Self-adaptive differential privacy federal learning training method, medium and equipment

Abstract

The invention discloses an adaptive differential privacy federal learning training method, medium and device, and the method comprises the steps: S1, a cloud server selects a client, and broadcasts a global model parameter and a cutting threshold to the selected client; s2, the selected client uses a personalized local momentum mechanism to correct the global model, and client model training is executed locally; s3, the cloud server aggregates the client model parameters to generate a new global model; s4, calculating a loss value of the new global model, and if the loss value is continuously reduced for three rounds, adjusting a cutting threshold; and S5, when the number of aggregation times of the client model reaches a preset communication round, stopping training, otherwise, returning to S1, and continuing to carry out the next round of training. The method not only can improve the training efficiency, but also can effectively cope with the data distribution change, and improves the training effect on the premise of ensuring the differential privacy.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning models, and in particular to an adaptive differential privacy federated learning training method, medium and device. Background Art

[0002] With the continuous development of the information society, the protection of privacy data has become increasingly important. In this context, federated learning, as an emerging machine learning method, has attracted much attention. Federated learning is an emerging distributed machine learning algorithm framework that can collaboratively train models without sharing data among participants. While protecting user privacy, federated learning combines multi-party data for joint modeling, thus solving the "data silo" problem. From the perspective of technological development, currently, federated learning mainly focuses on in-depth research on challenges such as communication bottlenecks, data heterogeneity, and privacy issues.

[0003] Research work related to the security and privacy of data has been highly concerned before the emergence of federated learning. In the prior art, one of the most advanced technologies for mitigating privacy risks in federated learning is differential privacy. Differential privacy prevents privacy leakage by introducing random noise into the data. Therefore, the use of differential privacy technology can effectively address privacy issues in federated learning. However, in practical applications, differential privacy federated learning faces the dual challenges of data heterogeneity and privacy-utility balance. Specifically, the data of clients is often non-independent and identically distributed (non-IID), which leads to the client drift phenomenon, that is, there are significant differences in the model update directions of different clients. At the same time, the differential privacy technology introduces noise in the process of protecting user privacy. Too much noise will affect the accuracy of the model, and too little noise cannot fully protect privacy. Summary of the Invention

[0004] An adaptive differential privacy federated learning training method, medium and device provided by the present invention can at least solve one of the above technical problems.

[0005] To solve the above technical problems, the present invention adopts the following technical solutions: An adaptive differential privacy federated learning training method includes the following steps: S1. The cloud server selects clients according to the client random scheduling strategy, and broadcasts the global model parameters and the clipping threshold to the selected clients; S2. The selected clients use the personalized local momentum mechanism to correct the global model, form the client model, and perform client model training locally; S3. After the cloud server receives all the client models participating in the training in this round, it aggregates the client model parameters to generate a new global model; S4. Calculate the loss value of the new global model. If the loss value drops for three consecutive rounds, adjust the pruning threshold until the aggregation times of the client models reach the preset communication rounds; S5. When the aggregation times of the client models reach the preset communication rounds, stop the adaptive differential privacy federated learning training based on personalized local momentum. Otherwise, return to S1 and continue the next round of training.

[0006] Further, in S1, the cloud server initializes the pruning threshold C 0 = 1 before the start of training. Before each round of communication, s clients are selected. The strategy for selecting clients is the client random scheduling strategy, that is, s clients are randomly sampled in each round of communication. The sampling formula is: s = qU where q is the sampling factor, 0 < q < 1, and U is the total number of clients; After selecting the clients, the cloud server broadcasts the global model of the t-th round of communication and the pruning threshold C t to the selected clients.

[0007] Further, in S2, each client executes an optimization algorithm according to the task type and model architecture to update its corresponding local model parameters. This process can be iterated multiple times, and the local model parameters are updated in each iteration. After the client completes the preset rounds of local model iteration, according to the pruning threshold C received from the cloud server t prune the local model parameters and add noise, and upload the updated and noisy local model parameters to the cloud server.

