A model training method and system based on data privacy-preserving federated learning

Abstract

This invention relates to a model training method and system based on data privacy-preserving federated learning, comprising the following steps: S1: Initialize the global model and transmit it to the client, where the client performs importance analysis using neuron activation frequencies; S2: Based on the importance analysis results, allocate privacy budgets to each layer proportionally; S3: Dynamically adjust the pruning threshold based on the gradient statistical characteristics of each layer to balance noise addition and gradient fidelity; S4: By calculating the SHAP value vector similarity and model accuracy of the client models, prioritize the aggregation of high-contribution models to suppress the interference of low-quality updates on the global model; S5: Iteratively aggregate all client models to generate a new global model, which is then distributed to each client for the next round of training, with the global model update and dynamic optimization cycle repeating. This invention effectively solves the problems of model convergence difficulties, accuracy loss, and waste of privacy resources.

Description

Technical Field

[0001] This invention belongs to the field of data privacy technology, and in particular relates to a model training method and system based on data privacy-preserving federated learning. Background Technology

[0002] In recent years, Federated Learning (FL), as a distributed machine learning paradigm, has significantly reduced the risk of data leakage by avoiding the centralized transmission of raw data through local model training and parameter sharing. However, existing research shows that Federated Learning still faces the threat of gradient leakage, where malicious attackers can infer sensitive user information from shared gradients through reverse engineering. To address this, Differential Privacy (DP) technology has been introduced into the Federated Learning framework to achieve privacy protection by adding noise to the gradients. Summary of the Invention

[0003] To address the aforementioned problems, the present invention aims to provide a model training method and system based on data privacy-preserving federated learning.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] A model training method based on data privacy-preserving federated learning includes the following steps:

[0006] S1: Initialize the global model and transmit it to the client. The client uses the neuron activation frequency to perform model layer importance analysis. If a neuron is successfully activated, it is identified as a key layer; otherwise, it is identified as a secondary layer.

[0007] S2: Based on the importance analysis results, in order to allocate the privacy budget to each layer proportionally, the critical layer is allocated a high privacy budget to reduce noise interference, while the secondary layer is allocated a lower budget to strengthen privacy protection.

[0008] S3: Dynamically adjust the clipping threshold based on the statistical characteristics of the gradients of each layer to balance noise addition and gradient fidelity;

[0009] S4: By calculating the similarity of the SHAP value vectors of the client models and the model accuracy, high-contribution models are aggregated first to suppress the interference of low-quality updates on the global model;

[0010] S5: After iteratively aggregating all client models, a new global model is generated and distributed to each client for the next round of training. The global model is updated and dynamically optimized in a loop. The client performs local training based on the new global model. S1-S3 are repeated to generate noisy gradients and upload them. The central server repeats the aggregation until the model converges or reaches the preset number of training rounds.

[0011] Furthermore, after receiving the global model, the client calculates the activation frequency of neurons in each layer based on the local validation dataset:

[0012]

[0013] in, To verify the input sample into the model, the value of the j-th neuron in the i-th layer of the model before the Sigmoid activation function is input; M is the number of neurons in the m-th layer of the model, which is the number of verification samples.

[0014] Furthermore, based on the importance analysis results, to allocate the privacy budget to each layer proportionally, the following is done: The layer importance s is quantified according to the activation frequency. i Allocate privacy budgets proportionally across all levels:

[0015]

[0016] Where L represents the total number of layers in the model, i represents the i-th layer in the model, and ε t This indicates the current round of privacy budget.

[0017] Furthermore, the pruning threshold is dynamically adjusted based on the statistical characteristics of the gradients at each layer to balance noise addition and gradient fidelity, as detailed below:

[0018] During the first round of local training on the client side, the true gradient is calculated based on the current model parameters, and noise is added to the gradient using the currently allocated privacy budget.

[0019] We use the Armijo condition to check whether the updated objective function value meets the preset requirements. Let the objective function be f(θ). When it satisfies:

[0020]

[0021] In the formula, c is a preset constant, and η is the learning rate, indicating that the update direction under the current noise level is sufficient to reduce the objective function value and send the noisy gradient to the central server.

