Federal feature forgetting method based on adversarial samples
By constructing adversarial perturbation vectors to evaluate feature sensitivity in federated learning and introducing a loss function, the problem of poor feature forgetting in existing federated learning is solved, achieving accurate feature forgetting and enhancing privacy protection and model management capabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING JIAOTONG UNIV
- Filing Date
- 2025-11-26
- Publication Date
- 2026-04-24
AI Technical Summary
Existing federated learning methods do not adequately support feature-level forgetting, especially when dealing with complex models and nonlinear decision boundaries, and they do not fully utilize research findings in the field of adversarial attacks, resulting in limited forgetting performance.
By constructing adversarial perturbation vectors on the client side, calculating feature sensitivity and introducing it as a regularization term into the loss function, local model training is guided, enabling controlled forgetting of features. This method is suitable for image, text, and structured data scenarios.
It achieves precise and controllable forgetting of sensitive features within the federated learning framework, enhancing the model's privacy protection and manageability. It is applicable to various data modalities and has good generalization and deployment practicality.
Smart Images
Figure CN121920570A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of federated learning and forgetting learning technologies, and in particular to a federated feature forgetting method based on adversarial examples. Background Technology
[0002] The era of big data has driven the rapid development of artificial intelligence and machine learning technologies, and data-driven modeling methods have generated significant value in scenarios such as healthcare, finance, and mobile devices. However, data is often scattered and stored in edge devices or within organizations, such as mobile phones, sensors, and enterprise databases. Due to privacy protection regulations and corporate compliance requirements, the traditional approach of centralizing data in the cloud for unified modeling is gradually becoming unsuitable, thus giving rise to the "data silo" problem.
[0003] Federated learning, as a novel distributed machine learning framework, enables multiple participants to collaboratively train models without sharing local data, effectively avoiding the risk of data leakage. It is an important direction for combining privacy protection and distributed modeling.
[0004] As federated learning is widely deployed, another key issue has emerged—how to satisfy users' right to be "forgotten." Users may wish to delete certain information or features from a trained model, a demand stemming from considerations such as compliance, security, or ethics. However, most existing federated forgetting methods focus on the client-level (e.g., deleting a user's data) or sample-level, lacking sufficient support for finer-grained "feature-level forgetting," thus failing to meet practical needs.
[0005] Current academic work has attempted to propose feature forgetting methods. The core idea is to inject Gaussian noise into the input features to assess the model's dependence on a particular feature, and then use this as a basis for training and optimization, thereby reducing the model's sensitivity to that feature. While these methods achieve feature elimination to some extent, the randomness of the Gaussian noise's direction and the unstable perturbation effect limit the forgetting performance, especially when dealing with highly complex models and nonlinear decision boundaries.
[0006] The drawbacks of existing federated feature learning methods include: failure to utilize research findings from the adversarial attack field and neglect of the value of constructing "worst-case perturbations" for model sensitivity analysis. Summary of the Invention
[0007] This invention provides a federated feature forgetting method based on adversarial examples to support the controlled forgetting of sensitive features within a federated learning framework, thereby enhancing the privacy protection and manageability of the model.
[0008] To achieve the above objectives, the present invention adopts the following technical solution.
[0009] A federated feature forgetting method based on adversarial examples includes:
[0010] The central server broadcasts the trained global model parameters to each client.
[0011] The client initiates a feature forgetting request, identifies a subset of features to be forgotten, and constructs an adversarial perturbation vector for the feature subset;
[0012] The feature sensitivity is calculated by comparing the model output before and after the adversarial perturbation. This feature sensitivity is then used as a regularization term in the loss function to guide the training of the local model. After the local model training is completed, the client uploads the updated local model parameters to the central server for participation in global model aggregation and updates.
[0013] Preferably, the central server broadcasts the trained global model parameters to each client, including:
[0014] Before each round of federated learning begins, the central server broadcasts the currently trained global model parameters to all clients. If it is the first round of training, the central server needs to initialize the global model parameters and distribute them to each client as the initial local model for each client. If it is a subsequent round, the central server broadcasts the new global model obtained from the previous round of aggregation to each client.