[0008] Further, S2 further includes: S21. Each client stores personalized momentum locally. The selected client initializes the client model using the local personalized momentum after receiving the global model broadcast by the cloud server:

[0009] where: i represents the client; t represents the communication round; represents the initialization model of client i in the t-th round of communication, that is, the 0-th local iteration model; represents the personalized momentum of client i in the t-th round of communication; S22. Client i uses the local dataset D i for training, with as the loss function, where x jDenote the input features of the j-th sample in the local dataset, y j Denote the true label corresponding to the j-th sample in the local dataset. Then, for client i on the local dataset D i The loss function is defined as:

[0010] Client i uses the corrected initial model and uses the local dataset D i to solve for the optimal parameter w. The goal is to find the optimal model parameters that minimize the loss function ; S23. Client i performs k rounds of local iteration based on the stochastic gradient descent algorithm, and the update method is:

[0011] where η represents the step size for calculating the model update, represents the model gradient, represents the model of client i in the k-th round of local iteration, represents the model of client i in the (k - 1)-th round of local iteration; S24. After client i finishes the local iteration, calculate the local update Δw i as:

[0012] where, represents the model of client i after performing k rounds of local iteration in the t-th communication; and update the personalized local momentum as:

[0013] where λ 1 and λ 2 are momentum coefficients, and 0 < λ 1 < 1, 0 < λ 2 < 1, represents the personalized momentum of client i in the (t + 1)-th communication; S25. According to the clipping threshold C t received from the cloud server, clip the local update Δw i as follows:

[0014] and add Gaussian noise that satisfies ε-differential privacy:

[0015] where: ε represents the privacy protection strength. The smaller the ε value, the more noise is added, and the greater the privacy protection strength. represents Gaussian noise, and σ is the noise multiplier coefficient. represents the model parameters after being clipped by client i. represents the model parameters of client i after adding Gaussian noise. S26. After the noise addition is completed, client i uploads the parameter to the cloud server.

[0016] Further, in S3, after the cloud server receives all the client models participating in the training in this round of communication, it performs weighted average aggregation on the client model parameters:

[0017] where: represents the new global model. represents the total size of the datasets of the s sampled clients.

[0018] Further, in S4, the cloud server calculates the cross-entropy loss value L t on the validation set using the aggregated new global model, and adaptively adjusts the clipping threshold C t+1 for the next round of communication using the following formula. If the loss value L t continuously decreases in three consecutive communication rounds, then the clipping threshold C t is adjusted as follows:

[0019] where β is the clipping threshold decay coefficient, and 0 < β < 1, and L t represents the central-side loss of the global model in the t-th round.

[0020] A computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the processor is caused to execute the steps of the above adaptive differential privacy federated learning training method.

[0021] A computer device includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor is caused to execute the steps of the above adaptive differential privacy federated learning training method.

[0022] The beneficial effects of the present invention are as follows: 1. The client adopts a personalized local momentum mechanism to effectively address the prevalent data heterogeneity problem in actual scenarios, reduce the bias caused by client drift, and accelerate the local training process of the client.

[0023] 2. By means of the strategy of adaptively reducing the clipping threshold, an appropriate amount of random noise is dynamically added to the model parameters to reduce the interference introduced by the noise and improve the convergence speed and final accuracy of the model. Description of the Drawings

[0024] The drawings described herein are used to provide a further understanding of the present application and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation to the present application.

[0025] Figure 1 It is a schematic flowchart of the adaptive differential privacy federated learning training method according to an embodiment of the present invention.

[0026] Figure 2 It is a graph showing the performance of the model accuracy in the test set in the comparative experiment according to an embodiment of the present invention.

[0027] Figure 3 It is a structural block diagram of a computer device according to an embodiment of the present invention. Detailed Embodiments

[0028] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Without conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0029] It should be noted that the meaning of "and / or" appearing throughout the text includes three parallel solutions. Taking "A and / or B" as an example, it includes solution A, or solution B, or a solution that satisfies both A and B at the same time. In addition, "a plurality" means two or more. In addition, the technical solutions between the embodiments can be combined with each other, but it must be based on the fact that those of ordinary skill in the art can implement it. When the combination of technical solutions appears to be contradictory or unable to be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the protection scope required by the present invention.

[0030] See Figure 1 , an embodiment of the present invention provides an adaptive differential privacy federated learning training method, including the following steps: S1. The cloud server selects clients according to the client random scheduling strategy and broadcasts the global model parameters and the clipping threshold to the selected clients; S2. The selected clients use the personalized local momentum mechanism to correct the global model, form the client model, and perform client model training locally; S3. After the cloud server receives all the client models participating in the training in this round, it aggregates the client model parameters to generate a new global model; S4. Calculate the loss value of the new global model. If the loss value decreases for three consecutive rounds, adjust the clipping threshold until the aggregation times of the client models reach the preset communication rounds; S5. When the aggregation times of the client models reach the preset communication rounds, stop the adaptive differential privacy federated learning training based on personalized local momentum. Otherwise, return to S1 and continue the next round of training.