[0022] Otherwise, it is considered that the current noise is too high, causing the update direction to deviate from the descent direction, and a privacy budget adjustment is required:

[0023] The privacy budget adjustment formula is:

[0024] ∈' t =λ∈ t' (λ>1)

[0025] In the formula, λ is a coefficient for adjusting the privacy budget, which reduces noise levels. The new privacy budget ∈' t Recalculate the noise gradient:

[0026]

[0027] Different gradient clipping values ​​are set for each layer. The gradient clipping value for each layer is calculated using statistical information about the gradients of each layer obtained during local training on the client side, including the mean, variance, and maximum value. Let the mean gradient of the i-th layer obtained during training on the client's local dataset be... Then dynamically set the gradient clipping threshold to

[0028] After gradient clipping, the sensitivity of the gradient of the i-th layer model to neighboring datasets can be calculated by the following formula: Δf i =2×C i ×η;

[0029] An evaluation dataset is maintained on a central server. It is assumed that the data of each customer is independent and identically distributed or nearly independent and identically distributed, and the distribution of the evaluation dataset is similar to that of the customer dataset. When the central server receives the gradient uploaded by each client, it calculates a temporary model for each client based on the previous round of global model.

[0030] The effectiveness of the noise gradient is verified using the Armijo condition. If the update direction does not meet the descent condition, the privacy budget is increased by the coefficient λ>1 and the noise gradient is recalculated.

[0031] Furthermore, by calculating the SHAP value vector similarity of the client models and the model accuracy, high-contribution models are prioritized for aggregation to suppress the interference of low-quality updates on the global model, as follows:

[0032] The central server calculates the SHAP value vector and performance evaluation metrics for all client temporary models based on the evaluation dataset. The calculation formula is as follows:

[0033]

[0034] Where, φ i is the SHAP value of feature i; N is the set of all features, and f(S) represents the model prediction when only a subset of features is used;

[0035] Treat all temporary models as a set, and each time select the two models with the highest cosine similarity of SHAP vectors for aggregation.

[0036] Furthermore, after iteratively aggregating all client-side models, a new global model is generated, as follows:

[0037] Let the accuracy of the temporary model for client k be p. k The temporary model accuracy of client j is p. j The temporary model parameter for client k is W. k The temporary model parameter for client j is W.j The temporary models for customer k and customer j are aggregated using the following formula: The client model pairs with the highest SHAP vector cosine similarity are selected and aggregated by precision weighting:

[0038]

[0039] The aggregation model W ' It will be added back to the temporary model set as the new global model.

[0040] A model training system based on data privacy-preserving federated learning includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the model training method based on data privacy-preserving federated learning described above.

[0041] The present invention has the following beneficial effects:

[0042] This invention effectively solves the contradiction between model convergence difficulties, accuracy loss, and privacy resource waste by dynamically optimizing noise allocation and model aggregation strategies, providing an efficient and secure distributed data collaborative learning solution for scenarios such as smart grids and power dispatching. Attached Figure Description

[0043] Figure 1 This is a diagram of a privacy-preserving federated learning framework driven by data interpretability in one embodiment of the present invention;

[0044] Figure 2 This is a flowchart of the method of the present invention;

[0045] Figure 3 This is a comparison chart of the maximum, minimum, and average MSE under different algorithms in one embodiment of the present invention;

[0046] Figure 4 This is a comparison chart of average MSE under different overall privacy budgets in one embodiment of the present invention. Detailed Implementation

[0047] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0048] refer to Figure 2 In this implementation, a model training method based on data privacy-preserving federated learning is provided, including the following steps:

[0049] S1: Initialize the global model and transmit it to the client. The client uses the neuron activation frequency to perform model layer importance analysis. If a neuron is successfully activated, it is identified as a key layer; otherwise, it is identified as a secondary layer.

[0050] S2: Based on the importance analysis results, in order to allocate the privacy budget to each layer proportionally, the critical layer is allocated a high privacy budget to reduce noise interference, while the secondary layer is allocated a lower budget to strengthen privacy protection.