[0015] Preferably, the client initiates a feature forgetting request, identifies a subset of features to be forgotten, and constructs an adversarial perturbation vector for the feature subset, including:
[0016] The client decides to initiate a feature forgetting request based on local needs. The feature forgetting request includes the feature identifier to be forgotten, which can be a structured field name, an image region index, or a text token range. The feature forgetting request is completed through a secure communication protocol between the client and the server.
[0017] The client identifies the feature dimensions or regions to be forgotten locally based on the feature forgetting request information, and calculates the loss function of the current input sample under the existing local model of the client. Calculate the gradient of the loss function with respect to the input. The adversarial perturbation vector corresponding to the feature dimension or region is generated using the fast gradient sign method. :
[0018]
[0019] This represents the generated adversarial perturbation vector, whose dimension is the same as that of the input sample. The feature dimensions are consistent;
[0020] The perturbation strength coefficient is a preset hyperparameter used to control the maximum allowable difference between the generated adversarial examples and the original samples, ensuring that the perturbed features do not deviate excessively from the original distribution numerically. The adversarial perturbation strength is determined by the parameter. control;
[0021] The sign function is used to extract the direction information of the gradient, ensuring that the perturbation is performed along the direction in which the loss function rises the fastest.
[0022] Represents the loss function About the input sample The gradient reflects the direction of the effect of small changes in input features on the model's output loss.
[0023] Preferably, the step of calculating feature sensitivity by comparing the model output before and after adversarial perturbation, incorporating the feature sensitivity as a regularization term into the loss function to guide local model training, and then, after local model training is complete, having the client upload updated local model parameters to the central server for participation in global model aggregation and updating, includes:
[0024] Based on the original input sample and the counter-perturbation vector Obtain the perturbed sample ,in This represents the target characteristics that need to be forgotten.
[0025] The client will provide the original input sample. and perturbated samples Input the local model separately and obtain the output results. and Calculate the original input sample and perturbated samples The degree of change between them, after normalization, is used as the feature sensitivity. :
[0026]
[0027] During the training of the local model, the client will use the aforementioned feature sensitivity. Introduce the original loss function and construct a joint loss function:
[0028]
[0029] in, The original supervised loss function is... To adjust the weights and control the influence of forgotten features during training, the client uses a joint loss function. To achieve this, perform multiple rounds of mini-batch local training and output updated local model parameters.
[0030] Preferably, after the local model training is completed, the client uploads the updated local model parameters to the central server for participation in global model aggregation and updating, including:
[0031] The client uploads the updated local model parameters to the central server via a federation protocol. The central server uses a predetermined aggregation strategy to weight and merge the received local model parameters from each client to generate a new global model. Subsequently, the central server broadcasts the aggregated new global model to each client again, and the next round of training begins.
[0032] As can be seen from the technical solutions provided by the embodiments of the present invention above, the present invention achieves the ability to perform targeted forgetting at the input feature level by introducing adversarial perturbation and sensitivity calculation mechanisms. At the same time, it does not require modification of the original federated server structure, is compatible with existing training frameworks, and is applicable to image, text and structured data scenarios. It has good generalization, controllability and deployment practicality.
[0033] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and will become apparent from the description or may be learned by practice of the invention. Attached Figure Description
[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0035] Figure 1 The flowchart illustrates a federated feature forgetting method based on adversarial examples, which is an example of the present invention. Detailed Implementation
[0036] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.
[0037] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or couplings. The term “and / or” as used herein includes any and all combinations of one or more of the associated listed items.
[0038] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as herein.
[0039] To facilitate understanding of the embodiments of the present invention, the following will provide further explanation and description with reference to the accompanying drawings and several specific embodiments. These embodiments do not constitute a limitation on the embodiments of the present invention.
[0040] This invention proposes a federated feature forgetting method based on adversarial examples. By constructing adversarial perturbations acting on target features locally on the client side, calculating their impact on the model output, and using this as an optimization objective, the accuracy and robustness of feature forgetting are improved, while simultaneously balancing model performance and training efficiency. This method requires no collaboration from other clients, is adaptable to various data modalities, and is an efficient and scalable federated feature forgetting mechanism.
[0041] The specific processing flow of a federated feature forgetting method based on adversarial examples provided in this embodiment of the invention is as follows: Figure 1 As shown, the processing steps include the following:
[0042] In step S10, the central server broadcasts the trained global model parameters to each client.
