Differential privacy model protection method and system for adaptively selecting cutting boundary
By adaptively selecting the differential privacy model protection method of the clipping boundary, the gradient clipping and noisy operations are optimized for different data and privacy protection requirements, which solves the problem of insufficient clipping threshold selection and improves the flexibility and prediction accuracy of the algorithm.
Patent Information
- Application Number
- CN202510770941.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-10
- Publication Date
- 2025-09-19
AI Technical Summary
In existing differential privacy protection algorithms, the selection of clipping thresholds is insufficient in the privacy-utility trade-off, leading to problems of gradient direction deviation and noise variance, and especially lacks flexibility under different data and privacy protection requirements.
A differential privacy model protection method with adaptive clipping bound selection is adopted. By approximately uniformly normalizing the gradient norm, the clipping bound is dynamically adjusted to adapt to different data and privacy protection requirements. The model update is optimized by combining gradient clipping and noise addition operations.
The flexibility and applicability of the differential privacy protection algorithm are improved, the impact of the pruning boundary selection on the algorithm performance is reduced, and the prediction accuracy and stability are improved.
Smart Images
Figure CN120671183A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of privacy protection, and specifically relates to a differential privacy model protection method and system for adaptively selecting a clipping boundary. Background Art
[0002] In recent years, how to achieve learning utility while preserving the privacy of training data has become an emerging bottleneck in the era of deep learning. Among many privacy-preserving techniques, differential privacy has become a recognized standard for privacy protection due to its rigorous formulation and flexible implementation mechanisms. Differentially private learning algorithms have also attracted widespread interest in academia and industry. Differentially private stochastic gradient descent (DP-SGD) is a benchmark algorithm for deep models, achieving state-of-the-art results in terms of the privacy-utility trade-off. It combines several advanced techniques, such as momentum accounting, sampling, and gradient clipping, all of which help balance this trade-off. In this paper, we focus on gradient clipping, an area that is not fully understood or optimized despite extensive research. Typically, in DP-SGD, the Gaussian noise used to perturb the gradient is calibrated using gradient sensitivity. Gradient clipping aims to clip gradients with large norms using a threshold, thereby limiting excessive DP noise. However, the choice of the clipping threshold is a trade-off between noise variance and model bias. Specifically, a small threshold can reduce the variance of the Gaussian noise but may bias the gradient direction. On the other hand, a large threshold may introduce large noise variance while having small model bias. There have been some studies devoted to setting an appropriate clipping threshold for DP-SGD. To address this issue, some studies have proposed tracking the quantiles of the gradient norm to determine the appropriate clipping threshold. However, their methods require additional privacy budget and may have low accuracy for the exact quantiles. It is observed that smaller clipping thresholds generally produce better experimental results. Automatic clipping methods can automatically clip each gradient while preserving the individual gradient scale information, assigning weights to each sample gradient according to the size of the gradient norm, aiming to minimize the deviation between the clipped gradient and the original average gradient. However, these studies on clipping boundary selection mainly focus on minimizing the model bias caused by clipping, while ignoring the trade-off between the bias and noise caused by clipping. Summary of the Invention
[0003] The present invention aims to meet these practical needs by providing a differential privacy model protection method and system for adaptively selecting a clipping bound for data sharing. This method can adaptively select a clipping bound based on different data and privacy protection requirements, thereby optimizing the performance of the differential privacy protection algorithm.
[0004] In order to achieve the above object, the present invention adopts the following technical solutions:
[0005] A differential privacy model protection method for adaptively selecting a clipping bound includes the following steps:
[0006] Setting differential privacy model parameters and obtaining the dataset and batch data size in the differential privacy model parameters;
[0007] Determining a quantile parameter, and determining a cropping bound quantile based on the quantile parameter and the batch data size;
[0008] According to the batch data size, sampling a batch data set containing a number of samples corresponding to the batch data size on the data set;
[0009] Each sample is approximately uniformly normalized to obtain the normalized gradient sum, and the clipping bound is obtained based on the normalized gradient sum and the clipping bound quantile;
[0010] Clipping the normalized gradient according to the clipping bound to obtain the differential privacy model gradient;
[0011] Aggregate and noise the gradient of the differential privacy model to obtain a batch average gradient, and perform a protection update on the differential privacy model based on the batch average gradient.
