Federal learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment

Abstract

The invention provides a federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment, and aims to balance data privacy protection and model training performance and improve model accuracy and convergence speed of federated learning on the premise of protecting user data privacy. And the contradiction between privacy protection and model performance in the existing federated learning is solved. The method comprises the following steps: step 1, constructing a privacy loss quantification model based on Rayleigh divergence; 2, deducing a tight upper bound of a Gaussian noise standard deviation; 3, initializing noise parameters of the federated learning system; 4, the client side executes local model training and noise adding; 5, updating the aggregation model of the central server and evaluating the performance; step 6, implementing a self-adaptive noise adjustment decision based on model performance; and step 7, iterating federal learning training until convergence or completion.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence and machine learning technology, and in particular to privacy protection technology in federated learning. Specifically, the present invention proposes a federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment. Background Art

[0002] With the rapid development of big data and artificial intelligence technologies, the importance of data in various fields has become increasingly prominent. However, when using large amounts of data to train machine learning models, data privacy issues have become increasingly prominent. Traditional centralized machine learning models require all data to be aggregated to a central server for training, which undoubtedly increases the risk of data privacy leaks.

[0003] Federated Learning (FL), an emerging decentralized machine learning paradigm, alleviates data privacy concerns to a certain extent by allowing multiple clients to collaboratively train global models without sharing raw data. However, FL is not completely immune to privacy risks. Research has shown that even model updates can leak sensitive information through differential attacks and membership inference attacks, leading to serious privacy issues.

[0004] To address the privacy leakage problem in federated learning, researchers have proposed a variety of privacy protection technologies, among which differential privacy (DP) has attracted widespread attention due to its strict privacy protection theoretical guarantees. Differential privacy obfuscates real information by adding random noise to data or model updates, thereby ensuring that the presence or absence of a single data point does not significantly affect the query results. In federated learning, differential privacy is mainly divided into central differential privacy (CDP-FL) and local differential privacy (LDP-FL). Central differential privacy usually involves a central server adding noise when aggregating model updates, but this approach still carries the risk of the central server being a single point of attack target. Local differential privacy adds noise locally to each client, providing stronger privacy protection, but because noise is added at the client level, the cumulative effect of noise may cause a significant degradation in model performance.

[0005] Existing technologies face challenges in balancing privacy protection strength and model practicality. How to provide strict privacy protection while minimizing the negative impact on model performance (such as convergence speed and accuracy) is a key issue that needs to be addressed in the current field of privacy protection in federated learning. Traditional static noise mechanisms often fail to adapt to the dynamic changes in privacy and performance requirements during model training. This can lead to excessive perturbations in the early stages of training that can affect convergence, while excessive noise in the later stages can hinder the model from achieving optimal performance. Summary of the Invention

[0006] This paper proposes a federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment, aiming to balance data privacy protection and model training performance, improve the model accuracy and convergence speed of federated learning while protecting user data privacy, and resolve the contradiction between privacy protection and model performance in existing federated learning.

[0007] The technical solution adopted by the present invention to solve the above problems is:

[0008] A federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment is characterized by comprising the following steps:

[0009] Step 1: Construct a privacy loss quantification model based on Rayleigh divergence;

[0010] Step 2: Derive a tight upper bound on the standard deviation of Gaussian noise;

[0011] Step 3: Initialize the noise parameters of the federated learning system;

[0012] Step 4: The client performs local model training and noise addition;

[0013] Step 5: Central server aggregation model update and performance evaluation;

[0014] Step 6: Implement adaptive noise adjustment decisions based on model performance;

[0015] Step 7: Iterate the federated learning training until convergence or completion.

