A differential privacy federated forgetting learning method and system based on update residual

Abstract

The application discloses a differential privacy federated forgetting learning method and system based on update residual, and the method comprises the following steps: a server sends a current global model to a client; the client performs federated learning cycle training on the current global model; a local model update is generated by performing differential privacy protection on the global model; the server integrates all the updates uploaded by all the clients through a cycle weighting aggregation strategy; a target client starts to calculate the weighted update residual of the client in the historical training through a forgetting request; and the forgetting model is obtained by removing all the historical weighted update residuals of the target client from the global model through the weighted update residual. The forgetting model and the retraining model are indistinguishable in a statistical sense by differential privacy, the learning ability of the model for local data is improved by adopting a cycle weighting aggregation, the incremental effect of the client to be forgotten is quantified by adopting an update residual, and all the historical weighted update residuals are removed to realize federated forgetting.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a differential privacy federated forgetting learning method and system based on update residual. BACKGROUND

[0002] Differential privacy is a widely recognized privacy protection paradigm, aiming to ensure the privacy of individual data in the data set from being leaked. The core method of differential privacy is to add noise to the query result to ensure that the addition or deletion of a single data does not significantly affect the query result, thereby avoiding the leakage of information about any record in the data set. Federated learning allows multiple participants to collaborate to train a model without sharing their own private data, and has become a widely used distributed training framework in the field of artificial intelligence. It effectively solves the problems of data privacy protection, cross-device collaborative learning, computational resource optimization and data silos. However, the federated learning model can remember information about the training data, which still poses an unprecedented risk of data security and privacy leakage. Federated forgetting learning can delete certain client data and the influence of these data on the global model of federated learning from the learned model. The most direct method of forgetting is to train the model from scratch, but the high computational cost limits the feasibility of retraining. Existing federated forgetting methods mostly remove the historical contributions of target clients or adjust the model step by step using gradient ascent to achieve the forgetting goal. However, storing historical gradients and additional communication or performance recovery training face high storage and communication overhead, limiting the efficiency of federated forgetting. In addition, federated forgetting learning also has privacy risk problems. SUMMARY

[0003] The embodiments of the present application provide a differential privacy federated forgetting learning method and system based on update residual, to solve the problems of high storage and communication overhead of storing historical gradients and additional communication or performance recovery training, which limits the efficiency of federated forgetting, and the privacy risk problem of federated forgetting learning.

[0004] In one aspect, the embodiments of the present application provide a differential privacy federated forgetting learning method based on update residual, comprising:

[0005] The server sends the current global model to multiple clients;

[0006] The client performs federated learning cycle training on the current global model through an importance sampling strategy and local data;

[0007] The client generates a local model update by performing differential privacy protection on the global model after the federated learning cycle training;

[0008] The client uploads the local model update to the server;

[0009] The server integrates all the local model updates uploaded by the clients to obtain an updated global model through a periodic weighted aggregation strategy;

[0010] The target client initiates the server to calculate the weighted update residual of the client in historical training through a forgetting request;

[0011] The server removes all historical weighted update residuals of the target client from the current global model through the weighted update residual to obtain a forgetting model.

[0012] In a possible implementation, the server sending the current global model to multiple clients comprises:

[0013] The server distributes the current global model to all the clients at the beginning of each round of training.

[0014] In a possible implementation, the client performing federated learning cycle training on the current global model through an importance sampling strategy and local data comprises:

[0015] The client selects the local data from a local data set through the importance sampling strategy based on the current global model to perform the federated learning cycle training:

[0016] The federated learning cycle training achieves differential privacy protection by injecting Gaussian noise.

[0017] In a possible implementation, the client performing differential privacy protection on the global model after the federated learning cycle training to generate a local model update comprises:

[0018] Each client selects important data from a local data set based on the current model to perform local training and injects Gaussian noise to obtain a local model with differential privacy protection;

[0019] The client generates a local model update according to the difference between the local model and the global model.

[0020] In a possible implementation, the server integrating all the local model updates uploaded by the clients to obtain an updated global model through a periodic weighted aggregation strategy comprises:

[0021] The server calculates the aggregation weight of each client after receiving all the local model updates uploaded by the clients;

[0022] The server performs global update weighted aggregation according to the aggregation weight of each client.

[0023] The server updates the global model through the global update.

