Distributed model training method and system, readable storage medium and program product

Abstract

The invention discloses a distributed model training method and system, a readable storage medium and a program product, and belongs to the field of artificial intelligence. The distributed model training method comprises the following steps: performing model training by utilizing a plurality of training servers to obtain a plurality of model parameters, encrypting the plurality of model parameters to obtain a plurality of encrypted model parameters, and uploading the plurality of encrypted model parameters to a shared cache pool; performing anomaly detection on the plurality of encryption model parameters by using the shared cache pool to obtain credible encryption model parameters, and uploading the credible encryption model parameters to a parameter server; aggregating the credible encryption model parameters by using a parameter server to obtain an aggregation result, and issuing the aggregation result to a shared cache pool; and decrypting the aggregation result by using the shared cache pool to obtain global model parameters, and issuing the global model parameters to each training server. Therefore, the model training overhead can be reduced, and the training efficiency of the whole system is improved.

Description

Technical Field

[0001] This application belongs to the field of artificial intelligence, and specifically relates to a distributed model training method, system, readable storage medium and program product. Background Art

[0002] With the development of big data and computing power, as well as the expansion of deep learning models, distributed model training has emerged. This approach splits model training tasks across multiple nodes and performs model training in parallel to accelerate model training. However, in current distributed model training architectures, to ensure consistent model parameters, the training servers executing model training require frequent communication and collaboration. Consequently, current distributed model training methods suffer from high collaboration overhead and low training efficiency. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a distributed model training method, system, readable storage medium and program product to solve the problems of high collaborative overhead and low training efficiency in current distributed model training methods.

[0004] In order to solve the above technical problems, this application is implemented as follows:

[0005] In a first aspect, a distributed model training method is provided. The method is performed by a distributed model training system, the system including a parameter server, a shared cache pool, and multiple training servers. The method includes:

[0006] Utilizing the multiple training servers to perform model training respectively to obtain multiple model parameters, encrypting the multiple model parameters to obtain multiple encrypted model parameters, and uploading the multiple encrypted model parameters to the shared cache pool;

[0007] Performing anomaly detection on the plurality of encryption model parameters using the shared cache pool to obtain credible encryption model parameters, and uploading the credible encryption model parameters to the parameter server;

[0008] Aggregating the trusted encryption model parameters using the parameter server to obtain an aggregation result, and sending the aggregation result to the shared cache pool;

[0009] The aggregated result is decrypted using the shared cache pool to obtain model global parameters, and the model global parameters are sent to each of the training servers.

[0010] In a second aspect, a distributed model training system is provided, comprising: a parameter server, a shared cache pool, and multiple training servers;

[0011] The multiple training servers are used to: perform model training respectively to obtain multiple model parameters, encrypt the multiple model parameters to obtain multiple encrypted model parameters, and upload the multiple encrypted model parameters to the shared cache pool;

[0012] The shared cache pool is used to: perform anomaly detection on the multiple encryption model parameters, obtain credible encryption model parameters, and upload the credible encryption model parameters to the parameter server;

[0013] The parameter server is used to aggregate the trusted encryption model parameters to obtain an aggregation result, and send the aggregation result to the shared cache pool;

[0014] The shared cache pool is further used to: decrypt the aggregation result, obtain model global parameters, and send the model global parameters to each of the training servers.

[0015] In a third aspect, an electronic device is provided, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0016] In a fourth aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0017] In a fifth aspect, a computer program product is provided, comprising computer instructions, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0018] The solution of the embodiment of the present application can reduce direct communication between the training server and the parameter server by introducing a shared cache pool, thereby reducing collaboration overhead and improving the training efficiency of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of a distributed model training method provided in an embodiment of the present application;

[0020] Figure 2 This is a flow chart of a distributed model training method based on shared cache provided in an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of the parameter encryption and decryption process in an embodiment of the present application;

[0022] Figure 4 is a schematic diagram of an anomaly detection process in an embodiment of the present application;

[0023] Figure 5 This is a flow chart of a distributed model training method based on shared cache provided in a specific embodiment of the present application;

[0024] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0027] In order to facilitate understanding of the embodiments of the present application, the following contents are first described.

[0028] The main challenges faced by deep learning model training are as follows: (1) Data is distributed among different organizations, institutions, or individuals, making centralized training impossible. Data silos reduce cross-organizational collaboration and model training efficiency, limiting the application potential of deep learning. (2) In large-scale distributed training, due to communication overhead and synchronization issues between training nodes, the overall training efficiency is low, and computing resources cannot be fully utilized. (3) User data privacy cannot be guaranteed. In centralized training, user data must be transmitted and stored on the server, which increases the risk of data theft or abuse. Even when data is encrypted, some model training processes may still expose sensitive information of user data.

[0029] Distributed deep learning is a technology that distributes deep learning tasks across multiple computing nodes for parallel processing, improving training efficiency and model performance. Distributed model training can leverage the computing resources of multiple machines / devices to process large datasets and complex models, overcoming the computing limitations of a single training device.

[0030] Homomorphic encryption (HE) is a cryptographic technique that allows computation to be performed on encrypted data without decryption. This allows data to be processed in an encrypted state, and the decrypted result is the same as if the original data were directly computed. In threshold homomorphic encryption, the encryption and decryption process requires the collaboration of multiple key holders. Data can only be decrypted when a sufficient number of participants provide their keys. This mechanism enhances security and prevents abuse by a single participant.