[0012] As a preferred solution, determining the quantile parameter and determining the cropping boundary quantile based on the quantile parameter and the batch data size specifically includes:
[0013] Calculate the quantile parameters:
[0014] Determine whether the quantile parameter is greater than the inverse of the batch data size;
[0015] If so, the quantile of the batch gradient norm after approximate uniform normalization is used as the clipping bound quantile;
[0016] If not, the value of the quantile parameter is equal to the inverse of the batch size, and the minimum gradient norm after approximate uniform normalization is selected as the clipping bound quantile.
[0017] As a preferred solution, the formula for calculating the quantile parameter is:
[0018]
[0019] Where T is the maximum number of iterations, d is the data dimension of the dataset, B is the batch size, σ is the standard deviation of the noise, n is the number of batch samples, and p0 is the quantile parameter.
[0020] As a preferred solution, the method of performing approximate uniform normalization on each sample to obtain a normalized gradient sum, and obtaining a clipping bound based on the normalized gradient sum and the clipping bound quantile, specifically includes:
[0021] Calculate the gradient and its norm corresponding to each sample, and sort the values of the norms, record the largest gradient norm as the first norm, and the smallest gradient norm as the second norm;
[0022] According to the first norm and the second norm, the gradient is approximately uniformly normalized to obtain a normalized gradient sum;
[0023] The clipping bound is obtained based on the gradient, normalized gradient and clipping bound quantile corresponding to each sample.
[0024] As a preferred solution, the formula for the gradient approximate uniform normalization transformation is:
[0025]
[0026] in, is the normalized gradient sum, g t,i is the gradient of the i-th sample in the t-th round, τ is a hyperparameter (can be set to 0.001), n is the number of batch samples, a is the first norm, b is the second norm, r i is the order of the i-th gradient in the batch gradient when arranged in ascending order;
[0027] The formula for the clipping bound is:
[0028]
[0029] Among them, C is the clipping bound and p0 is the quantile parameter;
[0030] The formula for clipping the normalized gradient sum is:
[0031]
[0032] in, is the differential privacy model gradient.
[0033] As a preferred solution, the differential privacy model gradient is aggregated and denoised to obtain a batch average gradient, and the differential privacy model is protected and updated based on the batch average gradient, specifically including:
[0034] Aggregate the pruned differential privacy model gradients, add noise to the aggregated differential privacy model gradients according to the preset differential privacy theorem requirements, and calculate the batch average gradient;
[0035] Update the model parameters of the differential privacy model according to the batch average gradient, combined with the learning rate and batch data size;
[0036] The updated model parameters are used as the initial model parameters of the next round of differential privacy model until the maximum number of iterations is reached. The final model parameters are then used in the differential privacy model to complete the protection of the differential privacy model.
[0037] As a preferred solution, the formula for calculating the batch average gradient is:
[0038]
[0039] in, is the batch average gradient, I d is the identity matrix of size d×d, is a multidimensional Gaussian distribution;
[0040] The model parameter update formula of the differential privacy model is:
[0041]
[0042] Among them, x t is the initial model parameter for the tth round, and η is the learning rate.
[0043] Accordingly, the present invention also provides a differential privacy model protection system for adaptively selecting a clipping boundary, comprising: a parameter setting module, a quantile module, a gradient module, and an update module;
[0044] The parameter setting module is used to set the differential privacy model parameters and obtain the data set and batch data size in the differential privacy model parameters;
[0045] The quantile module is used to determine the quantile parameter and determine the cropping boundary quantile according to the quantile parameter and the batch data size;
[0046] The gradient module is configured to sample a batch data set containing a number of samples corresponding to the batch data size on the data set according to the batch data size; perform approximately uniform normalization on each sample to obtain a normalized gradient sum, and obtain a clipping bound based on the normalized gradient sum and the clipping bound quantile; and clip the normalized gradient according to the clipping bound to obtain a differential privacy model gradient;
[0047] The update module is used to perform aggregation and noise addition operations on the differential privacy model gradient to obtain a batch average gradient, and perform a protection update on the differential privacy model based on the batch average gradient.
