Differential privacy federal learning method based on sparse response

Abstract

A differential privacy federal learning method based on sparse response comprises the following steps: according to task requirements, a server constructs an initial model, initializes global model parameters and distributes the parameters to a client, and the client performs gradient descent training on a local data set to obtain a model update gradient; for each layer of the model, applying a set rarefaction strategy, selecting a cutting standard according to the importance of the layer, dynamically updating a rarefaction threshold value of each layer according to a training progress, applying the rarefaction threshold value to gradient cutting of the current round, only retaining gradients of which absolute values exceed the updated rarefaction threshold value, and finally obtaining rarefied gradients; in the next round of training, the error variables are added into new gradient calculation; differential privacy noise is added to the sparse gradient for disturbance, the client uploads the disturbed sparse gradient to the server, and the server updates global model parameters; and the updated global model parameters are distributed to the client again, and the next round of iteration is entered.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and specifically relates to a differential privacy federated learning method based on sparse response. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) and mobile communication technologies globally, traditional machine learning methods face challenges related to data privacy and communication efficiency. To address these issues, Federated Learning (FL) has emerged as an effective distributed machine learning framework. Federated Learning allows multiple clients to train models locally, uploading only updated gradients to the server, avoiding centralized storage and sharing of raw data and protecting data privacy. However, while protecting data privacy, Federated Learning still faces a trade-off between privacy protection and model performance, especially in Differential Privacy (DP) environments, requiring more intelligent and efficient solutions to ensure improved model accuracy while maintaining privacy.

[0003] Existing differential privacy techniques protect data privacy by adding noise to the gradient. However, this noise perturbation may distort the gradient, and in severe cases, it may cause the model update to deviate from the true optimal direction, affecting the convergence and accuracy of the model. Summary of the Invention

[0004] In order to overcome the shortcomings of the prior art, the present invention aims to provide a differential privacy federated learning method based on sparse response, which aims to solve the problem that existing federated learning methods are difficult to balance privacy protection and model performance, and further solve the technical problem of information loss that may be caused by traditional sparsification processing.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A differential privacy-preserving federated learning method based on sparse responses includes the following steps: Step 1: Based on the task requirements, the server builds an initial model and initializes the global model parameters. And distribute it to all clients; Step 2: The client receives the global model parameters sent by the server. and in the local dataset Perform several rounds of gradient descent training to obtain the model update gradient. ; Step 3, for each layer of the model Applying a pre-defined sparsity strategy, a pruning criterion is selected based on the importance of the layer, and an initial sparsity threshold is defined. The sparsity threshold for each layer is dynamically updated based on the current training progress. This is then applied to the gradient pruning in the current round, retaining only gradients whose absolute value exceeds the updated sparsification threshold, ultimately yielding the sparsified gradient. and the clipped gradient Accumulated into the error variable, in the next round of training, the error variable... Added to the new gradient calculation; Step 4: Sparsify the gradient Differential privacy noise is added for perturbation. The client uploads the perturbed sparse gradient to the server, and the server updates the global model parameters. ; Step 5: The updated global model parameters are redistributed to the client, and the next iteration begins. Repeat steps 2 through 4 until the termination condition is met.

[0006] According to the present invention, step 4 can be further optimized according to the model task when adding noise. For example, for a common CNN model used for image classification, an image gradient perception noise addition strategy can be adopted. The noise scale is accurately calculated based on the privacy budget, the total number of training rounds and the sampling rate through privacy accounting analysis. The spatial distribution of noise is negatively correlated with the spatial importance of the gradient tensor. That is, the spatial feature region that contributes more to image classification is less affected by noise, and finally a sparse noise gradient for perceiving image content is formed.

[0007] Compared with the prior art, the beneficial effects of the present invention are: To address the varying importance of different model layers, an independent sparsification strategy is set for each layer, and the sparsification threshold is dynamically adjusted based on the training progress. This solves the problem of poor adaptability of traditional fixed threshold or fixed Top-K strategies at different training stages, effectively balancing gradient sparsity and model expressiveness.

[0008] By introducing an error accumulation variable, the gradient information discarded in each pruning is retained and accumulated, and gradually fed back into the gradient update process in subsequent training. This achieves the optimal trade-off between communication load and model performance, improves system communication efficiency and scalability, enhances training efficiency, and reduces dependence on hardware computing power.

