Federal learning privacy protection method and device, medium and computer program product
By generating second model update parameters in federated learning through the inverse operation of multiplication secret sharing, the problem of poor security of traditional encryption methods is solved, and privacy data protection and model accuracy are achieved.
Patent Information
- Application Number
- CN202511366354.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-17
- Publication Date
- 2025-12-16
AI Technical Summary
In decentralized federated learning systems, traditional encryption methods are less secure and easier to crack, leading to the leakage of user privacy data.
The method employs the inverse operation of multiplication secret sharing. By generating and interacting with the first secret shared data, a second model update parameter is generated. The goal is to make the sum of the first model update parameters corresponding to the two devices equal to the product of the second model update parameters corresponding to the two devices. The global model parameters are updated using a weighted average to prevent privacy data leakage.
It effectively prevents the leakage of private data, improves computational efficiency, reduces the loss of model accuracy caused by privacy protection, and further reduces the loss of model accuracy through error control.
Smart Images
Figure CN121145262A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to a federated learning privacy protection method, device, medium and computer program product. BACKGROUND
[0002] Federated learning is a distributed machine learning mode, which does not need to let data leave the local client, and plays a certain protection role on data privacy. The federated learning can be coordinated by a central server to train the process, or can be directly carried out between multiple user devices without a central server. In the federated learning system without a central server, a large amount of model update data interaction exists between user devices, which is easy to cause the leakage of user privacy data. The security of the traditional encryption mode using symmetric key or asymmetric key is poor and is easy to be cracked.
[0003] How to improve the communication security in the federated learning system without a central server is a technical problem to be solved by the person skilled in the art. SUMMARY
[0004] The present application provides a federated learning privacy protection method, device, medium and computer program product to at least solve the problem of poor communication security in the federated learning system without a central server in the related art.
[0005] The present application provides a federated learning privacy protection method applied to a first device participating in federated learning, comprising: training a global model by using a local data set respectively with a second device participating in federated learning to obtain a local first model update parameter; generating first secret sharing data by using a first key agreed with the second device and interacting with the second device, and generating a second model update parameter according to the first secret sharing data received from the second device; calculating a weighted average value according to the second model update parameter, and updating a global model parameter by using the weighted average value; Wherein, the generation target of the second model update parameter is that the sum of the first model update parameters corresponding to the two devices is equal to the product of the second model update parameters corresponding to the two devices.
[0006] The present application also provides an electronic device comprising a memory for storing a computer program and a processor for executing the computer program to implement the steps of any one of the above federated learning privacy protection methods.
[0007] The application further provides a non-volatile storage medium, wherein the non-volatile storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of any one of the federated learning privacy protection methods.
[0008] The application further provides a computer program product comprising a computer program, and the computer program is executed by a processor to implement the steps of any one of the federated learning privacy protection methods.
[0009] According to the application, the first device and the second device respectively train the global model by using the local data set to obtain the local first model update parameter, and generate the first secret sharing data by using the agreed first key to interact with the other device, generate the second model update parameter according to the received first secret sharing data, and the generation target of the second model update parameter is that the sum of the first model update parameters corresponding to the two devices is equal to the product of the second model update parameters corresponding to the two devices, and the weighted average value is calculated based on the second model update parameter to update the global model parameter, that is, the sum of the first model update parameters obtained by the two devices is converted into the product of the second model update parameters, and the two devices cannot know the first model update parameter of the other party, so that the first device, the second device or the third party device cannot infer the corresponding private data after obtaining the first model update parameter, and the private calculation process is simple, and compared with the differential privacy and other methods, the calculation efficiency is improved and the model precision loss caused by the privacy protection is reduced.
[0010] The application further provides a method for controlling the error in the above-mentioned privacy protection method, which converts the error control target of calculating the weighted average value into the error control target represented by the generation parameter of the second model update parameter, so that the error control is actively performed in the process of generating the first secret sharing data and interacting with each other and generating the second model update parameter and calculating the weighted average value between the two devices, thereby further reducing the model precision loss caused by the privacy protection.
[0011] The application further provides an error control target representation method in the case where the first model update parameter comprises the model update data and the first number of the model update data, and the privacy protection and error control can be realized by simple calculation.
[0012] The application can also select the number of local data sets different from that in the last round of iterative training in the current round of iterative training of the federated learning, so as to further improve the privacy data cracking difficulty and improve the security of the federated learning. BRIEF DESCRIPTION OF DRAWINGS
[0013] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0014] Figure 1 An architecture diagram of a federated learning system provided in an embodiment of the present invention; Figure 2 This is a flowchart of a federated learning privacy protection method provided in an embodiment of the present invention. Detailed Implementation
[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.
[0016] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not used to describe a specific order or sequence.
[0017] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0018] Figure 1 This is an architecture diagram of a federated learning system provided in an embodiment of the present invention.
[0019] The specific application environment architecture or specific hardware architecture on which the implementation of the federated learning privacy protection method depends is described here.
[0020] like Figure 1 As shown, the federated learning system provided in this embodiment of the invention may include a first device and a second device. Each device has a local dataset. The two devices perform iterative training based on the same initial global model parameters and the local dataset, and jointly update the model parameters until the federated learning iterative training termination condition is met.