[0048] Correspondingly, the present invention also provides a terminal device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the differential privacy model protection method of adaptively selecting a clipping boundary as described in any one of the above items.
[0049] Accordingly, the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the differential privacy model protection method of adaptively selecting a clipping boundary as described in any of the above items.
[0050] Compared with the prior art, the present invention has at least the following beneficial technical effects:
[0051] This paper proposes a differential privacy protection method and system for adaptively selecting a clipping bound, enabling differential privacy protection algorithms to be implemented under different data and privacy protection requirements. Specifically, this paper addresses the issue of clipping bound selection in differential privacy protection algorithms by proposing an approximately uniform normalization operation on the gradient and a method for calculating the adaptive clipping bound. This approach addresses the need for adaptive clipping bound selection in privacy protection algorithms for different data and privacy protection requirements.
[0052] Furthermore, to address the difficulties that the chaotic distribution of the gradient norm poses in selecting the clipping bound, a gradient normalization method is designed to approximately uniformize the gradient norm. By analyzing the characteristics of the gradient in the algorithm, the process of clipping bound selection, and the appropriate clipping bound technique, this method performs an approximately uniform normalization operation on the gradient norm, achieving a nearly uniform distribution of the gradient norm.
[0053] Furthermore, to address the bias introduced by the clipping bound on gradients and its impact on noise, we designed an adaptive clipping bound selection method. This method determines the clipping bound based on the normalized gradient norm, allowing the algorithm to flexibly select the clipping bound for different data and privacy protection requirements, improving the algorithm's flexibility and applicability while reducing the impact of the clipping bound selection on algorithm performance. BRIEF DESCRIPTION OF THE DRAWINGS
[0054] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0055] Figure 1 This is a flowchart of the differential privacy model protection method for adaptively selecting a clipping bound of the present invention.
[0056] Figure 2 It is a schematic diagram of the process of the present invention.
[0057] Figure 3 Schematic diagram of the mean and standard deviation of prediction accuracy (logistic regression model) for different learning rates and quantile clipping bounds.
[0058] Figure 4 Schematic diagram of the mean and standard deviation of prediction accuracy for different learning rates and quantile clipping bounds (CNN model).
[0059] Figure 5 This is a structural block diagram of a differential privacy protection system for adaptively selecting a clipping boundary in the present invention. DETAILED DESCRIPTION
[0060] Hereinafter, only certain exemplary embodiments are briefly described. As will be appreciated by those skilled in the art, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and description are to be considered as illustrative in nature and not restrictive.
[0061] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.
[0062] It should also be understood that the terms used in the present specification are only for the purpose of describing particular embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise.
[0063] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.
[0064] The accompanying drawings illustrate various schematic diagrams of structures according to embodiments disclosed herein. These figures are not drawn to scale; for clarity, some details are exaggerated and some details may be omitted. The shapes of the various regions and layers shown in the figures, as well as their relative sizes and positional relationships, are merely exemplary and may deviate in practice due to manufacturing tolerances or technical limitations. Those skilled in the art may design regions / layers with different shapes, sizes, and relative positions as needed.
[0065] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0066] Example 1
[0067] The present invention provides a differential privacy model protection method for adaptively selecting a clipping boundary, comprising the following steps S101-S106:
[0068] S101: Set differential privacy model parameters and obtain the data set and batch data size in the differential privacy model parameters.
[0069] In this embodiment, the differential privacy model parameter setting and management stage; dataset S, batch data size B, data dimension d, learning rate η, privacy budget (ε, δ), initial clipping bound C0, maximum number of iterations T, standard deviation of introduced noise σ, calculated gradient g of the i-th sample in the t-th round t,i , the gradient after approximate uniform normalization The clipped gradient Initial model parameters x in round t t .
[0070] S102: Determine a quantile parameter, and determine a cropping boundary quantile based on the quantile parameter and the batch data size.