[0051] S3: Dynamically adjust the clipping threshold based on the statistical characteristics of the gradients of each layer to balance noise addition and gradient fidelity;

[0052] S4: By calculating the similarity of the SHAP value vectors of the client models and the model accuracy, high-contribution models are aggregated first to suppress the interference of low-quality updates on the global model;

[0053] S5: After iteratively aggregating all client models, a new global model is generated and distributed to each client for the next round of training. The global model is updated and dynamically optimized in a loop. The client performs local training based on the new global model. S1-S3 are repeated to generate noisy gradients and upload them. The central server repeats the aggregation until the model converges or reaches the preset number of training rounds.

[0054] In this embodiment, after receiving the global model, the client calculates the activation frequency of neurons in each layer based on the local validation dataset:

[0055]

[0056] in, To verify the input sample into the model, the value of the j-th neuron in the i-th layer of the model before the Sigmoid activation function is input; M is the number of neurons in the m-th layer of the model, which is the number of verification samples.

[0057] Based on experience, when the input value of the Sigmoid activation function is greater than -2, the neuron is considered to be successfully activated; when the activation frequency of neurons in a certain layer is high, the importance of that layer is considered to be high.

[0058] In this embodiment, based on the importance analysis results, the privacy budget for each layer is allocated proportionally as follows: the layer importance s is quantified according to the activation frequency. i Allocate privacy budgets proportionally across all levels:

[0059]

[0060] Where L represents the total number of layers in the model, i represents the i-th layer in the model, and ε t This indicates the current round of privacy budget.

[0061] In this embodiment, the clipping threshold is dynamically adjusted based on the statistical characteristics of the gradients at each layer to balance noise addition and gradient fidelity, as detailed below:

[0062] During the first round of local training on the client side, taking Laplacian noise as an example, the true gradient is calculated based on the current model parameters, and noise is added to the gradient using the currently allocated privacy budget:

[0063] We use the Armijo condition to check whether the updated objective function value satisfies the "sufficient descent" requirement. Let the objective function be f(θ). When it satisfies:

[0064]

[0065] In the formula, c is a preset constant and η is the learning rate, indicating that the update direction under the current noise level is sufficient to reduce the objective function value, and the noisy gradient can be sent to the central server.

[0066] Otherwise, it is considered that the current noise is too high, causing the update direction to "deviate" from the ideal descent direction, and a privacy budget adjustment is required.

[0067] The privacy budget adjustment formula is:

[0068] ∈' t =λ∈ t' (λ>1)

[0069] In the formula, λ is a coefficient for adjusting the privacy budget, which reduces noise levels. The new privacy budget ∈' t Recalculate the noise gradient:

[0070]

[0071] Different gradient clipping values ​​are set for each layer. The gradient clipping value for each layer is calculated using statistical information about the gradients of each layer obtained during local training on the client side, including the mean, variance, and maximum value. Let the mean gradient of the i-th layer obtained during training on the client's local dataset be... Then dynamically set the gradient clipping threshold to By adaptively cropping different layers, more effective values ​​in the gradients are retained while avoiding adding excessive noise to some gradients, thereby improving the accuracy of the model.

[0072] After gradient clipping, the sensitivity of the gradient of the i-th layer model to neighboring datasets can be calculated by the following formula: Δf i =2×C i ×η;

[0073] An evaluation dataset is maintained on a central server. It is assumed that the data of each customer is independent and identically distributed or nearly independent and identically distributed, and the distribution of the evaluation dataset is similar to that of the customer dataset. When the central server receives the gradient uploaded by each client, it calculates a temporary model for each client based on the previous round of global model.

[0074] The effectiveness of the noise gradient is verified using the Armijo condition. If the update direction does not meet the descent condition, the privacy budget is increased by the coefficient λ>1 and the noise gradient is recalculated.