[0016] The step 1 of the present invention includes the following steps:

[0017] (1) For each model update communication, define a privacy loss function based on the Rayleigh divergence hidden

[0018] Private loss function The expression is:

[0019]

[0020] A σ (v1,v0) and B σ The expression for (v0,v1) is:

[0021]

[0022] in:

[0023] μ0=v0, where μ0 and v0 represent the probability density function of the model update before adding noise;

[0024] μ = v1, where μ and v1 represent the probability density function of the updated noise model under the influence of the data point sensitivity Δl and the client sampling ratio q;

[0025] x represents the value of the random variable in the probability density function;

[0026] μ0(x) represents the probability density function of the updated noise model when no sensitive data points change;

[0027] μ(x) represents the probability density function of the updated noise model after a sensitive data point changes;

[0028] A σ (v1,v0) means that under the distribution of probability density function v0, the ratio expected value;

[0029] B σ (v0,v1) means that under the distribution of probability density function v1, the ratio expected value;

[0030] (2) After T rounds of communication in federated learning, the total cumulative privacy loss is quantified as the exponential form of the sum of the privacy losses in each round:

[0031] The second step of the present invention includes the following steps:

[0032] (1) Number of privacy loss function roots of Gaussian mechanism satisfies the following tighter upper bound:

[0033]

[0034] (2) The derived Substitute the upper bound into the tail bound theorem of differential privacy: Get a value about σ i 2 The quadratic inequality of

[0035] By solving the above quadratic inequality, we can conclude that ensuring the i-th client satisfies (ε i ,δ i )-Gaussian noise standard deviation σ required by LDP i The minimum lower bound of :

[0036]

[0037] Step three of the present invention includes the following steps:

[0038] (1) Setting a global privacy budget;

[0039] (2) Determine the client sampling ratio;

[0040] (3),estimating local training sensitivity;

[0041] (4) Set the total number of communication rounds;

[0042] (5) Calculate the initial noise standard deviation;

[0043] (6) Model and parameter distribution.

[0044] Step three of the present invention includes the following steps:

[0045] (1) Setting the global privacy budget: First, determine the global privacy budget (ε0, δ0) of the entire federated learning task;

[0046] (2) Determine the client sampling ratio: clarify the ratio of the number of clients K participating in the aggregation to the total number of clients N in each round of training

[0047] (3) Estimation of local training sensitivity: Estimate the sensitivity Δt of the local training process;

[0048] (4) Set the total number of communication rounds: Determine the total number of training rounds T for the federated learning task;

[0049] (5) Calculate the initial noise standard deviation: the calculated initial noise standard deviation σ init for:

[0050]

[0051] (6) Model and parameter distribution: The central server initializes the global model w0 and distributes the global model w0 and the calculated σ init Distributed to all participating clients.

[0052] Step 4 of the present invention includes the following steps:

[0053] (1) Receive the global model and current noise parameters;

[0054] (2) Local model training;

[0055] (3) Model update sensitivity clipping;

[0056] (4) Add differential privacy Gaussian noise;

[0057] (5) Upload noisy updates.

[0058] The fourth step of the present invention includes the following steps:

[0059] (1) Receive the global model and current noise parameters: Each client receives the current global model w distributed by the central server t and the noise standard deviation σ used in the current round t ;

[0060] (2) Local model training: The client uses its local private dataset to train the current global model w t Perform local model training; during this process, the client calculates the update amount Δw of its local model relative to the global model t ;

[0061] (3) Model update sensitivity clipping: To ensure that the sensitivity of the local model update Δl is within a controllable range, the client adjusts the update amount Δw t Cutting

[0062] (4) Add differential privacy Gaussian noise: The client adds the Gaussian noise according to the current round σ t value, generate a zero mean and standard deviation σ t Gaussian distribution N(0,σ i 2 I) random noise vector Noise;

[0063] Local model update after noise addition:

[0064] (5) Upload noisy update: The client updates the local model after adding noise Uploaded to the central server through an encrypted communication channel.

[0065] The fifth step of the present invention includes the following steps:

[0066] (1) Receive noisy model updates: The central server receives the noisy local model updates uploaded by all clients participating in this round of training.

[0067] (2) Secure aggregation operation: The central server aggregates these noisy model updates to form a new global model w t+1 ;

[0068] (3) Global model performance evaluation: The central server uses an independent validation set that has not participated in training to evaluate the newly generated global model w t+1 Perform rigorous evaluation and accurately calculate its accuracy Acc(w t+1 );

[0069] (4) Update the accuracy record: The central server maintains a historical accuracy record list Acc histoty , Acc history=[Acc(w t-3 ),Acc(w t-2 ),Acc(w t-1 ),Acc(w t )].

