0115] After the first based on l k and Calculate the loss value (such as cross entropy loss, absolute average loss, etc.), iteratively train the inference model, and update the model parameters of the inference model until the inference model converges to obtain a trained inference model.

[0116] S112, inputting the timing matrix corresponding to the target client into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

[0117] In a specific implementation, after obtaining the trained inference model, the timing matrix corresponding to the target client can be input into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

[0118] The present embodiment proposes a method for obtaining the distributed privacy of user data based on federated learning, which successfully simulates a distributed reasoning attack to explore the potential threats of such attacks and has at least the following beneficial effects.

[0119] First, this embodiment can accurately predict the distribution information of the user's local training data. By analyzing the generalization performance of each category of the model and then using the inference model to capture the timing information in the training rounds, this embodiment can accurately predict the distribution of the client's training data. This shows that the gradient information uploaded by users in federated learning will leak their own data distribution privacy to the central server, revealing the privacy loopholes in federated learning. The prediction method based on timing information can more accurately fit the distribution of training data, which shows that timing information will leak more user privacy. This has important inspiration for the study of attack and defense mechanisms in federated learning, and provides new ideas and perspectives for the security and privacy research of federated learning.

[0120] Second, the attack method designed in this embodiment can accurately infer the distribution of user data. This embodiment explores the relationship between the user upload gradient and the size of the user's local data, and estimates the approximate size of the client training data based on this relationship. The virtual client training data generated based on this simulates the real client as much as possible. This embodiment is based on the discovery that the number of training data in each category of the user has a great influence on the generalization performance of its corresponding category, and then uses the inference model to capture the time series information of the change of generalization performance in the training rounds, accurately infers the distribution information of the user's local data, and combines the inferred training data size to estimate the amount of data in each category.

[0121] The step division of the above methods is only for clear description. When implemented, they can be combined into one step, or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0122] The following will further illustrate the effect of the method for obtaining user data distribution privacy based on federated learning proposed in this application in combination with simulation experiments.

[0123] 1. Simulation experiment conditions.

[0124] The hardware platform of the simulation experiment of this application is as follows: the processor is Intel(R) Xeon(R) Silver 4210CPU, the main frequency is 2.20GHz, the memory is 96GB, and the GPU is 4 NVIDIA GeForce RTX 3090.

[0125] The software platform for the simulation experiment of this application is: Ubuntu 18.04 operating system and python 3.9.

[0126] The data sets used in the simulation experiments of this application are the MNIST data set, the Fashion-MNIST data set, the CIFAR-10 data set, and the AG-News data set.

[0127] The MNIST dataset was collected by Yann et al. from the National Institute of Standards and Technology. The dataset contains a large number of handwritten digit images from 0 to 9, with 60,000 images in the training set and 10,000 images in the test set. Each image is a 28x28 pixel grayscale image with pixel values ​​between 0 and 255.

[0128] The Fashion-MNIST dataset was collected by the German fashion technology company Zalando. The dataset covers 70,000 front-facing images of different products from 10 categories, including T-shirts, pants, pullovers, dresses, coats, sandals, shirts, sneakers, bags, and boots. Each category contains 6,000 images, of which 60,000 are used for training and 10,000 for testing. The image format of Fashion-MNIST is 28x28 pixel grayscale images.

[0129] The Fer2013 (Facial Expression Recognition 2013) dataset was collected by researchers at Carnegie Mellon University. The dataset contains a large number of facial expression images, covering seven basic emotions, including anger, disgust, fear, happiness, sadness, surprise, and neutrality. The Fer2013 dataset has a total of 35,887 images, of which the training set contains 28,709 images, the validation set contains 3,589 images, and the test set contains 3,589 images. Each image is composed of a grayscale image with a fixed size of 48×48 pixels, with pixel values ​​ranging from 0 to 255, and all images are frontal photos of the face.

[0130] The AG-News dataset is collected by Cornell University in the United States. The dataset covers a total of 120,000 English news articles in four categories, including World, Sports, Business, and Sci / Tech. The dataset consists of about 300,000 news headlines and corresponding descriptions, with 3,000 training samples and 1,900 test samples for each category. These data come from more than 2,000 news sources in the AG News corpus.

[0131] 2. Analysis of simulation content and results.

[0132] The simulation experiment of this application uses this application (referred to as OURS) and two traditional methods (PPA preference reasoning attack method, LIA category reasoning attack method) to perform user local data distribution reasoning attacks on MNIST, Fashion-MNIST, Fer2013 and AG-News datasets respectively. The scenario simulated by the simulation experiment is that 20 users jointly train a federated learning global model, and the reasoning attack is performed on the data distribution of one of the 20 users.

