A Verifiable Privacy-Preserving Federated Learning Method Based on Sensitive Samples

Abstract

This application discloses a verifiable privacy-preserving federated learning method based on sensitive samples, relating to the field of fault diagnosis. This method introduces a Poisson sampling process, generating sampling probabilities based on a privacy budget to ensure that the privacy budget of all records is exhausted synchronously, effectively preventing catastrophic data forgetting and improving model utility. In the model verification module, a sensitive sample set is generated using the gradient maximization algorithm to detect model integrity attacks. Users only need to submit a small number of sensitive samples for prediction through the inference service API provided by the private cloud client. If the returned results deviate significantly from the actual results, it can be determined that the model may have been tampered with. This application can meet diverse user privacy needs and achieve black-box verification of model integrity, improving model accuracy.

Description

Technical Field

[0001] This application relates to the field of fault diagnosis, and in particular to a verifiable privacy-preserving federated learning method based on sensitive samples. Background Technology

[0002] Equipment condition monitoring is an essential part of industrial production. Existing detection methods are divided into manual and automatic detection. In the automatic detection process, machine learning models are usually used to analyze the equipment condition data to determine the equipment condition. However, training machine learning models requires a large amount of sample data, and the condition data of a single factory often cannot meet the requirements. Due to data confidentiality requirements, it is also impossible to obtain this data from other factories, resulting in insufficient sample data.

[0003] Federated learning has garnered significant attention due to the aforementioned issues. Specifically, it is suitable for multiple institutions to collaboratively train machine learning models in the cloud. Compared to centralized machine learning, this method allows each institution to complete model training locally, uploading only encrypted and differentially privacy-protected model parameters, thus avoiding the privacy risks associated with the centralized transmission of raw datasets.

[0004] More and more enterprises and institutions are choosing to outsource model training tasks to cloud computing platforms, enabling them to participate in large-scale collaborative training without the need for local platform setup. However, cloud outsourcing environments still present serious privacy and security risks. Specifically, cloud servers can snoop on sensitive information during data uploads or model aggregation, and even maliciously tamper with model parameters, returning incorrect training results. Furthermore, existing differential privacy methods typically employ a uniform privacy budget, setting the same protection strength for all client data records. This fails to meet diverse user privacy needs and leads to a significant reduction in model accuracy. In addition, previous cloud server-based federated learning architectures have neglected security threats from malicious clients. Therefore, how to flexibly meet diverse user privacy preferences and perform black-box verification of model integrity are pressing issues that current technology needs to address. Summary of the Invention

[0005] The purpose of this application is to provide a verifiable privacy-preserving federated learning method based on sensitive samples to meet the diverse privacy needs of users, and to achieve black-box verification of model integrity, thereby improving the accuracy of the model.

[0006] To achieve the above objectives, this application provides the following solution.

[0007] Firstly, this application provides a verifiable privacy-preserving federated learning method based on sensitive samples. This method is applied to a federated learning system used for training a fault diagnosis model. The fault diagnosis model is used to predict the state of production equipment based on its state data. The federated learning system includes a central server, a private cloud client, and a user terminal. The verifiable privacy-preserving federated learning method based on sensitive samples includes:

[0008] The central server builds a global model and probability estimator, initializes the parameters of the global model, generates a sensitive sample set, and sends the global model, probability estimator, initial parameters of the global model, and sensitive sample set to the user terminal.

[0009] On the user end, a small batch dataset is generated using Poisson sampling based on the probability estimator, and the global model, the initial parameters of the global model, and the small batch dataset are sent to the private cloud client.

[0010] On the private cloud client, a personalized differential privacy strategy is used to train the global model based on the initial parameters of the global model and a small batch dataset, and the inference service API of the trained model is released after training is completed.

[0011] The user client calls the model inference service API and verifies the integrity of the trained model based on the sensitive sample set. Once the verification is successful, the private cloud client is allowed to send the parameters of the trained model to the central server.

[0012] The central server aggregates the parameters of the trained models sent by each private cloud client to obtain the trained global model.

[0013] Optionally, the probability estimator is generated using a simulated sampling fitting algorithm.

[0014] Optionally, the probability estimator is generated in the following specific manner:

[0015] Generate a set of candidate sampling probabilities and a set of orders of the RDP;

[0016] For each sampling probability q in the sampling probability set, the optimal privacy budget for each sampling probability is obtained by optimizing the solution based on the corresponding order in the order set of RDP.

[0017] An exponential function is fitted to each sampling probability and the corresponding optimal privacy budget to construct a probability estimator.

[0018] Optionally, for each sampling probability q in the sampling probability set, the optimal privacy budget for each sampling probability is obtained by optimizing the solution based on the corresponding order in the order set of RDP:

[0019]

[0020] Where, ε * i,j For the optimal differential privacy budget of the j-th record in the dataset of the i-th user, ρ i,j Let δ be the Ruili differential privacy budget for the j-th record in the i-th user dataset, where δ is the relaxation parameter of differential privacy and α is the order of RDP.