[0009] This invention adds differential privacy noise to the sparsified gradient to protect data privacy. The server updates the global model parameters by combining the perturbed sparse gradient, which can avoid gradient distortion, ensure model accuracy, and achieve good data privacy protection. Attached Figure Description

[0010] Figure 1 This is a flowchart of the differential privacy federated learning method based on sparse response of the present invention.

[0011] Figure 2 This is a flowchart of the gradient clipping process of the present invention.

[0012] Figure 3 This is a flowchart of the error accumulation compensation process of the present invention.

[0013] Figure 4 This is a comparison of the test accuracy of the present invention (DP-FedSR) and the DP-FedAvg method on the CIFAR-10 dataset. Detailed Implementation

[0014] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings and examples.

[0015] To address the two major problems of "high noise interference" and "severe information loss" in existing differential privacy federated learning, this invention proposes a differential privacy federated learning method based on sparse response. Based on a systematic and adaptive gradient processing mechanism, a sparsification strategy is designed for each layer of the model to obtain the sparsified gradient. and for Differential privacy noise is introduced, balancing model accuracy and data privacy protection. Furthermore, by incorporating discarded gradient information during gradient updates, communication load and model performance are balanced, reducing reliance on hardware computing power.

[0016] like Figure 1 As shown, the main steps of the present invention include: Step 1: On the server, build an initial model according to the task requirements and initialize the global model parameters. And distribute it to all clients.

[0017] The server analyzes the model architecture and the importance of the training tasks, and assigns each layer of the model accordingly. Define a separate initial sparsity strategy. And locally on the client side, for each layer of the model... Initialize error accumulation variable The error accumulation variable is used to store the clipped gradient. The specific implementation of this step can be described as follows: Step 1.1, Model Architecture Analysis.

[0018] Based on the task requirements, the server constructs an initial neural network model structure and performs random initialization to generate global model parameters, thereby obtaining the initial global model parameters. The server then... Distribute to all participating clients.

[0019] Different layers have different effects on the model, especially in deep neural networks: The input layer typically contains basic information about the original data, has significant gradient variations, and is crucial for model training; therefore, its sparsity rate is set relatively low (e.g., 20%-40%). Shallow layers have relatively simple feature extraction but still contribute significantly to the model; therefore, their sparsity rate is also low (e.g., 40%-60%). As network depth increases, the gradient variations in intermediate layers typically decrease gradually; therefore, their sparsity rate can be appropriately increased (e.g., 60%-80%). Deep layers, closer to the output layer, are mainly responsible for synthesizing information and have a significant impact on the global output, but their gradient updates are slower; therefore, a higher sparsity rate can be set (e.g., 80%-90%). Clearly, this invention also needs to define a maximum sparsity rate. With minimum sparsity .

[0020] Step 1.2, Importance Analysis: The "importance" of each layer is evaluated based on the statistical properties of the gradient. Important layers have large and active gradient changes and may require a lower sparsity rate; less important layers can tolerate a higher sparsity rate. For each layer... The "importance" of a model can be quantified by calculating the activity of its gradient. This can be done by calculating the activity of each layer of the model. The L2 norm of the gradient is used to characterize its importance to the model; gradient norm The formula is as follows: in It is a layer The Middle The gradient of each training data sample. It is a layer The number of samples in the sample is obviously... The larger the value, the greater its importance to the model.

[0021] Step 1.3, Initial Sparsification Strategy Based on the importance assessment of each layer in steps 1.1 and 1.2, an initial sparsity strategy is defined for each layer. If the gradient norm of a layer is large, it indicates that the layer is more important to the model, and a lower sparsity rate should be set. If the gradient norm of a layer is small, it indicates that the layer's contribution is smaller, and a higher sparsity rate can be set. In summary: layers that are more important to the model should have a lower sparsity rate, and layers that are less important to the model should have a higher sparsity rate.

[0022] Based on layers The L2 norm is used to adjust its sparsity. : in It is the largest gradient norm among all layers. It is the smallest gradient norm among all layers. It is the maximum sparsity. It is the minimum sparsity rate.

[0023] Step 2: The client receives the global model parameters sent by the server. In the local dataset Above, use Perform several rounds of gradient descent training, calculate the gradient, and update the local model.

