Differential privacy federated learning method based on noise scale allocation and related device

Abstract

The application belongs to the technical field of model training, and provides a differential privacy federated learning method based on noise scale allocation and related equipment. Embodiments of the application obtain a total noise scale sequence of a target client under a total training step number, and allocate a noise scale sub-sequence to a plurality of local training steps of the target client in a current global iteration based on the total noise scale sequence; the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of a global model corresponding to a server under the constraint of a total privacy budget of the target client; the target client performs the current global iteration based on a decreasing learning rate sequence and a mini-batch stochastic gradient descent algorithm, and performs gradient noise processing according to the noise scale sub-sequence. Finally, the current global model is updated based on the aggregated cumulative noise gradient. Embodiments of the application can be applied to differential privacy federated learning of mini-batch local training, and can improve model performance while protecting privacy.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of federated learning, and particularly relates to a differential privacy federated learning method based on noise scale allocation and related equipment. BACKGROUND

[0002] At present, federated learning has attracted extensive attention because it can train a global model while keeping the privacy data of clients locally. During training, the client only needs to share the model gradient with the central parameter server (PS), which avoids the direct leakage of training data. However, the model gradient exposed during transmission can still be stolen by attackers and used to perform privacy attacks to illegally obtain the privacy data of the client.

[0003] In order to resist these privacy attacks, differential privacy federated learning (DPFL) is proposed, which uses zero-mean random noise generated by the differential privacy (DP) mechanism to disturb the model gradient. Although the noisy gradient has been proven to effectively reduce the success rate of the above privacy attacks, the noisy gradient also brings the challenge of performance degradation of the global model, which seriously hinders the practical application of differential privacy federated learning.

[0004] Gaussian mechanism (GM) is a commonly used differential privacy mechanism, and the noise size is determined by the noise scale. The larger the noise scale, the greater the probability of random noise deviating from the mean value of zero, the better the privacy protection effect, but the worse the usability of the model gradient. Under the given privacy budget and total training steps, the noise scale of each training step is usually determined by two aspects of audit method and noise allocation strategy. Among them, the audit method determines the form of privacy loss variable, and the noise allocation strategy further refines the noise scale of the training process on the basis of the audit method.

[0005] In related technologies, although an adaptive noise scale allocation strategy based on zero-concentrated differential privacy (zCDP) audit method is proposed, that is, a smaller noise scale is allocated to the later training stage to ensure the stable convergence of the model. However, this adaptive noise scale allocation strategy is designed for centralized machine learning and is not applicable to the federated learning scenario of small batch local training (i.e. the sampling probability q is less than 1).

[0006] In view of this, how to provide a differential privacy federated learning suitable for small batch local training to balance the relationship between privacy protection and model performance has become a key problem to be solved. SUMMARY

[0007] Therefore, the embodiments of the present application provide a differential privacy federated learning method based on noise scale allocation and related equipment, which can be applied to differential privacy federated learning with small batch local training, and improve model performance while protecting privacy.

[0008] The first aspect of the embodiments of the present application provides a differential privacy federated learning method based on noise scale allocation, comprising:

[0009] determining a learning rate sequence of each local training step under a total training step number, and sending the learning rate sequence to all clients; the total training step number corresponds to multiple rounds of global iterations, and the learning rate sequence is a decreasing sequence;

[0010] for each round of global iteration, determining a target client participating in the round of global iteration from the all clients, and sending a current global model to the target client;

[0011] obtaining a total noise scale sequence of the target client under the total training step number, and allocating a noise scale sub-sequence for multiple local training steps of the target client in the round of global iteration based on the total noise scale sequence, and sending the noise scale sub-sequence to the target client; the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client;

[0012] performing multiple local training steps in the round of global iteration by the target client based on the learning rate sequence and a small batch stochastic gradient descent algorithm, and respectively adding noise to the model gradient obtained by each local training step according to the noise scale sub-sequence to obtain a cumulative noise gradient;

[0013] obtaining the cumulative noise gradient uploaded by the target client, and updating the current global model based on the aggregated cumulative noise gradient.

[0014] In some embodiments, the obtaining the total noise scale sequence of the target client under the total training step number comprises:

[0015] determining an upper bound of noise variance of a Gaussian mechanism adopted by the target client under a local training step;

[0016] determining a sample distribution degree of the target client according to the difference between the local model gradient and the global model gradient of the target client;

[0017] deriving a model convergence upper bound under the total training step number based on the upper bound of noise variance and the sample distribution degree;

[0018] quantify a first cumulative privacy budget consumed by each of the target clients in the total number of training steps, by using a RAPPOR differential privacy mechanism;

[0019] determine a target constraint condition of a total noise scale sequence of the target clients based on the first cumulative privacy budget and a total privacy budget of each of the target clients;

[0020] minimize a convergence upper bound of a global model corresponding to the server under the target constraint condition, to obtain the total noise scale sequence of the target clients in the total number of training steps.

[0021] In some embodiments, the determining the target constraint condition of the total noise scale sequence of the target clients based on the first cumulative privacy budget and the total privacy budget of each of the target clients comprises:

[0022] obtain a conversion relationship between the RAPPOR differential privacy mechanism and a differential privacy mechanism, and convert the first cumulative privacy budget into a second cumulative privacy budget under the differential privacy mechanism based on the conversion relationship;

[0023] determine the target constraint condition of the total noise scale sequence of the target clients based on the second cumulative privacy budget and the total privacy budget of each of the target clients.

[0024] In some embodiments, the determining the target constraint condition of the total noise scale sequence of the target clients based on the second cumulative privacy budget being equal to the total privacy budget of each of the target clients comprises:

[0025] set the second cumulative privacy budget being equal to the total privacy budget of each of the target clients as a theoretical constraint condition of the total noise scale sequence of the target clients;

[0026] obtain a target optimal order parameter value determined based on a noise scale average allocation algorithm;

[0027] replace an optimal order parameter in the theoretical constraint condition based on the target optimal order parameter value, to obtain the target constraint condition of the total noise scale sequence of the target clients.

[0028] In some embodiments, the minimizing the convergence upper bound of the global model corresponding to the server under the target constraint condition, to obtain the total noise scale sequence of the target clients in the total number of training steps comprises:

[0029] determine a total noise upper bound of the target client based on a convergence upper bound of the global model corresponding to the server; the total noise upper bound is proportional to a learning rate and a noise scale;

[0030] convert minimizing the convergence upper bound of the global model corresponding to the server into minimizing the total noise upper bound of the target client;

[0031] minimize the total noise upper bound under the target constraint condition to calculate a total noise scale sequence of the target client under the total training step number.

[0032] In some embodiments, the minimizing the total noise upper bound under the target constraint condition to calculate a total noise scale sequence of the target client under the total training step number comprises:

[0033] ignore that noise scales allocated by multiple local training steps in each round of global iteration are different, to convert the total noise upper bound into a first noise upper bound of noise scales for each round of global iteration, and convert the target constraint condition into a first constraint condition for each round of global iteration;

[0034] minimize the first noise upper bound under the first constraint condition to calculate an optimal Riel privacy budget of the target client in each round of global iteration;

[0035] convert the total noise upper bound into a second noise upper bound of noise scales for multiple local training steps in each round of global iteration;

[0036] minimize the second noise upper bound under the constraint of the optimal Riel privacy budget to obtain a total noise scale sequence of the target client under the total training step number.

[0037] A second aspect of the embodiments of the application provides a differential privacy federated learning method based on noise scale allocation, the method comprising:

[0038] obtain a learning rate sequence of each local training step under a total training step number and a current global model, the total training step number corresponding to multiple rounds of global iteration, and the learning rate sequence being a decreasing sequence;

[0039] for each round of global iteration, obtain a noise scale sub-sequence allocated to multiple local training steps in the round of global iteration; the noise scale sub-sequence is obtained based on a total noise scale sequence under the total training step number; the total noise scale sequence is determined by minimizing a convergence upper bound of a global model corresponding to the server under a total privacy budget of the target client;

[0040] based on the learning rate sequence and a mini-batch stochastic gradient descent algorithm, performing a plurality of local training steps in the current global iteration, and respectively adding noise to model gradients obtained in each of the local training steps according to the noise scale sub-sequence to obtain accumulated noisy gradients;

[0041] uploading the accumulated noisy gradients to a server, and updating the current global model based on aggregated accumulated noisy gradients by the server.

[0042] A third aspect of the embodiments of the present application provides a differential privacy federated learning device based on noise scale allocation, the device comprising:

[0043] a determination module configured to determine a learning rate sequence of each local training step under a total training step number, and send the learning rate sequence to a full client; the total training step number corresponds to a plurality of global iterations, and the learning rate sequence is a decreasing sequence;

[0044] a screening module configured to determine, for each global iteration, a target client participating in the current global iteration from the full client, and send a current global model to the target client;

[0045] a noise allocation module configured to obtain a total noise scale sequence of the target client under the total training step number, and allocate a noise scale sub-sequence for a plurality of local training steps in the current global iteration of the target client based on the total noise scale sequence, and send the noise scale sub-sequence to the target client; the total noise scale sequence is an increasing sequence determined by minimizing a convergence upper bound of a global model corresponding to a server under a constraint of a total privacy budget of the target client;

[0046] a first training module configured to perform, by the target client, a plurality of local training steps in the current global iteration based on the learning rate sequence and a mini-batch stochastic gradient descent algorithm, and respectively add noise to model gradients obtained in each of the local training steps according to the noise scale sub-sequence to obtain accumulated noisy gradients;

[0047] a model updating module configured to obtain accumulated noisy gradients uploaded by the target client, and update the current global model based on aggregated accumulated noisy gradients.