[0043] Before each round of federated learning, the central server broadcasts the currently trained global model parameters to all clients. For the first round of training, the central server initializes the global model parameters and distributes them to all clients as the initial model. For subsequent rounds, the central server broadcasts the new global model obtained from the previous round to all clients. Upon receiving the global model, the clients use it as the basis for subsequent feature forgetting processes and local training operations.
[0044] Step S20, the client decides to initiate a feature forgetting request:
[0045] Some clients initiate feature forgetting requests based on local needs. These requests include the feature identifiers to be forgotten, which can be structured field names, image region indexes, or text token ranges. For structured data, the feature identifier is a column name or feature index in the data table; for image data, the feature identifier is the spatial coordinates of the image region or a mask matrix; for natural language text, the feature identifier is the sequence position of the token or a specific set of keywords. This feature forgetting request is completed through a secure communication protocol between the client and the server, serving as additional control input during the federated training process.
[0046] Step S30: The client locally identifies the feature subset to be forgotten and constructs an adversarial perturbation vector for that feature subset.
[0047] Based on the feature forgetting request information, the client locally identifies the feature dimensions or regions to be forgotten and constructs corresponding adversarial perturbations. Specifically, the implementation is as follows:
[0048] First, the client calculates the loss function of the current input sample under the existing local model on the client. Then calculate the gradient of the loss function with respect to the input. Generate adversarial perturbation vectors using the fast gradient sign method:
[0049]
[0050] This represents the generated adversarial perturbation vector, whose dimension is the same as that of the input sample. The feature dimensions are consistent;
[0051] The perturbation strength coefficient is a preset hyperparameter used to control the maximum allowable difference between the generated adversarial examples and the original samples, ensuring that the perturbed features do not deviate excessively from the original distribution numerically. The adversarial perturbation strength is determined by the parameter. control;
[0052] The sign function is used to extract the direction information of the gradient, ensuring that the perturbation is performed along the direction in which the loss function rises the fastest.
[0053] Represents the loss function About the input sample The gradient reflects the direction of the effect of small changes in input features on the model's output loss.
[0054] Based on the original input sample and the counter-perturbation vector Obtain the perturbed sample ,in This represents the target characteristics that need to be forgotten.
[0055] Step S40: Calculate the difference in model output before and after the perturbation to obtain the feature sensitivity.
[0056] The client will provide the original input sample. and perturbated samples Input the local model separately and obtain the output results. and Calculate the original input sample and perturbated samples The degree of change between them, after normalization, is used as the feature sensitivity. :
[0057]
[0058] This feature sensitivity This reflects the degree to which the client's local model depends on the target features and its feature sensitivity. The higher the value, the more the local model relies on that feature.
[0059] Step S50: Use feature sensitivity as a regularization term to guide the optimization of the local model.
[0060] During the training of the local model, the client will use the aforementioned feature sensitivity. Introduce the original loss function and construct a joint loss function:
[0061]
[0062] in, This is the original supervised loss function (such as cross-entropy loss). To adjust the weights and control the influence of forgotten features during training, the client uses a joint loss function. With the goal of training multiple rounds of mini-batch local training, the updated local model parameters are finally output.
[0063] The specific local model optimization and training process is as follows:
[0064] 1. Forward Propagation: The client inputs the current training batch data into the local model, according to the formula... Calculate the current joint loss value. To ensure the model's accuracy for the main task (such as classification), The term serves as a regularization constraint, forcing the model to be insensitive to perturbations of specified features;
[0065] 2. Backpropagation: Based on the calculated joint loss The loss with respect to the local model parameters is calculated using an automatic differentiation mechanism. gradient ;
[0066] 3. Parameter Update: Local model parameters are updated using stochastic gradient descent.
[0067]
[0068] in This is the local learning rate.
[0069] 4. Iterative loop: Repeat the above steps until the preset number of local training rounds or the loss function converges, thereby obtaining the updated model parameters that have forgotten the specific feature dependencies.
[0070] Step S60: The client uploads the updated local model parameters to the central server and participates in global aggregation.
[0071] The client uploads its updated local model parameters, trained locally, to the central server via a federated protocol. The central server uses a predetermined aggregation strategy (such as FedAvg) to weight and merge the received local model parameters from each client, generating a new global model. Subsequently, the server broadcasts the aggregated new global model again, initiating the next round of training.