[0021] To prevent the leakage of device privacy data to another device or a third party, this invention provides a process using the inverse operation of multiplicative secret sharing. The local first model update parameter, first secret shared data, is sent to another device, enabling the other device to generate a second model update parameter based on the first secret shared data. The goal of generating the second model update parameter is that the sum of the first model update parameters corresponding to the two devices equals the product of the second model update parameters corresponding to the two devices. A weighted average is calculated based on the second model update parameter to update the global model parameters. In other words, the sum of the first model update parameters obtained by each of the two devices is converted into the product of the second model parameters. Neither device can know the other's first model update parameter, effectively preventing the first device, the second device, or a third-party device from inferring the corresponding privacy data after obtaining the first model update parameter.
[0022] The embodiments of the present invention provide a method for protecting privacy in federated learning. The method is described in detail below, along with its execution flow.
[0023] Figure 2 This is a flowchart of a federated learning privacy protection method provided in an embodiment of the present invention.
[0024] like Figure 2 As shown, the federated learning privacy protection method provided in this embodiment of the invention can include: S201: training the global model using the local dataset and the second device participating in the federated learning respectively, to obtain the local first model update parameters.
[0025] S202: Using the first key agreed upon with the second device, generate first secret shared data from the first model update parameters and interact with the second device; generate second model update parameters based on the first secret shared data received from the second device.
[0026] S203: Calculate the weighted average based on the updated parameters of the second model, and use the weighted average to update the global model parameters.
[0027] The goal of generating the second model update parameters is that the sum of the first model update parameters corresponding to the two devices is equal to the product of the second model update parameters corresponding to the two devices.
[0028] In this embodiment of the invention, both the first device and the second device are devices that possess local datasets to participate in federated learning. In some optional implementations of this invention, the first device and the second device can be two equal devices in the federated learning process; that is, only one device needs to complete the step of initializing the global model parameters, and the remaining steps need to be performed by both devices. In other optional implementations of this invention, the first device can act as the master device, and the second device as the auxiliary device. The first device completes the process of initializing and updating the global model parameters, while the second device mainly provides assistance in updating the global model using the local dataset.
[0029] For S201, the first device can initialize the global model parameters and send them to the second device. Then, both devices train the model based on their respective local datasets using the global model parameters. In this embodiment, the types of parameters updated by the first model can include gradient data and weight data.
[0030] In this embodiment of the invention, to further improve the security of federated learning, in S201, the first device and the second device participating in federated learning respectively use local datasets to train the global model to obtain local first model update parameters. This may include: the first device and the second device respectively select local datasets to train the global model to obtain local first model update parameters, and the number of local datasets selected in this round of iteration training is different from that in the previous round of iteration training.
[0031] For S202, this embodiment of the invention employs an inverse operation process of multiplication secret sharing to update data in the interaction model between two devices. The inverse operation process of multiplication secret sharing will be described below.
[0032] Assume the first device possesses data The second device possesses data After the reverse process of multiplication secret sharing, the goal is to achieve data ownership by the first device. The second device possesses data And they satisfy At the same time, the first device does not disclose its data to the second device. And the second device does not disclose its data to the first device. In this embodiment of the invention, the first model update parameter of the first device is: The first model update parameters for the second device are: The second model update parameters for the first device are: The second model update parameters for the second device are: The process of the first and second devices generating the second model update parameters is achieved through intermediate first secret shared data. During this process, neither device can deduce the other's first model update parameters, but can only obtain the second model update parameters. Based on the second model update parameters of the local device and the other device, the global model parameters are updated.
[0033] It should be noted that the meaning of the second model update parameter generation target in this embodiment of the invention being that the sum of the first model update parameters corresponding to the two devices is equal to the product of the second model update parameters corresponding to the two devices is that, due to errors in the actual generation process, especially when division calculations are involved, the product of the generated second model update parameters will not actually be strictly equal to the sum of the two first model update parameters. Therefore, it is described as the form of the second model update parameter generation target. However, in reality, the two devices calculate the second model update parameters according to the reverse process of the shared multiplication secret.
[0034] For S203, based on the relationship between the first model update parameters and the second model update parameters, that is, ideally the product of the second model update parameters is equal to the sum of the two first model update parameters, the process of calculating the weighted average based on the first model update parameters obtained from the two devices can be converted into the process of calculating the weighted average based on the second model update parameters obtained from the two devices. Thus, the two devices can calculate the weighted average based on the second model update parameters calculated locally and the second model update parameters sent by the other device to complete the local global model parameter update. The federated learning privacy protection method provided in this invention involves a first device and a second device training a global model using local datasets to obtain local first model update parameters. Using an agreed-upon first key, the local first model update parameters are used to generate first secret shared data, which is then exchanged with another device. Based on the received first secret shared data from the other device, second model update parameters are generated. The goal of generating the second model update parameters is that the sum of the first model update parameters for both devices equals the product of the second model update parameters for both devices. A weighted average is calculated based on the second model update parameters to update the global model parameters. In other words, the sum of the first model update parameters obtained by each device is converted into the product of the second model parameters. Neither device knows the other's first model update parameters, effectively preventing the first device, the second device, or a third-party device from inferring the corresponding privacy data after obtaining the first model update parameters. Furthermore, this privacy calculation process is simple, improving computational efficiency and reducing model accuracy loss due to privacy protection compared to differential privacy methods.
[0035] Based on the above embodiments, the federated learning privacy protection method provided by the present invention may further include: obtaining a first error control objective of a weighted average; converting the first error control objective into a second error control objective represented by the generation parameters of the second model update parameters according to the type of the first key and the type of the first model update parameters; generating first secret shared data from the first model update parameters using the first key agreed with the second device and interacting with the second device, and generating second model update parameters according to the first secret shared data received from the second device, including: generating first secret shared data according to the second error control objective and interacting with the second device, and generating second model update parameters; calculating a weighted average according to the second model update parameters, including: calculating a weighted average according to the second error control objective and the second model update parameters.
