Privacy-preserving federated learning method for high spatiotemporal flux medical data

Abstract

The application provides a privacy protection federated learning method for high spatiotemporal flux medical data, and belongs to the technical field of medical information intelligent processing. The technical scheme comprises the following steps: S10, a central server broadcasts a current global model to each participating client, and each client locally trains the model; S20, the client adds Gaussian noise to the model parameter update; S30, in each round of training, the client aligns the local features extracted by itself with the global feature prototype; S40, the parameters with low importance are scaled. The application has the beneficial effects of effectively alleviating the problem of model performance decline caused by differential privacy noise of medical institutions, and improving the clinical prediction accuracy of federated learning under the condition of privacy protection.

Description

Technical Field

[0001] This invention relates to the field of intelligent medical information processing technology, specifically to a privacy-preserving federated learning method for high spatiotemporal throughput medical data. Technical Background

[0002] Machine learning (ML) is transforming clinical practice, finding applications in areas such as preclinical data analysis, real-time diagnostic support, patient outcome prediction modeling, treatment planning, and early intervention strategies for disease prevention. To provide these services, the large neural networks driving intelligent clinical predictions typically require vast amounts of clinical data for training. However, traditional centralized data collection methods raise patient privacy concerns, hindering their real-world application.

[0003] Federated learning (FL) is a distributed learning approach that offers a promising solution to these challenges. Under the FL algorithm, participants can train models locally and share only model updates, facilitating data fusion and global aggregation.

[0004] Currently, numerous high spatiotemporal throughput medical data processing, healthcare system, and intelligent clinical prediction applications based on federated learning have been proposed, such as gastric adenocarcinoma detection, personalized skin diagnosis, and medical image segmentation. These applications aim to improve regulatory compliance, enhance system credibility, and safeguard data sovereignty. However, the distribution, format, and quality of data collected by different institutions vary significantly, and existing methods exhibit a marked performance degradation in handling data heterogeneity and non-independent identically distributed data. Summary of the Invention

[0005] To address the aforementioned technical issues, this invention provides a privacy-preserving federated learning method for high spatiotemporal throughput medical data. During the model training phase, a feature alignment strategy is proposed. By maintaining and updating the global feature prototype for each class, the local model is guided to learn feature representations consistent with the global model, thereby mitigating the feature drift problem caused by data heterogeneity. A parameter scaling strategy is introduced to scale low-information parameters that are significantly affected by differential privacy noise, thus maintaining model performance while ensuring privacy. This method has strong application value for privacy protection of non-independent and identically distributed medical data.

[0006] The inventive concept of this invention is as follows: First, the central server broadcasts the current global model to each participating client with high spatiotemporal throughput medical data, and each client trains the deep model on its local dataset; then, the client adds Gaussian noise to update its model parameters; next, in each round of training, the client is guided to align its extracted local features with the global feature prototype; finally, the Fisher information matrix is ​​introduced to evaluate the importance of each parameter, and the parameters with low importance are scaled.

[0007] This invention is achieved through the following measures: a privacy-preserving federated learning method for high spatiotemporal throughput medical data, comprising the following steps:

[0008] S10: The central server broadcasts the current global model to each participating client with high spatiotemporal throughput medical data, and each client trains a deep model on its local dataset.

[0009] S20: The client prunes the updated values ​​of its model parameters and injects Gaussian noise with zero mean and fixed variance into the pruned update according to the Gaussian mechanism.

[0010] S30: During training, the client aligns its extracted features with the global feature prototype of the corresponding category by introducing a feature alignment loss term.

[0011] S40: Introduce the Fisher information matrix to evaluate the importance of each parameter in the extraction layer, measure the model's sensitivity to features, and scale the model parameters.

[0012] Further, step S10 includes the following steps:

[0013] S11: Suppose there are N medical institutions participating in a classification learning task with C categories, and each institution has a local clinical dataset D. n = {x, y}, where This represents the data in the input space. This represents the corresponding label in the output space. The optimal global model is represented as w. * It is the learning objective that all clients collaboratively train. The weight p for each client... n The calculation formula is determined by the size of its dataset:

[0014]

[0015] This weight satisfies the following constraints: function The loss function for client n is represented by the global objective function:

[0016]

[0017] S12: At global learning round t, each client updates its local model after receiving the global model (denoted as ). Pruning is performed using a pruning factor C, which limits the update magnitude between local and global model parameters. The update formula is as follows:

