A method for obtaining user data distribution privacy based on federated learning

Abstract

The embodiments of the present application relate to the field of machine learning technology, and more particularly to a method for obtaining user data distribution privacy based on federated learning. Federated learning is performed by deploying an auxiliary data set on a central server and establishing a virtual client cluster. After the federated learning is completed, a time series matrix is ​​obtained based on the accuracy of each round of training of the virtual client. The time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels, respectively, to train a pre-built inference model, thereby using the trained inference model to predict the data distribution of the local data of the target client under attack in various categories. This method can obtain user data distribution privacy without affecting the normal process of federated learning, providing new research ideas and perspectives for security and privacy protection in federated learning.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of machine learning technology, and in particular to a method for obtaining user data distribution privacy based on federated learning. Background Art

[0002] As a core resource of the digital economy and information society, data is considered another important production factor after land, labor, capital, and technology. The importance of data security is becoming increasingly prominent. Since 2021, my country has implemented a number of laws, regulations, and policies related to data security, and the protection of personal privacy and industry confidential data has been continuously improved. Traditional machine learning is no longer applicable under the premise of data privacy protection, and organizations are turning to federated learning to implement non-interactive machine learning training.

[0003] As a distributed machine learning framework, federated learning holds enormous potential for development in various distributed scenarios, such as finance, healthcare, e-commerce, and logistics. Federated learning eliminates the need for clients to upload large amounts of training data to a central server. Instead, the client trains the model locally, then sends the gradients or updated model parameters to the server. The server aggregates the model and then sends the next round of model training back to the client. This training approach not only combines the private data of each user for model training, ensuring model effectiveness, but also protects user privacy.

[0004] However, federated learning also presents potential threats. Due to the nature of model training methods, gradient kernel model parameters contain user privacy information. This allows servers to exploit user-uploaded gradients or model parameters to conduct inference and attribute inference attacks, thereby obtaining user privacy information. Currently, there is no detailed study of how servers in federated learning obtain the privacy of user data distribution, making privacy protection in federated learning difficult to address. Summary of the Invention

[0005] In order to solve the above technical problems, the embodiments of the present application propose a method for obtaining user data distribution privacy based on federated learning, which can obtain user data distribution privacy without affecting the normal process of federated learning, and provides new research ideas and perspectives for security protection and privacy protection in federated learning.

[0006] To achieve the above objectives, an embodiment of the present application proposes a method for obtaining user data distribution privacy based on federated learning, the method comprising the following steps:

[0007] S101: Each client trains the federated learning global model based on its own local data to obtain several user models. The global model and each user model are classification models.

[0008] S102, arbitrarily select a user model as the target user model, use the client corresponding to the target user model as the target client to be attacked, and obtain the target gradient and L2 norm of the target user model;

[0009] S103, collecting data corresponding to each category label to form an auxiliary data set;

[0010] S104, randomly sampling the auxiliary data to obtain a temporary auxiliary dataset, and using the temporary auxiliary dataset to train the global model to obtain the global gradient and L2 norm of the trained global model;

[0011] S105, setting global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjusting the size of the temporary auxiliary dataset based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, thereby obtaining a final adjusted temporary auxiliary dataset and its size;

[0012] S106: Randomly sample the auxiliary dataset into three different data distributions based on the final adjusted size of the temporary auxiliary dataset. The three different data distributions are sampled M times each to obtain 3M sampled datasets corresponding to 3M virtual clients. If this round of training is the first round of training, 3M virtual clients are established.

[0013] S107, aggregating the gradients of each user model to form an updated global model, and sending the updated global model to each virtual client;

[0014] S108, after receiving the updated global model, each virtual client trains the updated global model based on the corresponding sample data set and records the accuracy of this round of training;

[0015] S109, determining whether the updated global model meets the training termination condition. If not, execute S110; if so, execute S111;

[0016] S110: Send the updated global model to each client. Each client trains the updated global model based on its local data to obtain the latest target gradient and L2 norm of the target user model, and repeats S105 to S109.

[0017] S111, a time series matrix is ​​obtained based on the accuracy of each round of training of the virtual client, and the time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model;

[0018] S112: Input the time series matrix corresponding to the target client into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

[0019] In order to achieve the above-mentioned purpose, an embodiment of the present application also proposes an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for obtaining user data distribution privacy based on federated learning as described in the first aspect above.

