Adaptive Dimensional Cropping Differential Privacy Federated Learning Method for Medical Image Classification
By employing a differential privacy federated learning method with adaptive dimensional cropping and adaptive learning rate, this approach addresses the problem of excessive noise addition caused by gradient differences in medical image classification. It improves model accuracy and reduces privacy costs, making it suitable for secure sharing of medical data across institutions.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA UNIV OF MINING & TECH
- Filing Date
- 2026-02-27
- Publication Date
- 2026-06-02
AI Technical Summary
In non-independent and identically distributed scenarios, existing medical image classification methods often suffer from noise masking of gradients in the lesion feature dimension, affecting model performance. Furthermore, medical data is sensitive to single-sample privacy, necessitating a solution that can both protect patient privacy and maintain diagnostic accuracy.
An adaptive dimensional pruning differential privacy federated learning method is adopted. The pruning threshold is determined by flexibly estimating the sensitivity, and adaptive noise is introduced into different gradient dimensions. Combined with an adaptive learning rate strategy, the learning step size is dynamically adjusted to reduce the impact of noise on model performance.
It significantly improves model accuracy while maintaining the same level of privacy protection, reduces privacy costs, solves the problem of excessive noise addition caused by gradient differences in medical image classification, and achieves higher diagnostic accuracy and secure data sharing across institutions.
Smart Images
Figure CN122133759A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to federated learning and privacy protection technologies, specifically to an adaptive dimensional cropping differential privacy federated learning method for medical image classification. Background Technology
[0002] With the development of the digital economy, artificial intelligence has been widely applied in various fields, leading to an increasing reliance on data. However, with the continuous growth in data usage, issues related to data privacy and security have also emerged. To address these privacy concerns, federated learning has emerged, allowing local healthcare clients to train models using their own data and upload gradients instead of the raw data, subsequently aggregating these gradients to build a global model. Because privacy information never leaves the local healthcare client, federated learning is often seen as a technology that can guarantee the privacy of the training process. However, simply restricting data exchange is insufficient, as model updates and aggregation processes may still leak participants' data characteristics or intermediate results, thus posing privacy risks.
[0003] Differential privacy is a robust data privacy technique designed to ensure that changes to any single data record do not significantly affect the output, thereby protecting data privacy. Differential privacy federated learning frameworks typically employ two levels of protection: the first level protects each local medical client, preventing the server from identifying client participation by observing local updates (called CL-DP); the second level protects each local sample, ensuring that the server cannot identify specific samples from the aggregated local dataset (called SL-DP). This invention focuses on SL-DP.
[0004] Existing methods for ensuring SL-DP typically involve setting a pruning threshold to limit the sensitivity of the local model gradient and adding Gaussian noise to the local model gradient before aggregation. However, in non-independent and identically distributed scenarios, the introduction of noise can lead to a degraded model performance. Therefore, most research focuses on balancing model performance and privacy protection.
[0005] In existing medical image classification methods, the varying parameters of imaging equipment across different hospitals lead to significant non-independent and identically distributed (Non-IID) data characteristics. Traditional differential privacy methods employ a uniform cropping threshold, which can easily cause the gradient of the lesion feature dimension to be masked by noise. Furthermore, medical data is extremely sensitive to single-sample privacy, necessitating a solution that protects patient privacy while maintaining diagnostic accuracy. To address this, recent research has begun exploring adaptive cropping techniques, which estimate sensitivity by calculating the norm of previous gradients, thereby introducing adaptive noise in different communication rounds. However, these strategies typically focus on allocating noise between different communication rounds, neglecting the noise allocation between different gradient dimensions within the same round.
[0006] During federated learning training, there are significant differences between gradients across different dimensions. Since the impact of noise on model performance is closely related to the original gradient values, adding adaptive noise to gradients across different dimensions is a viable approach. To implement the adaptive noise mechanism in SL-DP, accurately estimating the sensitivity is crucial, as the sensitivity determines the amount of noise in the DP. Summary of the Invention
[0007] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide an adaptive, dimension-wise cropping differential privacy federated learning method for medical image classification.