[0018]

[0019] Further, step S20 includes the following steps:

[0020] S21: To provide privacy protection, participants introduce differential privacy (DP) noise into their models before uploading updates. DP noise is defined as follows: If a mechanism M satisfies (∈,δ) differential privacy, that is, for any two adjacent datasets D and D′ (adjacent datasets differ by at most one record), and any output set S, the following relationship holds:

[0021] Pr[M(D)∈S]≤e ∈ Pr[M(D′)∈S]+δ (15)

[0022] In this method, a Gaussian mechanism is used to protect privacy. Specifically, each client n adds Gaussian noise to its model update, as follows: where σ is the noise multiplication factor, and I represents a unit Gaussian noise vector with the same dimension as the model parameters. The update after adding noise is expressed as:

[0023]

[0024] S22: To quantify the maximum impact of data perturbation, the l2 norm sensitivity from the Gaussian mechanism is introduced. Let the function f be a mapping from the dataset D to... If D and D′ are a pair of adjacent datasets (i.e., differing by at most one record), then the l2 norm sensitivity of this Gaussian mechanism is defined as:

[0025] Δ = max D,D′ ||f(D)-f(D′)||2 (17)

[0026] S23: To implement the (∈,δ)-differential privacy protection mechanism, the client injects noise using a Gaussian mechanism before uploading the model parameters. According to the privacy guarantee theorem of the Gaussian mechanism, the standard deviation of the added noise satisfies a certain condition, i.e., σ≥c|Δf| / ∈, where At that time, the mechanism can ensure that the whole satisfies (∈,δ)-DP.

[0027] Further, step S30 includes the following steps:

[0028] S31: In each round of learning, the FedFAF server will combine the global model w and global features. (Initialized to 0 in round 0), when w and At that time, client n accesses private data D n The model is trained locally, and the optimal model w is generated by minimizing the following objective function F(·). * :

[0029]

[0030] in Here ε(w) n,ε D n The ) indicates that the feature statistics extraction module is used for the given data D n ;

[0031] S32: Introduce a feature alignment term G(·) based on this statistic to align each client's features with the global features. Considering that the current scene contains C categories, the client will receive C global features. And compare each input with global features of the same category. Alignment is performed. The hyperparameter λ controls the strength of the alignment. After local training is complete, each client uploads its features, including the global features. The update will be performed by averaging the features received from the same category, as formally represented below:

[0032]

[0033] in

[0034] Further, step S40 includes the following steps:

[0035] S41: Calculate the feature extraction layer w ε The Fisher information value is defined as:

[0036]

[0037] Where t represents the global training round. Represents the log-likelihood function corresponding to ε(·). The Fisher information matrix is ​​used to quantify the amount of information contained in the model feature representation of differential privacy (DP) noise. A higher Fisher information value indicates that the feature representation contains more useful information, which helps to improve the training effect of the model and improve its overall performance.

[0038] S42: In order to map the calculated Fisher information matrix to a bounded range and more accurately characterize the feature representation and parameters To determine the relationship between the two, this method employs the following preprocessing steps:

[0039]

[0040] S43: Through a parameter scaling mechanism, parameters that are significantly affected by noise and have low Fisher information are downscaled. For each parameter, its Fisher information value is compared with a preset threshold Γ to determine its scaling ratio, as follows:

[0041]

[0042] Where ⊙ represents the Hadamard product and τ is the scaling factor.

[0043] S44: At the end of local training, each institution uploads its local model parameters and category features to the server. The server merges all received local models to generate an updated global model. This global model is then broadcast to all participants to start the next round of training, until a preset maximum number of rounds is reached, at which point the training accuracy for each client is output.

[0044] The technical solution of the present invention has the following advantages compared with the prior art:

[0045] 1. A privacy-preserving federated learning method for high spatiotemporal throughput medical data proposes a feature alignment strategy. By maintaining global features for each data class and aligning them with local features, this significantly alleviates feature drift caused by non-IID distributions. This technique enhances the awareness of global distribution among participating models, improves feature representation consistency, and enhances model accuracy in non-IID data scenarios.

[0046] 2. This invention introduces a parameter scaling strategy based on Fisher information. By reducing the parameters with lower feature information that are most affected by noise, performance loss is effectively reduced while meeting differential privacy requirements. The privacy-preserving model of this technology can maintain near-noise-free performance and improve robustness even under strong privacy protection conditions.