[0075] In this embodiment, by calculating the SHAP value vector similarity and model accuracy of the client models, high-contribution models are aggregated first to suppress the interference of low-quality updates on the global model, as follows:

[0076] The central server calculates the SHAP value vector and performance evaluation metrics for all client temporary models based on the evaluation dataset. The calculation formula is as follows:

[0077]

[0078] Where, φ i is the SHAP value of feature i; N is the set of all features, and f(S) represents the model prediction when only a subset of features is used;

[0079] Treat all temporary models as a set, and each time select the two models with the highest cosine similarity of SHAP vectors for aggregation.

[0080] In this embodiment, a new global model is generated by iteratively aggregating all client models, as detailed below:

[0081] Let the accuracy of the temporary model for client k be p. k The temporary model accuracy of client j is p. j The temporary model parameter for client k is W. k The temporary model parameter for client j is W. j The temporary models for customer k and customer j are aggregated using the following formula: The client model pairs with the highest SHAP vector cosine similarity are selected and aggregated by precision weighting:

[0082]

[0083] The aggregation model W ' It will be added back to the temporary model set as the new global model.

[0084] A model training system based on data privacy-preserving federated learning includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the model training method based on data privacy-preserving federated learning described above.

[0085] Example 1: The following example illustrates the point:

[0086] This invention effectively addresses the contradictions of model convergence difficulties, accuracy loss, and privacy resource waste in power load forecasting tasks by dynamically optimizing noise allocation and model aggregation strategies. It provides an efficient and secure distributed data collaborative learning solution for smart grids, power dispatching, and other scenarios. In the experimental section, the classic federated learning algorithm FedAvg and the differential private federated learning algorithm DP-FL are used as comparison algorithms, employing the GEFC2012 dataset. The GEFC2012 dataset contains electricity consumption data from 20 power plants from January 2004 to July 2008, totaling 1650 days. In this experiment, the prediction target is the power load of each power plant. Each power plant in the GEFC2012 dataset is considered a separate client.

[0087] Figure 3 The mean squared error (MSE) of the trained global model was compared. MSE quantifies the degree of data variation; a smaller MSE indicates a more accurate fit between the predictive model and the experimental data. We ensured that the parameter settings for all three methods were consistent. Compared to FedAvg, the differences in maximum, minimum, and average MSE values ​​of this invention are negligible. This indicates that this invention can reduce the impact of noise on model training while maintaining the privacy of power data, thereby preserving model performance. On the other hand, the differential private federated learning method exhibits significantly worse performance in terms of maximum, minimum, and average MSE, with considerable differences in MSE. This indicates that the noise added by the differential private federated learning method is not negligible and has a significant negative impact on model performance.

[0088] Figure 4 The performance of Differential Private Federated Learning (DPRL) and the algorithm of this invention was compared under different total privacy budgets. The total privacy budget was set to 10, 15, 20, 25, and 30, and the average MES performance of the global model was observed for both algorithms. In terms of average MES, the algorithm of this invention significantly outperforms DPRL, and this advantage becomes more pronounced as the total privacy budget decreases. This demonstrates that the algorithm of this invention can effectively reduce the loss of model performance while ensuring the privacy of federated learning. By dynamically allocating the privacy budget and adopting an aggregation strategy based on interpretability and model performance, a balance between privacy protection and model performance can be effectively achieved.

[0089] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0090] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0092] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0093] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A model training method based on data privacy-preserving federated learning, characterized in that, Includes the following steps: S1: Initialize the global model and transmit it to the client. The client uses the neuron activation frequency to perform model layer importance analysis. If a neuron is successfully activated, it is identified as a key layer; otherwise, it is identified as a secondary layer. S2: Based on the importance analysis results, in order to allocate the privacy budget to each layer proportionally, the critical layer is allocated a high privacy budget to reduce noise interference, while the secondary layer is allocated a lower budget to strengthen privacy protection. S3: Dynamically adjust the clipping threshold based on the statistical characteristics of the gradients of each layer to balance noise addition and gradient fidelity; S4: By calculating the similarity of SHAP value vectors of client models and model accuracy, high-contribution models are aggregated first to suppress the interference of low-quality updates on the global model; S5: After iteratively aggregating all client models, a new global model is generated and distributed to each client for the next round of training. The global model is updated and dynamically optimized in a loop. The client performs local training based on the new global model. S1-S3 are repeated to generate noisy gradients and upload them. The central server repeats the aggregation until the model converges or reaches the preset number of training rounds.