[0031] With the rapid development of big data and computing power, the scale of deep learning models continues to expand, making it difficult for a single device to effectively support the training needs of deep learning models. To address this problem, distributed deep learning has emerged. Distributed model training is a technology that splits and distributes model training tasks across multiple computing nodes for parallel processing, accelerating the model training process through multi-node parallel processing. Although distributed model training has performed well in improving model training efficiency, as the scale of training systems continues to expand, key challenges remain in optimizing communication between training nodes, ensuring data privacy, and improving the security and accuracy of model training.

[0032] Distributed model training is typically performed by splitting computing tasks into three approaches: data parallelism, model parallelism, and pipeline parallelism. Data parallelism distributes portions of a dataset to each compute node. Different nodes share the same computing tasks and collaborate primarily by passing model parameters. Model parallelism distributes different parts of the model to different compute nodes, allowing each node to compute a portion of the model. Pipeline parallelism splits the different operators of the model onto different hardware devices, processing data flow between these devices in a pipelined manner. While these parallel approaches can effectively improve training efficiency, they still present challenges such as heavy inter-node communication loads and low node resource utilization. Especially in large-scale systems, inter-node coordination and synchronization become bottlenecks, impacting overall training performance.

[0033] The parameter update method for distributed model training depends largely on the choice of hardware architecture. Common approaches include parameter server architecture, ensemble architecture, data parallel architecture, and model parallel architecture. In the parameter server architecture, multiple compute nodes exchange gradients and model parameters through the parameter server, but this architecture can easily overload the server. The ensemble architecture uses a decentralized approach, allowing different compute nodes to synchronize model parameters through collective communication. However, the frequent collective communication operations incur significant communication overhead. While the data parallel architecture reduces the burden on the parameter server, the data synchronization between nodes is highly dependent, leading to frequent communication. The model parallel architecture, due to model partitioning, leads to high inter-node dependencies and is prone to performance bottlenecks. Overall, existing parameter update methods still face many challenges in ensuring model consistency and training efficiency. In particular, how to effectively balance communication load and computing resources in a distributed environment is an urgent issue that needs to be addressed.

[0034] The above computing nodes may also be called training nodes, training devices, training servers, etc.

[0035] In addition to solving the current problem of high model training overhead, it also specifically solves the following problems:

[0036] (1) Lack of communication and collaboration between multiple training servers: In existing distributed model training architectures, multiple training servers need to communicate and collaborate frequently. In particular, in integrated architectures, each node needs to exchange gradients and model parameters through collective communication operations to ensure parameter uniformity. In data-parallel and model-parallel architectures, each training server must wait for other servers to complete their calculations before synchronizing parameter updates. This greatly increases the communication burden between servers, especially when server performance is inconsistent or data processing speeds are mismatched. This can cause some servers to be idle, reducing overall system efficiency. In addition, frequent communication operations can also increase network overhead and latency, affecting model training speed.

[0037] (2) Data sharing among training servers brings data privacy protection issues: Existing distributed model training methods rely on multiple training servers to share gradients and model parameters after each iteration. Especially in data parallel architectures, each node needs to share the gradient information of its local training data, which makes sensitive data at risk of leakage. Because each training server exchanges model parameters containing data features during communication, attackers can infer the specific content of the training data by analyzing these parameters, thereby infringing user privacy. Although data can be protected through encryption, this often increases the computational and communication costs of the system and cannot completely avoid the risk of privacy leakage.

[0038] (3) Trust issues with training servers, resulting in deep learning models being vulnerable to attacks: Related technologies are insufficient in ensuring the trustworthiness of training servers, making trained models vulnerable to attacks. In some scenarios, malicious servers can maliciously interfere with the global model by uploading incorrect gradient information or model parameters, or even obtain sensitive training data from other servers by reversely inferring model outputs. Such attacks not only affect the accuracy of the model, but may also lead to data leakage, further damaging the security of the system and user privacy. The existing distributed model training architecture lacks an effective mechanism to evaluate the trustworthiness of training nodes and is unable to effectively filter and prevent malicious nodes.

[0039] To address the above issues, the solution in this application proposes a distributed model training method based on shared cache, aiming to effectively address the communication load, data privacy, and training server credibility issues in the existing technology. The solution in this application optimizes the communication efficiency between the training server and the parameter server (PS) by introducing a shared cache pool (SCP) between the training server and the parameter server (PS), significantly reducing the high overhead caused by direct communication, while improving the system's parallel processing capability and data transmission performance. Specifically, the shared cache pool is deployed between the parameter server and the training server to temporarily store and manage the encrypted model parameters uploaded by the training server. The shared cache pool can effectively reduce communication delays between multiple nodes through centralized caching and asynchronous aggregation mechanisms, and alleviate resource waste caused by heterogeneous node computing performance through a phased data transmission strategy. In terms of privacy protection, the datasets of each training server are independently distributed. Localized training avoids data sharing, fundamentally avoiding the risk of privacy leakage. Each training server independently completes model training based on local data and uploads the encrypted model parameters to the shared cache pool. In order to ensure the security and operability of uploaded parameters during transmission, this solution can adopt Homomorphic Encryption (HE) technology, so that encrypted parameters can participate in the aggregate calculation of the global model without decryption, further preventing data from being maliciously tampered with during transmission, and enhancing the system's risk resistance to threats such as Byzantine failures. In addition, to ensure the reliability and credibility of global model parameter updates, the solution in this application combines a parameter anomaly detection mechanism based on threshold encryption, which can filter and remove abnormal parameters from malicious training servers in the shared cache pool in real time, preventing erroneous parameters from affecting the accuracy of the global model. In addition, the solution in this application introduces a reputation scoring mechanism for training servers, thereby effectively suppressing the interference of malicious training servers on the global model, significantly improving the robustness of the distributed deep learning process and the credibility of the training results.