[0021] Optionally, the probability estimator is:

[0022]

[0023] Where q is the sampling probability, ε is the privacy budget, a, b, and c are all fitting parameters, and F(ε) is the probability estimator.

[0024] Optionally, the sensitive sample set is generated as follows:

[0025] Construct the objective function;

[0026] The objective function is solved using the stochastic gradient descent algorithm, and a sensitive sample set is constructed.

[0027] Optionally, the objective function is:

[0028]

[0029] Where v is the objective function, Let be the gradient of the global model's prediction of the sample data x with respect to the parameter W, p and q' be the upper and lower bounds of the sample data x, respectively, m be the dimension of the sample data, which is the total number of elements in the vector x, ∈ be a very small number, and x0 be the original sample data.

[0030] Optionally, the objective function is solved using a stochastic gradient descent algorithm to construct a sensitive sample set, specifically including:

[0031] The initial number of iterations, k, is set to 0.

[0032] Initialize the sample data to the original sample data;

[0033] Using formula Calculate the objective function value σ obtained in the k-th iteration. k ;where x k For the sample data obtained in the k-th iteration, For the global model, the sample data x is solved in the k-th iteration. k The gradient of the prediction result with respect to parameter W;

[0034] The objective function value σ is obtained based on the k-th iteration. k The sample data is updated using the following formula to obtain the sample data for the (k+1)th iteration.

[0035] x k+1 =x k +ε·Δ k ;

[0036]

[0037] Where, x k+1 For the sample data obtained in the (k+1)th iteration, Δ k Here, ε represents the update parameters for the sample data obtained in the k-th iteration, ε is the learning rate, and Δ is the learning parameter. k-1 The update parameters for the sample data obtained in the (k-1)th iteration are... The gradient of the objective function value with respect to the sample data is obtained in the k-th iteration.

[0038] Determine whether the sample data obtained in the (k+1)th iteration satisfies the following formula to obtain the first judgment result;

[0039]

[0040] Where p and q are the upper and lower limits of the values ​​of the sample data x, respectively, m is the dimension of the sample data, ∈ is a very small number, and x0 is the original sample data;

[0041] If the first judgment result is negative, then the sample data solved in the (k+1)th iteration is corrected (the correction method is to satisfy the above requirements, for example, when it exceeds q, it is set to q, and when it is less than p, it is set to p), and the step of judging whether the sample data solved in the (k+1)th iteration satisfies the following formula is returned to obtain the first judgment result.

[0042] If the first judgment result is yes, then the value of i is increased by 1, and the formula k≤E is judged to obtain the second judgment result; where E is the threshold for the number of iterations.

[0043] If the second judgment result is yes, then return to using the formula. Calculate the objective function value σ obtained in the k-th iteration. k Steps;

[0044] If the second judgment result is negative, then output {x}. k ,f(W,x k)} as sensitive samples.

[0045] Optionally, in generating a mini-batch dataset based on the probability estimator using Poisson sampling, the user terminal is specifically used for:

[0046] Based on the privacy budget for each data record on the client side, a probability estimator is used to calculate the sampling probability for each data record;

[0047] Based on the sampling probability of each data point, Poisson sampling is used to sample each data record on the client to obtain a small batch dataset.

[0048] Optionally, the parameters of the trained model sent by each private cloud client are aggregated to obtain the formula for the trained global model:

[0049]

[0050] Among them, W t and W t+1 These are the parameters of the global model for global aggregation in round t and round t+1, respectively. Let C be the parameter change of private cloud client c during the t-th round of global aggregation training. t Let n be the set of private cloud clients participating in the t-th round of global aggregation training. c Let n be the number of samples in a small batch of data for private cloud client c. c' The number of samples in the mini-batch dataset of the private cloud client c'.

[0051] According to the specific embodiments provided in this application, this application has the following technical effects.

[0052] This application provides a verifiable privacy-preserving federated learning method based on sensitive samples. This method introduces a Poisson sampling process, generating sampling probabilities based on a privacy budget to ensure that the privacy budget for all records is exhausted synchronously, effectively preventing catastrophic data forgetting and improving model utility. In the model validation module, a sensitive sample set is generated using the gradient maximization algorithm to detect model integrity attacks. Users only need to submit a small number of sensitive samples for prediction through the inference service API provided by the private cloud client. If the returned results deviate significantly from the actual results, it can be determined that the model may have been tampered with. This application can meet diverse user privacy needs and achieve black-box verification of model integrity, improving model accuracy.