[0072] Through continuous iteration of the above steps, the method of the present invention achieves targeted forgetting of client-specified features without sharing the original data, thus possessing good privacy protection capabilities and practical deployment value.
[0073] In summary, the solution of this invention introduces a feature sensitivity evaluation mechanism based on adversarial examples, enabling the federated learning framework to accurately and controllably forget specified sensitive features while ensuring data privacy, thereby enhancing the manageability and compliance of the model in practical applications.
[0074] This invention can efficiently remove the model's dependency on specified features without relying on other local client data, effectively achieving data privacy protection and model security enhancement.
[0075] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of one embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing the present invention.
[0076] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of the present invention.
[0077] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for apparatus or system embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. The apparatus and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.
[0078] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A federated feature forgetting method based on adversarial examples, characterized in that, include: The central server broadcasts the trained global model parameters to each client. The client initiates a feature forgetting request, identifies a subset of features to be forgotten, and constructs an adversarial perturbation vector for the feature subset; The feature sensitivity is calculated by comparing the model output before and after the adversarial perturbation. This feature sensitivity is then used as a regularization term in the loss function to guide the training of the local model. After the local model training is completed, the client uploads the updated local model parameters to the central server for participation in global model aggregation and updates.
2. The method according to claim 1, characterized in that, The central server broadcasts the trained global model parameters to each client, including: Before each round of federated learning begins, the central server broadcasts the currently trained global model parameters to all clients. If it is the first round of training, the central server needs to initialize the global model parameters and distribute them to each client as the initial local model for each client. If it is a subsequent round, the central server broadcasts the new global model obtained from the previous round of aggregation to each client.
3. The method according to claim 2, characterized in that, The client initiates a feature forgetting request, identifies a subset of features to be forgotten, and constructs an adversarial perturbation vector for the feature subset, including: The client decides to initiate a feature forgetting request based on local needs. The feature forgetting request includes the feature identifier to be forgotten, which can be a structured field name, an image region index, or a text token range. The feature forgetting request is completed through a secure communication protocol between the client and the server. The client identifies the feature dimensions or regions to be forgotten locally based on the feature forgetting request information, and calculates the loss function of the current input sample under the existing local model of the client. Calculate the gradient of the loss function with respect to the input. The adversarial perturbation vector corresponding to the feature dimension or region is generated using the fast gradient sign method. : This represents the generated adversarial perturbation vector, whose dimension is the same as that of the input sample. The feature dimensions are consistent; The perturbation strength coefficient is a preset hyperparameter used to control the maximum allowable difference between the generated adversarial examples and the original samples, ensuring that the perturbed features do not deviate excessively from the original distribution numerically. The adversarial perturbation strength is determined by the parameter. control; The sign function is used to extract the direction information of the gradient, ensuring that the perturbation is performed along the direction in which the loss function rises the fastest. Represents the loss function About the input sample The gradient reflects the direction of the effect of small changes in input features on the model's output loss.
4. The method according to claim 3, characterized in that, The method described above involves calculating feature sensitivity by comparing the model output before and after adversarial perturbation, incorporating this feature sensitivity as a regularization term into the loss function to guide local model training, and then, after local model training is complete, having the client upload updated local model parameters to the central server for participation in global model aggregation and updates. Based on the original input sample and the counter-perturbation vector Obtain the perturbed sample ,in This represents the target characteristics that need to be forgotten; The client will provide the original input sample. and perturbated samples Input the local model separately and obtain the output results. and Calculate the original input sample and perturbated samples The degree of change between them, after normalization, is used as the feature sensitivity. : During the training of the local model, the client will use the aforementioned feature sensitivity. Introduce the original loss function and construct a joint loss function: in, The original supervised loss function is... To adjust the weights and control the influence of forgotten features during training, the client uses a joint loss function. To achieve this, perform multiple rounds of mini-batch local training and output updated local model parameters.
5. The method according to claim 4, characterized in that, After the local model training is completed, the client uploads the updated local model parameters to the central server for participation in global model aggregation and updates, including: The client uploads the updated local model parameters to the central server via a federation protocol. The central server uses a predetermined aggregation strategy to weight and merge the received local model parameters from each client to generate a new global model. Subsequently, the central server broadcasts the aggregated new global model to each client again, and the next round of training begins.