Random forest privacy protection method and system based on shuffling differential privacy and medium

Abstract

The invention provides a random forest privacy protection method and system based on shuffling differential privacy and a medium, and the method comprises the steps: randomly selecting a tree t from T complete random trees in a random forest, and reasoning a leaf node number l to which a user sample belongs according to the structure of the tree t; constructing a triple (t, l, y) based on a real label y corresponding to the leaf node; k times of independent disturbance processing is carried out on y in the triple, and a message set comprising k messages is generated; and sending the message set to a shuffling server to enable the shuffling server to send the shuffled message set to a computing server after shuffling the received message sets of the multiple user sides, and enabling the computing server to estimate label distribution of each leaf node through a depolarization statistical method according to the shuffled message set. According to the method, the system and the medium, the problems of high privacy budget consumption and relatively high communication and calculation overhead of a traditional differential privacy random forest in a privacy protection scene can be solved.

Description

Technical Field

[0001] This invention relates to the field of privacy data protection technology, and in particular to a random forest privacy protection method, system and medium based on shuffle differential privacy. Background Technology

[0002] Currently, Differential Privacy (DP) technology has become one of the core standards in the field of data protection. Traditional differential privacy techniques mainly rely on adding noise during data querying or model training to mask individual information, such as the Laplace and Gaussian mechanisms. These methods are widely used in database querying, statistical data publishing, and machine learning model building. Traditional methods typically employ centralized differential privacy (DP), requiring data to be centralized on a trusted third-party platform, ensuring overall data security through global noise addition; however, this approach suffers from single-point trust issues and risks associated with centralized data storage. To address this problem, Local Differential Privacy (LocalDP) has been proposed in recent years, allowing each user to perturb data locally before uploading, thus avoiding the risks of centralized data. However, it requires a high amount of noise, leading to decreased model accuracy and excessively rapid consumption of privacy budgets in scenarios with multiple data interactions, which is particularly evident in the construction of machine learning models such as Random Forest, directly impacting the balance between model performance and privacy protection.

[0003] When the above mechanism is used in differential privacy random forest, the existing technology still has the following drawbacks:

[0004] (1) High privacy budget consumption of traditional differential privacy random forest: In the differential privacy random forest algorithm, users need to participate in the construction of decision trees multiple times. Especially when counting the number of node samples or selecting split attributes, complex mechanisms (such as Laplace mechanism or exponential mechanism) are needed to add noise, resulting in excessive consumption of privacy budget.

[0005] (2) High communication and computation overhead: Traditional differential privacy random forests require users to interact with the server multiple times, and users also need to perform complex calculations on the data to meet differential privacy requirements, which increases the cost of communication and computation. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the prior art by providing a method, system and medium for privacy protection of random forests based on shuffled differential privacy, so as to solve the problems of high privacy budget consumption and large communication and computing overhead in traditional differential privacy random forests in privacy protection scenarios.

[0007] In a first aspect, the present invention provides a random forest privacy protection method based on shuffle differential privacy, applied to the user end, the method comprising:

[0008] Randomly select a tree t from T completely random trees in the random forest, and infer the leaf node number l to which the user sample belongs based on the structure of the tree t;

[0009] Construct a triple (t, l, y) based on the actual label y corresponding to the leaf node;

[0010] Perform k independent perturbations on y in the triplet to generate a message set containing k messages; where T>1, k≥T;

[0011] The message set is sent to the shuffling server, which shuffles the message sets received from multiple user terminals. The shuffled message set is then sent to the computing server, which estimates the label distribution of each tree leaf node based on the shuffled message set using a biased statistical method. Finally, a final label is assigned to each tree, resulting in the constructed random forest model.

[0012] Furthermore, before randomly selecting a tree t from the T completely random trees in the random forest and inferring the leaf node number l to which the user sample belongs based on the structure of the tree t, the method further includes:

[0013] The system receives random forest-related parameters and the structure of each tree from the computing server after constructing T completely random trees according to random splitting rules; wherein, the random forest-related parameters include the number of trees T, the number of leaf nodes in each tree L, the number of messages generated by each user k, the user-side privacy budget parameter ε, and the label domain size C of the completely random tree classifier.

[0014] Based on the random forest parameters, complete the local parameter initialization on the user end.

[0015] Furthermore, the step of performing k independent perturbations on y in the triple to generate a message set containing k messages specifically includes:

[0016] Obtain the probability p of returning the true label y, and the probability p of returning the perturbed label. The probability q, where q = 1 - p;

[0017] Repeat the following single perturbation step k times to obtain k independent perturbation labels, generating a message set containing k messages: Sample the identifier variable r from the Bernoulli distribution Ber(p), where the probability of r = 1 is p, and the probability of r = 0 is q; generate perturbation labels based on the value of r. Where, if r = 1, then If r = 0, then uniform sampling is performed from the label set {0,…,C-1}\{y} excluding the true label y.

[0018] Furthermore, the formula for calculating the probability p of returning the true label y is:

[0019]

[0020] Return to Disruption Tags The formula for calculating the probability q is:

[0021]

[0022] Where ε is the user-side privacy budget parameter, and C is the label domain size of the fully random tree classifier.

[0023] Secondly, this invention provides a random forest privacy protection method based on shuffling differential privacy, applied to a shuffling server, the method comprising:

[0024] The system receives a set of messages sent by multiple user terminals. The set of messages is generated by the user terminal randomly selecting a tree t from T completely random trees in a random forest, inferring the leaf node number l to which the user sample belongs based on the structure of tree t, constructing a triple (t, l, y) based on the true label y corresponding to the leaf node, and then performing k independent perturbation processes on y in the triple; where T>1, k≥T;

[0025] The received message sets from multiple user terminals are shuffled and then sent to the computing server. The computing server estimates the label distribution of each tree leaf node based on the shuffled message set using a biased statistical method, and finally assigns a final label to each tree to obtain the constructed random forest model.

[0026] Furthermore, the shuffling of the received message sets from multiple user terminals specifically includes:

[0027] Create an array that contains all message sets from multiple clients;

[0028] Starting from the end of the array, randomly select an element and swap it with the current element, and move forward step by step until the beginning of the array to obtain the shuffled message set.