[0053] Specifically, this application introduces a personalized differential privacy mechanism and a sensitive sample detection technology. The personalized differential privacy mechanism allocates differentiated privacy budgets based on the sensitivity of different data records, and combines this with a Poisson sampling strategy to ensure that the privacy budgets of each record are exhausted synchronously. This significantly improves model accuracy and training engagement while meeting diverse privacy needs. The sensitive sample detection technology generates sensitive samples highly correlated with the target model parameters by a central server. Users can verify the integrity of the deployed model in a black-box environment through a cloud inference API, thereby effectively detecting and defending against attacks such as model compression, simplification, or tampering without exposing the model's internal structure. This solution ensures data security and model trustworthiness while having low additional computational overhead. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A framework diagram of a federated learning system provided in an embodiment of this application.

[0056] Figure 2 This is a diagram of the MLaaS framework provided in an embodiment of this application.

[0057] Figure 3 This is a flowchart illustrating a verifiable privacy-preserving federated learning method based on sensitive samples, provided as an embodiment of this application.

[0058] Figure 4 This is a schematic diagram of a verifiable privacy-preserving federated learning method based on sensitive samples, provided as an embodiment of this application.

[0059] Figure 5 The graph shows the RDP and DP budgets as a function of order under different sampling probabilities, as provided in an embodiment of this application.

[0060] Figure 6 The graph shows the fitting effect of the exponential function between the downsampling probability with different parameters and the privacy budget in one embodiment of this application.

[0061] Figure 7 This is a schematic diagram of a model integrity verification process provided in an embodiment of this application.

[0062] Figure 8 This is a schematic diagram illustrating the model integrity verification process for a sensitive sample provided in an embodiment of this application.

[0063] Figure 9 This is a schematic diagram illustrating the change in sensitivity with iteration rounds, provided as an embodiment of this application.

[0064] Figure 10 This is a schematic diagram illustrating the change in signal-to-noise ratio with iteration rounds, provided in an embodiment of this application. Detailed Implementation

[0065] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0066] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0067] like Figure 1 As shown, in the privacy-preserving federated learning system based on personalized differential privacy proposed in this application, each data provider has autonomy and can independently choose personalized privacy preferences for their respective records. The goal is to train a global model that satisfies both record-level personalized differential privacy and high accuracy. The system's central server, users (referring to the user end), and private cloud clients form a three-layer architecture of "central coordination - user participation - cloud execution," as detailed below:

[0068] Central Server: The central server is responsible for global model aggregation, collecting model updates uploaded by various private cloud clients, performing aggregation operations, and generating and distributing new global model parameters.

[0069] Users: Users are organizations or enterprises responsible for providing the original dataset and specifying a personalized privacy budget for each record in the dataset.

[0070] Private cloud clients: Private cloud clients provide users with Machine Learning as a Service (MLaaS) services, such as... Figure 2 As shown, this provides a model training environment based on user needs. Multiple rounds of local model training are performed, and finally, the updated model parameters are uploaded to the central server.

[0071] This application's embodiments assume that after the training task is completed, users can make predictions through the inference service API provided by the private cloud client, but cannot view or download the complete model details. The central server is a semi-honest party; although it faithfully aggregates the model update parameters from each client, it may infer sensitive user information by analyzing the model parameters. Similarly, users are also considered semi-honest parties and may use the global model obtained in each round to launch inference attacks, thereby obtaining sensitive information of other users. The private cloud client is the malicious party, using simplified, compressed, or tampered models to reduce deployment and maintenance costs.

[0072] Based on the above model assumptions, the embodiments of this application need to address the following security threats:

[0073] Gradient leakage: If the gradient is not perturbed, a semi-honest central server can reconstruct the original input features through a gradient inversion attack, thereby exposing sensitive user data.

[0074] Member inference attack: If the global model lacks privacy protection mechanisms, semi-honest users may infer the existence of certain specific samples or sensitive attributes by querying the prediction behavior of the global model on different datasets, thereby infringing on the privacy of other users.

[0075] Model integrity attacks: In cloud-hosted environments, the lack of effective mechanisms to verify model integrity may provide private cloud clients with opportunities to tamper with, compress, or use low-quality models.

[0076] Traditional cloud server-based federated learning architectures have overlooked security threats from malicious private cloud clients. However, in real-world scenarios, outsourced environments are often complex, dynamic, and prone to security issues.

[0077] Based on this, this application proposes a verifiable privacy-preserving federated learning method based on sensitive samples (OVeriFL), and designs an efficient model integrity verification mechanism. Users only need to submit a small number of sensitive samples through the inference API of a private cloud client to verify the model's integrity, thereby effectively reducing the possibility that cloud service providers may compromise model integrity in pursuit of cost or profit. Simultaneously, to balance privacy protection and model performance, gradient perturbation is introduced during training, combined with personalized differential privacy and Poisson sampling strategies. This not only alleviates the "catastrophic forgetting" problem but also significantly improves the accuracy of the global model. The technical method provided in this application should achieve the following objectives:

[0078] Personalized privacy protection: This application combines personalized differential privacy with a Poisson sampling strategy. The personalized differential privacy mechanism is used for privacy protection during model training, while the Poisson sampling strategy ensures that the privacy budget of all records is exhausted synchronously, preventing low privacy budget records from being forgotten by the model in advance during training. The combination of the two will improve the effectiveness of the model.