[0008] This invention determines the pruning threshold by flexibly estimating sensitivity and introduces adaptive noise in different gradient dimensions to reduce the impact of noise on model performance. Furthermore, it uses an adaptive learning rate to reduce privacy costs and accelerate model convergence.
[0009] Technical Solution: This invention provides an adaptive dimensional cropping differential privacy federated learning method for medical image classification, involving a parameter server and multiple local medical clients distributed across medical institutions. (The parameter server is mainly responsible for process management, initializing and broadcasting model parameters, and model aggregation; the local medical clients execute relevant calculations and privacy policies, train and update the local model). Specifically, it includes the following steps:
[0010] Step (1), initialization and model broadcasting: First, the parameter server initializes the global model parameters. Noise scale standard deviation and learning rate The parameters This includes the weights and biases for each dimension of the global model; subsequently, the parameter server broadcasts this information to all clients. ;
[0011] Step (2), sampling and gradient calculation, that is, for the k-th local medical client In the In round-robin communication, from its own medical sample dataset Sampling a batch And the gradients for each local medical client are calculated using the SAM optimizer. It can overcome the statistical lag problem caused by the sensitivity of existing technologies relying on "historical moving averages" for estimation.
[0012] Step (3) Privacy budget constraint, that is, adaptive dimensional pruning of gradients is performed according to the sensitivity of different dimensions, and Gaussian noise proportional to the sensitivity of the dimension is added to the pruned gradients of each dimension, so as to achieve fine-grained control, ensure that the amount of noise injected into each dimension is precisely matched with its information, thereby effectively reducing the negative impact of random noise on model performance and preserving the direction information of the gradient to the maximum extent, and finally significantly improving the model accuracy under the same privacy budget;
[0013] Step (4): Use gradient-based... The learning rate algorithm of the norm is used to dynamically adjust the learning rate and update the local model parameters;
[0014] Step (5): Upload the updated local model. The medical client will then train the updated local model parameters. Send back to the parameter server;
[0015] Step (6): Model aggregation, the parameter server collects the updated local model parameters uploaded by each medical client. Subsequently, based on the weight of each local medical client Perform weighted aggregation to calculate new global model parameters. And broadcast it to various medical clients;
[0016] Repeat steps (2) through (6) until completion. Round-robin communication, and calculate total privacy overhead.
[0017] Furthermore, the specific process of calculating the gradients for each client using the SAM optimizer in step (2) is as follows:
[0018] Step (2.1) Define the medical client Local loss function for:
[0019] ;
[0020] in These are the global model parameters of the parameter server. These are the perturbed local model parameters. It is a preset constant ( Used to determine the disturbance radius (its value is usually set to 0.5), yes Medical sample data in the middle;
[0021] In step (2.2), during the t-th round of communication, the medical client... The disturbance terms are calculated using the following methods respectively. and gradient :
[0022] ;
[0023] ;
[0024] in Computational healthcare client gradient, express Norm.
[0025] Furthermore, the specific process of performing adaptive dimensional cropping and adding noise in step (3) is as follows:
[0026] Step (3.1), Definition Sensitivity For function Maximum on adjacent datasets Norm distance, expressed as follows:
[0027] ;
[0028] in They are adjacent datasets that differ by only one sample. and Representing functions respectively In two adjacent datasets and The output results;
[0029] Step (3.2), for the medical client Use the dimension-wise DP average gradient from the previous round norm The sensitivity of the current communication round is multiplied by γ, where γ is a constant pruning factor; in the t-th round of communication, the client... Gradient sensitivity The estimates are as follows:
[0030]
[0031] Among them, clipping factor As an adjustable parameter to balance gradient and noise for The samples in; It refers to the first In round-robin communication (i.e., the previous round), the medical client In gradient 1 The noise scale used in each dimension;
[0032] Step (3.3), Medical Client Calculate noise scale and the local model gradient after clipping :
[0033] ;
[0034] ;
[0035] It is the global theory defined in differential privacy. Sensitivity, representing the maximum norm distance of function outputs on adjacent datasets, is a macroscopic static metric for the entire gradient vector; while It is a client In the Wheel gradient first The instantaneous sensitivity estimate for each dimension is used to guide adaptive pruning and noise addition for that dimension; Indicates the standard deviation of noise scale, superscript The first one representing the gradient of the local model One dimension, It is the total dimension of the gradient;
[0036] A warm-up strategy is employed before formal training begins, whereby the medical client is trained on random noise for one epoch and the average value is obtained. Norm for initialization ;
[0037] Step (3.4), based on scale Gaussian noise, medical client Calculate the gradient of the local model after adding noise. :
[0038] ;
[0039] Where L represents the batch size for a single local training session.
