Federal learning method based on importance gradient updating and adaptive differential privacy control

Abstract

The invention provides a federated learning method based on importance gradient updating and adaptive differential privacy control. The method comprises the following steps: a client performs model initialization according to global initial model weight and training parameters broadcasted by a central server; the client trains the local model based on the local training data set, calculates the gradient of the local model, and evaluates the importance of each parameter dimension to obtain a gradient statistical distribution vector; the client forms a sparse gradient according to the gradient statistical distribution vector; according to the collected gradient intensity measurement, the differential privacy noise intensity is adaptively adjusted to obtain a noise adding gradient, local model updating is performed after noise is injected into a sparse gradient, and updated model parameters from clients are aggregated by a central server to obtain new global model parameters; and repeating to realize iterative training of the global model. According to the method, the ineffective noise interference is effectively reduced while the differential privacy constraint is met, and the convergence speed and the prediction accuracy of the model are improved.

Description

Technical Field

[0001] This invention relates to the technical field of distributed machine learning and privacy-preserving computation, and in particular to a federated learning method based on importance gradient update and adaptive differential privacy control. Background Technology

[0002] With the rapid development of artificial intelligence and the Internet of Things (IoT), user-side devices such as sensors, wearable devices, smart terminals, and intelligent transportation systems continuously generate a large amount of high-value data during operation. In traditional machine learning and deep learning frameworks, model training typically relies on uploading data scattered across various terminals to a central server for unified processing and modeling. However, this centralized data processing approach not only incurs high communication costs but also easily leads to serious privacy risks during data transmission and centralized storage, making it difficult to meet increasingly stringent data security and privacy compliance requirements. Federated Learning (FL), as a novel distributed machine learning paradigm, provides an effective way to solve the problems of data silos and privacy protection by enabling multi-party collaborative modeling without sharing raw data. In the federated learning framework, the central server coordinates the training process, and each client trains its model locally using its private data and uploads model update information to the server, thus achieving a distributed learning model where "data does not leave its domain." This model has already been initially applied in scenarios such as input method prediction and recommendation systems.

[0003] However, despite the privacy advantages of federated learning, it inevitably exposes gradients or model parameters during model updates. Attackers could potentially recover sensitive user data from these updates using techniques such as gradient inversion and membership inference. To further enhance privacy, Differential Privacy (DP) has been introduced into federated learning frameworks. This approach injects random noise during model updates to limit the impact of individual samples on the model output, thus providing strict privacy guarantees.

[0004] Most existing differential privacy-preserving federated learning methods employ fixed gradient pruning thresholds and fixed noise intensities, injecting noise uniformly across all model parameter dimensions. However, in actual training, model gradients typically exhibit significant non-uniform distribution, with a large number of gradient components concentrated in near-zero regions, and only a small number of critical gradients playing a major role in model convergence. Treating all parameter dimensions equally with pruning and noise injection easily injects a large amount of noise into parameters that contribute little to model updates, not only wasting privacy budgets but also significantly reducing the model's convergence speed and final accuracy.

[0005] In existing technologies, several invention patents have explored privacy protection issues in federated learning. Patent application CN113591145A discloses a global model training method for federated learning based on differential privacy and quantization. This method reduces the risk of privacy leakage by quantizing model updates and injecting noise. However, it still uniformly introduces noise across all model parameter dimensions, failing to consider the differences in the importance of gradients across different parameter dimensions, which can easily lead to a decrease in model utility. Patent application CN111091199A discloses a federated learning method based on differential privacy, which satisfies differential privacy constraints by introducing random noise of fixed intensity during model updates. However, its noise parameters remain unchanged during training, making it difficult to adapt to the dynamic changes in gradient magnitude at different stages of model training, thus affecting model convergence performance. The invention patent with publication number CN112232528A proposes a federated learning model training method that achieves privacy protection by uniformly pruning and perturbing the model parameters. However, this method does not distinguish the degree of contribution of different gradient components to the model update, and still has the problems of uneven allocation of privacy budget and excessive perturbation of key gradients.