[0079] Model integrity is verifiable: The model integrity verification module in this application embodiment only requires the user to submit a small number of sensitive samples. It can detect whether the model has been tampered with when deployed in a private cloud by using the cloud inference API, thereby reducing detection costs and enhancing protection against malicious behavior.

[0080] In an exemplary embodiment, this application provides a verifiable privacy-preserving federated learning method based on sensitive samples. This method is applied to a federated learning system used to train a fault diagnosis model. The fault diagnosis model is used to predict the state of production equipment based on its state data. The federated learning system includes a central server, a private cloud client, and a user terminal, such as... Figure 3 As shown, the verifiable privacy-preserving federated learning method based on sensitive samples includes:

[0081] Step 101: Build a global model and probability estimator on the central server, initialize the parameters of the global model, generate a sensitive sample set, and send the global model, probability estimator, initial parameters of the global model, and sensitive sample set to the user terminal.

[0082] Step 102: On the user end, a small batch dataset is generated using Poisson sampling based on the probability estimator, and the global model, the initial parameters of the global model, and the small batch dataset are sent to the private cloud client.

[0083] Step 103: On the private cloud client, based on the initial parameters of the global model and a small batch dataset, a personalized differential privacy strategy is used to train the global model, and after training, the inference service API of the trained model is released.

[0084] Step 104: The user client calls the model inference service API and verifies the integrity of the trained model based on the sensitive sample set. If the verification is successful, the private cloud client is allowed to send the parameters of the trained model to the central server.

[0085] Step 105: The central server aggregates the parameters of the trained models sent by each private cloud client to obtain the trained global model.

[0086] In another exemplary embodiment, the aforementioned status data may be data detected by sensors on the production equipment, image information of the production equipment, or both. When it is sensor data, the operating status (operating speed, operating stability, etc.) of the production equipment can be predicted. When it is image information, structural faults (e.g., cracks, component detachment, loose connections, etc.) of the production equipment can be predicted.

[0087] In another exemplary embodiment, the aforementioned production equipment can be a CNC machine tool or other machining equipment, or a freeze dryer, a fully automatic filling line, or other biopharmaceutical production equipment. This application does not impose any limitations on these equipment. The federated learning method of this application can be used for fault diagnosis of any production equipment. It is only necessary to set different training sample data for different production equipment and select the corresponding machine learning model.

[0088] In another exemplary embodiment, the specific implementation process of the above-described verifiable privacy-preserving federated learning method based on sensitive samples is as follows: Figure 4 As shown, the details are as follows.

[0089] Phase 1: Initialization: The central server builds a suitable global model architecture based on the task, initializes the global model parameters W0 using common data, creates a sampling probability estimation function F(ε) using the SCF algorithm, and generates a sensitive sample set S using the gradient maximization algorithm. ver Distribute W0, F(ε) and S ver This applies to all participating users, corresponding to step 101 above.

[0090] Phase 2: Record-level Poisson sampling: User C i Using Privacy Budget ε i,j (Privacy budget is a hyperparameter, ranging from 0 to 10, pre-specified by the data provider, used to define the level of protection for that data; a smaller privacy budget indicates a higher level of protection.) Calculate the sampling probability q for each record. i,j =F(ε) i,j Then, Poisson sampling is performed to generate a mini-batch dataset B. t This serves as the training set for this round, corresponding to step 102 above.

[0091] Phase 3: Private Cloud Client Training: The private cloud client performs r-step stochastic gradient descent (corresponding to step 103 above), for each record b∈B t gradient Updates follow L2 norm pruning:

[0092]

[0093] in, Let be the gradient of record b in the r-th iteration of the t-th round of global aggregation. Let L be the change in the loss function, and L be the value of the loss function. For the parameters of the model of the private cloud client c in the r-th iteration of the t-th round of global aggregation.

[0094] Add Gaussian noise to the gradient:

[0095]

[0096] in, For the gradient after adding noise in the r-th iteration, N(0,σ) 2 () represents Gaussian noise.

[0097] Update the model parameters and calculate the parameter changes for this round (upload to the central server):

[0098]

[0099] in, Let η be the parameters of the model of the private cloud client c in the (r+1)th iteration of the t-th round of global aggregation, where η is the parameter update coefficient, t represents the current round of global aggregation, and r represents the number of iterations of local model training performed by the client in that round. For example, The table shows the parameter changes of the private cloud client c after the r-th iteration in round t.