[0040] Furthermore, the specific process of dynamically adjusting the learning rate and updating the parameters in step (4) is as follows:
[0041] Step (4.1), calculate the first... Medical Client in Wheel Communication Adaptive learning rate
[0042] ;
[0043] in, Represents the gradient of the local model after adding noise. yes Norm; growth factor of learning rate As an adjustable parameter, it controls the aggressiveness of the learning rate adjustment; These are all dimensions obtained in step (3). The complete gradient vector formed by, and It is a relationship between "the whole and its parts"; It's about quantity. It includes all The complete gradient vector in each dimension, i.e. ),
[0044] Step (4.2): Update the local model parameters using the learning rate. :
[0045] ;
[0046] in, These are the local model parameters for the current round.
[0047] Furthermore, the specific method for calculating the weighted aggregation and total privacy loss in step (6) is as follows:
[0048] Step (6.1): According to each medical client Calculate the weights based on the proportion of the local dataset size. :
[0049] ;
[0050] in, and , It is the training dataset. Size, It is the total size of all training datasets;
[0051] Step (6.2): Calculate the new global model parameters as follows. :
[0052] ;
[0053] Step (6.3): After T rounds of communication, the privacy loss of each medical client's DP satisfies the following:
[0054] ;
[0055] in, It's the sampling rate. It is the standard deviation of the noise scale. Denotes the binomial coefficient. For any Integers.
[0056] Beneficial effects: Compared with the prior art, the present invention has the following advantages:
[0057] 1. This invention employs adaptive dimensional pruning, setting different pruning thresholds for each gradient to match the added noise with the sensitivity of that dimension. Under the same accuracy requirements, this invention significantly reduces the privacy costs, achieving a better privacy-utility trade-off and facilitating the construction of a secure cross-institutional ecosystem for sharing medical data.
[0058] 2. The Sharpness-Aware Minimization Optimizer (SAM) integrated in this invention enhances the model's robustness to noise by optimizing loss plane features.
[0059] 3. The adaptive learning rate strategy adopted in this invention can dynamically adjust the learning step size according to the gradient fluctuations during the training process. This not only significantly accelerates the convergence process of the model and reduces the required number of communication rounds, but also solves the problem of heterogeneity and uneven distribution of data from various medical institutions to a certain extent. Attached Figure Description
[0060] Figure 1 This is a schematic diagram of the workflow of the present invention;
[0061] Figure 2 shows the situation under the same privacy budget. Below is a comparison chart of the average test accuracy of the present invention and existing algorithms on different datasets;
[0062] Figure 3 shows the situation under the same privacy budget. Below is a comparison chart of the average test loss of the present invention and existing algorithms on different datasets;
[0063] Figure 4 shows the micro-benchmark test results of this invention on the MNIST dataset, where (a) is a comparison between the original gradient values and the estimated values after clipping, and (b) is a distribution of the adaptive learning rate coefficients.
[0064] Figure 5 is a comparison between the true gradient norm and the sensitivity estimated by the present invention, where (a) is the linear layer 1 bias term tracking of the MNIST dataset and (b) is the layer 11 weight term tracking of the CIFAR-10 dataset.
[0065] Figure 6 is a sensitivity analysis diagram showing the impact of different hyperparameters on the accuracy of the present invention on the MNIST dataset;
[0066] Figure 7 is a sensitivity analysis diagram showing the impact of different hyperparameters on the accuracy of this invention on the CIFAR-10 dataset. Detailed Implementation
[0067] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.