[0020] In order to achieve the above-mentioned purpose, an embodiment of the present application also proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a method for obtaining user data distribution privacy based on federated learning as described above.

[0021] The embodiments of the present application propose a method for obtaining the distributed privacy of user data based on federated learning, which successfully simulates distributed reasoning attacks to explore the potential threats of such attacks and has at least the following beneficial effects.

[0022] First, this application can accurately predict the distribution information of the user's local training data. By analyzing the generalization performance of each category of the model and then using the inference model to capture the timing information in the training round, this application can accurately predict the distribution of the client's training data. This shows that the gradient information uploaded by users in federated learning will leak their own data distribution privacy to the central server, revealing the privacy loopholes in federated learning. The prediction method based on timing information can more accurately fit the distribution of training data, which means that timing information will leak more user privacy. This has important implications for the study of attack and defense mechanisms in federated learning, and provides new ideas and perspectives for the security and privacy research of federated learning.

[0023] Second, the attack method designed by this application can accurately infer the distribution of user data. This application explores the relationship between the user upload gradient and the size of the user's local data, and estimates the approximate size of the client training data based on this relationship. The virtual client training data generated based on this simulates the real client as much as possible. Based on the discovery that the number of training data of each category of the user has a great influence on the generalization performance of its corresponding category, this application uses the inference model to capture the temporal information of the change of generalization performance in the training round, accurately infers the distribution information of the user's local data, and combines the inferred training data size to estimate the amount of data in each category.

[0024] Optionally, collect data corresponding to each category label to form an auxiliary dataset, including:

[0025] The data corresponding to each category label of the classification task undertaken by the global model are crawled from the Internet and collected from the real world to form an auxiliary dataset.

[0026] Optionally, the target gradient is recorded as The L2 norm of the target gradient is calculated by the following formula:

[0027]

[0028] Among them, d represents the total dimension of the target gradient, Represents the value of the i-th dimension of the target gradient, Represents the L2 norm of the target gradient;

[0029] The global gradient is recorded as The L2 norm of the global gradient is calculated by the following formula:

[0030]

[0031] in, Represents the value of the i-th dimension of the global gradient, Represents the L2 norm of the global gradient.

[0032] Optionally, global upper and lower bounds are set based on the L2 norm of the target gradient, which is achieved by the following formula:

[0033]

[0034]

[0035] Among them, ∈ is the preset fluctuation constant, δ1 represents the global lower bound, and δ2 represents the global upper bound;

[0036] The size of the temporary auxiliary dataset is continuously adjusted based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds. The final adjusted temporary auxiliary dataset and its size are obtained, including:

[0037] judge Is it satisfied

[0038] like Dissatisfied Then adjust the size of the temporary auxiliary dataset, use the adjusted temporary auxiliary dataset to train on the global model, obtain the latest global gradient and its L2 norm, and determine the L2 norm of the latest global gradient Is it satisfied Among them, if Then expand the size of the temporary auxiliary data set, if Then reduce the size of the temporary auxiliary data set;

[0039] like satisfy The final adjusted temporary auxiliary dataset and its size are obtained, and the size of the final adjusted temporary auxiliary dataset is recorded as N.

[0040] Optionally, the three different data distributions are independent and identically distributed (IID), non-IID based on imbalanced number of categories, and non-IID based on imbalanced category distribution;

[0041] In the independent and identically distributed (IID) model, the proportion of data on each category label is in the interval [0.9N / C, 1.1N / C], where N represents the size of the final adjusted temporary auxiliary dataset and C represents the total number of categories.

[0042] In a non-IID based on an imbalanced number of categories, the data only exists on X category labels and does not exist on the remaining category labels;

[0043] In the non-independent and identically distributed (NIID) method based on imbalanced category distribution, the Dirichlet distribution partitioning method is used to divide the data, and the coefficient α is used to control the degree of non-IID, α = {0.5, 1.2}.

[0044] Optionally, the training termination conditions include a first condition and a second condition, the first condition being that the performance of the global model reaches a specified expected target, and the second condition being that the loss function of the global model converges. If both the first condition and the second condition are not met, execute S110; if either the first condition or the second condition is met, execute S111.