[0048] A fourth aspect of the embodiments of the present application provides a differential privacy federated learning device based on noise scale allocation, the device comprising:

[0049] a first obtaining module configured to obtain a learning rate sequence of each local training step under a total training step number and a current global model, the total training step number corresponding to a plurality of global iterations, and the learning rate sequence being a decreasing sequence;

[0050] a second obtaining module configured to, for each round of global iteration, obtain a noise scale sub-sequence allocated for a plurality of local training steps in the round of global iteration, the noise scale sub-sequence being allocated based on a total noise scale sequence at the total number of training steps, the total noise scale sequence being an increasing sequence determined by minimizing a convergence upper bound of a global model corresponding to the server under a constraint of a total privacy budget of the target client;

[0051] a second training module configured to perform the plurality of local training steps in the round of global iteration based on the learning rate sequence and a mini-batch stochastic gradient descent algorithm, and respectively add noise to model gradients obtained in each local training step according to the noise scale sub-sequence to obtain cumulative noisy gradients;

[0052] a transmission module configured to upload the cumulative noisy gradients to the server, and update the current global model based on aggregated cumulative noisy gradients by the server.

[0053] A fifth aspect of the embodiments of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the federated learning method based on noise scale allocation of differential privacy provided in the first aspect when executing the computer program.

[0054] A sixth aspect of the embodiments of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the federated learning method based on noise scale allocation of differential privacy provided in the first aspect.

[0055] A seventh aspect of the embodiments of the present application provides a computer program product, when the computer program product is executed on a processor, the processor is caused to implement the steps of the federated learning method based on noise scale allocation of differential privacy provided in the first aspect.

[0056] The first aspect of the embodiments of the present application provides a differential privacy federated learning method based on noise scale allocation. The learning rate sequence of each local training step under the total training step is determined, and the learning rate sequence is sent to the full client. The total training step corresponds to multiple global iterations, and the learning rate sequence is a decreasing sequence. For each global iteration, the target client participating in the global iteration is determined from the full client, and the current global model is sent to the target client. The total noise scale sequence of the target client under the total training step is obtained, and the noise scale sub-sequence is allocated to the multiple local training steps of the target client in the global iteration based on the total noise scale sequence, and the noise scale sub-sequence is sent to the target client. The total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client. The multiple local training steps in the global iteration are executed by the target client based on the learning rate sequence and the mini-batch stochastic gradient descent algorithm, and the model gradient obtained by each local training step is respectively added with noise according to the noise scale sub-sequence to obtain the cumulative noise gradient. The cumulative noise gradient uploaded by the target client is obtained, and the current global model is updated based on the aggregated cumulative noise gradient.

[0057] Thus, the total noise scale sequence of the target client under the total training step is obtained in advance, and the noise scale sub-sequence is allocated to the multiple local training steps of the target client in the global iteration based on the total noise scale sequence. Since the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client, that is, by the optimal noise scale increasing allocation strategy, smaller noise scale is allocated in the early training stage to make the model quickly establish the accurate strong correlation between the data features and the labels, thereby reducing the influence of noise on the final global model and improving the model accuracy. Larger noise scale is allocated in the later training stage to ensure that the privacy loss of the target client meets the privacy budget demand of each client. In addition, since the total noise scale sequence is an increasing sequence, the noise scales of the multiple local training steps in each global iteration are different in the mini-batch local training process of each global iteration, which realizes more fine-grained noise scale allocation, is suitable for differential privacy federated learning with mini-batch local training, and improves the model performance while protecting privacy.

[0058] It can be understood that the beneficial effects of the above-mentioned second aspect to seventh aspect can be referred to the related description in the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0060] Figure 1 is a comparison diagram of sensitivity of noise scale in different training stages provided by the embodiments of the present application;

[0061] Figure 2 is a flowchart of a differential privacy federated learning method based on noise scale allocation provided by the embodiments of the present application;

[0062] Figure 3 is a flowchart of a method for determining a total noise scale sequence of a target client at a total training step provided by the embodiments of the present application;

[0063] Figure 4 is a flowchart of another differential privacy federated learning method based on noise scale allocation provided by the embodiments of the present application;

[0064] Figure 5 is a structural block diagram of a differential privacy federated learning device based on noise scale allocation provided by the embodiments of the present application;

[0065] Figure 6 is a structural block diagram of another differential privacy federated learning device based on noise scale allocation provided by the embodiments of the present application;

[0066] Figure 7 is a structural diagram of an electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0067] In the following description, specific details are set forth in order to provide a thorough understanding of the embodiments of the present application. However, persons skilled in the art will understand that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary details.

[0068] It should be understood that when used in the present application, the term "comprising" indicates the presence of described features, whole, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, whole, steps, operations, elements, components and / or sets thereof.

[0069] It should also be understood that the term "and / or" as used herein refers to any one of the associated listed items, or a combination of any of the associated listed items, and all possible combinations, and includes these combinations.

[0070] As used in this application, the term "if' can be construed to mean "when" or "once" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be construed to mean "once it is determined" or "in response to determining" or "once [the described condition or event] is detected" or "in response to detecting [the described condition or event]," depending on the context.

[0071] In addition, in the description of the application, the terms "first", "second", "third", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0072] In this application description, the reference "one embodiment" or "some embodiments" and the like means that the specific features, structures or characteristics described in connection with the embodiment are included in one or more embodiments of the application. Therefore, the statements "in one embodiment", "in some embodiments", "in other some embodiments", "in additional some embodiments" and the like appearing in different places in the application description are not necessarily all referring to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized. The terms "include", "contain", "have" and their variants mean "include but not limited to", unless otherwise specifically emphasized.

[0073] First, some terms related to the embodiments of the application are explained and described, so as to facilitate the understanding of those skilled in the art.

[0074] Federated learning (FL): a machine learning framework that uses data for learning and training under the premise of meeting privacy and data security. As a distributed machine learning paradigm, federated learning can effectively solve the problem of data silos, allowing participants to jointly model without sharing data, and can technically break down data silos and achieve collaborative training.

[0075] Differential privacy (DP): by introducing controllable random noise in data query or model training, it is ensured that the query results on adjacent data sets are indistinguishable from the query results on the original data set, ensuring that attackers cannot infer the existence or non-existence of individual data from the output results.

[0076] Differentially Private Federated Learning (DPFL): is a method that applies differential privacy techniques to the federated learning framework to protect the privacy of client data.

[0077] Renyi Differential Privacy (RDP): is a more stringent and refined generalization of differential privacy that uses Renyi divergence to measure the difference between two probability distributions (i.e., the output distribution of an algorithm on adjacent datasets).

[0078] Gaussian Mechanism (GM): is one of the commonly used techniques to implement differential privacy noise perturbation. Its core operation is to add noise sampled from a Gaussian (normal) distribution to data queries or model training.

[0079] Federated Averaging Algorithm (FedAvg): is the core model training algorithm for federated learning. It collaboratively trains a shared global model without centralizing raw data to the server by leveraging multiple clients holding local data.

[0080] Stochastic Gradient Descent (SGD): is an iterative algorithm used to optimize machine learning models by updating model parameters using the gradient of only one sample (or a small batch of samples) at a time, thereby accelerating convergence and reducing computational cost.

[0081] Currently, federated learning has attracted widespread attention due to its ability to train a global model while keeping the privacy data of clients on the local side. During training, clients only need to share model gradients with the central parameter server (PS), which avoids direct leakage of training data. However, the model gradients exposed during transmission can still be stolen by attackers and used to perform privacy attacks to illegally obtain the privacy data of clients. Attackers can use the uniqueness of the gradient to iteratively restore the original training sample that generated the gradient, or use the gradient to train a shadow model to simulate the target model and infer whether a given sample is a member of the target model's training samples.

[0082] To defend against these privacy attacks, Differentially Private Federated Learning (DPFL) is proposed, which uses zero-mean random noise generated by a Differentially Private (DP) mechanism to perturb the model gradient. Although the noisy gradient has been proven to effectively reduce the success rate of the above privacy attacks, the noisy gradient also brings the challenge of performance degradation of the global model, which seriously hinders the practical application of DPFL.