[0029] Thirdly, this invention provides a random forest privacy protection method based on shuffle differential privacy, applied to a computing server, the method comprising:

[0030] The system receives a shuffled message set from a shuffle server. This shuffled message set is obtained by shuffling multiple message sets received by the shuffle server from multiple user terminals. The message set is generated by the user terminal randomly selecting a tree t from T completely random trees in a random forest, inferring the leaf node number l to which the user sample belongs based on the structure of tree t, constructing a triple (t, l, y) based on the true label y corresponding to the leaf node, and then performing k independent perturbation processes on y in the triple; where T>1, k≥T.

[0031] Based on the shuffled message set, the label distribution of each leaf node is estimated using a biased statistical method, and finally, a final label is assigned to each tree to obtain the constructed random forest model.

[0032] Furthermore, before receiving the shuffled message set sent by the shuffle server, the method further includes:

[0033] T completely random trees are constructed according to the random splitting rules, and the relevant parameters of the random forest and the structure of each tree are sent to the user terminal.

[0034] In this framework, the parameters related to the random forest include the number of trees T, the number of leaf nodes in each tree L, the number of messages generated by each user k, the user-side privacy budget parameter ε, and the label domain size C of the fully random tree classifier.

[0035] Furthermore, the step of estimating the label distribution of each leaf node based on the shuffled message set using a bias-reduction statistical method, and finally assigning a final label to each tree to obtain the constructed random forest model, specifically includes:

[0036] Traverse the shuffled message set, and for each leaf node l of each tree t in the random forest, count the perturbation labels according to each category in the label field {0,…,C-1}. The occurrence count is used to obtain a noisy counting vector. Where C is the label domain size of the completely random tree classifier, the Each element in the table corresponds to the number of times a category appears;

[0037] Based on the above The true label frequency vector n is calculated using a preset bias reduction formula. t,l , where n t,l Each element in the table corresponds to the recovery frequency of a category;

[0038] Compare n t,l The numerical values ​​of each element are considered, and the category corresponding to the element with the largest numerical value is selected as the final label of the leaf node.

[0039] The T completely random trees with final labels are combined into a random forest model to obtain the constructed random forest model.

[0040] Furthermore, the debiasing formula is as follows:

[0041]

[0042] Where k is the number of messages uploaded by each user, N is the total number of users; p is the probability of returning the true label y, and q is the probability of returning a perturbation label. The probability of.

[0043] Fourthly, embodiments of the present invention provide a random forest privacy protection system based on shuffle differential privacy, including a user terminal, a shuffle server, and a computing server;

[0044] The user terminal is used to execute the random forest privacy protection method based on shuffle differential privacy as described in the first aspect;

[0045] The shuffle server is used to execute the random forest privacy protection method based on shuffle differential privacy as described in the second aspect;

[0046] The computing server is used to execute the random forest privacy protection method based on shuffle differential privacy as described in the third aspect.

[0047] Fifthly, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the random forest privacy protection method based on shuffle differential privacy as described in the first, second, or third aspects above.

[0048] This invention provides a method, system, and medium for privacy protection in random forests based on shuffle differential privacy. First, the user client randomly selects a tree t from T completely random trees in the random forest. Based on the structure of tree t, the leaf node number l to which the user sample belongs is inferred. A triple (t, l, y) is constructed based on the true label y corresponding to the leaf node. Then, y in the triple is subjected to k independent perturbations to generate a message set containing k messages, where T > 1 and k ≥ T. This message set is then sent to a shuffling server, which shuffles the received message sets from multiple user clients and sends the shuffled message set to a computation server. The computation server estimates the label distribution of each leaf node based on the shuffled message set using a biased statistical method, and finally assigns a final label to each tree, resulting in the constructed random forest model. This invention effectively avoids the computational requirements of dynamic splitting rules by combining a shuffle differential privacy mechanism with a completely random tree structure, thereby significantly reducing the consumption of the privacy budget. Meanwhile, users only need to perform k independent perturbations on their local data and upload the perturbated messages, without participating in complex splitting rule judgments and node sample statistics processes. This not only simplifies the user's operation but also significantly reduces the computational and communication overhead on the user's end. This solves the problems of high privacy budget consumption and significant communication and computational overhead inherent in traditional differential privacy random forests in privacy-preserving scenarios. Attached Figure Description

[0049] Figure 1 This is a flowchart of a random forest privacy protection method based on shuffle differential privacy according to Embodiment 1 of the present invention;

[0050] Figure 2 This is a flowchart illustrating the user-side processing in an embodiment of the present invention;

[0051] Figure 3 This is an ε-accuracy trade-off diagram of the local and mixed-wash differential privacy models in this embodiment of the invention;

[0052] Figure 4 This is a flowchart of a random forest privacy protection method based on shuffle differential privacy according to Embodiment 2 of the present invention;

[0053] Figure 5 This is a flowchart of a random forest privacy protection method based on shuffle differential privacy according to Embodiment 3 of the present invention;

[0054] Figure 6 This is a schematic diagram of a random forest privacy protection system based on shuffle differential privacy, according to Embodiment 4 of the present invention. Detailed Implementation

[0055] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0056] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0057] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0058] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0059] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0060] It is understood that the terms "first," "second," etc., in the embodiments of the present invention are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0061] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0062] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0063] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0064] Example 1:

[0065] This embodiment provides a random forest privacy protection method based on shuffle differential privacy, such as... Figure 1 As shown, when applied to the user end, the method includes:

[0066] Step S101: Randomly select a tree t from the T completely random trees in the random forest, and infer the leaf node number l to which the user sample belongs based on the structure of the tree t.

[0067] In this embodiment, the random forest is pre-built by the computing server, but the label assignments for the leaf nodes (i.e., leaf nodes) have not yet been determined. To improve data availability, each user terminal randomly selects one tree from T completely random trees and contributes its data to that tree. Then, based on the tree structure published by the computing server, the leaf node number l where the user's sample is located is inferred.