[0031] In this embodiment, in S1, the cloud server initializes the clipping threshold C 0 =1 before the training starts. Before each round of communication, s clients are selected. The strategy for selecting clients is the client random scheduling strategy, that is, s clients are randomly sampled in each round of communication. The sampling formula is: s = qU where q is the sampling factor, 0 < q < 1, and U is the total number of clients; After selecting the clients, the cloud server broadcasts the global model of the t-th round of communication and the clipping threshold C t to the selected clients.

[0032] In this embodiment, in S2, each client executes an optimization algorithm according to the task type and model architecture to update its corresponding local model parameters. This process can be iterated multiple times. The local model parameters are updated in each round of iteration. When the client completes the preset number of rounds of local model iteration, according to the clipping threshold C t received from the cloud server, the local model parameters are clipped and noise is added, and the updated and noisy local model parameters are uploaded to the cloud server.

[0033] In this embodiment, S2 further includes: S21. Each client stores personalized momentum locally. After the selected client receives the global model broadcast by the cloud server, it initializes the client model using the local personalized momentum:

[0034] where: i represents the client; t represents the communication round; represents the initial model of client i in the t-th round of communication, i.e., the model of the 0-th local iteration; represents the personalized momentum of client i in the t-th round of communication; S22. Client i uses the local dataset D i for training to as the loss function, where x j represents the input feature of the j-th sample in the local dataset, and y j represents the true label corresponding to the j-th sample in the local dataset. Then, the loss function of client i on the local dataset D i is defined as:

[0035] Client i uses the corrected initial model , and uses the local dataset D i to solve for the optimal parameter w. The goal is to find the optimal model parameters that minimize the loss function ; S23. Client i performs k rounds of local iteration based on the stochastic gradient descent algorithm, and the update method is:

[0036] where η represents the calculation model update step size, represents the model gradient, represents the model of client i in the k-th round of local iteration, represents the model of client i in the (k - 1)-th round of local iteration; S24. After client i finishes the local iteration, it calculates the local update Δw i as:

[0037] where, represents the model of client i after performing k rounds of local iteration in the t-th round of communication; and updates the personalized local momentum as:

[0038] where λ 1 and λ 2 are momentum coefficients, and 0 < λ 1 < 1, 0 < λ 2 < 1, represents the personalized momentum of client i in the (t + 1)-th round of communication; S25. According to the clipping threshold C received by the cloud server tFor the local update Δw i Perform clipping:

[0039] And add Gaussian noise that satisfies ε-differential privacy:

[0040] Where: ε represents the privacy protection strength. The smaller the value of ε, the more noise is added, and the greater the privacy protection strength; represents Gaussian noise, and σ is the noise multiplier coefficient; represents the model parameters of client i after clipping; represents the model parameters of client i after adding Gaussian noise; S26. After adding noise, client i uploads the parameter to the cloud server.

[0041] In this embodiment, in S3, after the cloud server receives all the client models participating in training in this round of communication, it performs weighted average aggregation on the client model parameters:

[0042] Where: represents the new global model; represents the total size of the datasets of the s sampled clients.

[0043] In this embodiment, in S4, the cloud server calculates the cross-entropy loss value L of the aggregated new global model on the validation set t , and adaptively adjusts the clipping threshold C for the next round of communication using the following formula t+1 , if the loss value L t continually decreases in three consecutive communication rounds, then adjusts the clipping threshold C t :

[0044] Where β is the clipping threshold decay coefficient, and 0 < β < 1, and L t represents the central-side loss of the global model in the t-th round.

[0045] To verify the application of the present invention, a specific experiment will be provided below to further illustrate this adaptive differential privacy federated learning training method: Experimental environment: The experiment considers training in a distributed framework consisting of a cloud server and 100 clients to be involved in training.

[0046] In local training, a convolutional neural network is considered as the model and validated on the CIFAR-10 and CIFAR-100 datasets. The model initializes three convolutional layers and three fully connected layers, and max pooling operations are used after the convolutional layers. Among them: the first convolutional layer has 3 input channels, 16 output channels, a convolutional kernel size of 3, and a padding of 1. The second convolutional layer has 16 input channels, 32 output channels, a convolutional kernel size of 3, and a padding of 1. The third convolutional layer has 32 input channels, 32 output channels, a convolutional kernel size of 3, and a padding of 1. The first fully connected layer has 32×4×4 input nodes and 32×4×4 output nodes. The second fully connected layer has 32×4×4 input nodes and 32×2×2 output nodes. The third fully connected layer has 32×2×2 input nodes and 10 output nodes. The input data passes through the first convolutional layer, then ReLU activation and max pooling are performed, then through the second convolutional layer, ReLU activation and max pooling are also performed, then through the third convolutional layer, and ReLU activation and max pooling are performed again. Finally, the data is flattened to 32×4×4, passes through the first fully connected layer and ReLU activation is applied, then through the second fully connected layer and ReLU activation is applied, and finally the output result is returned through the three fully connected layers.

