Data privacy protection method for federal learning and related equipment

Abstract

The invention discloses a data privacy protection method and system for federal learning, electronic equipment and a computer readable storage medium, which are used for solving the problem. The method comprises the following steps: each computing node participating in federated learning obtains an encryption parameter value obtained by encrypting a value of a parameter of a second privacy protection model by respectively executing a specified operation; respectively sending the encryption parameter values to an aggregation center; wherein the second privacy protection model is a global model of federal learning and is used for executing a specified task; the aggregation center aggregates the values of the encrypted parameters to obtain an aggregation model update set, and sends the aggregation model update set to each computing node; and training the local second privacy protection model of each computing node by each computing node based on the aggregation model update set and local business data to obtain a final model for executing the specified task.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular, to a data privacy protection method, system, electronic device, computer-readable storage medium, and computer program product for federated learning. Background Art

[0002] Federated learning is a technology that allows multiple data owners to collaboratively train a machine learning model without sharing the original sample data. Its core concept lies in "the data does not move while the model moves", that is, each participating party trains the model locally and only uploads the model updates (such as gradient information) to the central server for aggregation, thereby generating a global model. This process effectively avoids the direct transmission of data and greatly reduces the risk of data leakage.

[0003] Data privacy protection refers to taking necessary technical and management measures during the processes of data collection, storage, processing, analysis, and sharing to ensure the confidentiality, integrity, and availability of personal data, and to prevent unauthorized access, use, modification, and disclosure, etc.

[0004] Although federated learning in the prior art already has a relatively high level of data privacy protection, with the rapid development and wide application of big data technology, how to further improve its performance in data privacy protection remains an urgent problem to be solved. Summary of the Invention

[0005] An embodiment of this application provides a data privacy protection method for federated learning to solve the problem in the prior art of how to improve the performance of federated learning in data privacy protection.

[0006] An embodiment of this application also provides a data privacy protection system, electronic device, computer-readable storage medium, and computer program product for federated learning.

[0007] The embodiments of this application adopt the following technical solutions: A data privacy protection method for federated learning, characterized in that the method includes: Each computing node participating in federated learning obtains an encrypted parameter value obtained by encrypting the value of the parameter of the second privacy protection model by respectively performing a specified operation; and respectively sends the encrypted parameter value to the aggregation center; wherein, the second privacy protection model is the global model of the federated learning and is used to perform a specified task; The aggregation center aggregates the encrypted parameter values to obtain an aggregated model update set, and then sends the aggregated model update set to each computing node; Each of the computing nodes trains the second privacy protection model local to each of the computing nodes based on the aggregated model update set and local service data to obtain a final model for performing the specified task; Among them, the specified operation includes the following operations: By inputting the features of the obtained local service data into a model to be trained for performing the specified task, training the model to be trained to obtain the trained model to be trained as a first local privacy protection model; After inputting the features of the local service data into the first local privacy protection model, obtaining the features of the specified intermediate layer output of the first local privacy protection model as the distilled first model knowledge; Sending the distilled first model knowledge, the values of the first parameters of the first local privacy protection model, and the predicted first soft labels to other computing nodes participating in the federated learning, and receiving the distilled second model knowledge, the values of the second parameters, and the predicted second soft labels corresponding to the first local privacy protection models local to other computing nodes sent by other computing nodes; Training the first local privacy protection model based on the second model knowledge, the values of the second parameters, and the second soft labels to obtain a second privacy protection model; Obtaining and encrypting the values of the parameters of the second privacy protection model to obtain the encrypted parameter values.

[0008] A data processing system, the system includes each computing node participating in federated learning and an aggregation center; among them: Each of the computing nodes is used to: obtain encrypted parameter values obtained after performing an encryption operation on the values of the parameters of the second privacy protection model by respectively performing specified operations; respectively send the encrypted parameter values to the aggregation center; respectively train the second privacy protection model local to each of the computing nodes based on the aggregated model update set and local service data to obtain a final model for performing the specified task; among them, the second privacy protection model is the global model of the federated learning and is used to perform the specified task; The aggregation center is used to: aggregate the encrypted parameter values to obtain an aggregated model update set, and then send the aggregated model update set to each of the computing nodes; Among them, the specified operation includes the following operations: By inputting the features of the obtained local service data into a model to be trained for performing the specified task, training the model to be trained to obtain the trained model to be trained as a first local privacy protection model; After inputting the features of the local service data into the first local privacy protection model, obtain the features output by a specified intermediate layer of the first local privacy protection model as the distilled first model knowledge; Send the distilled first model knowledge, the values of the first parameters of the first local privacy protection model, and the predicted first soft labels to other computing nodes participating in the federated learning, and receive the distilled second model knowledge, the values of the second parameters, and the predicted second soft labels corresponding to the first local privacy protection models of other computing nodes sent by other computing nodes; Train the first local privacy protection model based on the second model knowledge, the values of the second parameters, and the second soft labels to obtain a second privacy protection model; Obtain the values of the parameters of the second privacy protection model and encrypt them to obtain the encrypted parameter values.

[0009] An electronic device includes: a memory and a processor, where The memory is used to store a program; the processor is coupled to the memory and is used to execute the program stored in the memory to implement the operations performed by the computing node or the aggregation center in the above-mentioned data privacy protection method for federated learning.

[0010] A computer-readable storage medium storing a computer program, where the computer program, when executed by a computer, can implement the operations performed by the computing node or the aggregation center in the above-mentioned data privacy protection method for federated learning.

[0011] A computer program product stores instructions, and when the instructions are executed by a computer, the computer is caused to implement the operations performed by the computing node or the aggregation center in the above-mentioned data privacy protection method for federated learning.

[0012] The above-mentioned at least one technical solution adopted in the embodiments of the present application can achieve the following beneficial effects: On the one hand, by sharing the distilled model knowledge (instead of sharing the original data) among the computing nodes participating in the federated calculation, the purpose of both realizing multi-party data fusion and protecting data privacy is achieved; on the other hand, by encrypting the values of the parameters of the model and then sharing them among the computing nodes, multi-party data secure sharing and fusion are further realized. Through such highly privacy-protected measures in multiple links, this method can ensure the protection of the data privacy of all parties participating in the federated training and improve the performance of federated learning in terms of data privacy protection. Description of the Drawings

[0013] The accompanying drawings described herein are used to provide a further understanding of the present application, and constitute a part of the present application. The schematic embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation of the present application. In the drawings: Figure 1 It is a specific implementation flowchart of a data privacy protection method for federated learning provided by an embodiment of the present application; Figure 2 It is a schematic diagram of a specific process when the data privacy protection method for federated learning provided by an embodiment of the present application is applied in practice; Figure 3 It is a schematic diagram of a specific implementation process of step 21; Figure 4 It is a schematic diagram of a specific implementation process of step 22; Figure 5 It is a schematic diagram of a specific implementation process of step 23; Figure 6 It is a schematic diagram of a specific implementation process of step 24; Figure 7 It is a schematic diagram of a specific implementation process of step 25; Figure 8 It is a schematic diagram of a specific implementation process of step 26; Figure 9 It is a schematic diagram of a specific implementation process of step 27; Figure 10 It is a schematic diagram of a specific implementation process of step 28; Figure 11 It is a schematic diagram of a specific implementation process of step 29; Figure 12 It is a schematic diagram of a specific implementation process of step 210; Figure 13 It is a schematic diagram of a specific implementation process of step 211; Figure 14 It is a schematic diagram of a specific implementation process of step 212; Figure 15 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0014] To make the objectives, technical solutions, and advantages of the present application clearer, the technical solutions of the present application will be clearly and completely described below in conjunction with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts shall fall within the scope of protection of the present application.

[0015] As is known to those of ordinary skill in the art, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0016] The terms "first", "second", etc. in the specification, claims and the above-mentioned drawings of the present application are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that such terms can be interchanged under appropriate circumstances, which is only a way of distinction adopted when describing objects with the same attributes in the embodiments of the present application. In addition, the terms "comprising", "having" and any variations thereof are intended to cover non-exclusive inclusion, so that a process, method, system, product or device comprising a series of units does not have to be limited to those units, but may include other units that are not clearly listed or are inherent to these processes, methods, products or devices.

[0017] Embodiment 1 In terms of the principle of federated learning, it mainly lies in fusing multi-party data information through privacy protection technology to collaboratively build a global model, while ensuring the data privacy of each participating party is protected. The core idea of federated learning is to utilize the data sets scattered in each participating party, and by exchanging intermediate results such as model parameters and gradients, rather than sharing the original data, thereby greatly reducing the risk of data leakage and protecting the data privacy of the participating parties.

[0018] Starting from this principle and core idea, the inventor conducted research and developed a data privacy protection method for federated learning to solve the problem in the prior art of how to improve the performance of federated learning in terms of data privacy protection. On the one hand, this method achieves the purpose of both realizing multi-party data fusion and protecting data privacy by sharing the distilled model knowledge (instead of sharing the original data) among the computing nodes participating in the federated calculation; on the other hand, it further realizes the secure sharing and fusion of multi-party data by encrypting the values of the model parameters and then sharing them among the computing nodes. Through such measures of high privacy protection in multiple links, this method can ensure the data privacy of each participating party in the federated training and improve the performance of federated learning in terms of data privacy protection.

[0019] The execution subject of this method can be any computing device, or it can also be software running on a computing device. The embodiments of the present application do not limit what kind of computing device or software the execution subject is.

[0020] In addition, different steps of this method can be implemented by different computing devices or software. The embodiments of the present application do not limit which computing device or software is specifically used to implement which step.

[0021] For ease of description, the following takes the execution entity of this method as a BI system as an example to elaborate on the method provided in the embodiments of this application in detail.

[0022] Please refer to the attached Figure 1 FIG. is a specific implementation flowchart of a data privacy protection method for federated learning provided by an embodiment of this application, including the following steps: Step 11: Each computing node participating in federated learning obtains encrypted parameter values obtained by encrypting the values of the parameters of the second privacy protection model through respectively executing specified operations; and sends the encrypted parameter values to the aggregation center respectively; Among them, the second privacy protection model is the global model of federated learning and is used to execute specified tasks.

[0023] Among them, the specified operations include the following operations: By inputting the features of the obtained local service data into the to-be-trained model for executing specified tasks, training the to-be-trained model to obtain the trained to-be-trained model as the first local privacy protection model; After inputting the features of the local service data into the first local privacy protection model, obtaining the features of the specified intermediate layer output of the first local privacy protection model as the distilled first model knowledge; Sending the distilled first model knowledge, the values of the first parameters of the first local privacy protection model, and the predicted first soft labels to other computing nodes participating in federated learning, and receiving the distilled second model knowledge, the values of the second parameters, and the predicted second soft labels corresponding to the first local privacy protection models of other computing nodes sent by other computing nodes; Training the first local privacy protection model based on the second model knowledge, the values of the second parameters, and the second soft labels to obtain the second privacy protection model; Obtaining the values of the parameters of the second privacy protection model for encryption to obtain encrypted parameter values.

[0024] In an optional implementation manner, the features of the above local service data can be obtained in the following manner: Each computing node trains a student model by using the knowledge distillation technology based on soft targets based on a pre-trained teacher model for executing specified tasks; After each computing node inputs the local service data into the student model, obtaining the features of the specified intermediate layer output of the student model as the features of the local service data.

[0025] Step 12: After the aggregation center aggregates the encrypted parameter values to obtain an aggregated model update set, sending the aggregated model update set to each computing node; Step 13: Each computing node respectively trains the second privacy protection model local to each computing node based on the aggregation model update set and local service data to obtain a final model for performing a specified task.