[0036] According to the above embodiment, in the process of aggregating model update data by using the inverse operation process of multiplication secret sharing between two devices, from the generation of the first model update parameter to the first secret shared data, and then to the generation of the second model update parameter, corresponding generation parameters can be designed. However, some division calculations in the calculation process may lead to computational loss. The error generated in this process can be determined by the generation process of the second model update parameter, and the error control target of the weighted average is converted into an error control target represented by the generation parameters of the second model update parameter. In order to actively control the error in the generation process of the second model update parameter, the model accuracy loss caused by security protection is reduced.
[0037] In this embodiment of the invention, the first key held by the first device includes a first parameter and a third parameter; the first key held by the second device includes a second parameter and a fourth parameter; the product of the first parameter and the second parameter is equal to the sum of the third parameter and the fourth parameter. Then, in S202, using the first key agreed upon with the second device to generate first secret shared data from the first model update parameters and interacting with the second device, and generating second model update parameters based on the received first secret shared data from the second device, may include: the first device calculating a first difference between its local first model update parameters and the third parameter, dividing this difference by a first quotient of the first parameter, and sending the first quotient as the first secret shared data to the second device; the second device calculating a second difference between its local first model update parameters and the fourth parameter, calculating a first sum of the second parameter and the first quotient as its local second model update parameters, calculating a second quotient of the second difference divided by the first sum, and sending the second quotient as the first secret shared data to the first device; and the first device calculating the sum of the second quotient and the first parameter as its local second model update parameters.
[0038] In this embodiment of the invention, the step of generating the first key may include: a first device generating a set of asymmetric keys and sending the first public key of the asymmetric keys to a second device; the first device encrypting a first random value using the first private key of the asymmetric keys and sending the resulting first encryption result to the second device; the second device encrypting a second random value using the first public key to obtain a second encryption result, and calculating a third encryption result based on the first encryption result, the third random value, and the second encryption result, and sending the third encryption result to the first device; the first device decrypting the third encryption result using the first private key to obtain a fourth random value; the first device obtaining a fifth random value agreed upon with the second device, calculating a first parameter based on the fifth random value and the first random value, and calculating a third parameter based on the fifth random value and the fourth random value; the second device calculating a second parameter based on the fifth random value and the third random value, and calculating a fourth parameter based on the fifth random value and the second random value.
[0039] The calculation formulas for the above process are introduced below.
[0040] First, we will introduce the general symbol representations used in the embodiments of this invention.
[0041] express The least common multiple of, express The greatest common divisor, if say and Mutual elements. Represents a set . Represents a set Zhongyu A set of coprime elements. Read as mold ,express Divide by The remainder, express Divide by The remainders are the same. If ,express yes mold The multiplicative inverse is denoted as ,at this time Too mold The multiplicative inverse. If For sets ,definition functions on for .
[0042] express The sign function, whose value is .
[0043] Homomorphic encryption is a method frequently used in secure multi-party computation. The Paillier algorithm is an encryption method that satisfies additive homomorphism, and its contents are as follows: (1) Key generation: select two large prime numbers. ,make , They satisfy .choose Make it satisfy Then you can As a public key, As a private key.
[0044] (2) Encryption: for any Select random number The ciphertext is .
[0045] (3) Decryption: For any The plain text is .
[0046] Regarding extending this algorithm to the integer range, select sufficiently large integers. This ensures that the absolute value of the sum of the data will not exceed [a certain value]. Next, add a '+' to the data that is less than 0. Convert all data into natural numbers and encrypt them directly using the Paillier algorithm described above. After decryption using the Paillier algorithm, if the data is greater than... Subtract it If the data is less than If the result is not obtained, no further processing is needed, and the final decryption result can be obtained. Based on the additive homomorphism of the Paillier algorithm, it is easy to verify that the algorithm generalized to the integer range still satisfies the additive homomorphism.
[0047] Used later and This represents encryption and decryption algorithms generalized to the integer range. It can be obtained that if... and Therefore, there are .
[0048] Furthermore, we can obtain if ,in If it is a positive integer, then we have .
[0049] In addition, due to It can be known that (Here, finding the inverse in the ciphertext refers to finding the modulus...) The inverse in the sense of meaning is equivalent to the Encryption, i.e. Therefore, if ,and If it is a negative integer, then , and when At times, there are obviously also .so, ,and If it is an integer, then .
[0050] As described above, the implementation of the inverse operation of multiplication secret sharing used in the embodiments of the present invention can be divided into pre-generated arrays. and using pre-generated arrays accomplish The two main steps are secret sharing (the reverse process of secret sharing in multiplication).
[0051] I. Pre-generated array ,satisfy The first device has The second device has Follow these steps.
[0052] 1. The first device establishes the Paillier algorithm key. and the public key Send to the second device. The key contains... If it is large enough, for example, has 1024 bits, then in general the result of data operation will be in a certain range. Within the range.
[0053] 2. The first device selects the first random value. Encrypting it yields the first encryption result. And send it to the second device.
[0054] 3. The second device selects a third random value. Second random value Then to Encryption yields a second encryption result Then, the third encryption result is calculated. And send it to the first device.
[0055] 4. The first device encrypts the third result. Decryption yields the fourth random value .
[0056] 5. The first and second devices agree on a random decimal (denoted as the fifth random value). Then the first device calculates the first parameter. The third parameter
[0057] 6. The second device calculates the second parameter. The fourth parameter .