[0068] Optionally, before randomly selecting a tree t from T completely random trees in the random forest and inferring the leaf node number l to which the user sample belongs based on the structure of tree t, the method further includes:

[0069] The system receives random forest-related parameters and the structure of each tree from the computing server after constructing T completely random trees according to random splitting rules; wherein, the random forest-related parameters include the number of trees T, the number of leaf nodes in each tree L, the number of messages generated by each user k, the user-side privacy budget parameter ε, and the label domain size C of the completely random tree classifier.

[0070] Based on the random forest parameters, complete the local parameter initialization on the user end.

[0071] In this embodiment, the computing server first constructs T completely random trees according to the random splitting rules, and sends the random forest-related parameters and the structure of each tree to the user terminal. Each user terminal receives the random forest-related parameters and the structure of each tree sent by the computing server, and completes local parameter initialization. The random forest-related parameters include the number of trees T in the random forest, the number of leaf nodes L in each tree, the number of messages k generated by each user (usually k≥T), the user terminal privacy budget parameter ε, and the label field size C of the decision tree classifier (i.e., the completely random tree classifier).

[0072] Step S102: Construct a triple (t, l, y) based on the real label y corresponding to the leaf node.

[0073] In this embodiment, the user constructs a triple (t, l, y) for perturbation processing in subsequent steps, where t represents the tree number, l represents the leaf node number, and y∈{0,…,C-1} is the user's real label.

[0074] Step S103: Perform k independent perturbations on y in the triplet to generate a message set containing k messages; where T>1, k≥T.

[0075] In this embodiment, in order to protect privacy, the real label information is obtained from the user's real triple (t,l,y) and perturbed using a random response mechanism.

[0076] Optionally, the step of performing k independent perturbations on y in the triple to generate a message set containing k messages specifically includes:

[0077] Obtain the probability p of returning the true label y, and the probability p of returning the perturbed label. The probability q, where q = 1 - p;

[0078] Repeat the following single perturbation step k times to obtain k independent perturbation labels, generating a message set containing k messages: Sample the identifier variable r from the Bernoulli distribution Ber(p), where the probability of r = 1 is p, and the probability of r = 0 is q; generate perturbation labels based on the value of r. Where, if r = 1, then If r = 0, then uniform sampling is performed from the label set {0,…,C-1}\{y} excluding the true label y.

[0079] In this embodiment, the probability p of returning the true label y is calculated using the following formula:

[0080]

[0081] Return to Disruption Tags The formula for calculating the probability q is:

[0082]

[0083] Where ε is the user-side privacy budget parameter, and C is the label domain size of the fully random tree classifier.

[0084] In this embodiment, the specific perturbation formula is as follows:

[0085]

[0086] in, This is the scrambled label information, where U represents a uniform distribution. This represents the label information randomly sampled from the set of remaining labels {0,…,C-1}{y} after removing the true label y. To ensure the correctness of the sampling, the label variable r = Ber(p) is sampled from the Bernoulli distribution with probability p. The magnitude of r determines whether to return the true label or to scramble the label; that is, r is sampled as 1 with probability p and as 0 with probability 1-p.

[0087]

[0088] In this way, real-label data, after being perturbed, may retain the real label or become a perturbed label, thereby satisfying the requirements of local differential privacy.

[0089] In this embodiment, a multi-message set M is constructed. u Each time the disturbance occurs, a message is obtained, and the format of each message is: Where t represents the tree number and l represents the leaf node number. This is the category label after perturbation (i.e., the perturbation label). Then, message m... ui Join message set M u M u =M u ∪m ui Finally, a message set M containing k messages is obtained. u .

[0090] Step S104: Send the message set to the shuffling server so that the shuffling server shuffles the message sets received from multiple user terminals, sends the shuffled message set to the computing server, and the computing server estimates the label distribution of each tree leaf node based on the shuffled message set using a biased statistical method, and finally assigns a final label to each tree to obtain the constructed random forest model.

[0091] It should be noted that, during the research and practice of existing technologies, the inventors discovered that the differential privacy (DP) shuffle model has become a more promising alternative compared to centralized and local differential privacy models. In this model, the shuffler randomly arranges user information before publishing it to the server (or other data consumers). Since the shuffler only rearranges the information without accessing its content, it is considered semi-trusted (if each message is encrypted with the server's public key) and can be implemented through anonymous channels or edge servers. Because the server only observes the anonymized and shuffled information, each user only needs to inject a small amount of noise (low local privacy protection), and privacy is significantly amplified through shuffling. Recent research shows that, from the server's perspective, shuffled local ∈-DP messages from n users can be implemented. Privacy protection is enhanced. Therefore, the utility of the shuffling model exceeds that of the local differential privacy model and may approach that of the centralized differential privacy model.

[0092] In this embodiment, each user client sends its message set to a shuffling server. The shuffling server shuffles the received message sets from multiple user clients to achieve anonymization. Specifically, the shuffling server first creates an array containing all message sets from multiple user clients; then, starting from the end of the array, it randomly selects an element and swaps it with the current element, gradually moving forward until it reaches the beginning of the array, obtaining the shuffled message set. Since the order of the shuffled messages is no longer associated with the original user order, user privacy is protected.

[0093] In this embodiment, after the shuffling server shuffles the messages, it sends the shuffled message set to the computing server. The computing server estimates the label distribution of each tree leaf node based on the shuffled message set using a biased statistical method, and finally assigns a final label to each tree to obtain the constructed random forest model.

[0094] It should be noted that the privacy protection process in this embodiment is for the protection of training data, that is, the data provided by the user to train the model.

[0095] In an optional embodiment, the step of estimating the label distribution of each leaf node based on the shuffled message set using a bias-reduction statistical method, and finally assigning a final label to each tree to obtain the constructed random forest model, specifically includes:

[0096] Traverse the shuffled message set, and for each leaf node l of each tree t in the random forest, count the perturbation labels according to each category in the label field {0,…,C-1}. The occurrence count is used to obtain a noisy counting vector. Where C is the label domain size of the completely random tree classifier, the Each element in the table corresponds to the number of times a category appears;

[0097] Based on the above The true label frequency vector n is calculated using a preset bias reduction formula. t,l , where n t,l Each element in the table corresponds to the recovery frequency of a category;

[0098] Compare n t,l The numerical values ​​of each element are considered, and the category corresponding to the element with the largest numerical value is selected as the final label of the leaf node.