[0045] Optionally, the pre-built inference model is an LSTM model based on a temporal attention mechanism, which consists of a bidirectional LSTM layer, an attention mechanism layer, a fully connected layer, and a normalization layer;

[0046] The bidirectional LSTM layer is used to learn the forward and backward dependencies of the input sequence;

[0047] The attention mechanism layer is used to calculate the attention weight of each hidden state, perform weighted average of each hidden state, obtain the context vector and input it into the fully connected layer;

[0048] The fully connected layer is used to make predictions based on the context vector and outputs the predicted distribution after normalization by the normalization layer.

[0049] Optionally, the timing matrix corresponding to the kth virtual client is recorded as A k , whose dimensions are C represents the total number of categories, E represents the total number of training rounds, and the data distribution corresponding to the k-th virtual client is Based on the accuracy of each round of training for the virtual client, a time series matrix is ​​obtained. The time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model, including:

[0050] Initialize the model parameters h0 and c0 of the inference model, and calculate the output of the hidden state and long-term memory unit in sequence according to the current training round. The calculation formula is:

[0051]

[0052] Among them, h t represents the calculated hidden state, c t represents the computed output of the long-term memory unit, Represents the generalized performance data of the recorded virtual client;

[0053] The importance of each hidden state is calculated by the attention mechanism layer t , e t =v T tanh(W h h t +b h ), where W h 、b h and v are both learnable parameters;

[0054] For e t Normalize and get the attention weight ρ of the hidden state t ,

[0055] Perform weighted averaging on each hidden state to obtain the context vector f,

[0056] The fully connected layer is used to make predictions based on f, and after normalization by the normalization layer, the output prediction distribution l k ;

[0057] Based on l k and Calculate the loss value, iteratively train the inference model, and update the model parameters of the inference model until the inference model converges to obtain a trained inference model. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the related technologies, the following is a brief introduction to the drawings required for use in the embodiments of the present application or the description of the related technologies. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0059] Figure 1 This is a flowchart of a method for obtaining user data distribution privacy based on federated learning provided in one embodiment of the present application;

[0060] Figure 2 is a schematic diagram of the structure of an inference model provided in one embodiment of the present application;

[0061] Figure 3 This is a comparison chart of the training results of OURS and various traditional technologies in a simulation experiment based on a non-IID scenario with imbalanced class distribution, provided in one embodiment of the present application;

[0062] Figure 4 It is a structural diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below with reference to the accompanying drawings. In the various embodiments of the present application, many technical details are proposed to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the present application can be implemented. The division of the following embodiments is only for the convenience of description and should not constitute any limitation on the specific implementation of the present application. The various embodiments can be combined with each other and referenced to each other under the premise of no contradiction.

[0064] An embodiment of the present application proposes a method for obtaining user data distribution privacy based on federated learning. The implementation details of the method for obtaining user data distribution privacy based on federated learning proposed in this embodiment are described in detail below. The following content is only the implementation details provided for ease of understanding and is not necessary for implementing this solution.

[0065] The specific process of the method for obtaining user data distribution privacy based on federated learning proposed in this embodiment can be as follows: Figure 1 As shown, including:

[0066] S101: Each client trains the global model of federated learning based on its own local data to obtain several user models, where the global model and each user model are classification models.

[0067] In practice, federated learning requires a central server and several participating clients. The central server holds the global model for federated learning, while each client trains its own user model. At the start of federated learning, each client trains the global model based on its local data, generating several user models. It's important to note that both the global model and the user models are classification models designed to perform classification tasks.

[0068] S102: arbitrarily select a user model as a target user model, take the client corresponding to the target user model as the target client to be attacked, and obtain the target gradient and L2 norm of the target user model.

[0069] In the specific implementation, the central server needs to arbitrarily select a user model from each user model as the target user model, which means that the client corresponding to the target user model will be the target client to be attacked. The central server needs to obtain the target gradient and its L2 norm of the target user model from the target client.

[0070] In an example, the target gradient of the target user model can be written as The L2 norm of the target gradient is calculated by the following formula:

[0071]

[0072] Among them, d represents the total dimension of the target gradient, Represents the value of the i-th dimension of the target gradient, Represents the L2 norm of the target gradient;

[0073] S103, collecting data corresponding to each category label to form an auxiliary data set.

[0074] In the specific implementation, after obtaining the target gradient and L2 norm of the target user model, the central server needs to build an auxiliary dataset, which is achieved by collecting data corresponding to each category label.

[0075] In one example, the central server needs to crawl the Internet and collect data from the real world that corresponds to each category label of the classification task undertaken by the global model to form an auxiliary dataset.