[0024] The ultimate goal of this step is to obtain the model update gradient. Its specific implementation can be described as follows: Step 2.1, calculate the gradient. Select training batches: In each round of training, the client selects from the local dataset. We select a small batch for training. Assume the size of the currently selected batch is... Then the samples in the batch are The corresponding tag is .

[0025] Calculate the loss function: for each sample Calculate the loss for this sample. .

[0026] Calculate the gradient: Calculate the loss function relative to the global model parameters using the backpropagation algorithm. gradient This gradient reflects how the global model parameters are adjusted to reduce loss under the current model.

[0027] in, The loss function represents the loss function for a single sample. and its tags The gradient.

[0028] Step 2.2, gradient update.

[0029] When the client performs gradient descent training locally, it uses momentum. The stochastic gradient descent algorithm is used to update the local model parameters. This algorithm introduces momentum. This method accumulates historical gradient update directions into the current update using an exponentially decaying average, thereby accelerating training convergence and suppressing oscillations during optimization, thus providing more stable and effective gradient information for subsequent steps. The specific formula is: in It is the momentum coefficient. It is the momentum from the previous round. It's the learning rate. It is the gradient on the current batch of data.

[0030] After the client completes several rounds of local training, it finally obtains the updated local model parameters. The client calculates the model update gradient for this round of training. The specific formula is as follows: Step 3, for each layer of the model Applying a pre-defined sparsity strategy, a pruning criterion is selected based on the importance of the layer, and an initial sparsity threshold is defined. Based on the current training progress (such as gradient changes, model convergence status, etc.), the sparsity threshold of each layer is dynamically updated. Updated sparsity threshold Gradient clipping applied to the current iteration. Only gradients whose absolute value exceeds the new sparsification threshold are retained, resulting in the sparsified gradient. .

[0031] The purpose of this step is to obtain the sparsified gradient. Its specific implementation is as follows: Step 3.1, Initial sparsification threshold.

[0032] Update the gradient of the model calculated in step 2.2. Each layer Applying the sparsity strategy pre-defined in step 1.1, and based on the sparsity rate defined in step 1.3, determine the initial sparsity threshold, specifically defined as follows: First, it is necessary to analyze the gradient of each layer. Sort the elements in the gradient array from largest to smallest by absolute value. Set the absolute value of each gradient element to be... After sorting, we get .

[0033] Then, based on the sparsity rate Determine the number of gradient elements to retain, assuming the dimension of each gradient layer is . So, how many gradients should be retained? for: Finally, you can choose the sorted order. The absolute value of the largest gradient is used as the corresponding initial sparsity threshold. .

[0034] Step 3.2, threshold clipping.

[0035] For each layer of the model , It is the gradient of this layer, which sets the sparsity threshold. When gradient clipping is applied to the current round, the resulting sparsed gradient... It can be represented as: in For the first i gradient elements, for The absolute value of.

[0036] Step 3.3, Dynamic threshold adjustment.

[0037] The goal of this step is to dynamically update the sparsity threshold for each layer based on the current training progress. The specific implementation method is as follows: After each training round, the rate of change of the gradient is calculated, and the L2 norm of the gradient can be used to measure the change in the gradient. First, the gradient of the current round is calculated. gradient of the previous round Current round gradient: Previous gradient: Then, calculate the L2 norm of the gradient difference based on the gradient of each round. : Gradient change rate during training The formula is as follows: The training loss function is an important indicator of a model's fit, and can be expressed by the following formula: : in, It is the number of training samples. It is the first The loss function for each training sample.

[0038] The loss for the current round is calculated using the loss function formula. And the losses from the previous round Then calculate the rate of change of loss. : if A smaller threshold (e.g., less than a set value) indicates that the model is close to convergence, and the threshold should be increased. A large threshold (e.g., greater than a set value) indicates that the model is still in the learning phase, and the threshold should be reduced to retain more gradient information. The specific formula for dynamically adjusting the threshold in each training round is: in, and These are hyperparameters that control the impact of the gradient and loss change rates on the clipping threshold adjustment. They are typically set to constants less than 1, representing the contribution of gradient and loss changes to the threshold adjustment. If the gradient change rate... A large value indicates significant gradient fluctuations, necessitating the retention of more gradient information. Therefore, the clipping threshold should be relatively low, and its value can be reduced. If the loss rate of change... A smaller threshold indicates that the model is close to convergence, and the threshold can be appropriately increased to perform more stringent gradient clipping. The gradient clipping flowchart is shown below. Figure 2 As shown.