[0133] The PPA preference inference attack method refers to the preference inference attack method proposed by Zhou et al., denoted as PPA.

[0134] The LIA category reasoning attack method refers to the category reasoning attack method proposed by Ramakrishna et al., denoted as LIA.

[0135] In order to verify the effect of OURS, we use the following four evaluation indicators (Wasserstein distance, KL divergence, JS divergence, and L1 distance) to evaluate the results of the user local data distribution inference attack of the three methods. The smaller the distance, the better the inference attack effect, otherwise the worse the inference attack effect. All comparison results can be found in Table 1, Table 2, and Figure 3 .

[0136] Table 1: Comparison of training results between OURS and traditional techniques in simulation experiments under independent and identically distributed scenarios

[0137]

[0138] Table 2: Comparison of the training results of OURS and traditional techniques in simulation experiments under non-IID scenarios with imbalanced number of categories

[0139]

[0140] As can be seen from Table 1 and Table 2, no matter under which data distribution, the distance index of OURS on each data set is smaller than that of the traditional methods, indicating that the prediction results of OURS are closer to the actual data distribution than the other two traditional methods. In the four distance indicators of MNIST, Fashion-MNIST, and Fer2013, OURS is one order of magnitude smaller than the traditional methods, which shows the excellent prediction performance of OURS.

[0141] Depend on Figure 3It can be seen that OURS is closer to the real label distribution of the target client than the two traditional methods. The prediction curve of OURS almost overlaps with the real distribution curve, while the traditional methods show fluctuations that are inconsistent with the real distribution in different categories, which shows the excellent prediction performance of OURS.

[0142] Another embodiment of the present application provides an electronic device, whose specific structure is as follows: Figure 4 As shown, it includes: at least one processor M201; and a memory M202 that is communicatively connected to the at least one processor M201; wherein the memory M202 stores instructions that can be executed by the at least one processor M201, and the instructions are executed by the at least one processor M201 so that the at least one processor M201 can execute a method for obtaining user data distribution privacy based on federated learning as described in the above-mentioned method embodiments.

[0143] The memory and the processor may be connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors and memories together. The bus may also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be further described herein. The bus interface is responsible for providing an interface between the bus and the transceiver. The transceiver may be one component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium.

[0144] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0145] Another embodiment of the present application proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a method for obtaining user data distribution privacy based on federated learning as described in the above method embodiments.

[0146] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (such as a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, ROM (Read-Only Memory), RAM (Random Access Memory), disk or optical disk and other media that can store program codes.

[0147] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for obtaining user data distribution privacy based on federated learning, characterized in that: include: S101, each client trains the global model of federated learning based on its own local data to obtain several user models; wherein the global model and each user model are classification models; S102, arbitrarily select a user model as a target user model, take the client corresponding to the target user model as the target client to be attacked, and obtain the target gradient and L2 norm of the target user model; S103, collecting data corresponding to each category label to form an auxiliary data set; S104, randomly sampling the auxiliary data to obtain a temporary auxiliary data set, and using the temporary auxiliary data set to train the global model to obtain the global gradient and L2 norm of the trained global model; S105, setting global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjusting the size of the temporary auxiliary data set based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, thereby obtaining a final adjusted temporary auxiliary data set and its size; S106, based on the size of the final adjusted temporary auxiliary data set, the auxiliary data set is randomly sampled into three different data distributions, and the three different data distributions are sampled M times respectively to obtain 3M sampled data sets corresponding to 3M virtual clients; wherein, if this round of training is the first round of training, 3M virtual clients are established; S107, aggregating the gradients of each user model to form an updated global model, and sending the updated global model to each virtual client; S108, after receiving the updated global model, each virtual client trains the updated global model based on the corresponding sampling data set and records the accuracy of this round of training; S109, determining whether the updated global model satisfies the training termination condition. If not, executing S110; if satisfied, executing S111; S110, sending the updated global model to each client, and each client trains the updated global model based on its own local data, obtains the latest target gradient and L2 norm of the target user model, and repeats S105 to S109; S111, a timing matrix is ​​obtained based on the accuracy of each round of training of the virtual client, and the timing matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model; S112, inputting the timing matrix corresponding to the target client into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

2. According to claim 1, a method for obtaining user data distribution privacy based on federated learning is characterized in that: Collect the data corresponding to each category label to form an auxiliary data set, including: The data corresponding to each category label of the classification task undertaken by the global model are crawled from the Internet and collected from the real world to form an auxiliary dataset.

