A federated adversarial learning method, device, storage medium and electronic equipment

Abstract

The application provides a federal confrontation learning method, device, storage medium and electronic equipment. The method is applied to the field of computer technology. The method comprises the following steps: if a server model does not converge, a client performs feature extraction processing on a target training sample to obtain a first embedding vector and sends the first embedding vector to the server; the server generates a first loss difference based on the first embedding vector, calculates a zero-order gradient and a relaxation variable, and sends the zero-order gradient and the relaxation variable to the client; the client updates the target training sample according to the zero-order gradient and the relaxation variable to obtain a target confrontation sample, performs feature extraction processing on the target confrontation sample to obtain a second embedding vector, and sends the second embedding vector to the server; the server calculates a second loss difference based on the second embedding vector and sends the second loss difference to the client; and the server model and the client model are updated in parameters based on the second loss difference. The method can improve the communication efficiency in confrontation learning.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a federated adversarial learning method, apparatus, storage medium, and electronic device in the field of computer technology. Background Technology

[0002] Federated Learning (FL) is a distributed machine learning method that allows multiple client devices and one server device to collaboratively train a model. Existing technologies often use federated learning for model training to improve efficiency. Vertical Federated Learning (VFL) consists of a top-level model maintained by the server and multiple bottom-level models. Each bottom-level model resides on a participating client. During training, each client uses its own bottom-level model to calculate local embeddings of data features and transmits them to the server via a communication channel. The server aggregates these embeddings to update the top-level model and then sends the gradients back to the clients to update the bottom-level models accordingly. Therefore, performing adversarial learning on top of vertical federated learning consumes significant resources and time in communication between the server and clients, reducing the efficiency of federated adversarial learning. A method to improve the communication efficiency of federated adversarial learning is needed. Summary of the Invention

[0003] This application provides a federated adversarial learning method, apparatus, storage medium, and electronic device. The method can calculate the zero-order gradient and slack variables on the server side, realize delayed propagation based on the slack variables, and realize gradient estimation based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0004] In a first aspect, embodiments of this application provide a federated adversarial learning method applied to a server, the method comprising: If the server-side model does not converge, then obtain the first embedding vector returned by the client for the target training sample; Based on the first embedding vector, a first loss difference is generated, and the zeroth-order gradient and relaxation variable are calculated based on the first loss difference; The zeroth-order gradient and the relaxation variable are sent to the client, and the second embedding vector returned by the client is received. The second embedding vector is calculated by the client for the target training sample based on the zeroth-order gradient and the relaxation variable. Calculate the second loss difference based on the second embedding vector, and send the second loss difference to the client so that the client can update the parameters of the client model based on the second loss difference. The server-side model is updated based on the second loss difference.

[0005] Secondly, embodiments of this application provide a federated adversarial learning method applied to a client, the method comprising: The first embedding vector is obtained by performing feature extraction on the target training sample and then sent to the server. Obtain the zero-order gradient and relaxation variable returned by the server based on the embedding vector; the server generates a first loss difference based on the embedding vector; and calculates the zero-order gradient and relaxation variable based on the first loss difference. Based on the zeroth-order gradient and the relaxation variables, the target training samples are updated to obtain the target adversarial samples. The second embedding vector is obtained by performing feature extraction processing on the target adversarial sample, and then the second embedding vector is sent to the server. Obtain the second loss difference returned by the server based on the second embedding vector; The client model is updated with parameters based on the second loss difference.

[0006] Thirdly, embodiments of this application provide a federated adversarial learning device applied to a server, the device comprising: The first vector receiving unit is used to obtain the first embedding vector returned by the client for the target training sample if the server model does not converge. The first loss calculation unit is used to generate a first loss difference based on the first embedding vector, and to calculate the zero-order gradient and relaxation variable based on the first loss difference. The second vector receiving unit is used to send the zero-order gradient and the relaxation variable to the client and receive the second embedding vector returned by the client. The second embedding vector is calculated by the client based on the zero-order gradient and the relaxation variable for the target training sample. The second loss calculation unit is used to calculate the second loss difference based on the second embedding vector and send the second loss difference to the client so that the client can perform parameter update processing on the client model based on the second loss difference. The server-side model update unit is used to perform parameter update processing on the server-side model based on the second loss difference.

[0007] Fourthly, embodiments of this application provide a federated adversarial learning device applied to a client, the device comprising: The first vector sending unit is used to perform feature extraction processing on the target training sample to obtain the first embedding vector, and send the first embedding vector to the server. The first loss receiving unit is used to obtain the zero-order gradient and relaxation variable returned by the server based on the embedding vector, the server generates a first loss difference based on the embedding vector, and calculates the zero-order gradient and relaxation variable based on the first loss difference; The sample update unit is used to update the target training sample according to the zero-order gradient and the relaxation variable to obtain the target adversarial sample; The second vector sending unit is used to perform feature extraction processing on the target adversarial sample to obtain a second embedding vector, and send the second embedding vector to the server. The second loss receiving unit is used to obtain the second loss difference returned by the server based on the second embedding vector; The client model update unit is used to update the parameters of the client model based on the second loss difference.

[0008] Fifthly, embodiments of this application provide a computer storage medium storing a plurality of instructions adapted for loading by a processor and executing the above-described method steps.

[0009] Sixthly, embodiments of this application provide an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the above-described method steps.

[0010] In one or more embodiments of this application, if the server-side model does not converge, the client performs feature extraction processing on the target training samples to obtain a first embedding vector, and sends the first embedding vector to the server. The server generates a first loss difference based on the first embedding vector, calculates the zero-order gradient and relaxation variables based on the first loss difference, and sends the zero-order gradient and relaxation variables to the client. The client updates the target training samples based on the zero-order gradient and relaxation variables to obtain a target adversarial sample, performs feature extraction processing on the target adversarial sample to obtain a second embedding vector, and sends the second embedding vector to the server. The server calculates a second loss difference based on the second embedding vector, sends the second loss difference to the client, updates the parameters of the client model based on the second loss difference, and updates the parameters of the server model based on the second loss difference. By calculating the zero-order gradient and relaxation variables on the server, implementing delayed propagation based on the relaxation variables, and implementing gradient estimation based on the zero-order gradient, the number of communications between the server and the client is reduced, improving the communication efficiency in adversarial learning. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a system architecture diagram of federated adversarial learning provided in an embodiment of this application; Figure 2 This is a flowchart illustrating a federated adversarial learning method based on a server and a client, provided in an embodiment of this application. Figure 3 This is a flowchart illustrating a server-based federated adversarial learning method provided in an embodiment of this application. Figure 4 This is a flowchart illustrating a server-based federated adversarial learning method provided in an embodiment of this application. Figure 5 This is a flowchart illustrating a client-based federated adversarial learning method provided in an embodiment of this application; Figure 6 This is a flowchart illustrating a client-based federated adversarial learning method provided in an embodiment of this application; Figure 7 This is a schematic diagram of a federated adversarial learning device applied to a server, provided in an embodiment of this application. Figure 8 This is a schematic diagram of the structure of a federated adversarial learning device applied to a client, provided in an embodiment of this application; Figure 9 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0013] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0014] When training a model using federated learning, a server-maintained upper-layer model and multiple lower-layer models can be used. Each lower-layer model resides on a participating client. During training, each client uses its own lower-layer model to calculate local embeddings of data features and transmits them to the server via a communication channel. The server aggregates these embeddings to update the upper-layer model and then sends the gradients back to the clients to update the lower-layer models accordingly. Vertical federated learning is a type of federated learning that can be applied to scenarios where different clients have the same samples but different feature spaces. For example, when the samples are users, the clients can be banks or e-commerce platforms. Banks can provide features related to user spending amounts, while e-commerce platforms can provide features related to user spending behavior. To increase the robustness of the model, adversarial training (AT) is incorporated during training. Adversarial examples are used as training samples, allowing attacks to be generated on the model during iterative training to maximize the perturbation of the loss. This trains the model to maintain its stability and output correct results even under perturbation. Combining vertical federated learning with adversarial training leads to computationally intensive adversarial example generation during training, requiring sequential forward and backward propagation to calculate gradients and iteratively optimize the input. This increases communication costs, making it difficult to balance model robustness and communication efficiency during training. This application provides a federated adversarial learning method that optimizes communication efficiency between the server and client during adversarial training by combining the delayed propagation principle and zero-order optimization. The federated adversarial learning method provided can be implemented using a computer program and can run on a von Neumann-based federated adversarial learning device. This computer program can be integrated into an application or run as a standalone utility application. The federated adversarial learning device can be a server or client, or a module or application within the server or client to implement the federated adversarial learning method.