[0058] II. Using pre-generated arrays Reality The secret sharing (the inverse process of multiplication secret sharing).
[0059] 1. The first device calculates the third parameter. First quotient and will Send to the second device.
[0060] 2. The first device calculates the second difference. The local second model updates the parameters (second sum value). Second quotient and will Send to the first device.
[0061] 3. The first device calculates the local update parameters for the second model. .
[0062] Verifiable And based on the information obtained from the first device... It cannot be deduced as well as Information; information obtained from the second device It cannot be deduced as well as Information. Here it is referred to as... These are the multiplication secret shared values (i.e., the second model update parameters in the above embodiments) owned by the first device and the second device, respectively.
[0063] In the above process (the reverse process of sharing the secret of multiplication), calculate and There is a truncation error, which leads to a truncation error in the final calculated result. In this embodiment of the invention, a relative error can be considered, that is, it can be controlled. Less than ,in It is a very small number that can represent the tolerance for relative error. The following describes how to control... and The calculation error is such that the relative error meets the requirements.
[0064] If we set , .So: .
[0065] Among them, record The first error of the first device, This is the first error of the second device. (Note: The original text contains some formatting errors and inconsistencies. A more accurate translation would require the full context.) The fourth quotient, i.e., the calculation Divide by The truth value of; The fifth quotient, i.e., the calculation Divide by The truth value of . It is the first secret shared data introduced above, and it is also the result obtained by performing a division calculation.
[0066] The final error is divided into two parts. and Therefore, it is necessary to control the error. Less than Only the first device needs to be set. Second device settings That's all.
[0067] In this embodiment of the invention, the first error control objective can be: the absolute value of the error between the true value of the weighted average and the weighted average is less than the product of the true value of the weighted average and the first error coefficient. In this embodiment of the invention, in S201, training the global model using local datasets with the second device participating in federated learning to obtain local first model update parameters can include: training the global model using local datasets with the second device to obtain model update data; calculating the first product of the local model update data and the first number of data entries; and using the local first product and the first number of data entries as the first model update parameters. In S203, calculating the weighted average based on the second model update parameters can include: calculating the quotient of the second model update parameter corresponding to the local first product divided by the second model update parameter corresponding to the local first number of data entries to obtain local third model update parameters; and calculating the product of the local third model update parameters and the third model update parameters sent by the second device to obtain the weighted average.
[0068] Assuming each model update has Each component, the first device possesses 10 data points, their average is 10. The second equipment possesses 10 data points, their average is 10. Without revealing any data information (including individual averages and the number of data points), calculate the weighted average of all the data: .
[0069] in, for The weighted average of the data components. That is, the weighted average true value. The above problem can also be expressed as... , The proportion of weights is allocated to the data. The weighted average is calculated by weighting the data of the two devices by weighting the first data of each device.
[0070] Due to errors in actual calculations, the actual weighted average calculated on the left side of the above formula will differ from the true weighted average on the right side.
[0071] The corresponding steps are as follows: 1. The first device and the second device use the inverse algorithm of the above-mentioned multiplication secret sharing to calculate the result. and The data obtained by the first device is The data obtained by the second device is That is to say, As the first model update parameter in the aforementioned multiplication secret-sharing inverse algorithm. ,Will As the first model update parameter , The second model update parameters obtained from the two are respectively And will As the first model update parameter in the above process ,Will As the first model update parameter , The second model update parameters obtained from the two are respectively .
[0072] 2. The first device updates parameters based on the local second model. , calculate The value is sent to the second device, which updates the parameters according to the local second model. , calculate The value is sent to the first device, where For distinction, it is denoted as... , Update the parameters for the third model.
[0073] 3. The weighted average values were calculated separately for the first and second equipment. .
[0074] If strict error control is not required, it is sufficient to ensure that more significant digits are retained when performing division in the above process. Similarly, regarding error control, relative error is considered here. Therefore, the first error control objective can be: the absolute value of the error between the true value of the weighted average and the weighted average is less than the product of the true value of the weighted average and the first error coefficient. That is, the first error control objective can be expressed by the following formula: ; in, The true value of the weighted average. This is the weighted average (actual calculation result). The first error coefficient, It is a relatively small number.
[0075] In this embodiment of the invention, converting a first error control objective into a second error control objective represented by the generation parameters of a second model update parameter, based on the type of the first key and the type of the first model update parameter, may include: converting the first error control objective into a third error control objective and a fourth error control objective based on the type of the first key and the type of the first model update parameter; and converting the third error control objective and the fourth error control objective into corresponding second error control objectives respectively; wherein, the third error control objective is that the absolute value of the error between the weighted average true value and the corresponding secret shared data is less than the product of the weighted average true value and the second error coefficient; the secret shared data corresponding to the weighted average true value is the third quotient of the product of the second model update parameters corresponding to the first product of the two devices divided by the product of the second model update parameters corresponding to the first number of records of the two devices; the fourth error control objective is that the absolute value of the error between the third quotient and the weighted average is less than the product of the weighted average true value and the second error coefficient; and the second error coefficient is half of the first error coefficient.
[0076] Specifically, due to The parameters can be controlled to make: ; .
[0077] in, The true value of the weighted average. The third quotient, It is the weighted average (i.e., the actual value calculated in S203). This is the second error coefficient.