[0100] Phase 4: Model Integrity Validation: Users deploy the global model and submit training set B t Training can begin on the private cloud client. After training, the inference service API will be available, allowing you to verify the model's integrity. This involves calling the model inference service API; if the model accurately predicts all sensitive samples S... ver If the client environment is trustworthy, it indicates that the client environment is trustworthy; otherwise, it indicates that the client environment is untrustworthy, corresponding to step 104 above.

[0101] Phase 5: Global Model Aggregation: Each private cloud client aggregates the changes in model parameters. Uploaded to the central server, the central server performs weighted aggregation according to the following formula to update and obtain new global model parameters, corresponding to step 105 above:

[0102]

[0103] Among them, W t and W t+1 These are the parameters of the global model for global aggregation in round t and round t+1, respectively. Let C be the parameter change of private cloud client c during the t-th round of global aggregation training. tLet n be the set of private cloud clients participating in the t-th round of global aggregation training. c Let n be the number of samples in a small batch of data for private cloud client c. c' The central server distributes the updated global model to all participants, triggering the next round of training, based on the number of samples in the mini-batch dataset of the private cloud client c'. When the empirical risk function of the global model converges, it can be considered that the global model has reached a better state, and training stops.

[0104] This application innovatively proposes a federated learning training process that not only effectively prevents model integrity attacks during training but also ensures that the final global model is protected from threats such as model inversion attacks. Specifically, during training, noise is added to each data record based on a personalized differential privacy mechanism, thereby ensuring that even if an attacker obtains the global model, they cannot infer sensitive information from the original data through the model.

[0105] In another exemplary embodiment, the parameters involved in the embodiments of this application and their meanings are shown in Table 1.

[0106] Table 1 Parameter Table

[0107]

[0108] In another exemplary embodiment, the probability estimator described above is generated using a simulated sampling fitting algorithm, as follows:

[0109] To address the lack of efficient sampling mechanisms in existing personalized differential privacy methods, this application incorporates a Poisson sampling process using a simulated curve fitting (SCF) algorithm. The SCF algorithm studies the nonlinear relationship between the sampling probability q and the privacy budget ε by simulating a privacy budget curve, enabling the direct calculation of the recording sampling probability based on a user-defined privacy budget. Specifically, this method combines a Poisson sampling process, sampling data in the current iteration based on the calculated sampling probability to form a small batch of data for training. This not only effectively controls the premature inclusion of sensitive records and reduces the risk of catastrophic forgetting, but also reduces overall noise injection. The entire algorithm consists of two stages:

[0110] First, let's introduce a lemma (the privacy amplification effect formula under the Poisson-Gaussian mechanism):

[0111] By inputting the Rényi Differential Privacy (RDP) parameter α and the sampling probability q, the upper bound ρ of the privacy budget for the sample can be calculated. PoisG :

[0112]

[0113] Among them, M α The cumulative privacy loss can be expressed as follows:

[0114]

[0115] in, To record the probability of selecting l samples, the added Gaussian noise variance is σ. 2 Its privacy loss is suppressed to e (l-1)ρ(l) Calculate the cumulative privacy loss M. α :

[0116]

[0117] Simplified to:

[0118]

[0119] Substituting into the RDP definition, the privacy upper bound ρ, after privacy amplification through the Poisson-Gaussian mechanism, is... PoisG It can be represented as:

[0120]

[0121] Where, for any α > 1,

[0122] Simulation Phase: In this phase, a candidate sampling probability set Q = {q1, q2, ..., q} is first generated. m' ](q∈[0,1]) and the set of orders of RDP α={α1,α2,...,α k'} (generally, α is taken as an integer in [1, 64]), and then, for each sampling probability q in the set Q, the privacy amplification effect formula ρ under the Poisson-Gaussian mechanism given in the lemma is applied. PoisG (a,q), calculate record d using the combinatorial theorem. i,j The cumulative privacy cost ρ generated after global T-round training and client-side τ-round local updates. i,j =Tτρ PoisG (a,q i,j Finally, by solving the optimization problem, the corresponding optimal privacy budget ε is obtained. * :

[0123]

[0124] Where δ is the relaxation parameter (e.g., 10). -5 ).

[0125] Figure 5The graphs show the RDP and Differential Privacy (DP) budget as a function of order α for six different sampling probabilities Q = {q1 = 0.001, q2 = 0.01, q3 = 0.1, q4 = 0.5, q5 = 0.9, q6 = 1.0], while the calculated ε... * The corresponding minimum point of the DP budget curve, Figure 5 In the figure, (a) and (b) are the curves of RDP budget as a function of order α and DP budget as a function of order α, respectively.

[0126] Through this process, a set of data pairs can be obtained. To provide support for subsequent stages.