[0040] According to the solution in this application, at least the following technical effects can be achieved:

[0041] (1) Reduce communication load and improve node collaboration efficiency: The solution in this application reduces direct communication between training servers and parameter servers by introducing a shared cache pool. The shared cache pool is mainly responsible for collecting and storing model parameters uploaded by each training server, and summarizing and uploading them to the parameter server for aggregation. In this way, there is no need for frequent synchronous communication between training servers, which reduces the collaboration overhead between server nodes and improves the training efficiency of the overall system. In addition, the introduction of a shared cache pool can effectively avoid the problem of idle computing resources, especially when the performance of the training servers is inconsistent, and can balance the computing tasks of each training server.

[0042] (2) Protecting data privacy: The solution in this application protects data privacy by enabling each training server to independently perform model training based on its own data set. During the model training process, each training server encrypts the model parameters using homomorphic encryption, and uploads the encrypted model parameters to a shared cache pool before aggregating and decrypting the model parameters. By using encryption and collaborative decryption, the data privacy of each training server can be effectively protected, avoiding the problem of sensitive information leakage caused by gradient sharing in a data parallel architecture. In addition, the use of threshold homomorphic encryption technology further enhances the privacy protection capabilities of the system.

[0043] (3) Improving the credibility of training servers: To ensure the security of model training, the solution in this application introduces an anomaly detection algorithm based on threshold homomorphic encryption technology and a reputation scoring mechanism for training servers. The anomaly detection algorithm can effectively filter out abnormal parameters from untrusted training servers, preventing malicious training servers from uploading erroneous data that affects the global model. The reputation scoring mechanism dynamically scores the training server based on its historical behavior and the credibility of the uploaded model parameters, reducing the weight of the parameters of untrusted training servers in the global model, thereby improving the security of the distributed model training system and the reliability of the model training results.

[0044] The following, in conjunction with the accompanying drawings, describes in detail the distributed model training method, system, readable storage medium and program product provided in the embodiments of the present application through specific embodiments and their application scenarios.

[0045] See Figure 1 , Figure 1This is a flowchart of a distributed model training method provided in an embodiment of the present application. The method is performed by a distributed model training system, which includes a parameter server, a shared cache pool, and multiple training servers. The parameter server is, for example, a single parameter server, and multiple parameter servers can also be set up according to actual needs. The shared cache pool is, for example, a single shared cache pool, and multiple shared cache pools can also be set up according to actual needs. The training servers are independent of each other and do not affect each other. Their main function is to train the model using their own local data, encrypt the obtained model parameters, and upload the encrypted model parameters to the shared cache pool. After the shared cache pool collects the encrypted model parameters from each training server within a specified time, it filters these encrypted model parameters, selects credible encrypted model parameters, and uploads the credible encrypted model parameters to the parameter server to reduce communication load and ensure parameter security. The parameter server is responsible for obtaining credible encrypted model parameters from the shared cache pool and aggregating them to update the global model. The updated global model parameters are distributed to each training server through the shared cache pool, without the need to communicate with each training server individually each time.

[0046] like Figure 1 As shown, the distributed model training method includes the following steps:

[0047] Step 11: Utilize multiple training servers to perform model training respectively to obtain multiple model parameters, encrypt the multiple model parameters to obtain multiple encrypted model parameters, and upload the multiple encrypted model parameters to a shared cache pool;

[0048] Step 12: Use the shared cache pool to perform anomaly detection on the multiple encryption model parameters to obtain credible encryption model parameters, and upload the credible encryption model parameters to the parameter server;

[0049] Step 13: Utilize the parameter server to aggregate the trusted encryption model parameters to obtain an aggregation result, and send the aggregation result to the shared cache pool;

[0050] Step 14: Decrypt the aggregation result using the shared cache pool to obtain the model global parameters, and send the model global parameters to each training server.

[0051] It should be noted that after receiving the global model parameters, each training server will update its own model parameters to obtain the model for the next round of training and continue to step 11. The above process is repeated until the model converges or the maximum number of iterations is reached, resulting in a trained model. In this solution, a deep learning model can be selected.

[0052] The solution of the embodiment of the present application can reduce direct communication between the training server and the parameter server by introducing a shared cache pool, thereby reducing collaboration overhead and improving the training efficiency of the overall system.

[0053] Optionally, each training server stores a public key and a private key shard, and the private key shard in each training server is obtained by splitting the private key corresponding to the public key. For example, a parameter server or other device can generate public and private keys for encrypting and decrypting model parameters, and then uniformly distribute the public key to each training server, and distribute the private key to each training server in the form of shards. That is, the private key is split into multiple private key shards according to a threshold key splitting algorithm, and each training server obtains a private key shard. No single training server can use its own private key shard to decrypt the global model parameters alone. Only when a sufficient number of shards are collected can a complete private key be synthesized to achieve decryption of the model parameters.

[0054] The encrypting the multiple model parameters to obtain the multiple encrypted model parameters may include: encrypting the multiple model parameters respectively according to the public key in each training server to obtain the multiple encrypted model parameters.

[0055] The above-mentioned use of a shared cache pool to decrypt the aggregated results and obtain global model parameters may include: sending the aggregated results from the shared cache pool to m training servers, respectively, where the m training servers correspond to the trusted encrypted model parameters, and m is an integer greater than 1; decrypting the aggregated results according to the private key shards in each of the m training servers to obtain m decrypted shards; and merging s decrypted shards using the shared cache pool to obtain global model parameters, where s is greater than or equal to a preset value and less than or equal to m, and s is an integer greater than 1. In this way, through encryption and collaborative decryption, the data privacy of each training server can be effectively protected.