[0006] In addition, the invention patent with publication number CN118504659A proposes a federated hierarchical learning method based on differential privacy, which enhances privacy protection capabilities through hierarchical structure. However, its privacy noise is still injected using a fixed or preset strategy, and it fails to combine gradient distribution characteristics for fine-grained control. Summary of the Invention

[0007] To address the common technical problems of existing differential privacy federated learning methods during model training, such as static noise injection strategies, lack of differentiation of gradient importance, and difficulty in balancing privacy protection and model utility, this invention proposes a federated learning method based on importance gradient updates and adaptive differential privacy control. Within the federated learning framework, the importance of model gradients across parameter dimensions is evaluated to guide gradient selection and sparsification updates. Furthermore, historical statistical information of gradient norms is used to adaptively adjust the intensity of differential privacy noise. This effectively reduces the interference of invalid noise on model training while ensuring strict privacy constraints, thereby improving the model's convergence speed and prediction accuracy. Compared to existing technologies, this invention does not uniformly inject fixed-intensity noise across all model parameter dimensions. Instead, it fully utilizes the non-uniformity of model gradient distribution, focusing privacy protection resources on key gradient components that contribute significantly to model updates. Simultaneously, the noise injection intensity is adaptively adjusted based on the dynamic changes in gradient intensity during model training, matching the privacy protection intensity with the model training phase. This achieves an effective balance between privacy security and model utility, making it suitable for data privacy protection scenarios in multi-party collaborative modeling.

[0008] To achieve the above objectives, the technical solution of this invention is implemented as follows: a federated learning method based on importance gradient update and adaptive differential privacy control, comprising the following steps:

[0009] S1: The client initializes the model based on the global initial model weights and training parameters broadcast by the central server, and forms the local training dataset and test set for each client.

[0010] S2: The client trains the local model based on the local training dataset, calculates the local model gradient, evaluates the importance of each parameter dimension of the local model gradient, and obtains the gradient statistical distribution vector.

[0011] S3: The client selects key gradient components in the local model gradient based on the gradient statistical distribution vector to form a sparse gradient;

[0012] S4: Based on the gradient strength metric collected during the training process in step S2, the intensity of differential privacy noise is adaptively adjusted to obtain a noisy gradient. After injecting noise into the sparse gradient, the local model is updated. The central server aggregates the updated model parameters from each client to update the global model parameters.

[0013] S5: Repeat steps S2 to S4 to achieve iterative training of the global model; the central server uses the test set to evaluate the model performance based on the updated global model parameters, and ends the training when the global model reaches the preset maximum number of training rounds on the test set.

[0014] Preferably, using the CIFAR-10 dataset with the same number of images for each category, the images in the training set of the CIFAR-10 dataset are randomly assigned to each local client in a non-independent and identically distributed manner, forming the first... Local training dataset for each client Images from the test set of the CIFAR-10 dataset are kept on the central server and are not used for training. They are only used to test the updated global model after each round of global aggregation, and to calculate the classification accuracy to evaluate the model performance.

[0015] Under the coordination of the central server, all clients jointly train a global model, and the optimizers of each client all use stochastic gradient descent.

[0016] When a federated learning task is created, the central server broadcasts the global initial model weights to each client. Global initial learning rate and the largest training round in the local area ;

[0017] No. Each client is based on the received global initial model weights. and global initial learning rate The local model is initialized and updated to obtain its initial weights. and local model learning rate .

[0018] Preferably, in the first In the round of global training, the first to participate in the training Each client receives global model parameters sent by the central server. And used as initial parameters for training the local model. And based on a pre-partitioned local training dataset The local model is trained using a stochastic gradient descent optimizer. Update and upload local model parameters after each local iteration. The central server receives the local model parameters from all clients, performs a weighted average to obtain the global model parameters for the next round, and then distributes the global model parameters to each client.

[0019] During local training, each client evaluates the importance of each parameter dimension based on its local model gradient to reflect the relative importance of different parameter dimensions in model training; at the same time, gradient strength metrics are collected.

[0020] Preferably, the method for calculating the gradient of the local model is as follows:

[0021] Flatten all trainable parameters of the global model into a d-dimensional vector to obtain the parameter vector. Each component Trainable weights in the global model; given the loss function of the local model. gradient vector for Each gradient component represents the loss function. Local sensitivity to the corresponding component;

[0022] Client on gradient vector conduct Norm clipping, the first Each client is based on a local training dataset. In the The clipped local model gradients obtained during global training

[0023] in, This is the gradient clipping threshold. Representing vectors Norm, Indicates the first The client in the first Round of global training, the first Local model parameters after the next local iteration This represents the loss function of the local model. Represents the loss function The gradient.