[0127] Fitting phase: Observing data pairs The relationship between them was found to be describable using an exponential function. This application uses the least squares method for fitting and evaluates the fitting effect of multiple exponential functions. It was found that although more complex function forms improve the goodness of fit, this improvement is limited. Figure 6 In the figure, (a), (b), and (c) are the fitting results of the exponential function when λ = 0.8, λ = 0.5, and λ = 0.2, respectively, and T = 50 and τ = 100 for all cases. Figure 6 As shown, Figure 6 In this context, T represents the total number of training rounds, τ represents the number of local training steps per round, λ represents the sampling rate of the private cloud client, q is the sampling probability of the sample, and ε is the sampling probability of the sample. * It is differential privacy budget, R 2 Reflecting goodness of fit, the closer to 1, the better:

[0128] Following Occam's Razor principle, which states that when multiple models exist to describe the nonlinear relationship between the privacy budget and sampling probability, choosing a simple model with good fitting performance can reduce system complexity, facilitate understanding and implementation, and reduce the risk of overfitting. Therefore, this paper selects the following relatively simple and well-fitting exponential model for approximation:

[0129] ε≈e a·q+b +c

[0130] After obtaining the fitted model, find its inverse function:

[0131]

[0132] Where q is the sampling probability, ε is the privacy budget, a, b, and c are all fitting parameters, and F(ε) is the probability estimator.

[0133] In another exemplary embodiment, the process of generating the above-mentioned sensitive samples is as follows:

[0134] In model outsourcing, to detect whether a cloud-based model has been maliciously tampered with, it is necessary to generate samples that are "highly sensitive" to changes in model parameters but imperceptible to the human eye. These sensitive samples make correct predictions on the original model, but once the model parameters are fine-tuned, their prediction results will change significantly, thus revealing the tampering behavior. Sensitive samples are generated by solving an optimization problem: using the original training samples as initial input, the samples are iteratively optimized using methods such as gradient maximization to maximize the sensitivity of the output to changes in model parameters (i.e., the gradient norm of the model output relative to the parameters).

[0135] Given a neural network model y = f(W, x), where W = [ω1, ω2, ..., ω n [x] is the set of model parameters. When the model parameters are tampered with to W+Δω, the output becomes f(W+Δω,x). To detect whether the model has been tampered with, we need to find a set of inputs x such that the model output is most sensitive to the parameter perturbation Δω, i.e., the following objective function:

[0136]

[0137] By expanding and approximating the objective function using the Taylor formula, we obtain the sensitive sample set S of the model y = f(W,x). ver Definition:

[0138]

[0139] Among them ||·|| F Let represent the Frobenius norm, and let represent the square root of the sum of the squares of all elements of the matrix. In practice, certain constraints need to be added to the sensitive samples: the value of sample x is restricted to the image pixel space ([0,255]), and the generated sensitive sample should be close to the original sample x0. Therefore, the final objective function is as follows:

[0140]

[0141] stx∈[p,q'] m

[0142] ||x-x0||≤∈

[0143] Based on the objective function described above, the flow of the sensitive sample generation algorithm is shown in Table 2. The algorithm's inputs are the target model f, model parameters w, learning rate ε, and training epochs E. The output is the sensitive sample set {x, f(x, w)}. Rows 1 and 2 in Table 2 initialize the iteration epochs and sensitive samples; the initial samples come from the original training dataset. Row 3 shows the optimization function obtained from the objective function. Rows 4-9 use the stochastic gradient descent algorithm to find the optimal sensitive samples. Row 10 outputs the final sensitive sample set.

[0144] Table 2 Sensitive Sample Generation Algorithm

[0145]

[0146] In another exemplary embodiment, the process of model integrity verification described above is as follows:

[0147] Attackers, such as those operating on private cloud clients, could potentially tamper with model parameters, altering the original model and launching a model integrity attack. To address this issue, this application generates a small set of sensitive samples to check for model tampering. Specifically, this involves generating samples highly sensitive to changes in model parameters through optimization problems, then submitting these samples to the private cloud client for prediction, comparing the accuracy of the output results, and determining whether the model has been modified. The process is as follows: Figure 7 As shown:

[0148] The process for verifying model accuracy involves the user submitting a generated set of sensitive samples to a private cloud client for prediction and collecting the model's output. Because the sensitive samples are highly correlated with the model parameters at the time of generation, even a small change in the model parameters can lead to significant differences in the prediction results. By comparing the consistency of the original model's predictions with those of the cloud-based (potentially tampered) model for the sensitive samples, it is possible to detect whether the model has been compressed or tampered with. Verification of model integrity includes... Figure 8 As shown.

[0149] Sensitive samples provide an effective mechanism for detecting model tampering in the cloud. By testing with sensitive samples under model compression attacks, the behavioral differences between the original and tampered models can be revealed. Even if the compressed model performs indistinguishably on regular samples, significant differences in predictions on sensitive samples can be detected. This method can be used as part of model integrity verification, ensuring that users can detect potential model tampering behavior on the cloud server side.