[0056] Optionally, the preset value is greater than or equal to the difference between the number of training servers in the system and the maximum number of malicious training servers. The preset value can be understood as the minimum number of training servers required to participate in the decryption process of the aggregated results. Only after collecting enough decrypted fragments can the decrypted global model parameters be merged.

[0057] In this embodiment of the present application, a reputation scoring mechanism can be used to ensure the security and accuracy of the global model. Optionally, the parameter server can be used to initialize the reputation score of each training server, where the reputation score of each training server is determined based on the historical training behavior of each training server and / or the quality of the uploaded model parameters.

[0058] Optionally, aggregating the trusted encryption model parameters using a parameter server to obtain an aggregation result may include:

[0059] The parameter server performs weighted aggregation on the trusted encrypted model parameters to obtain the aggregation result; wherein the weight of each encrypted model parameter in the trusted encrypted model parameters is proportional to the reputation score of the training server corresponding to each encrypted model parameter. In this way, the weight of the parameters of untrusted training servers in the global model can be reduced, thereby improving the security of the distributed model training system and the reliability of the model training results.

[0060] Optionally, the reputation score of the training server is determined based on at least one of the following:

[0061] Whether the model parameters uploaded by the training server in the past are credible parameters; for example, if the encrypted model parameters uploaded by the training server pass the anomaly detection and are credible parameters, the reputation points of the training server will be increased; otherwise, the reputation points of the training server will be reduced.

[0062] Whether the training server uploads the trained model parameters within the specified iteration period. For example, if the training server fails to upload the model parameters before the end of the iteration period, the reputation points of the training server will be deducted.

[0063] In the embodiment of the present application, the influence of malicious training servers can be avoided by using an anomaly detection algorithm.

[0064] Optionally, the parameter server may be configured to: based on historical training results, set a minimum scoring threshold for performing anomaly detection on the encryption model parameters of the training server.

[0065] Optionally, the above-mentioned using the shared cache pool to perform anomaly detection on the multiple encryption model parameters to obtain credible encryption model parameters may include:

[0066] The shared cache pool is used to perform the following operations:

[0067] respectively determining whether the plurality of encryption model parameters are from a trusted training server;

[0068] Determine an encrypted model parameter from a trusted training server among the multiple encrypted model parameters as a trusted encrypted model parameter. And for a first encrypted model parameter from the multiple encrypted model parameters that is not from a trusted training server, if the first encrypted model parameter's anomaly score is below a minimum score threshold, determine the first encrypted model parameter as a trusted encrypted model parameter. The anomaly score of the first encrypted model parameter can be determined based on factors such as the probability that the first encrypted model parameter is from an untrusted training server and / or the historical reputation of the corresponding training server. Thus, the anomaly detection algorithm can effectively filter out abnormal parameters from untrusted training servers, preventing malicious training servers from uploading erroneous data that could impact the global model.

[0069] Optionally, separately determining whether the multiple encryption model parameters come from a trusted training server may include: separately processing the multiple encryption model parameters through a K-Nearest Neighbors (KNN) model to determine whether each encryption model parameter comes from a trusted training server; wherein, when the average distance between the encryption model parameter and multiple sample parameters of its nearest neighbors is less than or equal to a preset distance threshold, determining that the encryption model parameter comes from a trusted training server; or, when the average distance between the encryption model parameter and multiple sample parameters of its nearest neighbors is greater than the preset distance threshold, determining that the encryption model parameter does not come from a trusted training server. The KNN model mainly determines abnormal situations by calculating the distance between the encryption model parameter and historical samples. For each encrypted model parameter, the KNN model calculates its distance from historical samples and selects the nearest K neighbors. If most of these neighbors are normal samples and have a close average distance to the encrypted model parameter, the encrypted model parameter is judged to be normal, i.e., it comes from a trusted training server. This average distance can be considered as the anomaly score or anomaly probability of the encrypted model parameter. If the average distance between the encrypted model parameter and normal samples is large or the proportion of abnormal neighbors is high, the encrypted model parameter is judged to be abnormal, i.e., it comes from an untrusted training server. This average distance can be considered as the anomaly score or anomaly probability of the encrypted model parameter.

[0070] The solution in this application is described in detail below with reference to examples.

[0071] like Figure 2As shown, this example uses a distributed model training method based on a shared cache pool. During one iteration, each training server independently trains the model using local data and uploads the encrypted training results to the shared cache pool. After collecting the encrypted model parameters from each training server within a specified timeframe, the shared cache pool uses a shared cache parameter anomaly detection algorithm based on threshold homomorphic encryption to filter these encrypted model parameters and upload the filtered, legitimate parameter sets to the parameter server. The parameter server aggregates the encrypted model parameters based on the reputation scoring mechanism of the distributed deep learning training servers and transmits the aggregated results back to the shared cache pool. The shared cache pool then sends this aggregated result to each training server for decryption, resulting in the next round of model parameters. This process repeats until the model reaches the maximum limit or converges.

[0072] Specifically, the shared cache parameter anomaly detection algorithm based on threshold homomorphic encryption technology is responsible for filtering the encrypted model parameters from each training server, selecting legitimate model parameter sets. This ensures that the system can correctly decrypt the model parameters when the proportion of legitimate training servers is between 50% and 100%. The reputation points mechanism based on distributed deep learning training servers uses the reputation score of each training server to assign weight to the uploaded model parameters in the aggregation process. This reduces the impact of model parameters from untrusted training servers and ensures that model parameters from each training server can be securely aggregated.

[0073] like Figure 2 and Figure 3 As shown, the specific training process may include:

[0074] S1: The parameter server randomly initializes the model parameters, mainly including:

[0075] (1) The total number of training servers n and the maximum tolerated number of malicious training servers x are preset.