[0071] As a preferred solution, calculate the quantile parameter; determine whether the quantile parameter is greater than the inverse of the batch data size; if so, use the quantile of the batch gradient norm after approximate uniform normalization as the clipping bound quantile; if not, use the value of the quantile parameter equal to the inverse of the batch data size, and select the smallest gradient norm after approximate uniform normalization as the clipping bound quantile.
[0072] In this embodiment, the clipping boundary quantile determination stage; first, the value of the quantile parameter p0 is calculated according to the proposed clipping boundary score determination method, the quantile selection of the clipping boundary is determined according to the relationship between the value of p0 and the batch data set size B, and the quantile p0 corresponding to the quantile clipping boundary used is calculated based on this.
[0073] In this embodiment, the quantile parameter p0 is calculated based on the following formula:
[0074]
[0075] Get the value of p0;
[0076] Step 2.2: Determine whether p0 is greater than 1 / B. If p0 is greater than or equal to 1 / B, clip according to the p0 quantile of the batch gradient norm after approximate uniform normalization. Otherwise, set p0 = 1 / B, that is, select the smallest gradient norm after approximate uniform normalization for clipping.
[0077] S103: According to the batch data size, a batch data set containing a number of samples corresponding to the batch data size is sampled from the data set.
[0078] S104: Perform approximate uniform normalization on each sample to obtain a normalized gradient sum, and obtain a clipping bound based on the normalized gradient sum and the clipping bound quantile.
[0079] In this embodiment, the gradient and its L2 norm corresponding to each sample are calculated, and the L2 norm values are sorted. The norm of the largest gradient is recorded as the first norm a, and the smallest gradient norm is recorded as the second norm b. The gradient is approximately uniformly normalized based on the first norm and the second norm to obtain the normalized gradient sum. The clipping bound is obtained based on the gradient corresponding to each sample, the normalized gradient sum, and the clipping bound quantile.
[0080] S105: Clip the normalized gradient according to the clipping bound to obtain a differential privacy model gradient.
[0081] In this embodiment, in the gradient processing stage, the gradient is calculated and processed in each round of gradient update. First, according to the batch data size B, a batch data set containing B samples is sampled from the data set S, and the gradient of each sample is calculated and recorded as g. t,i , first of all, g t,i Perform an approximate uniform normalization operation, based on the normalized gradient and and p0 quantile to obtain the clipping bounds right Clipping is performed according to the clipping boundary, and the processed gradient is finally obtained.
[0082] In this embodiment, in order to achieve adaptive clipping boundary selection and clipping, the gradient is transformed, specifically including the following steps:
[0083] Step 3.1. Based on the batch data size B, sample a batch data set containing B samples from the data set S.
[0084] Step 3.2: Calculate the gradient g corresponding to each sample t,i and its L2 norm, and sort the values of these L2 norms, the largest gradient norm is recorded as a, the smallest gradient norm is recorded as b, r i Represents the order of the i-th gradient in the batch gradient when it is arranged in ascending order, and the gradient is approximately uniformly normalized according to the following formula:
[0085]
[0086] Get the normalized gradient
[0087] Step 3.3, according to the normalized gradient and and p0 quantile to obtain the clipping bounds
[0088] Step 3.4: Normalize the approximate uniform gradient according to the clipping bound Cut according to the following formula:
[0089]
[0090] Based on this, we get the clipped gradient
[0091] S106: Aggregate and add noise to the differential privacy model gradient to obtain a batch average gradient, and perform a protection update on the differential privacy model based on the batch average gradient.
[0092] In this embodiment, the pruned differential privacy model gradients are aggregated, and according to the preset differential privacy theorem requirements, noise is added to the aggregated differential privacy model gradients to calculate the batch average gradient; based on the batch average gradient, the model parameters of the differential privacy model are updated in combination with the learning rate and batch data size; the updated model parameters are used as the initial model parameters of the next round of the differential privacy model until the maximum number of iterations is reached, and then the final model parameters are used in the differential privacy model to complete the protection of the differential privacy model.
[0093] In this embodiment, the clipped gradients are first aggregated, and noise is added to the aggregated gradients according to the theorem of differential privacy, and then the batch average gradient is calculated to update the model.