[0039] Based on this step, this invention designs a hierarchical dynamic sparsity mechanism to replace the existing fixed global gradient processing strategy. This invention adopts a hierarchical processing approach: based on the importance of different layers in the model during training, an initial sparsity rate is independently set for each layer. Important layers have a low sparsity rate to retain more information; unimportant layers have a high sparsity rate to improve communication efficiency. Dynamic adjustments are made: the sparsity threshold of each layer is adaptively and dynamically adjusted according to the training progress. More gradients are automatically retained during periods of rapid model change to accelerate convergence, while more stringent pruning is performed during periods of model stabilization to improve efficiency.

[0040] Step 4, error accumulation compensation.

[0041] For the clipped gradient Instead of discarding them directly, they are accumulated in the error variable and then used in the next training round. By incorporating new gradient calculations, we ensure that pruning information can be gradually fed back to the global model.

[0042] For each layer gradient Threshold clipping needs to be performed during each training round. This invention sets the gradient for the current round to be... The cropping threshold is For each gradient element If its absolute value is less than the threshold, it is discarded and accumulated in the error variable. middle: in It is the first Gradient elements in Error variables of the wheel.

[0043] In the next round of training, the error variable It will be accumulated with the new gradient to obtain the updated gradient. The specific formula is: in, yes The original gradient of the wheel.

[0044] After the next round of training, the error variable This will be retained until the next update. During each update cycle, the error variable is continuously updated and accumulated. However, if the error variable continues to accumulate without proper adjustment, its value will eventually become very large, causing the clipping effect during training to gradually disappear, ultimately rendering the gradient clipping process meaningless. To avoid this problem, the accumulation of the error variable needs to be reasonably controlled to prevent the endless accumulation of gradient information throughout the training process. This invention adds a decay factor to the error variable in each training cycle. This way, the error variable decays after each training round, preventing it from accumulating indefinitely. The decay factor is designed to ensure that the error variable maintains a reasonable size after each training round. The decay formula is as follows: in: It is an indicator function that returns 1 when the absolute value of the gradient is less than the threshold, and 0 otherwise. A constant with a value less than 1 represents the influence of the previous error variable on the current error variable.

[0045] Furthermore, to avoid excessive computational overhead due to too many error variables, the error variables can be reset periodically. This ensures that the error variables do not accumulate indefinitely, but are periodically "cleaned up," retaining only the gradient information lost in the short term. The reset formula is as follows: in, It is the reset cycle, every After each training round, the error variable is reset to zero. This strategy avoids the endless accumulation of the error variable; after each reset, only the error information from the most recent rounds is retained. The flowchart for error accumulation compensation is as follows: Figure 3 As shown.

[0046] Based on this step, the present invention designs an error accumulation and compensation mechanism to mitigate information loss caused by sparsity. Specifically, error accumulation involves maintaining an error accumulation variable for each layer locally on the client side. During each round of gradient sparsification, the pruned gradient values ​​are accumulated and stored in this variable. Compensation feedback occurs in the next round of local gradient calculation, where the accumulated error from the previous round is added to the new gradient before another round of sparsification. This allows discarded gradient information to be gradually fed back and utilized in subsequent training. Stability control is implemented to prevent the error variable from expanding indefinitely, introducing a decay factor and a periodic reset mechanism to ensure the stability of the training process.

[0047] Step 5, sparse the gradient Differential privacy noise is added for perturbation. The client uploads the perturbed sparse gradients to the server, which then performs a weighted average and updates the global model parameters.

[0048] This step mainly involves introducing differential privacy noise to protect data privacy, and then globally aggregating the sparse gradients after adding differential privacy noise to update the global model parameters. The specific implementation is as follows: For the sparsified gradient Differential privacy noise is added to meet differential privacy requirements, as shown in the following formula: in It is Gaussian noise.

[0049] Each client uploads a perturbation sparse gradient. To the server. The server to The perturbation sparse gradients uploaded by each client are weighted and averaged. Assume the client... The proportion of data volume to the total is Then the aggregation formula is: Based on the aggregated gradient The server updates the global model parameters: in This represents the learning rate and controls the gradient step size.

