A privacy protection federated learning method for a personalized recommendation system

Abstract

The present application relates to the technical field of privacy protection, in particular to a privacy protection federated learning method for personalized recommendation system, comprising: initializing a user vector and an item matrix based on personalized commodity information; updating the user vector and calculating a local gradient, and requesting a noise reduction matrix; adding noise to the local gradient, aggregating, and obtaining a global noise gradient; removing noise in the global noise gradient based on the noise reduction matrix, updating the item matrix, and iterating until termination and outputting a recommendation list, which enables the federated recommendation algorithm based on local differential privacy to realize a safe and lossless training mode, and solves the problem of low model training efficiency caused by the "straggler effect" of federated learning, prevents user ratings, local gradients and recommendation results from being leaked to the server, and achieves the same model accuracy as in the plaintext scenario. The present application solves the problem that the existing local differential privacy federated recommendation algorithm cannot balance the degree of privacy protection and model accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy protection, and particularly relates to a privacy protection federated learning method for a personalized recommendation system. BACKGROUND

[0002] A recommendation system can be defined as an application whose core is a recommendation algorithm. The main purpose of the recommendation system is to explore the user's preferences in a specific scenario and find information that the user may be interested in from a large amount of data to generate a recommendation list for the user. As an effective technology to solve the problem of "information overload", the recommendation system is widely used in e-commerce, advertising, music, video, news, job hunting, social networking, tourism, takeout, finance, education, medical treatment, industrial production and other fields. According to the report of McKinsey, 35% of the content purchased by customers on Amazon and 75% of the content watched by users on Netflix come from the recommendation system.

[0003] The recommendation system technology brings convenience to our life, but also brings new challenges. The recommendation system uses the historical interaction data of users and items and their inherent content attribute features, and integrates various additional information (such as social information, text information, image information, etc.) for personalized modeling to achieve the function of accurately predicting the items that the user may be interested in the future. Due to the existence of user personal data and sensitive information in the vast amount of information, the platform needs to collect more training data to improve the recommendation performance, and the contradiction between the user's protection of privacy and the sharing of personal data as little as possible gradually highlights. Whether it is an individual, an enterprise, or an organization, no one wants their privacy data to be leaked, but the existing technology cannot provide good data protection capability. In order to strengthen the protection of data privacy and security, countries have begun to introduce various laws and regulations to regulate and protect data security from the legal level.

[0004] Traditional centralized learning, the server needs to collect user original score data and complete model training, and then feedback the recommendation result to the user. This training method is easy to cause user behavior information to be leaked to an untrusted server. Federated learning is a distributed machine learning technology, which is characterized by: user behavior data is stored locally, and the server and the user perform model training through model intermediate parameter collaborative optimization. Therefore, applying the federated learning framework to the recommendation system can solve the privacy protection problem of user behavior information from the root. However, the latest research (Wang Z, Song M, Zhang Z, Song Y, Wang Q, Qi H. Beyond inferring class representatives: User-level privacy leakage from federated learning. In: Proceedings of the IEEE Conference on Computer Communications, 2019, 16: 2512-2520) shows that the gradient information of the transmitted model can still be subject to reverse attacks and thus leak user privacy and model structure information.

[0005] The current privacy protection method for federated recommendation systems mainly includes homomorphic encryption and differential privacy. The former requires high communication and calculation costs and is not suitable for terminal devices with limited computing resources, and the latter inevitably affects the accuracy of the model due to strict mathematical assumptions. Therefore, a lightweight, high-precision and privacy protection capable federated learning method for personalized recommendation systems is still in urgent need of research. SUMMARY

[0006] The purpose of the present application is to provide a privacy protection federated learning method for personalized recommendation systems, aiming to solve the problem that the existing local differential privacy federated recommendation algorithm cannot balance the degree of privacy protection and model accuracy.

[0007] To achieve the above purpose, the present application provides a privacy protection federated learning method for personalized recommendation systems, comprising the following steps:

[0008] Initializing the user vector and item matrix based on personalized commodity information;

[0009] Updating the user vector and calculating the local gradient, and requesting a denoising matrix;

[0010] Adding noise to the local gradient to generate a local noise gradient, aggregating to obtain a global noise gradient;

[0011] Remove the noise in the global noise gradient based on the denoising matrix, and update the item matrix, and the iteration is terminated and the recommendation list is output.

[0012] The specific way of initializing the user vector and the item matrix based on the personalized commodity information is:

[0013] Randomly initialize the user feature vector locally based on the personalized commodity information.