[0078] The second error control objective corresponding to the third error control objective can be: the first error is less than twice the absolute value of the corresponding third error coefficient multiplied by the model update data and divided by the corresponding second parameter; wherein, the third error coefficient is determined based on the first error coefficient; corresponding to the process of the first device generating the second model update parameter, the first error is the absolute value of the difference between the first secret shared data calculated by the first device and the fourth quotient, and the fourth quotient is the quotient of the first difference divided by the first parameter; corresponding to the process of the second device generating the second model update parameter, the first error is the absolute value of the difference between the first secret shared data calculated by the second device and the fifth quotient, and the fifth quotient is the quotient of the second difference divided by the first sum.
[0079] Specifically, for If the errors of the numerator and denominator are respectively and ,Right now and Let the relative errors be the inverse algorithm process of sharing the multiplication secrets of the first product and the inverse algorithm process of sharing the multiplication secrets of the first number, respectively. Then: .
[0080] Therefore, if we take and ,So: .
[0081] Therefore, in the inverse algorithm using multiplication secret sharing, the calculation... At that time, the error of the control parameters of the first device needs to meet the following requirements. The second device needs to control the error of the parameters to meet the following requirements. .
[0082] in, The first error is the first error encountered by the first device during the inverse operation of the secret sharing of the multiplication of the first product. As mentioned above In ; This refers to the first error in the second device when performing the inverse operation of the secret sharing of the multiplication of the first product. As mentioned above In ; The first parameter is used by the first device when performing the inverse operation of the secret sharing of the multiplication of the first product; The second parameter is used by the second device when performing the inverse operation of the secret sharing of the multiplication of the first product; The first quotient value is obtained by the first device when performing the inverse operation of the secret sharing of the multiplication of the first product; The first product is the first product local to the first device. The first product of the second device locally; This is the third error coefficient; The relative error in the inverse algorithm process of sharing the multiplication secret of the first product.
[0083] And, in calculating using the inverse algorithm of multiplication secret sharing At that time, the error of the control parameters of the first device needs to meet the following requirements. The second device needs to control the error of the parameters to meet the following requirements. .
[0084] in, The first error is the first error encountered by the first device when performing the inverse operation of the secret sharing of the multiplication of the first number. As mentioned above In ; This refers to the first error in the second device when performing the inverse operation of the secret sharing of the multiplication of the first number. As mentioned above In ; The first parameter is used by the first device when performing the inverse operation of the secret sharing of the multiplication of the first number; The second parameter is used by the second device when performing the inverse operation of the secret sharing of the multiplication of the first number; The first quotient value is obtained by the first device when performing the inverse operation of the secret sharing of multiplication of the first number; This is the first record on the first device's local machine. This is the first record on the second device's local machine; This is the third error coefficient; The relative error in the inverse algorithm process of the secret sharing of the first number multiplication is given.
[0085] In this embodiment of the invention, the second error control objective corresponding to the fourth error control objective can be: the absolute value of the error of the third model update parameter calculated by the first device minus the corresponding sixth quotient is less than the product of the fourth error coefficient and the corresponding sixth quotient; the absolute value of the error of the third model update parameter calculated by the second device minus the corresponding sixth quotient is less than the product of the fourth error coefficient and the corresponding sixth quotient; wherein, the sixth quotient is the true value of the quotient of the first secret shared data corresponding to the model update data divided by the first secret shared data corresponding to the first number; the fourth error coefficient is determined according to the first error coefficient.
[0086] Specifically, for Since the first item has already been controlled and The distance between them is very small, so it can be used It is used to approximate its relative error control.
[0087] set up We can obtain: .
[0088] Pick Then we can get: .
[0089] Therefore, when calculating the weighted average, it is necessary to control... and .
[0090] in, , For ease of description, let's call it an intermediate parameter. This is the fourth error coefficient. truth value The truth value is the sixth quotient. , The results are obtained when calculating the update parameters of the third model for the first and second devices, respectively.
[0091] Using the algorithm above for calculating the weighted average of the two sides, privacy protection can be achieved in peer-to-peer federated learning (where clients communicate directly) with only two devices.
[0092] Based on the above embodiments, in this embodiment of the invention, in S201, the global model is trained by the second device participating in federated learning using local datasets to obtain local first model update parameters. This may include: in the first round of iterative training, initializing the global model and sending the initial model parameters to the second device; in the second round and subsequent iterative training, training is performed by the second device using local datasets based on the global model parameters obtained in the previous round of iterative training to obtain local first model update parameters, until the first iteration termination condition is met.
[0093] The process of calculating a weighted average based on the updated parameters of the second model, updating the global model parameters using the weighted average, and updating the global model parameters using the weighted average may include: calculating a gradient-weighted average and a weight-weighted average based on the updated parameters of the second model; and updating the global model parameters based on the gradient-weighted average, the weight-weighted average, and the model training learning rate.
[0094] For the first device and the second device, the iterative training steps of federated learning can include: 1. The first device builds a global parameter model and sends it to the second device. Assume the parameters are as follows: .
[0095] 2. The first device and the second device each randomly select a portion of the dataset (assuming the number of datasets selected by the two devices are respectively...). and Then, the model is trained locally on these datasets to obtain local gradient data or local model parameters.
[0096] (1) Gradient-weighted average: Let the local gradient data obtained by the first device be... The second device obtains local gradient data as follows: .
[0097] (2) Weighted average: Let the local model parameters obtained by the first device be... The second device obtains the local model parameters as follows: .
[0098] The purpose of randomly selecting the dataset in this step is to ensure that the number of datasets used in each calculation is different, so as to prevent malicious users from using the differences in the results of multiple calculations to speculate on the user's gradient data or model parameter data.