[0047] 3. This invention proposes a FedFAF algorithm that combines feature alignment and parameter scaling to achieve privacy-preserving federated learning under non-IID conditions in the context of high spatiotemporal throughput medical data. This technique improves the model's adaptability to heterogeneous data distribution and enhances data security. Attached Figure Description

[0048] The technical solution and its beneficial effects of the present invention will become apparent from the following detailed description of specific embodiments in conjunction with the accompanying drawings.

[0049] Figure 1 The diagram shown is a flowchart of a privacy-preserving federated learning method for high spatiotemporal throughput medical data in an embodiment of this application.

[0050] Figure 2 The diagram shown is a block diagram of a privacy-preserving federated learning method for high spatiotemporal throughput medical data in an embodiment of this application.

[0051] Figure 3 The diagram shown is a model diagram of the client-side federated learning method for privacy protection in high spatiotemporal throughput medical data according to an embodiment of this application.

[0052] Figure 4 The diagram shown is a schematic representation of the data in the input space in an embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Example 1

[0055] This embodiment provides a privacy-preserving federated learning method for high spatiotemporal throughput medical data, such as... Figures 1-3 As shown, it includes the following steps:

[0056] S10: The central server broadcasts the current global model to each participating client with high spatiotemporal throughput medical data, and each client trains a deep model on its local dataset.

[0057] S20: The client prunes the updated values ​​of its model parameters and injects Gaussian noise with zero mean and fixed variance into the pruned update according to the Gaussian mechanism.

[0058] S30: During training, the client aligns its extracted features with the global feature prototype of the corresponding category by introducing a feature alignment loss term.

[0059] S40: Introduce the Fisher information matrix to evaluate the importance of each parameter in the extraction layer, measure the model's sensitivity to features, and scale the model parameters.

[0060] Specifically, step S10 includes the following steps:

[0061] S11: Suppose there are 10 medical institutions participating in a classification learning task with 10 categories, and each institution has a local clinical dataset D. n = {x, y}, where This represents the data in the input space. This represents the corresponding label in the output space, and the data in the input space is as follows: Figure 4 As shown. The optimal global model is represented by w. * It is the learning objective for collaborative training by all clients, and the weight p of each client is... n The calculation formula is determined by the size of its dataset:

[0062]

[0063] This weight satisfies the following constraints: function The loss function for client n is represented by the global objective function:

[0064]

[0065] S12: At global learning round t, each client updates its local model after receiving the global model (denoted as ). Pruning is performed using a pruning factor C, which limits the update magnitude between local and global model parameters. The update formula is as follows:

[0066]

[0067] Specifically, step S20 includes the following steps:

[0068] S21: To provide privacy protection, participants introduce differential privacy (DP) noise into their models before uploading updates. DP noise is defined as follows: If a mechanism M satisfies (∈,δ) differential privacy, that is, for any two adjacent datasets D and D′ (adjacent datasets differ by at most one record), and any output set S, the following relationship holds:

[0069] Pr[M(D)∈S]≤e ∈ Pr[M(D′)∈S]+δ (26)

[0070] In this method, a Gaussian mechanism is used to protect privacy. Specifically, each client n adds Gaussian noise to its model update, as follows: where σ is the noise multiplication factor, and I represents a unit Gaussian noise vector with the same dimension as the model parameters. The update after adding noise is expressed as:

[0071]

[0072] S22: To quantify the maximum impact of data perturbations, the l2 norm sensitivity from the Gaussian mechanism is introduced. Let function f map from dataset D to... If D and D′ are a pair of adjacent datasets (i.e., differing by at most one record), then the l2 norm sensitivity of this Gaussian mechanism is defined as:

[0073] Δ = max D,D′ ||f(D)-f(D′)||2 (28)

[0074] S23: To implement the (∈,δ)-differential privacy protection mechanism, the client injects noise using a Gaussian mechanism before uploading the model parameters. According to the privacy guarantee theorem of the Gaussian mechanism, the standard deviation of the added noise satisfies a certain condition, i.e., σ≥c|Δf| / ∈, where At that time, the mechanism can ensure that the whole satisfies (∈,δ)-DP.