[0099] The T completely random trees with final labels are combined into a random forest model to obtain the constructed random forest model.

[0100] The de-biasing formula is as follows:

[0101]

[0102] In the formula, k is the number of messages uploaded by each user, N is the total number of users; p is the probability of returning the true label y, and q is the probability of returning a perturbation label. The probability of.

[0103] In this embodiment, the computing server first traverses the shuffled global message set and performs statistics on each leaf node. For each leaf node (t, l), which represents a certain category label y, the perturbation label of that leaf node in the perturbation message is counted. The number of times it appears is recorded as The formula is expressed as: in, This is an indicator function. That is, for a given t and l, from the message set M... The statistical message m includes the number of messages of category y. Then, the calculation server uses a bias-reduction formula to calculate the true label frequency vector n. t,l Among them, the bias correction formula can effectively correct the bias introduced by random response disturbances and restore the true label frequency distribution of each leaf node. and n t,l Each is a numerical vector of length C. Next, based on the bias-reduced statistical results, for each leaf node (t, l), the server calculates the recovery frequency of different categories and selects the category with the highest frequency as the final label for that leaf node. For example, for leaf node (t, l), if the frequency of category 0 after recovery... Frequency higher than category 1 The label of the leaf node is then determined to be 0. Finally, the computing server, in conjunction with the structure of the pre-built T completely random trees, assigns the final labels to the corresponding leaf nodes to form a complete completely random tree; after combining all T completely random trees, the constructed random forest model is obtained.

[0104] It's important to note that while random forests, as an ensemble learning method, consist of multiple decision trees and possess strong robustness and generalization capabilities, traditional random forests rely on complex splitting rules (such as information gain and Gini index) for node partitioning in privacy-preserving scenarios. This not only consumes significant privacy budgets but may also expose some statistical information. To address these issues, we propose a random forest model based on fully random trees. During the model's construction, the server randomly generates splitting attributes and thresholds, completely independent of user data statistics, thus avoiding direct reliance on user data and significantly reducing privacy budget consumption. Users only need to upload perturbed, simple participation information. The server then anonymizes this data using a multi-message shuffling protocol, estimates the label distribution of leaf nodes using a debiased statistical method, and finally assigns labels to each tree. This method not only theoretically achieves a balance between privacy and model accuracy but also demonstrates lower communication and computational overhead in practical applications.

[0105] It should be noted that the random forest privacy protection method based on shuffle differential privacy provided in this invention avoids the calculation of dynamic splitting rules by introducing a shuffle differential privacy mechanism and combining it with a fully random tree structure, significantly reducing the consumption of privacy budget. At the same time, this method fully utilizes the privacy enhancement effect of the shuffle protocol. Furthermore, users only need to perturb their local data and upload the perturbed message, without needing to participate in complex splitting rule judgments and node sample statistics, thus greatly reducing the computational and communication burden on the user end.

[0106] In one specific embodiment, the random forest privacy protection method based on shuffle differential privacy may include the following steps:

[0107] I. Client-side processing

[0108] The flowchart for user-side processing is as follows: Figure 2 As shown, it specifically includes:

[0109] S1: Initialization parameters: number of trees T in the random forest, number of leaf nodes L in each tree, number of messages generated by each user k (usually k≥T), user-side privacy budget parameter ε, and label domain size C of the decision tree classifier.

[0110] It's important to note that in a classification task scenario, this classifier label field corresponds to the total size of the data labels present in the entire dataset. If the size is C, it can be understood as having integer numerical labels of 0, 2, ..., C-1.

[0111] S2: Determine the target node. Assume the random forest contains T trees, each with L leaf nodes. The user randomly selects any tree t from the T trees to report their data results. For the selected t-th tree, the user infers the leaf node number l where their sample is located based on the tree structure published by the server (i.e., the computing server). The user constructs a triple (t, l, y) for perturbation processing in subsequent step S3, where y ∈ {0, …, C-1} is the user's true class label y. Simultaneously, the message set M is initialized. u This is an empty set, used in the subsequent step S4 for constructing a multi-message set.

[0112] It's important to note that the partitioning process in a random forest is randomized; therefore, users only need to provide their data during the leaf node label determination phase. It's also worth noting that since a random forest contains T trees, users can contribute their data to one or more trees depending on the algorithm design. This approach chooses to contribute data to only one tree because, in the field of differential privacy, this approach can be combined with the parallel theorem to achieve better data availability.

[0113] S3: Local Perturbation. To protect privacy, the user's real label information is obtained from the real triple (t, l, y), and a random response mechanism is used to perturb it. Let the probability of returning the real label be... The probability of returning a perturbation label (i.e., any label uniformly sampled from {0,…,C-1}\{y}) is: The specific perturbation formula is as follows:

[0114]

[0115] in, This is the scrambled label information, where U represents a uniform distribution. This represents the label information randomly sampled from the set of remaining labels {0,…,C-1}{y} after removing the true label y. To ensure the correctness of the sampling, the label variable r = Ber(p) is sampled from the Bernoulli distribution with probability p. The magnitude of r determines whether to return the true label or to scramble the label; that is, r is sampled as 1 with probability p and as 0 with probability 1-p.

[0116]

[0117] In this way, real-label data, after being perturbed, may retain the real label or become a perturbed label, thereby satisfying the requirements of local differential privacy.

[0118] S4: Construct a multi-message set M u. To enhance the utility of statistical data, the user needs to construct a multi-message data set of size k. The format of each message is as follows: where t represents the tree number and l represents the leaf node number. It is the class label after perturbation in step S3. Subsequently, the message m ui is added to the message set M u , that is, M u = M u ∪ m ui . If the current size of the message set is less than k (|M u | < k), repeat steps S3 and S4 until the size of the message set meets the requirement.