[0099] 3. The first and second devices use the algorithm described above to calculate the weighted average of the two sides to obtain the weighted average of the local gradient data or the local model parameters.
[0100] (1) Gradient-weighted average: calculate and weighted average .
[0101] (2) Weighted average: calculate and weighted average That is to say, As in the above weighted average process ,Will As a process ,as well as and Corresponding to the above process and The result obtained As And will As in the above weighted average process ,Will As a process ,as well as and Corresponding to the above process and The result obtained As .
[0102] 4. Both the first and second devices perform global model parameter updates.
[0103] (1) Gradient-weighted average: ,in This represents the learning rate.
[0104] (2) Weighted average: .
[0105] 5. Then repeat steps 2-4 until the first iteration termination condition is met. The first iteration termination condition can be that the required number of iterations has been reached, or the model training accuracy has reached the required level.
[0106] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.
[0107] Embodiments of the present invention also provide a privacy protection device for federated learning, applied to a first device participating in federated learning, which may include: a training unit, used to train a global model using a local dataset, together with a second device participating in federated learning, to obtain local first model update parameters; an interaction control unit, used to generate first secret shared data from the first model update parameters using a first key agreed upon with the second device and interact with the second device, and generate second model update parameters based on the received first secret shared data from the second device; and an update unit, used to calculate a weighted average based on the second model update parameters and update the global model parameters using the weighted average; wherein, the goal of generating the second model update parameters is that the sum of the first model update parameters corresponding to the two devices is equal to the product of the second model update parameters corresponding to the two devices.
[0108] The federated learning privacy protection device provided in the embodiments of the present invention may further include: an error control unit, configured to obtain a first error control target of weighted average; and to convert the first error control target into a second error control target represented by the generation parameters of the second model update parameters according to the type of the first key and the type of the first model update parameters. The interaction control unit uses the first key agreed upon with the second device to generate first secret shared data from the first model update parameters and interacts with the second device, and generates second model update parameters based on the received first secret shared data from the second device, including: generating first secret shared data according to the second error control target and interacting with the second device, and generating second model update parameters; the update unit calculates a weighted average based on the second model update parameters, including: calculating a weighted average based on the second error control target and the second model update parameters.
[0109] In this embodiment of the invention, the first key held by the first device includes a first parameter and a third parameter; the first key held by the second device includes a second parameter and a fourth parameter; the product of the first parameter and the second parameter is equal to the sum of the third parameter and the fourth parameter. The interactive control unit uses the first key agreed upon with the second device to generate first secret shared data from the first model update parameters and interacts with the second device. Generating second model update parameters based on the received first secret shared data from the second device can include: the first device calculating a first difference between its local first model update parameters and the third parameter, dividing this difference by a first quotient of the first parameter, and sending the first quotient as the first secret shared data to the second device; the second device calculating a second difference between its local first model update parameters and the fourth parameter, calculating a first sum of the second parameter and the first quotient as its local second model update parameters, calculating a second quotient of the second difference divided by the first sum, and sending the second quotient as the first secret shared data to the first device; and the first device calculating the sum of the second quotient and the first parameter as its local second model update parameters.
[0110] In this embodiment of the invention, the step of generating the first key may include: a first device generating a set of asymmetric keys and sending the first public key of the asymmetric keys to a second device; the first device encrypting a first random value using the first private key of the asymmetric keys and sending the resulting first encryption result to the second device; the second device encrypting a second random value using the first public key to obtain a second encryption result, and calculating a third encryption result based on the first encryption result, the third random value, and the second encryption result, and sending the third encryption result to the first device; the first device decrypting the third encryption result using the first private key to obtain a fourth random value; the first device acquiring a fifth random value agreed upon with the second device, calculating a first parameter based on the fifth random value and the first random value, and calculating a third parameter based on the fifth random value and the fourth random value; the second device calculating a second parameter based on the fifth random value and the third random value, and calculating a fourth parameter based on the fifth random value and the second random value.
[0111] In this embodiment of the invention, the first error control objective can be: the absolute value of the error between the true value of the weighted average and the weighted average is less than the product of the true value of the weighted average and the first error coefficient.
[0112] In this embodiment of the invention, the training unit and the second device participating in federated learning respectively train the global model using local datasets to obtain local first model update parameters. This may include: training the global model using local datasets with the second device to obtain model update data; calculating a first product of the local model update data and the first number of data entries; and using the local first product and the first number of data entries as the first model update parameters. The update unit calculates a weighted average based on the second model update parameters, which may include: calculating the quotient of the second model update parameters corresponding to the local first product divided by the second model update parameters corresponding to the local first number of data entries to obtain local third model update parameters; and calculating the product of the local third model update parameters and the third model update parameters sent by the second device to obtain a weighted average.
[0113] In this embodiment of the invention, the error control unit converts the first error control target into a second error control target represented by the generation parameters of the second model update parameters according to the type of the first key and the type of the first model update parameters. This can include: converting the first error control target into a third error control target and a fourth error control target according to the type of the first key and the type of the first model update parameters; and converting the third error control target and the fourth error control target into corresponding second error control targets respectively. The third error control target is defined as follows: the absolute value of the error of the weighted average true value minus the corresponding secret shared data is less than the product of the weighted average true value and the second error coefficient; the third quotient is the product of the second model update parameters corresponding to the first product of the two devices divided by the product of the second model update parameters corresponding to the first number of records of the two devices; the fourth error control target is defined as the absolute value of the error of the weighted average minus the third quotient is less than the product of the weighted average true value and the second error coefficient; and the second error coefficient is half of the first error coefficient.
