Federal learning cold start method and system based on FPGA dynamic watermark

Abstract

The invention discloses a federated learning cold start method and system based on an FPGA dynamic watermark, and the method comprises the following steps: 1, obtaining a preset watermark bit stream at an edge node of a client, and relates to the technical field of federated learning and privacy calculation crossing. According to the method, the watermark bit stream is embedded into the low level of the shadow vector through the FPGA watermark embedding device by adopting the differential pulse code modulation, so that the watermark information carried by the embedded watermark bit stream has the anti-noise capability, the watermark embedding strength lambda is dynamically adjustable, the dynamic self-adaptive adjustment of the watermark strength is realized, and the watermark embedding efficiency is improved. Therefore, the anti-stripping capability of the watermark is enhanced, and model pruning, fine tuning and DLG reverse attack can be effectively resisted.

Description

Technical Field

[0001] This invention relates to the field of federated learning and privacy computing, and in particular to a cold start method and system for federated learning based on FPGA dynamic watermarking. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, provides an effective way to break down data silos and protect user privacy by training models locally and uploading only the model parameters instead of the raw data.

[0003] CN114580665B discloses a federated learning system, method, apparatus, device, and storage medium, comprising: multiple terminal devices, each terminal device having a trusted execution environment; one terminal device possessing an initial model acting as the active party, and the other terminal devices not possessing the initial model acting as participants; the active party sends the initial model to each participant and trains the initial model based on a first training sample to obtain a first training model; each participant trains the initial model based on a second training sample set to obtain a second training model, and sends the second training model to the active party; the active party fuses model parameters and updates the parameters of the initial model, and sends the updated initial model to each participant until the target model is obtained.

[0004] However, the above applications still have the following problems: During the cold start phase, each participant, i.e., each client, has a limited amount of data. To accelerate initialization, they currently rely on uploading raw client data or encrypted gradients. However, such methods are vulnerable to deep gradient leakage attacks, where attackers can infer the original training data from the shared gradient information, posing a privacy risk. To prevent unauthorized use of the model, some solutions use software watermarking for copyright authentication. However, software watermarks are usually embedded in the model weights and are easily removed or destroyed through model pruning and fine-tuning operations, failing to provide continuous and effective copyright protection for the model. Furthermore, the strength of existing watermarks is mostly a fixed value, unable to adaptively adjust according to the dynamic and distributed training environment of federated learning. This leads to a decrease in their protective capabilities in complex and ever-changing real-world scenarios, making software watermarks susceptible to removal by model pruning or fine-tuning attacks and unable to dynamically adapt to the federated learning environment. Summary of the Invention

[0005] To address the technical problems existing in the background art, this invention proposes a federated learning cold start method and system based on FPGA dynamic watermarking.

[0006] The cold start method for federated learning based on FPGA dynamic watermarking proposed in this invention includes the following steps: Step 1: At the client edge node, obtain the preset watermark bitstream, which is used to represent copyright information; the temperature T is collected in real time by the temperature sensor, and the training time Δt of this round of federated learning is obtained by the timer. Based on the temperature T and the training time Δt, the watermark embedding strength λ is generated. As an explanation, the watermark strength λ is a control parameter applied to the watermark bitstream; Step 2: Obtain the gradient or features generated by the local training model as the shadow vector. With a dynamically adjustable watermark embedding intensity λ, use the FPGA watermark embedder to embed the watermark bit stream into the low bits of the shadow vector using differential pulse code modulation to generate a watermarked shadow vector. For clarification, a locally trained model refers to a model that the client downloads from the federated learning global server and trains locally; the low-order bits of the shadow vector refer to the least significant bits of each value in the shadow vector. Step 3: Receive watermarked shadow vectors from the client through the cloud center, and use the cloud center to drive the generative adversarial network to generate synthetic corpus for cold start of federated learning based on the watermarked shadow vectors. As an explanation, the generative adversarial network in the cloud center uses multiple watermarked shadow vectors as learning materials and driving conditions to generate synthetic corpora that approximate the distribution of real data in terms of statistical features. Step 4: In the cloud center, an initial model is obtained by training with synthetic corpus. The initial model is then fine-tuned through model-independent meta-learning to complete the cold start of federated learning.

