Efficient federal category forgetting learning method based on error maximization noise
By generating error-maximizing noise and combining confidence sampling with a single forget-enhancement step, this method addresses the issues of poor forgetting performance and long processing times in existing federated category forgetting methods. It achieves efficient category forgetting and privacy protection, making it suitable for large-scale federated learning environments.
Patent Information
- Application Number
- CN202511026395.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-24
- Publication Date
- 2025-11-07
AI Technical Summary
Existing federalized category forgetting methods suffer from poor forgetting performance and long forgetting times, making it difficult to efficiently protect user data privacy on resource-constrained clients.
An efficient federated category forgetting learning method based on error maximization noise is adopted. A noise matrix is generated by a central server to maximize the classification error, and the model is trained with local residual datasets to disrupt the weights of forgotten categories in the global model. A confidence sampling method is used to select high-quality residual datasets for a single forgetting-reinforcement operation.
It achieves fast and effective category forgetting, ensuring that the model's accuracy on the forgotten dataset is close to 0 after forgetting, protecting user privacy, avoiding the central server from obtaining local data information, and is suitable for large-scale federated learning environments.
Smart Images
Figure CN120910693A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of artificial intelligence security, and particularly relates to an efficient federated class unlearning method based on error maximization noise. BACKGROUND
[0002] In recent years, artificial intelligence (AI) technology has developed rapidly, and the training of models cannot be separated from the support of user data. On the one hand, massive data helps to further promote the development of AI; on the other hand, it poses a threat to the privacy of users, and data may be leaked in sharing and use. In order to realize the circulation and sharing of data while protecting the privacy information of users, federated learning (FL) has emerged as the times require. As a new distributed learning framework, FL allows multiple data participants to collaboratively train a global model without sharing local data, realizes that data is "available but invisible", effectively reduces the risk of user data privacy leakage, but still faces some security problems. In the FL training, an attacker may construct the original privacy information of a user by gradient inversion attack or data reconstruction attack, etc., and pose a threat to the privacy of the user. Therefore, in order to further protect the privacy of the user, after the user exits the training, not only the original training data needs to be deleted, but also the influence of the user on the model needs to be deleted from the model.
[0003] With the increasing attention of people to the protection of personal data privacy, many countries have formulated strict data privacy regulations, such as GDPR, APPI, CCPA, etc., which affirm the right of users to delete specific influences from the model and define it as "the right to be forgotten" (RTBF). RTBF enables users to delete data from the training data set and the trained model, including the influence of these data on the model, which is machine unlearning (MU). The emergence of federated unlearning (FU) is to solve the challenge of unlearning user data in the federated learning scenario and protect the privacy and security of FL users.
[0004] The goal of FU is to eliminate the influence of specific data from the global model while maintaining the performance of the model on the remaining data. According to the granularity of forgetting, FU can be divided into three categories: client forgetting, sample forgetting and class forgetting. Among them, sample forgetting mainly focuses on removing the influence of specific data samples, class forgetting mainly focuses on removing the influence of specific classes, and client forgetting mainly focuses on removing the influence of all data of the forgetting user. In the FU framework, the server cannot access the local data set of the user, and the user contributes to the FL model through iterative training, so data forgetting becomes very difficult. The existing federal class forgetting methods mainly include gradient ascent, fast retraining, model pruning, etc. Due to the "available but invisible" data, the forgetting operation needs to be performed on the resource-limited client, and various FU methods exchange time for space, but there are still problems such as poor forgetting effect and long forgetting time, therefore, a safe and efficient federal class forgetting method is urgently needed. SUMMARY
[0005] The purpose of the present application is to provide an efficient federal class forgetting learning method based on error maximization noise, which solves the problems of poor forgetting effect and long forgetting time existing in the prior art.