[0015] Please see also Figure 1This application provides a system architecture diagram for federated adversarial learning, which can consist of a server and multiple clients. The server can contain a server-side model (upper-layer model), and the clients can contain client-side models (lower-layer models). At the start of model training, the server-side model and the client-side model have the same model parameters. When the server indicates that training is needed for a training sample, since different clients store different training spaces for the same training sample, each client can obtain different embedding vectors for the same training sample. After all clients send their embedding vectors to the server, the server can calculate the zero-order gradient and slack variable based on all the embedding vectors and send the zero-order gradient and slack variable to the clients. This allows the clients to update the adversarial samples based on the zero-order gradient and slack variable, thereby achieving delayed propagation through the slack variable and gradient estimation through the zero-order gradient. This reduces the number of communications between the server and clients and improves the communication efficiency in adversarial learning.

[0016] The federated adversarial learning method provided in this application will be described in detail below with reference to specific embodiments.

[0017] Please see Figure 2 This document provides a flowchart illustrating a federated adversarial learning method based on a server and a client, as described in an embodiment of this application. Figure 2 As shown, the embodiments of this application are described in conjunction with the server side and the client side. The method may include the following steps S101-S111.

[0018] S101, if the server-side model does not converge, the client performs feature extraction processing on the target training samples to obtain the first embedding vector.

[0019] Specifically, during model training, if the server-side model does not converge, it means that vertical federated learning and adversarial training are needed to continue model training. The client can use the client-side model to perform feature extraction processing on the target training samples to obtain the first embedding vector. The first embedding vector is the embedding vector corresponding to the target training sample. The target training sample can be randomly determined by the server or determined by the server according to a preset sample selection rule. The preset sample selection rule can be the initial setting of the federated adversarial learning device or can be set by relevant personnel.

[0020] Since different clients have different feature spaces for the same target training samples, different clients use their own deployed client models, and the resulting first embedding vectors are also different.

[0021] S102, the client sends the first embedding vector to the server.

[0022] Specifically, each client can send the obtained first embedding vector to the server, and the server can obtain the first embedding vector returned by all clients for the target training sample.

[0023] S103, the server generates the first loss difference based on the first embedding vector, and calculates the zero-order gradient and slack variable based on the first loss difference.

[0024] Specifically, after the server obtains the first embedding vector of the target training sample, it can calculate the loss difference using the server-side model based on the first embedding vector, and confirm the obtained loss difference as the first loss difference. The loss difference can be the average of the differences between two loss values ​​obtained by perturbing along random directions around the embedding vector. Then, the zeroth-order gradient and relaxation variables are calculated based on the first loss difference. The zeroth-order gradient is the approximate true gradient obtained by projecting the loss difference onto random directions without using analytical derivatives, and the relaxation variables are the upper bound used to control the maximum perturbation norm allowed in the embedding space.

[0025] Optionally, the server can perform perturbation processing with a preset perturbation along a random direction around the first embedding vector and obtain two loss values. Then, the difference between the two loss values ​​is calculated and divided by 2 to obtain the first loss difference corresponding to the first embedding vector. The preset perturbation can be the initial setting of the adversarial learning device or can be preset by relevant personnel. The preset perturbation can be stored not only in the server for perturbation processing by the server, but also in the client for subsequent perturbation processing and perturbation update processing by the client.

[0026] S104, the server sends the zeroth gradient and relaxation variables to the client.

[0027] Specifically, the server will send the zeroth-order gradient and relaxation variables calculated based on the first embedding vector back to the client.

[0028] Optionally, since there can be one server and multiple clients in a federated adversarial learning system, each client can send the first embedding vector obtained based on the target training sample to the server. Therefore, the server can calculate the zero-order gradient and relaxation variables based on all the first embedding vectors and return the zero-order gradient and relaxation variables to all clients.

[0029] S105, the client updates the target training samples based on the zero-order gradient and relaxation variables to obtain the target adversarial samples.

[0030] Specifically, after receiving the zero-order gradient and relaxation variables returned by the server, the client can increase the loss based on the zero-order gradient and use the relaxation variables as the upper bound of the maximum perturbation norm, that is, determine the magnitude of the change of the adversarial sample relative to the target training sample, and then update the target training sample to obtain the target adversarial sample.

[0031] Optionally, the client can perform perturbation update processing on the preset perturbation based on the zero-order gradient and relaxation variables to obtain the updated perturbation. For example, the client can use the zero-order gradient as the upward direction to perform upward processing on the preset perturbation, and use relaxation variables to ensure that the perturbation norm does not exceed the relaxation variables. The target adversarial sample can be obtained by adding the updated perturbation to the target training sample.

[0032] S106, the client performs feature extraction processing on the target adversarial sample to obtain the second embedding vector.

[0033] Specifically, the client can use the deployed client model to perform feature extraction on the target adversarial sample to obtain a second embedding vector, which is the embedding vector corresponding to the target adversarial sample.

[0034] S107, the client sends the second embedding vector to the server.

[0035] Specifically, the client can send the second embedding vector to the server.

[0036] S108, the server calculates the second loss difference based on the second embedding vector.

[0037] Specifically, after receiving the second embedding vector returned by the client, the server can calculate the loss difference based on the second embedding vector using the deployed server model, and confirm the obtained loss difference as the second loss difference.

[0038] S109, the server sends the second loss difference to the client.

[0039] Specifically, the server can send the second loss difference to the client for parameter update processing of the client model.

[0040] S110, the client updates the parameters of the client model based on the second loss difference.

[0041] Specifically, the client can update the parameters of the deployed client model based on the second loss difference.

[0042] S111, the server updates the parameters of the server model based on the second loss difference.

[0043] Specifically, the server can update the parameters of the deployed server model based on the second loss difference.

[0044] Optionally, after parameter update processing, it is possible to check whether the server-side model has converged. If the server-side model does not converge, step S101 can be continued. If the server-side model converges, it means that the model training is complete, and the server-side model after parameter update processing can be confirmed as the trained server-side model.