[0014] The trusted third party randomly initializes the item feature matrix and sends it to the user participating in the current round of training.

[0015] The specific way of updating the user vector and calculating the local gradient, and requesting a denoising matrix is:

[0016] The user participating in the current round of training respectively updates the user feature vector and calculates the local gradient locally;

[0017] Request a noise matrix from a trusted third party, randomly generate a Laplace noise matrix and a weight parameter.

[0018] The specific way of adding noise to the local gradient, aggregating, and obtaining a global noise gradient is:

[0019] The user participating in the current round of training respectively adds noise to the local gradient locally, and sends the local noise gradient to the federal server;

[0020] The federal server aggregates the local noise gradient to obtain a global noise gradient, and sends it to the user participating in the current round of training.

[0021] The specific way of removing the noise in the global noise gradient based on the denoising matrix, and updating the item matrix, and terminating the iteration and outputting the recommendation list is:

[0022] Remove the noise in the global noise gradient based on the denoising matrix, and update the item matrix;

[0023] When the training reaches the model accuracy or the upper limit threshold of iteration, terminate the iteration, and the user respectively calculates the score vector locally to obtain the recommendation list.

[0024] The update formula of the user vector is:

[0025] ;

[0026] The local gradient calculation is:

[0027] ;

[0028] Where, is the index of the user, is an index of items, represents the first step iteration, is a user rating vector, is a user rating value for an item, is a user feature vector of the first user in the first and step iteration, is an item feature vector of the first item in the first step iteration, is an item matrix, is a local gradient calculated by the first user, and are hyperparameters.

[0029]

[0030] The personalized recommendation system privacy protection federated learning method provided by the application initializes a user vector and an item matrix based on personalized commodity information; the user vector is updated and a local gradient is calculated, and a denoising matrix is requested; the local gradient is added with noise, aggregated, and a global noise gradient is obtained; the noise in the global noise gradient is removed based on the denoising matrix, and the item matrix is updated, the iteration is terminated, and a recommendation list is output. The user rating, the local gradient and the recommendation result can be prevented from being leaked to the server, and the same model precision as in the plaintext scenario can be achieved. The local gradient of the user and the server communication satisfies local differential privacy, and the global gradient satisfies joint differential privacy. The privacy of the local data and the gradient is protected, and the personalized recommendation list generated finally is generated locally and can only be accessed by the user, so that the privacy of the personalized recommendation result of the user is protected. A mechanism is designed for the user to remove the noise of the global gradient locally by introducing a trusted third party, so that the influence of the low model precision caused by the noise accumulation in the local differential privacy federated learning is overcome, so that the proposed method has strong privacy protection capability and the model precision is not lost. The method does not require all users to participate in the training of each round, and the user set participating in the training of each round is selected by the server, so that the "straggler effect" of the federated learning can be effectively coped with, so that the federated learning is efficient and robust, and the problem that the existing local differential privacy federated recommendation algorithm cannot balance the privacy protection degree and the model precision is solved. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below only show some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0032] Figure 1 is a schematic diagram of the mathematical principle of matrix factorization recommendation system.

[0033] Figure 2 is a privacy protection federated learning schematic diagram for a personalized recommendation system provided by the present application.

[0034] Figure 3 is a flowchart of a privacy protection federated learning method for a personalized recommendation system provided by the present application.

[0035] Figure 4 is a flowchart of a privacy protection federated learning method for a personalized recommendation system provided by the present application.

[0036] Figure 5 is a flowchart of a specific way of initializing user vectors and item matrices.

[0037] Figure 6 is a flowchart of a specific way of updating the user vector and calculating the local gradient, and requesting the denoising matrix.

[0038] Figure 7 is a flowchart of a specific way of adding noise to the local gradient, aggregating, and obtaining the global noise gradient.

[0039] Figure 8 is a flowchart of a specific way of removing noise in the global noise gradient based on the denoising matrix, updating the item matrix, terminating iteration and outputting a recommendation list. DETAILED DESCRIPTION

[0040] The embodiments of the present application will be described in detail below, and examples of the embodiments are shown in the drawings, wherein the same or similar reference signs represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the drawings are exemplary and are intended to explain the present application, and cannot be understood as a limitation of the present application.

[0041] Please refer to Figures 1 to 8 , the present application provides a privacy protection federated learning method for a personalized recommendation system, comprising the following steps:

[0042] S1 initializing user vectors and item matrices based on personalized commodity information;

[0043] In the embodiments of the present application, the user respectively locally randomly initializes the user feature vector, the trusted third party randomly initializes the item feature matrix and sends it to the user participating in the current round of training. Each user has the same item list and the score vector composed of the user's score on the item, and the score vector is usually a sparse vector containing a large number of missing values, and the score vectors of all users constitute the score matrix.