[0068] like Figure 1As shown, the adaptive dimensional cropping differential privacy federated learning method for medical image classification of the present invention involves a parameter server and multiple local medical clients distributed at medical institutions. The specific steps are as follows:
[0069] Step (1), initialization and model broadcasting: First, the parameter server initializes the global model parameters. Noise scale standard deviation and learning rate The parameters This includes the weights and biases for each dimension of the global model; subsequently, the parameter server broadcasts this information to all clients. ;
[0070] Step (2), sampling and gradient calculation, that is, for the k-th local medical client In the In round-robin communication, from its own medical sample dataset Sampling a batch And the gradients for each local medical client are calculated using the SAM optimizer. ;
[0071] Step (3) Privacy budget constraint, that is, perform adaptive dimensional pruning on the gradient according to the sensitivity of different dimensions, and add Gaussian noise proportional to the sensitivity of the dimension to the pruned gradient of each dimension;
[0072] Step (4): Use gradient-based... The learning rate algorithm of the norm is used to dynamically adjust the learning rate and update the local model parameters;
[0073] Step (5): Upload the updated local model. The medical client will then train the updated local model parameters. Send back to the parameter server;
[0074] Step (6): Model aggregation, the parameter server collects the updated local model parameters uploaded by each medical client. Subsequently, based on the weight of each local medical client Perform weighted aggregation to calculate new global model parameters. And broadcast it to various medical clients;
[0075] Repeat steps (2) through (6) until completion. Round-robin communication, and calculate total privacy overhead.
[0076] The specific process of calculating the gradient of each medical client using the SAM optimizer in step (2) of this embodiment is as follows:
[0077] Step (2.1) Define the medical client Local loss function for:
[0078] ;
[0079] in These are the global model parameters of the parameter server. These are the perturbed local model parameters. It is a preset constant used to determine the disturbance radius. yes Medical sample data in the middle;
[0080] In step (2.2), during the t-th round of communication, the medical client... The disturbance terms are calculated using the following methods respectively. and gradient :
[0081] ;
[0082] ;
[0083] in Computational healthcare client gradient, express Norm.
[0084] The specific process of performing adaptive dimensional cropping and adding noise in step (3) of this embodiment is as follows:
[0085] Step (3.1), Definition Sensitivity For function Maximum on adjacent datasets Norm distance, expressed as follows:
[0086] ;
[0087] in They are adjacent datasets that differ by only one sample. and Representing functions respectively In two adjacent datasets and The output results;
[0088] Step (3.2), for the medical client Use the dimension-wise DP average gradient from the previous round norm The sensitivity of the current communication round is multiplied by γ, where γ is a constant pruning factor; in the t-th round of communication, the client... Gradient sensitivity The estimates are as follows:
[0089] ;
[0090] Among them, clipping factor As an adjustable parameter to balance gradient and noise for The samples in; It refers to the first In round-robin communication, the medical client In gradient 1 The noise scale used in each dimension;
[0091] Step (3.3), Medical Client Calculate noise scale and the local model gradient after clipping :
[0092] ;
[0093] ;
[0094] It is the global theory defined in differential privacy. Sensitivity It is a medical client. In the Wheel gradient first Real-time estimates of sensitivity across all dimensions Indicates the standard deviation of noise scale, superscript The first one representing the gradient of the local model One dimension, It is the total dimension of the gradient;
[0095] A warm-up strategy is employed before formal training, whereby the medical client is trained on random noise for one epoch and the average value is obtained. Norm for initialization ;
[0096] Step (3.4), based on scale Gaussian noise, medical client Calculate the gradient of the local model after adding noise. :
[0097] ;
[0098] Where L represents the batch size for a single local training session.
[0099] The specific process of dynamically adjusting the learning rate and updating the parameters in step (4) of this embodiment is as follows:
[0100] Step (4.1), calculate the first... Medical Client in Wheel Communication Adaptive learning rate
[0101] ;
[0102] in, This represents the gradient of the local model after adding noise. yes Norm; growth factor of learning rate As an adjustable parameter, it controls the aggressiveness of the learning rate adjustment;
[0103] Step (4.2): Update the local model parameters using the learning rate. :
[0104] ;
[0105] in, These are the local model parameters for the current round.