[0076] (2) Generate public and private keys for encryption and decryption of model parameters. The public key is uniformly distributed to each training server, and the private key is distributed to each training server in the form of shards.

[0077] (3) Initialize the reputation score of each training server. At the beginning, the reputation score of each training server is the same, and there is no bonus or penalty for historical behavior. The reputation score of each training server can be dynamically adjusted based on factors such as historical training behavior, stability of contribution, and quality of uploaded model parameters. For example, a reputation score table can be maintained, in which the reputation score corresponding to training server M1 is G1, the reputation score corresponding to training server M2 is G2, ..., and the reputation score corresponding to training server Mn is Gn, so that the reputation score of each training server can be dynamically adjusted.

[0078] (4) Based on historical training results, the minimum scoring threshold of the shared cache parameter anomaly detection algorithm based on threshold homomorphic encryption technology is generated.

[0079] (5) Generate the minimum number W of training servers required to participate in the decryption process of the aggregated results, where W is the difference nx between the total number of training servers and the maximum tolerated number of malicious training servers.

[0080] Each training server (such as M1, M2...Mn) initializes a local data set (such as D1, D2...Dn) and a model training iteration cycle.

[0081] S2: Each training server independently trains the model based on local data. After model training is complete within the specified training cycle, each training server encrypts the training-generated gradients or updated model parameters using the public key distributed during the initialization phase and uploads the encrypted model parameters to the shared cache pool.

[0082] S3: The shared cache pool collects the encrypted model parameters from each training server and obtains the legal parameter set through the shared cache parameter anomaly detection algorithm based on threshold homomorphic encryption technology. This step does not require decryption of the encrypted model parameters. It aims to ensure that the parameters passed in during the aggregation process come from trusted training servers and prevent untrusted or abnormal parameters from affecting the final aggregation results. It mainly includes three sub-steps: parameter anomaly detection, scoring based on detection results, and discarding abnormal parameters. Figure 4 As shown in the figure, the specific processing process includes:

[0083] S31: Receive encrypted model parameters from each training server.

[0084] S32: Determine whether the encryption model parameters are uploaded within the specified iteration period; if an encryption model parameter is not uploaded within the specified iteration period, the encryption model parameter will be discarded, and the reputation points of the corresponding training server will be deducted. If the reputation points are deducted to 0, the training server will be blacklisted; if an encryption model parameter is uploaded within the specified iteration period, execute S33.

[0085] S33: For encryption model parameters uploaded within the specified iteration cycle, determine whether the encryption model parameters originate from a trusted training server. This determination can be performed by performing anomaly detection using a pre-trained KNN model. Specifically, each encryption model parameter is input into the KNN model and the distances between each encryption model parameter and the K nearest neighbors in the training sample set (including both normal and abnormal samples) are calculated, thereby assessing the credibility of these encryption model parameters. For an encryption model parameter uploaded from a training server, if its neighbors are mostly normal samples and have a close average distance to the encryption model parameter, the encryption model parameter is considered normal, i.e., originating from a trusted training server. This average distance can be used to determine the anomaly score or probability of the encryption model parameter. If the average distance from normal samples is greater or the proportion of abnormal neighbors is higher, the encryption model parameter is considered abnormal, i.e., not originating from a trusted training server. This average distance can be used to determine the anomaly score or probability of the encryption model parameter. If the encryption parameter uploaded by the training server passes anomaly detection, its reputation score is increased.

[0086] S34: Add the encrypted model parameters from the trusted training server to the legal parameter set.

[0087] S35: For the encryption model parameters from the untrusted training server, a weighted calculation is performed based on the anomaly score (or anomaly probability) of the encryption model parameters and combined with the historical reputation, etc. to obtain the detection score of the encryption model parameters from the untrusted training server.

[0088] S36: Compare the detection score with the minimum score threshold generated during the initialization phase to determine whether the detection score is lower than the minimum score threshold. If the detection score is lower than the minimum score threshold, the corresponding encryption model parameters are deemed invalid and discarded. If the detection score is not lower than the minimum score threshold, the corresponding encryption model parameters are added to the set of valid parameters. The reputation points of the training server from which the invalid parameters filtered out by anomaly detection originated will be deducted. If the reputation points are deducted to 0, the training server will be blacklisted.

[0089] S4: The shared cache pool uploads the obtained legal parameter set to the parameter server.

[0090] S5: The parameter server securely aggregates the encrypted model parameters from the shared cache pool using a reputation scoring mechanism based on the distributed deep learning training servers. The aggregation process assigns weights based on the training server's reputation score. The honesty of the training server is proportional to its reputation score and the weight assigned to the encrypted model parameters uploaded by the server in the aggregation process. Encrypted model parameters from training servers with high reputation scores are given higher weight in the aggregation process.

[0091] S6: The parameter server returns the encrypted aggregation result obtained after the aggregation is completed to the shared cache pool.

[0092] S7: The shared cache pool sends the encrypted aggregated result to each training server. Each training server decrypts the encrypted aggregated result using its private key shards to obtain decrypted shards. However, each training server's decryption shard cannot independently decrypt the encrypted aggregated result. Once the shared cache pool has collected a sufficient number of decrypted shards (i.e., greater than or equal to W), it merges these shards to obtain the plaintext, completing the decryption. If the number of decrypted shards collected is less than W, the decryption is invalid.

[0093] If the model reaches the maximum limit or converges, the model training ends. Otherwise, the aggregation results of this round are sent to each training server as the model parameters for the next round of iteration, and the model training is continued in S2 and the above process is repeated.