[0006] The present application is implemented by using the following technical solutions:
[0007] An efficient federal class forgetting learning method based on error maximization noise, comprising the following steps:
[0008] Step 1: After the forgetting client proposes a forgetting request, the center server generates a noise matrix on the global model for the forgetting request, so as to maximize the classification error;
[0009] Step 2: The forgetting client screens the local remaining data set, combines the noise matrix and the subset of the local remaining data set to form a forgetting training data set, trains the global model, destroys the weight responsible for identifying the forgetting class data in the global model, and obtains a forgetting model;
[0010] Step 3: The forgetting client trains the forgetting model on the subset of the local remaining data set to enhance the weight corresponding to the remaining data in the forgetting model;
[0011] Step 4: The forgetting client uploads the forgetting model, and if there are multiple forgetting clients, the center server aggregates the forgetting models of the multiple forgetting clients to obtain a final forgetting model. It should be noted that the final forgetting model is the global model of the center server when the next forgetting client proposes a forgetting request.
[0012] Further preferably, the step 1 specifically comprises the following steps:
[0013] Step 11: The forgetting client submits a forgetting request to the center server, and the center server determines the target forgetting category after responding to the forgetting request;
[0014] Step 12: The center server initializes a noise matrix and optimizes the noise matrix by maximizing the classification error of the target forgetting category through an objective function;
[0015] Step 13: The center server distributes the global model and the generated noise matrix to the forgetting client, and the center server distributes the generated noise matrix and the global model to the forgetting client, which performs the forgetting operation locally.
[0016] Further preferably, the step 2 comprises the following steps:
[0017] Step 21: The forgetting client receives the noise matrix and the global model, and uses a sampling method based on model confidence to select 10% to 20% of the local remaining data set to obtain a subset of the local remaining data set;
[0018] Step 22: The forgetting client combines the remaining data with the noise matrix and the subset of the local remaining data set to form a forgetting training data set, and performs one round of training on the global model to destroy the model weights corresponding to the forgetting data in the global model, destroy the influence of the forgetting category data on the global model, and make the global model unable to recognize the forgetting category data, thereby obtaining a forgetting model.
[0019] Further preferably, the step 3 comprises the following steps:
[0020] Step 31: The forgetting client uses the subset of the local remaining data set to perform one round of training on the forgetting model to restore the forgetting model's weights corresponding to the remaining data;
[0021] Step 32: If the forgetting model performance does not meet the preset conditions: the remaining accuracy differs by less than 10% from the initial model, and the forgetting accuracy is less than 10%, a feedback mechanism is triggered to adjust the sample size of the forgetting training data set and re-execute the forgetting-enhancing step (step 2 is defined as the forgetting step, and step 3 is defined as the enhancing step).
[0022] Further preferably, the step 4 comprises the following steps:
[0023] Step 41: The forgetting client uploads the forgetting model after steps 2 and 3 to the center server;
[0024] Step 42: The center server aggregates the forgetting model to obtain the final forgetting model.
[0025] Further preferably, the noise matrix initialization and optimization process in step 12 is as follows:
[0026] For single data forgetting:
[0027] Step 121, freeze the weights of the global model, train an error maximization noise with the same size as the input of the global model;
[0028] Step 122, given a randomly initialized noise matrix N, Optimize the noise using the following objective function;
[0029]
[0030] where, is the classification loss corresponding to the forgetting category, f is the global model, w n is the parameter of noise N, λ is used to manage the trade-off between the two terms, the loss function Adopt the cross-entropy loss function with L2 regularization; the optimization problem is to find the L p -norm bounded noise.
[0031] The training of the noise matrix does not need to use the forgetting data, input the noise matrix into the global model, and constantly adjust to get the error maximization noise, and finally the noise can be regarded as the anti-sample of the forgetting category. λ||w n || Regularize the overall loss by preventing the values in N from becoming too large, without the regularization of N, the global model will consider that the image with a higher value belongs to the forgetting category, resulting in a noise matrix that cannot replace the forgetting category.