[0024] Preferably, the method for obtaining the gradient statistical distribution vector is as follows:

[0025] gradient of the local model Dimensions of each parameter Calculate the corresponding statistics to obtain the importance measure: in, Indicates the gradient parameter dimension index. It is an absolute value function. Represents the gradient of the local model. Gradient values ​​in each dimension This represents the total dimension of the model parameters;

[0026] No. Each client sorts the statistics corresponding to each parameter dimension by numerical value, forming a gradient statistical distribution vector: in, This indicates a descending order sorting operation;

[0027] Collect local model gradients

[0028] Preferably, the method for forming sparse gradients is as follows:

[0029] No. Each client is based on the gradient statistical distribution vector Construct gradient selection mask Among them, gradient selection mask variable in, For the first A threshold parameter used to control the gradient retention ratio during round-based global training;

[0030] No. Each client selects a mask based on the gradient. gradient of the local model Screening is performed to form an importance-guided sparse gradient. in, This indicates element-wise multiplication, where the gradient components of the gradient of the unselected local model are set to zero.

[0031] Preferably, based on a preset sparsity ratio In the sorted gradient statistical distribution vector Selected from The values ​​at each position are used as the threshold. .

[0032] Preferably, the method for adaptively adjusting the differential privacy noise intensity to obtain the noise gradient is as follows:

[0033] In the In the round of global training, the central server obtains the gradient strength metric based on step S2. The gradient strength metrics of multiple clients participating in the current training round are statistically analyzed to obtain the average gradient strength metric: in, This indicates the number of clients participating in the current training round;

[0034] Based on average gradient strength Combined with scaling parameters used to control the noise conditioning scale Calculate the adaptive noise adjustment factor in, The hyperbolic tangent function ;

[0035] Based on adaptive noise adjustment factor Gaussian noise is injected into the sparse gradient to obtain a noisy gradient. in, This indicates that the mean is zero and the covariance is... Multidimensional Gaussian distribution, for 3D identity matrix This is the gradient clipping threshold.

[0036] Preferably, the local model learning rate is used. Update local model parameters After completing the local model update, all clients participating in this round of training will update their local model parameters. Uploaded to the central server; the central server then uses the local training dataset from each client. Perform a weighted average to obtain the global model parameters for the next round:

[0037]

[0038] in, The number of local datasets owned by the client. This represents the total number of client datasets participating in the training.

[0039] The central server distributes the updated global model parameters to all clients, initiating the next round of training.

[0040] Preferably, the scaling parameter The value is determined based on the adaptive noise adjustment factor. The degree of influence is divided into:

[0041] When scaling parameters Average gradient strength metric noise modulation factor The impact is weakened, the adaptive noise intensity changes relatively smoothly, the noise decay rate is slow, and strong privacy protection is maintained during training.

[0042] When scaling parameters Average gradient strength metric With noise modulation factor A balance is achieved between these factors, resulting in a compromise between the strength of privacy protection and the model's convergence performance;

[0043] When scaling parameters Average gradient strength metric noise modulation factor The influence of noise is enhanced, and the noise intensity decays faster during the training process, which is beneficial for the model to be finely optimized in the later stages.

[0044] The beneficial effects of this invention are as follows: This invention effectively solves the problem of balancing privacy protection and model utility in practical applications of differential privacy federated learning. While ensuring strict privacy and security constraints, it significantly improves the convergence speed and prediction accuracy of model training. Specifically, in the implementation of this invention, each client performs statistical analysis on the distribution characteristics of the model gradient across the parameter dimensions during the local training phase. Based on the gradient importance evaluation results, it selects key gradient components that contribute significantly to model updates, thereby avoiding the indiscriminate injection of privacy noise into all parameter dimensions. This importance-guided gradient selection method effectively reduces the interference of redundant noise on model training, improves the utilization efficiency of the privacy budget, alleviates the problem of inconsistent model update directions caused by differences in data distribution, and improves the convergence performance of the global model. Furthermore, this invention introduces an adaptive differential privacy noise control mechanism based on historical statistical information of the gradient norm during model training. It dynamically adjusts the noise injection intensity according to the changes in gradient strength at different stages of model training. In the early stages of training, when the gradient amplitude is large, a high noise intensity is maintained to enhance privacy protection; in the later stages of training, as the model gradually converges and the gradient amplitude decreases, the noise intensity correspondingly and smoothly decays, which is beneficial for fine-tuning the model. This adaptive noise adjustment mechanism effectively avoids the performance loss caused by the fixed noise strategy and improves the final accuracy of the model.