[0083] Gaussian Mechanism (GM) is a commonly used DP mechanism, and the noise size is determined by the noise scale (i.e. the standard deviation of the Gaussian distribution). The larger the noise scale, the greater the probability of random noise deviating from the mean of zero (i.e. the larger the noise), the better the privacy protection effect, but the worse the usability of the model gradient. Under the given privacy budget and total training steps, the noise scale of each training step is usually determined by two aspects of audit method and noise allocation strategy. Among them, the audit method determines the form of privacy loss variable, and the noise allocation strategy refines the noise scale of the training process on the basis of the audit method.

[0084] In related technologies, although an adaptive noise scale allocation strategy based on zero-concentrated differential privacy zCDP audit method is proposed, that is, a smaller noise scale is allocated to the later training to ensure the stable convergence of the model. However, this adaptive noise scale allocation strategy is designed for centralized machine learning and is not applicable to the federated learning scenario of small batch local training (i.e. the sampling probability q is less than 1). Specifically, first of all, the performance of these allocation strategies is very sensitive to hyperparameters (such as the initial noise scale and the noise scale decay rate), so the optimal hyperparameters need to be searched by grid search to achieve the best performance, which is not allowed in federated learning because each search will leak privacy. Secondly, the audit method zCDP used by these allocation strategies cannot achieve the optimal privacy audit under the common small batch training scenario (i.e. ) of federated learning. Most importantly, these allocation strategies are heuristic and cannot provide theoretical convergence guarantees or optimality.

[0085] In view of this, how to provide a differentially private federated learning suitable for small batch local training to balance the relationship between privacy protection and model performance has become a key problem to be solved.

[0086] First of all, introduce the general differentially private federated learning system (DPFL system), which includes a parameter server (Parameter Server, PS) and a client, the client is represented as where PS is semi-honest and curious, i.e., satisfies the following properties: (1) PS will honestly sample clients and aggregate the model gradients collected from the selected clients; (2) PS will not modify or delete any information used for model aggregation; (3) PS tries to infer the sensitive information of the corresponding client from the received model gradients. Therefore, the DP mechanism can be used to resist both PS and malicious external attackers. Each client has an independent dataset of size denoted as . All clients collaboratively train a global model whose training objective is to minimize the global loss function denoted as . Where is the model training parameter of dimension d, is the local loss function of client , i.e., the average of the loss functions of all its data samples, denoted as .

[0087] Federated Averaging Algorithm (FedAvg) is one of the most popular training algorithms in federated learning, and most of the current DPFL frameworks are improved based on the Federated Averaging Algorithm (FedAvg). The existing DPFL framework generates DP random noise that satisfies a specific Gaussian distribution to disturb the gradient after the local training calculation of the FedAvg algorithm. However, the original DP auditing method cannot accurately track the privacy loss in the training process, and the noise scale average allocation strategy also cannot consider the differences in model performance improvement in different training stages of the training process, which leads to poor performance of the existing DPFL and makes it difficult to be applied in practice.

[0088] Currently, there have been a large number of research works dedicated to improving the auditing method or noise scale allocation strategy to reduce the impact of noise scale, thereby improving the performance of DPFL. On the one hand, since the Renyi divergence can measure the difference between any two distributions, it is used to define the privacy loss variable, i.e., the difference between the output distributions on a pair of adjacent datasets. Some researchers relax the order of the Renyi divergence from infinity (DP definition) to a real number greater than 1, thereby defining the upper bound of all orders of Renyi divergence as the zCDP loss variable. Compared with the original DP auditing method, zCDP can more accurately track the combined privacy loss of multiple (such as ) differential privacy mechanisms, thereby reducing the noise scale from ) to ), where is the total number of training steps.

[0089] The inventors found that although the above zCDP auditing method greatly reduces the magnitude of the noise scale, they ignore the inherent dynamics of the training process, thus assigning the same noise scale for each training step. In fact, the relevant researchers observed that the model gradient gradually becomes smaller as the training process progresses, and in order to ensure the stable convergence of the model, they proposed a noise decreasing assignment strategy based on zCDP. Specifically, some researchers proposed to adaptively reduce the noise scale based on the local loss, and they believed that if the local loss of the noisy local model obtained after one local training step is higher than the local loss of the model before training, it means that the noise scale is too large, so they use a factor less than 1 to reduce the noise scale until the local loss after training is lower than the local loss before training.

[0090] However, the above-mentioned adaptive noise scale assignment strategies are designed for centralized machine learning and face various limitations in federated learning. First, their algorithm performance is sensitive to the setting of hyperparameters. Too large initial noise scale or too fast noise scale decay rate can prevent the model from learning any knowledge in the early stage of training. Therefore, these algorithms usually need to grid search the optimal hyperparameter setting to achieve the highest model accuracy, which is not allowed in federated learning because the search process requires the client and server to interact with the gradient, which consumes the privacy budget. Second, these algorithms all use the zCDP auditing method to track the combined privacy loss of multiple training steps. However, small batch local training is a common setting in federated learning, and in this scenario, zCDP cannot reduce the noise scale according to the batch sampling rate. Most importantly, these algorithms are essentially heuristic algorithms because their design is not based on theoretical analysis, so they cannot guarantee the reasonableness of noise assignment and the optimality of model performance.

[0091] We illustrate why the existing noise scale decreasing assignment strategies violate the theory of key learning stages in the training process through an experiment. Specifically, we perform DPFL training on the MNIST dataset and divide the training process into four stages (i.e. 、 、 and ) on average. We set the noise scale of one of the stages to be twice the noise scale of the other three stages in turn, and then record the accuracy of the global model aggregated in each round of global iteration on the test set, as shown in Figure 1 . From Figure 1It can be seen that when the noise scale of the first stage of training is twice that of the remaining two (black line), the model improves performance in this stage much slower than the other three cases. And from the performance of the final global model, the performance loss caused by the first stage cannot be compensated for in the later small noise scale training. Therefore, these results show that in the early stage of training, the model quickly establishes a strong relationship between the characteristics of the training data and the labels, and this relationship lasts throughout the training process. If the noise is too large in the early stage of training, the model cannot establish an accurate relationship. In this case, even if small noise is used in the later training, the model cannot correct this inaccurate relationship. So the early stage of training is more sensitive to noise scale, and smaller noise scale is beneficial to the model to quickly establish an accurate relationship, thereby improving the performance of the model.

[0092] Inspired by the sensitivity of different training stages to noise scale, in this application, we propose an optimal noise scale incremental allocation strategy, that is, allocate smaller noise scale (i.e. smaller noise) to the early stage of training to promote the model to quickly establish an accurate relationship in the early stage of training, thereby reducing the impact of noise on the final global model while ensuring privacy, that is, improving the accuracy of the model.

[0093] As shown in Figure 2 , the differential privacy federated learning method based on noise scale allocation provided by the embodiments of the present application includes the following steps S201 to S205:

[0094] Step S201, determine the learning rate sequence of each local training step under the total training step, and send the learning rate sequence to the full client; the total training step corresponds to multiple rounds of global iteration, and the learning rate sequence is a decreasing sequence.

[0095] Specifically, the server determines the learning rate sequence of each local training step under the total training step , and sends the learning rate sequence to the full client. The full client refers to all clients participating in differential privacy federated learning. In addition, the server also initializes the global model , and initializes the available client candidate set to , and initializes the index of the local training step . Each client has a private independent data set of size (size ), and sets the privacy budget according to its own privacy requirements ). The total number of training steps corresponds to multiple global iterations, and each global iteration includes multiple local training steps. Each client has an independent data set as a training data set to train the global model. The data type of the training data set is related to the downstream task to which the global model needs to be applied. For example, if the downstream task includes an image recognition task, the training data set can include at least one of image sample data, video sample data, and the like. If the downstream task includes a video-text understanding task, the training data set can include multi-modal data such as video sample data and text sample data.

[0096] Suppose the total number of training steps is T, and the client performs local training steps in each global iteration. Among them, is the number of training periods, is the mini-batch sampling rate, so one training period contains local training steps to traverse the entire data set. Accordingly, the learning rate sequence is set. The learning rate sequence is a decreasing sequence, that is, as the number of local training steps increases, the learning rate gradually decreases.

[0097] Step S202, for each global iteration, determine the target client participating in the current global iteration from the full set of clients, and send the current global model to the target client.

[0098] Specifically, before the start of each global iteration (i.e. ), the server randomly selects K clients from the available client candidate set as target clients participating in the current global iteration, denoted as . Then, the server can distribute the current global model to the selected target clients, and record the current training step index .

[0099] Step S203, obtaining a total noise scale sequence of the target client under the total training steps, and assigning a noise scale sub-sequence to the target client for multiple local training steps in the current global iteration based on the total noise scale sequence, and sending the noise scale sub-sequence to the target client; the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client.

[0100] Specifically, the server obtains a total noise scale sequence of the target client under the total training steps , and then determines a noise scale sub-sequence corresponding to the current global iteration from the total noise scale sequence according to an arrangement order of the multiple local training steps in the current global iteration among the total training steps, that is, assigns the noise scale sub-sequence to the target client for the multiple local training steps in the current global iteration. Then, the server sends the noise scale sub-sequence to the target client, so that the target client performs gradient noise disturbance based on each noise scale in the noise scale sub-sequence, and ensures the data privacy of the target client.