[0045] In this embodiment, if the server-side model fails to converge, the client performs feature extraction on the target training samples to obtain a first embedding vector, which is then sent to the server. The server generates a first loss difference based on the first embedding vector, calculates the zero-order gradient and relaxation variables based on the first loss difference, and sends the zero-order gradient and relaxation variables to the client. The client updates the target training samples based on the zero-order gradient and relaxation variables to obtain target adversarial samples, performs feature extraction on the target adversarial samples to obtain a second embedding vector, and sends the second embedding vector to the server. The server calculates a second loss difference based on the second embedding vector, sends the second loss difference to the client, updates the parameters of the client model based on the second loss difference, and updates the parameters of the server model based on the second loss difference. By calculating the zero-order gradient and relaxation variables on the server, implementing delayed propagation based on the relaxation variables, and implementing gradient estimation based on the zero-order gradient, the number of communications between the server and the client is reduced, improving the communication efficiency in adversarial learning.

[0046] Please see Figure 3 This document provides a flowchart illustrating a server-side federated adversarial learning method as described in an embodiment of this application. Figure 3 As shown in the figure, the embodiments of this application are described in conjunction with the server side, and the method may include the following steps S201-S205.

[0047] S201, if the server-side model does not converge, then obtain the first embedding vector returned by the client for the target training sample.

[0048] Specifically, if the server-side model deployed on the server has not yet converged, the first embedding vector returned by the client for the target training sample can be obtained. The first embedding vector is the embedding vector obtained by the client using the deployed client model to perform feature extraction processing on the target training sample.

[0049] S202, the first loss difference is generated based on the first embedding vector, and the zero-order gradient and relaxation variable are calculated based on the first loss difference.

[0050] Specifically, after obtaining the first embedding vector of the target training sample, the server-side model can be used to calculate the loss difference based on the first embedding vector, and the obtained loss difference is confirmed as the first loss difference. The loss difference can be the average of the differences between two loss values ​​obtained by perturbing along random directions around the embedding vector. Then, the zeroth-order gradient and relaxation variables are calculated based on the first loss difference. The zeroth-order gradient is the approximate true gradient obtained by projecting the loss difference onto random directions without using analytical derivatives, and the relaxation variables are the upper bound used to control the maximum perturbation norm allowed in the embedding space.

[0051] S203 sends the zeroth-order gradient and relaxation variables to the client and receives the second embedding vector returned by the client.

[0052] Specifically, the zero-order gradient and relaxation variables are sent to the client. The client can calculate the target adversarial sample based on the zero-order gradient and relaxation variables for the target training sample, and use the deployed client model to perform feature extraction processing on the target adversarial sample to obtain the second embedding vector and send it to the server. The server can receive the second embedding vector returned by the client.

[0053] S204, calculate the second loss difference based on the second embedding vector, and send the second loss difference to the client.

[0054] Specifically, after receiving the second embedding vector returned by the client, the loss difference can be calculated based on the second embedding vector using the deployed server-side model, and the obtained loss difference is confirmed as the second loss difference. Then, the second loss difference is sent to the client so that the client can update the parameters of the client model based on the second loss difference.

[0055] S205, update the parameters of the server-side model based on the second loss difference.

[0056] Specifically, the parameters of the deployed server-side model can be updated based on the difference in the second loss.

[0057] In this embodiment, if the server-side model fails to converge, the first embedding vector returned by the client for the target training sample is obtained. A first loss difference is generated based on the first embedding vector. The zero-order gradient and relaxation variables are calculated based on the first loss difference and sent to the client. The second embedding vector returned by the client is received, and a second loss difference is calculated based on the second embedding vector. The second loss difference is sent to the client, and the parameters of the server-side model are updated based on the second loss difference. By calculating the zero-order gradient and relaxation variables on the server side, delay propagation is achieved based on the relaxation variables, and gradient estimation is achieved based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0058] Please see Figure 4 This document provides a flowchart illustrating a server-side federated adversarial learning method as described in an embodiment of this application. Figure 4 As shown in the illustration, this application embodiment is described in conjunction with the server side, and the method may include the following steps S301-S309.

[0059] S301, Obtain the first embedding vector returned by the client for the target training sample.

[0060] Specifically, the client can use the deployed client model to perform feature extraction processing on the target training samples to obtain the first embedding vector and send it to the server. The server can receive the first embedding vector returned by the client.

[0061] Optionally, when it is detected that the server-side model has not yet completed model training, a sample acquisition instruction can be sent to the client. The sample acquisition instruction can be used to instruct the client to determine the target training sample and calculate the first embedding vector. The situation that the model training has not yet been completed may include the server-side model not converging.

[0062] S302, the first loss difference is generated based on the first embedding vector, and the zero-order gradient and relaxation variable are calculated based on the first loss difference.

[0063] Specifically, after receiving the first embedding vector sent by the client, the server-side model can calculate the loss difference based on the first embedding vector, and the obtained loss difference is confirmed as the first loss difference. The loss difference can be the average of the differences of the loss values ​​obtained by perturbing along random directions around the embedding vector. Then, the zeroth-order gradient and relaxation variables are calculated based on the first loss difference. The zeroth-order gradient is the approximate true gradient obtained by projecting the loss difference onto random directions without using analytical derivatives, and the relaxation variables are the upper bound used to control the maximum perturbation norm allowed in the embedding space.

[0064] Optionally, a preset perturbation can be applied along a random direction around the first embedding vector to perform perturbation processing and obtain two loss values. Then, the difference between the two loss values ​​is calculated and divided by 2 to obtain the first loss difference corresponding to the first embedding vector. The preset perturbation can be the initial setting of the adversarial learning device or can be preset by relevant personnel. The preset perturbation can be stored not only on the server for perturbation processing on the server side, but also on the client side for subsequent perturbation processing and perturbation update processing on the client side.

[0065] Optionally, the formula for calculating slack variables is as follows:

[0066] in, This refers to the relaxation variable used to compute the m-th second embedding vector of the i-th training sample. The i-th sample can be the target training sample. For server model, This represents the first layer of the client-side model. This represents the first layer of all C client models. This is the output of the first layer of the client model. For the input data of the i-th training sample, The perturbation is used to calculate the m-th second embedding vector of the i-th training sample, and yi is the true label of the i-th training sample.

[0067] Optionally, the formula for calculating the zeroth gradient is as follows:

[0068] in, The first embedding vector returned to all clients, distributed Follows a multivariate normal distribution , The number of samples, which is the number of random directions used to calculate the first loss difference, is [number]. The loss difference is derived from the original first embedding vector and the perturbed embedding, that is, the loss difference in the j-th direction. As a preset disturbance, The loss function for the server model. These are the parameters for the server model.

[0069] Therefore, the server can send a set of data to the client. Instead of transmitting the partial derivatives of the entire embedding vector, it is used for gradient estimation, reducing the amount of data that needs to be transmitted.

[0070] S303 sends the zeroth-order gradient and relaxation variables to the client and receives the second embedding vector returned by the client.

[0071] Specifically, a federated adversarial learning system can have one server and multiple clients. Each client can send a first embedding vector obtained based on the target training samples to the server. Therefore, the server can calculate the zeroth-order gradient and relaxation variables based on all the first embedding vectors and return them to all clients. Clients can use their deployed client models to perform feature extraction on the target adversarial samples to obtain a second embedding vector, which is then sent back to the server. This second embedding vector is the embedding vector corresponding to the target adversarial sample, and the server can receive the second embedding vector returned by the client.