[0026] In an alternative implementation, step 13 may be specifically implemented in the following manner: Each computing node decrypts the encrypted data in the aggregation model update set to obtain the values of the parameters of the second privacy protection model from each computing node. Each computing node respectively calculates the weighted average of the values of the parameters of each second local privacy protection model, and updates the value of the parameters of the second local privacy protection model local to it to the calculated weighted average to obtain a second local privacy protection model with updated parameter values. Each computing node trains the second local privacy protection model with updated parameter values local to it based on local service data by using an adaptive learning rate mechanism to obtain a final model for performing a specified task.

[0027] In an alternative implementation, "each computing node trains the second local privacy protection model with updated parameter values local to it based on local service data by using an adaptive learning rate mechanism to obtain a final model for performing a specified task" may specifically include: Each computing node respectively executes: Adjust the preset privacy budget according to the privacy loss accumulated by the second local privacy protection model with updated parameter values local to it, the preset privacy budget, and the received task requirements. Based on the adjusted privacy budget, determine the noise to be added to the local service data. Based on the local service data with added noise, train the second local privacy protection model with updated parameter values local to it by using an adaptive learning rate mechanism to obtain a final model for performing a specified task.

[0028] In an alternative implementation, "based on the local service data with added noise, train the second local privacy protection model with updated parameter values local to it by using an adaptive learning rate mechanism to obtain a final model for performing a specified task" may specifically include: Each computing node respectively trains the second local privacy protection model with updated parameter values local to it based on the local service data with added noise by using an adaptive learning rate mechanism to obtain an adaptive update model. Each computing node respectively trains the adaptive update model by using adversarial training techniques to obtain a robust privacy protection model as the final model for performing a specified task.

[0029] By adopting the above method used in the embodiments of the present application, on the one hand, by sharing the distilled model knowledge (instead of sharing the original data) among the computing nodes participating in the federated computing, the purpose of realizing multi-party data fusion while protecting data privacy is achieved; on the other hand, by encrypting the values of the model parameters and then sharing them among the computing nodes, multi-party data secure sharing and fusion are further realized. Through such measures of high-level privacy protection in multiple links, this method can ensure the protection of the data privacy of all parties participating in the federated training and improve the performance of federated learning in terms of data privacy protection.

[0030] Embodiment 2 The following introduces a specific application example of the above method provided by the embodiments of the present application in an actual scenario.

[0031] Specifically, the specific implementation process of this application example is as Figure 2 shown and includes the following steps: Step 21: Each computing node participating in the federated learning respectively uses the knowledge distillation technology to perform feature representation on the original sample data for training the privacy protection model, and generates a distillation feature set composed of compact feature vectors of the original sample data; The privacy protection model mentioned here is a machine learning model that each computing node participating in the federated learning needs to cooperate in training, that is, the global model in the federated learning. This model is intended to perform specified tasks, including but not limited to: user classification tasks, image processing tasks, speech recognition tasks, natural language processing tasks, or recommendation system tasks, etc.

[0032] Knowledge distillation is a model compression technology, and its core idea is to guide a lightweight student model to "imitate" a teacher model with better performance and more complex structure, so as to improve its performance without changing the structure of the student model.

[0033] Feature representation refers to converting data into a format that a machine learning model can understand and process. Feature representation is an important link in data preprocessing, which directly affects the performance and effect of the model. Through reasonable feature representation, the generalization ability and prediction accuracy of the model can be improved.

[0034] The original sample data can be, for example, but not limited to, any business data. Among them, business data is the data generated during the business processing process or thing processing, generally including: user data, transaction data, behavior data, product data, operation data, log data. A number of original sample data constitute an original sample data set, and the data sources of the original sample data set include but are not limited to users, servers, or data storage systems.

[0035] The following will introduce Embodiment 2 of the present application by taking the original sample data as business data as an example.

[0036] In an alternative embodiment, taking any computing node as an example, step 21 may include sub-steps as Figure 3 shown. Figure 3 The specific process shown includes the following sub-steps: Sub-step 2011: The computing node obtains the original sample data set, performs data cleaning on the original sample data set, and obtains the preprocessed data set; Data cleaning may specifically include, but is not limited to, performing operations such as removing noise, filling in missing values, standardizing, and normalizing the original sample data in the original sample data set.

[0037] These operations performed on the original sample data can be implemented using related mature technologies, and the embodiments of the present application will not elaborate on this.

[0038] By executing sub-step 2011, the data quality can be ensured, providing a basis for subsequent feature extraction.

[0039] Sub-step 2012: The computing node uses the preprocessed data set to train an initial model for performing a specified task; Specifically, sub-step 2012 may include the following content: 1. First, the preprocessed data set is split into a training set, a validation set, and a test set.

[0040] During the model training process, the roles of the training set, the validation set, and the test set are as follows: The training set is used for the model to learn the patterns and relationships in the data and is the main data source for model training.

[0041] The validation set is used to adjust the model parameters during the model training process to prevent overfitting and help select the best model structure.

[0042] The test set is used to evaluate the generalization ability of the model after the model training is completed, that is, the performance of the model on unseen data. In this way, it can be ensured that the model not only performs well on the training data but also can adapt to a new data environment.

[0043] 2. Select a suitable model architecture. Generally, a suitable model framework can be selected according to the characteristics of the data in the preprocessed data set and the type of the specified task (such as a classification task, a regression task, or others).

[0044] Specifically: First, the dimensions and feature types of the preprocessed data set can be analyzed to determine the data complexity that the model needs to handle. For example, if the data set contains high-dimensional features, a model that can capture complex relationships between features, such as a deep learning model like Transformer, may be required.

[0045] Secondly, consider the nature of the task. For classification tasks, traditional machine learning models such as support vector machines (SVMs) or decision trees can be selected, or deep learning models such as Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) can be used. For regression tasks, linear regression, ridge regression, or Deep Neural Networks (DNNs) may be more suitable choices.

[0046] Thirdly, evaluate the size of the preprocessed dataset. For large-scale datasets, models that can effectively process large amounts of data, such as deep learning models with a large number of parameters, need to be selected to fully utilize the information in the dataset.

[0047] Finally, consider the interpretability of the model. In some applications, such as medical diagnosis, the decision-making process of the model needs to be interpretable so that users can understand the basis for the model's predictions. In such cases, selecting a model with high transparency, such as a decision tree or logistic regression, may be more appropriate.

[0048] In an alternative implementation, a technician can manually control the computing node to select an appropriate model framework based on the characteristics of the data in the preprocessed dataset and the characteristics of the specified task, taking the above considerations into account.

[0049] 3. Select an appropriate loss function and optimizer.

[0050] Among them, the loss function is used to measure the difference between the predicted value and the true value of the model, and the optimizer is used to update the weights of the model to minimize the loss function. For example, if the type of the specified task is a classification task, the cross-entropy loss function can be selected; the optimizer can be selected from optimizers such as Stochastic Gradient Descent (SGD) optimizer or Adam optimizer.

[0051] Of course, in an alternative implementation, a technician can select an appropriate loss function and optimizer.

[0052] 4. Input the data in the training set into the input layer of the selected model framework, calculate the prediction result through forward propagation, then calculate the loss through the selected loss function, then calculate the gradient of the loss function with respect to the model parameters through the backpropagation algorithm, and finally use the optimizer to update the parameters of the model according to the gradient. This process will be repeated for multiple epochs until the performance of the model on the validation set no longer improves significantly or reaches the preset number of training epochs.

[0053] After each training cycle, use the validation set to evaluate the model performance, such as accuracy, recall, or other task-related performance metrics. Based on the validation results, it may be necessary to adjust the model parameters, such as the magnitude of the learning rate, the architecture of the model, the strength of the regularization term, etc. The purpose of the adjustment is to improve the generalization ability of the model and avoid overfitting.

[0054] After evaluation on the validation set, when the performance on the validation set no longer improves significantly, use the model at this time as the initial model. The main role of the initial model is to learn effective feature vectors from the preprocessed dataset, thereby obtaining important information about the data in the preprocessed dataset and filtering out irrelevant noise.

[0055] Sub-step 2013: Use the initial model to generate a distilled feature set through knowledge distillation technology.

[0056] Knowledge distillation, that is, Knowledge Distillation, refers to first training a large model (generally called the teacher model), and then training a small model (generally called the student model or the distilled model) to imitate the representation learning ability of the trained large model.

[0057] The goal of knowledge distillation is to make the distribution of the output of the softmax layer of the distilled model be sufficiently close to the distribution of the output of the softmax layer of the teacher model. From the perspective of technical implementation, the specific implementation idea of knowledge distillation is: increase the temperature parameter (a hyperparameter in the softmax function) of the softmax layer of the teacher model to obtain a suitable set of soft targets (that is, the prediction results output by the teacher model), and then for the distilled model to be trained, use the same temperature parameter value to match the set of soft targets of the teacher model as part of the total objective function of the distilled model to induce the training of the distilled model and achieve the transfer of knowledge.

[0058] In the embodiments of this application, a knowledge distillation technology based on soft targets (logits) can be specifically used to train the distilled model. According to this technology, the distilled model is trained to imitate the soft targets (logits) generated by the teacher model instead of hard labels. The temperature parameter is used to smooth the logits, and the loss function is usually a combination of the standard classification loss (such as cross-entropy loss) and the distillation loss, and the latter minimizes the difference between the distilled model and the teacher model in the soft targets.

[0059] Among them, the soft targets of the model refer to, in machine learning, in addition to the hard targets, the targets for further optimizing or improving the model performance. Soft targets are usually further optimization metrics for the model performance, such as accuracy, recall, or F1 score, etc. These targets are not requirements that the model must meet, but can help improve the model performance. By learning these soft labels of the teacher model, the distilled model can better capture the prediction distribution of the teacher model, thereby reducing the model size while maintaining the performance. In this way, the distilled model not only learns how to predict, but also learns how to predict in a way closer to the teacher model, which helps improve the generalization ability of the model.

[0060] Generally, the teacher model is usually trained using data with true labels; while the distilled model can be trained using unlabeled data. Specifically, the teacher model is used to perform labeled prediction on the unlabeled data to generate pseudo-labels, and then the appropriate unlabeled data is selected and trained together with its pseudo-labels for the distilled model. This process of "labeling, screening, and training" is carried out multiple times until a distilled model with qualified performance is obtained.

[0061] In the embodiments of this application, the initial model is used as the teacher model, and the selected small model is used as the distilled model, and knowledge distillation is carried out using the knowledge distillation technology based on soft targets (logits). Specifically, the specific implementation manner of sub-step 213 may include: 1. First, input the business data in the preprocessed data set into the initial model (teacher model) to obtain the soft labels (Soft labels, that is, probability distributions) obtained by the initial model (teacher model) based on the input business data for prediction.

[0062] Depending on the specific tasks, the soft labels may have different situations. Taking the business data as the user data, transaction data, behavior data, and product data of users applying for insurance claims in an insurance company, and the specified task performed by the initial model being a classification task - classifying users into ordinary users and users suspected of insurance fraud as an example, the soft labels can be the probabilities that the user is an ordinary user or a user suspected of insurance fraud.

[0063] 2. Then, train the distilled model using the knowledge distillation technology based on soft targets (logits) to make its output as close as possible to the soft labels of the initial model, rather than directly learning the preprocessed data set; In this way, the distilled model can learn the knowledge of the initial model without accessing the preprocessed dataset. Among them, the soft label is the class probability distribution output by the initial model when predicting the input data. Training the distilled model with soft labels can help the distilled model better learn the knowledge of the initial model. The smooth probability distribution of the soft labels enables the distilled model to pay more attention to the relationships between different classes during training, rather than just focusing on the most likely class, which helps to improve the generalization ability and robustness of the distilled model.