[0024] In another aspect, an embodiment of the present application provides a differential privacy federated forgetting learning system based on update residual, comprising: a server and a plurality of clients, the server being configured to send a current global model to the plurality of clients;

[0025] The client is configured to perform federated learning cycle training on the current global model through an importance sampling strategy and local data;

[0026] The client is configured to generate a local model update by performing differential privacy protection on the global model after the federated learning cycle training;

[0027] The client is configured to upload the local model update to the server;

[0028] The server is configured to integrate all the local model updates uploaded by the clients to obtain an updated global model through a cycle weighted aggregation strategy;

[0029] The target client is configured to start the server to calculate the weighted update residual of the target client in the historical training through a forgetting request;

[0030] The server is configured to remove all the historical weighted update residuals of the target client from the current global model through the weighted update residual to obtain a forgetting model.

[0031] The differential privacy federated forgetting learning method and system based on update residual in the present application have the following advantages:

[0032] (1) By performing local model training based on differential privacy at the client, the forgetting model and the retraining model are statistically indistinguishable, providing strict privacy guarantee for the federated forgetting learning process.

[0033] (2) According to the stability of the sample for model training, important data is selected, and cycle weighted aggregation is adopted to improve the learning ability of the model to local data, thereby reducing the communication and storage overhead and improving the model utility of federated learning in a heterogeneous data environment.

[0034] (3) The update residual is used to quantify the incremental effect of the client to be forgotten, and the federated forgetting is realized by removing all the historical weighted update residuals, without saving complete historical gradient information and without relying on additional communication or recovery training process, thereby significantly reducing the storage overhead and improving the forgetting efficiency, ensuring good model performance while guaranteeing the forgetting effect, and quickly completing the federated forgetting process, with good practicability. BRIEF DESCRIPTION OF DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0036] Figure 1 A flowchart of a differential privacy federated forgetting learning method based on update residual is provided for the embodiments of the present application.

[0037] Figure 2 A schematic diagram of the overall architecture of a differential privacy federated forgetting learning system based on update residual is provided for the embodiments of the present application.

[0038] Figure 3 A comparison chart of the accuracy of forgetting models under different federated forgetting mechanisms on MNIST, FMNIST and CIFAR-10 data sets for a differential privacy federated forgetting learning method based on update residual is provided for the embodiments of the present application.

[0039] Figure 4 A federated forgetting mechanism accuracy evaluation chart under different privacy budgets for a differential privacy federated forgetting learning method based on update residual is provided for the embodiments of the present application.

[0040] Figure 5 A comparison chart of the change of model accuracy with rounds in the forgetting and post-training stages on MNIST, FMNIST and CIFAR-10 data sets for a differential privacy federated forgetting learning method based on update residual is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0042] Figure 1 A flowchart of a differential privacy federated forgetting learning method and system based on update residual is provided for the embodiments of the present application. The present application provides a differential privacy federated forgetting learning method based on update residual, which comprises:

[0043] The server sends a current global model to a plurality of clients;

[0044] The clients train the current global model through a federated learning cycle by an importance sampling strategy and local data;

[0045] The clients generate local model updates by differentially private protection of the global model after the federated learning cycle training;

[0046] The clients upload the local model updates to the server;

[0047] The server integrates the local model updates uploaded by all the clients to obtain an updated global model through a cycle weighted aggregation strategy;

[0048] The target client initiates the server to calculate the weighted update residual of the client in historical training through a forgetting request;

[0049] The server removes all historical weighted update residuals of the target client from the current global model through the weighted update residual to obtain a forgetting model.

[0050] The server sends a current global model to a plurality of clients includes:

[0051] The server distributes the current global model to all the clients at the beginning of each round of training .

[0052] The clients train the current global model through a federated learning cycle by an importance sampling strategy and local data includes:

[0053] The clients select the local data from a local data set through the importance sampling strategy based on the current global model for the federated learning cycle training:

[0054] The federated learning cycle training achieves differentially private protection by injecting Gaussian noise.

[0055] The clients generate local model updates by differentially private protection of the global model after the federated learning cycle training includes:

[0056] Each of the clients selects important data from a local data set based on a current model for local training and injecting Gaussian noise to obtain a local model with differentially private protection;

[0057] The clients generate local model updates according to the difference between the local model and the global model.

[0058] The server integrates all the local model updates uploaded by the clients using a periodic weighted aggregation strategy to obtain an updated global model, including:

[0059] After receiving all the local model updates uploaded by the clients, the server calculates the aggregate weight for each client.

[0060] The server updates the weighted aggregation based on the aggregation weight of each client to obtain a global update;

[0061] The server completes the update of the global model through the global update.

[0062] For example, such as Figure 1 As shown, the server in this application distributes the current global model to each client: Client set , No. The dataset for each client is represented as ,go through The global model obtained after rounds of federated learning training is At the start of each training round, the server will display the current global model. Distribute to all clients The client then trains the model on local data.