[0119] It should be noted that in a triple (t, l, y) obtained in step S2, the first two variables t and l are used to identify the location of user data and will not be perturbed in subsequent steps (S3, S4). The main task of the subsequent steps is to perform k independent perturbations on y to generate k random (independent) messages of the form (t, l, y1), (t, l, y2), …, (t, l, y k ). For the perturbation algorithm, these k messages are independent, that is, the randomness introduced in each message during the perturbation process is independent of each other (independent).

[0120] It should be noted that: S3 and S4 are a loop body, and its basic logic is to generate a single message and then add the message to the message set. When k = 2, if S3 - S4 is only executed once, only one message will be generated. So |M| = 1 < k = 2, and S3 and S4 need to be continued to be repeated.

[0121] S5: The user uploads the generated message set M u = {m u1 , m u2 , …, m uk} to the shuffle server. Each uploaded message has been locally perturbed and does not contain the original data.

[0122] It should be noted that: Before the user transmits the message set {(t, l, y1), (t, l, y2), …, (t, l, y k )} to the shuffle server, the data can be compressed first. Specifically, the message set {(t, l, y1), (t, l, y2), …, (t, l, y k )} will be compressed into a form of [|t|l|y1|y2|…|y kThis means that the user side can complete the transmission by sending log2(T+L+k×C) bits of information without sending the entire set, thus significantly reducing communication overhead.

[0123] II. Shuffling

[0124] S1: The shuffling server collects perturbation messages from the local randomizer, which have already had some noise added locally.

[0125] S2: Create an array containing all message sets.

[0126] S3: Starting from the end of the array, randomly select an element and swap it with the current element, and move forward step by step until the beginning of the array is reached.

[0127] S4: Send the randomly permuted messages to the computing server. Since the shuffled message order is no longer associated with the original user's order, user privacy is protected.

[0128] Specifically, this step will send all messages Randomly shuffle the order, where M u Let N be the set of messages for user u (of size k), and N be the number of users in the system. The shuffling server performs a unified shuffling of the received N·k messages. The purpose of this is to prevent potential adversarial analysts from gaining sensitive information about the original data by observing the order or correlation between data. The shuffling party can use various methods to shuffle, primarily through random permutations.

[0129] III. Server-side statistics and bias correction estimation

[0130] S1: Traverse the message set and perform statistics. Calculate the global message set after the server traverses the shuffled / mixed message set, and perform statistics for each leaf node. For each leaf node (t, l), which represents a certain category label y, count the perturbation label of that leaf node in the perturbation messages. The number of times it appears is recorded as The formula is expressed as: in, This is an indicator function. That is, for a given t and l, count the number of messages m containing category y from the message set M.

[0131] S2: Bias-free estimation. Since the uploaded messages are noisy after being subjected to random response perturbations, the statistically obtained counts... It is noisy data, in which, A numerical vector of length C. To recover the true label frequency n. t,l The computing server uses the following debiasing formula: Where: k is the number of messages uploaded by each user; N is the total number of users; p and q are the probabilities of returning the true label and the reverse label, respectively. For ease of description, the operation between vectors and scalars is defined as first performing scalar broadcasting, then performing computation. Therefore, the computation result n t,l It is also a numerical vector of length C. This formula can effectively correct for the bias introduced by random response disturbances and restore the true label frequency distribution of each leaf node.

[0132] S3: Leaf Node Label Assignment. Based on the bias-reduced statistical results, for each leaf node (t, l), the server compares the recovery frequencies of different categories and selects the category with the highest frequency as the final label for that leaf node. For example, for leaf node (t, l), if the frequency of category 0 after recovery... Frequency higher than category 1 The label of the leaf node is then determined to be 0.

[0133] It should be noted that the distribution calculated in step S1 is a perturbed distribution. Step S2 performs biased statistics (i.e., restoration operation) to obtain the restored frequency, which is the biased frequency information, also known as the true label frequency distribution.

[0134] IV. Random Forest Model Construction

[0135] S1: Completely Random Tree Construction. The server generates the splitting rules for each tree randomly based on pre-defined completely random rules, independent of user-uploaded data. The leaf node positions of each tree are statistically obtained through user-uploaded messages. The server uses the statistically derived leaf node labels to assign final labels to the leaf nodes of each tree, that is, the category with the highest frequency in the debiased statistical histogram is used as the leaf node label.

[0136] S2: Ensemble Random Forest. All T completely random trees are ensembled to form a random forest model. For new samples, the model outputs the final prediction using majority voting or weighted voting.

[0137] It's important to note that before step S1 of "User-side Processing," the computing server needs to first complete the random construction of the decision tree (i.e., generate the decision tree according to random splitting rules) and publish the algorithm-related parameters required for S1 (for initialization in step S1) and the topology of each tree (so that users can determine the location of the leaf nodes to which their data belongs in stage S2). However, even though the computing server has completed the construction of the random topology, the random forest is still unusable because the label assignments for the leaf nodes have not yet been determined. Therefore, the goal of "User-side Processing" is to statistically analyze the label distribution of the leaf nodes.

[0138] It should be noted that, compared to non-completely random topology tree model construction schemes that rely on information theory metrics, users do not need to participate in the additional topology construction process. In a distributed environment, the additional topology construction process usually requires multiple computations and communication interactions between the user and the computing server. However, the completely random topology construction method used in this invention does not rely on statistical information from user data, thus eliminating the computational and communication overhead in the topology construction process.

[0139] It should be noted that the random forest privacy protection method based on shuffle differential privacy provided by this invention can significantly improve the privacy protection capability of random forest models while ensuring model usability, effectively solving the trade-off problem between privacy protection and model performance in existing technologies. Specifically, this is reflected in the following aspects:

[0140] (1) Low computational and communication overhead on the user side: Each user only needs to generate leaf node label information in the form of triples for a single tree in the random forest, without having to participate in the calculation of complex decision tree splitting rules or multiple interactions. At the same time, the user side completes local perturbation through a lightweight random response mechanism, which simplifies the data processing flow and reduces the computational complexity and communication burden on the user side.