[0050] This step achieves an integrated design for privacy protection and communication optimization under sparse response. This invention adds differential privacy noise only to the gradient after sparsification and error compensation, generating a "sparse noise gradient." The client only needs to upload this sparse gradient to the server. Because a sparse vector is uploaded, the communication overhead is reduced by an order of magnitude compared to transmitting the complete gradient vector, and sparse matrix compression techniques can be directly utilized. At the same communication cost, it achieves accuracy far exceeding that of baseline methods, significantly optimizing the privacy-benefit tradeoff.

[0051] Step 6, repeat.

[0052] Updated global model parameters on the server Distribute the data to the client again to begin the next iteration. Repeat steps 2, 3, 4, and 5 until the termination condition is met (such as reaching the preset number of iterations or global model convergence).

[0053] To verify the effectiveness of the present invention, the proposed method DP-FedSR and the standard difference privacy federated averaging algorithm DP-FedAvg were compared through the following embodiments.

[0054] 1. Experimental setup The experiments used the CIFAR-10 dataset and a lightweight convolutional neural network (CNN) for image classification. All methods were trained using the same CNN architecture and compared under the same hardware and software environment. The specific experimental setup is as follows: The CIFAR-10 dataset contains color images in 10 different categories, with 6,000 images in each category. The training set contains 50,000 images and the test set contains 10,000 images.

[0055] Server-Client Architecture and Training Process: Experiments were conducted in a simulated federated learning environment. This environment consisted of one central server and ten client nodes. The server was responsible for initializing, distributing, and aggregating models, and maintaining the global state; each client independently held a subset of the CIFAR-10 training set and executed the local training, sparsification, and privacy protection processes of this invention.

[0056] The specific architecture of the CNN model used: The lightweight CNN used in this experiment consists of the following layers: Convolutional Block 1: Convolutional layer (32 3×3 convolutional kernels, stride 1, padding 1) → Batch normalization layer → ReLU activation → 2×2 max pooling.

[0057] Convolutional Block 2: Convolutional layer (64 3×3 convolutional kernels, stride 1, padding 1) → Batch normalization layer → ReLU activation → 2×2 max pooling.

[0058] Fully connected part: After flattening the feature map, it is connected to a fully connected layer with 128 neurons and ReLU activation, and finally connected to an output layer with 10 neurons (corresponding to 10 categories) and Softmax activation.

[0059] Specific applications of the layered sparsity strategy: According to steps S1.1-S1.3 of the present invention, an independent initial sparsity rate is defined for each layer of the above-described CNN. Combining the characteristics of shallow feature extraction and deep semantic synthesis in image classification tasks, the rate is set as follows: Convolutional layer 1: The initial sparsity rate is set to 30% to retain more basic feature information.

[0060] Convolutional layer 2: The initial sparsity is set to 45%.

[0061] Fully connected layer 1: The initial sparsity is set to 65%.

[0062] Output layer: Initial sparsity is set to 80%.

[0063] During training, these sparsity rates are dynamically adjusted based on the gradient change rate and loss change rate described in S3.3.

[0064] Introducing differential privacy noise: To ensure comparable levels of privacy protection, all methods satisfy differential privacy, with a privacy protection budget set to 2.0 and a privacy loss relaxation parameter of 10. -5 .

[0065] Gradient clipping: Before adding noise, the model update gradient is first clipped according to its norm, and a clipping threshold is set.

[0066] Noise Addition: According to S5 of this invention, differential privacy noise related to image feature perception is added to the cropped gradient. Considering the spatial locality of image data and the differences in the importance of visual features, this invention adopts a noise addition strategy based on image gradient perception while meeting strict differential privacy requirements. The noise scale is precisely calculated through privacy accounting analysis based on the privacy budget, the total number of training rounds, and the sampling rate. Furthermore, the spatial distribution of noise is negatively correlated with the spatial importance of the gradient tensor; that is, the spatial feature region that contributes more to image classification is less affected by noise. This ensures that the gradient uploaded by each client not only meets strict differential privacy requirements but also undergoes the sparsification processing of this invention, forming a sparse noise gradient that perceives image content.