[0063] The client performs periodic training locally: A client-side periodic training method is adopted, allowing each participating client to perform multiple local updates in each round. The server then periodically aggregates the updates uploaded by the clients. Specifically, after updating the global model, the server sends it to the client, which then uses its local data to perform training based on the stochastic gradient descent algorithm. Each iteration completes local model training, and the updated model is uploaded to the server, which then performs a new round of global model updates. Using periodic updates for federated learning training significantly reduces communication and storage overhead. Assuming each client executes stochastic gradient descent for training... Then only First, communication and storage; second, client execution. This approach involves updating locally before uploading the update, thus avoiding the latency issues caused by frequent communication in traditional federated learning.

[0064] In federated learning training under a non-independent and identically distributed environment, the local periodic training phase introduces a system based on... An important data sampling strategy for error scores is to select data samples that are more critical to the training of local models, thereby improving training efficiency and reducing redundant computations;

[0065] For a given sample and its labels Assuming in the first In the first round of federated training, the global model received by the client is The model's predicted output is denoted as Then the sample of The expected value of the error is given by formula (1):

[0066] (1)

[0067] in Indicates sample The mean prediction error is relatively high. This indicates that the sample is difficult for the current model to learn, and may be an outlier, while the lower This indicates that the sample is easily fitted by the model and contributes little information.

[0068] Furthermore, the sample is further measured based on the standard deviation of the error. The impact on model training stability is defined by the standard deviation of the error as shown in formula (2):

[0069] (2)

[0070] in, This reflects the volatility of the prediction error of this sample, i.e., its potential impact on model stability;

[0071] Based on the expected value and standard deviation of the error for each sample, the screening interval is set as shown in formula (3), as follows:

[0072] (3)

[0073] in and These are two hyperparameters used to flexibly control the range of sample selection, achieving a balance between training accuracy and resource consumption. Only when the score of a sample falls into this range is it selected for this round of training. This strategy can effectively filter out abnormal samples with excessively high scores (avoiding model overfitting) and redundant samples with excessively low scores (reducing invalid computation), thereby improving the model convergence speed while reducing local computational overhead.

[0074] Differential privacy protection is achieved using a gradient perturbation method based on Gaussian noise, for any client. In the The first round of federal learning In the next local iteration This indicates the model for this iteration. This indicates the important data batch currently being sampled, then each sample The gradient is To apply differential privacy, for each sample gradient To cut, that is ,in To set the cropping threshold, use Indicates client In batch The average gradient on, then ,in Batch size;

[0075] In each round of training, the client By perturbating the gradient with noise, i.e.

[0076] (4)

[0077] in, This represents a noise vector that follows a Gaussian distribution. For sensitivity, It is a measurement mechanism Sensitivity to changes in a single data point defines the maximum impact of a change in that data point on the outcome in the worst-case scenario. It is from the domain To the result space The random mechanism, and These are two adjacent data points, the mechanism. sensitivity Defined as: At the same time, noise standards are set. ;

[0078] The client injects noise in each local iteration, after which... The local model parameters obtained after the second local update Accumulated differential privacy noise, the global model obtained by aggregating local noisy updates on the server, and through differential privacy protection, ensures that the model remains intact after forgetting. Satisfying differential privacy constraints and retraining the model They are indistinguishable in a statistical sense.

[0079] The server updates the global model using a periodic weighted aggregation strategy: in the federated learning process... During the training round, the client After completing local periodic training, update its local model. To further mitigate the impact of non-independent, identically distributed data on the federated learning process, the server employs a weighted aggregation strategy to calculate the global model update. Specifically, when aggregating updates uploaded by each client, the server considers the relative change in client-uploaded updates (through model updates). The weights are calculated using a norm measure, thus reflecting the importance of each client's model update in the current training process. Indicates client In the Updates uploaded in rounds The aggregate weight, i.e.:

[0080] (5)

[0081] After obtaining the aggregate weights of each participating client, the server performs a weighted aggregation update to obtain the updated global model, i.e.:

[0082] (6)

[0083] When a target client requests to forget, the server quantifies its cumulative contribution to the global model by calculating the client's weighted update residuals from historical training: in federated learning algorithms, this is done using... Indicates the first The global model of the wheel, the client The amount of change in the model after local periodic training Defined as:

[0084] (7)

[0085] in, Indicates client go through The local model obtained through rounds of periodic training. Representation Model In the client Model updates;

[0086] The server-wide model update is shown in formula (6), assuming the client... In the A forget request is made after the round (assuming the last client is removed). In fact, this method supports removing any client. If the client is removed, the global model update method is modified as follows:

[0087] (8)

[0088] in, Indicates removal of the client Then other clients Aggregate weights.