[0141] (2) Significant Privacy Amplification Effect: By introducing a shuffling differential privacy model, each user randomly selects one of T trees. A small amount of noise (satisfying ∈ 0-LDP) added locally by the user disturbs the data. After anonymization processing by a multi-message shuffling protocol at the shuffling module end, the label distribution information of the leaf nodes on that tree is reported. The process of each user randomly selecting a response tree is independent of each other, and each user contributes at most the query result of one tree node. The shuffling process severs the correlation between the data and the original user by randomly permuting the order of user messages, making the global privacy protection level from the server's perspective significantly higher than the local privacy budget of a single user, thus achieving high-strength privacy protection under low local noise conditions.

[0142] (3) Tight Theoretical Privacy Boundaries: In the privacy amplification analysis, based on the characteristics of user group queries, the advanced parallel theorem in the shuffle differential privacy model is adopted, combined with privacy amplification effect analysis techniques, to analyze the privacy level in the decision tree construction process, effectively enhancing the level of privacy protection. This invention derives that the global privacy protection level after shuffling can reach... The tight limit (where n is the number of users, β is...) δ represents the desired privacy leakage risk parameter. Compared to the traditional Local Differential Privacy (LDP) method, the global privacy leakage risk is significantly reduced under the same local budget. This theoretical result provides a rigorous guarantee for the balance between privacy and utility, ensuring that while protecting user privacy, it can still support large-scale data analysis and model building with high utility.

[0143] To verify the effectiveness of this invention, experiments were conducted using a constructed synthetic classification dataset to compare the classification accuracy of the models under different privacy budgets. Specifically, the constructed dataset included n users and C categories. Each user had a sample data set with dimension d. The values ​​of each dimension were independently sampled from a Gaussian distribution, with the central value following a uniform distribution of Uinform(-10,10) and a fixed standard deviation of 5. The experiments tested the classification performance of the local differential privacy random forest model and the shuffled differential privacy random forest model on the synthetic dataset when the budget parameter ε∈{0.05,0.1,0.5,0.1,0.2}. The experimental results (i.e., the ε-accuracy tradeoff plot of the local and shuffled differential privacy models) are shown below when n=200000, d=350, C=50, T=40, L=32. Figure 3 As shown. Figure 3 Experimental results show that, compared with traditional local differential privacy random forests, the method of this invention improves classification accuracy by 20%-60% while ensuring privacy security, and significantly reduces the privacy budget. More specifically:

[0144] In a strong privacy environment, i.e. when the privacy budget ∈ 0 = 0.5, the traditional local differential privacy method achieves a classification accuracy of 8% on the test data, while the classification accuracy of this invention is 56%.

[0145] In a weak privacy environment, i.e. when the privacy budget ∈ 0 = 2, the traditional local differential privacy method achieves a classification accuracy of 43% on the test data, while the classification accuracy of this invention is 96%.

[0146] This invention not only optimizes the balance between privacy protection and model availability and reduces privacy budget consumption, but also has broad application prospects, especially suitable for data mining tasks that require the protection of user privacy in scenarios such as financial risk control, medical diagnosis, and intelligent recommendation.

[0147] The random forest privacy protection method based on shuffle differential privacy provided in this invention firstly involves the user client randomly selecting a tree t from T completely random trees in the random forest. Based on the structure of tree t, the leaf node number l to which the user sample belongs is inferred. A triple (t, l, y) is constructed based on the true label y corresponding to the leaf node. Then, y in the triple is subjected to k independent perturbations to generate a message set containing k messages, where T > 1 and k ≥ T. This message set is then sent to a shuffling server, which shuffles the received message sets from multiple user clients and sends the shuffled message set to a computation server. The computation server estimates the label distribution of each leaf node based on the shuffled message set using a biased statistical method, and finally assigns a final label to each tree, resulting in the constructed random forest model. This invention effectively avoids the computational requirements of dynamic splitting rules by combining a shuffle differential privacy mechanism with a completely random tree structure, thereby significantly reducing the consumption of the privacy budget. Meanwhile, users only need to perform k independent perturbations on their local data and upload the perturbated messages, without participating in complex splitting rule judgments and node sample statistics processes. This not only simplifies the user's operation but also significantly reduces the computational and communication overhead on the user's end. This solves the problems of high privacy budget consumption and significant communication and computational overhead inherent in traditional differential privacy random forests in privacy-preserving scenarios.

[0148] Example 2:

[0149] like Figure 4 As shown, this embodiment provides a random forest privacy protection method based on shuffling differential privacy, applied to a shuffling server. The method includes:

[0150] Step S201: Receive a message set sent by multiple user terminals. The message set is generated by the user terminal randomly selecting a tree t from T completely random trees in the random forest, inferring the leaf node number l to which the user sample belongs based on the structure of the tree t, and constructing a triple (t, l, y) based on the real label y corresponding to the leaf node, and then performing k independent perturbation processing on y in the triple; where T>1, k≥T.

[0151] In this embodiment, the random forest is pre-built by the computing server, but the label assignments for the leaf nodes (i.e., leaf nodes) have not yet been determined. To improve data availability, each user client randomly selects one tree from T completely random trees and contributes its data to that tree. Based on the tree structure published by the computing server, the leaf node number l where the user's sample is located is inferred, and a triple (t, l, y) is constructed based on the true label y corresponding to the leaf node. To protect privacy, the true label information is obtained from the user's true triple (t, l, y) and perturbed using a random response mechanism.

[0152] Step S202: Shuffle the message sets received from multiple user terminals and send the shuffled message sets to the computing server. The computing server estimates the label distribution of each tree leaf node based on the shuffled message sets using a biased statistical method, and finally assigns a final label to each tree to obtain the constructed random forest model.

[0153] In this embodiment, each user terminal sends the message set to the shuffling server, which shuffles the message sets received from multiple user terminals to achieve anonymization.

[0154] Optionally, the shuffling of the received message sets from multiple user terminals specifically includes:

[0155] Create an array that contains all message sets from multiple clients;

[0156] Starting from the end of the array, randomly select an element and swap it with the current element, and move forward step by step until the beginning of the array to obtain the shuffled message set.

[0157] In this embodiment, user privacy is protected because the shuffled message order is no longer associated with the original user's order.