[0070] Step six of the present invention includes the following steps:

[0071] The central server uses the list Acc history Based on the accuracy trend of the last four rounds, the noise standard deviation σ of the next round (t+1) is dynamically determined according to the following preset rules. t+1 How to adjust:

[0072]

[0073] Among them, σ t is the standard deviation of the noise actually used by the client in the current round t, Acc(w t ) is the accuracy of the global model on the validation set in round t;

[0074] If the validation accuracy of the model continues to improve in three consecutive rounds, that is, Acc(w t-3 )>Acc(w t-2 )>Acc(w t-1 )>Acc(w t ), the current noise standard deviation σ t Multiply by a noise reduction factor β;

[0075] If the validation accuracy of the model continues to decline in three consecutive rounds, that is, Acc(w t-3 ) <Acc(w t-2 ) <Acc(w t-1 ) <Acc(w t ), the current noise standard deviation σ t Multiply by a noise expansion factor α.

[0076] Step seven of the present invention includes the following steps:

[0077] In each round of training, the client receives the current global model w distributed by the central server t and the noise standard deviation σ determined in the current round t , and train on the local dataset, and upload the noisy model updates; the central server aggregates these updates to form a new global model w t+1 , and calculate the noise standard deviation σ for the next round based on its performance on the validation set t+1 ; The central server then w t+1 and σ t+1Distribute to the client and prepare for the next round of iteration; this iterative process continues until the preset maximum number of training rounds T is reached, or the model reaches the preset convergence condition on the validation set.

[0078] This paper combines the Rayleigh divergence framework with improved privacy accounting techniques to derive a tighter privacy loss bound. Based on this, it dynamically adjusts the noise scale during federated learning training, thereby significantly improving the model's convergence speed and ultimate accuracy while ensuring strict privacy protection. Compared with existing technologies, this paper has the following advantages and effects:

[0079] (1) More efficient privacy budget allocation: A tighter privacy loss bound derived from the Rayleigh divergence allows adding smaller noise at the same privacy level or providing stronger privacy guarantees at the same noise level, thereby improving the overall efficiency of the privacy mechanism and the effectiveness of model training.

[0080] (2) Adaptive noise adjustment to optimize the privacy-performance trade-off: A strategy that dynamically adjusts the noise level ensures that the model obtains sufficient privacy protection and exploration capabilities in the early stages of training, while effectively reducing noise in the later stages of training to promote model convergence to higher accuracy, thereby intelligently balancing the contradiction between privacy protection and model performance. This flexibility is unmatched by traditional static noise mechanisms.

[0081] (3) Improve the model convergence speed and final accuracy: Experimental results show that compared with the traditional static noise mechanism

[0082] AFLDP significantly improves the convergence speed and final accuracy of the model on multiple real-world datasets. Dynamic noise adjustment avoids the obstruction of model convergence caused by excessive perturbations in the late stages of training, enabling it to more effectively approach the optimal solution.

[0083] (4) Enhance training robustness and prevent overfitting: Adding noise when the model accuracy drops in the early stages of training helps the model escape from shallow local optimality and effectively prevents overfitting that occurs prematurely when the amount of data is limited or the model complexity is high, greatly improving the robustness and generalization ability of the federated learning process. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 Schematic diagram of a federated learning system architecture in which an embodiment of the present invention is implemented.

[0085] Figure 2 This is a specific flow chart of a round of training of a local model of a single client according to an embodiment of the present invention. DETAILED DESCRIPTION

[0086] The present invention will be further described in detail below with reference to the accompanying drawings and through examples. The following examples are intended to explain the present invention but the present invention is not limited to the following examples.

[0087] 1. As Figure 1 As shown, the present invention is implemented in a standard federated learning system architecture, which mainly includes:

[0088] Central Server: Responsible for initializing the global model, receiving client model updates, aggregating models, distributing the global model, and managing privacy budgets and noise adjustments.