[0076] S104: Randomly sample the auxiliary data to obtain a temporary auxiliary dataset, and use the temporary auxiliary dataset to train the global model to obtain the global gradient and L2 norm of the trained global model.

[0077] In the specific implementation, after the server obtains Gou Jian's knife auxiliary dataset, it also needs to randomly sample the auxiliary data to obtain a temporary auxiliary dataset (the scale of the temporary auxiliary dataset is smaller than the auxiliary dataset), and use the temporary auxiliary dataset to train on the global model to obtain the global gradient and L2 norm of the trained global model.

[0078] In an example, the global gradient of the trained global model can be written as The L2 norm of the global gradient is calculated by the following formula:

[0079]

[0080] in, Represents the value of the i-th dimension of the global gradient, Represents the L2 norm of the global gradient.

[0081] S105, setting global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjusting the size of the temporary auxiliary dataset based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, thereby obtaining the final adjusted temporary auxiliary dataset and its size.

[0082] In the specific implementation, after the server obtains the global gradient and L2 norm of the trained global model, it needs to set global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjust the size of the temporary auxiliary dataset based on the L2 norm of the global gradient and the global upper and lower bounds (expand or reduce the amount of data in the temporary auxiliary dataset) until the L2 norm of the global gradient is between the global upper and lower bounds, and obtain the final adjusted temporary auxiliary dataset and its size.

[0083] In one example, global upper and lower bounds are set based on the L2 norm of the target gradient, which is achieved by the following formula:

[0084]

[0085] Among them, ∈ is the preset fluctuation constant, δ1 represents the global lower bound, and δ2 represents the global upper bound. At this point, the central server has obtained a constraint condition, namely the L2 norm of the global gradient Should satisfy

[0086] It is understandable that the central server needs to judge Is it satisfied

[0087] like Dissatisfied Then adjust the size of the temporary auxiliary dataset, use the adjusted temporary auxiliary dataset to train on the global model, obtain the latest global gradient and its L2 norm, and determine the L2 norm of the latest global gradient Is it satisfied Among them, if Then expand the size of the temporary auxiliary data set, if Then reduce the size of the temporary auxiliary dataset.

[0088] like satisfy The final adjusted temporary auxiliary dataset and its size are obtained, and the size of the final adjusted temporary auxiliary dataset is recorded as N.

[0089] S106: Based on the size of the final adjusted temporary auxiliary dataset, the auxiliary dataset is randomly sampled into three different data distributions. The three different data distributions are sampled M times respectively to obtain 3M sampled datasets corresponding to 3M virtual clients. If this round of training is the first round of training, 3M virtual clients are established.

[0090] In the specific implementation, after obtaining the final adjusted size N of the temporary auxiliary dataset, the central server needs to randomly sample the auxiliary dataset into three different data distributions based on N. The three different data distributions are sampled M times respectively, and 3M sampled datasets are obtained to correspond to 3M virtual clients. In the first round of federated learning, the central server will establish 3M virtual clients for subsequent training.

[0091] In one example, M is generally set to 1200, that is, three different data distributions are sampled 1200 times each, resulting in 3600 sample data sets corresponding to 3600 virtual clients.

[0092] In one example, the three different data distributions are independent and identically distributed (IID), non-IID based on imbalanced number of categories, and non-IID based on imbalanced category distribution.

[0093] In the independent and identically distributed (IID) model, the proportion of data on each category label is in the interval [0.9N / C, 1.1N / C], where N represents the size of the final adjusted temporary auxiliary dataset and C represents the total number of categories.

[0094] In a non-IID model based on an imbalanced number of categories, data only exists on X category labels and does not exist on the remaining category labels.

[0095] In the non-independent and identically distributed (NIID) method based on imbalanced category distribution, the Dirichlet distribution partitioning method is used to divide the data, and the coefficient α is used to control the degree of non-IID, α = {0.5, 1.2}.

[0096] S107: Aggregate the gradients of the user models to form an updated global model, and send the updated global model to each virtual client.

[0097] In the specific implementation, after obtaining the sampled data set for this round of federated learning training, the central server needs to aggregate the gradients of each user model to form an updated global model, and then send the updated global model to each virtual client for training.

[0098] S108 , after receiving the updated global model, each virtual client trains the updated global model based on the corresponding sampling data set and records the accuracy of this round of training.