[0106] The specific method for calculating the weighted aggregation and total privacy loss in step (6) of this embodiment is as follows:
[0107] Step (6.1): According to each medical client Calculate the weights based on the proportion of the local dataset size. :
[0108] ;
[0109] in, and , It is the training dataset. Size, It is the total size of all training datasets;
[0110] Step (6.2): Calculate the new global model parameters as follows. :
[0111] ;
[0112] Step (6.3): After T rounds of communication, the privacy loss of each client's DP satisfies the following equation:
[0113] ;
[0114] in, It's the sampling rate. It is the standard deviation of the noise scale. Denotes the binomial coefficient. For any Integers.
[0115] Example 1:
[0116] This invention is applied to the medical image classification scenario. The model is trained using medical image data stored in a distributed client. To verify the effectiveness of this invention, this embodiment was tested on a system equipped with an NVIDIA RTX 4090 GPU, using the commonly used CIFAR-10, MNIST, and FashionMNIST datasets to simulate a multi-classification task of medical images.
[0117] For MNIST and FashionMNIST, this embodiment uses a two-layer convolutional neural network, consisting of two 2D convolutional layers and two fully connected layers, with the hyperbolic tangent activation function; CIFAR-10 is trained using a ResNet-18 backbone network. The total number of all clients is set to... The sampling rate is set to Using the SAM optimizer, the base learning rate is 0.002, and the weight perturbation rate is... The value is 0.5. For the privacy parameter, the noise scale standard deviation is... Setting it to 0.95 results in a privacy failure probability of [value missing]. In this embodiment, Set to 0.1, Each client participates in all communication rounds.
[0118] Table 1
[0119]
[0120] This embodiment compares the privacy cost results of the proposed method with other existing methods on three datasets. As shown in Table 1, compared with other existing algorithms, the privacy cost of the proposed method (APC-DPFL) is reduced by an average of 20.3%, 55.3%, and 31.7% on MNIST, CIFAR-10, and FashionMNIST datasets. Furthermore, this embodiment sets the sampling rate on the MNIST, CIFAR-10, and FashionMNIST datasets to a certain value. The number of communication rounds is Ultimately, the minimum privacy budget is obtained. The analysis was performed using the cross-entropy loss function.
[0121] As shown in Figures 2 and 3, the final test accuracies achieved by the present invention on the three datasets are 95.7% (MNIST, shown in Figure 2(a) and Figure 3(a)), 68.9% (CIFAR-10, shown in Figure 2(b) and Figure 3(b)) and 76.7% (FashionMNIST, shown in Figure 2(c) and Figure 3(c)). Compared with other methods, the present invention maintains a lower overall loss value.
[0122] This embodiment also evaluates the accuracy of the sensitivity estimation method and the adaptability of the learning rate adjustment. As shown in Figure 4(a), the cutoff value accurately reflects the change in the gradient of the original model (( and From the 300th communication round to the 3000th communication round, both the original value and the estimated value showed a downward trend.
[0123] Figure 4(b) shows the distribution of the learning rate coefficients (learning rate coefficients) calculated during MNIST training. It can be observed that as the growth factor increases... As the value increases, the distribution of the learning rate coefficient becomes sparser.
[0124] As shown in Figure 5, this embodiment records the linear layer 1 bias of MNIST (Figure 5(a)) and the layer 11 weight of CIFAR-10 (Figure 5(b)). The results show that the estimator of the present invention can successfully track the trend of the true gradient norm with high fidelity and maintain robustness even in the fluctuating initial training phase, without crashing or gradient explosion.
[0125] Finally, this embodiment investigated the impact of different hyperparameters on accuracy. As shown in Figures 6 and 7, with the clipping factor... As the growth factor increases (Figures 6 and 7(a)), the model accuracy shows an overall decreasing trend, indicating that its optimal value is approximately 0.1. Larger pruning factors lead to a decrease in model performance; the training accuracy initially increases with the growth factor. The increase in [the value] (Figures 6 and 7(b)) leads to an increase in [the value]. It reaches its peak at a certain point and then declines; with the standard deviation of the noise scale... As the sampling rate increases (Figures 6 and 7(c)), the accuracy also increases overall, indicating that the invention exhibits robust performance under different noise levels and maintains its effectiveness even under high noise conditions; with the increase of the sampling rate As the sampling rate increases (Figure 6 and Figure 7(d)), the accuracy typically decreases, demonstrating that the present invention maintains good performance at different sampling rates; although the model accuracy usually decreases with the increase of local update sparsity. While the trend of decreasing values is observed with increasing values, this invention demonstrates excellent robustness, even when... Even at extreme scales (Figure 6 and Figure 7(e)), it still maintains a high level of availability.