[0089] Multiple clients (Clients / Mobile Terminals, MTs): Each has a local private dataset and is responsible for local model training, calculating model updates, adding differential privacy noise to model updates, and uploading noisy updates to the central server.

[0090] 2. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment in an embodiment of the present invention includes the following steps:

[0091] Step 1: Construct a privacy loss quantification model based on Rayleigh divergence.

[0092] This paper constructs a privacy loss quantification model based on the Rényi divergence to accurately calculate the privacy loss generated by each round of communication in federated learning. The model uses the Rényi divergence characteristics under the Gaussian mechanism to define the privacy loss function The cumulative privacy loss after multiple rounds of communication is quantified. This step includes the following steps:

[0093] (1) Define the privacy loss function of Rayleigh divergence:

[0094] For each model update communication, define a privacy loss function based on the Rayleigh divergence This function quantifies the degree of privacy leakage caused by the distribution change caused by adding noise when a given Rényi order λ>1.

[0095] Privacy loss function The expression is:

[0096]

[0097] in,

[0098] A σ (v1,v0) and B σ The expression for (v0,v1) is:

[0099]

[0100] in:

[0101] μ0=v0, μ0 and v0 represent the probability density function of the model update before adding noise, which is usually assumed to be a Gaussian distribution N(0,σ i 2 );

[0102] μ=v1,μ and v1 represent the sensitivity at the data point The probability density function of the noise model update under the influence of the client sampling ratio q is expressed as a combination of two Gaussian distributions:

[0103] It should be noted that μ and v are two commonly used mathematical symbols for the same thing. Generally, they are used to avoid confusion in different contexts. μ is used in probability density scenarios, and v is used in probability distribution scenarios.

[0104] x represents the value of the random variable in the probability density function;

[0105] μ0(x) represents the probability density function of the updated noise model when no sensitive data points change;

[0106] μ(x) represents the probability density function of the updated noise model after a sensitive data point changes;

[0107] A σ (v1,v0) means that under the distribution of probability density function v0, the ratio expected value;

[0108] B σ (v0,v1) means that under the distribution of probability density function v1, the ratio expected value.

[0109] (2) Calculation of cumulative privacy loss:

[0110] After T rounds of communication in federated learning, the total cumulative privacy loss is quantified as the exponential sum of the privacy losses in each round: This enables consistent and precise tracking of privacy leaks throughout the training process.

[0111] Step 2: Derive a tight upper bound on the standard deviation of Gaussian noise.

[0112] Based on the quantization model of step 1, the present invention derives the noise standard deviation σ required to update the local model under the Gaussian mechanism i By combining the differential privacy tail bound theorem, we derive the guarantee that the client satisfies (ε i ,δ i )-σ of local differential privacy iThe calculation formula provides an accurate theoretical basis for noise configuration. This step includes the following steps:

[0113] (1) Proof of the upper bound of the privacy loss function:

[0114] The privacy loss function constructed according to step 1 Definition, proof of sampling probability on the client side And the Rényi order Where C is a constant), the privacy loss function of the Gaussian mechanism is satisfies the following tighter upper bound:

[0115]

[0116] This derivation involves the binomial expansion of the expected expression and the use of Gaussian distribution properties, which ensures the accuracy of the upper bound.

[0117] (2) LDP noise standard deviation σ i Export:

[0118] In order to compare the RDP privacy loss with the traditional (ε i ,δ i )-differential privacy definition, the present invention utilizes the tail bound theorem of differential privacy:

[0119] will be derived Substituting the upper bound into the tail bound theorem and performing algebraic operations and optimization procedures (including taking the derivative of λ to find the minimum value), we can finally obtain a value about σ i 2 The quadratic inequality.

[0120] By solving this quadratic inequality, the present invention derives the following equation to ensure that the i-th client satisfies (ε i ,δ i )-Gaussian noise standard deviation σ required by LDP i The minimum lower bound of :

[0121]

[0122] This formula not only gives σ i The precise calculation method of the noise size and the privacy budget (ε i ,δ i ), the intrinsic relationship between the sampling ratio q, the total number of communication rounds T, and the local training sensitivity Δt provides a quantitative basis for subsequent noise initialization and adaptive adjustment.