[0158] Example 3:

[0159] like Figure 5 As shown, this embodiment provides a random forest privacy protection method based on shuffle differential privacy, applied to a computing server. The method includes:

[0160] Step S301: Receive the shuffled message set sent by the shuffle server. The shuffled message set is obtained by the shuffle server after receiving message sets from multiple user terminals and shuffling them. The message set is generated by the user terminal randomly selecting a tree t from T completely random trees in the random forest, inferring the leaf node number l to which the user sample belongs based on the structure of the tree t, constructing a triple (t, l, y) based on the real label y corresponding to the leaf node, and then performing k independent perturbation processes on y in the triple; where T>1, k≥T.

[0161] In this embodiment, the shuffling server first creates an array containing all message sets from multiple users; then, starting from the end of the array, it randomly selects an element and swaps it with the current element, gradually moving forward until it reaches the beginning of the array, thus obtaining the shuffled message set. Since the order of the shuffled messages is no longer associated with the original user's order, user privacy is protected.

[0162] Optionally, before receiving the shuffled message set sent by the shuffle server, the method further includes:

[0163] T completely random trees are constructed according to the random splitting rules, and the relevant parameters of the random forest and the structure of each tree are sent to the user terminal.

[0164] In this framework, the parameters related to the random forest include the number of trees T, the number of leaf nodes in each tree L, the number of messages generated by each user k, the user-side privacy budget parameter ε, and the label domain size C of the fully random tree classifier.

[0165] In this embodiment, the random forest is pre-built by the computing server, but the label assignments for the leaf nodes (i.e., leaf nodes) have not yet been determined.

[0166] Step S302: Estimate the label distribution of each leaf node based on the shuffled message set using a biased statistical method, and finally assign a final label to each tree to obtain the constructed random forest model.

[0167] Optionally, the step of estimating the label distribution of each leaf node based on the shuffled message set using a bias-reduction statistical method, and finally assigning a final label to each tree to obtain the constructed random forest model, specifically includes:

[0168] Traverse the shuffled message set, and for each leaf node l of each tree t in the random forest, count the perturbation labels according to each category in the label field {0,…,C-1}. The occurrence count is used to obtain a noisy counting vector. Where C is the label domain size of the completely random tree classifier, the Each element in the table corresponds to the number of times a category appears;

[0169] Based on the above The true label frequency vector n is calculated using a preset bias reduction formula. t,l , where n t,l Each element in the table corresponds to the recovery frequency of a category;

[0170] Compare n t,l The numerical values ​​of each element are considered, and the category corresponding to the element with the largest numerical value is selected as the final label of the leaf node.

[0171] The T completely random trees with final labels are combined into a random forest model to obtain the constructed random forest model.

[0172] Optionally, the de-biasing formula is:

[0173]

[0174] Where k is the number of messages uploaded by each user, N is the total number of users; p is the probability of returning the true label y, and q is the probability of returning a perturbation label. The probability of.

[0175] In this embodiment, the computing server first traverses the shuffled global message set and performs statistics on each leaf node. For each leaf node (t, l), which represents a certain category label y, the perturbation label of that leaf node in the perturbation message is counted. The number of times it appears is recorded as The formula is expressed as: in, This is an indicator function. That is, for a given t and l, from the message set M... The statistical message m includes the number of messages of category y. Then, the calculation server uses a bias-reduction formula to calculate the true label frequency vector n. t,l Among them, the bias correction formula can effectively correct the bias introduced by random response disturbances and restore the true label frequency distribution of each leaf node. and n t,l Each is a numerical vector of length C. Next, based on the bias-reduced statistical results, for each leaf node (t, l), the server calculates the recovery frequency of different categories and selects the category with the highest frequency as the final label for that leaf node. For example, for leaf node (t, l), if the frequency of category 0 after recovery... Frequency higher than category 1 The label of the leaf node is then determined to be 0. Finally, the computing server, in conjunction with the structure of the pre-built T completely random trees, assigns the final labels to the corresponding leaf nodes to form a complete completely random tree; after combining all T completely random trees, the constructed random forest model is obtained.

[0176] Example 4:

[0177] refer to Figure 6 This embodiment provides a random forest privacy protection system based on shuffle differential privacy, including a user terminal 11, a shuffle server 12, and a computing server 13;

[0178] The user terminal 11 is used to execute the random forest privacy protection method based on shuffle differential privacy in Embodiment 1;

[0179] The shuffle server 12 is used to execute the random forest privacy protection method based on shuffle differential privacy in Embodiment 2;

[0180] The computing server 13 is used to execute the random forest privacy protection method based on shuffle differential privacy in Embodiment 3.

[0181] Example 5:

[0182] This embodiment provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the random forest privacy protection method based on shuffle differential privacy as described in Embodiment 1, Embodiment 2, or Embodiment 3 above.

[0183] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0184] In summary, the random forest privacy protection method, system, and medium based on shuffle differential privacy provided in this invention firstly involves the user terminal randomly selecting a tree t from T completely random trees in the random forest. Based on the structure of tree t, the leaf node number l to which the user sample belongs is inferred. A triple (t, l, y) is constructed based on the true label y corresponding to the leaf node. Then, y in the triple is subjected to k independent perturbations to generate a message set containing k messages, where T > 1 and k ≥ T. This message set is then sent to a shuffling server, which shuffles the received message sets from multiple user terminals and sends the shuffled message set to a computation server. The computation server estimates the label distribution of each leaf node based on the shuffled message set using a biased statistical method, and finally assigns a final label to each tree, resulting in the constructed random forest model. This invention effectively avoids the computational requirements of dynamic splitting rules by combining a shuffle differential privacy mechanism with a completely random tree structure, thereby significantly reducing the consumption of the privacy budget. Meanwhile, users only need to perform k independent perturbations on their local data and upload the perturbated messages, without participating in complex splitting rule judgments and node sample statistics processes. This not only simplifies the user's operation but also significantly reduces the computational and communication overhead on the user's end. This solves the problems of high privacy budget consumption and significant communication and computational overhead inherent in traditional differential privacy random forests in privacy-preserving scenarios.