[0032] For multi-class data forgetting:
[0033] Step 123, refer to the generation process of single-class data noise matrix, the center server generates a noise matrix for each forgetting category respectively, assuming the number of forgetting categories is m, then the noise matrix set N = {N1, N2,..., N m m}, for single and multi-class forgetting, the noise training algorithm is executed only once. Since the optimization is performed using the model loss noise matrix, this can be done in a very short time.
[0034] Further preferably, the specific process of sampling the subset of remaining data in step 21 is as follows:
[0035] Step 211, the forgetting client evaluates the performance of the global model on the local training set during a round of federated learning before submitting a forgetting request, and stores the prediction confidence of the global model; for example, for a classification task, the model's prediction probability can be regarded as the confidence, the client records these probabilities and analyzes them, here the local training set can be replaced by an open source or public dataset.
[0036] It should be noted that the local training set includes the forgetting data set and the local remaining data set.
[0037] Step 212, the forgetting client proposes a forgetting request, filters the local remaining data set by using the global model confidence, and for each remaining data category y r , the confidence of all samples in y is sorted in descending order by using the quick sort method, and the sample with high confidence is selected as the sampling data, wherein the sampling ratio of the remaining data can be determined according to actual requirements and the size of the data set;
[0038] Step 213, the sampled samples in each remaining class are combined to obtain a subset of the local remaining data set, which is used for subsequent 'forgetting-enhancing' process, and can be adjusted within a certain range according to the model forgetting effect and the performance of the model after forgetting.
[0039] The application includes the steps of error maximization noise generation, model forgetting and model enhancement. The server side generates the corresponding noise matrix by maximizing the classification loss of the forgetting category in the error maximization noise generation; the client filters the local remaining data set in the model forgetting, and trains the model by combining the noise matrix and the subset of the local remaining data set; and the client enhances the model weight by training the forgetting model on the subset of the remaining data set in the model enhancement. The method proposed in the application avoids the center server to obtain the local data related information of the participants, protects the data privacy, and realizes efficient category forgetting through a single 'forgetting-enhancing' step, which provides a new idea for federated forgetting. BRIEF DESCRIPTION OF DRAWINGS
[0040] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the application.
[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.
[0042] Figure 1 The schematic diagram of the framework of the method of the present application is shown.
[0043] Figure 2 The scheme flow chart of the method of the present application is shown. DETAILED DESCRIPTION
[0044] In order to enable the above-mentioned purposes, features and advantages of the present application to be more clearly understood, the following will further describe the solutions of the present application. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.
[0045] In the description, it should be noted that the terms "first", "second" are only for the purpose of description, and cannot be understood as indicating or implying relative importance. It should be noted that, unless otherwise explicitly specified and limited, the terms "mounting", "connecting", "connecting" should be understood in a broad sense, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be the communication inside two elements. For those skilled in the art, the specific meanings of the above terms can be understood according to the specific circumstances.
[0046] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein; obviously, the examples in the description are only some of the embodiments of the present application, not all the embodiments.
[0047] The specific embodiments of the present application will be described in detail below with reference to the accompanying drawings.
[0048] Embodiment one
[0049] An efficient federated class forgetting learning method based on error maximization noise includes the following steps:
[0050] Step 1: After the forgetting client proposes a forgetting request, the center server generates a noise matrix for the forgetting request on the global model, so as to maximize the classification error;
[0051] Step 11: The forgetting client proposes a forgetting request (single class or multiple classes) to the center server, and the center server determines the target forgetting class after responding to the forgetting request;
[0052] Step 12: The center server freezes the weight of the global model, generates an error maximization noise matrix for the forgetting class, and establishes a correlation between N and the forgetting learning class label f: N≠x. Given a randomly initialized noise matrix N, The following objective function is used to optimize the noise:
[0053]
[0054] Wherein, is the classification loss corresponding to the forgetting class, f is the global model, w nis the parameter of noise N, λ is used to manage the trade-off between the two terms, the loss function The cross-entropy loss function with L2 regularization is adopted. The optimization problem is to find the L p The noise matrix is optimized by maximizing the classification error of the target forgetting class through the objective function.