[0075] Specifically, step S30 includes the following steps:

[0076] S31: In each round of learning, the FedFAF server will combine the global model w and global features. (Initialized to 0 in round 0), when w and At that time, client n accesses private data D n The model is trained locally, and the optimal model w is generated by minimizing the following objective function F(·). * :

[0077]

[0078] in Here ε(w) n,ε D n The ) indicates that the feature statistics extraction module is used for the given data D n ;

[0079] S32: Introduce a feature alignment term G(·) based on this statistic to align each client's features with the global features. Considering that the current scene contains C categories, the client will receive C global features. And compare each input with global features of the same category. Alignment is performed. The hyperparameter λ controls the strength of the alignment. After local training is complete, each client uploads its features, including the global features. The update will be performed by averaging the features received from the same category. The formal representation is as follows:

[0080]

[0081] in

[0082] Specifically, step S40 includes the following steps:

[0083] S41: Calculate the feature extraction layer w ε The Fisher information value is defined as:

[0084]

[0085] Where t represents the global training round. Represents the log-likelihood function corresponding to ε(·). The Fisher information matrix is ​​used to quantify the amount of information contained in the model feature representation of differential privacy DP noise. A higher Fisher information value indicates that the feature representation contains more useful information, which helps to improve the training effect of the model and improve its overall performance.

[0086] S42: In order to map the calculated Fisher information matrix to a bounded range and more accurately characterize the feature representation and parameters To determine the relationship between the two, this method employs the following preprocessing steps:

[0087]

[0088] S43: Through a parameter scaling mechanism, parameters that are significantly affected by noise and have low Fisher information are downscaled. For each parameter, its Fisher information value is compared with a preset threshold Γ to determine its scaling ratio, as follows:

[0089]

[0090] Where ⊙ represents the Hadamard product and τ is the scaling factor.

[0091] S44: At the end of local training, each institution uploads its local model parameters and category features to the server. The server merges all received local models to generate an updated global model. This global model is then broadcast to all participants to start the next round of training until the preset maximum number of rounds is reached, at which point the training accuracy of 10 clients is output as [80.2, 82.2, 82.3, 83.3, 83.4, 83.8, 83.6, 83.8, 84.2, 84.0, 84.2, 84.5, 84.4, 84.1, 84.3].

[0092] Example 2

[0093] Referring to Example 1, this example uses the parameters and results calculated in Example 1 to compare with traditional methods, demonstrating the superiority of this example. In the specific comparison, we employed different models and compared different indicators. The final results show that this example is preferred over the comparison methods.

[0094] 1. Comparison Algorithm

[0095] DP-FedAvg model: A basic FL algorithm that averages gradients from all clients. Disadvantages: While DP-FedAvg is a benchmark algorithm for privacy-preserving federated learning and provides basic privacy guarantees in data isolation scenarios, it still has the following significant drawbacks that limit its effectiveness in complex scenarios.

[0096] The DP-FedSAM model utilizes a sharpness-aware optimizer to smooth gradient landscapes and mitigate the impact of differential privacy noise. However, DP-FedSAM relies on server-side clustering of client data to alleviate data heterogeneity. In real-world scenarios, client data distribution changes dynamically, making it difficult for fixed clustering strategies to adapt in real-time, leading to the failure of personalized classifiers.

[0097] The DP-FedDPA model addresses clipping instability in differential privacy by using hierarchical Fisher information and employs two regularization techniques to personalize parameters and improve convergence. However, its drawbacks include: the forced uniformity of privacy parameters makes it unsuitable for varying client data distributions, exacerbating feature space misalignment and reducing model generalization in highly heterogeneous scenarios such as medical imaging.

[0098] 2. Configuration Details

[0099] This patent uses PyTorch to implement the algorithm, and each baseline algorithm is evaluated on 10 clients. The experimental settings are as follows: learning rate (lr) is set to 0.001, batch size is 64, global training epochs are 10, and local training epochs are 4. Differential privacy parameters include a clipping factor (C) of 0.5 and δ of 0. The scaling trap gate (Γ) is 0.4, and β is 0.02.

[0100] 3. Comparison Results

[0101] Experiments show that the FedFAF algorithm of this patent achieves the best learning performance and highest test accuracy across all settings. Specifically, FedFAF achieves approximately 87%, 58%, and 84% accuracy on IID FashionMNIST, CIFAR-10, and SVHN, respectively. In the extreme setting (α = 0.3), FedFAF maintains test accuracy of 59%, 30%, and 42%, demonstrating its state-of-the-art (SOTA) effectiveness. In contrast, although the DP-FedSAM and DP-FedDPA algorithms show improvements over DP-FedAvg in some scenarios, their overall performance remains unsatisfactory. Table 1 compares the learning performance of different federated learning (FL) algorithms under various data distribution settings.