[0089] To quantify the client The impact on model updates can be obtained by subtracting formula (8) from formula (6):

[0090]

[0091]

[0092]

[0093]

[0094] (9)

[0095] For the forgotten client In terms of the first Wheel Renewal Residual for:

[0096] (10)

[0097] When removing client data, all historical update residuals of that client need to be removed to completely eliminate its overall impact on the global model. In actual federated learning, update residuals from different rounds differ; that is, the update residuals from different rounds are not entirely consistent with the global model's update direction. The closer they are to the global model's update direction, the more effective the current update is, and the more it contributes to the global model's convergence. Therefore, update residuals from rounds that contribute more to the global model should be removed. Assume the forgotten client is... ( In each round of federated learning, this paper updates the forgetting client. and global update The alignment degree is used to calculate the forgotten client. In the Wheel Renewal Residual weight Specifically, cosine similarity is used to measure the forgetting client update. and global update The alignment degree is calculated using the following formula:

[0098] (11)

[0099] in This represents the dot product operator. Representing vectors Norm, the ReLU function guarantees that the result is positive;

[0100] Then forget the client In the Wheel Renewal Residual weight for:

[0101] (12)

[0102] Remove all historical weighted update residuals from the target client from the current global model to generate a forgotten model: when the client exist When forgetting is raised after the round, it is based on the current global model. Subtract client The forgetting model can be obtained by weighting and updating all historical residuals. ,Right now:

[0103] (13)

[0104] refer to Figure 3 This study compares the accuracy of forgetting models using different federated forgetting mechanisms on the MNIST, FMNIST, and CIFAR-10 datasets. The proposed mechanism is denoted as FedUR, and the comparison mechanisms are FedRetrain (representing retraining), FedRecovery, MoDe, and FedOSD. As can be seen, the proposed method demonstrates superior post-forgetting model performance on all three datasets. For the relatively simple MNIST and FMNIST datasets with clear sample distributions, FedUR's accuracy is almost on par with the baseline method FedRetrain, and even slightly surpasses it in some cases, indicating that it effectively achieves forgetting while maximizing the retention of the original model. On the more complex CIFAR-10 dataset, the proposed method still achieves better accuracy than other forgetting methods and slightly exceeds the retraining strategy FedRetrain, demonstrating the stability and advantages of the proposed method under complex tasks. This shows that compared to other mechanisms, the proposed method effectively achieves knowledge forgetting while maintaining the overall performance of the global model.

[0105] refer to Figure 4 This study evaluates the accuracy of the federated forgetting mechanism under different privacy budgets on the MNIST, FMNIST, and CIFAR-10 datasets. As can be seen, on the MNIST dataset, as the privacy budget increases from 1.0 to 8.0, the accuracy of the forgetting model in this invention improves from approximately 61% to 87%. Furthermore, the difference in accuracy between the retrained model and the forgotten model in this invention is very small, indicating that they are almost indistinguishable in performance and can effectively protect user privacy. In contrast, the accuracy of the FedRecovery mechanism is consistently lower than that of this invention under different privacy budgets. Figure 3Experimental results on the FMNIST and CIFAR-10 datasets are also presented. Consistent with the MNIST results, the present invention consistently outperforms the FedRecovery mechanism under different privacy budgets, demonstrating that the present invention has better privacy protection performance and model utility compared to other mechanisms.

[0106] refer to Figure 5 This experiment examines the changes in model accuracy over multiple rounds during the forgetting and post-training phases on the MNIST, FMNIST, and CIFAR-10 datasets. It can be seen that both the proposed mechanism and the FedRecovery mechanism complete the federated forgetting process in only a single round after the forgetting request is issued, resulting in the lowest model accuracy. This is because both the proposed mechanism and FedRecovery achieve federated forgetting by removing historical contributions from forgetting clients; therefore, the forgetting phase only includes a single round, and subsequent processes can be used for post-forgetting training to improve model performance. In contrast, MoDe and FedOSD achieve forgetting through model adjustments during training. Figure 4 The display shows that MoDe and FedOSD require 25 rounds of forgetting to complete the forgetting process after a forgetting request is issued (e.g., ...). Figure 4 (As shown by the dashed line in the middle) Compared with the present invention and FedRecovery, it has a lower forgetting efficiency. In addition, although both the present invention and FedRecovery can achieve rapid forgetting, it can be seen from the comparison that the mechanism of the present invention has higher model accuracy than FedRecovery while achieving rapid forgetting. Therefore, overall, the present invention not only has the highest accuracy, but also has a high forgetting efficiency, indicating that compared with other mechanisms, the present invention achieves a good balance between model utility and forgetting efficiency.