[0045] This invention effectively reduces invalid noise interference while satisfying differential privacy constraints, thereby improving the convergence speed and prediction accuracy of the model. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart of the present invention.

[0048] Figure 2 This is a framework diagram of the present invention.

[0049] Figure 3 This is a trend graph showing the change of the loss function over time in comparison with other methods of the present invention. Detailed Implementation

[0050] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] like Figure 1 As shown, this invention provides a federated learning training method based on importance gradient update and adaptive differential privacy control, executed by a federated learning system, which includes a central server and multiple local clients participating in the training, such as... Figure 2 As shown. The present invention specifically includes the following steps:

[0052] S1: The client initializes the model based on the global initial model weights and training parameters broadcast by the central server, and forms the local training dataset and test set for each client.

[0053] As an example, Figure 2The training framework diagram of the method in this embodiment is given. This embodiment uses the CIFAR-10 dataset (CIFAR-10 stands for Canadian Institute for Advanced Research -10 classes; it is a widely used color image dataset in computer vision). The CIFAR-10 dataset consists of 60,000 32×32 RGB color images, divided into 10 categories (including airplane, car, bird, cat, deer, dog, frog, horse, boat, and truck). The training set contains 50,000 images, and the test set contains 10,000 images. Each category in the CIFAR-10 dataset has the same number of images, i.e., 5,000 images per category in the training set and 1,000 images per category in the test set. Specifically, the 50,000 training set images are randomly distributed to k local clients in a non-independent identically distributed (Non-IID) manner, forming local training datasets for each client. This is used for gradient calculation and updating of the local model. 10,000 test set images are stored on the central server, not used for training, but only for testing the updated global model after each round of global aggregation, calculating classification accuracy to evaluate model performance.

[0054] The experiment of this invention simulates that each client trains a global model together under the coordination of a central server. The optimizer of each client adopts stochastic gradient descent (SGD) to verify the classification performance of the model on the CIFAR-10 dataset.

[0055] First, when the federated learning task is created, the central server broadcasts the global initial model to all clients. Global initial learning rate and the largest training round in the local area This is used to unify the initial training state of each client.

[0056] Furthermore, each client k is determined based on the received global initial model weights. and global initial learning rate The local model is initialized and updated to obtain its initial weights. and local model learning rate This provides initial conditions for subsequent local training and gradient calculation.

[0057] S2: The client trains the local model based on the local training dataset, calculates the local model gradient, evaluates the importance of each parameter dimension of the local model gradient, and obtains the gradient statistical distribution vector.

[0058] Furthermore, the local model training and update method is as follows:

[0059] In the In the round of global training, for those participating in the training Each client receives global model parameters sent by the central server. And used as initial parameters for training the local model. And based on the local training dataset pre-divided in step S1 The local model is trained using a stochastic gradient descent optimizer. Update and upload local model parameters after each local iteration. The central server receives the local model parameters from all clients and performs a weighted average (the weights are calculated based on the number of local datasets owned by each client). Divided by the total dataset of clients participating in training The system obtains the global model parameters for the next round and then distributes these parameters to each client.

[0060] Furthermore, during local training, each client evaluates the importance of each parameter dimension based on its local model gradient, reflecting the relative importance of different parameter dimensions in model training. Simultaneously, gradient strength metrics are collected for subsequent adaptive differential privacy parameter control. Specifically, all trainable parameters of the model's neural network are first flattened into a d-dimensional vector. Let... This represents the flattened parameter vector, where each component... This corresponds to a specific trainable weight or bias in the model. Given a loss function. gradient vector Defined as Each gradient component represents the local sensitivity of the loss function to the corresponding parameter.

[0061] To satisfy differential privacy constraints, the client processes the gradient vector. conduct Norm clipping, the first Each client is based on a local training dataset. In the The clipped local model gradients obtained during global training

[0062]

[0063] in, Gradient clipping threshold (take) =0.01 (as the default pruning threshold) is used to limit the maximum sensitivity of gradients uploaded by a single client. Representing vectors Norm, Indicates the first The client in the first Round of global training, the first Local model parameters after the next local iteration This represents the loss function of the local model. The loss function of the local model The gradient.