[0055] The optimized noise matrix is opposite to the forgetting class, so it can be used as an anti-sample of the forgetting class, and the forgetting operation of the global model is performed subsequently. If there are multiple classes of requests, the corresponding number of noise matrices is generated. The generation algorithm of the noise matrix only needs to be executed once, and the optimization uses the noise matrix as input, so the error maximization can be realized in a short time.
[0056] Step 13: The center server distributes the global model and the generated noise matrix to the forgetting client, and the forgetting client performs the forgetting operation locally.
[0057] Step 2: The forgetting client screens the local remaining data set, combines the noise matrix with a subset of the local remaining data set to form a forgetting training data set, trains the global model, destroys the weight responsible for identifying the forgetting class data in the global model, and obtains a forgetting model;
[0058] Step 21: The forgetting client receives the noise matrix and the global model, and uses a sampling method based on the confidence of the global model to select 10% to 20% of the data from the local remaining data set to obtain a subset of the local remaining data set. In this embodiment, a selection ratio of 15% is adopted.
[0059] The specific process of sampling the subset of the remaining data is as follows:
[0060] Step 211: The forgetting client evaluates the performance of the global model on the local training set during a round of federated learning before the forgetting request is submitted, and stores the prediction confidence of the global model;
[0061] Step 212: The forgetting client submits a forgetting request and uses the global model confidence to screen the local remaining data set. For each remaining data class y∈Y r , Y r represents the data class set of the local remaining data set, and the confidence of all samples in y is sorted in descending order using the quicksort method. The samples with high confidence are selected as the sampling data, and 10% to 20% of each data class is selected. The sampling ratio of the remaining data can be determined according to actual requirements and the size of the data set.
[0062] Step 213: The sampled samples in each remaining class are combined to obtain a subset D rIt is used in the subsequent "forget-reinforcement" process and can be adjusted within a certain range according to the model's forgetting effect and the model's performance after forgetting.
[0063] Step 22: The forgetting client combines the remaining data with the noise matrix and a subset of the local remaining dataset to form a forgetting training dataset, and performs one round of training on the global model, thereby destroying the model weights corresponding to the forgotten data in the global model to obtain the forgetting model.
[0064] Specifically, the client uses D r The number of samples is such that the noise matrix N is copied 0.1% to 1% of D. r In this embodiment, the noise matrix N is copied by 0.5% D. r The dataset D is obtained from the noisy dataset. N Combined with a subset D of the local remaining dataset r The model is trained (in one round), and the global model weights corresponding to the forgotten category data are disrupted. This is used to eliminate the influence of the forgotten category data on the global model, preventing the global model from recognizing the forgotten category data. By combining the noisy dataset with a subset of the local remaining dataset for training, the forgotten category data can be removed while preserving the model performance of the forgotten category model on the remaining dataset.
[0065] Step 3: The forgetting client trains the forgetting model on a subset of the local remaining dataset to enhance the weights of the remaining data in the forgetting model;
[0066] Step 31: The forgetting client uses a subset of the local remaining dataset to train the forgetting model once, restoring the weights of the forgetting model for the remaining data;
[0067] Specifically, the forgetting process in the global model may affect the weights of the remaining classes in the global model. To recover these weights and ensure the generalization ability of the forgotten model, the forgetting client utilizes D... r Train the forgetting model once to recover the weights of the forgetting model for the remaining data (in rare cases, more rounds may be needed, for example, when the subset of the selected local remaining dataset has few samples, or when the model accuracy is inherently low in the case of non-iid).