[0101] In the embodiment, the total noise scale sequence is an increasing sequence, that is, the noise scale of each local training step in the total noise scale sequence increases with the increase of the local training step. That is, a smaller noise scale is used in the early training stage, and a larger noise scale is used in the later training stage. The total noise scale sequence is determined under the constraint of the total privacy budget of the target client.

[0102] In order to determine the optimal noise scale increasing allocation strategy, an improved DPFL framework is proposed, which is different from the traditional DPFL framework in which the same noise scale is set for each local training step of the client in each iteration. In the improved DPFL framework, the noise scale of each training step of the client is a variable.

[0103] In addition, considering that the aforementioned zCDP auditing method cannot reduce the noise scale according to the batch sampling rate, and cannot be applied to differential privacy federated learning with small batch local training, the RDP auditing method is used instead of the original DP auditing method and the zCDP auditing method to track the cumulative privacy consumption in the training process. Unlike the zCDP auditing method, in the RDP auditing method, if the upper bound of each order RDP divergence is defined as an RDP loss variable, since the tail of the distribution of the RDP loss variable satisfies the sub-exponential distribution, the privacy loss can be further relaxed under subsampling, that is, the noise scale is only ) to achieve a given privacy protection level, where is the batch sampling probability, is the total training step.

[0104] In order to facilitate understanding, the following introduces the related knowledge of the differential privacy mechanism involved in the present application.

[0105] Since the privacy loss variables of RDP and original DP can be defined by RDP divergence, first, the RDP divergence is introduced here:

[0106] Definition 1. (RDP divergence). For any two distributions and , given the order , the corresponding RDP divergence is defined as:

[0107] (1)

[0108] According to the definition, the Rényi divergence describes the difference between two distributions and The Rényi divergence is the expectation of the difference in probability of the same value , so it can be used to represent the difference in probability that a differentially private algorithm produces the same result on adjacent datasets (at most one sample difference), i.e., the privacy loss variable. The smaller the Rényi divergence, the closer the probability of producing the same result on adjacent datasets, and it is more difficult to distinguish from which dataset the output comes from, i.e., the privacy loss is small. Next, we introduce DP and RDP in turn from the perspective of Rényi divergence.

[0109] Suppose and are a pair of adjacent datasets, i.e. and have at most one sample difference, denoted as . Let be a differentially private algorithm, then and represent the outputs of on and respectively. Since the output of a differentially private algorithm is a distribution, let and represent the probability that the algorithm outputs on and respectively. Based on this, the definition of DP is as follows:

[0110] Definition 2. ((ε)-DP). When , the algorithm satisfies ((ε)-DP.

[0111] where is the DP privacy loss variable, is the DP privacy budget, is the maximum probability that the DP loss variable exceeds the DP privacy budget. From this definition, it can be seen that is smaller or is smaller, which means that the algorithm is more likely to produce the same output on adjacent datasets, which means that the privacy protection effect is better.

[0112] ​​In this paper, we use Gaussian mechanism (GM) to achieve differential privacy. GM perturbs the gradient by generating Gaussian random noise to achieve privacy protection. Since the noise adding process is irreversible, an attacker cannot recover the original gradient from the noisy gradient to conduct effective gradient inversion attack or membership inference attack. We describe each local training step as a d-dimensional gradient query on the local dataset, denoted as where denotes the model parameters before training, denotes the local dataset. GM generates Gaussian random noise to perturb , i.e., the output is where is a d-dimensional identity matrix, is the noise scale, is the L2-sensitivity of the gradient . Since different auditing methods have different definitions of loss variable, the noise scale they require is also different.

[0113] Theorem 1. (Gaussian noise scale under DP privacy auditing). When using DP auditing method and the noise scale satisfies and , the Gaussian mechanism satisfies ( )-DP.

[0114] Theorem 1 can guarantee that each local training step achieves ( )-DP. If local training steps are required, the cumulative privacy consumption should be calculated according to Theorem 2.

[0115] Theorem 2. (Composition theorem of DP). Let each local training step, satisfy ( )-DP, then satisfies ( )-DP.

[0116] Both Theorem 1 and Theorem 2 assume that the entire dataset is used for training in each local training step. However, in FL, only a small batch of data is usually selected to calculate the stochastic gradient, so in this case the actual privacy consumption should be calculated according to Theorem 3.

[0117] Theorem 3. (DP of subsampling). Suppose the differential privacy algorithm satisfies ( )-DP on the entire dataset, and denotes the sampling rate of the mini-batch, then satisfies ( )-DP on the subsampled dataset, where and .

[0118] However, since DP requires that the Rayleigh divergence have a constant upper bound at orders of infinity, this is an overly strict constraint, and therefore its combinatorial theorem (Theorem 2) amplifies the privacy overhead during training. To more accurately track the cumulative privacy overhead during training, RDP only requires that the upper bound of the Rayleigh divergence at each order be describable by the corresponding order. Similar to DP, we will introduce the definition and related theorems of RDP as follows.

[0119] Definition 2. (( -RDP). Given order Below, when the corresponding Rayleigh divergence satisfies Then the algorithm satisfy( )-RDP.

[0120] in, For RDP privacy loss variables, For RDP privacy budget and It is about The function is denoted by . According to the Rayleigh divergence, the following transformation relationship exists between RDP and DP.

[0121] Lemma 1. (Transformation relationship between RDP and DP). Satisfying ( The randomization algorithm of )-RDP also satisfies ( )-DP, where .

[0122] Through this transformation relationship, the optimal privacy budget for RDP can be found. This is transformed into a minimum DP privacy budget. Similarly, we introduce the Gaussian noise scaling, combination theorem, and subsampling theorem of RDP in turn.

[0123] Theorem 4. (Gaussian Noise Scale under RDP Privacy Audit). When using the RDP auditing method and noise scale... satisfy At that time, the Gaussian mechanism satisfies ( )-RDP.

[0124] Theorem 5. (Combinatorial Theorem of RDP). Let each local training step... respectively satisfy ( )-RDP, then satisfy( )-RDP.

[0125] Theorem 6. (RDP for Subsampling). Assuming a differential privacy algorithm... Satisfy on the entire dataset ( )-RDP, and denotes the mini-batch sampling rate, then satisfies )-RDP, where .

[0126] Theorem 7. (Relationship between Gaussian noise scale and subsampling RDP). Assume that the Gaussian noise scale is , the mini-batch sampling rate is , and the order is , then the RDP privacy budget of the Gaussian mechanism is

[0127]

[0128] where and .

[0129] In this application, in order to explore the influence of the Gaussian noise scale allocation strategy under the RDP privacy audit on the performance of the DPFL model, we analyze the convergence of the above-mentioned DPFL framework. Referring to the related theoretical analysis work, we analyze the upper bound of the variance of the Gaussian noise to quantify the influence of the noise scale allocation strategy on the convergence rate, and then obtain the total noise scale sequence of the target client under the total training step.

[0130] In some embodiments, as shown in Figure 3 , the obtaining the total noise scale sequence of the target client under the total training step comprises:

[0131] Step S301, determining the upper bound of the noise variance of the Gaussian mechanism used by the target client at the local training step.

[0132] Specifically, let denote the L2 norm upper bound of the original gradient of a single data sample, then the L2-sensitivity of the gradient is , so the Gaussian noise used by the target client at the i-th local training step has an upper bound of the noise variance of . .

[0133] Step S302, determining the sample distribution degree of the target client according to the difference between the local model gradient of the target client and the global model gradient.

[0134] ​Specifically, the sample distribution among clients in federated learning is usually Non-Identical and Independently Distributed (Non-IID). In this application, we define the difference between local gradient and global gradient to represent the Non-IID degree of the sample distribution of the client. Based on this, we further define the upper bound of its expectation as .

[0135] Step S303, based on the noise variance upper bound and the sample distribution degree, deduce the model convergence upper bound under the total training step number.

[0136] Specifically, similar to the related convergence analysis work, we also make some general assumptions about the trained model. We assume that the loss function of all clients satisfies L-smooth and Lipschitz continuity, and the upper bound of the variance of the stochastic gradient and the true gradient of a single sample is represented as .

[0137] Based on the calculation of the above noise variance upper bound, the definition of the sample distribution Non-IID degree and the related assumptions of various models, and based on the set learning rate , where , we can deduce the convergence result of the above improved DPFL framework after local training steps as follows:

[0138]

[0139]

[0140] where, , . is a model sampled from all global model sequences with probability . In addition, is the global loss value calculated on the initial global model, and is the minimum global loss value.

[0141] Step S304, using the RDP mechanism, quantifying the first cumulative privacy budget consumed by the noise scale of each target client under the total training step number.

[0142] Specifically, since in the actual system, only target clients participate in training at each local training step, which means that the participation probability of each client at each training step is s. Therefore, according to the above theorem 7, the entire global training process In the middle, each target client The expected value of the first cumulative privacy budget consumed can be expressed as:

[0143]

[0144] in, Noise scale sequence The optimal Rayleigh order to achieve the minimum DP privacy budget.