[0114] In this embodiment of the invention, the second error control target corresponding to the third error control target can be: the first error is less than twice the absolute value of the corresponding third error coefficient multiplied by the model update data and divided by the corresponding second parameter; wherein, the third error coefficient is determined based on the first error coefficient; corresponding to the process of the first device generating the second model update parameter, the first error is the absolute value of the difference between the first secret shared data calculated by the first device and the fourth quotient, and the fourth quotient is the quotient of the first difference divided by the first parameter; corresponding to the process of the second device generating the second model update parameter, the first error is the absolute value of the difference between the first secret shared data calculated by the second device and the fifth quotient, and the fifth quotient is the quotient of the second difference divided by the first sum.
[0115] In this embodiment of the invention, the second error control objective corresponding to the fourth error control objective can be: the absolute value of the error between the third model update parameter calculated by the first device and the corresponding sixth quotient is less than the product of the fourth error coefficient and the corresponding sixth quotient; the absolute value of the error between the third model update parameter calculated by the second device and the corresponding sixth quotient is less than the product of the fourth error coefficient and the corresponding sixth quotient; wherein, the sixth quotient is the true value of the quotient of the first secret shared data corresponding to the model update data divided by the first secret shared data corresponding to the first number; the fourth error coefficient is determined according to the first error coefficient. In this embodiment of the invention, the training unit and the second device participating in federated learning respectively use local datasets to train the global model to obtain local first model update parameters, which may include: the first device and the second device respectively select local datasets to train the global model to obtain local first model update parameters, and the number of local datasets selected in this round of iterative training is different from that in the previous round of iterative training.
[0116] In this embodiment of the invention, the training unit and the second device participating in federated learning respectively use local datasets to train the global model and obtain local first model update parameters. This may include: in the first round of iterative training, initializing the global model and sending the initial model parameters to the second device; in the second round and subsequent iterative training, training the global model based on the global model parameters obtained in the previous round of iterative training and using local datasets respectively with the second device to obtain local first model update parameters, until the first iteration termination condition is met.
[0117] In this embodiment of the invention, the updating unit calculates a weighted average based on the second model update parameters, and updates the global model parameters using the weighted average. Updating the global model parameters using the weighted average may include: calculating a gradient weighted average and a weight weighted average based on the second model update parameters; and updating the global model parameters based on the gradient weighted average, the weight weighted average, and the model training learning rate.
[0118] For a description of the features in the embodiments corresponding to the federated learning privacy protection device, please refer to the relevant descriptions in the embodiments corresponding to the federated learning privacy protection method, which will not be repeated here.
[0119] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program, the processor being configured to run the computer program to perform the steps in any of the above embodiments of the federated learning privacy protection method.
[0120] Embodiments of the present invention also provide a non-volatile storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above embodiments of the federated learning privacy protection method when it is run.
[0121] In one exemplary embodiment, the aforementioned non-volatile storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.
[0122] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the federated learning privacy protection method.
[0123] Embodiments of the present invention also provide another computer program product, including a non-volatile storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above embodiments of the federated learning privacy protection method.
[0124] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0125] The foregoing has provided a detailed description of the federated learning privacy protection method, device, medium, and computer program product provided by this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of this invention. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of this invention.
Claims
1. A method for protecting privacy in federated learning, characterized in that, The first devices used in federated learning include: The first local model updates its parameters by training the global model on the local dataset, which is used by the second device participating in federated learning. Using the first key agreed upon with the second device, the first model update parameters are used to generate first secret shared data and interact with the second device. The second model update parameters are then generated based on the first secret shared data received from the second device. Calculate the weighted average value based on the second model update parameters, and update the global model parameters using the weighted average value; The goal of generating the second model update parameter is that the sum of the first model update parameters corresponding to the two devices is equal to the product of the second model update parameters corresponding to the two devices.
2. The method for protecting privacy in federated learning according to claim 1, characterized in that, Also includes: The first error control objective for obtaining the weighted average value; Based on the type of the first key and the type of the first model update parameter, the first error control objective is converted into a second error control objective represented by the generation parameter of the second model update parameter; Using a first key agreed upon with the second device, the first model update parameters are used to generate first secret shared data and interact with the second device. The second model update parameters are generated based on the first secret shared data received from the second device. This includes: generating the first secret shared data based on the second error control target and interacting with the second device, and generating the second model update parameters. Calculating the weighted average based on the second model update parameters includes: calculating the weighted average based on the second error control objective and the second model update parameters.
3. The method for protecting privacy in federated learning according to claim 2, characterized in that, The first key held by the first device includes a first parameter and a third parameter; the first key held by the second device includes a second parameter and a fourth parameter; the product of the first parameter and the second parameter is equal to the sum of the third parameter and the fourth parameter; Using a first key agreed upon with the second device, the first model update parameters are used to generate first secret shared data, which is then interacted with the second device. Based on the received first secret shared data from the second device, second model update parameters are generated, including: The first device calculates the first difference between the first model update parameter and the third parameter, divides it by the first quotient of the first parameter, and sends the first quotient as the first secret shared data to the second device. The second device calculates the second difference between the first model update parameter and the fourth parameter, calculates the first sum of the second parameter and the first quotient as the second model update parameter, calculates the second difference divided by the first sum as the second quotient, and sends the second quotient as the first secret shared data to the first device. The first device calculates the sum of the second quotient and the first parameter as the local second model update parameter.