[0094] In this example, to achieve the specified differential privacy protection, noise is added to the gradient after gradient aggregation. The specific steps are as follows:
[0095] Step 4.1: Aggregate batch gradients and add noise according to the following formula so that the aggregated batch gradients satisfy the definition of differential privacy:
[0096]
[0097] Get the sum of batch gradients
[0098] Step 4.2. Calculate the batch average gradient and update the model according to the following formula:
[0099]
[0100] The updated model parameters are obtained as the initial model parameters of the next round of model. When t=T, the loop ends and the corresponding model parameters are output.
[0101] To address the destabilizing effects of the selection of clipping bounds on differential privacy algorithms, we devised an approximate uniform normalization method to stabilize the gradient and facilitate the selection of quantile clipping bounds. Furthermore, we designed a quantile clipping bound selection method and integrated it into the DP-SGD algorithm to select the quantile parameter within the clipping bound. This algorithm adaptively adjusts the clipping bound based on batch size, privacy requirements, and data dimensionality, ensuring that a better clipping bound is selected in each update round, thereby improving the prediction accuracy of differential privacy algorithms.
[0102] Example 2
[0103] Reference Figure 2 The differential privacy protection method for adaptively selecting a clipping bound provided by this invention first calculates the quantile corresponding to the quantile clipping bound based on the initial model parameters and dataset according to the proposed method, then calculates the corresponding quantile clipping bound based on the quantile, and performs approximate homogenization and clipping operations on each round of gradients. The processed gradients are aggregated and denoised, and finally the model is updated. The method specifically includes the following steps:
[0104] Step S1, parameter setting and management phase; dataset S, batch size B, data dimension d, learning rate η, privacy budget (ε, δ), initial cropping bound C0, maximum number of iterations T, standard deviation of introduced noise σ, calculate the gradient g of the i-th sample in round t t,i , the gradient after approximate uniform normalization The clipped gradient Initial model parameters x for round t t ;
[0105] Step S2, the clipping bound quantile determination stage; first, the value of the quantile parameter p0 is calculated according to the proposed clipping bound fraction determination method, the quantile selection of the clipping bound is determined according to the relationship between the value of p0 and the batch data set size B, and the quantile clipping bound used by the algorithm is calculated based on this, specifically including the following steps:
[0106] Step S2.1: Calculate the quantile parameter p0 based on the following formula:
[0107]
[0108] Get the value of p0;
[0109] Step S2.2: Determine whether p0 is greater than 1 / B. If p0 is greater than or equal to 1 / B, clip according to the p0 quantile of the batch gradient norm after approximate uniform normalization. Otherwise, set p0 = 1 / B, that is, select the smallest gradient norm after approximate uniform normalization for clipping.
[0110] Step S3, gradient processing stage: In each round of algorithm update, the gradient needs to be calculated and processed. First, according to the batch data size B, a batch data set containing B samples is sampled from the data set S, and the gradient of each sample is calculated and recorded as g t,i , first of all, g t,i Perform an approximate uniform normalization operation and clip the gradient after approximate uniform normalization according to the clipping boundary. The specific steps are as follows:
[0111] Step S3.1, based on the batch data size B, sample a batch data set containing B samples from the data set S;
[0112] Step S3.2: Calculate the gradient g corresponding to each sample t,i and its L2 norm, and sort the values of these L2 norms, the largest gradient norm is recorded as a, the smallest gradient norm is recorded as b, r i Represents the order of the i-th gradient in the batch gradient when it is arranged in ascending order, and the gradient is approximately uniformly normalized according to the following formula:
[0113]
[0114] Get the normalized gradient
[0115] Step S3.3, according to the normalized gradient and and p0 quantile to obtain the clipping bounds
[0116] Step S3.4: Normalize the approximate uniform gradient according to the clipping boundary Cut according to the following formula:
[0117]
[0118] Based on this, we get the clipped gradient
[0119] Step S4: Aggregation, Noise Addition, and Model Update: For the processed gradients, aggregation and noise addition are required to obtain the batch average gradient required for model update and then update. First, the clipped gradients are aggregated, and noise is added to the aggregated gradients according to the theorem of differential privacy. Then, the batch average gradient is calculated and the model is updated. The specific steps are as follows:
[0120] Step S4.1: Aggregate batch gradients and add noise according to the following formula so that the aggregated batch gradients satisfy the definition of differential privacy:
[0121]
[0122] Get the sum of batch gradients
[0123] Step S4.2: Calculate the batch average gradient and update the model according to the following formula:
[0124]
[0125] The updated model parameters are obtained as the initial model parameters of the next round of model. When t=T, the loop ends and the corresponding model parameters are output.