[0185] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A random forest privacy protection method based on shuffle differential privacy, characterized in that, When applied to a user terminal, the method includes: Randomly select a tree t from T completely random trees in the random forest, and infer the leaf node number l to which the user sample belongs based on the structure of the tree t; Construct a triple (t, l, y) based on the actual label y corresponding to the leaf node; Perform k independent perturbations on y in the triplet to generate a message set containing k messages; where T>1, k≥T; The message set is sent to the shuffling server, which shuffles the message sets received from multiple user terminals. The shuffled message set is then sent to the computing server, which estimates the label distribution of each tree leaf node based on the shuffled message set using a biased statistical method. Finally, a final label is assigned to each tree, resulting in the constructed random forest model.

2. The method according to claim 1, characterized in that, Before randomly selecting a tree t from T completely random trees in the random forest and inferring the leaf node number l to which the user sample belongs based on the structure of tree t, the method further includes: The system receives random forest-related parameters and the structure of each tree from the computing server after constructing T completely random trees according to random splitting rules; wherein, the random forest-related parameters include the number of trees T, the number of leaf nodes in each tree L, the number of messages generated by each user k, the user-side privacy budget parameter ε, and the label domain size C of the completely random tree classifier. Based on the random forest parameters, complete the local parameter initialization on the user end.

3. The method according to claim 1, characterized in that, The step of performing k independent perturbations on y in the triplet to generate a message set containing k messages specifically includes: Obtain the probability p of returning the true label y, and the probability p of returning the perturbed label. The probability q, where q = 1 - p; Repeat the following single perturbation step k times to obtain k independent perturbation labels, generating a message set containing k messages: Sample the identifier variable r from the Bernoulli distribution Ber(p), where the probability of r = 1 is p, and the probability of r = 0 is q; generate perturbation labels based on the value of r. Where, if r = 1, then If r = 0, then uniform sampling is performed from the label set {0,…,C-1}\{y} excluding the true label y.

4. The method according to claim 3, characterized in that, The formula for calculating the probability p of returning the true label y is: Return to Disruption Tags The formula for calculating the probability q is: Where ε is the user-side privacy budget parameter, and C is the label domain size of the fully random tree classifier.

5. A random forest privacy protection method based on shuffle differential privacy, characterized in that, Applied to a mixed-wash server, the method includes: The system receives a set of messages sent by multiple user terminals. The set of messages is generated by the user terminal randomly selecting a tree t from T completely random trees in a random forest, inferring the leaf node number l to which the user sample belongs based on the structure of tree t, constructing a triple (t, l, y) based on the true label y corresponding to the leaf node, and then performing k independent perturbation processes on y in the triple; where T>1, k≥T; The received message sets from multiple user terminals are shuffled and then sent to the computing server. The computing server estimates the label distribution of each tree leaf node based on the shuffled message set using a biased statistical method, and finally assigns a final label to each tree to obtain the constructed random forest model.

6. The method according to claim 5, characterized in that, The shuffling of the received message sets from multiple user terminals specifically includes: Create an array that contains all message sets from multiple clients; Starting from the end of the array, randomly select an element and swap it with the current element, and move forward step by step until the beginning of the array to obtain the shuffled message set.

7. A random forest privacy protection method based on shuffle differential privacy, characterized in that, Applied to a computing server, the method includes: The system receives a shuffled message set from a shuffle server. This shuffled message set is obtained by shuffling multiple message sets received by the shuffle server from multiple user terminals. The message set is generated by the user terminal randomly selecting a tree t from T completely random trees in a random forest, inferring the leaf node number l to which the user sample belongs based on the structure of tree t, constructing a triple (t, l, y) based on the true label y corresponding to the leaf node, and then performing k independent perturbation processes on y in the triple; where T>1, k≥T. Based on the shuffled message set, the label distribution of each leaf node is estimated using a biased statistical method, and finally, a final label is assigned to each tree to obtain the constructed random forest model.

8. The method according to claim 7, characterized in that, Before receiving the shuffled message set sent by the shuffle server, the method further includes: T completely random trees are constructed according to the random splitting rules, and the relevant parameters of the random forest and the structure of each tree are sent to the user terminal. In this framework, the parameters related to the random forest include the number of trees T, the number of leaf nodes in each tree L, the number of messages generated by each user k, the user-side privacy budget parameter ε, and the label domain size C of the fully random tree classifier.

9. The method according to claim 7, characterized in that, The process involves estimating the label distribution of each leaf node based on the shuffled message set using a bias-reduction statistical method, and finally assigning a final label to each tree to obtain the constructed random forest model. Specifically, this includes: Traverse the shuffled message set, and for each leaf node l of each tree t in the random forest, count the perturbation labels according to each category in the label field {0,…,C-1}. The occurrence count is used to obtain a noisy counting vector. Where C is the label domain size of the completely random tree classifier, the Each element in the table corresponds to the number of times a category appears; Based on the above The true label frequency vector n is calculated using a preset bias reduction formula. t,l , where n t,l Each element in the table corresponds to the recovery frequency of a category; Compare n t,l The numerical values ​​of each element are considered, and the category corresponding to the element with the largest numerical value is selected as the final label of the leaf node. The T completely random trees with final labels are combined into a random forest model to obtain the constructed random forest model.

10. The method according to claim 9, characterized in that, The de-biasing formula is as follows: Where k is the number of messages uploaded by each user, N is the total number of users; p is the probability of returning the true label y, and q is the probability of returning a perturbation label. The probability of.

11. A random forest privacy protection system based on shuffle differential privacy, characterized in that, This includes the user terminal, the shuffling server, and the computing server; The user terminal is used to execute the random forest privacy protection method based on shuffle differential privacy as described in any one of claims 1-4; The shuffle server is used to execute the random forest privacy protection method based on shuffle differential privacy as described in claim 5 or 6; The computing server is used to execute the random forest privacy protection method based on shuffle differential privacy as described in any one of claims 7-10.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the random forest privacy protection method based on shuffle differential privacy as described in any one of claims 1-4, or the random forest privacy protection method based on shuffle differential privacy as described in claim 5 or 6, or the random forest privacy protection method based on shuffle differential privacy as described in any one of claims 7-10.

Images