[0064] 3. After the distilled model is trained, several data in the preprocessed dataset are input into the trained distilled model, so that the distilled model calculates the outputs of each layer of the distilled model through forward propagation; and during the forward propagation process, the output of the specified intermediate layer of the distilled model is obtained; Among them, the features of the output of the specified intermediate layer are usually in the form of high-dimensional vectors or tensors. The specified intermediate layer can be a fully connected layer, a convolutional layer of the distilled model, or some specific layers based on the task. In the embodiments of the present application, the principles for the specified intermediate layer may include: the feature expression ability of this layer, whether sufficient information is retained, and whether the redundancy and noise of the input data are removed.

[0065] It should be noted that in a deep learning model, the output of the intermediate layer usually contains an abstract representation of the input data, and these representations are called features. For a deep learning framework, a tensor is the basic unit of the output of the model intermediate layer. For example, in Convolutional Neural Networks (CNN), the output of each convolutional layer or pooling layer can be regarded as a tensor, and this tensor contains the feature map of this layer. These feature maps are abstract representations obtained after the input data undergoes convolution or pooling operations, and each feature map contains specific information of the input data at this layer.

[0066] 4. Store the outputs of the specified intermediate layer obtained by the distilled model based on several data in the preprocessed dataset, and these stored outputs together constitute the distilled feature set.

[0067] In some alternative embodiments, other types of knowledge distillation methods can also be used to train the student model. Other types of knowledge distillation methods include, but are not limited to: feature-based knowledge distillation, prompt-based knowledge distillation, and attention-based knowledge distillation, etc.

[0068] Step 22: Each computing node participating in federated learning uses the respective obtained distilled feature sets to locally train a first local privacy protection model at each computing node; the computing nodes share the distilled model knowledge with each other, and train the first local privacy protection model based on the distilled model knowledge to obtain a second local privacy protection model. In step 22, what is shared between different computing nodes is the distilled model knowledge, rather than directly sharing data, so as to achieve the effect of both sharing knowledge and avoiding data leakage, which plays a positive and active role in data privacy protection.

[0069] In the embodiments of this application, taking any computing node as an example, step 22 may include the following Figure 4 sub-steps: Sub-step 221: The computing node uses the obtained distilled feature set to train a first local privacy protection model to obtain a trained first local privacy protection model. In an optional implementation manner, the computing node may select a model architecture as the first local privacy protection model - for example, a simple feedforward neural network (FCN) may be selected as the first local privacy protection model.

[0070] Among them, FCN is also called a feedforward neural network, which is a most basic artificial neural network. In FCN, neurons are organized into multiple layers, and neurons in each layer are all connected to neurons in the previous layer and the next layer, but there is no connection between neurons in the same layer. Data propagates unidirectionally from the input layer to the output layer in the network, without feedback (or loop) connections, which is also the origin of the name "feedforward".

[0071] Each connection in FCN has a weight, and these weights are learned through training data. Each neuron calculates the weighted sum of all its inputs, and then obtains its output through an activation function (such as ReLU, sigmoid or tanh, etc.). This network structure of FCN can adapt to various tasks, such as classification, regression, etc.

[0072] FCN includes an input layer, a hidden layer and an output layer. Among them: Input layer, mainly responsible for receiving the data input into FCN (specifically, the features in the distilled feature set described in the embodiments of this application), and passing these input data to the neurons in the next layer.

[0073] The hidden layer is mainly responsible for receiving information from the neurons in the previous layer (for the input layer, it is the data input to the FCN). This information is aggregated after weight adjustment. The aggregation method is to multiply the output of each neuron in the previous layer by the corresponding weight and then sum them up. Next, this aggregated information is input into an activation function, such as the ReLU or sigmoid function. The role of the activation function is to introduce non-linearity in the neurons, enabling the neural network to learn and represent non-linear complex relationships. The output of the neurons in the hidden layer will continue to be passed to the neurons in the next layer for the same operation. Such operations progress layer by layer until the data is passed into the final output layer. In this way, the neural network can extract useful features from the original input data and use these features for prediction or classification.

[0074] The output layer is mainly responsible for generating the final output of the FCN. These outputs usually correspond to the results of prediction or classification tasks. For example, in a classification task, the number of neurons in the output layer usually equals the number of classification categories, and the output of each neuron represents the prediction probability of the corresponding category.

[0075] The first local privacy protection model is used to perform a specified task, such as the user classification task introduced above. The first local privacy protection model can be the global model in federated learning and is sent by the aggregation center to each computing node participating in federated learning. Correspondingly, each model subsequently trained based on the first local privacy protection model is a global model in federated learning.

[0076] In an optional implementation, the first local privacy protection model and the privacy protection model described in step 21 can be the same model; in another optional implementation, the first local privacy protection model and the privacy protection model described in step 21 can be different models.

[0077] In an optional implementation, the features in the distilled feature set (i.e., high-dimensional vectors / tensors and their corresponding labels) can be converted into PyTorch tensors to facilitate input into the FCN serving as the first local privacy protection model for training the first local privacy protection model.

[0078] Among them, the labels corresponding to the features in the distilled feature set are: the prediction results obtained by the distilled model after inputting several data in the preprocessed dataset into the trained distilled model. For example, continuing with the above example, if the specified task performed by the initial model is a classification task - classifying users into ordinary users and users suspected of insurance fraud, then the prediction results obtained by the distilled model (i.e., the labels described here) can be ordinary users or users suspected of insurance fraud.

[0079] During the training process of the first local privacy protection model, the loss function is used to evaluate the gap between the output of the first local privacy protection model and the actual labels (the prediction results obtained from the distillation model), and the cross-entropy loss function is usually used.

[0080] During the training process of the first local privacy protection model, an optimizer can be used to update the model parameters, such as the Adam optimizer.

[0081] Generally, the training process of the first local privacy protection model usually includes multiple epochs. In each epoch, the computing node can perform the following steps: Step (1): The computing node inputs the PyTorch tensor obtained by transforming the features in the distillation feature set into the first local privacy protection model, and obtains the prediction result of the first local privacy protection model based on this input.

[0082] Among them, the features in the distillation feature set can accurately represent the business data, and at the same time, it is only a high-dimensional feature expression of the business data, and does not directly represent the sensitive information carried by the business data.

[0083] Step (2): Use the loss function to calculate the loss between the prediction result obtained by the first local privacy protection model and the true label - this loss characterizes the difference between the label predicted by the first local privacy protection model and the true label.

[0084] Step (3): Calculate the gradient by calling loss.backward().

[0085] Step (4): Use the optimizer to update the model parameters.

[0086] In addition, the computing node can output the currently calculated loss every certain number of epochs.

[0087] Sub-step 222: Each computing node converts the knowledge of the trained first local privacy protection model (such as model parameters, intermediate layer outputs, etc.) into a form suitable for sharing; In the embodiments of the present application, the form suitable for sharing generally should satisfy: the knowledge existing in this form does not directly expose the business data in the preprocessed dataset.

[0088] Specifically, after the first local privacy protection model is trained, the PyTorch tensor obtained by transforming the features in the distillation feature set can be input into the first local privacy protection model, so that the first local privacy protection model calculates the outputs of each layer of the model through forward propagation; and during the forward propagation process, the output of the specified intermediate layer is obtained as the knowledge that can be shared, which is called the distilled model knowledge.

[0089] Among them, the specified intermediate layer can be the fully connected layer, convolutional layer of the first local privacy protection model, or some specific layers based on the task. In the embodiments of the present application, the principles for specifying the intermediate layer may include: the feature expression ability of this layer, whether sufficient information is retained, and whether the redundancy and noise of the input data are removed. The output of the specified intermediate layer is usually a high-dimensional vector or tensor.

[0090] Sub-step 223: Each computing node respectively executes: sending the distilled model knowledge (which can be called the distilled first model knowledge) obtained from its own trained first local privacy model, the values of the parameters of the first local privacy model, and the soft labels (Soft labels, that is, probability distributions) generated during the training process of the first local privacy model to other computing nodes participating in federated learning; Sub-step 224: Each computing node, according to its own trained first local privacy protection model and the "distilled model knowledge, parameter values, and soft labels corresponding to the first local privacy protection model of other computing nodes" sent by other computing nodes participating in federated learning, adjusts the first local privacy protection model to generate a second local privacy protection model.

[0091] For the convenience of distinguishing the description, from the perspective of each computing node itself, the distilled model knowledge, parameter values, and soft labels sent by other computing nodes can be respectively called the distilled second model knowledge, the values of the second parameters, and the second soft labels.

[0092] In the embodiments of the present application, in sub-step 224, the specific process of adjusting the first local privacy protection model to generate a second local privacy protection model may include: Calculating the weighted average of the values of each second parameter and the values of the parameters of the first local privacy protection model (which can be called the values of the first parameters), and updating the values of the parameters of the first local privacy protection model (the values of the first parameters) to the calculated weighted average; Inputting the distilled second model knowledge into the "first local privacy protection model with updated parameter values", and training the "first local privacy protection model with updated parameter values" with the goal of minimizing the function value of the loss function to obtain the trained "first local privacy protection model with updated parameter values" as the second local privacy protection model.

[0093] Among them, when training the "first local privacy protection model with updated parameter values", the true label used is the weighted average of the soft labels (which can be called the first soft labels) predicted by the first local privacy protection model local to the current computing node and the second soft labels sent by other computing nodes.

[0094] The difference between the second local privacy protection model and the first local privacy protection model lies in: As can be seen from the above training method of the second local privacy protection model, on the basis of the first local privacy protection model, the second local privacy protection model integrates the knowledge from other computing nodes and learns more extensive data features and patterns; at the same time, the generation of the second local privacy protection model is through the way of sharing knowledge rather than directly sharing business data, which further enhances privacy protection and improves the learning effect of the model. Therefore, there are at least two technical effects in the process of training the second local privacy protection model: 1. The trained second local privacy protection model can adapt to different data distributions and scenarios; 2. It avoids directly exchanging sensitive data and enhances privacy protection.

[0095] Step 23: Each computing node respectively uses an encryption algorithm to encrypt the parameter update value of the second local privacy protection model generated by itself to generate an encrypted model update set; Taking any computing node as an example, please refer to Figure 5 , step 23 may include the following sub-steps: Sub-step 231: After the computing node generates the second local privacy protection model locally, extract the parameter value of the second local privacy protection model; Sub-step 232: Use the Paillier encryption algorithm to perform an encryption operation on the parameter value described in sub-step 231; The Paillier encryption algorithm is a public key encryption algorithm, which is based on the difficult mathematical problem - the discrete logarithm problem. The core of this algorithm lies in its homomorphic property, that is, specific mathematical operations can be performed on ciphertexts, and the operation results are equivalent to the results of performing the same operations on plaintexts after decryption. Specifically, the encryption process of the Paillier algorithm involves the following steps: 1. First, select two large prime numbers p and q, and calculate their product n = pq. The length of n determines the security of encryption.

[0096] 2. Then, calculate the Euler's totient function of n, φ(n)=(p - 1)(q - 1), and select an integer g such that the result of g to the power of φ(n) modulo n is 1, and g is not divisible by n.

[0097] 3. Then, select a random number r, which is relatively prime to n, as part of the private key.

[0098] 4. The public key consists of (n, g), and the private key consists of (r, n).

[0099] 5. The encryption process multiplies the plaintext m by the n-th power of a random number r, and then takes the square of the result modulo n^2, i.e., the ciphertext c = (g^m * r^n) mod n^2.

[0100] 6. The decryption process uses the private key. By calculating the φ(n)-th power of the ciphertext c modulo n^2 and then dividing by n, the plaintext m is obtained.

[0101] Due to the homomorphic property of the Paillier algorithm, it is particularly suitable for scenarios that require calculations on ciphertexts, such as secure multi-party computation and privacy-preserving data mining. In the second local privacy protection model, using the Paillier algorithm to encrypt parameter values can ensure that sensitive data is not exposed.

[0102] In sub-step 232, specifically, the computing node uses the public key generated based on the Paillier encryption algorithm to encrypt the parameter value to ensure the security of the parameter value during subsequent transmission.