[0126] Example 3
[0127] In order to test the prediction accuracy performance of the model under different data sets and different privacy protection requirements, and compare the differential privacy protection algorithms with other pruning strategies, the MINIST data set, FMINIST data set and Celeba data set were used to conduct experiments on the Auto-S algorithm and the DP-PSAC algorithm. The neural network models were the CNN model with 587K and 102K parameters and the Resnet18 model with 11.7M parameters, respectively. The privacy protection requirements were (ε, δ) = (3, 1e-5) and (8, 5e-6), respectively. The evaluation indicators were the average prediction accuracy and stability of the network model when predicting the data set using different algorithms.
[0128] The results are shown in Table 1. Figure 3 , Figure 4 As shown in Table 1, under different data sets, neural network models with different parameter amounts, and different privacy protection requirements, the prediction accuracy of our method is consistently higher than that of the other two methods, indicating that our clipping boundary is well adapted to different data sets and privacy protection requirements, and our algorithm is more stable, as shown in the smaller standard deviation of our algorithm's prediction accuracy than previous algorithms in most experiments. This shows that our algorithm makes the gradient more stable, thus making the prediction results more stable. Figure 3 , Figure 4 As can be seen from the figure, the quantile clipping bounds we selected (our quantiles correspond to the horizontal coordinates 0.41 and 0.82 in the figure) have the best prediction accuracy among different clipping bounds.
[0129]
[0130] In the description of the present invention, it is important to understand that “prediction accuracy” is the number of correctly predicted samples divided by the total number of samples in the validation set; “average prediction accuracy” refers to the average value of the prediction accuracy obtained after running the algorithm repeatedly for multiple times; and “stability” refers to the standard deviation of the prediction accuracy obtained after running the algorithm repeatedly for multiple times.
[0131] Example 4
[0132] See also Figure 5 ,The present invention provides a differential privacy model protection system with ,adaptive selection of clipping bounds, which is characterized by ,including: a parameter setting module, a quantile module, a gradient module, and an ,update module;
[0133] The parameter setting module is used to set the differential privacy model parameters and obtain the data set and batch data size in the differential privacy model parameters;
[0134] The quantile module is used to determine the quantile parameter and determine the cropping boundary quantile according to the quantile parameter and the batch data size;
[0135] The gradient module is configured to sample a batch data set containing a number of samples corresponding to the batch data size on the data set according to the batch data size; perform approximately uniform normalization on each sample to obtain a normalized gradient sum, and obtain a clipping bound based on the normalized gradient sum and the clipping bound quantile; and clip the normalized gradient according to the clipping bound to obtain a differential privacy model gradient;
[0136] The update module is used to perform aggregation and noise addition operations on the differential privacy model gradient to obtain a batch average gradient, and perform a protection update on the differential privacy model based on the batch average gradient.
[0137] As a preferred solution, determining the quantile parameter and determining the cropping boundary quantile based on the quantile parameter and the batch data size specifically includes:
[0138] Calculate the quantile parameters:
[0139] Determine whether the quantile parameter is greater than the inverse of the batch data size;
[0140] If so, the quantile of the batch gradient norm after approximate uniform normalization is used as the clipping bound quantile;
[0141] If not, the value of the quantile parameter is equal to the inverse of the batch size, and the minimum gradient norm after approximate uniform normalization is selected as the clipping bound quantile.
[0142] As a preferred solution, the formula for calculating the quantile parameter is:
[0143]
[0144]
[0145] Where T is the maximum number of iterations, d is the data dimension of the dataset, B is the batch size, σ is the standard deviation of the noise, n is the number of batch samples, and p0 is the quantile parameter.