[0094] A specific implementation method, such as Figure 5 As shown in Figure 1, a distributed deep learning system based on shared cache consists of one parameter server S, one shared cache pool M, and four training servers: M1, M2, M3, and M4. The local datasets of the four training servers are D1, D2, D3, and D4, respectively. The system includes one Byzantine node, M1. Taking the first round of iteration as an example, the specific model training steps are as follows:

[0095] S1: The parameter server S is randomly initialized and generates the public key pk and private key shards d1, d2, d3, and d4 for parameter encryption and decryption. The reputation points of all training servers are set to 50, the minimum score threshold of the shared cache parameter anomaly detection algorithm based on threshold homomorphic encryption technology is set to 30, and the minimum number of training servers required to participate in the decryption process of the aggregated results is set to 3. The training servers M1, M2, M3, and M4 are independent of each other and perform model training based on their respective local data sets D1, D2, D3, and D4 in a specified period to generate gradients w1, w2, w3, and w4. They use the public key pk to encrypt w1, w2, w3, and w4 respectively to obtain the encrypted gradient w ’ 1. w ’ 2. w ’ 3. w ’ 4.

[0096] S2: Each training server uploads the encrypted gradient to the shared cache pool M.

[0097] S3: Shared cache pool M collects the encrypted gradient w uploaded by training servers M1, M2, M3, and M4 ’ 1. w ’ 2. w ’ 3. w ’4, and perform abnormal detection on these encrypted gradients. The specific detection method is as described above. If M2, M3, and M4 upload w ’ 2. w ’ 3. w ’ 4 passes the test, then the credit score of M2, M3, and M4 will be increased by 5 respectively. ’ 1 comes from the Byzantine node M1, and the anomaly detection score is 25, which is lower than the set minimum threshold of 30. Then w ’ 1 is discarded by the shared cache pool M as an invalid parameter, and the credit score of M1 is reduced by 10.

[0098] S4: The shared cache pool M encrypts the gradient w ’ 2. w ’ 3. w ’ 4Upload to parameter server S.

[0099] S5: Parameter server S receives the encrypted gradient w ’ 2. w ’ 3. w ’ 4 performs secure aggregation and obtains the encrypted aggregation result R. Since the reputation points of training servers M2, M3, and M4 are the same, all 55, so w ’ 2. w ’ 3. w ’ 4 have the same weight in the aggregation process, 1 / 3 each.

[0100] S6: After the aggregation is completed, the parameter server S returns the encrypted aggregation result R to the shared cache pool M.

[0101] S7: The shared cache pool M sends the encrypted aggregation result R to the training servers M2, M3, and M4. The training servers M2, M3, and M4 use the private key fragments to decrypt R and generate decrypted fragments. The shared cache pool M collects the decrypted fragments d from M2, M3, and M4. ’ 2.d ’ 3.d ’ 4. When 3 decrypted fragments are collected, these 3 decrypted fragments are merged to successfully decrypt the plaintext R ’ .

[0102] Afterwards, the shared cache pool can store the aggregated results R ’ The next round of model parameters are sent to training servers M1, M2, M3, and M4, and then returned to S2 to repeat the above process until the model reaches the maximum limit or converges.

[0103] In summary, the solution in this application proposes a distributed model training method based on a shared cache pool. By optimizing the communication structure between the training server and the parameter server, the efficiency and security of the system are improved. In this solution, the data privacy of the training server is protected through independent training, and homomorphic encryption technology is introduced to effectively prevent attacks from malicious servers and model tampering. This solution aims to solve technical problems such as heavy communication load, data privacy leakage, and insufficient security in existing distributed deep learning systems. The solution in this application can at least achieve the following technical effects:

[0104] (1) Introduction of shared cache pool and communication optimization: The solution in this application effectively reduces the direct communication overhead between the training server and the parameter server by introducing a shared cache pool between the parameter server and the training server, reduces the communication load of the system, and avoids frequent collective communication operations through the aggregation function of the shared cache pool, effectively improves the concurrent processing efficiency of the system, reduces the synchronization delay generated by multiple nodes in the data exchange process, and improves the overall training efficiency.

[0105] (2) Independent dataset training and privacy protection: In this solution, the training servers perform model training based on their own independent datasets, avoiding the transmission and sharing of data between servers, fundamentally preventing the leakage of sensitive information, and thus achieving data privacy protection. In this way, the solution in this application solves the data leakage risk under the traditional data parallel architecture in distributed deep learning, ensuring that the local data of each training server is only used locally, eliminating the need to exchange sensitive information between nodes. This independent training method is suitable for scenarios involving personal data or multi-organizational collaboration, and can effectively reduce the risk of data leakage.

[0106] (3) Homomorphic encryption and security assurance: The solution in this application uses homomorphic encryption technology to ensure that the model parameters uploaded by the training server can still participate in the aggregate calculation of the global model in an encrypted state. This not only enhances the security of the data and prevents the data from being maliciously tampered with during transmission, but also effectively defends against potential threats such as Byzantine attacks. Homomorphic encryption technology allows calculations to be performed on encrypted data, thereby ensuring the accuracy and credibility of model training without leaking the original data. This encryption method is suitable for data scenarios that require high privacy protection. The solution in this application not only relies on homomorphic encryption, but also combines anomaly detection algorithms to effectively filter abnormal parameters uploaded by malicious nodes, prevent Byzantine attacks, and further improve the security of the system and the credibility of the model.

[0107] (4) Reputation Scoring Mechanism and Anti-attack Capability: To prevent untrusted nodes from disrupting model training, the solution in this application introduces a reputation scoring mechanism that assigns different weights to the model parameters uploaded by the training server based on its historical behavior, thereby reducing potential threats from malicious servers. The reputation scoring mechanism in this application not only optimizes the synchronization process, but also defends against malicious behaviors such as Byzantine attacks, ensuring the reliability of the global model. By combining anomaly detection algorithms and reputation scoring mechanisms, the solution in this application further improves the system's anti-attack capabilities, effectively protecting data privacy and the security of model training, especially in applications in untrusted computing environments.