[0103] During the encryption process of the parameter value, different parameter values can be encrypted independently, but all encryption results can perform secure addition operations in subsequent aggregation operations.

[0104] Sub-step 233: After the computing node finishes encrypting all the parameter values, it constructs an encrypted model update set containing all the encrypted parameter values.

[0105] Step 24: Each computing node completes the aggregation of the encrypted model update sets of each computing node based on the Secure Multi-party Computation (SMC) protocol, and generates an aggregated model update set at the aggregation center; The Secure Multi-party Computation (SMC) protocol is a protocol that allows multiple participating parties to jointly calculate the value of a function without revealing their respective private data. In this protocol, each participating party only provides the encrypted form of its private data. Through a series of interactions and calculations, the encrypted result of the function is finally obtained without revealing the specific content of any private data.

[0106] The core of SMC is to ensure that the private data of the participating parties cannot be obtained by other parties during the calculation process through a series of protocols and algorithms, while still obtaining the correct calculation result. SMC usually involves complex cryptographic techniques such as secret sharing, homomorphic encryption, and zero-knowledge proof. These techniques can ensure the privacy of data and the correctness of calculations. In the second local privacy protection model, the use of the SMC protocol enables each computing node to securely aggregate the model update sets in the encrypted state, thereby realizing the joint optimization and update of the model while protecting data privacy.

[0107] Taking any computing node as an example, please refer to Figure 6 , step 24 may include the following sub-steps: Sub-step 241: The aggregation center receives the encrypted model update sets from each computing node participating in the federated learning; Sub-step 242: The aggregation center performs an aggregation operation on the received encrypted model update sets to generate an aggregated model update set.

[0108] Among them, the process of performing the aggregation operation is as follows: First, the aggregation center verifies the integrity of the encrypted model update sets respectively sent by each computing node to ensure that the data (parameter update values) has not been tampered with; Then, the aggregation center performs a mathematical operation on each encrypted model update set while keeping the data in the encrypted model update set in an encrypted state to obtain an aggregated model update set - specifically, according to the different selected SMC protocols, this process can be carried out in the following ways: First, the aggregation center decomposes the encrypted model update set sent by each computing node into multiple parts and distributes different parts to different computing nodes; then, the computing nodes aggregate the received parts to obtain an intermediate aggregation result and send the intermediate aggregation result to the aggregation center; finally, the aggregation center further aggregates the intermediate aggregation results to obtain an aggregated model update set.

[0109] In the embodiment of the present application, since the aggregation calculation is performed on the data in the encrypted state, the data privacy of the data sent by the computing nodes is protected, and thus the specific parameter values of the second local privacy protection model will not be leaked. By aggregating the parameter update values of multiple computing nodes, the influence of the data of a single computing node can be reduced, and the robustness and generalization ability of the model can be improved. The aggregation operation enables multiple computing nodes to perform collaborative learning without directly exchanging data, which conforms to the decentralized concept of federated learning and protects data privacy.

[0110] In a specific example, SMC-Avg can be used to implement step 24. Among them, SMC-Avg is based on the secure multi-party computing technology and can ensure that each participant only obtains the calculation result without leaking its input data in a multi-user network where the participants do not trust each other.

[0111] Specifically, SMC-Avg realizes the aggregation of data through the following steps: Initialization: Each participant (computing node) holds secret data (encrypted model update set) and hopes to jointly calculate the result of a certain function.

[0112] Calculation process: The participants jointly calculate the output of the function through a secure multi-party calculation protocol, ensuring that each participant only obtains their own calculation results without revealing the input data of other participants (i.e., the encrypted model update sets held by other participants).

[0113] Aggregation: Finally, the aggregation result of the global model parameters is obtained, but the input data of each participant remains confidential throughout the process. The aggregation result of the global model parameters is the aggregation result of the parameter values of the second local privacy protection models of all computing nodes.

[0114] SMC-Avg is applicable to scenarios that require high protection of data privacy, such as the financial and medical fields. In the financial field, it can be used for risk control, fraud detection, etc.; in the medical field, it can be used for the processing and analysis of patient data to improve the accuracy and efficiency of diagnosis and treatment.

[0115] Step 25: Each computing node uses the generated aggregated model update set, based on the local data of each computing node, to train the second local privacy protection model using an adaptive learning rate adjustment mechanism to generate an adaptive update model; Taking any computing node as an example, please refer to Figure 7 , Step 25 may include the following sub-steps: Sub-step 251: The computing node receives the aggregated model update set sent by the aggregation center; As can be seen from the foregoing, the aggregated model update set contains the model parameter adjustment information from all nodes in the federated learning framework.

[0116] Sub-step 252: The computing node uses the aggregated model update set and local business data, and adopts an adaptive learning rate adjustment mechanism to train the second local privacy protection model to obtain the trained second local privacy model as the adaptive update model.

[0117] Among them, the described adaptive learning rate adjustment mechanism includes: dynamically adjusting the learning rate of each parameter during the model training process.

[0118] In the embodiments of the present application, each computing node may have a private key that can successfully decrypt the data in the aggregated model update set. Among them, the public key used to encrypt the parameter values of the second local privacy protection model and the private key used to successfully decrypt the data in the aggregated model update set can both be generated using the aforementioned Paillier encryption algorithm.

[0119] Based on this private key, the computing node can successfully decrypt the data in the aggregated model update set, and then use the decrypted data to train the second local privacy protection model. As described above, it can be known that the data in the aggregated model update set is the value of the encrypted parameters of the second local privacy protection model from each computing node. Therefore, what is obtained by decrypting with the private key is the value of the encrypted parameters of the second local privacy protection model from each computing node.

[0120] The adaptive learning rate refers to dynamically adjusting the learning rate during the model training process according to the performance of the model during training to adapt to different training stages and task requirements. This method can significantly improve the training efficiency and performance of the model and avoid the limitations brought by a fixed learning rate.

[0121] In the embodiment of the present application, the specific implementation process of sub-step 252 may include: First, decrypt the data in the aggregated model update set with the private key to obtain the values of the parameters of the second local privacy protection model from each computing node; Then, calculate the weighted average of the values of the parameters of the second local privacy protection model from each computing node, and update the values of the parameters of the second local privacy protection model to the calculated weighted average; Finally, input the local service data into the second local privacy protection model with updated parameter values, and adopt an adaptive learning rate mechanism, aiming to minimize the function value of the loss function, to train the second local privacy protection model.

[0122] During the model training process, adopting an adaptive learning rate can have the following effects: 1. Improve training efficiency: The adaptive learning rate can dynamically adjust the learning rate according to the training state of the model, so as to reduce the learning rate when the gradient is large to prevent oscillation; increase the learning rate when the gradient is small to help the model jump out of the local optimal solution faster. 2. Enhance model performance: By dynamically adjusting the learning rate, it can better optimize the model parameters and improve the convergence speed and final performance of the model.

[0123] In the embodiment of the present application, methods with adaptive learning rates such as AdaGrad, RMSProp, or Adam can be used to adjust the learning rate.

[0124] After training the second local privacy protection model to update the model, the performance of the model can be evaluated using a validation set, including indicators such as accuracy and recall, to ensure the effectiveness of the model update. When the performance of the model reaches the expectation, the second local privacy protection model that meets the expectation can be used as the adaptive update model.

[0125] Since the adaptive update model is trained based on the aggregated model update set, integrating the parameter values of the second local privacy protection models from different computing nodes, this means that it contains the data features and knowledge of multiple computing nodes, which can improve the overall performance of the finally obtained adaptive update model and enable it to have better generalization ability.

[0126] Step 26: Adopt a dynamic privacy budget management strategy, dynamically adjust the privacy budget according to the privacy consumption of model updates and task requirements, and generate a dynamic privacy budget plan; For machine learning models, when the model is trained multiple times (or multiple queries and other operations are performed), the total privacy loss accumulates. Each operation on the model will generate a certain amount of privacy loss. It is necessary to ensure that the accumulated privacy loss of all operations does not exceed the preset privacy budget.

[0127] Privacy Loss is a core concept in Differential Privacy, used to quantitatively describe the impact on the probability distribution of the algorithm output results due to the presence or absence of individual data. The significance of privacy loss lies in: 1. Privacy: When is relatively small, even if a certain record in the dataset changes, the output distribution of the model will not change significantly, thus protecting the privacy of individuals; 2. Utility: When is relatively large, the utility (accuracy) of the model output is higher, but the individual privacy protection is weaker.

[0128] It can be seen that privacy loss is a key indicator to measure the degree of individual data protection by differential privacy. By restricting the range of privacy loss, the usefulness of data can be allowed while protecting individual privacy. The privacy budget controls the maximum value of privacy loss, thus balancing privacy protection and data utility. Reasonably managing and allocating the privacy budget to ensure that the total privacy loss in multiple queries or operations does not exceed the predetermined limit is an important task in the practical application of differential privacy.

[0129] It should be noted that differential privacy is a cryptographic technology designed to protect personal privacy. When querying from a statistical database, differential privacy technology can maximize the accuracy of data queries while minimizing the chance of identifying specific individuals in the data records. Differential privacy protects personal privacy by adding random noise. Its core idea is that even if an attacker knows all the information except one or more records, it is impossible to determine whether a specific record exists in the database. This technology blurs the data by adding random noise to the query results, making it impossible for the attacker to accurately infer the specific information of a single data point.

[0130] Privacy loss in differential privacy is usually described by the output results of two adjacent datasets. Given two adjacent datasets D and D′, which differ only in that one data in D and D′ is different, the output distributions generated by the differential privacy mechanism M for these two datasets are M(D) and M(D′) respectively. For a certain output o, the privacy loss L is defined as:

[0131] where is the probability that the differential privacy mechanism M generates the output o on the dataset D; is the probability that the differential privacy mechanism M generates the output o on the dataset D′.

[0132] Taking any computing node as an example, it should be noted that in the embodiments of the present application, the operation of "adopting a dynamic privacy budget management strategy to dynamically adjust the privacy budget according to the privacy consumption of model updates and task requirements" in step 26 runs through each round of training of the model by the computing node locally, that is, this operation will be executed in each round of training. Among them, the model mentioned here at least includes the privacy protection model mentioned in step 21, the first local privacy protection model mentioned in step 22, and the second local privacy protection model mentioned in step 25.

[0133] Taking any computing node as an example, please refer to Figure 8 , the specific implementation process of step 26 may include the following sub-steps: Sub-step 261: The computing node obtains the current task requirements for the model (current model) on the computing node sent by the task scheduler; The model mentioned here may refer to the model currently trained by the computing node, such as any one of the privacy protection model mentioned in step 21, the first local privacy protection model mentioned in step 22, and the second local privacy protection model mentioned in step 25.

[0134] The current task requirements may include the data sensitivity level, the attack ability level of the predicted attacker, and the privacy protection requirement level of the current business. Continuing with the previous example, the task may be a classification task - classifying users into ordinary users and users suspected of insurance fraud.

[0135] Sub-step 262: The computing node obtains the currently accumulated privacy loss of the current model; After each operation on the current model - specifically referring to after training the current model in each training cycle - the computing node can execute: calculating the privacy loss generated after the current training of the current model; determining the accumulated privacy loss according to the calculated privacy loss and the historically calculated privacy loss.

[0136] Among them, the process by which the computing node calculates the privacy loss generated by training the current model in the current training cycle includes: First, in the current training cycle, the differential privacy mechanism (such as the Gaussian mechanism, Laplace mechanism) is used to inject noise into the dataset composed of the service data for training the current model, and then the parameters of the current model are updated.