[0047] This experiment uses the CIFAR-10 and CIFAR-100 datasets for validation. The CIFAR-10 dataset contains 60,000 images in 10 categories, including 50,000 training images and 10,000 test images. The CIFAR-100 dataset is an extended version of CIFAR-10, containing 60,000 images in 100 categories, including 50,000 training images and 10,000 test images. Compared with CIFAR-10, CIFAR-100 contains more categories and higher challenges, and is suitable for more complex image classification tasks. For the training set data, this experiment uses the Dirichlet Data Partitioning strategy to simulate the non-independent and identically distributed scenario, which is characterized by being able to generate an unbalanced and biased data distribution.

[0048] In this experiment, the system model parameters are configured as shown in Table 1 below: Table 1 System Model Parameter Configuration Table

[0049] Comparative experiment settings: The performance of the method proposed in the present invention is compared with several latest methods in differential privacy federated learning, including the differential privacy federated learning algorithm (DP-FedAvg) and the differential privacy federated learning algorithm based on sharpness-aware minimization (DP-FedSAM).

[0050] Conclusion analysis: The experimental results are as Figure 2 shown. It can be seen that the method of the present invention significantly outperforms the comparative algorithms DP-FedAvg and DP-FedSAM in differential privacy federated learning. In terms of the improvement of the test set accuracy, the method of the present invention shows faster convergence speed and higher final accuracy on both CIFAR-10 and CIFAR-100 datasets. During the entire training process, the accuracy significantly exceeds the comparative algorithms, and finally reaches approximately 56% on the CIFAR-10 dataset and approximately 23% on the CIFAR-100 dataset. This indicates that the present invention effectively alleviates the bias problem introduced by differential privacy noise in the global model through the personalized momentum mechanism and dynamic pruning threshold adjustment, enabling the client to quickly adjust and optimize the local model, and improving the efficiency and effect of federated learning.

[0051] The embodiment of the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to execute the steps of the above-mentioned adaptive differential privacy federated learning training method.

[0052] Refer to Figure 3 , the embodiment of the present invention also provides a computer device including a memory and a processor, where the memory stores a computer program, and when the computer program is executed by the processor, it causes the processor to execute the steps of the above-mentioned adaptive differential privacy federated learning training method.

[0053] The embodiment of the present invention also provides a computer program product containing instructions, which, when running on a computer, causes the computer to execute the steps of the above-mentioned adaptive differential privacy federated learning training method.

[0054] It can be understood that the system, device, and storage medium provided by the embodiment of the present invention correspond to the method provided by the embodiment of the present invention. The explanations, examples, and beneficial effects of related content can refer to the corresponding parts in the above-mentioned adaptive differential privacy federated learning training method.

[0055] It should be noted that those of ordinary skill in the art can understand that all or part of the steps implemented in the embodiments of the present invention can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using hardware, it can be implemented in whole or in part in the form of purchasing standard parts or modified parts. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more integrated available media. The available medium can be a magnetic medium (such as a floppy disk, hard disk, magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

[0056] In summary, to address the dual challenges of data heterogeneity and privacy-utility balance faced by differential privacy federated learning, the present invention proposes an adaptive differential privacy federated learning training method, which has two complementary innovations in differential privacy federated learning: First, the personalized momentum mechanism accelerates the early convergence of the model and improves communication efficiency; Second, the dynamic pruning threshold adjustment optimizes the later training process of the model, further improving accuracy and generalization ability. The above experimental results further fully demonstrate that the present invention achieves a good balance between privacy protection and model performance, providing strong support for the practical application of differential privacy federated learning in privacy-sensitive scenarios.