[0145] Step S305: Based on the first cumulative privacy budget and the total privacy budget of each target client, determine the target constraint conditions for the total noise scale sequence of the target client.

[0146] Specifically, based on the relationship between the first cumulative privacy budget and the total privacy budget of each target client, a target constraint condition for the total noise scale sequence of the target client is determined. Under this target constraint condition, the sum of the cumulative privacy budget consumed by the noise scale of all local training steps of the client can be equal to the total privacy budget.

[0147] In some embodiments, determining the target constraint condition for the total noise scale sequence of the target client based on the first cumulative privacy budget and the total privacy budget of each target client includes:

[0148] Obtain the conversion relationship between Ruili differential privacy mechanism and differential privacy mechanism, and based on the conversion relationship, convert the first cumulative privacy budget into the second cumulative privacy budget under differential privacy mechanism;

[0149] Based on the second cumulative privacy budget and the total privacy budget of each target client, the target constraints of the total noise scale sequence of the target client are determined.

[0150] Specifically, considering that the noise scale is also constrained by the client's total privacy budget, based on the conversion relationship between the Ruili differential privacy mechanism RDP and the differential privacy mechanism DP (i.e., Lemma 1 above), the first cumulative privacy budget is converted into the second cumulative privacy budget under the differential privacy mechanism, that is, the RDP privacy budget is converted into a given... The minimum DP privacy budget is then determined. This is followed by consideration of the target client. Total privacy budget under differential privacy mechanism ( The target constraint is defined by the total noise scale sequence of the target client, along with the second cumulative privacy budget. Generally, the sum of the cumulative privacy budgets consumed by the noise scales of all local training steps on the client, equaling the total privacy budget, can be used as the target constraint, i.e., the determined noise scale sequence. The following constraints must be met:

[0151]

[0152] wherein, is the participation probability of the client at each training step, is the sampling rate.

[0153] Step S306, under the target constraint condition, the convergence upper bound of the global model corresponding to the server is minimized, and the total noise scale sequence of the target client at the total training step is calculated.

[0154] Specifically, under the target constraint condition, the convergence upper bound of the global model corresponding to the server is minimized by adjusting the noise scale of each local training step, and the total noise scale sequence of the target client at the total training step is solved.

[0155] In some embodiments, the total noise scale sequence of the target client at the total training step is calculated by minimizing the convergence upper bound of the global model corresponding to the server under the target constraint condition, comprising:

[0156] Based on the convergence upper bound of the global model corresponding to the server, the total noise upper bound of the target client is determined; the total noise upper bound is proportional to the learning rate and the noise scale;

[0157] The convergence upper bound of the global model corresponding to the server is minimized, which is converted into minimizing the total noise upper bound of the target client;

[0158] The total noise scale sequence of the target client at the total training step is calculated by minimizing the total noise upper bound under the target constraint condition.

[0159] Specifically, the convergence result of the above equation (3) shows the influence of the noise scale on the convergence of the DPFL training model. Through the analysis of the convergence result, we can draw the following three conclusions:

[0160] 1) The first term ( ) and the second term ( ) in the above convergence result are the convergence loss caused by the federated learning training without differential privacy, which is consistent with the convergence upper bound obtained by the previous research work.

[0161] 2) The third term ( ) in the above convergence result is the sum of the noise upper bounds of all target clients. Since each client independently allocates the noise scale of each training step according to its total privacy budget, the noise upper bound of different clients can be optimized independently by the client, i.e. each client only needs to consider optimizing the total noise upper bound , so as to minimize the convergence upper bound.

[0162] 3) Total noise upper bound Existing noise scale decreasing allocation strategies are disclosed, which cannot minimize the convergence error under the decreasing learning rate, so their design is not optimal.

[0163] Thus, combining equations (3) and (5) above, each target client The following optimization problem can be established to adjust the noise scale of each local training step to achieve the minimum convergence error upper bound:

[0164]

[0165]

[0166] where the optimization objective function is . Since the Hessian matrix of is positive definite, the is a convex function about .

[0167] However, the constraint condition of problem is not an affine function, so problem is a non-convex optimization problem, which can be solved by existing IPOPT (a nonlinear optimization solver) optimization algorithm. According to the properties of the objective function and the constraint condition, it can be concluded that when the learning rate is decreasing, the optimal noise scale allocation strategy should be increasing, which is consistent with the previous motivation experiment conclusion, that is, smaller noise scales, i.e. smaller noise, should be allocated in the early stage of training.

[0168] However, the time complexity of directly solving problem in practical application scenarios is very high, mainly for two reasons. On the one hand, the optimal RDP order depends on the noise scale sequence , which means is a complex function about . Therefore, it takes a long time to calculate the derivative of this constraint about during optimization. On the other hand, the time complexity of solving problem presents an exponential growth with the increase of the number of optimization variables . In addition, in the actual training process, complex models usually require thousands (or even more) of training steps to ensure that the model achieves good performance or reaches convergence. In order to improve the solving efficiency of problem , we propose the DPFL-STNS (DPFL with Smart Tuning of Noise Scale) algorithm.

[0169] First, DPFL-STNS finds an optimal RDP order that is approximate and independent of the sequence of noise scales under a given total privacy budget and total number of training steps to simplify the problem with the constraint condition.

[0170] In some embodiments, the determining the target constraint condition of the total noise scale sequence of the target clients based on the second cumulative privacy budget being equal to the total privacy budget of each of the target clients comprises:

[0171] Setting the second cumulative privacy budget being equal to the total privacy budget of each of the target clients as a theoretical constraint condition of the total noise scale sequence of the target clients;

[0172] Obtaining a target optimal order parameter value determined based on a noise scale average allocation algorithm;

[0173] Replacing the optimal order parameter in the theoretical constraint condition with the target optimal order parameter value to obtain the target constraint condition of the total noise scale sequence of the target clients.

[0174] Specifically, the second cumulative privacy budget is set to be equal to the total privacy budget of each of the target clients as a theoretical constraint condition of the total noise scale sequence of the target clients, that is, the above equation (5) is taken as the theoretical constraint condition. Then, a target optimal order parameter value determined based on a noise scale average allocation algorithm is obtained, and the target optimal order parameter value is used to replace the optimal order parameter in the theoretical constraint condition as the target constraint condition of the total noise scale sequence of the target clients.

[0175] In practical applications, existing research results show that when the noise scale fluctuates within a small range, the corresponding optimal RDP order changes very little. Referring to the existing noise scale average allocation algorithm based on RDP (i.e., DP-SGD), the problem The optimal noise scale allocation strategy obtained by solving the problem can be adjusted within a small range of average noise scale. Therefore, the DPFL-STNS can use the optimal RDP order parameter value of the DP-SGD algorithm to approximate the problem The experimental results show that the optimal noise scale allocation strategy obtained by using the approximate value for training has an actual optimal RDP order equal to the optimal RDP order of the DP-SGD for more than 95% of the clients, which proves the effectiveness of the approximation process.

[0176] In some embodiments, the calculating the total noise scale sequence of the target clients under the total number of training steps under the target constraint condition comprises: ​

[0177] converts the total noise upper bound to a first noise upper bound for the noise scale of each global iteration, and converts the target constraint condition to a first constraint condition for each global iteration;

[0178] minimizing the first noise upper bound under the first constraint condition, to obtain an optimal RDP privacy budget of the target client in each global iteration;

[0179] converts the total noise upper bound to a second noise upper bound for the noise scale of each local training step in each global iteration;

[0180] minimizing the second noise upper bound under the constraint of the optimal RDP privacy budget, to obtain a total noise scale sequence of the target client under the total number of training steps.

[0181] Specifically, DPFL-STNS proposes a two-stage method to reduce the number of optimization variables, so that the problem can be solved efficiently in complex training tasks (large number of training steps).

[0182] In the first stage, it is assumed that the noise scales allocated to training steps in each global iteration are the same, that is, satisfy . That is, ignoring the different noise scales allocated to multiple local training steps in each global iteration, the total noise upper bound is converted to a first noise upper bound for the noise scale of each global iteration, and the target constraint condition is converted to a first constraint condition for each global iteration, and the problem is defined as minimizing the first noise upper bound under the first constraint condition. Then the problem can be converted to:

[0183]

[0184]

[0185] By solving the problem , the optimal RDP privacy budget of each global iteration can be obtained, where is the optimal solution of the problem .

[0186] On this basis, in the second stage, the total noise upper bound is converted to a second noise upper bound for the noise scale of each local training step in each global iteration. The problem to minimize the second noise upper bound under the constraint of optimal RDP privacy budget. Under the constraint of optimal RDP privacy budget , the noise scale of each local training step is optimized , i.e., solving the following problem :

[0187]

[0188]

[0189] By the above two-stage method, the problem with optimization variables is solved , which can be decomposed into solving a problem with optimization variables and solving a problem with optimization variables times , which greatly reduces the time complexity required in the solving process. The optimal noise scale allocation strategy calculated based on this method can be used to generate corresponding random noise for a given local training step when the target client is selected to participate in training, and to update the current privacy consumption of the client in real time according to Lemma 1 and Theorem 7.