[0137] Specifically, the Gaussian mechanism (The Gaussian Mechanism, which is more suitable for ( , δ )-differential privacy, δ representing the allowed failure probability) or the Laplace mechanism (the Laplace mechanism is often used to implement -differential privacy) and other differential privacy mechanisms can be used to inject noise. Continuing with the previous example, for instance, after adding noise to datasets D and D′ respectively, the current model can take D and D′ as inputs respectively to generate corresponding output distributions M(D) and M(D′). Generally, if the added noise is large enough such that M(D) and M(D′) are very close, then even if one data in D and D′ changes, the impact on the final result is very small, thus protecting the privacy of this data.

[0138] For the Gaussian mechanism, the standard deviation of the injected noise is: ensitivity / , where represents the accumulated privacy loss; δ represents the allowed failure probability; Sensitivity is the sensitivity, which characterizes the maximum possible impact of each update to the current model on the parameters of the model. The sensitivity can be set in advance. For example, for the gradient descent method, the sensitivity can be defined as the l 2-norm of the gradient vector.

[0139] After injecting noise and updating the parameters of the current model by training the current model, based on the Advanced Composition Theorem or other composition theorems, the privacy loss of this parameter update operation for the current model can be calculated.

[0140] Generally, if each update to the current model satisfies ( , δ )-differential privacy, then after k rounds of updates to the current model, the calculated accumulated privacy loss falls within this interval range: ( , k · δ ).

[0141] Sub-step 263: The computing node compares the currently accumulated privacy loss with the preset privacy budget. In the case where the currently accumulated privacy loss is greater than or equal to the preset privacy budget, the preset privacy budget is adjusted to obtain an adjusted privacy budget. Generally, the privacy budget can be comprehensively considered based on factors such as the sensitivity of the data, the capabilities of the attacker, and the business's requirements for privacy protection.

[0142] In the embodiments of the present application, in the case of receiving a task requirement, the privacy budget can be adjusted according to the task requirement and the urgency of privacy protection. The adjustment strategy can be, for example, linear programming or dynamic programming, in order to minimize the privacy risk while meeting the task requirements.

[0143] For example, the task requirement may include the data sensitivity level, the predicted attack capability level of the attacker, and the current business's requirement level for privacy protection; based on these levels, the preset privacy budget is adjusted in a manner that the level is positively correlated with the amount of privacy budget adjustment - for example, in the case where the amount of privacy budget adjustment is negative, the higher the data sensitivity level, the predicted attack capability level of the attacker, and the current business's requirement level for privacy protection, the greater the amount of privacy budget adjustment; the lower the data sensitivity level, the predicted attack capability level of the attacker, and the current business's requirement level for privacy protection, the smaller the amount of privacy budget adjustment. The adjusted privacy budget = the preset privacy budget + the amount of privacy budget adjustment.

[0144] In an alternative embodiment, the corresponding relationship between the above various levels and the amount of privacy budget adjustment can be established in advance. According to the levels included in the received task requirement, the corresponding amount of budget adjustment can be determined by querying this corresponding relationship.

[0145] Sub-step 264: After completing the adjustment of the privacy budget, based on the latest adjusted privacy budget, control the training of the latest current model. In a specific example, for instance, the noise to be added to the local business data can be determined according to the latest adjusted privacy budget; based on the local business data with added noise, train the latest updated current model.

[0146] In a specific example, for instance, the noise to be added to the local business data can be determined according to the latest adjusted privacy budget; based on the local business data with added noise, train the latest updated current model using an adaptive learning rate mechanism.

[0147] Repeat the above sub-steps 262 to 264 until the training of the current model (such as the second local privacy protection model, etc.) is finally completed. The trained second local privacy protection model can be used as the final model for performing the specified task.

[0148] Sub-step 265: Generate a dynamic privacy budget plan according to the relevant information for adjusting the privacy budget. This plan can include different training stages, triggering times, and key operations of the model - as shown in Table 1.

[0149] Table 1:

[0150] The computing node can continuously monitor the implementation of the privacy budget, and generate a dynamic privacy budget plan after evaluating its impact on data security and task completion rate - in addition to the content shown in Table 1, the generated dynamic privacy budget plan also includes the implementation measures and their expected effects of different privacy budget adjustment plans - as shown in Table 2.

[0151] Table 2:

[0152] In addition, the dynamic privacy budget plan generated by the computing node can also include the application stage and the acting model of the adaptive learning rate adjustment mechanism - as shown in Table 3.

[0153] Based on the various data recorded in the dynamic privacy budget plans in Table 1, Table 2, and Table 3, it can provide a reference for further optimizing the dynamic management strategy of the privacy budget.

[0154] Table 3:

[0155] In the embodiments of this application, after obtaining the adaptive update model in step 25, a robust privacy protection model with strong robustness against privacy attacks can be further generated through the following steps.

[0156] Step 27: Each computing node trains the adaptive update model using adversarial training techniques to obtain a robust privacy protection model; Taking any computing node as an example, please refer to Figure 9 , step 27 can include the following sub-steps: Sub-step 271: The computing node uses a generative adversarial network (GAN) or other adversarial sample generation techniques to generate adversarial samples based on local business data; Among them, adversarial examples were proposed by Christian Szegedy et al., which refer to input samples formed by deliberately adding subtle disturbances to a dataset, causing the model to give a wrong output with high confidence.

[0157] By executing sub-step 271, adversarial samples similar to local business data but containing slight perturbations can be generated, and the adversarial samples are designed to simulate potential privacy attacks.

[0158] Sub-step 272: The computing node uses the adversarial samples as training samples and trains the adaptive update model according to the dynamic privacy budget scheme to obtain the trained adaptive update model as a robust privacy protection model. For example, the projected gradient descent (PGD) method or the fast gradient sign (FGSM) method can be adopted to alternately use local business data and adversarial samples to train the adaptive update model to update the parameter values of the adaptive update model. The trained adaptive update model can be used as a robust privacy protection model.

[0159] Adopting the above training method aims to make the robust privacy protection model remain stable and accurate in the face of privacy attacks.

[0160] It should be noted that when training the adaptive update model, differential privacy technology can also be used for training, that is, noise is injected into both local business data and adversarial samples. That is to say, the above-mentioned alternating use of local business data and adversarial samples to train the adaptive update model specifically refers to alternately using the local business data injected with noise and the adversarial samples injected with noise to train the adaptive update model.

[0161] Among them, the privacy budget can determine the size of the injected noise. The smaller the privacy budget, the greater the added noise and the stronger the privacy protection, but the accuracy of the model may decrease; the larger the privacy budget, the smaller the added noise, the higher the accuracy of the model, but the weaker the privacy protection.

[0162] In the embodiments of the present application, when training the adaptive update model, the privacy budget can be adjusted according to the dynamic privacy budget scheme. For example, it can include but is not limited to key operations recorded according to the dynamic privacy budget scheme shown in Table 1, and the privacy budget for the next round of training is adjusted when each round of local training is completed.

[0163] Sub-step 273: In an optional implementation manner, the computing node can further perform a series of privacy attack simulation tests on the robust privacy protection model based on the adversarial samples to obtain evaluation indicators characterizing the performance of the robust privacy protection model in the face of different types and intensities of attacks. Among them, the evaluation metrics include the accuracy metric of the prediction results of the robust privacy protection model, the privacy leakage risk metric, etc.

[0164] Specifically, adversarial samples can be input into the robust privacy protection model, enabling the model to obtain corresponding prediction results based on this input. Based on the prediction results, the above-mentioned evaluation metrics can be obtained.

[0165] In an alternative implementation, based on the prediction results, the specific implementation process of obtaining the above-mentioned evaluation metrics may include: 1. Calculate the accuracy metric of the robust privacy protection model by comparing the prediction results with the true labels; 2. Use a specific privacy leakage assessment tool to analyze the amount of privacy information that may be leaked during the prediction process of the robust privacy protection model, and further determine the privacy leakage risk metric based on the amount of privacy information that may be leaked.

[0166] Sub-step 274: The computing node adjusts the parameters and strategies of the adversarial training according to the obtained evaluation metrics - such as increasing the diversity of adversarial samples, adjusting the number of training iterations, etc. - and trains the robust privacy protection model according to the adjusted parameters and strategies to obtain the final robust privacy protection model.

[0167] By executing sub-step 274, the robustness of the robust privacy protection model can be further improved. By executing sub-step 274, after multiple rounds of adversarial training and optimization, a final robust privacy protection model is generated, which can effectively resist various privacy attacks while protecting privacy.

[0168] Of course, the robust privacy protection model obtained after executing sub-step 272 can also be directly used as the final robust privacy protection model.

[0169] Step 28: Each computing node respectively processes the data output by the robust privacy protection model (referring to the final robust privacy protection model, the same below) through a data sharing strategy, and sends the local service data and the processed data to the aggregation center, and the aggregation center generates a shared data set based on the local service data and the processed data; Among them, the data output by the robust privacy protection model mentioned here refers to the prediction results output after the robust privacy protection model executes the specified task.

[0170] For example, assuming that the specified task is a user classification task, the prediction results output after the robust privacy protection model executes the specified task may include: prediction labels (such as "high-risk users" or "ordinary users") and probability distributions (soft labels).

[0171] Taking any computing node as an example, please refer to Figure 10 , step 28 may include the following sub-steps: Sub-step 281: Reset a privacy budget for the robust privacy protection model ; As mentioned above, the privacy budget is a parameter used to measure the degree of privacy protection. Relatively speaking, a smaller value indicates stronger privacy protection; a larger value indicates weaker privacy protection.

[0172] Sub-step 281 can specifically be performed by technical personnel.

[0173] Sub-step 282: Determine the sensitivity Δ of the data query f ; In differential privacy, the sensitivity Δ of the data query f is a key parameter that measures the sensitivity of the query function (i.e., statistical operations on the dataset) to changes in a single record.

[0174] A data query refers to a function (Query Function) that extracts information from a dataset. Common types include: Count query (Count): Such as "the number of records in the dataset that meet a certain condition".

[0175] Sum query (Sum): Such as "the sum of a numeric field in the dataset".

[0176] Average query (Average): Such as "the average value of a field in the dataset".

[0177] Histogram query (Histogram): Such as "the user distribution by age group.

[0178] Mathematically defined, the sensitivity Δ f is defined as: Δ f = max_{D, D’} ‖ f (D) - f (D’)‖. Where ‖·‖ represents the norm (usually the L1 or L2 norm), and D and D’ are any pair of adjacent datasets.

[0179] Physically speaking, Δ f is the maximum output change value of the query function f over all adjacent datasets.

[0180] The sensitivity Δ f determines the amount of noise added to satisfy differential privacy. According to the Laplace mechanism, the amount of noise = Lap(Δ f / ), where is the privacy budget. It can be seen that the smaller Δ f , the less noise, and the higher the data availability.

[0181] Taking the task of classifying users into high - risk users and non - high - risk users as an example, in an application scenario, further assume that the classification result is used to count the number of high - risk users, that is, to perform a counting query on the number of high - risk users. In this scenario, the output data of the robust privacy protection model is: user classification labels - such as high - risk users or low - risk users. Among them, a classification label of 1 indicates that the user is a high - risk user, and a classification label of 0 indicates that the user is a low - risk user. In this scenario, the query target is to count the total number of high - risk users in the dataset input to the robust privacy protection model. At this time, the sensitivity Δ f is determined as follows: First, calculate the value of the query function f (D). Specifically, f (D)= the number of users with a classification label of 1. Among them, adjacent datasets D and D’ are two datasets that differ only in one record. For example, D is a dataset containing user A with a classification label of 1, and the difference between D’ and D is that D’ does not contain user A, or although it contains user A, its classification label is 0.

[0182] Then, based on D and D’, we can calculate | f (D)- f (D’)| = 1 (the presence or absence of user A causes the counting result to change by 1).

[0183] Finally, according to Δ f = max_{D,D’} ‖ f (D)- f (D’)‖, we can calculate the sensitivity Δ f = 1.