[0007] Preferably, in step one, the watermark embedding strength λ is generated based on the temperature T and the training duration Δt, as follows: Watermark embedding strength λ = a·temperature T + b·training duration Δt; Wherein, the value of a ranges from 0.04 to 0.02, the value of b ranges from 0.015 to 0.005, the value of temperature T ranges from 20℃ to 40℃, and the value of training duration Δt ranges from 0 to 20 minutes.

[0008] Preferably, in step one, when the temperature T is greater than 30℃ or the training duration Δt is greater than 20 minutes, the watermark intensity λ is automatically increased by X%; The value of X ranges from 5 to 15.

[0009] Preferably, in step three, the generative adversarial network is a progressive generative adversarial network, which includes a spectrum normalization layer and an adaptive instance normalization layer.

[0010] Preferably, in step three, the generated synthetic corpus satisfies an FID score of no more than 15.

[0011] Preferably, in step four, fine-tuning the initial model through model-independent meta-learning includes: performing 1 to 3 rounds of local updates using model-independent meta-learning.

[0012] Preferably, in step one, the watermark bitstream is a binary sequence of length 128 bits, and in step two, the shadow vector is a 4096-dimensional vector.

[0013] A federated learning cold start system based on FPGA dynamic watermarking includes: Watermark embedding strength generation module: At the client edge node, a preset watermark bitstream is obtained, which is used to represent copyright information; the temperature T is collected in real time by a temperature sensor, and the training duration Δt of this round of federated learning is obtained by a timer. Based on the temperature T and the training duration Δt, the watermark embedding strength λ is generated. Watermarked Shadow Vector Generation Module: Obtain the gradient or features generated by the local training model as the shadow vector, and embed the watermark bit stream into the low bit of the shadow vector using the FPGA watermark embedder with the dynamically adjustable watermark embedding intensity λ and differential pulse code modulation, thereby generating a watermarked shadow vector. Synthetic Corpus Generation Module: Receives watermarked shadow vectors from clients via the cloud center, and uses the cloud center to drive a generative adversarial network to generate synthetic corpus for cold start of federated learning based on the watermarked shadow vectors. Federated learning cold start module: In the cloud center, an initial model is obtained by training with synthetic corpus, and the initial model is fine-tuned by model-independent meta-learning to complete the cold start of federated learning.

[0014] The FPGA-based dynamic watermarking-based federated learning cold start method and system proposed in this invention have the following beneficial technical effects: 1. This application uses a FPGA watermark embedder to embed the watermark bitstream into the low bits of the shadow vector using differential pulse code modulation, which enables the watermark information carried by the embedded watermark bitstream to have noise resistance. Moreover, the watermark embedding strength λ is dynamically adjustable, realizing dynamic adaptive adjustment of the watermark strength to cope with different hardware environment temperatures and training stages, thereby enhancing the watermark's anti-peeling ability and effectively resisting model pruning, fine-tuning and DLG reverse attacks.

[0015] 2. This application mitigates the risk of privacy leakage by generating and uploading watermarked shadow vectors instead of the original data, while providing higher-quality input for the synthetic corpus generated by generative adversarial networks in the cloud center. This greatly alleviates the problem of insufficient data in the cold start phase, thereby significantly improving the initialization efficiency of federated learning while ensuring security. Attached Figure Description

[0016] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0017] Embodiments of the present invention are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar symbols denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0018] like Figure 1 The FPGA-based dynamic watermarking-based federated learning cold start method shown includes the following steps: Step 1: At the client edge node, obtain the preset watermark bitstream, which is used to represent copyright information; the temperature T is collected in real time by the temperature sensor, and the training time Δt of this round of federated learning is obtained by the timer. Based on the temperature T and the training time Δt, the watermark embedding strength λ is generated. As an explanation, the watermark strength λ is a control parameter applied to the watermark bitstream; Step 2: Obtain the gradient or features generated by the local training model as the shadow vector. With a dynamically adjustable watermark embedding intensity λ, use the FPGA watermark embedder to embed the watermark bit stream into the low bits of the shadow vector using differential pulse code modulation to generate a watermarked shadow vector. As an illustration, differential pulse code modulation is used to make the information carried by the watermark bitstream noise-resistant when it is embedded. In an optional embodiment, the noise resistance is not less than 35dB. The FPGA watermark embedder is a dedicated hardware circuit that is already integrated into the field programmable gate array chip of the client edge node. For clarification, a locally trained model refers to a model that the client downloads from the federated learning global server and trains locally; the low-order bits of the shadow vector refer to the least significant bits of each value in the shadow vector. Step 3: Receive watermarked shadow vectors from the client through the cloud center, and use the cloud center to drive the generative adversarial network to generate synthetic corpus for cold start of federated learning based on the watermarked shadow vectors. As an explanation, the generative adversarial network in the cloud center uses multiple watermarked shadow vectors as learning materials and driving conditions to generate synthetic corpora that approximate the distribution of real data in terms of statistical features. Step 4: In the cloud center, an initial model is obtained by training with synthetic corpus. The initial model is then fine-tuned through model-independent meta-learning to complete the cold start of federated learning.