[0044] The updating formula of the user vector is:

[0045] ;

[0046] The local gradient calculation is:

[0047] ;

[0048] wherein, is the index of the user, is the index of the item, represents the step iteration, is the score vector of the user, is the score value of the user on the item, is the user feature vector of the first user at the first and second step iteration, is the item feature vector of the first item at the first step iteration, is the item matrix, is the local gradient calculated by the first user, and is the hyperparameter. Specifically,

[0049] The specific way is:

[0050] S11 locally randomly initializes the user feature vector based on the personalized commodity information;

[0051] S12 the trusted third party randomly initializes the item feature matrix and sends it to the user participating in the current round of training.

[0052] S2 updates the user vector and calculates the local gradient, and requests the denoising matrix;

[0053] The specific way is:

[0054] ​S21, the users participating in the current round of training respectively update the user feature vectors and calculate local gradients locally;

[0055] In the embodiments of the present application, the users participating in the current round of training respectively update the user feature vectors and calculate local gradients locally. In the embodiments of the present application, the users participating in the current round of training respectively update the user feature vectors and calculate local gradients locally.

[0056] S22, a noise matrix is requested from a trusted third party, a Laplace noise matrix and weight parameters are randomly generated.

[0057] In the embodiments of the present application, a noise matrix is requested from a trusted third party, a Laplace noise matrix and weight parameters are randomly generated by the trusted third party (wherein, ), are multiplied respectively with to obtain noise matrices , and parts are randomly distributed to the users participating in the current round of training.

[0058] S3, the local gradients are added with noise to generate local noise gradients, and aggregation is performed to obtain global noise gradients.

[0059] Specifically,

[0060] S31, the users participating in the current round of training respectively add noise to the local gradients locally, and send the local noise gradients to the federated server. In the embodiments of the present application, the users participating in the current round of training respectively add noise to the local gradients

[0061] locally, and send the local noise gradients to the federated server. In the embodiments of the present application, the users participating in the current round of training respectively add noise to the local gradients locally, and send the local noise gradients to the federated server.

[0062] The local gradient noise addition formula is:

[0063] The federated server (aggregation) formula is: .

[0064] S32, the federated server aggregates the local noise gradients to obtain global noise gradients , and sends them to the users participating in the current round of training.

[0065] ​​In the embodiment of the present application, the federal server aggregates the local noise gradient of the users participating in the current round of training to obtain the global noise gradient, and sends it to the users participating in the current round of training. The server selects the users in good condition from the user set as the next round of training users.

[0066] S4 removes the noise in the global noise gradient based on the noise reduction matrix, and updates the item matrix. The iteration is terminated and the recommendation list is output.

[0067] Specifically,

[0068] S41 removes the noise in the global noise gradient based on the noise reduction matrix, and updates the item matrix;

[0069] In the embodiment of the present application, the users participating in the current round of training respectively use to remove the noise in the global noise gradient to obtain the real global gradient, and use it to update the item matrix.

[0070] Global gradient denoising formula: ;

[0071] Item matrix update formula: , wherein, is a hyperparameter;

[0072] S42 terminates the iteration when the training reaches the model accuracy or the upper limit threshold of iteration, and the users respectively calculate the score vector locally to obtain the recommendation list.

[0073] In order to better understand the technical solution, the following embodiments are provided for further description:

[0074] The example contains three types of entities, namely users (Users), servers (CS) and trusted third parties (TPA). Among them, the server is assumed to be honest but curious. The method of the present application aims to train a high-precision recommendation model through the cooperation of the three parties, and to ensure that the privacy information such as the original ratings, gradients and recommendation lists of the users will not be stolen by the untrusted server. In the example, three small, medium and large movie data sets widely used for recommendation algorithm evaluation are selected, and the specific information is shown in Table 1.

[0075] Table 1 Recommendation algorithm evaluation data set

[0076]

[0077] According to the privacy protection federated learning method flowchart for personalized recommendation system as shown in Figure 3 , the specific implementation steps are as follows:

[0078] Initialization Phase: The server selects healthy online users to participate in this round of training. A trusted third party sets the model's hyperparameters. And randomly initialize the project matrix. and will Send to all users, and each user randomly initializes a user vector locally. .in, The dimension of the latent features, for The regularization parameters of the matrix factorization model. This represents the learning rate for the gradient descent algorithm. Specific parameter settings are shown in Table 2.