[0190] Step S204, by the target client, performing a plurality of local training steps in the current global iteration based on the learning rate sequence and the mini-batch stochastic gradient descent algorithm, and respectively adding noise to the model gradient obtained in each local training step according to the noise scale sub-sequence to obtain a cumulative noisy gradient.

[0191] Specifically, for each global iteration, the selected target client updates the local model after receiving the global model, i.e., . Then, the target client performs local training steps locally. In each training step , the target client randomly samples data samples, denoted as , performs a mini-batch stochastic gradient descent algorithm to obtain the total gradient of the batch . Then, the target client n generates Gaussian noise to disturb and average the model gradient, i.e., . Based on this gradient, the local model is updated, i.e., . After local training steps, the cumulative noisy gradient is uploaded to the server. At the same time, the target client According to equation (2), the consumed RDP privacy budget of the target client is Then, the optimal order is found by using Lemma 1 above * to transform the RDP privacy budget into the minimum DP privacy budget under the given If , it means that the privacy budget of the target client has been used up, and the server will remove the client from the candidate set , that is, the target client no longer participates in global training.

[0192] Step S205, obtaining the cumulative noisy gradient uploaded by the target client, and updating the current global model based on the aggregated cumulative noisy gradient.

[0193] Specifically, the server obtains the cumulative noisy gradient uploaded by each target client, and aggregates the cumulative noisy gradient collected from the selected target clients in an average manner to obtain the aggregated cumulative noisy gradient. Then, the current global model is updated based on the aggregated cumulative noisy gradient, that is, After that, the server will loop back to step S204 to perform the next round of global iteration until the total training step or other model training conditions are reached.

[0194] In the embodiments of the present application, the total noise scale sequence of the target client under the total training step is obtained in advance, and the noise scale sub-sequence is allocated to the target client for multiple local training steps in the current global iteration based on the total noise scale sequence. Since the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the corresponding global model of the server under the constraint of the total privacy budget of the target client, that is, by using the optimal noise scale increasing allocation strategy, smaller noise scales are allocated in the early training period to enable the model to quickly establish an accurate strong correlation between data features and labels, thereby reducing the impact of noise on the final global model and improving the accuracy of the model. Larger noise scales are allocated in the later training period to ensure that the privacy loss of the target client meets the privacy budget requirements of each client. In addition, since the total noise scale sequence is an increasing sequence, the noise scales of the multiple local training steps in each global iteration are different in the small-batch local training process of each global iteration, which realizes more fine-grained noise scale allocation and is suitable for differential privacy federated learning with small-batch local training. While protecting privacy, the model performance is improved.

[0195] ​In addition, to determine the optimal noise scale increasing allocation strategy, we propose a general DPFL framework, in which the noise scale of each local training step is a variable. Moreover, the clients use mini-batch SGD for local training, and the RDP auditing method is used to track the privacy consumption during training. On this basis, we analyze the convergence upper bound of the DPFL framework under non-convex loss function, which reveals the influence of noise scale on model performance. By taking the noise scale of each training step as an optimization variable, we establish an optimization problem, which aims to optimize the noise scale of each training step to minimize the convergence upper bound under the constraint of total privacy budget. In addition, by proposing the DPFL-STNS algorithm, we efficiently solve the optimization problem to obtain the optimal noise scale allocation strategy. Since our allocation strategy can minimize the theoretically derived convergence error, our algorithm is the optimal noise scale allocation strategy. Specifically, DPFL-STNS greatly reduces the time complexity of solving the original optimization problem through simplifying the constraint condition and a two-stage solving method. Finally, we conduct a large number of experiments on the commonly used public datasets MNIST, FEMNIST and CIFAR-10, and the results show that: compared with the latest noise scale allocation strategy, the noise increasing allocation strategy of the DPFL-STNS algorithm proposed in the application achieves faster convergence speed and higher final model accuracy, for example, it can improve the model accuracy by an average of 2.37%, and DPFL-STNS is more robust and stable in performance under different training system settings.

[0196] As Figure 4 shown, another noise scale allocation based differential privacy federated learning method provided by the embodiments of the application includes the following steps S401 to S404:

[0197] Step S401, obtaining a learning rate sequence of each local training step under a total training step number and a current global model, the total training step number corresponding to multiple global iterations, and the learning rate sequence being a decreasing sequence.

[0198] Step S402, for each global iteration, obtaining a noise scale sub-sequence allocated to multiple local training steps in the global iteration; the noise scale sub-sequence is allocated based on a total noise scale sequence under the total training step number; the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client.

[0199] Step S403, based on the learning rate sequence and the mini-batch stochastic gradient descent algorithm, performing a plurality of local training steps in the current global iteration, and respectively adding noise to the model gradient obtained by each local training step according to the noise scale sub-sequence to obtain a cumulative noisy gradient.

[0200] Step S404, uploading the cumulative noisy gradient to the server, and updating the current global model based on the aggregated cumulative noisy gradient through the server.

[0201] The embodiments of the present application obtain a noise scale sub-sequence for a plurality of local training steps in the current global iteration, which is obtained based on a total noise scale sequence under a total number of training steps. Since the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client, that is, by using an optimal noise scale increasing allocation strategy, smaller noise scales are allocated in the early training stage to enable the model to quickly establish an accurate strong correlation between data features and labels, thereby reducing the impact of noise on the final global model and improving the accuracy of the model. Larger noise scales are allocated in the later training stage to ensure that the privacy loss of the target client meets the privacy budget requirements of the respective clients. In addition, since the total noise scale sequence is an increasing sequence, the noise scales of the plurality of local training steps in each global iteration are different in the mini-batch local training process of each global iteration, which realizes more fine-grained noise scale allocation and is suitable for differential privacy federated learning with mini-batch local training. While protecting privacy, the model performance is improved.

[0202] It should be noted that the specific technical details and beneficial effects of steps S401 to S404 described above are described in detail in the foregoing method embodiments, and will not be repeated here.

[0203] It should be understood that the size of the serial number of each step in the above embodiments does not mean the order of execution, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0204] Corresponding to the differential privacy federated learning method based on noise scale allocation described in the foregoing embodiments, Figure 5 A structure block diagram of a differential privacy federated learning device based on noise scale allocation provided by the embodiments of the present application is shown, and only the parts related to the embodiments of the present application are shown for ease of illustration. Figure 5 The differential privacy federated learning device 500 based on noise scale allocation comprises:

[0205] The determining module 501 is configured to determine a learning rate sequence of each local training step under a total training step number, and send the learning rate sequence to full-quantity clients; the total training step number corresponds to multiple rounds of global iterations, and the learning rate sequence is a decreasing sequence.

[0206] The screening module 502 is configured to determine, for each round of global iteration, target clients participating in the current round of global iteration from the full-quantity clients, and send a current global model to the target clients.

[0207] The noise allocation module 503 is configured to obtain a total noise scale sequence of the target clients under the total training step number, and allocate, based on the total noise scale sequence, a noise scale sub-sequence for multiple local training steps in the current round of global iteration of the target clients, and send the noise scale sub-sequence to the target clients; the total noise scale sequence is an increasing sequence determined by minimizing a convergence upper bound of a global model corresponding to a server under a constraint of a total privacy budget of the target clients.

[0208] The first training module 504 is configured to perform, by the target clients, multiple local training steps in the current round of global iteration based on the learning rate sequence and a mini-batch stochastic gradient descent algorithm, and respectively add noise to model gradients obtained in each local training step according to the noise scale sub-sequence to obtain cumulative noise-added gradients.

[0209] The model updating module 505 is configured to obtain the cumulative noise-added gradients uploaded by the target clients, and update the current global model based on aggregated cumulative noise-added gradients.

[0210] In some embodiments, the noise allocation module 503 is further configured to:

[0211] determine an upper bound of noise variance of a Gaussian mechanism adopted by the target clients in the local training step;

[0212] determine a sample distribution degree of the target clients according to a difference between local model gradients and global model gradients of the target clients;

[0213] deduce a model convergence upper bound under the total training step number based on the upper bound of noise variance and the sample distribution degree;

[0214] quantify, by using a Laplace differential privacy mechanism, a first cumulative privacy budget consumed by noise scales of the target clients respectively under the total training step number;

[0215] determine a target constraint condition of the total noise scale sequence of the target clients based on the first cumulative privacy budget and a total privacy budget of the target clients respectively;

[0216] minimizing a convergence upper bound of the global model corresponding to the server under the target constraint condition, to obtain the total noise scale sequence of the target client under the total training step number.

[0217] In some embodiments, the noise allocation module 503 is further configured to:

[0218] obtain a conversion relationship between the RAPPOR differential privacy mechanism and the differential privacy mechanism, and convert the first cumulative privacy budget into a second cumulative privacy budget under the differential privacy mechanism based on the conversion relationship;

[0219] determine a target constraint condition of the total noise scale sequence of the target client based on the second cumulative privacy budget and the total privacy budget of each target client.