[0102] Table 1

[0103]

[0104] The above description is merely an exemplary embodiment of the present invention and does not limit the scope of patent protection of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A privacy-preserving federated learning method for high spatiotemporal throughput medical data, characterized in that, Includes the following steps: S10: The central server broadcasts the current global model to each participating client with high spatiotemporal throughput medical data, and each client trains a deep model on its local dataset. S20: The client prunes the updated values ​​of its model parameters and injects Gaussian noise with zero mean and fixed variance into the pruned update according to the Gaussian mechanism. S30: During training, the client aligns its extracted features with the global feature prototype of the corresponding category by introducing a feature alignment loss term. Step S30 includes the following steps: S31: In each round of learning, the FedFAF server will globally model... and global features Initialized to 0 in round 0, when received and At that time, the client Through private data The model is trained locally and minimized by the following objective function. Generate the optimal model : ； in , The feature statistics extraction module is used for the given data. ; S32: Introduce a feature alignment term based on this statistic. To align the features of each client with global features, the current scene includes The client will receive [number] categories. Global features And compare each input with global features of the same category. Alignment, hyperparameters Used to control the strength of alignment, each client uploads its features after local training is complete, along with global features. The update is performed by averaging the features received from the same category, as formally represented below: ； in ; S40: Introduce the Fisher information matrix to evaluate the importance of each parameter in the extraction layer, measure the model's sensitivity to features, and scale the model parameters. Step S40 includes the following steps: S41: Calculate the feature extraction layer The Fisher information value is defined as: ； in Indicates the global training round. Indicates and The corresponding log-likelihood function and Fisher information matrix are used to quantify the amount of information contained in the model feature representation of differential privacy DP noise; S42: Map the calculated Fisher information matrix to a bounded range and characterize the feature representation and parameters. To determine the relationship between the two, this method employs the following preprocessing steps: ； S43: Through a parameter scaling mechanism, for each parameter, its Fisher information value will be compared with a preset threshold. The scaling ratio is determined by comparison, as follows: ； in This represents the Hadamard product. This is the scaling factor; S44: At the end of local training, each institution uploads its local model parameters and category features to the server. The server merges all received local models to generate an updated global model. This global model will be broadcast to all participants again to start the next round of training until the preset maximum number of rounds is reached, at which point the training accuracy of each client will be output.

2. The privacy-preserving federated learning method for high spatiotemporal throughput medical data according to claim 1, characterized in that, Step S10 includes the following steps: S11: Assume there is A medical institution participates in a The classification learning task involves categories, with each institution possessing a local clinical dataset. ,in This represents the data in the input space. Representing the corresponding label in the output space, the optimal global model representation is: It is the learning objective for collaborative training by all clients, and the weights of each client. The calculation formula is determined by the size of its dataset: ； This weight satisfies the following constraints: ,function The loss function for client n is represented by the global objective function: ； S12: In the global learning cycle At that time, after receiving the global model, each client will prune the update of its local model, denoted as . The clipping uses a clipping factor. This factor limits the update range between local and global model parameters. The update formula is as follows: 。 3. The privacy-preserving federated learning method for high spatiotemporal throughput medical data according to claim 1, characterized in that, Step S20 includes the following steps: S21: Participants introduce differential privacy (DP) noise into their models before uploading updates, defined as: if a mechanism satisfy Differential privacy refers to the privacy of any two adjacent datasets. and Adjacent datasets refer to datasets that differ by at most one record, and any set of outputs. There is a related formula: ； A Gaussian mechanism is used to protect privacy for each client. Gaussian noise is added to the model update as follows, where... It is the noise multiplication factor. Let a unit Gaussian noise vector have the same dimension as the model parameters be represented. The update expression after adding noise is: ； S22: Introducing the Gaussian mechanism Norm sensitivity, let the function From the dataset Mapped to The function, and It is a pair of adjacent datasets, and the Gaussian mechanism is... Norm sensitivity is defined as: ； S23: In order to achieve - Differential privacy protection mechanism: Before uploading model parameters, the client injects noise using a Gaussian mechanism. According to the privacy guarantee theorem of the Gaussian mechanism, when the standard deviation of the added noise meets the condition... ,in At the same time, the mechanism ensures overall satisfaction. -DP.

Images