[0064] Then collect the local model gradients. This is used for subsequent adaptive adjustment of the differential privacy noise intensity. Next, the gradient of the local model is... Dimensions of each parameter Calculate the corresponding statistics to obtain the importance measure:

[0065]

[0066] in, Indicates the gradient parameter dimension index. It is an absolute value function. Represents the gradient vector of the first element. The values ​​of each dimension This represents the total dimension of the model parameters.

[0067] No. Each client sorts the statistics corresponding to each parameter dimension by numerical value, forming a gradient statistical distribution vector:

[0068]

[0069] in, This indicates a descending order sorting operation.

[0070] S3: The client selects key gradient components in the local model gradient based on the gradient statistical distribution vector to form sparse gradients, and uses the sparse gradients for subsequent privacy protection processing. Unselected gradient components do not participate in the model update of the current round.

[0071] Furthermore, the client, based on the gradient statistical distribution vector... Construct gradient selection mask

[0072]

[0073] Among them, gradient selection mask variable

[0074]

[0075] in, For the first The threshold parameter used to control the gradient retention ratio during round-wide training, where the threshold is determined based on a preset sparsity rate. (For example (This indicates that the top 10% of parameters are retained), and the gradient statistical distribution vector after sorting. Selected from The values ​​at each position are used as the threshold. Empirically explored different sparsity rates The impact of the value on the final model performance was investigated, and a 40% pruning rate (i.e., sparsity rate) was observed. It achieves the best balance between accuracy and sparsity.

[0076] Furthermore, the client selects the mask based on the gradient. gradient of the original local model Screening is performed to form an importance-guided sparse gradient.

[0077]

[0078] in, This indicates element-wise multiplication; the values ​​of unselected gradient components are set to zero and do not participate in the model update of the current round. Based on the gradient importance metric, the client selects gradient components that contribute significantly to the model update to form sparse gradients, and sets the values ​​of unselected gradient components in the current round to zero, preventing them from participating in the model update. This avoids injecting noise into non-critical parameters during subsequent differential privacy noise injection, thus significantly reducing the total noise and improving the signal-to-noise ratio. This enhances model usability and convergence accuracy while maintaining privacy.

[0079] S4: Based on the gradient strength metric collected during the training process in step S2, the intensity of differential privacy noise is adaptively adjusted to obtain a noisy gradient. After injecting noise into the sparse gradient, the local model is updated. The central server aggregates the updated model parameters from each client to update the new global model parameters.

[0080] Furthermore, in the In the round of global training, the central server obtains the gradient strength metric based on step S2. The gradient strength metrics of multiple clients participating in the current training round are statistically analyzed to obtain the average gradient strength metric:

[0081]

[0082] in, This indicates the number of clients participating in the current training round.

[0083] Furthermore, based on the average gradient strength Combined with scaling parameters used to control the noise conditioning scale Calculate the adaptive noise adjustment factor:

[0084]

[0085] in, The hyperbolic tangent function This is used to smoothly map gradient intensity changes to an adaptive noise adjustment factor. Adaptive noise adjustment factor Used to adjust the intensity of differential privacy noise. Adaptive noise adjustment factor. This is used to dynamically adjust the injection intensity of differential privacy noise in subsequent steps to adapt to the privacy protection requirements and convergence characteristics at different stages of model training.

[0086] Furthermore, based on the aforementioned adaptive noise adjustment factor Gaussian noise is injected into the sparse gradient to obtain a noisy gradient. in, This indicates that the mean is zero and the covariance is... Multidimensional Gaussian distribution, The noise scale parameter is determined based on the adaptive noise adjustment factor. for 3D identity matrix.

[0087] Furthermore, the local model learning rate is used. Update local model parameters After completing the local update, all clients participating in this training round will update their local model parameters. Uploaded to the central server. The central server then uses the local training dataset from each client. A weighted average is then performed to obtain the global model parameters for the next round:

[0088]

[0089] Among them, the weight calculation method The number of local datasets owned by the client Divided by the total dataset of clients participating in training Subsequently, the central server distributes the updated global model parameters to all clients, initiating the next round of training.