[0099] In the specific implementation, after receiving the updated global model, each virtual client will train the updated global model based on the corresponding federated learning sampling data set of this round of training and record the accuracy of this round of training.

[0100] S109, determining whether the updated global model meets the training termination condition. If not, execute S110; if so, execute S111.

[0101] In the specific implementation, after each virtual client completes this round of training, the central server needs to determine whether the updated global model meets the training termination conditions, that is, whether the federated learning meets the end conditions. If the training termination conditions are not met, the next round of federated learning training will continue. If the training termination conditions are met, the federated learning will exit.

[0102] In one example, the training termination conditions include a first condition and a second condition, the first condition being that the performance of the global model reaches a specified expected target, and the second condition being that the loss function of the global model converges. If both the first condition and the second condition are not met, S110 is executed; if either the first condition or the second condition is met, S111 is executed.

[0103] S110, the updated global model is sent to each client, and each client trains the updated global model based on its own local data, obtains the latest target gradient and L2 norm of the target user model, and repeats S105 to S109.

[0104] In the specific implementation, after the central server determines that the updated global model does not meet the training termination conditions, it needs to send the updated global model to each client, and each client will train the updated global model based on its own local data to obtain the latest target gradient and L2 norm of the target user model, and then repeat S105 to S109 to perform a new round of federated learning training.

[0105] S111, based on the accuracy combination of each round of training of the virtual client, a time series matrix is ​​obtained, and the time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model.

[0106] In the specific implementation, after completing federated learning, the central server needs to obtain a timing matrix based on the accuracy of each round of training of the virtual client, and use the timing matrix and data distribution corresponding to each virtual client as training samples and training labels to train the pre-built inference model.

[0107] In one example, the pre-built inference model is an LSTM model based on the temporal attention mechanism, and its model structure can be as follows: Figure 2 As shown in the figure, the model consists of a bidirectional LSTM layer, an attention mechanism layer, a fully connected layer, and a normalization layer. The bidirectional LSTM layer learns the forward and backward dependencies of the input sequence. The attention mechanism layer calculates the attention weights for each hidden state, performs a weighted average of these hidden states, and obtains a context vector, which is then input to the fully connected layer. The fully connected layer makes predictions based on the context vector, and after normalization by the normalization layer, outputs the predicted distribution.

[0108] In an example, the timing matrix corresponding to the kth virtual client is A k , whose dimensions are C represents the total number of categories, E represents the total number of training rounds, and the data distribution corresponding to the k-th virtual client is When the central server trains the pre-built inference model, it first needs to initialize the model parameters h0 and c0 of the inference model, and then calculate the output of the hidden state and long-term memory unit in sequence according to the current training round. The calculation formula is:

[0109]

[0110] Among them, h trepresents the calculated hidden state, c t represents the computed output of the long-term memory unit, Represents the generalized performance data recorded for a virtual client.

[0111] Next, the attention mechanism layer calculates the importance of each hidden state e t , e t =v T tanh(W h h t +b h ), where W h 、b h and v are learnable parameters.

[0112] Afterwards, t Normalize and get the attention weight ρ of the hidden state t , T represents the total number of time steps.

[0113] Then, the weighted average of each hidden state is performed to obtain the context vector f.

[0114] Next, the fully connected layer is used to make predictions based on f, and after normalization by the normalization layer, the output prediction distribution l k .

[0115] After the first based on l k and Calculate the loss value (such as cross entropy loss, absolute average loss, etc.), iteratively train the inference model, and update the model parameters of the inference model until the inference model converges to obtain a trained inference model.

[0116] S112: Input the time series matrix corresponding to the target client into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

[0117] In a specific implementation, after obtaining the trained inference model, the timing matrix corresponding to the target client can be input into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

[0118] This embodiment proposes a method for obtaining distributed privacy of user data based on federated learning, which successfully simulates distributed reasoning attacks to explore the potential threats of such attacks and has at least the following beneficial effects.

[0119] First, this embodiment can accurately predict the distribution information of the user's local training data. By analyzing the generalization performance of each category of the model and then using the inference model to capture the timing information in the training round, this embodiment can accurately predict the distribution of the client's training data. This shows that the gradient information uploaded by users in federated learning will leak their own data distribution privacy to the central server, revealing the privacy loopholes in federated learning. The prediction method based on timing information can more accurately fit the distribution of training data, which means that timing information will leak more user privacy. This has important implications for the study of attack and defense mechanisms in federated learning, and provides new ideas and perspectives for the security and privacy research of federated learning.