[0079] Table 2 Hyperparameter Settings

[0080]

[0081] Model training phase: Participants in this round of training Each user requests to send noise to a trusted third party, while simultaneously updating the user vector locally using the user vector update formula. Calculate the local gradient using the local gradient calculation formula. A trusted third party received After each user requests noise, a Laplace noise matrix is ​​randomly generated. Randomly generated Weight parameters , making Then by and Multiply to get noise matrix A trusted third party will share Send randomly Each user receives noise from a trusted third party and adds noise to the local gradient according to the local gradient noise formula to obtain the perturbed local gradient. And will send it to the server. The server receives it. After receiving the perturbation gradients from each user, the local gradient aggregation formula is used to aggregate the gradients to obtain the global gradient of the perturbation. and will Sent to those who participated in this round of training Each user receives a perturbed global gradient and performs a denoising operation on their local machine using the global gradient denoising formula to obtain the true global gradient. Then, the item matrix is updated by using the item matrix update formula. After the completion of the current round of training, the server selects the next round of user set for training, and iterates until the termination condition is met, and the training phase is completed. In each round of training, 5-fold cross-validation is used to evaluate the prediction effect of the model on the test set. The evaluation indexes include: root mean square error (RMSE) and mean absolute error (MAE), which are defined as:

[0082]

[0083]

[0084] wherein, is the number of test set score samples; , are the real ratings and predicted ratings of the user to the item .

[0085] Training completion phase: after the completion of the training phase, the optimal model parameters are outputted, and the user respectively performs the calculation locally: to obtain the predicted ratings of the user to all items, and the top K items with higher predicted ratings are taken as the recommendation list of the user, so that the recommendation task is completed.

[0086] Finally, the method (Ours) of the present application is compared with the training method in the plaintext state (FLMF) and the federated learning method based on local differential privacy (LDPFLMF), and the cross-validation comparison results are shown in Table 3. From the comparison results, it can be known that the prediction accuracy of the method of the present application is equivalent to that of the training method in the plaintext state, and is significantly better than that of the federated learning method based on local differential privacy.

[0087] Table 3: Comparison of model prediction accuracy

[0088]

[0089] The above disclosed is only a preferred embodiment of the present application, which is a privacy protection federated learning method for personalized recommendation system, and of course cannot limit the scope of the present application. Those skilled in the art can understand that the above-mentioned embodiment can be implemented in whole or in part, and equivalent changes made according to the claims of the present application still belong to the scope of the present application.

Claims

1. A privacy protection federated learning method for a personalized recommendation system, characterized in that, The method comprises the following steps: Initializing a user vector and an item matrix based on personalized commodity information; Specifically, Randomly initializing a user feature vector locally based on personalized commodity information; A trusted third party randomly initializes an item feature matrix and sends it to users participating in the current training round; Updating the user vector and calculating a local gradient, and requesting a denoising matrix; The update formula of the user vector is: ； The local gradient calculation is: ； in, It is the user's index. It is the index of the project. Representing the Step iteration, User The rating vector, User For the project The rating value, They are the first The user in the first and Iterative user feature vectors, It is the first The project in the The feature vector of the project in each iteration, It is a project matrix. It is the first Local gradients computed by each user. and It's a hyperparameter; Specifically, Users participating in the current training round update the user feature vector and calculate the local gradient locally; Requesting a noise matrix from a trusted third party, randomly generating a Laplacian noise matrix and weight parameters wherein, , are multiplied respectively with to obtain noise matrices wherein, , parts are randomly distributed to users participating in the current round of training; Adding noise to the local gradient to generate a local noise gradient, aggregating to obtain a global noise gradient; Specifically, The users participating in the round of training each locally compute the local gradient adding noise and send the local noisy gradient to the federated server; The federal server participates in aggregating the local noise gradients to obtain a global noise gradient and sends it to the users participating in the current round of training; Based on the denoising matrix, remove the noise in the global noise gradient, and update the item matrix, and terminate the iteration and output the recommendation list; Specifically, Based on the denoising matrix, remove the noise in the global noise gradient, and update the item matrix; wherein the global gradient denoising formula is: ; The project matrix update formula is: wherein, is a hyperparameter; When the training reaches the model accuracy or the upper limit threshold of iteration, terminate the iteration, and the user calculates the score vector locally to obtain the recommendation list.

2. The privacy-preserving federated learning method for a personalized recommendation system of claim 1, wherein ； The user has the same item list, and the score vector composed of the user's score on the item, the score vector is a sparse vector containing a large number of missing values, and the score vectors of all users constitute a score matrix.

Images