[0220] In some embodiments, the noise allocation module 503 is further configured to:

[0221] set the second cumulative privacy budget to be equal to the total privacy budget of each target client as a theoretical constraint condition of the total noise scale sequence of the target client;

[0222] obtain a target optimal order parameter value determined based on a noise scale average allocation algorithm;

[0223] replace an optimal order parameter in the theoretical constraint condition based on the target optimal order parameter value, to obtain a target constraint condition of the total noise scale sequence of the target client.

[0224] In some embodiments, the noise allocation module 503 is further configured to:

[0225] determine a total noise upper bound of the target client based on a convergence upper bound of the global model corresponding to the server; the total noise upper bound is directly proportional to a learning rate and a noise scale;

[0226] convert minimizing the convergence upper bound of the global model corresponding to the server into minimizing the total noise upper bound of the target client;

[0227] minimize the total noise upper bound under the target constraint condition, to obtain the total noise scale sequence of the target client under the total training step number.

[0228] In some embodiments, the noise allocation module 503 is further configured to:

[0229] convert the total noise upper bound to a first noise upper bound for a noise scale of each global iteration round, and convert the target constraint condition to a first constraint condition for each global iteration round;

[0230] minimize the first noise upper bound under the first constraint condition to calculate an optimal Riel privacy budget of the target client in each global iteration round;

[0231] convert the total noise upper bound to a second noise upper bound for a noise scale of each local training step in each global iteration round;

[0232] minimize the second noise upper bound under the constraint of the optimal Riel privacy budget to obtain a total noise scale sequence of the target client under the total training step number.

[0233] Figure 6 Another structure block diagram of the differential privacy federated learning device based on noise scale allocation provided by the embodiment of the application is shown, and only the part related to the embodiment of the application is shown for the convenience of description. Figure 6 The differential privacy federated learning device 600 based on noise scale allocation includes:

[0234] The first acquisition module 601 is configured to acquire a learning rate sequence of each local training step under a total training step number and a current global model, the total training step number corresponding to multiple global iteration rounds, and the learning rate sequence being a decreasing sequence.

[0235] The second acquisition module 602 is configured to acquire, for each global iteration round, a noise scale sub-sequence allocated to multiple local training steps in the global iteration round; the noise scale sub-sequence is allocated based on a total noise scale sequence under the total training step number; and the total noise scale sequence is an increasing sequence determined by minimizing a convergence upper bound of a global model corresponding to a server under a total privacy budget of a target client.

[0236] The second training module 603 is configured to perform multiple local training steps in the global iteration round based on the learning rate sequence and a mini-batch stochastic gradient descent algorithm, and perform noise adding processing on a model gradient obtained by each local training step according to the noise scale sub-sequence to obtain a cumulative noise-added gradient.

[0237] The transmission module 604 is configured to upload the cumulative noise-added gradient to a server, and update the current global model based on an aggregated cumulative noise-added gradient by the server.

[0238] In applications, each module in the differential privacy federated learning device based on noise scale allocation described above can be a software program module, can be implemented by different logic circuits integrated in a processor, and can also be implemented by multiple distributed processors.

[0239] As shown in Figure 7 the embodiments of the present application also provide an electronic device 700, comprising: at least one processor 701 (only one processor is shown in the Figure 7 memory 702 and a computer program 703 stored in the memory 702 and executable on the at least one processor 701, the processor 701 implements the steps in any method embodiment described above when executing the computer program 703.

[0240] In applications, the electronic device 700 can be a desktop computer, a notebook, a palm computer and a cloud server, etc. The electronic device can include, but is not limited to, a processor, a memory. Those skilled in the art can understand that Figure 7 only an example of the electronic device, and does not constitute a limitation on the electronic device, and can include more or fewer components than shown, or combine certain components, or different components, for example, it can also include a face capture device, an input / output device, a network access device, etc.

[0241] In applications, the processor can be a central processing unit (CPU), and the processor can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0242] In applications, the memory can be an internal storage unit, such as a hard disk or an internal memory, in some embodiments. The memory can also be an external storage device of the bionic robot, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the bionic robot, in other embodiments. Further, the memory can include both the internal storage unit and the external storage device. The memory is used to store an operating system, an application program, a boot loader, data, and other programs, such as program codes of computer programs, etc. The memory can also be used to temporarily store data that has been output or will be output.

[0243] It should be noted that the information interaction, execution process, etc. between the above devices / modules, since based on the same concept as the method embodiments of the present application, the specific functions and the technical effects brought by them can be referred to the method embodiments part, and will not be repeated here.

[0244] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above division of functional modules is taken as an example for illustration, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. Each functional module in the embodiment can be integrated into one processing module, or each module can exist physically, or two or more modules can be integrated into one module. The above integrated module can be realized in the form of hardware or in the form of software functional module. In addition, the specific name of each functional module is only for easy distinction, and does not limit the protection scope of the present application. The specific working process of the modules in the device can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0245] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in each of the above method embodiments can be implemented.

[0246] The embodiment of the present application provides a computer program product, when the computer program product runs on the processor, so that the processor executes the steps in each of the above method embodiments.

[0247] The integrated module, if implemented in the form of a software function module and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. When the processor executes the computer program, the steps of the above-mentioned various method embodiments can be implemented. The computer program includes computer program code, which can be in the form of source code, object code, executable files or some intermediate forms. The computer readable medium at least includes any entity or device capable of carrying the computer program code to the device / bionic robot, a recording medium, a computer memory, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), an electrical carrier signal, a telecommunications signal and a software distribution medium. For example, a U disk, a mobile hard disk, a magnetic disk or an optical disk, etc. In some jurisdictions, according to legislation and patent practice, the computer readable medium can not be an electrical carrier signal and a telecommunications signal.

[0248] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the related description of other embodiments.

[0249] Those of ordinary skill in the art can understand that the modules and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0250] In the embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of modules is only a logical function division. In actual implementation, additional division can be made, for example, a plurality of modules or components can be combined or integrated into another device, or some features can be omitted or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed mutual entities can be indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0251] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, i.e., may be located in one place, or may be distributed to multiple network modules. Part or all of the modules can be selected as needed to achieve the purpose of the embodiment.

[0252] The above embodiments are only used to illustrate the technical solutions of the present application, but not limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent ones; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for differentially private federated learning based on noise scale assignment, the method comprising: The method comprises: determining a learning rate sequence of each local training step under a total training step number, and sending the learning rate sequence to a full quantity client; the total training step number corresponds to multiple rounds of global iterations, and the learning rate sequence is a decreasing sequence; for each round of global iteration, determining a target client participating in the round of global iteration from the full quantity client, and sending a current global model to the target client; obtaining a total noise scale sequence of the target client under the total training step number, and based on the total noise scale sequence, assigning a noise scale sub-sequence to multiple local training steps of the target client in the round of global iteration, and sending the noise scale sub-sequence to the target client; the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client; by the target client, based on the learning rate sequence and the mini-batch stochastic gradient descent algorithm, performing multiple local training steps in the round of global iteration, and respectively adding noise to the model gradient obtained by each local training step according to the noise scale sub-sequence to obtain a cumulative noise gradient; obtaining the cumulative noise gradient uploaded by the target client, and updating the current global model based on the aggregated cumulative noise gradient; wherein, the total noise scale sequence of the target client under the total training step number comprises: determining an upper bound of the noise variance of the Gaussian mechanism adopted by the target client at the local training step; determining the sample distribution degree of the target client according to the difference between the local model gradient and the global model gradient of the target client; based on the noise variance upper bound and the sample distribution degree, deducing the model convergence upper bound under the total training step number; using the RAPPOR differential privacy mechanism, quantifying the first cumulative privacy budget consumed by the noise scale of each target client under the total training step number; obtaining the conversion relationship between the RAPPOR differential privacy mechanism and the differential privacy mechanism, and based on the conversion relationship, converting the first cumulative privacy budget into a second cumulative privacy budget under the differential privacy mechanism; the second cumulative privacy budget is equal to the total privacy budget of each target client, and is set as the theoretical constraint condition of the total noise scale sequence of the target client; obtaining the target optimal order parameter value determined based on the noise scale average allocation algorithm; based on the target optimal order parameter value, replacing the optimal order parameter in the theoretical constraint condition to obtain the target constraint condition of the total noise scale sequence of the target client; under the target constraint condition, minimizing the convergence upper bound of the global model corresponding to the server to calculate the total noise scale sequence of the target client under the total training step number.

2. The noise scale based differential privacy federated learning method of claim 1, wherein, the total noise scale sequence of the target client under the total training step number is calculated by minimizing the convergence upper bound of the global model corresponding to the server under the target constraint condition, comprising: determine a total noise upper bound of the target client based on a convergence upper bound of a global model corresponding to the server; the total noise upper bound is proportional to a learning rate and a noise scale; convert minimizing the convergence upper bound of the global model corresponding to the server into minimizing the total noise upper bound of the target client; minimize the total noise upper bound under the target constraint condition to calculate a total noise scale sequence of the target client under the total training step number.