[0184] Sub - step 283: Select an appropriate noise distribution according to the sensitivity Δ f and the privacy budget ; In a specific example, continuing with the above example, if the sensitivity Δ f = 1, and the privacy budget = 0.1, then according to the Laplace mechanism, the noise amount can be calculated as = Lap(Δ f / ) = Lap(1 / 0.1) = Lap(10). That is, the finally released number of high - risk users should be: the true count + Lap(10).

[0185] Sub - step 284: The computing node adds random noise drawn from the selected noise distribution to the dataset composed of the data output by the robust privacy protection model according to the calculated noise amount to meet - Requirements for differential privacy protection; Sub-step 285: The computing node sends the local service data used to train the robust privacy protection model and the data output by the robust privacy protection model with added random noise to the aggregation center; As described in the previous example, the data output after the robust privacy protection model performs a specified task may include: prediction labels (such as "high-risk users" or "ordinary users") and probability distributions (soft labels). The local service data may include, for example, data carrying privacy information such as the user's name, mobile phone number, and transaction records.

[0186] Sub-step 286: After receiving the data sent by each computing node respectively, the aggregation center fuses the data to obtain a shared data set.

[0187] By executing step 28, the robustness of the robust privacy protection model against privacy attacks can be enhanced. This method can maintain the effectiveness of privacy protection in complex and changeable attack scenarios. At the same time, by adopting the mechanism of differential privacy publishing in step 28 to achieve data sharing between different computing nodes, it can adapt to different data sharing requirements and scenarios while protecting personal privacy.

[0188] Step 29: Based on the shared data set, the aggregation center uses graph embedding and graph neural network technologies to analyze the correlation between different data in the shared data set, identify potential security threats, and generate a security threat analysis result; send the generated security threat analysis result to each computing node; In the embodiment of the present application, when performing security threat analysis, by constructing a graph structure through the correlation relationship between data, discrete behaviors can be transformed into analyzable network topology relationships, thereby discovering group anomalies and attack chains.

[0189] Taking the detection of abnormal transactions in financial risk control as an example, the data used as the basis for security threat analysis may include, for example, user accounts, transaction records, device fingerprints, IP addresses, etc. If individual data representing users (such as user accounts, device fingerprints, IP addresses of devices) are used as nodes in the graph structure and edges are constructed between related nodes, a graph structure can be realized based on the data.

[0190] Among them, an edge can connect user accounts to user accounts. For example, it can connect the user account representing user A and the user account representing user B. For such an edge, the edge weight can be set according to the number of transactions and / or the amount between the two users. An edge can also connect a user account and a device fingerprint. For such an edge, the edge weight can be set according to the binding time between the device corresponding to the user account and the device fingerprint, and / or the usage frequency of the device corresponding to the device fingerprint by the user corresponding to the user account. An edge can also connect a user account and the IP address of a device. For such an edge, the edge weight can be set according to the time and / or geographical location when the user corresponding to the user account logs in to the software system based on the IP address of the device.

[0191] In this example, based on the constructed graph structure, if it is found through analyzing the graph structure that multiple users form a star transfer structure through an intermediate account, an analysis result indicating possible money laundering can be obtained.

[0192] In the embodiment of the present application, in order to obtain the security threat analysis result, step 29 may include the following Figure 11 sub-steps as shown: Sub-step 291: In the training stage, the aggregation center obtains the data carrying privacy information (referred to as privacy data for convenience of description) from the pre-obtained shared data set used as a training sample. Among them, the construction method of the pre-obtained shared data set used as a training sample can refer to the previous text and will not be elaborated here. It should be noted that the "pre-obtained shared data set used as a training sample" mentioned here and the "shared data set" described in step 28 may not be the same data set. The former is the sample data set used to train the graph neural network model (Graph Neural Network, GNN); the latter is the data set to be analyzed using the trained GNN. For the sake of distinction, the former can be denoted as shared data set 1, and the latter as shared data set 2.

[0193] In the embodiment of the present application, the privacy information in shared data set 1 may include, but is not limited to, personal information such as user names and mobile phone numbers, transaction records, etc.

[0194] Sub-step 292: The aggregation center constructs a graph structure according to the association relationship between the obtained privacy data. In an alternative embodiment, the constructed graph structure can be, for example, an undirected graph. In a specific example, when constructing the graph structure, individual data representing users (such as user accounts, device fingerprints, IP addresses of devices) can be used as nodes in the graph structure, and edges are constructed between nodes with associations. For example, based on transaction records, edges can be constructed between the nodes corresponding to user accounts that have had transaction behaviors; based on the information of the devices (device fingerprints or IP addresses) used by users when logging in to the software system, edges can be constructed between the nodes corresponding to user accounts and the nodes corresponding to the information of the devices used by the users.

[0195] In this way, the constructed graph structure can reflect various association relationships between users, thereby providing more comprehensive data support for subsequent security threat analysis. After the graph structure is constructed, the aggregation center can further utilize the nodes and edges in the graph structure to analyze the association and potential security threats between users, so as to obtain more accurate security threat analysis results.

[0196] Sub-step 293: The aggregation center applies a graph embedding algorithm to convert the nodes in the graph structure into embedding vectors. Graph embedding is a process of mapping graph data (usually a high-dimensional dense matrix) into low-dimensional dense vectors, which can well solve the problem that graph data is difficult to efficiently input into machine learning algorithms. By executing sub-step 293, the structured graph information can be converted into a format that can be processed by machine learning methods.

[0197] In an alternative embodiment, for example, node2vec technology or GraphSAGE (Graph Sample and Aggregated) technology can be used to perform embedding on the nodes, thereby converting the nodes into embedding vectors.

[0198] Sub-step 294: The aggregation center inputs the obtained embedding vectors into a graph neural network model (Graph Neural Network, GNN), and trains the graph neural network model through forward propagation and backpropagation algorithms to obtain a trained GNN. Among them, GNN refers to a general term for algorithms that use neural networks to learn graph structure data, extract and discover features and patterns in graph structure data, and meet the requirements of graph learning tasks such as clustering, classification, prediction, segmentation, and generation. In the embodiments of the present application, GNN can be, for example, a graph convolution network (Graph Convolution Network, GCN) or a graph attention network (Graph Attention Networks, GAT).

[0199] By aggregating information from neighboring nodes (message passing mechanism), GNN can identify abnormal subgraph structures (such as closed-loop transfers, star-shaped transaction networks), which are common in fraud or money laundering scenarios (Case: PayPal uses GNN to detect money laundering closed-loops). In terms of the implementation principle, GNN maps nodes to a low-dimensional vector space (such as a 128-dimensional embedding vector), so that the embedding vectors obtained by mapping nodes with similar behavior patterns are close in the low-dimensional vector space, while the embeddings obtained by mapping nodes with significantly different behavior patterns deviate from the normal distribution, thus identifying abnormal subgraph structures.

[0200] In a specific example, in an e-commerce scenario, the embedding vectors of the subgraph structures corresponding to the purchase behaviors of normal users generally show a uniform distribution, while the embedding vectors of the brushstroke gangs form dense clusters due to the high-frequency purchase of the same commodity categories.

[0201] In the embodiments of the present application, during the process of training GNN, with the goal of minimizing the value of the loss function, at least the weights of GNN are adjusted. The weights of a neural network are the coefficients of the edges connecting the neurons in each layer of the neural network, which determine the strength of the signal from one neuron to another. Weights are one of the main parameters adjusted during the learning process of a neural network, and they determine the influence degree of input features on the final output. In a neural network, weights are usually adjusted through the training process to optimize the performance and accuracy of the model.

[0202] Sub-step 295: In the model application stage, the aggregation center uses the trained GNN to analyze the graph structure constructed based on the shared dataset 2 to identify whether there are security threats (such as abnormal patterns or potential risk behaviors) in the graph structure, and obtain the prediction probability that there are security threats in the graph structure output by the GNN; The method of constructing the graph structure based on the shared dataset 2 can refer to the explanation of sub-step 292 above, and will not be elaborated here.

[0203] The implementation principle of the trained GNN to identify abnormal patterns or potential risk behaviors by analyzing the graph structure is: by analyzing the node and edge relationships in the graph structure input to the GNN, potential complex patterns in the dataset are captured.

[0204] Still taking the e-commerce scenario as an example, in the graph structure, nodes usually represent entities (such as users, commodities, etc.), while edges represent the relationships between these entities (such as purchase behaviors). GNN updates the representation of each node by iteratively aggregating information from neighboring nodes, and this aggregation process enables GNN to learn the local structural features of nodes in the graph.

[0205] In the e-commerce scenario, the subgraph structure formed by the purchase behaviors of normal users is relatively dispersed, while the brushstroke gangs form dense clusters in the graph structure due to the frequent purchase of the same commodity categories. By capturing the differences between such dense clusters and the normal dispersed structure, GNN can effectively identify potential brushstroke behaviors. When GNN analyzes the graph structure, it calculates the embedding vectors of each node, and these vectors reflect the position of the node in the graph and the information of its neighboring nodes. By comparing the embedding vectors of different nodes, GNN can identify groups of nodes with similar behavior patterns. Further, by comparing the behavior patterns jointly represented by the embedding vectors of the node groups with the known risk behavior patterns, it can identify whether there are potential security threats in the groups of nodes with similar behavior patterns.

[0206] In a specific example, a rule base containing "vectors representing the risk behavior patterns of historical security threat cases" can be predefined. On this basis, the similarity between the embedding vectors of the groups of nodes with similar behavior patterns identified by GNN and the vectors in this rule base can be compared; if the similarity is greater than the preset similarity threshold, it can be determined that there are potential security threats in the node groups; if the similarity is not greater than the preset similarity threshold, it can be determined that there are no potential security threats in the node groups.

[0207] Sub-step 296: The aggregation center processes all the security threats identified by GNN (such as classifying the security threats and / or evaluating the levels of the security threats, etc.), and then generates a detailed security threat analysis result according to the processing results (such as classification results and / or evaluation results), and sends the security threat analysis result to each computing node.

[0208] In a specific example, the "vectors representing the risk behavior patterns of historical security threat cases" in the above rule base can correspond to different types of security threats. For example, the security threat type corresponding to vector 1 in the rule base is "data leakage", and the security threat type corresponding to vector 2 in the rule base is "false transaction", etc. In such a case, when the similarity between the embedding vectors of the groups of nodes with similar behavior patterns identified by GNN and vector 1 in this rule base is greater than the preset similarity threshold, it can be determined that there are potential security threats in the node groups, and the security threat type is "data leakage".

[0209] In a specific example, the corresponding relationship between the scope of security threat impact and the threat level can be preset. For example, when the scope of security threat impact is 1 to 10 nodes, the corresponding threat level is 1; when the scope of security threat impact is 11 to 50 nodes, the corresponding threat level is 3; and so on. In such a case, the level of potential security threat existing in the node group can be determined. For example, if the node group contains 10 nodes, that is, the scope of security threat impact is 10 nodes, and thus the corresponding threat level is 1.

[0210] In a specific example, the threat score of the node group can be calculated according to the following formula :

[0211] where and are the set weight coefficients, which can be set according to actual needs; the estimated financial loss, for example, can be determined according to the pre-established corresponding relationship between different data leakage scales and the estimated financial loss.

[0212] In a specific example, the corresponding relationship between the "number of associated nodes of the nodes in the node group with potential security threats" and the diffusion risk can be pre-established. For example, if the maximum number of associated nodes of the nodes in the node group with potential security threats is 1 to 3, the corresponding diffusion risk is low; if the maximum number is 4 to 9, the corresponding diffusion risk is medium; if the maximum number is 10 or more, the corresponding diffusion risk is high. In such a case, the diffusion risk of the security threat existing in the node group can be determined. For example, if the maximum number of associated nodes of the nodes in a node group with a security threat is 10, it can be determined that the diffusion risk of the security threat existing in this node group is "high".