[0057] It should be understood that the examples and embodiments described herein are for illustrative purposes only and are not intended to limit the present invention. Those skilled in the art can make various modifications or changes based on it. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. An adaptive differential privacy federated learning training method, characterized in that: It includes the following steps: S1. The cloud server selects clients according to the client random scheduling policy, and broadcasts the global model parameters and the clipping threshold to the selected clients; S2. The selected clients use the personalized local momentum mechanism to correct the global model, form the client model, and perform client model training locally; S3. After the cloud server receives all the client models participating in the training in this round, it aggregates the client model parameters to generate a new global model; S4. Calculate the loss value of the new global model. If the loss value decreases continuously for three rounds, adjust the clipping threshold until the aggregation times of the client models reach the preset communication rounds; S5. When the aggregation times of the client models reach the preset communication rounds, stop the adaptive differential privacy federated learning training based on the personalized local momentum. Otherwise, return to S1 and continue the next round of training.

2. The adaptive differential privacy federated learning training method according to claim 1, characterized in that: In S1, the cloud server initializes the clipping threshold C0 = 1 before the training starts, and selects s clients before each round of communication. The policy for selecting clients is the client random scheduling policy, that is, randomly sample s clients in each round of communication. The sampling formula is: s = qU where q is the sampling factor, 0 < q < 1, and U is the total number of clients; After selecting the client, the cloud server will send the global model of the tth round of communication and the clipping threshold C t Broadcast to selected clients.

3. The adaptive differential privacy federated learning training method according to claim 1, characterized in that: In S2, each client executes the optimization algorithm according to the task type and model architecture to update the corresponding local model parameters. This process can be repeated for multiple rounds, and each round of iteration will update the local model parameters. When the client completes the preset rounds of local model iteration, it updates the local model parameters according to the clipping threshold C received by the cloud server. t The local model parameters are trimmed and noise is added, and the updated noisy local model parameters are uploaded to the cloud server.

4. The adaptive differential privacy federated learning training method according to claim 3, characterized in that: S2 further includes: S21. Each client stores personalized momentum locally. The selected client receives the global model broadcasted by the cloud server. Finally, initialize the client model with local personalized momentum: Among them: i represents the client; t represents the communication round; represents the initialization model of client i in the tth round of communication, that is, the 0th local iteration model; represents the personalized momentum of client i in the tth round of communication; S22, client i uses local data set D i Conduct training to is the loss function, where x j Represents the input features of the jth sample in the local dataset, y j represents the true label corresponding to the jth sample in the local dataset, then client i has i The loss function on is defined as: Client i uses the modified initialization model , using the local dataset D i Solve for the optimal parameter w. The goal is to find the optimal model parameter that minimizes the loss function ; S23. The client i performs k rounds of local iterations based on the stochastic gradient descent algorithm, and the update method is: Among them, η represents the update step of the calculation model, represents the model gradient, represents the model of the kth round of local iteration of client i, Represents the model of the local iteration of client i in round k-1; S24, after client i finishes local iteration, calculate the local update Δw i for: in, represents the model after client i performs k rounds of local iterations in the tth round of communication; And update the personalized local momentum as: Where λ1 and λ2 are momentum coefficients, and 0<λ1<1, 0<λ2<1, represents the personalized momentum of client i in the t+1th round of communication; S25, according to the clipping threshold C received by the cloud server t Update Δw locally i To crop: And add Gaussian noise that satisfies ε-differential privacy: Among them: ε represents the privacy protection strength. The smaller the ε value, the more noise is added, and the greater the privacy protection strength; represents Gaussian noise, σ is the noise multiplier coefficient; Represents the model parameters after the client i is pruned; represents the model parameters after Gaussian noise is added to client i; S26, after the noise is added, the client i sets the parameter Upload to the cloud server.

5. The adaptive differential privacy federated learning training method according to claim 1, characterized in that: In S3, after the cloud server receives all the client models participating in the training in this round of communication, it performs weighted average aggregation on the client model parameters: Among them: represents the new global model; Represents the total size of the dataset of the sampled s clients.

6. The adaptive differential privacy federated learning training method according to claim 1, characterized in that: In S4, the cloud server uses the aggregated new global model to calculate the cross entropy loss value L on the validation set. t , use the following formula to adaptively adjust the clipping threshold C for the next round of communication t+1 , if the loss value L t If it decreases continuously in three communication rounds, the pruning threshold C is adjusted. t : Among them, β is the clipping threshold decay coefficient, and 0<β<1, L t represents the central side loss of the global model in the tth round.

7. A computer-readable storage medium, characterized in that: There is a computer program stored. When the computer program is executed by a processor, the processor is caused to execute the steps of the adaptive differential privacy federated learning training method according to any one of claims 1-6.

8. A computer device, characterized in that: It includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor is caused to execute the steps of the adaptive differential privacy federated learning training method according to any one of claims 1-6.

Images