3. The noise scale based differential privacy federated learning method of claim 2, wherein, The total noise scale sequence of the target client under the total training step number is calculated by minimizing the total noise upper bound under the target constraint condition. The total noise scale sequence of the target client under the total training step number is calculated by minimizing the total noise upper bound under the target constraint condition. Ignore the different noise scales allocated by multiple local training steps in each round of global iteration, convert the total noise upper bound into a first noise upper bound of the noise scale for each round of global iteration, and convert the target constraint condition into a first constraint condition for each round of global iteration; minimize the first noise upper bound under the first constraint condition to calculate the optimal RAPPOR privacy budget of the target client in each round of global iteration; convert the total noise upper bound into a second noise upper bound of the noise scale for multiple local training steps in each round of global iteration; 4. A method for differentially private federated learning based on noise scale allocation, characterized in that, minimize the second noise upper bound under the constraint of the optimal RAPPOR privacy budget to obtain the total noise scale sequence of the target client under the total training step number. The method comprises: obtain a learning rate sequence and a current global model for each local training step under a total training step number, the total training step number corresponding to multiple rounds of global iteration, and the learning rate sequence being a decreasing sequence; for each round of global iteration, obtain a noise scale sub-sequence allocated for multiple local training steps in the round of global iteration; the noise scale sub-sequence is allocated based on a total noise scale sequence under the total training step number; the total noise scale sequence is an increasing sequence determined by minimizing a convergence upper bound of a global model corresponding to the server under the constraint of a total privacy budget of the target client; based on the learning rate sequence and the mini-batch stochastic gradient descent algorithm, perform multiple local training steps in the round of global iteration, and respectively add noise to the model gradient obtained by each local training step according to the noise scale sub-sequence to obtain a cumulative noise gradient; upload the cumulative noise gradient to the server, and update the current global model based on the aggregated cumulative noise gradient by the server; wherein the total noise scale sequence is obtained by: determining an upper bound of the noise variance of the Gaussian mechanism used by the target client at the local training step; determining the degree of sample distribution of the target client according to the difference between the local model gradient and the global model gradient of the target client; based on the noise variance upper bound and the sample distribution degree, deduce the model convergence upper bound under the total training step number; quantify the first cumulative privacy budget consumed by the noise scale of each of the target clients under the total training step number by using the RAPPOR differential privacy mechanism; obtain a conversion relationship between the RAPPOR differential privacy mechanism and the differential privacy mechanism, and convert the first cumulative privacy budget into a second cumulative privacy budget under the differential privacy mechanism based on the conversion relationship; set the second cumulative privacy budget to be equal to a total privacy budget of each of the target clients, and set a theoretical constraint condition of a total noise scale sequence of the target clients; obtain a target optimal order parameter value determined based on a noise scale average allocation algorithm; replace an optimal order parameter in the theoretical constraint condition with the target optimal order parameter value to obtain a target constraint condition of the total noise scale sequence of the target clients; minimize a convergence upper bound of a global model corresponding to the server under the target constraint condition to calculate the total noise scale sequence of the target clients at the total training step number.

5. A differential privacy federated learning device based on noise scale allocation, characterized in that, The device comprises: a determination module configured to determine a learning rate sequence of each local training step at a total training step number and send the learning rate sequence to full-quantity clients; the total training step number corresponds to multiple rounds of global iterations, and the learning rate sequence is a decreasing sequence; a screening module configured to determine, for each round of global iteration, a target client participating in the round of global iteration from the full-quantity clients and send a current global model to the target client; a noise allocation module configured to obtain a total noise scale sequence of the target client at the total training step number, allocate noise scale subsequences for multiple local training steps of the target client in the round of global iteration based on the total noise scale sequence, and send the noise scale subsequences to the target client; the total noise scale sequence is an increasing sequence determined by minimizing a convergence upper bound of a global model corresponding to the server under a constraint of a total privacy budget of the target client; a first training module configured to perform, by the target client, multiple local training steps in the round of global iteration based on the learning rate sequence and a mini-batch stochastic gradient descent algorithm, and respectively add noise to model gradients obtained in each local training step according to the noise scale subsequences to obtain cumulative noise-added gradients; a model updating module configured to obtain the cumulative noise-added gradients uploaded by the target client and update the current global model based on aggregated cumulative noise-added gradients; The noise allocation module is further configured to: determine an upper bound of a noise variance of the target client using a Gaussian mechanism at a local training step; determine a sample distribution degree of the target client according to a difference between a local model gradient and a global model gradient of the target client; deduce a model convergence upper bound at the total training step number based on the upper bound of the noise variance and the sample distribution degree; quantify a first cumulative privacy budget consumed by noise scales of each of the target clients at the total training step number using the RAPPOR differential privacy mechanism; obtain a conversion relationship between the RAPPOR differential privacy mechanism and the differential privacy mechanism, and convert the first cumulative privacy budget into a second cumulative privacy budget under the differential privacy mechanism based on the conversion relationship; The second cumulative privacy budget is equal to the total privacy budget of the target client, and is set as a theoretical constraint condition of the total noise scale sequence of the target client; An optimal order parameter value of the target client is determined based on the noise scale average allocation algorithm; The optimal order parameter in the theoretical constraint condition is replaced by the optimal order parameter value based on the target optimal order parameter value, to obtain a target constraint condition of the total noise scale sequence of the target client; Under the target constraint condition, the convergence upper bound of the global model corresponding to the server is minimized to calculate the total noise scale sequence of the target client under the total training step number.

6. The noise scale distribution based differential privacy federated learning apparatus according to claim 5, characterized in that, The noise allocation module is further configured to: Determine a total noise upper bound of the target client based on the convergence upper bound of the global model corresponding to the server; the total noise upper bound is directly proportional to the learning rate and the noise scale; Convert minimizing the convergence upper bound of the global model corresponding to the server into minimizing the total noise upper bound of the target client; Minimize the total noise upper bound under the target constraint condition to calculate the total noise scale sequence of the target client under the total training step number.

7. The noise scale distribution based differential privacy federated learning apparatus according to claim 5, wherein, The noise allocation module is further configured to: Ignore the different noise scales allocated by the plurality of local training steps in each round of global iteration, to convert the total noise upper bound into a first noise upper bound for the noise scale of each round of global iteration, and convert the target constraint condition into a first constraint condition for each round of global iteration; Minimize the first noise upper bound under the first constraint condition to calculate the optimal RDP budget of the target client in each round of global iteration; Convert the total noise upper bound into a second noise upper bound for the noise scale of the plurality of local training steps in each round of global iteration; Minimize the second noise upper bound under the constraint of the optimal RDP budget to obtain the total noise scale sequence of the target client under the total training step number.

8. A differential privacy federated learning device based on noise scale allocation, characterized in that, The device comprises: A first obtaining module is configured to obtain a learning rate sequence of each local training step and a current global model under a total training step number, the total training step number corresponding to a plurality of rounds of global iteration, and the learning rate sequence being a decreasing sequence; A second obtaining module is configured to, for each round of global iteration, obtain a noise scale sub-sequence allocated in a plurality of local training steps in the round of global iteration; the noise scale sub-sequence is obtained based on a total noise scale sequence under the total training step number; the total noise scale sequence is an increasing sequence determined by minimizing the convergence upper bound of the global model corresponding to the server under the constraint of the total privacy budget of the target client; A second training module is configured to perform the plurality of local training steps in the round of global iteration based on the learning rate sequence and a mini-batch stochastic gradient descent algorithm, and respectively add noise to the model gradient obtained by each local training step according to the noise scale sub-sequence to obtain a cumulative noise gradient; A transmission module is configured to upload the cumulative noise gradient to a server, and update the current global model based on the aggregated cumulative noise gradient by the server; The total noise scale sequence is obtained by the following method: determining a noise variance upper bound of the target client adopting a Gaussian mechanism in a local training step; determining a sample distribution degree of the target client according to a difference between a local model gradient of the target client and a global model gradient; deriving a model convergence upper bound in the total training step based on the noise variance upper bound and the sample distribution degree; quantifying a first cumulative privacy budget consumed by a noise scale of each of the target clients in the total training step by adopting a RAPPOR mechanism; obtaining a conversion relationship between the RAPPOR mechanism and a differential privacy mechanism, and converting the first cumulative privacy budget into a second cumulative privacy budget under the differential privacy mechanism based on the conversion relationship; setting the second cumulative privacy budget as equal to a total privacy budget of each of the target clients as a theoretical constraint condition of a total noise scale sequence of the target client; obtaining a target optimal order parameter value determined based on a noise scale average allocation algorithm; replacing an optimal order parameter in the theoretical constraint condition with the target optimal order parameter value to obtain a target constraint condition of the total noise scale sequence of the target client; minimizing a convergence upper bound of a global model corresponding to the server under the target constraint condition to calculate a total noise scale sequence of the target client in the total training step.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps of the differential privacy federated learning method based on noise scale allocation of any one of claims 1 to 4.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1-9. The computer program is executed by the processor to implement the steps of the differential privacy federated learning method based on noise scale allocation of any one of claims 1 to 4.

Images