[0123] Step 3: Initialize the noise parameters of the federated learning system.

[0124] Before the federated learning training officially begins, the central server will calculate and initialize a baseline noise standard deviation σ based on the formula in step 2, using the preset privacy budget, client sampling ratio, local training sensitivity estimate, and total number of communication rounds. init , laying the foundation for subsequent iterative training. This step includes the following steps:

[0125] (1) Setting the global privacy budget: First, determine the global privacy budget (ε0, δ0) for the entire federated learning task. These parameters will serve as the privacy goals that each client needs to meet during the training process.

[0126] (2) Determine the client sampling ratio: clarify the ratio of the number of clients K participating in the aggregation to the total number of clients N in each round of training

[0127] (3) Estimate local training sensitivity: Estimate the sensitivity Δt of the local training process. This usually refers to the maximum change in the L2 norm of the model update (gradient or parameter) when a data point in the dataset changes. In practical applications, the L2 norm of the model update can be limited by clipping, thereby setting an upper limit on Δt.

[0128] (4) Set the total number of communication rounds: Determine the total number of training rounds T for the federated learning task.

[0129] (5) Calculate the initial noise standard deviation: Use the formula derived in step 2 to calculate the initial noise standard deviation σ init :

[0130]

[0131] This value will serve as a baseline for how clients add noise to local model updates in the first iteration of federated learning.

[0132] (6) Model and parameter distribution: The central server initializes the global model w0 and distributes the global model w0 and the calculated σ init Distributed to all participating clients. At this point, the clients know the noise level they need to add in the first round of training.

[0133] Step 4: The client performs local model training and noise addition.

[0134] In each round of federated learning iteration, the client receives the current global model w distributed by the central server. t and the noise standard deviation σ determined in the current round t After that, the model is trained on the local dataset and updates are generated. tGenerate Gaussian random noise from the value and accurately add it to the local model update to form a noisy update and upload it to the central server. This step includes the following steps:

[0135] (1) Receive the global model and current noise parameters: Each client receives the current global model w distributed by the central server t and the noise standard deviation σ used in the current round t .

[0136] (2) Local model training: The client uses its local private dataset to train the current global model w t Perform local model training. This typically involves performing a small number (e.g., 1 to E) of local training iterations (e.g., gradient descent) to update the model parameters based on local data. During this process, the client calculates the update Δw of its local model relative to the global model. t .

[0137] (3) Model update sensitivity trimming: To ensure the sensitivity of local model updates Within a controllable range, the client can update the amount Δw t Perform clipping. For example, limit the L2 norm of the update amount to a preset clipping threshold C, that is, The clipping threshold C is usually used to calculate upper limit.

[0138] (4) Adding differential privacy Gaussian noise: This is the core step for the client to protect privacy. The client adds differential privacy Gaussian noise according to the current round σ t value, generate a zero mean and standard deviation σ t Gaussian distribution N(0,σ i 2 I) is a random noise vector Noise. The dimension of this noise vector is consistent with the local model update Δw t The dimensions are the same.

[0139] Local model update after noise addition:

[0140] By adding this noise, the influence of a single client's local data point on the final uploaded update is obscured, providing strict differential privacy guarantees.

[0141] (5) Upload noisy update: The client updates the local model after adding noise Uploaded to the central server through an encrypted communication channel.

[0142] Step 5: Central server aggregation model update and performance evaluation.

[0143] After receiving the noisy model updates uploaded by all participating clients, the central server securely aggregates them to form a new global model. Next, it evaluates the new model using an independent validation set, calculates its accuracy, and updates the historical accuracy record to provide data for subsequent noise adjustments. This step includes the following steps:

[0144] (1) Receive noisy model updates: The central server receives the noisy local model updates uploaded by all clients participating in this round of training.