[0150] In the simulation of the sensitive sample generation algorithm, this application embodiment used the CIFAR-10 dataset (http: / / yann.lecun.com / exdb / mnist / ), built a ResNet-20 model as the original model, and completed the model training based on the CIFAR-10 dataset. The training accuracy of the model reached 98%, the testing accuracy reached 80%, and a sensitive sample set was generated on this basis.

[0151] When generating sensitive samples, embodiments of this application must consider both sensitivity and signal-to-noise ratio to ensure that these samples are not easily detected, but can effectively reveal whether the model has been tampered with.

[0152] Figure 9The data shows how the sensitivity of the samples to the model parameters changes with the number of iterations. Initially, the sensitivity of the samples is low, indicating that the prediction results of the samples are not sensitive to changes in the model parameters; that is, changes in the model parameters do not affect the prediction results of the samples or the changes are too small to be detected. Within 2000 iterations, the sensitivity of the samples increases rapidly. After 2000 iterations, the sensitivity of the samples increases slightly and eventually converges.

[0153] Figure 10 The results show how the signal-to-noise ratio (SNR) of the samples relative to the model parameters changes with the number of iterations. The higher the SNR, the closer the sensitive samples are to the original samples; the lower the SNR, the more severe the distortion of the samples. As the number of training iterations increases, the SNR of the samples begins to decrease, but eventually stabilizes at 39, indicating that the sensitive samples are close to the original samples, ensuring the concealment of the samples.

[0154] Therefore, when training sensitive samples, both sensitivity and signal-to-noise ratio should be considered. After extensive experimental testing, the technical solution provided in this application selected 2000 iterations when generating sensitive samples, so that the samples have high sensitivity without severe distortion.

[0155] In this embodiment, a sensitive sample is generated by randomly selecting an original image from the CIFAR-10 dataset and applying the gradient maximization method.

[0156] The embodiments of this application reduce the number of filters in the convolutional layers of the original ResNet-20 model and reduce the number of residual blocks in the early stages, further simplifying the model and making it simpler, without significantly reducing the model's training accuracy and testing accuracy.

[0157] In a compression attack experiment, the compressed model could correctly predict on the original image and the sensitive sample, but it exhibited significant errors when using the sensitive sample for prediction. This indicates that the generated sensitive samples are highly correlated with the model parameters, and changes in these parameters lead to significant changes in the prediction output. Without an effective verification mechanism, users will find it difficult to detect tampering of the model by the cloud server. Such tampering could lead to inaccurate predictions in more complex tasks, seriously threatening the reliability and security of the model.

[0158] This application embodiment further generates a sensitive sample set with 10 samples, and experiments are conducted on this sensitive sample set. The experimental results are shown in Table 3.

[0159] Table 3 Comparison of prediction accuracy between the original model and the compressed model under different sample types.

[0160] Sample type Original model accuracy Compression model accuracy Original sample 100％ 100％ Sensitive samples 100％ 70％

[0161] The verification results show that the compressed model maintains 100% prediction accuracy on the original samples, but the accuracy drops sharply to 70% on sensitive samples, revealing the significant impact of parameter tampering on the output. This verifies the effectiveness of sensitive samples in detecting model tampering and provides key technical support for ensuring the reliability of cloud-based models.

[0162] According to the specific embodiments provided in this application, this application has the following technical effects.

[0163] Personalized privacy protection: This solution employs a personalized differential privacy mechanism during model training, injecting personalized noise into the gradient update of each record. This effectively hides the contribution of individual records while avoiding the impact of excessive noise on model performance.

[0164] High level of regulatory control: Through a sensitive sample verification mechanism, users can detect whether a private cloud client has tampered with the model in a black-box environment where they are unaware of the model's internal structure. If the server's output does not match expectations, malicious client behavior can be quickly detected, thus ensuring the integrity of the model in the outsourced environment.

[0165] Dual Improvement in Computational Efficiency and Utility: This solution combines a personalized differential privacy mechanism with a Poisson sampling process, using synchronous privacy budgeting to avoid catastrophic data forgetting, resulting in a significant improvement in model accuracy compared to existing differential privacy solutions. Simultaneously, the additional overhead introduced by sensitive sample validation is minimal, and the system's resistance to malicious server or client attacks is greatly enhanced, achieving a balance between performance and security overall.