[0108] The solution in this application provides an efficient and secure solution for distributed deep learning by introducing a shared cache pool, homomorphic encryption technology, and a reputation scoring mechanism. This is reflected in the following aspects:

[0109] (a) With data privacy issues gaining increasing attention, the solution in this application enables secure distributed model training in a multi-party data collaboration environment. This is particularly suitable for untrusted computing environments, such as collaborative projects between different organizations and institutions. Through homomorphic encryption technology, data can be used for computing while still encrypted, eliminating the risk of data leakage. This technology has significant market demand in highly sensitive data scenarios such as finance and healthcare.

[0110] (b) The solution in this application is particularly suitable for defending against malicious nodes in distributed deep learning. In a distributed environment, there is a risk of nodes being maliciously exploited to launch model attacks. This solution, through a reputation scoring mechanism, effectively identifies and suppresses the influence of malicious nodes, ensuring the accuracy and security of model training. This feature gives this technology broad application prospects in areas such as network security and the Internet of Things, and can provide enterprises and institutions with more secure and reliable distributed system solutions, reducing potential security threats and operational risks.

[0111] (c) The solution in this application demonstrates great flexibility in processing cross-regional and cross-institutional data training. By supporting the independent deployment of training servers in different regions or organizations without the need to transmit original data, the solution can achieve collaborative training of deep models. This capability is particularly suitable for scenarios where data is dispersed and not convenient for centralized storage or sharing, such as complex distributed systems such as smart cities and global supply chains. The application of this technology not only improves the efficiency of data utilization, but also reduces the compliance risks of cross-border data transmission, further expanding the possibility of its commercial application.

[0112] (d) Considering the computational load and communication overhead of distributed deep learning, the solution in this application effectively reduces direct communication between training servers by introducing a shared cache pool, thereby improving the system's concurrent processing capabilities. This communication optimization technology has significant advantages in large-scale distributed computing environments, and can help companies improve system training efficiency and reduce hardware and network costs. Therefore, the solution in this application has extremely high commercial value in industrial application scenarios that require efficient resource utilization and low-latency communication, especially in fields such as cloud computing and big data analysis.

[0113] Optionally, an embodiment of the present application further provides a distributed model training system, comprising: a parameter server, a shared cache pool, and multiple training servers;

[0114] The multiple training servers are used to: perform model training respectively to obtain multiple model parameters, encrypt the multiple model parameters to obtain multiple encrypted model parameters, and upload the multiple encrypted model parameters to the shared cache pool;

[0115] The shared cache pool is used to: perform anomaly detection on the multiple encryption model parameters, obtain credible encryption model parameters, and upload the credible encryption model parameters to the parameter server;

[0116] The parameter server is used to aggregate the trusted encryption model parameters to obtain an aggregation result, and send the aggregation result to the shared cache pool;

[0117] The shared cache pool is further used to: decrypt the aggregation result, obtain model global parameters, and send the model global parameters to each of the training servers.

[0118] Optionally, the parameter server is further used to initialize the reputation score of each training server, wherein the reputation score of each training server is determined based on the historical training behavior of each training server and / or the quality of uploaded model parameters.

[0119] Optionally, the parameter server is further used to: set a minimum scoring threshold for anomaly detection on the encryption model parameters of the training server based on historical training results.

[0120] Optionally, each of the training servers stores a public key and a private key fragment, and the private key fragment in each of the training servers is obtained by splitting the private key corresponding to the public key;

[0121] The multiple training servers are further configured to: encrypt the multiple model parameters respectively according to the public key in each of the training servers to obtain the multiple encrypted model parameters;

[0122] The shared cache pool is further configured to: send the aggregation results to m training servers respectively, where the m training servers correspond to the trusted encryption model parameters, and m is an integer greater than 1;

[0123] The m training servers are used to: decrypt the aggregation results respectively according to the private key shards therein to obtain m decrypted shards;

[0124] The shared cache pool is also used to merge s decrypted fragments to obtain the model global parameters, where s is greater than or equal to a preset value and less than or equal to m, and s is an integer greater than 1.

[0125] Optionally, the preset value is greater than or equal to the difference between the number of training servers in the system and a preset maximum number of malicious training servers.

[0126] Optionally, the parameter server is further used to: perform weighted aggregation on the trusted encryption model parameters to obtain the aggregation result; wherein the weight of each encryption model parameter in the trusted encryption model parameters is proportional to the reputation score of the training server corresponding to each encryption model parameter.

[0127] Optionally, the reputation score of the training server is determined based on at least one of the following:

[0128] Whether the model parameters historically uploaded by the training server are credible parameters;

[0129] Whether the training server uploads the model parameters obtained through training within the specified iteration period.

[0130] Optionally, the shared cache pool is further configured to perform the following operations:

[0131] respectively determining whether the plurality of encryption model parameters are from a trusted training server;

[0132] Determine an encrypted model parameter from a trusted training server among the multiple encrypted model parameters as a trusted encrypted model parameter, and for a first encrypted model parameter from the multiple encrypted model parameters that is not from a trusted training server, when an abnormality score of the first encrypted model parameter is lower than a minimum score threshold, determine the first encrypted model parameter as a trusted encrypted model parameter.

[0133] Optionally, the shared cache pool is also used to: process the multiple encrypted model parameters separately through the KNN model to obtain whether each encrypted model parameter comes from a trusted training server; wherein, when the average distance between the encrypted model parameter and multiple sample parameters of its nearest neighbors is less than or equal to a preset distance threshold, it is determined that the encrypted model parameter comes from a trusted training server; or, when the average distance between the encrypted model parameter and multiple sample parameters of its nearest neighbors is greater than the preset distance threshold, it is determined that the encrypted model parameter does not come from a trusted training server.