[0213] In the embodiments of the present application, the aggregation center can generate a security threat analysis result according to a pre-set security threat analysis result template based on one or more of the processing results obtained by processing the security threat, such as the determined security threat type, threat level, threat score, and diffusion risk, and based on the prediction probability of the existence of a security threat in the graph structure output by the GNN. For example, the security threat analysis result can be generated by writing the security threat type, threat level, threat score, diffusion risk, and prediction probability into the corresponding positions in the text-type security threat analysis result template.

[0214] The generated security threat analysis result includes one or more of the determined security threat type, threat level, threat score, and diffusion risk, and the prediction probability of the existence of a security threat in the graph structure output by the GNN.

[0215] After generating the security threat analysis results, the aggregation center can send the security threat analysis results to each computing node.

[0216] Step 210: Each computing node, according to the security threat analysis results sent by the aggregation center, adopts an adaptive threshold adjustment mechanism to dynamically adjust the privacy protection policy and generate a dynamic privacy protection policy. Taking any computing node as an example, Step 210 can specifically include the following Figure 12 sub-steps as shown: Sub-step 2101: The computing node receives the security threat analysis results sent by the aggregation center. Sub-step 2102: The computing node calculates the initial threshold for privacy protection based on the received security threat analysis results. The threshold for privacy protection is a technical concept with multiple meanings in different fields, mainly used to balance privacy protection and data availability. In the embodiments of the present application, this initial threshold is a key parameter that determines the degree of adjustment of the privacy protection policy, and it sets the baseline level of privacy protection. In the embodiments of the present application, after calculating the initial threshold, the initial threshold will be dynamically adjusted according to specific scenarios / requirements subsequently to achieve the best balance between security and availability.

[0217] Specifically, the computing node can use a preset formula or a machine learning algorithm to calculate this initial threshold.

[0218] In an alternative embodiment, the preset formula can be, for example: Initial threshold = Basic threshold + k × (Average risk score Target risk score) The relevant explanations for this formula are as follows: The basic threshold is initially set. For example, it can be the privacy protection level, usually a fixed value. k is an adjustment coefficient; the average risk score, denoted as ARS, is determined based on the received security threat analysis results and is used to represent the average level of the security threats faced; the target risk score is the maximum acceptable risk level set in advance.

[0219] In a specific example, when the security threat analysis results contain several threat levels, the average value of these threat levels can be calculated as the above-mentioned average risk score ARS.

[0220] In another specific example, the average risk score ARS can be calculated according to the following calculation formula:

[0221] The relevant explanations for this formula are as follows: is the threat score for the nth data unit, where the data unit mentioned here can refer to a group of nodes; is the set weight coefficient.

[0222] Sub-step 2103: Calculate the performance of the node's continuous monitoring privacy protection measures, and evaluate whether the initial threshold of the current privacy protection needs to be adjusted according to the monitoring situation; In an optional implementation, in sub-step 2103, the node mainly monitors one or more of the data access patterns, user behaviors, and external requests. The following will be introduced separately: The data access pattern refers to the specific way data is accessed within a software system (specifically, it can refer to the software system that generates business data), including the access frequency, access time, access content range, etc. of the access subject (such as internal employees, third-party applications).

[0223] In a specific example, taking the software system as a financial software system, the access frequency of the access subject is monitored. Specifically, it can include monitoring the frequency of internal employees accessing user credit reports - such as monitoring whether the daily access times of a certain risk control officer exceed the threshold, etc.; monitoring the access time, specifically, it can include monitoring abnormal batch data export behaviors during non-working hours (such as 2 am), etc.; monitoring the access content range, specifically, it can include monitoring whether there are unauthorized personnel querying sensitive fields (such as user ID numbers, bank card numbers), etc.

[0224] In an optional implementation, the above-mentioned monitoring of data access patterns can be achieved by recording and analyzing data query logs through a log analysis tool (such as ELK Stack) and verifying the permission matching degree in combination with Role-Based Access Control (RBAC).

[0225] User behavior refers to the operation trajectory of the end user in the system, including behavior characteristics such as login frequency, function usage, and data modification.

[0226] In a specific example, taking the software system as a shopping software system of an e-commerce platform, the user behavior is monitored. Specifically, it can include monitoring whether the user has a specified type of high-frequency operation - such as the user modifying the delivery address 3 times continuously within 1 minute (which may involve account theft); or it can include monitoring whether the user has a specified type of sensitive operation - such as the user trying to access the "account balance" page multiple times in a short period; or, it can also include monitoring whether the user performs a specified operation during abnormal periods - such as the user frequently submitting return applications at 3 am (an abnormal shopping active period).

[0227] In an alternative embodiment, the above monitoring of user behavior can be achieved by using a User Behavior Analytics (UBA) tool to construct a baseline model (such as the normal login time distribution).

[0228] An external request refers to a data call request from a third-party application or API interface to a software system. Monitoring external requests includes, but is not limited to, monitoring the request source, request parameters, return data volume, etc.

[0229] In a specific example, taking the software system as a medical data sharing platform, monitoring external requests can include monitoring whether the external request is from an illegal source - such as monitoring whether a request for patient medical record data is initiated from an unauthorized IP address (such as the IP address of an overseas server), etc.; or, it can also include monitoring whether the return field of the external request contains unmasked privacy information (such as the patient's mobile phone number), etc.

[0230] In an alternative embodiment, the method of using regular expressions to match sensitive parameters (such as / api / patient?phone=138****) can be adopted to identify whether there are sensitive parameters in the API gateway record request logs, thereby achieving the above monitoring of external requests.

[0231] Sub-step 2104: The computing node dynamically adjusts the privacy protection threshold through an adaptive algorithm based on the continuous monitoring result in sub-step 2103 and a predetermined risk tolerance. Performing this adjustment in sub-step 2104 is a response to the changes in real-time data and security requirements, ensuring that the privacy protection policy always adapts to the latest data security environment.

[0232] In an alternative embodiment, the new threshold for privacy protection can be calculated in the following manner :

[0233] The explanation of the above formula is as follows: is the current latest threshold, which can also be called the base threshold. The initial value of is the initial threshold for privacy protection as described above.

[0234] is a dynamic adjustment coefficient, which can be optimized by a Proportion Integration Differentiation (PID) controller; specifically, k can be calculated in the following manner:

[0235] wherein, is the error term, and the specific calculation method is . ARS is the average risk score, and the calculation method can refer to the previous text; is the target risk score, which is the expected risk level calculated based on the current privacy protection policy and real-time data. The target risk score TRS aims to reflect the effect of the privacy protection policy in actual applications and whether it meets the established security requirements. By comparing ARS and TRS, we can evaluate the effectiveness of the current privacy protection policy and adjust the threshold T_new accordingly to ensure that data privacy is fully protected while adapting to the changing security environment.

[0236] t is the time variable representing the current moment. are respectively: the proportional coefficient, the integral coefficient, and the differential coefficient, all of which can be obtained through training with historical data, such as = 0.8, = 0.2, = 0.05). These coefficients can be determined through experiments or experience and are used to adjust the dynamic response speed and stability of k. By optimizing k through the PID controller, the new threshold T_new for privacy protection can more accurately adapt to the changes in real-time data and security requirements, improving the security and availability of the system. After calculating the new threshold T_new, the computing node can apply it to subsequent privacy protection policies, thereby realizing the dynamic adjustment of the privacy protection policy.

[0237] Sub-step 2105: The computing node implements the new privacy protection policy according to the new threshold.

[0238] The specific implementation method of sub-step 2105 can include: based on the new threshold T_new, adjusting data access permissions, encryption intensity, or data masking strategies, etc. For example, when the new threshold indicates a higher level of security threat, the access permissions to certain sensitive data can be automatically restricted, or the data encryption intensity can be enhanced to reduce the risk of data leakage. On the contrary, if the new threshold indicates that the current security environment is relatively stable, the data access permissions can be appropriately relaxed to improve data availability.

[0239] After implementing the new privacy protection policy, the computing node can also continue to monitor the effect of the policy to ensure that data privacy is properly protected without affecting the normal operation of the business. If it is found that the new privacy protection policy is insufficient or too strict, the threshold can be further adjusted to optimize the policy effect. Through such an adaptive threshold adjustment mechanism, the continuous optimization of the privacy protection policy can be achieved to ensure the best balance between data security and availability.

[0240] Step 211: Each computing node respectively uses a dynamic privacy protection strategy, combines real-time monitoring and a feedback mechanism, conducts real-time monitoring and anomaly detection on the data stream, and generates real-time monitoring and anomaly detection results; Taking any computing node as an example, step 211 may specifically include the following Figure 13 sub-steps as shown: Sub-step 2111: Receive the generated dynamic privacy protection strategy; This strategy will guide the subsequent monitoring and feedback activities.

[0241] Sub-step 2112: Use a preset real-time monitoring system to capture the data stream; Specifically, the real-time monitoring system can adopt monitoring algorithms such as network traffic analysis, user behavior monitoring, and data access patterns to ensure a comprehensive observation of the data stream.

[0242] The content of the data stream in the financial transaction risk control scenario is, for example: User transaction records: including transaction time, amount, payee account (after desensitization such as the last four digits ****1234). Device fingerprint: device ID, IP address, browser characteristics (User-Agent, screen resolution). Behavior log: login frequency, operation sequence (such as "login → query balance → transfer").

[0243] Sub-step 2113: Use anomaly detection algorithms based on machine learning, such as clustering analysis, support vector machines, or neural networks, to identify abnormal behaviors or potential data leaks in the data stream in real time; This algorithm uses historical data to train a model to identify possible abnormal patterns.

[0244] Sub-step 2114: Continuously analyze the received data, apply the anomaly detection algorithm, and record the detected abnormal behaviors as anomaly detection results; In addition, the real-time monitoring log is also updated to record all monitored data stream activities.

[0245] Sub-step 2115: Based on the results of monitoring and anomaly detection, select and apply preset feedback strategies, including adjusting data access control, strengthening data encryption measures, or optimizing the existing privacy protection strategy.

[0246] These strategies are designed to strengthen the model's defense against privacy attacks.

[0247] Conduct real-time monitoring and anomaly detection on the data stream by combining real-time monitoring and a feedback mechanism. This method can timely detect and respond to security threats in a dynamically changing data environment.

[0248] Step 212: Based on the real-time monitoring and anomaly detection results, adopt causal inference and prediction models to evaluate the effectiveness of the privacy protection strategy and generate a strategy evaluation result.

[0249] Taking any computing node as an example, step 212 may specifically include the following sub-steps as shown in Figure 14 the following: Sub-step 2121: Receive the real-time monitoring and anomaly detection results from the previous step 211. These data include the monitored behavior patterns, detected abnormal events, and feedback information on the current privacy protection strategy; Sub-step 2122: Use the received data to construct a causal inference model; This model uses statistical methods, such as Bayesian networks or structural equation models, to determine the causal relationship between different privacy protection measures and privacy protection effectiveness.

[0250] Sub-step 2123: Based on the causal inference results, further establish a prediction model, usually using machine learning algorithms such as random forests or gradient boosting machines; During the training process of this model, use strategies such as cross-validation to optimize the model parameters to ensure the generalization ability and prediction accuracy of the model.

[0251] Sub-step 2124: Apply the causal inference model and the prediction model to analyze the effectiveness of the current privacy protection strategy. By comparing the predicted protection effectiveness of the model with the actual monitoring results, evaluate the effectiveness of the strategy and the potential improvement space; Sub-step 2125: Generate a detailed strategy evaluation report based on the model analysis. The report includes the effectiveness evaluation of the privacy protection strategy, causal relationship analysis, and prediction results. Improvement suggestions will also be put forward in the report, pointing out the deficiencies of the current strategy and the potential optimization directions.