[0072] S304, calculate the second loss difference based on the second embedding vector, and send the second loss difference to the client.

[0073] Specifically, the second loss difference is calculated based on the second embedding vector. For example, a server-side model can be used to calculate the perturbation embedding in a random direction based on a preset perturbation, and then calculate the second loss difference based on the perturbation embedding and the second embedding vector. By transmitting the loss difference, since the loss difference is a scalar rather than a complete gradient vector, the amount of data that needs to be transmitted is reduced. Moreover, calculating the loss difference is usually simpler than calculating the gradient because it does not require differentiation of the model parameters, thereby reducing the computational burden on the server.

[0074] S305, obtain the target number of the second loss difference obtained for the target training sample.

[0075] Specifically, the training can iterate a certain number of times for the target training samples. In each iteration, the zeroth-order gradient and relaxation variables can be calculated once, allowing the client to update against the adversarial examples. Then, the server calculates the second loss and difference against the second embedding vector of the target adversarial example. Therefore, the target number of iterations for the target training samples can be obtained, representing the number of iterations performed on the target training samples. The preset number of iterations can be the initial setting of the federated adversarial learning device or can be set by relevant personnel. The adversarial perturbation update during each iteration against the target training samples further improves the model's robustness.

[0076] S306, determine whether the target number of iterations meets the training iteration limit.

[0077] Specifically, determine whether the target number of iterations meets the training iteration count. If it does not meet the training iteration count, it means that further iterations are needed for the target training sample, and step S301 can be executed. If the training iteration count meets the training iteration count, then step S307 is executed.

[0078] S307, based on all the second loss difference values, uses the gradient descent algorithm to update the parameters of the server model.

[0079] Specifically, if the target number of iterations meets the training iteration count, then based on all the calculated second loss difference values, i.e., the second loss difference values ​​that meet the pre-training iteration count, the gradient descent algorithm is used to update the parameters of the server-side model deployed on the server. The gradient descent algorithm is an optimization algorithm used to minimize the loss function. It can use the gradient to indicate the direction in which the loss function value decreases the fastest. By iteratively adjusting the model parameters, the value of the loss function is reduced, thereby finding the local minimum of the loss function.

[0080] Optionally, if the target number of iterations meets the training iteration count, a parameter update instruction can be sent to all servers, instructing all clients to update their parameters based on all second loss difference values ​​corresponding to the target training samples.

[0081] S308 determines whether the server-side model has converged.

[0082] Specifically, after updating the parameters of the server-side model, it can be determined whether the server-side model deployed on the server has converged. When the loss function value of the server-side model on the training or validation set stops decreasing significantly and the prediction performance of the server-side model no longer shows a significant improvement, it can be determined that the server-side model has converged, and further model training will not significantly change the model's prediction results. If the server-side model has not converged, proceed to step S309; ​​if the server-side model has converged, proceed to step S310.

[0083] S309, send a sample acquisition instruction to the client.

[0084] Specifically, if the server-side model does not converge, a sample acquisition instruction can be sent to the client, instructing the client to determine a target training sample again and calculate the corresponding first embedding vector, and then continue to execute step S301 to iterate the number of training iterations for the target training sample.

[0085] S310, confirm the server-side model after parameter update as the successfully trained server-side model.

[0086] Specifically, if the server-side model converges, it means that the server-side model training is complete, and the server-side model after parameter update can be confirmed as the successfully trained server-side model.

[0087] In this embodiment, a first embedding vector returned by the client for the target training sample is obtained. A first loss difference is generated based on the first embedding vector. The zero-order gradient and relaxation variable are calculated based on the first loss difference and sent to the client. A second embedding vector returned by the client is received. A second loss difference is calculated based on the second embedding vector and sent to the client. The target number of second loss differences obtained for the target training sample is obtained. By transmitting the loss difference, since the loss difference is a scalar rather than a complete gradient vector, the amount of data that needs to be transmitted is reduced, thus reducing communication costs. If the target number does not meet the training iteration count, the step of obtaining the first embedding vector returned by the client for the target training sample continues. If the target number meets the training iteration count, the gradient descent algorithm is used to update the parameters of the server-side model based on all second loss difference values. Adversarial perturbation updates of the training iteration count can further improve the robustness of the model and reduce the number of communication calls and data transmission. If the server-side model does not converge, a sample retrieval command can be sent to the client, and the step of retrieving the first embedding vector returned by the client for the target training samples can continue. If the server-side model converges, the parameter-updated server-side model is confirmed as the successfully trained server-side model. By calculating the zero-order gradient and relaxation variables on the server side, delay propagation is implemented based on the relaxation variables, and gradient estimation is implemented based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0088] Please see Figure 5 This document provides a flowchart illustrating a client-based federated adversarial learning method as an embodiment of this application. Figure 5 As shown, the embodiments of this application are described in conjunction with the client side, and the method may include the following steps S401-S406.

[0089] S401, perform feature extraction processing on the target training sample to obtain the first embedding vector, and send the first embedding vector to the server.

[0090] Specifically, a client-side model performs feature extraction on the target training samples to obtain a first embedding vector, which is the embedding vector corresponding to the target training sample. This first embedding vector is then sent to the server. The target training samples can be randomly determined by the server or determined by the server according to a preset sample selection rule. This preset sample selection rule can be the initial setting of the federated adversarial learning device or can be set by relevant personnel. Because different clients have different feature spaces for the same target training sample, different clients use their respective deployed client-side models, resulting in different first embedding vectors.

[0091] S402, obtain the zeroth-order gradient and relaxation variables returned by the server based on the first embedding vector.

[0092] Specifically, the server can generate a first loss difference based on the first embedding vector, and calculate the zero-order gradient and relaxation variables based on the first loss difference. The client can obtain the zero-order gradient and relaxation variables returned by the server based on the first embedding vector.

[0093] S403 updates the target training samples based on the zero-order gradient and relaxation variables to obtain the target adversarial samples.

[0094] Specifically, the loss can be increased based on the zero-order gradient, and the slack variable can be used as the upper bound of the maximum perturbation norm to determine the perturbation magnitude for the target training sample, thereby updating the target training sample to obtain the target adversarial sample.

[0095] S404: Perform feature extraction processing on the target adversarial sample to obtain the second embedding vector, and send the second embedding vector to the server.

[0096] Specifically, the deployed client model is used to perform feature extraction on the target adversarial copy to obtain the corresponding embedding vector, which is then confirmed as the second embedding vector and sent to the server.

[0097] S405, Obtain the second loss difference returned by the server based on the second embedding vector.

[0098] Specifically, after receiving the second embedding vector returned by the client, the server can calculate the loss difference based on the second embedding vector using the deployed server model, and confirm the obtained loss difference as the second loss difference. The client can receive the second loss difference returned by the server's second embedding vector.

[0099] S406, parameter update processing of the client model based on the second loss difference.

[0100] Specifically, the parameters of the deployed client model can be updated based on the difference in the second loss.

[0101] In this embodiment, feature extraction is performed on the target training sample to obtain a first embedding vector, which is then sent to the server. The server returns the zero-order gradient and relaxation variables based on the first embedding vector. Based on the zero-order gradient and relaxation variables, the target training sample is updated to obtain a target adversarial sample. Feature extraction is then performed on the target adversarial sample to obtain a second embedding vector, which is also sent to the server. The server returns a second loss difference based on the second embedding vector. By calculating the zero-order gradient and relaxation variables on the server side, delay propagation is implemented based on the relaxation variables, and gradient estimation is implemented based on the zero-order gradient. This reduces the number of communications between the server and the client, improving communication efficiency in adversarial learning.