[0134] Optional, such as Figure 6 As shown, an embodiment of the present application also provides an electronic device 60, including a processor 61, a memory 62, and a program or instruction stored in the memory 62 and executable on the processor 61. When the program or instruction is executed by the processor 61, each process of the above-mentioned distributed model training method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0135] An embodiment of the present application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, the various processes of the above-mentioned distributed model training method embodiment can be implemented and the same technical effect can be achieved. To avoid repetition, they will not be repeated here.

[0136] An embodiment of the present application also provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned distributed model training method embodiment can be implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0137] Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0138] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0139] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0140] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a service classification device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0141] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A distributed model training method, characterized in that: The method is performed by a distributed model training system, the system including a parameter server, a shared cache pool, and multiple training servers, and the method includes: Utilizing the multiple training servers to perform model training respectively to obtain multiple model parameters, encrypting the multiple model parameters to obtain multiple encrypted model parameters, and uploading the multiple encrypted model parameters to the shared cache pool; Performing anomaly detection on the plurality of encryption model parameters using the shared cache pool to obtain credible encryption model parameters, and uploading the credible encryption model parameters to the parameter server; Aggregating the trusted encryption model parameters using the parameter server to obtain an aggregation result, and sending the aggregation result to the shared cache pool; The aggregated result is decrypted using the shared cache pool to obtain model global parameters, and the model global parameters are sent to each of the training servers.

2. The method according to claim 1, characterized in that Each of the training servers stores a public key and a private key fragment, wherein the private key fragment in each of the training servers is obtained by splitting the private key corresponding to the public key; The step of encrypting the plurality of model parameters to obtain a plurality of encrypted model parameters includes: Encrypting the multiple model parameters according to the public key in each training server to obtain the multiple encrypted model parameters; The step of decrypting the aggregated result using the shared cache pool to obtain the global model parameters includes: Sending the aggregated results from the shared cache pool to m training servers respectively, where the m training servers correspond to the trusted encryption model parameters, and m is an integer greater than 1; Decrypting the aggregated result according to the private key shard in each of the m training servers to obtain m decrypted shards; The shared cache pool is used to merge s decrypted fragments to obtain the model global parameter, where s is greater than or equal to a preset value and less than or equal to m, and s is an integer greater than 1.

3. The method according to claim 2, characterized in that The preset value is greater than or equal to the difference between the number of training servers in the system and the maximum number of preset malicious training servers.

4. The method according to claim 1, wherein The utilizing the parameter server to aggregate the trusted encryption model parameters to obtain an aggregation result includes: The parameter server is used to perform weighted aggregation on the trusted encryption model parameters to obtain the aggregation result; wherein the weight of each encryption model parameter in the trusted encryption model parameters is proportional to the reputation score of the training server corresponding to each encryption model parameter.

5. The method according to claim 4, characterized in that The reputation score of the training server is determined based on at least one of the following: Whether the model parameters historically uploaded by the training server are credible parameters; Whether the training server uploads the model parameters obtained through training within the specified iteration period.

6. The method according to claim 1, characterized in that The utilizing the shared cache pool to perform anomaly detection on the plurality of encryption model parameters to obtain credible encryption model parameters includes: The shared cache pool is used to perform the following operations: respectively determining whether the plurality of encryption model parameters are from a trusted training server; Determine an encrypted model parameter from a trusted training server among the multiple encrypted model parameters as a trusted encrypted model parameter, and for a first encrypted model parameter from the multiple encrypted model parameters that is not from a trusted training server, when an abnormality score of the first encrypted model parameter is lower than a minimum score threshold, determine the first encrypted model parameter as a trusted encrypted model parameter.

7. The method according to claim 6, characterized in that The respectively determining whether the plurality of encrypted model parameters are from a trusted training server includes: The multiple encrypted model parameters are processed separately by the K nearest neighbor (KNN) model to obtain whether each of the encrypted model parameters comes from a trusted training server; wherein, when the average distance between the encrypted model parameter and multiple sample parameters of its nearest neighbors is less than or equal to a preset distance threshold, it is determined that the encrypted model parameter comes from a trusted training server; or, when the average distance between the encrypted model parameter and multiple sample parameters of its nearest neighbors is greater than the preset distance threshold, it is determined that the encrypted model parameter does not come from a trusted training server.

8. A distributed model training system, characterized in that: include: Parameter servers, shared cache pool, and multiple training servers; The multiple training servers are used to: perform model training respectively to obtain multiple model parameters, encrypt the multiple model parameters to obtain multiple encrypted model parameters, and upload the multiple encrypted model parameters to the shared cache pool; The shared cache pool is used to: perform anomaly detection on the multiple encryption model parameters, obtain credible encryption model parameters, and upload the credible encryption model parameters to the parameter server; The parameter server is used to aggregate the trusted encryption model parameters to obtain an aggregation result, and send the aggregation result to the shared cache pool; The shared cache pool is further used to: decrypt the aggregation result, obtain model global parameters, and send the model global parameters to each of the training servers.

9. The system according to claim 8, characterized in that The parameter server is further configured to initialize the reputation score of each training server, wherein the reputation score of each training server is determined based on the historical training behavior of each training server and / or the quality of uploaded model parameters.

10. The system according to claim 8, wherein: The parameter server is further configured to set a minimum scoring threshold for performing anomaly detection on the encryption model parameters of the training server based on historical training results.

11. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

12. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 7.

Images