[0252] Evaluating the effectiveness of the privacy protection strategy, this method can continuously optimize and improve the privacy protection measures to adapt to the changing data environment and security requirements.

[0253] In summary, through the comprehensive application of a variety of advanced technologies and strategies, this technical solution not only improves the accuracy and efficiency of privacy protection, but also enhances the adaptability and robustness in complex and changing data types and scenarios, effectively solving the problems faced by traditional big data privacy protection methods in actual operation, such as incomplete data protection and inadequate security risk management, and reducing the risk of data leakage and privacy infringement.

[0254] Example 3 For the same inventive concept as the foregoing embodiments, to solve the problem of how to improve the performance of federated learning in terms of data privacy protection in the prior art, an embodiment of the present application further provides a data privacy protection system for federated learning. The system specifically includes each computing node participating in federated learning and an aggregation center. The functions of the computing node and the aggregation center are specifically introduced as follows: Each computing node is configured to: obtain encrypted parameter values obtained by encrypting the values of the parameters of the second privacy protection model by respectively performing specified operations; respectively send the encrypted parameter values to the aggregation center; respectively train the second privacy protection model local to each computing node based on the aggregation model update set and local service data to obtain a final model for performing a specified task; wherein, the second privacy protection model is the global model of federated learning and is used to perform a specified task; The aggregation center is configured to: aggregate the encrypted parameter values to obtain an aggregation model update set, and then send the aggregation model update set to each computing node; Wherein, the specified operation includes the following operations: By inputting the features of the obtained local service data into a to-be-trained model for performing a specified task, training the to-be-trained model to obtain a trained to-be-trained model as the first local privacy protection model; After inputting the features of the local service data into the first local privacy protection model, obtaining the features of the specified intermediate layer output of the first local privacy protection model as the distilled first model knowledge; Sending the distilled first model knowledge, the values of the first parameters of the first local privacy protection model, and the predicted first soft labels to other computing nodes participating in federated learning, and receiving the distilled second model knowledge, the values of the second parameters, and the predicted second soft labels corresponding to the first local privacy protection models local to other computing nodes sent by other computing nodes; Training the first local privacy protection model based on the second model knowledge, the values of the second parameters, and the second soft labels to obtain the second privacy protection model; Obtaining the values of the parameters of the second privacy protection model and encrypting them to obtain encrypted parameter values.

[0255] In an alternative embodiment, each computing node may further be configured to: Based on a pre-trained teacher model for performing a specified task, training a student model using knowledge distillation technology based on soft targets; after inputting local service data into the student model, obtaining the features of the specified intermediate layer output of the student model as the features of the local service data.

[0256] In an alternative embodiment, each computing node may specifically be configured to: Decrypt the encrypted data in the aggregated model update set respectively to obtain the parameter values of each second privacy protection model from each computing node; Calculate the weighted average of the parameter values of each second local privacy protection model respectively, and update the parameter values of the local second local privacy protection model to the calculated weighted average to obtain the second local privacy protection model with updated parameter values; Based on the local service data, train the second local privacy protection model with updated parameter values locally by using an adaptive learning rate mechanism to obtain a final model for performing a specified task.

[0257] In an alternative embodiment, each computing node can be specifically used to perform respectively: Adjust the preset privacy budget according to the privacy loss accumulated by the second local privacy protection model with updated parameter values locally, the preset privacy budget, and the received task requirements; Determine the noise to be added to the local service data based on the adjusted privacy budget; Based on the local service data with added noise, train the second local privacy protection model with updated parameter values locally by using an adaptive learning rate mechanism to obtain a final model for performing a specified task.

[0258] In an alternative embodiment, each computing node can be specifically used to: respectively train the second local privacy protection model with updated parameter values locally by using an adaptive learning rate mechanism based on the local service data with added noise to obtain an adaptive update model, and respectively train the adaptive update model by using an adversarial training technique to obtain a robust privacy protection model as the final model for performing the specified task.

[0259] By using the system provided in the embodiments of the present application, on the one hand, by sharing the distilled model knowledge (instead of sharing the original data) among the computing nodes participating in the federated computing, the purpose of realizing multi-party data fusion and protecting data privacy is achieved; on the other hand, by encrypting the parameter values of the model and then sharing them among the computing nodes, the multi-party data secure sharing and fusion are further realized. Through such measures of highly privacy protection in multiple links, the method can ensure the protection of the data privacy of each participant in the federated training and improve the performance of federated learning in terms of data privacy protection.

[0260] Embodiment 4 For the same inventive concept as the previous embodiments, the embodiments of the present application also provide an electronic device to solve the problem in the prior art of how to improve the performance of federated learning in terms of data privacy protection.

[0261] As Figure 15As shown, the electronic device includes: a memory 151 and a processor 152. The memory 151 can be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method for operating on the electronic device. The memory 151 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disks, or optical disks.

[0262] The processor 152, coupled to the memory 151, is configured to execute programs stored in the memory 151 for implementing operations performed by the computing node and / or the aggregation center in the data privacy protection method for federated learning described in embodiments of the present application.

[0263] When the processor 152 executes the programs in the memory 151, in addition to the above functions, other functions can also be implemented. For specific details, reference can be made to the descriptions of the previous embodiments.

[0264] Furthermore, as Figure 15 shown, the electronic device further includes: a display 154, a communication component 153, a power supply component 155, an audio component 156, and other components. Figure 15 Only some components are schematically shown herein, and it does not mean that the electronic device only includes Figure 15 the components shown.

[0265] Correspondingly, embodiments of the present application further provide a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, it can implement operations performed by the computing node and / or the aggregation center in the data privacy protection method for federated learning described in embodiments of the present application.

[0266] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0267] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0268] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data privacy protection method for federated learning, characterized in that, The method includes: Each computing node participating in the federated learning obtains encrypted parameter values obtained by encrypting the values of the parameters of the second privacy protection model by respectively performing specified operations; and respectively sends the encrypted parameter values to the aggregation center; wherein, the second privacy protection model is the global model of the federated learning and is used to perform a specified task; After aggregating the encrypted parameter values to obtain an aggregated model update set, the aggregation center sends the aggregated model update set to each of the computing nodes; Each of the computing nodes respectively trains the second privacy protection model local to each of the computing nodes based on the aggregated model update set and local service data to obtain a final model for performing the specified task; Wherein, the specified operations include the following operations: By inputting the features of the obtained local service data into a to-be-trained model for performing the specified task, training the to-be-trained model to obtain the trained to-be-trained model as a first local privacy protection model; After inputting the features of the local service data into the first local privacy protection model, obtaining the features of the specified intermediate layer output of the first local privacy protection model as the distilled first model knowledge; Sending the distilled first model knowledge, the values of the first parameters of the first local privacy protection model, and the predicted first soft labels to other computing nodes participating in the federated learning, and receiving the distilled second model knowledge, the values of the second parameters, and the predicted second soft labels corresponding to the first local privacy protection models local to other computing nodes sent by other computing nodes; Training the first local privacy protection model based on the second model knowledge, the values of the second parameters, and the second soft labels to obtain a second privacy protection model; Obtaining the values of the parameters of the second privacy protection model and encrypting them to obtain the encrypted parameter values.

2. The method according to claim 1, wherein The features of the local service data are obtained in the following manner: Each of the computing nodes trains a student model based on a teacher model pre-trained for performing the specified task by using knowledge distillation technology based on soft targets; After each of the computing nodes inputs the local service data into the student model, obtaining the features of the specified intermediate layer output of the student model as the features of the local service data.

3. The method according to claim 1 or 2, characterized in that, Each of the computing nodes respectively trains the second privacy protection model local to each of the computing nodes based on the aggregated model update set and local service data to obtain a final model for performing the specified task, including: Each of the computing nodes respectively decrypts the encrypted data in the aggregated model update set to obtain the values of the parameters of the second privacy protection models originating from each of the computing nodes; Each of the computing nodes respectively calculates the weighted average of the values of the parameters of each of the second local privacy protection models, and updates the values of the parameters of the second local privacy protection model local to it to the calculated weighted average to obtain a second local privacy protection model with updated parameter values; Each of the computing nodes trains a second local privacy protection model with updated local parameter values based on local service data by using an adaptive learning rate mechanism, so as to obtain a final model for performing the specified task.

4. The method according to claim 3, wherein Each of the computing nodes trains a second local privacy protection model with updated local parameter values based on local service data by using an adaptive learning rate mechanism, so as to obtain a final model for performing the specified task, including: Each of the computing nodes respectively performs: Adjust the preset privacy budget according to the privacy loss accumulated by the second local privacy protection model with updated local parameter values, the preset privacy budget, and the received task requirements; Determine the noise to be added to the local service data based on the adjusted privacy budget; Train a second local privacy protection model with updated local parameter values based on the local service data with the added noise by using an adaptive learning rate mechanism, so as to obtain a final model for performing the specified task.

5. The method according to claim 4, wherein Train a second local privacy protection model with updated local parameter values based on the local service data with the added noise by using an adaptive learning rate mechanism, so as to obtain a final model for performing the specified task, including: Each of the computing nodes respectively trains a second local privacy protection model with updated local parameter values based on the local service data with the added noise by using an adaptive learning rate mechanism to obtain an adaptive update model; Each of the computing nodes respectively trains the adaptive update model by using an adversarial training technique to obtain a robust privacy protection model as the final model for performing the specified task.

6. A data processing system, characterized in that, The system includes each computing node participating in federated learning and an aggregation center; wherein: Each of the computing nodes is configured to: obtain encrypted parameter values obtained by encrypting the values of the parameters of the second privacy protection model by respectively performing specified operations; respectively send the encrypted parameter values to the aggregation center; respectively train the second privacy protection model local to each of the computing nodes based on an aggregation model update set and local service data, so as to obtain a final model for performing the specified task; wherein, the second privacy protection model is the global model of the federated learning and is used to perform a specified task; The aggregation center is configured to: aggregate the encrypted parameter values to obtain an aggregation model update set, and then send the aggregation model update set to each of the computing nodes; Wherein, the specified operation includes the following operations: Train a to-be-trained model for performing the specified task by inputting the features of the obtained local service data into the to-be-trained model, so as to obtain the trained to-be-trained model as a first local privacy protection model; After inputting the features of the local service data into the first local privacy protection model, obtain the features of the specified intermediate layer output of the first local privacy protection model as the distilled first model knowledge; Send the distilled first model knowledge, the values of the first parameters of the first local privacy protection model, and the predicted first soft labels to other computing nodes participating in the federated learning, and receive the distilled second model knowledge, the values of the second parameters, and the predicted second soft labels corresponding to the first local privacy protection model of other computing nodes sent by other computing nodes; Train the first local privacy protection model based on the second model knowledge, the values of the second parameters, and the second soft labels to obtain a second privacy protection model; Obtain the values of the parameters of the second privacy protection model and encrypt them to obtain the encrypted parameter values.

7. The system according to claim 1, wherein Each of the computing nodes is further configured to: Train a student model by using knowledge distillation technology based on soft targets based on a pre-trained teacher model for performing the specified task; After inputting local service data into the student model, obtain the features output by a specified intermediate layer of the student model as the features of the local service data.

8. An electronic device, characterized in that, Comprising: A memory and a processor, wherein, The memory is used for storing programs; The processor is coupled to the memory and is configured to execute the programs stored in the memory to implement the operations performed by the computing node or the aggregation center in a data privacy protection method for federated learning according to any one of claims 1 to 5.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a computer, it can implement the operations performed by the computing node or the aggregation center in a data privacy protection method for federated learning according to any one of claims 1 to 5.

10. A computer program product, characterized in that, The computer program product stores instructions, and when the instructions are executed by a computer, the computer is caused to implement the operations performed by the computing node or the aggregation center in a data privacy protection method for federated learning according to any one of claims 1 to 5.

Images