[0146] As a preferred solution, the method of performing approximate uniform normalization on each sample to obtain a normalized gradient sum, and obtaining a clipping bound based on the normalized gradient sum and the clipping bound quantile, specifically includes:
[0147] Calculate the gradient and its norm corresponding to each sample, and sort the values of the norms, record the largest gradient norm as the first norm, and the smallest gradient norm as the second norm;
[0148] According to the first norm and the second norm, the gradient is approximately uniformly normalized to obtain a normalized gradient sum;
[0149] The clipping bound is obtained based on the gradient, normalized gradient and clipping bound quantile corresponding to each sample.
[0150] As a preferred solution, the formula for the gradient approximate uniform normalization transformation is:
[0151]
[0152] in, is the normalized gradient sum, g t,i is the gradient of the i-th sample in the t-th round, τ is a hyperparameter (can be set to 0.001), n is the number of batch samples, a is the first norm, b is the second norm, r i is the order of the i-th gradient in the batch gradient when arranged in ascending order;
[0153] The formula for the clipping bound is:
[0154]
[0155] Among them, C is the clipping bound and p0 is the quantile parameter;
[0156] The formula for clipping the normalized gradient sum is:
[0157]
[0158] in, is the differential privacy model gradient.
[0159] As a preferred solution, the differential privacy model gradient is aggregated and denoised to obtain a batch average gradient, and the differential privacy model is protected and updated based on the batch average gradient, specifically including:
[0160] Aggregate the pruned differential privacy model gradients, add noise to the aggregated differential privacy model gradients according to the preset differential privacy theorem requirements, and calculate the batch average gradient;
[0161] Update the model parameters of the differential privacy model according to the batch average gradient, combined with the learning rate and batch data size;
[0162] The updated model parameters are used as the initial model parameters of the next round of differential privacy model until the maximum number of iterations is reached. The final model parameters are then used in the differential privacy model to complete the protection of the differential privacy model.
[0163] As a preferred solution, the formula for calculating the batch average gradient is:
[0164]
[0165] in, is the batch average gradient, I d is the identity matrix of size d×d, is a multidimensional Gaussian distribution;
[0166] The model parameter update formula of the differential privacy model is:
[0167]
[0168] Among them, x t is the initial model parameter for the tth round, and η is the learning rate.
[0169] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0170] Example 5
[0171] The present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the differential privacy model protection method for adaptively selecting a pruning boundary for data sharing.
[0172] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
[0173] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems, and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or boxes.
[0174] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0176] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention. Therefore, from all points of view, the embodiments should be regarded as illustrative and non-restrictive. The scope of the present invention is defined by the appended claims rather than the above description, and it is intended that all changes that fall within the meaning and range of equivalents of the claims are included in the present invention. Any reference signs in the claims should not be construed as limiting the claim to which they relate.
[0177] In addition, it should be understood that although this specification describes the embodiments, not every embodiment contains only one independent technical solution. This description is for clarity only. Those skilled in the art should consider the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art. The above content is only for the purpose of illustrating the technical concept of the present invention and cannot be used to limit the scope of protection of the present invention. Any changes made based on the technical solution in accordance with the technical concept proposed by the present invention fall within the scope of protection of the claims of the present invention.
Claims
1. A differential privacy model protection method with adaptive selection of clipping bounds, characterized by: The following steps are involved: Setting differential privacy model parameters and obtaining the dataset and batch data size in the differential privacy model parameters; Determining a quantile parameter, and determining a cropping bound quantile based on the quantile parameter and the batch data size; According to the batch data size, sampling a batch data set containing a number of samples corresponding to the batch data size on the data set; Each sample is approximately uniformly normalized to obtain the normalized gradient sum, and the clipping bound is obtained based on the normalized gradient sum and the clipping bound quantile; Clipping the normalized gradient according to the clipping bound to obtain the differential privacy model gradient; Aggregate and noise the gradient of the differential privacy model to obtain a batch average gradient, and perform a protection update on the differential privacy model based on the batch average gradient.