2. The model training method based on data privacy-preserving federated learning according to claim 1, characterized in that, After receiving the global model, the client calculates the activation frequency of neurons in each layer based on the local validation dataset: ， ； in, To validate the input samples into the model, the value of the j-th neuron in the i-th layer of the model before the Sigmoid activation function is input; M is the number of validation samples. Let be the number of neurons in the i-th layer of the model.

3. The model training method based on data privacy-preserving federated learning according to claim 2, characterized in that, Based on the importance analysis results, the privacy budget for each layer is allocated proportionally as follows: Layer importance is quantified based on activation frequency. Allocate privacy protection funds at each level proportionally. ； in, This represents the total number of layers in the model, where i represents the i-th layer in the model. This indicates the current round of privacy budget.

4. The model training method based on data privacy-preserving federated learning according to claim 1, characterized in that, The method of dynamically adjusting the clipping threshold based on the statistical characteristics of gradients at each layer to balance noise addition and gradient fidelity is as follows: During the first round of local training on the client side, the true gradient is calculated based on the current model parameters, and noise is added to the gradient using the currently allocated privacy budget. Using Armijo conditional checks, we can determine whether the updated objective function value meets the preset requirements. Let the objective function be... When the following conditions are met: ； In the formula It is a preset constant. The learning rate indicates that the update direction at the current noise level is sufficient to reduce the objective function value, and the noisy gradient is sent to the central server. Otherwise, it is considered that the current noise is too high, causing the update direction to deviate from the descent direction, and a privacy budget adjustment is required: The formula for adjusting the privacy budget is: ； In the formula To adjust the privacy budget coefficients, the privacy budget adjustment will reduce the noise level; utilizing the new privacy budget Recalculate the noise gradient: ； Set different gradient clipping values ​​for each layer; use the statistical information of the gradients of each layer obtained by the client during local training, including the mean, variance and maximum value, to calculate the gradient clipping value for each layer. Suppose that the first training dataset obtained on the client's local dataset is... The gradient mean of the layer is Then dynamically set the gradient clipping threshold to ; After completing gradient clipping, the first The sensitivity of the gradient of a layer model to neighboring datasets can be calculated using the following formula: ; An evaluation dataset is maintained on a central server. Each client's data is assumed to be independently and identically distributed (IOD) or nearly IOD, and the distribution of the evaluation dataset is similar to that of the client datasets. When the central server receives gradients uploaded by each client, it computes a temporary model for each client based on the previous global model. The effectiveness of the noisy gradient is verified using the Armijo condition. If the update direction does not satisfy the descent condition, then the coefficient is used to verify its validity. Increase the privacy budget and recalculate the noise gradient.

5. The model training method based on data privacy-preserving federated learning according to claim 1, characterized in that, The process involves calculating the SHAP value vector similarity and model accuracy of client-side models, prioritizing the aggregation of high-contribution models, and suppressing the interference of low-quality updates on the global model, as detailed below: The central server calculates the SHAP value vector and performance evaluation metrics for all client temporary models based on the evaluation dataset. The calculation formula is as follows: ； in, The SHAP value of feature i; It is the set of all features. This represents the model prediction when only a subset of features is used; Treat all temporary models as a set, and each time select the two models with the highest cosine similarity of SHAP vectors for aggregation.

6. The model training method based on data privacy-preserving federated learning according to claim 5, characterized in that, The iterative aggregation of all client models generates a new global model, as detailed below: Set up the client The accuracy of the temporary model is Client The accuracy of the temporary model is Client The temporary model parameters are Client The temporary model parameters are , will customers Temporary models and clients The temporary models are aggregated using the following formula: Client model pairs with the highest SHAP vector cosine similarity are selected and aggregated by precision weighting: ； The aggregation model It will be added back to the temporary model set as the new global model.

7. A model training system based on data privacy-preserving federated learning, characterized in that, It includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the model training method based on data privacy-preserving federated learning as described in any one of claims 1-6.

Images