[0120] Second, the attack method designed in this embodiment can accurately infer the distribution of user data. This embodiment explores the relationship between the user upload gradient and the size of the user's local data, and estimates the approximate size of the client training data based on this relationship. The virtual client training data generated based on this simulates the real client as closely as possible. Based on the discovery that the amount of training data for each category of the user has a significant impact on the generalization performance of the corresponding category, this embodiment uses an inference model to capture the temporal information of the changes in generalization performance during training rounds, accurately inferring the distribution information of the user's local data. Combined with the inferred training data size, it can also estimate the amount of data for each category.

[0121] The step division of the above various methods is only for the purpose of clear description. During implementation, they can be combined into one step, or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0122] The following will further illustrate the effect of the method for obtaining user data distribution privacy based on federated learning proposed in this application in combination with simulation experiments.

[0123] 1. Simulation experiment conditions.

[0124] The hardware platform of the simulation experiment of this application is as follows: the processor is Intel(R) Xeon(R) Silver 4210CPU with a main frequency of 2.20GHz, 96GB of memory, and the GPU is 4 NVIDIA GeForce RTX 3090.

[0125] The software platform for the simulation experiment in this application is: Ubuntu 18.04 operating system and Python 3.9.

[0126] The datasets used in the simulation experiments of this application are the MNIST dataset, the Fashion-MNIST dataset, the CIFAR-10 dataset, and the AG-News dataset.

[0127] The MNIST dataset was collected by Yann et al. from the National Institute of Standards and Technology (NIST). It contains a large number of images of handwritten digits from 0 to 9, with 60,000 images in the training set and 10,000 images in the test set. Each image is a 28x28 pixel grayscale image with pixel values ​​between 0 and 255.

[0128] The Fashion-MNIST dataset was collected by the German fashion technology company Zalando. It contains 70,000 front-facing images of different products from 10 categories, including T-shirts, trousers, pullovers, dresses, coats, sandals, shirts, sneakers, bags, and booties. Each category contains 6,000 images, with 60,000 used for training and 10,000 for testing. Fashion-MNIST images are in 28x28 pixel grayscale format.

[0129] The Fer2013 (Facial Expression Recognition 2013) dataset was collected by researchers at Carnegie Mellon University. This dataset contains a large number of facial expression images, covering seven basic emotions: anger, disgust, fear, happiness, sadness, surprise, and neutrality. The Fer2013 dataset consists of 35,887 images, including 28,709 images in the training set, 3,589 images in the validation set, and 3,589 images in the test set. Each image consists of a fixed grayscale image of 48×48 pixels, with pixel values ​​ranging from 0 to 255. All images are frontal shots of the face.

[0130] The AG-News dataset, collected by Cornell University, covers 120,000 English news articles across four categories: World, Sports, Business, and Sci / Tech. The dataset consists of approximately 300,000 news headlines and their corresponding descriptions. Each category has 3,000 training examples and 1,900 test examples. These data are sourced from over 2,000 news sources in the AG News corpus.

[0131] 2. Analysis of simulation content and results.

[0132] This application's simulation experiment uses this application (denoted as OURS) and two traditional methods (PPA preference inference attack method and LIA category inference attack method) to perform inference attacks on user local data distribution on the MNIST, Fashion-MNIST, Fer2013, and AG-News datasets. The simulation scenario simulates 20 users collaboratively training a federated learning global model, and the inference attack targets the data distribution of one of the 20 users.

[0133] The PPA preference inference attack method refers to the preference inference attack method proposed by Zhou et al., denoted as PPA.

[0134] The LIA category inference attack method refers to the category inference attack method proposed by Ramakrishna et al., denoted as LIA.

[0135] In order to verify the effect of OURS, we use the following four evaluation indicators (Wasserstein distance, KL divergence, JS divergence, and L1 distance) to evaluate the results of the user local data distribution inference attack of the three methods. The smaller the distance, the better the inference attack effect, otherwise the inference attack effect is worse. All comparison results can be found in Table 1, Table 2, and Figure 3 .