3. According to claim 1, a method for obtaining user data distribution privacy based on federated learning is characterized in that: The target gradient is recorded as The L2 norm of the target gradient is calculated by the following formula: Among them, d represents the total dimension of the target gradient, Represents the value of the i-th dimension of the target gradient, Represents the L2 norm of the target gradient; The global gradient is denoted as The L2 norm of the global gradient is calculated by the following formula: in, Represents the value of the i-th dimension of the global gradient, Represents the L2 norm of the global gradient.

4. According to claim 3, a method for obtaining user data distribution privacy based on federated learning is characterized in that: The global upper and lower bounds are set based on the L2 norm of the target gradient, which is achieved through the following formula: Among them, ∈ is the preset fluctuation constant, δ1 represents the global lower bound, and δ2 represents the global upper bound; The size of the temporary auxiliary dataset is continuously adjusted based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, and the final adjusted temporary auxiliary dataset and its size are obtained, including: judge Is it satisfied? like Dissatisfied Then adjust the size of the temporary auxiliary dataset, use the adjusted temporary auxiliary dataset to train on the global model, obtain the latest global gradient and its L2 norm, and determine the latest global gradient L2 norm Is it satisfied? Among them, if Then expand the size of the temporary auxiliary data set, if Then reduce the size of the temporary auxiliary data set; like satisfy Then the final adjusted temporary auxiliary data set and its size are obtained, and the size of the final adjusted temporary auxiliary data set is recorded as N.

5. According to claim 1, a method for obtaining user data distribution privacy based on federated learning is characterized in that: The three different data distributions are independent and identically distributed, non-independent and identically distributed based on imbalanced number of categories, and non-independent and identically distributed based on imbalanced category distribution; In the independent and identical distribution, the proportion of data on each category label is in the interval [0.9N / C, 1.1N / C], N represents the size of the final adjusted temporary auxiliary data set, and C represents the total number of categories; In a non-IID based on an imbalanced number of categories, data only exists on X category labels and does not exist on the remaining category labels; In the non-independent and identically distributed (NIID) method based on imbalanced category distribution, the Dirichlet distribution partitioning method is used to divide the data, and the coefficient α is used to control the degree of non-independent and identically distributed (α={0.5,1.2}).

6. According to claim 1, a method for obtaining user data distribution privacy based on federated learning is characterized in that: The training termination conditions include a first condition and a second condition. The first condition is that the performance of the global model reaches the specified expected goal, and the second condition is that the loss function of the global model converges. If both the first condition and the second condition are not met, S110 is executed. If any one of the first condition and the second condition is met, S111 is executed.

7. A method for obtaining user data distribution privacy based on federated learning according to any one of claims 1 to 6, characterized in that: The pre-built inference model is an LSTM model based on the temporal attention mechanism. The LSTM model based on the temporal attention mechanism consists of a bidirectional LSTM layer, an attention mechanism layer, a fully connected layer, and a normalization layer. The bidirectional LSTM layer is used to learn the forward and backward dependencies of the input sequence; The attention mechanism layer is used to calculate the attention weight of each hidden state, perform weighted average on each hidden state, obtain the context vector and input it into the fully connected layer; The fully connected layer is used to make predictions based on the context vector, and after normalization by the normalization layer, the predicted distribution is output.

8. The method for obtaining user data distribution privacy based on federated learning according to claim 7, characterized in that: The timing matrix corresponding to the kth virtual client is A k , whose dimensions are C represents the total number of categories, E represents the total number of training rounds, and the data distribution corresponding to the kth virtual client is Based on the accuracy of each round of training of the virtual client, a time series matrix is ​​obtained. The time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model, including: Initialize the model parameters h0 and c0 of the inference model, and calculate the output of the hidden state and long-term memory unit in turn according to the current training round. The calculation formula is: Among them, h t represents the calculated hidden state, c t represents the computed output of the long-term memory unit, represents the generalized performance data of the recorded virtual client; The importance of each hidden state is calculated by the attention mechanism layer t , e t =v T tanh(W h h t +b h ), where W h 、b h and v are both learnable parameters; For t Normalize and get the attention weight ρ of the hidden state t , Take the weighted average of each hidden state to get the context vector f, The fully connected layer is used to make predictions based on f, and after normalization by the normalization layer, the output prediction distribution l k ; Based on l k and The loss value is calculated, the inference model is iteratively trained, and the model parameters of the inference model are updated until the inference model converges to obtain a trained inference model.

9. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; In which, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for obtaining user data distribution privacy based on federated learning as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it can implement a method for obtaining user data distribution privacy based on federated learning as described in any one of claims 1 to 8.

Images