[0102] Please see Figure 6 This document provides a flowchart illustrating a client-based federated adversarial learning method as an embodiment of this application. Figure 6 As shown, the embodiments of this application are described in conjunction with the client side, and the method may include the following steps S501-S511.

[0103] S501, if a sample acquisition instruction is received from the server, the target training sample is determined based on the sample acquisition instruction.

[0104] Specifically, when it is detected that the server-side model has not yet completed training, the server can send a sample acquisition instruction to the client. This instruction instructs the client to determine the target training samples and calculate the first embedding vector. The condition that the model training is not yet complete may include the server-side model not converging. If the client receives the sample acquisition instruction from the server, it can determine the target training samples based on this instruction.

[0105] S502, perform feature extraction processing on the target training samples to obtain the initial embedding vector.

[0106] Specifically, the deployed client model is used to perform feature processing on the target training samples to obtain the embedding vector, and this embedding vector is confirmed as the initial embedding vector.

[0107] S503, the initial embedding vector is compressed to obtain the first embedding vector, and the first embedding vector is sent to the server.

[0108] Specifically, the initial embedding vector is compressed to a preset number of bits to obtain the first embedding vector, which is then sent to the server. The preset number of bits can be the initial setting of the federated adversarial learning device or can be set by relevant personnel. For example, the preset number of bits can be 8 bits, that is, the size of the first embedding vector is 8 bits, or 1 byte.

[0109] Optionally, a uniform-scale compressor C( The initial embedding vector is compressed from a 32-bit floating-point number to an 8-bit representation, thereby reducing the amount of data to be transmitted and improving the efficiency of data transmission and model training.

[0110] S504, obtain the zeroth-order gradient and relaxation variables returned by the server based on the embedding vector.

[0111] Specifically, the server can generate a first loss difference based on the first embedding vector, and calculate the zero-order gradient and relaxation variables based on the first loss difference. The client can obtain the zero-order gradient and relaxation variables returned by the server based on the first embedding vector.

[0112] S505, based on zero-order gradient and slack variables, uses the gradient ascent algorithm to update the target training samples to obtain intermediate adversarial samples.

[0113] Specifically, the zero-order gradient can be used as the inflection direction, and an update perturbation is obtained by perturbing a preset perturbation based on the learning rate. The learning rate controls the compensation for the perturbation update process; it can be an initial setting for the federated adversarial learning device or set by relevant personnel. A slack variable is used to limit the magnitude of the update perturbation, ensuring that its norm does not exceed the slack variable. Adding the update perturbation to the target training sample yields the target adversarial sample. Since multiple update processes need to be implemented within the client during delayed propagation, the slack variable limits the upper bound of the perturbation norm, thus enabling the federated adversarial learning device to achieve delayed propagation.

[0114] S506, determine whether the number of update processing steps meets the number of sample iterations.

[0115] Specifically, the client can use zero-order gradients and slack variables to update the sample to the required number of iterations. This involves setting a pre-defined number of perturbations and adversarial examples for the required number of iterations. The number of iterations can be the initial setting of the federated adversarial learning device or can be set by relevant personnel. If the update count does not meet the required number of iterations, proceed to step S507; if the update count meets the required number of iterations, proceed to step S508.

[0116] S507 identifies intermediate adversarial samples as target training samples.

[0117] Specifically, if the number of update processing steps does not meet the number of sample iterations, the intermediate adversarial sample is identified as the target training sample, and then step S505 is executed.

[0118] S508 identifies intermediate adversarial samples as target adversarial samples.

[0119] Specifically, if the number of update processing steps meets the number of sample iterations, that is, the iteration against the preset perturbation and the sample has been completed, the intermediate adversarial sample can be identified as the target adversarial sample. S509, perform feature extraction processing on the target adversarial sample to obtain the second embedding vector, and send the second embedding vector to the server.

[0120] Specifically, the deployed client model can be used to extract features from the target adversarial sample to obtain a second embedding vector, which is the embedding vector corresponding to the target adversarial sample. This second embedding vector is then sent to the server. The client can calculate the embedding vector and send it to the server after updating the sample iteration count, utilizing local computing resources for multiple iterations. This not only improves overall computational efficiency but also reduces the number of communications with the server, achieving delayed propagation.

[0121] S509, perform feature extraction processing on the target adversarial sample to obtain a second embedding vector, and send the second embedding vector to the server.

[0122] Specifically, the deployed client model is used to perform feature extraction on the target adversarial copy to obtain the corresponding embedding vector, which is then confirmed as the second embedding vector and sent to the server.

[0123] S510, obtain the second loss difference returned by the server based on the second embedding vector.

[0124] Specifically, after receiving the second embedding vector returned by the client, the server can calculate the loss difference based on the second embedding vector using the deployed server model, and confirm the obtained loss difference as the second loss difference. The client can receive the second loss difference returned by the server based on the second embedding vector.

[0125] S511 uses gradient descent to update the parameters of the client model based on all the second loss differences.

[0126] Specifically, when the server detects that the target number of second loss differences obtained for the target training samples meets the training iteration count, it can send a parameter update command to the client. After receiving the parameter update command from the server, the client model can be updated with parameters using the gradient descent algorithm based on all second loss difference values, and the updated client model will be used for feature extraction in the next round of model training.

[0127] In this embodiment, if a sample acquisition instruction is received from the server, a target training sample is determined based on the instruction. Feature extraction is performed on the target training sample to obtain an initial embedding vector. The initial embedding vector is then compressed to obtain a first embedding vector. This compression reduces the amount of data to be transmitted, improving data transmission and model training efficiency. The first embedding vector is then sent to the server. The server returns the zero-order gradient and relaxation variables based on the embedding vector. Based on the zero-order gradient and relaxation variables, the gradient ascent algorithm is used to update the target training sample to obtain intermediate adversarial samples. If the number of update operations does not meet the sample iteration count, the intermediate adversarial sample is confirmed as the target training sample, and the process continues. The gradient ascent algorithm is used to update the target training sample to obtain intermediate adversarial samples. If the number of update operations meets the sample iteration count, the intermediate adversarial sample is confirmed as the target adversarial sample. Feature extraction is performed on the target adversarial sample to obtain a second embedding vector, which is then sent to the server. The server returns the second loss difference based on the second embedding vector. Based on all second loss difference values, the gradient descent algorithm is used to update the parameters of the client model. After updating the number of sample iterations, the embedding vector is calculated and sent to the server. Multiple iterations are performed using local computing resources, which not only improves the overall computational efficiency but also reduces the number of communications with the server, achieving delayed propagation. Gradient estimation is achieved based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0128] The following will be combined with the appendix Figure 7 - Appendix Figure 8 This paper provides a detailed description of the federal adversarial learning device provided in the embodiments of this application. It should be noted that the appendix... Figure 7 - Appendix Figure 8 The federal adversarial learning device in the application is used to execute this application. Figures 1-6 The methods shown in the embodiments are for illustrative purposes only, illustrating the parts relevant to the embodiments of this application. For specific technical details not disclosed, please refer to this application. Figures 1-6 The example shown.