[0136] Table 1: Comparison of training results between OURS and traditional techniques in simulation experiments under independent and identically distributed scenarios

[0137]

[0138] Table 2: Comparison of training results between OURS and traditional techniques in simulation experiments under non-IID scenarios with imbalanced number of categories

[0139]

[0140] As can be seen from Tables 1 and 2, regardless of the data distribution, OURS achieves smaller distance metrics than traditional methods on all datasets, indicating that its predictions are closer to the actual data distribution than the other two traditional methods. Across all four distance metrics for MNIST, Fashion-MNIST, and Fer2013, OURS is an order of magnitude smaller than traditional methods, demonstrating its superior prediction performance.

[0141] Depend on Figure 3As can be seen from the figure, OURS is closer to the target client's true label distribution than the two traditional methods. The prediction curve of OURS almost overlaps with the true distribution curve, while the traditional methods show fluctuations in different categories that are inconsistent with the true distribution, which shows the excellent prediction performance of OURS.

[0142] Another embodiment of the present application provides an electronic device, the specific structure of which is as follows: Figure 4 As shown, it includes: at least one processor M201; and a memory M202 communicatively connected to the at least one processor M201; wherein the memory M202 stores instructions that can be executed by the at least one processor M201, and the instructions are executed by the at least one processor M201 so that the at least one processor M201 can execute a method for obtaining user data distribution privacy based on federated learning as described in the above method embodiments.

[0143] The memory and processor can be connected using a bus. The bus can include any number of interconnected buses and bridges, connecting various circuits within one or more processors and the memory. The bus can also connect various other circuits, such as peripherals, voltage regulators, and power management circuits. These are well known in the art and will not be described further herein. The bus interface is responsible for providing an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium.

[0144] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0145] Another embodiment of the present application proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a method for obtaining user data distribution privacy based on federated learning as described in the above method embodiments.

[0146] That is, those skilled in the art will understand that all or part of the steps in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (such as a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard drive, a ROM (Read-Only Memory), a RAM (Random Access Memory), a magnetic disk, or an optical disk, etc., various media that can store program code.

[0147] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and that in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for obtaining user data distribution privacy based on federated learning, characterized in that: include: S101: Each client trains the federated learning global model based on its own local data to obtain several user models. The global model and each user model are classification models. S102, arbitrarily select a user model as the target user model, use the client corresponding to the target user model as the target client to be attacked, and obtain the target gradient and L2 norm of the target user model; S103, collecting data corresponding to each category label to form an auxiliary data set; S104, randomly sampling the auxiliary data to obtain a temporary auxiliary dataset, and using the temporary auxiliary dataset to train the global model to obtain the global gradient and L2 norm of the trained global model; S105, setting global upper and lower bounds based on the L2 norm of the target gradient, and continuously adjusting the size of the temporary auxiliary dataset based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds, thereby obtaining a final adjusted temporary auxiliary dataset and its size; S106: Randomly sample the auxiliary dataset into three different data distributions based on the final adjusted size of the temporary auxiliary dataset. The three different data distributions are sampled M times each to obtain 3M sampled datasets corresponding to 3M virtual clients. If this round of training is the first round of training, 3M virtual clients are established. S107, aggregating the gradients of each user model to form an updated global model, and sending the updated global model to each virtual client; S108, after receiving the updated global model, each virtual client trains the updated global model based on the corresponding sample data set and records the accuracy of this round of training; S109, determining whether the updated global model meets the training termination condition. If not, execute S110; if so, execute S111; S110: Send the updated global model to each client. Each client trains the updated global model based on its local data to obtain the latest target gradient and L2 norm of the target user model, and repeats S105 to S109. S111, a time series matrix is ​​obtained based on the accuracy of each round of training of the virtual client, and the time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model; S112: Input the time series matrix corresponding to the target client into the trained inference model to obtain the data distribution of the local data of the target client predicted by the inference model.

2. The method for obtaining user data distribution privacy based on federated learning according to claim 1, characterized in that: Collect data corresponding to each category label to form an auxiliary dataset, including: The data corresponding to each category label of the classification task undertaken by the global model are crawled from the Internet and collected from the real world to form an auxiliary dataset.

3. The method for obtaining user data distribution privacy based on federated learning according to claim 1, characterized in that: The target gradient is recorded as The L2 norm of the target gradient is calculated by the following formula: Among them, d represents the total dimension of the target gradient, Represents the value of the i-th dimension of the target gradient, Represents the L2 norm of the target gradient; The global gradient is recorded as The L2 norm of the global gradient is calculated by the following formula: in, Represents the value of the i-th dimension of the global gradient, Represents the L2 norm of the global gradient.