[0067] Experimental configuration and hyperparameter settings: The learning rate was set to 0.001, the batch size to 32, and the total number of training epochs to 200. The local training cycle was 3, meaning each client performed 3 training epochs locally before each global update. The accuracy in the experiment refers to the model's classification accuracy on the CIFAR-10 dataset, i.e., the proportion of samples correctly classified by the model out of the total samples. Experimental results are as follows: Figure 4 As shown.

[0068] from Figure 4 The following key conclusions were observed: After the entire training process, the baseline method DP-FedAvg converged to a final accuracy of approximately 81%. In contrast, the proposed method DP-FedSR achieved a final accuracy of approximately 92%, an improvement of 11 percentage points. This clearly demonstrates that the proposed method, through hierarchical dynamic sparsity and error accumulation compensation mechanisms, effectively mitigates noise interference and information loss, significantly improving the model's performance ceiling under strict privacy constraints. Superior convergence speed and stability are also observed. As shown in the figure, the accuracy curve of the proposed method consistently remains higher than that of the baseline method throughout the training process, indicating the consistency and reliability of its performance advantage. The baseline method converged after approximately 48 epochs, while the proposed method converged after approximately 26 epochs, demonstrating superior convergence potential and stability. The proposed method requires fewer epochs to achieve the same accuracy, reflecting a faster effective convergence speed.

[0069] Experimental results show that, under the same level of privacy protection, compared with the existing standard technology DP-FedAvg, the DP-FedSR method provided by this invention can significantly improve the final test accuracy of the model, exhibiting better convergence performance and stability, and possessing higher performance potential.

[0070] In a further embodiment of the present invention, the public dataset can be replaced with a self-built dataset, such as traffic images of intersections captured by traffic monitoring equipment. The local client trains the model locally using global model parameters distributed by the server and a portion of the self-built dataset, and executes the differential privacy federated learning method of the present invention during training. The introduced differential privacy noise is related to image feature perception. The finally trained model is deployed on the client, enabling effective identification of targets in the image on the client side, while protecting image data privacy during training and ensuring model recognition accuracy. In summary, the present invention organically combines three technologies—hierarchical dynamic sparsity, error accumulation compensation, and sparse response communication—to synergistically solve the problem of balancing privacy, accuracy, and efficiency in differential privacy federated learning.

Claims

1. A differential privacy-preserving federated learning method based on sparse responses, characterized in that, Includes the following steps: Step 1: Based on the task requirements, the server builds an initial model and initializes the global model parameters. And distribute it to all clients; Step 2: The client receives the global model parameters sent by the server. and in the local dataset Perform several rounds of gradient descent training to obtain the model update gradient. ; Step 3, for each layer of the model Applying a pre-defined sparsity strategy, a pruning criterion is selected based on the importance of the layer, and an initial sparsity threshold is defined. The sparsity threshold for each layer is dynamically updated based on the current training progress. This is then applied to the gradient pruning in the current round, retaining only gradients whose absolute value exceeds the updated sparsification threshold, ultimately yielding the sparsified gradient. and the clipped gradient Accumulated into the error variable, in the next round of training, the error variable... Added to the new gradient calculation; Step 4: Sparsify the gradient Differential privacy noise is added for perturbation. The client uploads the perturbed sparse gradient to the server, and the server updates the global model parameters. ; Step 5: The updated global model parameters are redistributed to the client to enter the next iteration; repeat steps 2 to 4 until the termination condition is met.

2. The differential privacy federated learning method based on sparse response according to claim 1, characterized in that, The server analyzes the model architecture and the importance of the training tasks, and assigns each layer of the model accordingly. Define separate initial sparsity strategies, where layers with higher importance to the model have lower sparsity rates, and layers with lower importance to the model have higher sparsity rates; the client is for each layer of the model. Initialize error accumulation variable It is used to store the clipped gradients.

3. The differential privacy federated learning method based on sparse response according to claim 2, characterized in that, Each layer of the model The importance of a model is determined by its gradient norm. The representation is shown in the following formula: in It is a layer The Middle The gradient of each training data sample. It is a layer The number of samples in The larger the value, the greater its importance to the model; According to the layer The L2 norm is used to adjust its sparsity. : in It is the largest gradient norm among all layers. It is the smallest gradient norm among all layers. It is the maximum sparsity. It is the minimum sparsity rate.