[0129] Please see Figure 7 This illustration shows a schematic diagram of a federated adversarial learning device applied to a server, provided by an exemplary embodiment of this application. The federated adversarial learning device can be implemented as all or part of a device through software, hardware, or a combination of both. The device 1 includes a first vector receiving unit 11, a first loss calculation unit 12, a second vector receiving unit 13, a second loss calculation unit 14, and a server-side model update unit 15.

[0130] The first vector receiving unit 11 is used to obtain the first embedding vector returned by the client for the target training sample if the server model does not converge. The first loss calculation unit 12 is used to generate a first loss difference based on the first embedding vector, and to calculate the zero-order gradient and relaxation variable based on the first loss difference. The second vector receiving unit 13 is used to send the zero-order gradient and the relaxation variable to the client and receive the second embedding vector returned by the client. The second embedding vector is calculated by the client based on the zero-order gradient and the relaxation variable for the target training sample. The second loss calculation unit 14 is used to calculate the second loss difference based on the second embedding vector and send the second loss difference to the client so that the client can perform parameter update processing on the client model based on the second loss difference. The server-side model update unit 15 is used to perform parameter update processing on the server-side model based on the second loss difference.

[0131] Optionally, the server-side model update unit 15 is specifically used to obtain the target number of the second loss difference obtained for the target training sample; If the target number of iterations does not meet the training iteration number, then the step of obtaining the first embedding vector returned by the client for the target training sample is executed. If the target number of iterations meets the training iteration number of iterations, then the server-side model is updated based on the second loss difference.

[0132] Optionally, the server-side model update unit 15 is specifically used to update the parameters of the server-side model based on all the second loss difference values ​​if the target number satisfies the number of training iterations. If the server-side model does not converge, a sample acquisition instruction is sent to the client, and the step of acquiring the embedding vector returned by the client for the target training sample is executed. If the server-side model converges, the server-side model with updated parameters is confirmed as the successfully trained server-side model.

[0133] In this embodiment, the first embedding vector returned by the client for the target training sample is obtained. A first loss difference is generated based on the first embedding vector. The zero-order gradient and relaxation variable are calculated based on the first loss difference and sent to the client. The second embedding vector returned by the client is received. A second loss difference is calculated based on the second embedding vector and sent to the client. The target number of second loss differences obtained for the target training sample is obtained. By transmitting the loss difference, since the loss difference is a scalar rather than a complete gradient vector, the amount of data that needs to be transmitted is reduced, thus reducing communication costs. If the target number does not meet the training iteration count, the step of obtaining the first embedding vector returned by the client for the target training sample continues. If the target number meets the training iteration count, the gradient descent algorithm is used to update the parameters of the server model based on all second loss difference values. Adversarial perturbation update of the training iteration count can further improve the robustness of the model and reduce the number of communication and data transmission. If the server model does not converge, a sample acquisition command can be sent to the client and the step of obtaining the first embedding vector returned by the client for the target training sample continues. If the server model converges, the server model after parameter update is confirmed as the trained server model. By calculating the zero-order gradient and slack variables on the server side, delay propagation is implemented based on the slack variables, and gradient estimation is implemented based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0134] Please see Figure 8 This illustration shows a schematic diagram of a federated adversarial learning device applied to a client, provided by an exemplary embodiment of this application. The federated adversarial learning device can be implemented as all or part of a device through software, hardware, or a combination of both. The device 2 includes a first vector transmission unit 21, a first loss receiving unit 22, a sample update unit 23, a second vector transmission unit 24, a second loss receiving unit 25, and a client model update unit 26.

[0135] The first vector sending unit 21 is used to perform feature extraction processing on the target training sample to obtain the first embedding vector, and send the first embedding vector to the server. Optionally, if the first vector sending unit 21 receives a sample acquisition instruction from the server, it determines the target training sample based on the sample acquisition instruction. The target training samples are subjected to feature extraction processing to obtain an initial embedding vector; The initial embedding vector is compressed to obtain a first embedding vector, and the first embedding vector is sent to the server.

[0136] The first loss receiving unit 22 is used to obtain the zero-order gradient and relaxation variable returned by the server based on the embedding vector, the server generates a first loss difference based on the embedding vector, and calculates the zero-order gradient and relaxation variable based on the first loss difference; The sample update unit 23 is used to update the target training sample according to the zeroth-order gradient and the relaxation variable to obtain the target adversarial sample. Optionally, the sample update unit 23 updates the target training sample using the gradient ascent algorithm based on the zero-order gradient and the slack variable to obtain intermediate adversarial samples. If the number of update processing steps does not meet the number of sample iterations, then the intermediate adversarial sample is identified as the target training sample, and the step of updating the target training sample using the gradient ascent algorithm based on the zeroth gradient and the relaxation variable to obtain the intermediate adversarial sample is executed. If the number of update processes meets the sample iteration count, then the intermediate adversarial sample is identified as the target adversarial sample.

[0137] The second vector sending unit 24 is used to perform feature extraction processing on the target adversarial sample to obtain a second embedding vector, and send the second embedding vector to the server. The second loss receiving unit 25 is used to obtain the second loss difference returned by the server based on the second embedding vector; The client model update unit 26 is used to perform parameter update processing on the client model based on the second loss difference.

[0138] Optionally, the client model update unit 26 is specifically used to update the parameters of the client model using a gradient descent algorithm based on all the second loss difference values.

[0139] In this embodiment, if a sample acquisition instruction is received from the server, a target training sample is determined based on the instruction. Feature extraction is performed on the target training sample to obtain an initial embedding vector. This initial embedding vector is then compressed to obtain a first embedding vector. Compressing the embedding vector reduces the amount of data to be transmitted, improving data transmission efficiency and model training efficiency. The first embedding vector is then sent to the server. The server returns the zero-order gradient and relaxation variables based on the embedding vector. Based on the zero-order gradient and relaxation variables, the gradient ascent algorithm is used to update the target training sample to obtain intermediate adversarial samples. If the number of update operations does not meet the sample iteration count, the intermediate adversarial sample is confirmed as the target training sample, and the process continues. The gradient ascent algorithm is used to update the target training sample to obtain intermediate adversarial samples. If the number of update operations meets the sample iteration count, the intermediate adversarial sample is confirmed as the target adversarial sample. Feature extraction is performed on the target adversarial sample to obtain a second embedding vector, which is then sent to the server. The server returns the second loss difference based on the second embedding vector. Based on all second loss difference values, the gradient descent algorithm is used to update the parameters of the client model. After updating the number of sample iterations, the embedding vector is calculated and sent to the server. Multiple iterations are performed using local computing resources, which not only improves the overall computational efficiency but also reduces the number of communications with the server, achieving delayed propagation. Gradient estimation is achieved based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0140] It should be noted that the federated adversarial learning device provided in the above embodiments is only illustrated by the division of the above functional modules when executing the federated adversarial learning method. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the federated adversarial learning device and the federated adversarial learning method embodiments provided in the above embodiments belong to the same concept, and the implementation process is detailed in the method embodiments, which will not be repeated here.

[0141] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0142] This application also provides a computer storage medium that can store multiple instructions, which are adapted to be loaded and executed by a processor as described above. Figures 1-6 The federated adversarial learning method described in the illustrated embodiment can be found in the following document for a detailed implementation process. Figures 1-6 The specific details of the illustrated embodiments will not be elaborated here.

[0143] This application also provides a computer program product storing at least one instruction, which is loaded and executed by the processor as described above. Figures 1-6 The federated adversarial learning method described in the illustrated embodiment can be found in the following document for a detailed implementation process. Figures 1-6 The specific details of the illustrated embodiments will not be elaborated here.