2. The differential privacy model protection method for adaptively selecting a clipping bound according to claim 1, characterized in that: Determining the quantile parameter and determining the cropping boundary quantile based on the quantile parameter and the batch data size specifically includes: Calculate the quantile parameters: Determine whether the quantile parameter is greater than the inverse of the batch data size; If so, the quantile of the batch gradient norm after approximate uniform normalization is used as the clipping bound quantile; If not, the value of the quantile parameter is equal to the inverse of the batch size, and the minimum gradient norm after approximate uniform normalization is selected as the clipping bound quantile.
3. The differential privacy model protection method for adaptively selecting a clipping bound according to claim 2, characterized in that: The formula for calculating the quantile parameter is: Where T is the maximum number of iterations, d is the data dimension of the dataset, B is the batch size, σ is the standard deviation of the noise, n is the number of batch samples, and p0 is the quantile parameter.
4. The differential privacy model protection method for adaptively selecting a clipping bound according to claim 1, characterized in that: The process of performing approximate uniform normalization on each sample to obtain a normalized gradient sum, and obtaining a clipping bound based on the normalized gradient sum and the clipping bound quantile, specifically includes: Calculate the gradient and its norm corresponding to each sample, and sort the values of the norms, record the largest gradient norm as the first norm, and the smallest gradient norm as the second norm; Performing an approximately uniform normalization transformation on the gradient according to the first norm and the second norm to obtain a normalized gradient sum; The clipping bound is obtained based on the gradient, normalized gradient and clipping bound quantile corresponding to each sample.
5. The differential privacy model protection method for adaptively selecting a clipping bound according to claim 4, characterized in that: The formula for the gradient approximate uniform normalization transformation is: in, is the normalized gradient sum, g t,i is the gradient of the i-th sample in the t-th round, τ is the hyperparameter, n is the number of batch samples, a is the first norm, b is the second norm, r i is the order of the i-th gradient in the batch gradient when arranged in ascending order; The formula for the clipping bound is: Among them, C is the clipping bound and p0 is the quantile parameter; The formula for clipping the normalized gradient sum is: in, is the differential privacy model gradient.
6. The differential privacy model protection method for adaptively selecting a clipping bound according to claim 5, characterized in that: The operation of aggregating and denoising the differential privacy model gradient to obtain a batch average gradient, and performing a protection update on the differential privacy model based on the batch average gradient specifically includes: Aggregate the pruned differential privacy model gradients, add noise to the aggregated differential privacy model gradients according to the preset differential privacy theorem requirements, and calculate the batch average gradient; Update the model parameters of the differential privacy model according to the batch average gradient, combined with the learning rate and batch data size; The updated model parameters are used as the initial model parameters of the next round of differential privacy model until the maximum number of iterations is reached. The final model parameters are then used in the differential privacy model to complete the protection of the differential privacy model.
7. The differential privacy model protection method for adaptively selecting a clipping bound according to claim 6, characterized in that: The formula for calculating the batch average gradient is: in, is the batch average gradient, I d is the identity matrix, is a multidimensional Gaussian distribution; The model parameter update formula of the differential privacy model is: Among them, x t is the initial model parameter for the tth round, and η is the learning rate.
8. A differential privacy model protection system with adaptive selection of clipping bounds, characterized by: include: Parameter setting module, quantile module, gradient module and update module; The parameter setting module is used to set the differential privacy model parameters and obtain the data set and batch data size in the differential privacy model parameters; The quantile module is used to determine the quantile parameter and determine the cropping boundary quantile according to the quantile parameter and the batch data size; The gradient module is used to sample a batch data set containing a number of samples corresponding to the batch data size on the data set according to the batch data size; Each sample is approximately uniformly normalized to obtain a normalized gradient sum, and a clipping bound is obtained based on the normalized gradient sum and the clipping bound quantile. The normalized gradient is clipped according to the clipping bound to obtain the differential privacy model gradient. The update module is used to perform aggregation and noise addition operations on the differential privacy model gradient to obtain a batch average gradient, and perform a protection update on the differential privacy model based on the batch average gradient.
9. A terminal device, characterized in that: The invention comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the differential privacy model protection method of adaptively selecting a pruning boundary as described in any one of claims 1 to 7 is implemented.
10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the differential privacy model protection method for adaptively selecting a clipping boundary according to any one of claims 1 to 7.