4. The differential privacy federated learning method based on sparse response according to claim 1, characterized in that, In step 2, during each round of training, the client retrieves data from the local dataset. Choose a size of The model is trained in batches, and the loss function is calculated relative to the global model parameters using the backpropagation algorithm. The gradient, and using the driving force The stochastic gradient descent algorithm updates the local model parameters, and the update formula is: in It is the momentum coefficient. It's the momentum from the previous round. It's the learning rate. It is the gradient on the current batch of data; After the client completes several rounds of local training, it obtains the updated local model parameters. And calculate the model update gradient for this round of training. .

5. The differential privacy federated learning method based on sparse response according to claim 1, characterized in that, Step 3, initial sparsification threshold Defined as follows: First, the gradient of each layer The elements in the array are sorted from largest to smallest by their absolute values; Then, based on the sparsity rate Determine the number of gradient elements to retain, and the dimension of each gradient layer is... Then the number of gradients to be retained for: Finally, select the sorted number. The absolute value of the largest gradient is used as the initial sparsity threshold. ; For each layer of the model , sparsification threshold Gradient clipping applied to the current round, resulting in a sparsified gradient. Represented as: in For the first i gradient elements, for The absolute value of.

6. The differential privacy federated learning method based on sparse response according to claim 1 or 5, characterized in that, In step 3, the sparsity threshold of each layer is dynamically updated according to the current training progress. The implementation method is as follows: After each training round, calculate the gradient for the current round. gradient of the previous round Calculate the L2 norm of gradient difference based on round gradient. : Gradient change rate during training The formula is as follows: Training loss function The formula is as follows: in, It is the number of training samples. It is the first The loss function for each training sample; Combining the losses from the previous round Calculate the rate of change of loss : if If it is less than the set value, increase the threshold; if If the value exceeds the set threshold, decrease the threshold; the formula for dynamically adjusting the threshold in each training round is: in, and This is a hyperparameter that controls the impact of the gradient and loss change rates on the clipping threshold adjustment. It is set to a constant less than 1, representing the contribution of gradient and loss changes to the threshold adjustment; if the gradient change rate... If the value is greater than the set value, decrease the threshold; if the loss rate changes... If the value is less than the set value, increase the threshold.

7. The differential privacy federated learning method based on sparse response according to claim 1, characterized in that, In step 3, the gradient to be clipped Accumulated into the error variable, in the next round of training, the error variable... The new gradient calculation is implemented as follows: Set the gradient for the current round as The cropping threshold is For each gradient element If its absolute value is less than the threshold, it is discarded and accumulated in the error variable. middle: in It is the first Gradient elements in Error variables of the wheel; In the next round of training, the error variable The gradient is accumulated with the new gradient to obtain the updated gradient. The formula is: in, yes The original gradient of the wheel; In each round of training, a decay factor is added to the error variable. To prevent the error variable from accumulating indefinitely, the attenuation formula is as follows: in: This is an indicator function that returns 1 if the absolute value of the gradient is less than a threshold, and 0 otherwise. A constant with a value less than 1 represents the influence of the previous error variable on the current error variable.

8. The differential privacy federated learning method based on sparse response according to claim 7, characterized in that, The error variable is periodically reset to ensure that it does not accumulate indefinitely. The reset formula is as follows: in, It is the reset cycle, every After each training run, the error variable will be reset to zero.

9. The differential privacy federated learning method based on sparse response according to claim 7, characterized in that, In step 4, the gradient after sparsification is... Differential privacy noise is added for perturbation, as shown in the following formula: in It is Gaussian noise; Each client uploads a perturbation sparse gradient. To the server, the server to Perturbation sparse gradient uploaded by each client Perform a weighted average, assuming the client... The proportion of data volume to the total is Then the aggregation formula is: Based on the aggregated gradient The server updates the global model parameters: in This represents the learning rate and controls the gradient step size.

10. The differential privacy federated learning method based on sparse response according to claim 1 or 9, characterized in that, The model is a CNN model for image classification. In step 4, a noise addition strategy for image gradient perception is adopted. The noise scale is accurately calculated based on the privacy budget, the total number of training rounds and the sampling rate through privacy accounting analysis. Moreover, the spatial distribution of noise is negatively correlated with the spatial importance of the gradient tensor. That is, the spatial feature region that contributes more to image classification is less affected by noise, and finally a sparse noise gradient for perceiving image content is formed.

Images