[0090] Furthermore, the scaling parameters The value is determined based on its effect on the adaptive noise adjustment factor. The degree of impact can be divided into the following three situations:

[0091] When scaling parameters When the value is large Average gradient strength metric noise modulation factor The impact is weakened, the adaptive noise intensity changes more gradually, and the noise decay rate is slower, thus maintaining a strong privacy protection capability during training.

[0092] When scaling parameters When the value is appropriate Average gradient strength metric With noise modulation factor A balance is achieved between these factors, resulting in a compromise between the strength of privacy protection and the model's convergence performance;

[0093] When scaling parameters When the value is small Average gradient strength metric noise modulation factor The influence of noise is enhanced, and the noise intensity decays faster during the training process, which is beneficial for the model to be finely optimized in the later stages.

[0094] S5: Repeat steps S2 to S4 to achieve iterative training of the global model. The central server uses the test set data from step S1 to evaluate the model performance based on the updated global model parameters. When the global model reaches the preset maximum number of training epochs (global training epochs) on the test set... Training ends when (the time is reached).

[0095] The algorithm of this invention compares the Fixed Differential Privacy Noise Injection Method (FixDP) and the Federated Sparse Masking Method (FedSMP) based on public data. FixDP employs a fixed-intensity noise injection strategy, adding constant differential privacy noise to all model parameter updates throughout the training process. FedSMP, on the other hand, selects the first [model] with the largest update magnitude... Each coordinate is used as an active dimension for sparse updates. To avoid directly exposing gradient importance information related to each client's data, this method uses a public dataset on the server to generate a universal Top-mask and broadcasts it to all clients.

[0096] like Figure 3 As shown, the algorithm of this invention compares the Fixed Differential Privacy Noise Injection Method (FixDP) and the Federated Sparse Masking Method (FedSMP) based on public data. FixDP employs a fixed-intensity noise injection strategy, adding constant differential privacy noise to all model parameter updates throughout the training process. FedSMP selects the first... Each coordinate is used as an active dimension for sparse updates. To avoid directly exposing gradient importance information related to each client's data, this method uses a public dataset on the server to generate a universal Top-mask and broadcasts it to all clients.

[0097] Experimental results show that the present invention achieves the best convergence speed, stability, and final accuracy. Thanks to the gradient-based importance assessment and adaptive noise control mechanism proposed in this invention, the algorithm can dynamically select key parameters based on the true gradient of local data and adaptively reduce noise interference as the training process progresses. This not only avoids the misleading effects of public dataset bias in FedSMP but also solves the problem of excessive invalid noise in FixDP, thus achieving optimal model performance while ensuring privacy.

[0098] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A federated learning method based on importance gradient update and adaptive differential privacy control, characterized in that, The steps are as follows: S1: The client initializes the model based on the global initial model weights and training parameters broadcast by the central server, and forms the local training dataset and test set for each client. S2: The client trains the local model based on the local training dataset, calculates the gradient of the local model, evaluates the importance of each parameter dimension of the local model gradient, and obtains the gradient statistical distribution vector. S3: The client selects key gradient components in the local model gradient based on the gradient statistical distribution vector to form a sparse gradient; S4: Based on the gradient strength metric collected during the training process in step S2, the intensity of differential privacy noise is adaptively adjusted to obtain a noisy gradient. After injecting noise into the sparse gradient, the local model is updated. The central server aggregates the updated model parameters from each client to update the global model parameters. S5: Repeat steps S2 to S4 to achieve iterative training of the global model; the central server uses the test set to evaluate the model performance based on the updated global model parameters, and ends the training when the global model reaches the preset maximum number of training rounds on the test set.

2. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 1, characterized in that, Using the CIFAR-10 dataset, which has the same number of images for each category, the images from the CIFAR-10 training set are randomly distributed to local clients in a non-independent and identically distributed manner, forming the... Local training dataset for each client Images from the test set of the CIFAR-10 dataset are kept on the central server and are not used for training. They are only used to test the updated global model after each round of global aggregation, and to calculate the classification accuracy to evaluate the model performance. Under the coordination of the central server, all clients jointly train a global model, and the optimizers of each client all use stochastic gradient descent. When a federated learning task is created, the central server broadcasts the global initial model weights to each client. Global initial learning rate and the largest training round in the local area ; No. Each client is based on the received global initial model weights. and global initial learning rate The local model is initialized and updated to obtain its initial weights. and local model learning rate .

3. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 1 or 2, characterized in that, In the In the round of global training, the first to participate in the training Each client receives global model parameters sent by the central server. And used as initial parameters for training the local model. And based on a pre-partitioned local training dataset The local model is trained using a stochastic gradient descent optimizer. Update and upload local model parameters after each local iteration. The central server receives the local model parameters from all clients, performs a weighted average to obtain the global model parameters for the next round, and then distributes the global model parameters to each client. During local training, each client evaluates the importance of each parameter dimension based on its local model gradient to reflect the relative importance of different parameter dimensions in model training; at the same time, gradient strength metrics are collected.

4. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 3, characterized in that, The method for calculating the gradient of the local model is as follows: Flatten all trainable parameters of the global model into a d-dimensional vector to obtain the parameter vector. Each component These are the trainable weights in the global model; Given the loss function of the local model gradient vector for Each gradient component represents the loss function. Local sensitivity to the corresponding component; Client on gradient vector conduct Norm clipping, the first Each client is based on a local training dataset. In the The clipped local model gradients obtained during global training in, This is the gradient clipping threshold. Representing vectors Norm, Indicates the first The client in the first Round of global training, the first Local model parameters after the next local iteration This represents the loss function of the local model. Represents the loss function The gradient.

5. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 4, characterized in that, The method for obtaining the gradient statistical distribution vector is as follows: gradient of the local model Dimensions of each parameter Calculate the corresponding statistics to obtain the importance measure: in, Indicates the gradient parameter dimension index. It is an absolute value function. Represents the gradient of the local model. Gradient values ​​in each dimension This represents the total dimension of the model parameters; No. Each client sorts the statistics corresponding to each parameter dimension by numerical value, forming a gradient statistical distribution vector: in, This indicates a descending order sorting operation; Collect local model gradients 6. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 5, characterized in that, The method for forming sparse gradients is as follows: No. Each client is based on the gradient statistical distribution vector Construct gradient selection mask Among them, gradient selection mask variable in, For the first A threshold parameter used to control the gradient retention ratio during round-based global training; No. Each client selects a mask based on the gradient. gradient of the local model Screening is performed to form an importance-guided sparse gradient. in, This indicates element-wise multiplication, where the gradient components of the gradient of the unselected local model are set to zero.

7. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 6, characterized in that, Based on the preset sparsity In the sorted gradient statistical distribution vector Selected from The values ​​at each position are used as the threshold. .

8. The federated learning method based on importance gradient update and adaptive differential privacy control according to any one of claims 4-7, characterized in that, The method for adaptively adjusting the differential privacy noise intensity to obtain the noise gradient is as follows: In the In the round of global training, the central server obtains the gradient strength metric based on step S2. The gradient strength metrics of multiple clients participating in the current training round are statistically analyzed to obtain the average gradient strength metric: in, This indicates the number of clients participating in the current training round; Based on average gradient strength Combined with scaling parameters used to control the noise conditioning scale Calculate the adaptive noise adjustment factor in, The hyperbolic tangent function ; Based on adaptive noise adjustment factor Gaussian noise is injected into the sparse gradient to obtain a noisy gradient. in, This indicates that the mean is zero and the covariance is... Multidimensional Gaussian distribution, for 3D identity matrix This is the gradient clipping threshold.

9. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 7, characterized in that, Learning rate of the local model Update local model parameters After completing the local model update, all clients participating in this round of training will update their local model parameters. Uploaded to the central server; The central server uses the local training datasets of each client. Perform a weighted average to obtain the global model parameters for the next round: in, The number of local datasets owned by the client. This represents the total number of client datasets participating in the training. The central server distributes the updated global model parameters to all clients, initiating the next round of training.

10. The federated learning method based on importance gradient update and adaptive differential privacy control according to claim 9, characterized in that, The scaling parameters The value is determined based on the adaptive noise adjustment factor. The degree of influence is divided into: When scaling parameters Average gradient strength metric noise modulation factor The impact is weakened, the adaptive noise intensity changes relatively smoothly, the noise decay rate is slow, and strong privacy protection is maintained during training. When scaling parameters Average gradient strength metric With noise modulation factor A balance is achieved between these factors, resulting in a compromise between the strength of privacy protection and the model's convergence performance; When scaling parameters Average gradient strength metric noise modulation factor The influence of noise is enhanced, and the noise intensity decays faster during the training process, which is beneficial for the model to be finely optimized in the later stages.

Images