[0107] Figure 2 Figure 2 This application provides a schematic diagram of the overall architecture of a differential privacy federated forgetting learning system based on updated residuals; this invention provides a differential privacy federated forgetting learning system based on updated residuals, including:

[0108] A server and multiple clients, wherein the server is used to send the current global model to the multiple clients;

[0109] The client is used to perform federated learning cycles to train the current global model using an importance sampling strategy and local data.

[0110] The client is used to generate local model updates by performing differential privacy protection on the global model trained through the federated learning cycle.

[0111] The client is used to update and upload the local model to the server;

[0112] The server is used to integrate the local model updates uploaded by all the clients through a periodic weighted aggregation strategy to obtain an updated global model;

[0113] The target client is used to initiate the server to calculate the weighted update residual of the client in the historical training via a forget request;

[0114] The server is used to remove all historical weighted update residuals of the target client from the current global model through the weighted update residuals to obtain the forgotten model.

[0115] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0116] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A differential privacy-preserving federated forgetting learning method based on updating residuals, characterized in that, include: The server sends the current global model to multiple clients; The client performs federated learning cycles to train the current global model using an importance sampling strategy and local data. The client performs differential privacy protection on the global model trained through the federated learning cycle to generate a local model update. The client updates and uploads the local model to the server; The server integrates all the local model updates uploaded by the clients using a periodic weighted aggregation strategy to obtain an updated global model; The target client initiates the server to calculate the weighted update residual of the client in the historical training by requesting a forgetting request; The server removes all historical weighted update residuals of the target client from the current global model using the weighted update residuals to obtain the forgotten model; According to the Forgotten Client update and global update The alignment degree is used to calculate the forgotten client. In the Wheel Renewal Residual weight ; Using cosine similarity to measure forgetting client updates and global update The alignment degree is calculated using the following formula: in This represents the dot product operator. Representing vectors Norm, the ReLU function guarantees that the result is positive; Then forget the client In the Wheel Renewal Residual weight for: Remove all historical weighted update residuals from the target client from the current global model to generate a forgotten model: when the client exist When forgetting is raised after the round, it is based on the current global model. Subtract client The forgetting model can be obtained by weighting and updating all historical residuals. ,Right now: 。 2. The differential privacy federated forgetting learning method based on updating residuals according to claim 1, characterized in that, The server sends the current global model to multiple clients, including: At the start of each training round, the server distributes the current global model to all the clients.

3. The differential privacy federated forgetting learning method based on updating residuals according to claim 1, characterized in that, The client performs federated learning cycle training on the current global model using an importance sampling strategy and local data, including: The client selects local data from the local dataset based on the current global model using the importance sampling strategy for training in the federated learning cycle: The federated learning cycle training achieves differential privacy protection by injecting Gaussian noise.

4. The differential privacy federated forgetting learning method based on updating residuals according to claim 1, characterized in that, The client performs differential privacy protection on the global model trained through the federated learning cycle to generate a local model update, including: Each client selects important data from the local dataset based on the current model, performs local training, and injects Gaussian noise to obtain a local model with differential privacy protection; The client generates a local model update based on the differences between the local model and the global model.

5. The differential privacy federated forgetting learning method based on updating residuals according to claim 1, characterized in that, The server integrates all the local model updates uploaded by the clients using a periodic weighted aggregation strategy to obtain an updated global model, including: After receiving all the local model updates uploaded by the clients, the server calculates the aggregate weight for each client. The server updates the weighted aggregation based on the aggregation weight of each client to obtain a global update; The server completes the update of the global model through the global update.

6. A differential privacy-preserving federated forgetting learning system based on updating residuals, characterized in that, The differential privacy federated forgetting learning system based on updated residuals is used to implement the method described in any one of claims 1-5, comprising: A server and multiple clients, wherein the server is used to send the current global model to the multiple clients; The client is used to perform federated learning cycles to train the current global model using an importance sampling strategy and local data. The client is used to generate local model updates by performing differential privacy protection on the global model trained through the federated learning cycle. The client is used to update and upload the local model to the server; The server is used to integrate the local model updates uploaded by all the clients through a periodic weighted aggregation strategy to obtain an updated global model; The target client is used to initiate the server to calculate the weighted update residual of the client in the historical training via a forget request; The server is used to remove all historical weighted update residuals of the target client from the current global model through the weighted update residuals to obtain the forgotten model.

Images