4. The method for obtaining user data distribution privacy based on federated learning according to claim 3, characterized in that: The global upper and lower bounds are set based on the L2 norm of the target gradient, which is achieved through the following formula: Among them, 𝜖 is the preset fluctuation constant, δ1 represents the global lower bound, and δ2 represents the global upper bound; The size of the temporary auxiliary dataset is continuously adjusted based on the L2 norm of the global gradient and the global upper and lower bounds until the L2 norm of the global gradient is between the global upper and lower bounds. The final adjusted temporary auxiliary dataset and its size are obtained, including: judge Is it satisfied like Dissatisfied Then adjust the size of the temporary auxiliary dataset, use the adjusted temporary auxiliary dataset to train on the global model, obtain the latest global gradient and its L2 norm, and determine the L2 norm of the latest global gradient Is it satisfied Among them, if Then expand the size of the temporary auxiliary data set, if Then reduce the size of the temporary auxiliary data set; like satisfy The final adjusted temporary auxiliary dataset and its size are obtained, and the size of the final adjusted temporary auxiliary dataset is recorded as N.

5. The method for obtaining user data distribution privacy based on federated learning according to claim 1, characterized in that: The three different data distributions are independent and identically distributed, non-independent and identically distributed based on imbalanced number of categories, and non-independent and identically distributed based on imbalanced category distribution; In the independent and identically distributed (IID) model, the proportion of data on each category label is in the interval [0.9N / C, 1.1N / C], where N represents the size of the final adjusted temporary auxiliary dataset and C represents the total number of categories. In a non-IID based on an imbalanced number of categories, the data only exists on X category labels and does not exist on the remaining category labels; In the non-independent and identically distributed (NIID) method based on imbalanced category distribution, the Dirichlet distribution partitioning method is used to divide the data, and the coefficient α is used to control the degree of non-IID, α = {0.5, 1.2}.

6. The method for obtaining user data distribution privacy based on federated learning according to claim 1, characterized in that: The training termination conditions include a first condition and a second condition. The first condition is that the performance of the global model reaches the specified expected goal, and the second condition is that the loss function of the global model converges. If both the first condition and the second condition are not met, execute S110. If any one of the first condition and the second condition is met, execute S111.

7. A method for obtaining user data distribution privacy based on federated learning according to any one of claims 1 to 6, characterized in that: The pre-built inference model is an LSTM model based on the temporal attention mechanism. The LSTM model based on the temporal attention mechanism consists of a bidirectional LSTM layer, an attention mechanism layer, a fully connected layer, and a normalization layer. The bidirectional LSTM layer is used to learn the forward and backward dependencies of the input sequence; The attention mechanism layer is used to calculate the attention weight of each hidden state, perform weighted average of each hidden state, obtain the context vector and input it into the fully connected layer; The fully connected layer is used to make predictions based on the context vector and outputs the predicted distribution after normalization by the normalization layer.

8. The method for obtaining user data distribution privacy based on federated learning according to claim 7, characterized in that: The timing matrix corresponding to the kth virtual client is recorded as A k , whose dimensions are C represents the total number of categories, E represents the total number of training rounds, and the data distribution corresponding to the k-th virtual client is Based on the accuracy of each round of training for the virtual client, a time series matrix is ​​obtained. The time series matrix and data distribution corresponding to the virtual client are used as training samples and training labels to train the pre-built inference model, including: Initialize the model parameters h0 and c0 of the inference model, and calculate the output of the hidden state and long-term memory unit in sequence according to the current training round. The calculation formula is: Among them, h t represents the calculated hidden state, c t represents the computed output of the long-term memory unit, Represents the generalized performance data of the recorded virtual client; The importance of each hidden state is calculated by the attention mechanism layer t , e t =v T tanh(W h h t +b h ), where W h 、b h and v are both learnable parameters; For e t Normalize and get the attention weight ρ of the hidden state t , Perform weighted averaging on each hidden state to obtain the context vector f, The fully connected layer is used to make predictions based on f, and after normalization by the normalization layer, the output prediction distribution l k ; Based on l k and Calculate the loss value, iteratively train the inference model, and update the model parameters of the inference model until the inference model converges to obtain a trained inference model.

9. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; In which, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a method for obtaining user data distribution privacy based on federated learning as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it can implement a method for obtaining user data distribution privacy based on federated learning as described in any one of claims 1 to 8.

Images