4. The method for protecting privacy in federated learning according to claim 3, characterized in that, The steps for generating the first key include: The first device generates a set of asymmetric keys and sends the first public key of the asymmetric keys to the second device; The first device uses the first private key in the asymmetric key to encrypt the first random value and sends the obtained first encryption result to the second device; The second device uses the first public key to encrypt the second random value to obtain a second encryption result, and calculates a third encryption result based on the first encryption result, the third random value, and the second encryption result, and sends the third encryption result to the first device; The first device uses the first private key to decrypt the third encryption result to obtain a fourth random value; The first device acquires a fifth random value agreed upon with the second device, calculates the first parameter based on the fifth random value and the first random value, and calculates the third parameter based on the fifth random value and the fourth random value; The second device calculates the second parameter based on the fifth random value and the third random value, and calculates the fourth parameter based on the fifth random value and the second random value.
5. The method for protecting privacy in federated learning according to claim 3, characterized in that, The first error control objective is: the absolute value of the error between the true value of the weighted average and the weighted average is less than the product of the true value of the weighted average and the first error coefficient.
6. The method for protecting privacy in federated learning according to claim 5, characterized in that, The first local model update parameters are obtained by training the global model using the local dataset on the second device participating in federated learning, respectively, and the second device also uses the local dataset. The second device and the local dataset are used to train the global model respectively to obtain model update data; Calculate the first product of the local model update data and the first number of the model update data; The first product and the first number of records in the local model are used as the update parameters for the first model. The weighted average is calculated based on the updated parameters of the second model, including: Calculate the quotient of the second model update parameter corresponding to the first product in the local area divided by the second model update parameter corresponding to the first number in the local area to obtain the third model update parameter in the local area. The weighted average value is obtained by multiplying the locally received third model update parameters and the third model update parameters sent by the second device.
7. The method for protecting privacy in federated learning according to claim 6, characterized in that, Based on the type of the first key and the type of the first model update parameters, the first error control objective is converted into a second error control objective represented by the generation parameters of the second model update parameters, including: Based on the type of the first key and the type of the first model update parameter, the first error control objective is converted into a third error control objective and a fourth error control objective; The third error control target and the fourth error control target are respectively converted into the corresponding second error control target; Wherein, the third error control objective is that the absolute value of the error between the weighted average true value and the corresponding secret shared data is less than the product of the weighted average true value and the second error coefficient; the secret shared data corresponding to the weighted average true value is the third quotient of the product of the second model update parameters corresponding to the first product of the two devices divided by the product of the second model update parameters corresponding to the first number of the two devices. The fourth error control objective is that the absolute value of the error between the third quotient and the weighted average is less than the product of the true value of the weighted average and the second error coefficient. The second error coefficient is half of the first error coefficient.
8. The method for protecting privacy in federated learning according to claim 7, characterized in that, The second error control objective corresponding to the third error control objective is: The first error is less than twice the absolute value of the corresponding third error coefficient multiplied by the model update data and divided by the corresponding second parameter; The third error coefficient is determined based on the first error coefficient; Corresponding to the process of the first device generating the second model update parameters, the first error is the absolute value of the difference between the first secret shared data calculated by the first device and the fourth quotient, wherein the fourth quotient is the quotient of the first difference divided by the first parameter; Corresponding to the process of the second device generating the second model update parameters, the first error is the absolute value of the difference between the first secret shared data calculated by the second device and the fifth quotient, wherein the fifth quotient is the quotient of the second difference divided by the first sum.
9. The method for protecting privacy in federated learning according to claim 7, characterized in that, The second error control objective corresponding to the fourth error control objective is: The absolute value of the error between the third model update parameter calculated by the first device and the corresponding sixth quotient is less than the product of the fourth error coefficient and the corresponding sixth quotient. The absolute value of the error between the third model update parameter calculated by the second device and the corresponding sixth quotient is less than the product of the fourth error coefficient and the corresponding sixth quotient. Wherein, the sixth quotient is the truth value of the quotient of the first secret shared data corresponding to the model update data divided by the first secret shared data corresponding to the first number of records; The fourth error coefficient is determined based on the first error coefficient.
10. The method for protecting privacy in federated learning according to claim 1, characterized in that, The first local model update parameters are obtained by training the global model using the local dataset on the second device participating in federated learning, respectively, and the second device also uses the local dataset. The first device and the second device respectively select local datasets to train the global model to obtain the local update parameters of the first model, and the number of local datasets selected in this round of iterative training is different from that in the previous round of iterative training.
11. The method for protecting privacy in federated learning according to claim 1, characterized in that, The first local model update parameters are obtained by training the global model using the local dataset on the second device participating in federated learning, respectively, and the second device also uses the local dataset. In the first round of iterative training, the global model is initialized and the initial model parameters are sent to the second device; In the second and subsequent iterations of training, both the first model and the second device use their local datasets to train based on the global model parameters obtained in the previous iteration, thus obtaining the local update parameters of the first model until the first iteration termination condition is met.
12. The method for protecting privacy in federated learning according to claim 11, characterized in that, Calculate a weighted average based on the second model update parameters, update the global model parameters using the weighted average, and update the global model parameters using the weighted average, including: Calculate the gradient-weighted average and the weight-weighted average based on the updated parameters of the second model; The global model parameters are updated based on the gradient-weighted average, the weight-weighted average, and the model training learning rate.
13. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for implementing the steps of the federated learning privacy protection method as described in any one of claims 1 to 12 when executing the computer program.
14. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the federated learning privacy protection method as described in any one of claims 1 to 12.
15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the federated learning privacy protection method as described in any one of claims 1 to 12.