[0019] In an optional embodiment, in step one, the watermark embedding strength λ is generated based on the temperature T and the training duration Δt, as follows: Watermark embedding strength λ = a·temperature T + b·training duration Δt; Wherein, the value of a ranges from 0.04 to 0.02, the value of b ranges from 0.015 to 0.005, the value of temperature T ranges from 20℃ to 40℃, and the value of training duration Δt ranges from 0 to 20 minutes; In an optional embodiment, a = 0.03, b = 0.01; In an optional embodiment, in step one, when the temperature T is greater than 30°C or the training duration Δt is greater than 20 minutes, the watermark intensity λ is automatically increased by X%; Where X takes values ​​ranging from 5 to 15; In an optional embodiment, X=10; This application uses a FPGA watermark embedder to embed the watermark bitstream into the low bits of the shadow vector using differential pulse code modulation. This makes the watermark information carried by the embedded watermark bitstream noise resistant, and the watermark embedding strength λ is dynamically adjustable, realizing dynamic adaptive adjustment of the watermark strength to cope with different hardware environment temperatures and training stages. This enhances the watermark's resistance to stripping and can effectively resist model pruning, fine-tuning, and DLG reverse engineering attacks.

[0020] In an optional embodiment, in step three, the generative adversarial network is a progressive generative adversarial network, which includes a spectrum normalization layer and an adaptive instance normalization layer.

[0021] In an optional embodiment, in step three, the generated synthetic corpus satisfies an FID score of no more than 15.

[0022] In an optional embodiment, step four, fine-tuning the initial model through model-independent meta-learning, includes performing one to three rounds of local updates using model-independent meta-learning.

[0023] In an optional embodiment, in step one, the watermark bitstream is a binary sequence of length 128 bits, and in step two, the shadow vector is a 4096-dimensional vector.

[0024] The method described in this application can be applied to federated learning cold start scenarios in medical imaging, financial risk control, or government data processing.

[0025] This application mitigates the risk of privacy breaches by generating and uploading watermarked shadow vectors instead of the original data, while providing higher-quality input for the synthetic corpus generated by generative adversarial networks in the cloud center. This greatly alleviates the problem of insufficient data during the cold start phase, thereby significantly improving the initialization efficiency of federated learning while ensuring security.

[0026] like Figure 2The FPGA-based dynamic watermarking federated learning cold start system shown includes: Watermark embedding strength generation module: At the client edge node, a preset watermark bitstream is obtained, which is used to represent copyright information; the temperature T is collected in real time by a temperature sensor, and the training duration Δt of this round of federated learning is obtained by a timer. Based on the temperature T and the training duration Δt, the watermark embedding strength λ is generated. Watermarked Shadow Vector Generation Module: Obtain the gradient or features generated by the local training model as the shadow vector, and embed the watermark bit stream into the low bit of the shadow vector using the FPGA watermark embedder with the dynamically adjustable watermark embedding intensity λ and differential pulse code modulation, thereby generating a watermarked shadow vector. Synthetic Corpus Generation Module: Receives watermarked shadow vectors from clients via the cloud center, and uses the cloud center to drive a generative adversarial network to generate synthetic corpus for cold start of federated learning based on the watermarked shadow vectors. Federated learning cold start module: In the cloud center, an initial model is obtained by training with synthetic corpus, and the initial model is fine-tuned by model-independent meta-learning to complete the cold start of federated learning.

[0027] For clarification, "acquisition" in this application refers to obtaining the required content or data using existing technical means.