[0166] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0167] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A verifiable privacy-preserving federated learning method based on sensitive samples, characterized in that, The verifiable privacy-preserving federated learning method based on sensitive samples is applied to a federated learning system. This system is used to train a fault diagnosis model, which predicts the state of production equipment based on its state data, which is presented as images. The federated learning system includes a central server, a private cloud client, and a user terminal. The verifiable privacy-preserving federated learning method based on sensitive samples includes: The central server builds a global model and probability estimator, initializes the parameters of the global model, generates a sensitive sample set, and sends the global model, probability estimator, initial parameters of the global model, and sensitive sample set to the user terminal. On the user end, a small batch dataset is generated using Poisson sampling based on the probability estimator, and the global model, the initial parameters of the global model, and the small batch dataset are sent to the private cloud client. On the private cloud client, a personalized differential privacy strategy is used to train the global model based on the initial parameters of the global model and a small batch dataset, and the inference service API of the trained model is released after training is completed. The user client calls the model inference service API and verifies the integrity of the trained model based on the sensitive sample set. Once the verification is successful, the private cloud client is allowed to send the parameters of the trained model to the central server. The central server aggregates the parameters of the trained models sent by each private cloud client to obtain the trained global model. The probability estimator is generated using a simulated sampling fitting algorithm, as detailed below: Generate a set of candidate sampling probabilities and a set of orders of the RDP; For each sampling probability in the sampling probability set Based on the order of the RDP set, optimization is performed to obtain the optimal privacy budget for each sampling probability, as shown in the formula: ； in, For the optimal differential privacy budget of the j-th record in the dataset of the i-th user, For the Ruili differential privacy budget of the j-th record in the i-th user dataset, For the relaxation parameters of differential privacy, Let be the order of the RDP; An exponential function is fitted based on each sampling probability and the optimal privacy budget corresponding to each sampling probability to construct a probability estimator; The probability estimator is: ； in, For sampling probability, For privacy budget, , , All are fitted parameters. It is a probability estimator.

2. The verifiable privacy-preserving federated learning method based on sensitive samples according to claim 1, characterized in that, The sensitive sample set is generated as follows: Construct the objective function; The objective function is solved using the stochastic gradient descent algorithm, and a sensitive sample set is constructed.

3. The verifiable privacy-preserving federated learning method based on sensitive samples according to claim 2, characterized in that, The objective function is: ； in, Let be the objective function. The global model's prediction result for sample data x relative to the parameters gradient, and , where x represents the upper and lower bounds of the sample data, and m represents the dimension of the sample data. It is a very small number. This is the original sample data.

4. The verifiable privacy-preserving federated learning method based on sensitive samples according to claim 2, characterized in that, The objective function is solved using the stochastic gradient descent algorithm, and a sensitive sample set is constructed, specifically including: The initial number of iterations, k, is set to 0. Initialize the sample data to the original sample data; Using formula Calculate the objective function value obtained in the k-th iteration. ;in, For the sample data obtained in the k-th iteration, For the sample data of the global model for the k-th iteration solution The prediction results are related to the parameters The gradient; The objective function value obtained based on the k-th iteration The sample data is updated using the following formula to obtain the sample data for the (k+1)th iteration. ； ； in, For the sample data obtained in the (k+1)th iteration, The update parameters for the sample data obtained in the k-th iteration are... For learning rate, The update parameters for the sample data obtained in the (k-1)th iteration are... The gradient of the objective function value with respect to the sample data is obtained in the k-th iteration. Determine whether the sample data obtained in the (k+1)th iteration satisfies the following formula to obtain the first judgment result; ； in, and , where x represents the upper and lower bounds of the sample data, and m represents the dimension of the sample data. It is a very small number. This is the original sample data; If the first judgment result is negative, then the sample data solved in the (k+1)th iteration is corrected, and the step of judging whether the sample data solved in the (k+1)th iteration satisfies the following formula is returned to obtain the first judgment result; If the first judgment result is yes, then let The value increases by 1, and the judgment formula is updated. Whether the condition is met or not, a second judgment result is obtained; where E is the threshold for the number of iterations. If the second judgment result is yes, then return to using the formula. Calculate the objective function value obtained in the k-th iteration. Steps; If the second judgment result is negative, then output... As a sensitive sample.

5. The verifiable privacy-preserving federated learning method based on sensitive samples according to claim 1, characterized in that, In generating mini-batch datasets based on the probability estimator using Poisson sampling, the user terminal is specifically used for: Based on the privacy budget for each data record on the client side, a probability estimator is used to calculate the sampling probability for each data record; Based on the sampling probability of each data point, Poisson sampling is used to sample each data record on the client to obtain a small batch dataset.

6. The verifiable privacy-preserving federated learning method based on sensitive samples according to claim 1, characterized in that, The formula for aggregating the parameters of the trained model sent by each private cloud client to obtain the trained global model is as follows: ； in, and These are the parameters of the global model for global aggregation in round t and round t+1, respectively. Let be the parameter change of private cloud client c during the t-th round of global aggregation training. This refers to the set of private cloud clients participating in the t-th round of global aggregation training. The number of samples in the small batch dataset of private cloud client c. For private cloud clients The number of samples in a small batch dataset.

Images