[0145] (2) Secure aggregation operation: The central server aggregates these noisy model updates to form a new global model w t+1 The most common aggregation algorithm is Federated Averaging (FedAvg), and its aggregation formula is:

[0146]

[0147] Among them, S t is the set of clients participating in this round of training, n k is the local data volume of client k, N total is the sum of all client data volumes (or the total data volume of participating clients only), is the noisy local model update uploaded by client k in round t. During the aggregation process, the randomness of the noise will offset each other, thus preserving the effective information of the model as a whole.

[0148] (3) Global model performance evaluation: The central server uses an independent validation set that does not participate in training (usually a small amount of public data reserved by the central server or anonymous validation data aggregated from the client) to evaluate the newly generated global model w t+1 Perform rigorous evaluation and accurately calculate its accuracy Acc(w t+1 ). This accuracy will serve as a key indicator of the model's current learning status.

[0149] (4) Update the accuracy history: The central server maintains a list of historical accuracy records, such as Acc history , used to store the validation accuracy of the most recent rounds. In order to implement noise adjustment based on continuous trends, this list usually needs to store the accuracy of the most recent four rounds, that is:

[0150] Acc history =[Acc(w t-3 ),Acc(w t-2 ),Acc(w t-1 ),Acc(w t )]. After each round of evaluation, the new Acc(wt+1 ) are added to the end of the list and the oldest record is removed to maintain the list length.

[0151] Step 6: Implement adaptive noise adjustment decisions based on model performance.

[0152] Based on the global model performance evaluation results and historical accuracy records obtained in step 5, the central server will dynamically determine the noise standard deviation σ to be used in the next round of federated learning iteration (i.e., round t+1). t+1 If the accuracy continues to improve, the noise level is reduced; if it continues to decrease, the noise level is increased; otherwise, it remains unchanged, intelligently balancing privacy and performance. This decision allows the noise level to intelligently respond to the model training status, thus achieving a dynamic balance between privacy and performance. This step includes the following steps:

[0153] (1) Determination of noise adjustment rules: The central server determines the noise adjustment rules according to Acc history Based on the accuracy trend of the last four rounds, the noise standard deviation σ of the next round (t+1) is dynamically determined according to the following preset rules. t+1 How to adjust:

[0154]

[0155] Among them, σ t is the standard deviation of the noise actually used by the client in the current round t, Acc(w t ) is the accuracy of the global model on the validation set in round t.

[0156] Noise reduction (improved accuracy): If the validation accuracy of the model is t-3 to w t ) continue to improve, that is, Acc(w t-3 )>Acc(w t-2 )>Acc(w t-1 )>Acc(w t ), indicating that the model learning effect is good and tends to converge. At this time, the current noise standard deviation σ t Multiply by a noise reduction factor β (0 < β < 1). For example, β can be set to a value between 0.8 and 0.95. Reducing noise helps update model parameters more accurately, thereby accelerating the model's convergence to the optimal solution and potentially achieving a higher final accuracy.

[0157] Noise increase (to enhance privacy and prevent overfitting): If the validation accuracy of the model continues to decrease for three consecutive rounds, that is, Acc(w t-3 ) <Acc(w t-2 ) <Acc(w t-1 ) <Acc(w t), which may mean that the model is stuck in a local optimum, or the current noise level is too low, resulting in an increased risk of privacy leakage, or the model is showing early signs of overfitting. At this time, the current noise standard deviation σ t Multiply by a noise expansion factor α (α>1), for example, α can be set to a value between 1.05 and 1.2. Increasing noise helps enhance privacy protection while introducing more randomness, helping the model escape the current local optimum or suppressing overfitting in the early stages of training, thereby improving model generalization.

[0158] Noise remains unchanged (maintain balance): In addition to the above two cases, if the accuracy does not show a clear continuous upward or downward trend (for example, the accuracy fluctuates greatly, remains unchanged, or the trend is discontinuous), then maintain the current noise intensity σ t unchanged to maintain the existing balance between privacy protection and model performance and avoid unnecessary adjustments.