[0028] Furthermore, any content not described in detail in this specification is existing technology known to those skilled in the art.

[0029] In the embodiments provided by this invention, it should be understood that the disclosed system or method can be implemented in other ways. For example, the embodiments of the invention described above are merely illustrative; for instance, the division of modules is only a logical functional division, and there may be other division methods in actual implementation.

[0030] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0031] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in the form of hardware plus software functional modules.

[0032] For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the basic characteristics of the present invention.

[0033] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cold-start method for federated learning based on FPGA dynamic watermarking, characterized in that, Includes the following steps: Step 1: At the client edge node, obtain the preset watermark bit stream, collect the temperature T in real time through the temperature sensor, obtain the training duration Δt of this round of federated learning through the timer, and generate the watermark embedding strength λ based on the temperature T and the training duration Δt. Step 2: Obtain the gradient or features generated by the local training model as the shadow vector. With the watermark embedding intensity λ, use the FPGA watermark embedder to embed the watermark bit stream into the low bits of the shadow vector using differential pulse code modulation to generate a watermarked shadow vector. Step 3: Receive watermarked shadow vectors from the client through the cloud center, and use the cloud center to drive the generative adversarial network to generate synthetic corpus for cold start of federated learning based on the watermarked shadow vectors. Step 4: In the cloud center, an initial model is obtained by training with synthetic corpus. The initial model is then fine-tuned through model-independent meta-learning to complete the cold start of federated learning.

2. The FPGA-based dynamic watermarking-based federated learning cold start method according to claim 1, characterized in that, In step one, the watermark embedding strength λ is generated based on the temperature T and the training duration Δt, as follows: Watermark embedding strength λ = a·temperature T + b·training duration Δt; Wherein, the value of a ranges from 0.04 to 0.02, the value of b ranges from 0.015 to 0.005, the value of temperature T ranges from 20℃ to 40℃, and the value of training duration Δt ranges from 0 to 20 minutes.

3. The FPGA-based dynamic watermarking-based federated learning cold start method according to claim 2, characterized in that, In step one, when the temperature T is greater than 30℃ or the training duration Δt is greater than 20 minutes, the watermark intensity λ is automatically increased by X%; The value of X ranges from 5 to 15.

4. The FPGA-based dynamic watermarking-based federated learning cold start method according to claim 1, characterized in that, In step three, the generative adversarial network is a progressive generative adversarial network, which includes a spectrum normalization layer and an adaptive instance normalization layer.

5. The FPGA-based dynamic watermarking-based federated learning cold start method according to claim 1, characterized in that, In step three, the generated synthetic corpus satisfies the condition that the FID score is no greater than 15.

6. The FPGA-based dynamic watermarking-based federated learning cold start method according to claim 1, characterized in that, In step four, fine-tuning the initial model through model-independent meta-learning includes performing 1 to 3 rounds of local updates using model-independent meta-learning.

7. The FPGA-based dynamic watermarking-based federated learning cold start method according to claim 1, characterized in that, In step one, the watermark bitstream is a 128-bit binary sequence, and in step two, the shadow vector is a 4096-dimensional vector.

8. A federated learning cold start system based on FPGA dynamic watermarking, used for employing the federated learning cold start method based on FPGA dynamic watermarking as described in any one of claims 1 to 7, characterized in that, include: Watermark embedding strength generation module: At the client edge node, a preset watermark bit stream is obtained, the temperature T is collected in real time by a temperature sensor, the training duration Δt of this round of federated learning is obtained by a timer, and the watermark embedding strength λ is generated based on the temperature T and the training duration Δt. Watermarked Shadow Vector Generation Module: Obtain the gradient or features generated by the locally trained model as the shadow vector, and embed the watermark bit stream into the low bit of the shadow vector using differential pulse code modulation through the FPGA watermark embedder with watermark embedding intensity λ, thereby generating a watermarked shadow vector. Synthetic Corpus Generation Module: Receives watermarked shadow vectors from clients via the cloud center, and uses the cloud center to drive a generative adversarial network to generate synthetic corpus for cold start of federated learning based on the watermarked shadow vectors. Federated learning cold start module: In the cloud center, an initial model is obtained by training with synthetic corpus, and the initial model is fine-tuned by model-independent meta-learning to complete the cold start of federated learning.

Images