[0144] Please refer to Figure 9, which shows a structural block diagram of an electronic device provided in an exemplary embodiment of this application. The electronic device in this application may include one or more components such as a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, memory 120, input device 130, and output device 140 may be connected to each other via the bus 150.

[0145] Processor 110 may include one or more processing cores. Processor 110 connects to various parts of the electronic device using various interfaces and lines, and executes various functions of terminal 100 and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 120, and by calling data stored in memory 120. Optionally, processor 110 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 110 may integrate one or more of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user page, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into processor 110 and may be implemented separately using a communication chip.

[0146] The memory 120 may include random access memory (RAM) or read-only memory (ROM). Optionally, the memory 120 may include non-transitory computer-readable storage medium. The memory 120 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the various method embodiments described above, etc. The operating system may be the Android system, including systems deeply developed based on the Android system, the iOS system developed by Apple Inc., including systems deeply developed based on the iOS system, or other systems.

[0147] The memory 120 can be divided into operating system space and user space. The operating system runs in the operating system space, while native and third-party applications run in user space. To ensure that different third-party applications can achieve good running performance, the operating system allocates corresponding system resources for each application. However, different application scenarios within the same third-party application have different requirements for system resources. For example, in local resource loading scenarios, third-party applications have high requirements for disk read speed; in animation rendering scenarios, third-party applications have high requirements for GPU performance. Since the operating system and third-party applications are independent of each other, the operating system often cannot promptly perceive the current application scenario of a third-party application, resulting in the operating system's inability to adapt system resources accordingly.

[0148] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to establish data communication between the third-party applications and the operating system. This would allow the operating system to obtain the current scenario information of the third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0149] The input device 130 is used to receive input instructions or data, and includes, but is not limited to, a keyboard, mouse, camera, microphone, or touch device. The output device 140 is used to output instructions or data, and includes, but is not limited to, a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 can be a touch display screen.

[0150] The touch display screen can be designed as a full-screen, curved screen, or irregularly shaped screen. It can also be designed as a combination of a full-screen and a curved screen, or a combination of an irregularly shaped screen and a curved screen; however, this application does not limit the specific design in this regard.

[0151] In addition, those skilled in the art will understand that the structure of the electronic device shown in the above figures does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements. For example, the electronic device may also include radio frequency circuits, input units, sensors, audio circuits, Wireless Fidelity (WiFi) modules, power supplies, Bluetooth modules, etc., which will not be described in detail here.

[0152] In the electronic device shown in Figure 9, the processor 110 can be used to call the federated adversarial learning application stored in the memory 120 for the server, and specifically perform the following operations: If the server-side model does not converge, then obtain the first embedding vector returned by the client for the target training sample; Based on the first embedding vector, a first loss difference is generated, and the zeroth-order gradient and relaxation variable are calculated based on the first loss difference; The zeroth-order gradient and the relaxation variable are sent to the client, and the second embedding vector returned by the client is received. The second embedding vector is calculated by the client for the target training sample based on the zeroth-order gradient and the relaxation variable. Calculate the second loss difference based on the second embedding vector, and send the second loss difference to the client so that the client can update the parameters of the client model based on the second loss difference. The server-side model is updated based on the second loss difference.

[0153] In one embodiment, when the processor 110 performs parameter update processing on the server-side model based on the second loss difference, it specifically performs the following operations: Obtain the target number of the second loss difference obtained for the target training sample; If the target number of iterations does not meet the training iteration number, then the step of obtaining the first embedding vector returned by the client for the target training sample is executed. If the target number of iterations meets the training iteration number of iterations, then the server-side model is updated based on the second loss difference.

[0154] In one embodiment, when the processor 110 performs parameter update processing on the server-side model based on the second loss difference if the target number satisfies the training iteration number, the processor 110 specifically performs the following operations: If the target number of iterations satisfies the training iteration number of iterations, then the server-side model is updated with parameters using the gradient descent algorithm based on all the second loss difference values. If the server-side model does not converge, a sample acquisition instruction is sent to the client, and the step of acquiring the embedding vector returned by the client for the target training sample is executed. If the server-side model converges, the server-side model with updated parameters is confirmed as the successfully trained server-side model.

[0155] In this embodiment, the first embedding vector returned by the client for the target training sample is obtained. A first loss difference is generated based on the first embedding vector. The zero-order gradient and relaxation variable are calculated based on the first loss difference and sent to the client. The second embedding vector returned by the client is received. A second loss difference is calculated based on the second embedding vector and sent to the client. The target number of second loss differences obtained for the target training sample is obtained. By transmitting the loss difference, since the loss difference is a scalar rather than a complete gradient vector, the amount of data that needs to be transmitted is reduced, thus reducing communication costs. If the target number does not meet the training iteration count, the step of obtaining the first embedding vector returned by the client for the target training sample continues. If the target number meets the training iteration count, the gradient descent algorithm is used to update the parameters of the server model based on all second loss difference values. Adversarial perturbation update of the training iteration count can further improve the robustness of the model and reduce the number of communication and data transmission. If the server model does not converge, a sample acquisition command can be sent to the client and the step of obtaining the first embedding vector returned by the client for the target training sample continues. If the server model converges, the server model after parameter update is confirmed as the trained server model. By calculating the zero-order gradient and slack variables on the server side, delay propagation is implemented based on the slack variables, and gradient estimation is implemented based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0156] In the electronic device shown in Figure 9, the processor 110 can be used to call the federated adversarial learning application stored in the memory 120 for the client, and specifically perform the following operations: The first embedding vector is obtained by performing feature extraction on the target training sample and then sent to the server. Obtain the zero-order gradient and relaxation variable returned by the server based on the first embedding vector; the server generates a first loss difference based on the first embedding vector; and calculates the zero-order gradient and relaxation variable based on the first loss difference. Based on the zeroth-order gradient and the relaxation variables, the target training samples are updated to obtain the target adversarial samples. The target adversarial sample is subjected to feature extraction processing to obtain a second embedding vector, and the second embedding vector is sent to the server. Obtain the second loss difference returned by the server based on the second embedding vector; The client model is updated with parameters based on the second loss difference.

[0157] In one embodiment, when the processor 110 performs feature extraction processing on the target training samples to obtain a first embedding vector and sends the first embedding vector to the server, it specifically performs the following operations: If a sample acquisition instruction is received from the server, the target training sample is determined based on the sample acquisition instruction; The target training samples are subjected to feature extraction processing to obtain an initial embedding vector; The initial embedding vector is compressed to obtain a first embedding vector, and the first embedding vector is sent to the server.

[0158] In one embodiment, when the processor 110 performs the operation of updating the target training sample based on the zeroth-order gradient and the relaxation variable to obtain the target adversarial sample, it specifically performs the following operations: Based on the zero-order gradient and the relaxation variables, the gradient ascent algorithm is used to update the target training samples to obtain intermediate adversarial samples. If the number of update processing steps does not meet the number of sample iterations, then the intermediate adversarial sample is identified as the target training sample, and the step of updating the target training sample using the gradient ascent algorithm based on the zeroth gradient and the relaxation variable to obtain the intermediate adversarial sample is executed. If the number of update processes meets the sample iteration count, then the intermediate adversarial sample is identified as the target adversarial sample.