[0159] (2) Parameter Setting: The noise expansion factor α and the noise reduction factor β are adjustable parameters of the present invention. Their specific values ​​should be determined through preliminary experiments and hyperparameter tuning to achieve the optimal privacy-performance trade-off based on the actual dataset, model complexity, and required privacy strength.

[0160] Step 7: Iterate the federated learning training until convergence or completion.

[0161] The present invention implements continuous training of federated learning by iteratively executing client training, noise addition, central server aggregation and performance evaluation, and adaptive noise adjustment. This process continues until the preset maximum number of training rounds or model convergence conditions are reached. This step includes the following steps:

[0162] The present invention achieves a dynamic balance between privacy protection and model performance by iteratively performing federated learning training and noise parameter updates. In each round of training, the client receives the current global model w distributed by the central server. t and the noise standard deviation σ determined in the current round t , and train on the local dataset, and upload the noisy model updates. The central server aggregates these updates to form a new global model w t+1 , and based on its performance on the validation set, use the adaptive strategy in step six to calculate the noise standard deviation σ for the next round t+1 The central server will then w t+1 and σ t+1The data is distributed to the client, preparing for the next round of iteration. This iterative process continues until the preset maximum number of training rounds T is reached, or the model reaches the preset convergence condition on the validation set (for example, the accuracy no longer improves significantly after multiple consecutive rounds, or reaches a certain target accuracy). This dynamic adjustment ensures full privacy protection and assists model exploration in the early stages of training, while gradually reducing noise in the later stages of training to accelerate model convergence to higher accuracy, effectively improving the robustness of federated learning and preventing overfitting.

[0163] In addition, the above content described in this specification is merely an example of the structure of the present invention. Any equivalent or simple changes made based on the structure, features, and principles described in the patent concept of the present invention are included in the scope of protection of the patent of the present invention. Those skilled in the art of the present invention may make various modifications or supplements to the specific embodiments described, or replace them with similar methods. As long as they do not deviate from the structure of the present invention or exceed the scope defined by the claims, they shall fall within the scope of protection of the present invention.

Claims

1. A federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment, characterized by: The following steps are involved: Step 1: Construct a privacy loss quantification model based on Rayleigh divergence; Step 2: Derive a tight upper bound on the standard deviation of Gaussian noise; Step 3: Initialize the noise parameters of the federated learning system; Step 4: The client performs local model training and noise addition; Step 5: Central server aggregation model update and performance evaluation; Step 6: Implement adaptive noise adjustment decisions based on model performance; Step 7: Iterate the federated learning training until convergence or completion.

2. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 1, characterized in that: The step 1 includes the following steps: (1) For each model update communication, define a privacy loss function based on the Rayleigh divergence Privacy loss function The expression is: A σ (v1,v0) and B σ The expression for (v0,v1) is: in: μ0=v0, where μ0 and v0 represent the probability density function of the model update before adding noise; μ=v1, μ and v1 represent the sensitivity at the data point The probability density function of the noise model update under the influence of the client sampling ratio q; x represents the value of the random variable in the probability density function; μ0(x) represents the probability density function of the updated noise model when no sensitive data points change; μ(x) represents the probability density function of the updated noise model after a sensitive data point changes; A σ (v1,v0) means that under the distribution of probability density function v0, the ratio expected value; B σ (v0,v1) means that under the distribution of probability density function v1, the ratio expected value; (2) After T rounds of communication in federated learning, the total cumulative privacy loss is quantified as the exponential form of the sum of the privacy losses in each round:

3. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 2, characterized in that: The step 2 includes the following steps: (1) Number of privacy loss function roots of Gaussian mechanism satisfies the following tighter upper bound: (2) The derived Substitute the upper bound into the tail bound theorem of differential privacy: Get a value about σ i 2 The quadratic inequality of By solving the above quadratic inequality, we can conclude that ensuring the i-th client satisfies (ε i ,δ i )-Gaussian noise standard deviation σ required by LDP i The minimum lower bound of :

4. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 1, characterized in that: The step three includes the following steps: (1) Setting a global privacy budget; (2) Determine the client sampling ratio; (3),estimating local training sensitivity; (4) Set the total number of communication rounds; (5) Calculate the initial noise standard deviation; (6) Model and parameter distribution.

5. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 4, characterized in that: The step three includes the following steps: (1) Setting the global privacy budget: First, determine the global privacy budget (ε0, δ0) of the entire federated learning task; (2) Determine the client sampling ratio: clarify the ratio of the number of clients K participating in the aggregation to the total number of clients N in each round of training (3) Estimation of local training sensitivity: Estimate the sensitivity Δt of the local training process; (4) Set the total number of communication rounds: Determine the total number of training rounds T for the federated learning task; (5) Calculate the initial noise standard deviation: the calculated initial noise standard deviation σ init for: (6) Model and parameter distribution: The central server initializes the global model w0 and distributes the global model w0 and the calculated σ init Distributed to all participating clients.

6. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 4, characterized in that: The step 4 includes the following steps: (1) Receive the global model and current noise parameters; (2) Local model training; (3) Model update sensitivity clipping; (4) Add differential privacy Gaussian noise; (5) Upload noisy updates.

7. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 6, characterized in that: The step 4 includes the following steps: (1) Receive the global model and current noise parameters: Each client receives the current global model w distributed by the central server t and the noise standard deviation σ used in the current round t ; (2) Local model training: The client uses its local private dataset to train the current global model w t Perform local model training; during this process, the client calculates the update amount Δw of its local model relative to the global model t ; (3) Model update sensitivity trimming: To ensure the sensitivity of local model updates Within a controllable range, the client's update amount Δw t Cutting (4) Add differential privacy Gaussian noise: The client adds the Gaussian noise according to the current round's σ t value, generate a zero mean and standard deviation σ t Gaussian distribution N(0,σ i 2 I) random noise vector Noise; Local model update after noise addition: (5) Upload noisy update: The client updates the local model after adding noise Uploaded to the central server through an encrypted communication channel.

8. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 1, characterized in that: The step five includes the following steps: (1) Receive noisy model updates: The central server receives the noisy local model updates uploaded by all clients participating in this round of training. (2) Secure aggregation operation: The central server aggregates these noisy model updates to form a new global model w t+1 ; (3) Global model performance evaluation: The central server uses an independent validation set that has not participated in training to evaluate the newly generated global model w t+1 Perform rigorous evaluation and accurately calculate its accuracy Acc(w t+1 ); (4) Update the accuracy record: The central server maintains a historical accuracy record list Acc histoty , Acc history =[Acc(w t-3 ),Acc(w t-2 ),Acc(w t-1 ),Acc(w t )].

9. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 8, characterized in that: The step six includes the following steps: The central server uses the list Acc history Based on the accuracy trend of the last four rounds, the noise standard deviation σ of the next round (t+1) is dynamically determined according to the following preset rules. t+1 How to adjust: Among them, σ t is the standard deviation of the noise actually used by the client in the current round t, Acc(w t ) is the accuracy of the global model on the validation set in round t; If the validation accuracy of the model continues to improve in three consecutive rounds, that is, Acc(w t-3 )>Acc(w t-2 )>Acc(w t-1 )>Acc(w t ), the current noise standard deviation σ t Multiply by a noise reduction factor β; If the validation accuracy of the model continues to decline in three consecutive rounds, that is, Acc(w t-3 ) <Acc(w t-2 ) <Acc(w t-1 ) <Acc(w t ), the current noise standard deviation σ t Multiply by a noise expansion factor α.

10. The federated learning differential privacy method based on Rayleigh divergence and adaptive noise adjustment according to claim 1, characterized in that: The step seven includes the following steps: In each round of training, the client receives the current global model w distributed by the central server t and the noise standard deviation σ determined in the current round t , and train on the local dataset, and upload the noisy model updates; the central server aggregates these updates to form a new global model w t+1 , and calculate the noise standard deviation σ for the next round based on its performance on the validation set i+1 ; The central server then w t+1 and σ t+1 Distribute to the client and prepare for the next round of iteration; this iterative process continues until the preset maximum number of training rounds T is reached, or the model reaches the preset convergence condition on the validation set.

Images