[0068] Step 32: If the performance of the forgetting model does not meet the preset conditions: the residual accuracy differs from the initial model by less than 10%, and the forgetting accuracy is less than 10%, then the feedback mechanism is triggered to adjust the number of samples in the forgotten training dataset and re-execute the forgetting-reinforcement step. The residual accuracy represents the accuracy of the forgetting model on the local residual dataset, used to evaluate the fidelity of the forgetting algorithm, as shown in formula (2). The forgetting accuracy represents the accuracy of the forgetting model on the forgotten dataset (D). fThe accuracy on the validation set is used to evaluate the effectiveness of the forgetting algorithm, as shown in formula (3).
[0069]
[0070]
[0071] Specifically, the condition (the difference between the remaining accuracy before and after forgetting is <10%, and the forgetting accuracy is <10%) is set, if the remaining data accuracy of the model after "forgetting-enhancing" is greater than 10% than the initial model, or the forgetting accuracy is greater than 10%, the feedback mechanism is triggered, the size of D r and D N is adjusted, the number of forgetting training data samples is adjusted, and the forgetting-enhancing step is re-executed until the preset threshold (the difference between the remaining accuracy before and after forgetting is <10%, and the forgetting accuracy is <10%) is reached, so as to ensure the performance of the forgetting model.
[0072] Step 4: The forgetting client uploads the forgetting model, and if there are multiple forgetting clients, the center server aggregates the forgetting models of the multiple forgetting clients to obtain the final forgetting model.
[0073] Step 41: The forgetting client uploads the forgetting model after the "forgetting-enhancing" operation to the center server, and if there are multiple forgetting clients, the forgetting operation is performed locally (which can ensure that the forgetting client data is not leaked, and the influence of the forgetting data on the model can be eliminated) and then uploaded to the center server.
[0074] Step 42: The center server aggregates the forgetting results of the clients, updates the global model parameters, and obtains the final forgetting model.
[0075] The working principle is as follows:
[0076] The optimized noise matrix is opposite to the forgetting category, so it can be used as an anti-sample of the forgetting category, and the model forgetting is performed subsequently. If there are multiple categories of requests, the corresponding number of noise matrices is generated, the generation algorithm of the noise matrix only needs to be executed once, and the optimization uses the noise matrix as the input, so the error maximization can be realized in a short time.
[0077] The application realizes the rapid forgetting of the target category by generating error maximization noise and combining a single "forgetting-enhancing" step, protects user privacy, and avoids the center server from obtaining the local data information of the client.
[0078] Compared with the prior art, the application has the beneficial effects that: (1) by generating error maximization noise, the classification ability of the model to the target forgotten class can be completely destroyed, and the forgetting effect is ensured. After forgetting, the accuracy of the model on the forgotten data set is close to 0, which indicates that the forgetting effect is good; (2) the remaining data is sampled by using a confidence-based sampling method to obtain a high-quality subset of the local remaining data set, and the performance of the model after forgetting is ensured; (3) the center server only generates a noise matrix and delivers it to the client, avoiding direct or indirect acquisition of the local data information of the client, and protecting the user privacy; (4) the single 'forgetting-enhancing' step significantly improves the forgetting efficiency, and the data required for the forgetting operation is less, which is suitable for large-scale federated learning environment.
[0079] The above description is only a specific embodiment of the present application, which enables those skilled in the art to understand or implement the present application. Although the foregoing embodiments are described in detail, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some or all of the technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments, and they should be covered in the protection scope of the claims.
Claims
1. An efficient federated class forgetting learning method based on error maximization noise, characterized in that: The method comprises the following steps: Step 1: After the forgetting client proposes a forgetting request, the center server generates a noise matrix for the forgetting request on the global model to maximize the classification error of the forgetting request; Step 2: The forgetting client screens the local remaining data set, combines the noise matrix and the subset of the local remaining data set to form a forgetting training data set, trains the global model, destroys the weight of the global model responsible for identifying the forgetting category data, and obtains a forgetting model; Step 3: The forgetting client trains the forgetting model on the subset of the local remaining data set to enhance the weight of the remaining data in the forgetting model; Step 4: The forgetting client uploads the forgetting model, and if there are multiple forgetting clients, the center server aggregates the forgetting models of the multiple forgetting clients to obtain a final forgetting model.