[0159] In one embodiment, when the processor 110 performs the operation of updating the target training sample based on the zeroth-order gradient and the relaxation variable to obtain the target adversarial sample, it specifically performs the following operations: Based on all the second loss difference values, the gradient descent algorithm is used to update the parameters of the client model.

[0160] In this embodiment, if a sample acquisition instruction is received from the server, a target training sample is determined based on the instruction. Feature extraction is performed on the target training sample to obtain an initial embedding vector. This initial embedding vector is then compressed to obtain a first embedding vector. Compressing the embedding vector reduces the amount of data to be transmitted, improving data transmission efficiency and model training efficiency. The first embedding vector is then sent to the server. The server returns the zero-order gradient and relaxation variables based on the embedding vector. Based on the zero-order gradient and relaxation variables, the gradient ascent algorithm is used to update the target training sample to obtain intermediate adversarial samples. If the number of update operations does not meet the sample iteration count, the intermediate adversarial sample is confirmed as the target training sample, and the process continues. The gradient ascent algorithm is used to update the target training sample to obtain intermediate adversarial samples. If the number of update operations meets the sample iteration count, the intermediate adversarial sample is confirmed as the target adversarial sample. Feature extraction is performed on the target adversarial sample to obtain a second embedding vector, which is then sent to the server. The server returns the second loss difference based on the second embedding vector. Based on all second loss difference values, the gradient descent algorithm is used to update the parameters of the client model. After updating the number of sample iterations, the embedding vector is calculated and sent to the server. Multiple iterations are performed using local computing resources, which not only improves the overall computational efficiency but also reduces the number of communications with the server, achieving delayed propagation. Gradient estimation is achieved based on the zero-order gradient, thereby reducing the number of communications between the server and the client and improving the communication efficiency in adversarial learning.

[0161] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory, or random access memory, etc.

[0162] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

[0163] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the target training samples, embedding vectors, and loss differences involved in this specification were all obtained with full authorization.

Claims

1. A federated adversarial learning method, applied to the server side, characterized in that, The method includes: If the server-side model does not converge, then obtain the first embedding vector returned by the client for the target training sample; Based on the first embedding vector, a first loss difference is generated, and the zeroth-order gradient and relaxation variable are calculated based on the first loss difference; The zeroth-order gradient and the relaxation variable are sent to the client, and the second embedding vector returned by the client is received. The second embedding vector is calculated by the client for the target training sample based on the zeroth-order gradient and the relaxation variable. Calculate the second loss difference based on the second embedding vector, and send the second loss difference to the client so that the client can update the parameters of the client model based on the second loss difference. The server-side model is updated based on the second loss difference.

2. The method according to claim 1, characterized in that, The parameter update process for the server-side model based on the second loss difference includes: Obtain the target number of the second loss difference obtained for the target training sample; If the target number of iterations does not meet the training iteration number, then the step of obtaining the first embedding vector returned by the client for the target training sample is executed. If the target number of iterations meets the training iteration number of iterations, then the server-side model is updated based on the second loss difference.

3. The method according to claim 2, characterized in that, If the target number satisfies the training iteration number, then the server-side model is updated based on the second loss difference, including: If the target number of iterations satisfies the training iteration number of iterations, then the server-side model is updated with parameters using the gradient descent algorithm based on all the second loss difference values. If the server-side model does not converge, a sample acquisition instruction is sent to the client, and the step of acquiring the embedding vector returned by the client for the target training sample is executed. If the server-side model converges, the server-side model with updated parameters is confirmed as the successfully trained server-side model.

4. A federated adversarial learning method, applied to a client, characterized in that, The method includes: The first embedding vector is obtained by performing feature extraction on the target training sample and then sent to the server. Obtain the zero-order gradient and relaxation variable returned by the server based on the first embedding vector; the server generates a first loss difference based on the first embedding vector; and calculates the zero-order gradient and relaxation variable based on the first loss difference. Based on the zeroth-order gradient and the relaxation variables, the target training samples are updated to obtain the target adversarial samples. The target adversarial sample is subjected to feature extraction processing to obtain a second embedding vector, and the second embedding vector is sent to the server. Obtain the second loss difference returned by the server based on the second embedding vector; The client model is updated with parameters based on the second loss difference.

5. The method according to claim 4, characterized in that, The step of performing feature extraction processing on the target training samples to obtain a first embedding vector and sending the first embedding vector to the server includes: If a sample acquisition instruction is received from the server, the target training sample is determined based on the sample acquisition instruction; The target training samples are subjected to feature extraction processing to obtain an initial embedding vector; The initial embedding vector is compressed to obtain a first embedding vector, and the first embedding vector is sent to the server.

6. The method according to claim 4, characterized in that, The step of updating the target training sample based on the zeroth-order gradient and the relaxation variable to obtain the target adversarial sample includes: Based on the zero-order gradient and the relaxation variables, the gradient ascent algorithm is used to update the target training samples to obtain intermediate adversarial samples. If the number of update processing steps does not meet the number of sample iterations, then the intermediate adversarial sample is identified as the target training sample, and the step of updating the target training sample using the gradient ascent algorithm based on the zeroth gradient and the relaxation variable to obtain the intermediate adversarial sample is executed. If the number of update processes meets the number of sample iterations, then the intermediate adversarial sample is identified as the target adversarial sample.

7. The method according to claim 4, characterized in that, The parameter update process for the client model based on the second loss difference includes: Based on all the second loss difference values, the gradient descent algorithm is used to update the parameters of the client model.

8. A federated adversarial learning device, applied to a server, characterized in that, The device includes: The first vector receiving unit is used to obtain the first embedding vector returned by the client for the target training sample if the server model does not converge. The first loss calculation unit is used to generate a first loss difference based on the first embedding vector, and to calculate the zero-order gradient and relaxation variable based on the first loss difference. The second vector receiving unit is used to send the zero-order gradient and the relaxation variable to the client and receive the second embedding vector returned by the client. The second embedding vector is calculated by the client based on the zero-order gradient and the relaxation variable for the target training sample. The second loss calculation unit is used to calculate the second loss difference based on the second embedding vector and send the second loss difference to the client so that the client can perform parameter update processing on the client model based on the second loss difference. The server-side model update unit is used to update the parameters of the server-side model based on the second loss difference.

9. A federated adversarial learning device, applied to a client, characterized in that, The device includes: The first vector sending unit is used to perform feature extraction processing on the target training sample to obtain the first embedding vector, and send the first embedding vector to the server. The first loss receiving unit is used to obtain the zero-order gradient and relaxation variable returned by the server based on the embedding vector, the server generates a first loss difference based on the embedding vector, and calculates the zero-order gradient and relaxation variable based on the first loss difference; The sample update unit is used to update the target training sample according to the zeroth-order gradient and the relaxation variable to obtain the target adversarial sample; The second vector sending unit is used to perform feature extraction processing on the target adversarial sample to obtain a second embedding vector, and send the second embedding vector to the server. The second loss receiving unit is used to obtain the second loss difference returned by the server based on the second embedding vector; The client model update unit is used to update the parameters of the client model based on the second loss difference.

10. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions adapted for loading by a processor and executing the method steps as claimed in any one of claims 1 to 3 and 4 to 7.

11. An electronic device, characterized in that, include: A processor and a memory; wherein the memory stores a computer program adapted to be loaded by the processor and to execute the method steps as claimed in any one of claims 1 to 3 and 4 to 7.

Images