2. The efficient federated categorical forgetting learning method based on error maximization noise according to claim 1, characterized in that: The step 1 specifically comprises the following steps: Step 11: The forgetting client proposes a forgetting request to the center server, and the center server determines a target forgetting category after responding to the forgetting request; Step 12: The center server initializes a noise matrix and optimizes the noise matrix by maximizing the classification error of the target forgetting category through a target function; Step 13: The center server distributes the global model and the generated noise matrix to the forgetting client, and the forgetting client performs a forgetting operation locally.
3. The efficient federated categorical forgetting learning method based on error maximization noise according to claim 1, characterized in that: The step 2 comprises the following steps: Step 21: The forgetting client receives the noise matrix and the global model, uses a model confidence-based sampling method to select 10% to 20% of the data from the local remaining data set to obtain a subset of the local remaining data set; Step 22: The forgetting client combines the noise matrix and the subset of the local remaining data set according to the remaining data to form a forgetting training data set, trains the global model for one round, and destroys the model weight corresponding to the forgetting data in the global model to obtain a forgetting model.
4. The efficient federated categorical forgetting learning method based on error maximization noise according to claim 1, characterized in that: The step 3 comprises the following steps: Step 31: The forgetting client trains the forgetting model for one round using the subset of the local remaining data set to restore the weight of the forgetting model corresponding to the remaining data; Step 32: If the performance of the forgetting model does not meet the preset conditions: the difference between the remaining accuracy and the initial model is less than 10%, and the forgetting accuracy is less than 10%, a feedback mechanism is triggered, the sample size of the forgetting training data set is adjusted, and steps 2 and 3 are re-executed.
5. The efficient federated categorical forgetting learning method based on error maximization noise according to claim 1, characterized in that: The step 4 comprises the following steps: Step 41: The forgetting client uploads the forgetting model after steps 2 and 3 to the center server; Step 42: The center server aggregates the forgetting model to obtain a final forgetting model.
6. The efficient federated categorical forgetting learning method based on error maximization noise according to claim 2, characterized in that: The process of noise matrix initialization and optimization in step 12 is as follows: For single-data forgetting: Step 121, freeze the weight of the global model, and train an error maximization noise with the same size as the input of the global model; Step 122, given a randomly initialized noise matrix N, The noise is optimized using the following objective function; wherein, is the classification loss corresponding to the forgetting class, f is the global model, w n is the parameter of the noise N, λ is used to manage the trade-off between the two terms, the loss function cross-entropy loss function with L2 regularization; For multi-class data forgetting: Step 123, referring to the generation process of single-class data noise matrix, the central server generates a noise matrix for each forgotten class respectively. Assuming the number of forgotten classes is m, then the noise matrix set N = {N1, N2, …, Nm} is obtained. m} 7. The efficient federated categorical forgetting learning method based on error maximization noise according to claim 3, characterized in that: The specific process of sampling the subset of the remaining data in step 21 is as follows: Step 211: The forgetting client evaluates the performance of the global model on the local training set during a round of federated learning before proposing the forgetting request, and stores the prediction confidence of the global model; Step 212, the forgetting client proposes a forgetting request, uses a global model confidence to screen a local remaining data set, and for each remaining data category y e Y r , sorts the confidence of all samples in y in descending order by using a quick sorting method, selects samples with high confidence as sampling data, and a sampling ratio of the remaining data is determined according to actual demand and a data set size. Step 213, combine the samples in each remaining class to obtain a subset of the local remaining dataset, which is used for subsequent "forgetting-enhancing" process, and can be adjusted within a certain range according to the model forgetting effect and the performance of the model after forgetting.