[0126] In summary, this invention effectively solves the problem of excessive noise addition caused by the huge differences in gradient sensitivity of lesion regions in federated learning of medical images through adaptive gradient cropping technology; while maintaining a high level of privacy protection, it achieves more accurate classification performance than traditional algorithms, and has great application value in clinical auxiliary diagnosis.
Claims
1. An adaptive dimensional cropping differential privacy federated learning method for medical image classification, characterized in that, This involves a parameter server and multiple local medical clients distributed across medical institutions. The specific steps are as follows: Step (1), initialization and model broadcasting: First, the parameter server initializes the global model parameters. Noise scale standard deviation and learning rate ,parameter This includes the weights W and biases B for each dimension of the global model; Subsequently, the parameter server broadcasts to all clients. ; Step (2), sampling and gradient calculation, that is, for the k-th local medical client In the In round-robin communication, from its own medical sample dataset Sampling a batch And the gradients for each local medical client are calculated using the SAM optimizer. ; Step (3) Privacy budget constraint, that is, perform adaptive dimensional pruning on the gradient according to the sensitivity of different dimensions, and add Gaussian noise proportional to the sensitivity of the dimension to the pruned gradient of each dimension; Step (4): Use gradient-based... The learning rate algorithm of the norm is used to dynamically adjust the learning rate and update the local model parameters; Step (5): Upload the updated local model. The medical client will then train the updated local model parameters. Send back to the parameter server; Step (6): Model aggregation, the parameter server collects the updated local model parameters uploaded by each medical client. Subsequently, based on the weight of each local medical client Perform weighted aggregation to calculate new global model parameters. And broadcast it to various medical clients; Repeat steps (2) through (6) until completion. Round-robin communication, and calculate total privacy overhead.
2. The adaptive dimensional cropping differential privacy federated learning method for medical image classification according to claim 1, characterized in that, The specific process of calculating the gradients for each medical client using the SAM optimizer in step (2) is as follows: Step (2.1) Define the medical client Local loss function for: ； in These are the global model parameters of the parameter server. These are the perturbed local model parameters. It is a preset constant used to determine the disturbance radius. yes Medical sample data in the middle; In step (2.2), during the t-th round of communication, the medical client... The disturbance terms are calculated using the following methods respectively. and gradient : ； ； in Computational healthcare client gradient, express Norm.
3. The adaptive dimensional cropping differential privacy federated learning method for medical image classification according to claim 1, characterized in that, The specific process of performing adaptive dimensional cropping and adding noise in step (3) is as follows: Step (3.1), Definition Sensitivity For function Maximum on adjacent datasets Norm distance, expressed as follows: ； in They are adjacent datasets that differ by only one sample. and Representing functions respectively In two adjacent datasets and The output results; Step (3.2), for the medical client Use the dimension-wise DP average gradient from the previous round norm The sensitivity of the current communication round is multiplied by γ, where γ is a constant pruning factor; in the t-th round of communication, the client... Gradient sensitivity The estimates are as follows: ； Among them, clipping factor As an adjustable parameter to balance gradient and noise for The samples in; It refers to the first In round-robin communication, the medical client In gradient 1 The noise scale used in each dimension; Step (3.3), Medical Client Calculate noise scale and the local model gradient after clipping : ； ； It is the global theory defined in differential privacy. Sensitivity It is a medical client. In the Wheel gradient first Real-time estimates of sensitivity across all dimensions Indicates the standard deviation of noise scale, superscript The first one representing the gradient of the local model One dimension, It is the total dimension of the gradient; A warm-up strategy is employed before formal training, whereby the medical client is trained on random noise for one epoch and the average value is obtained. Norm for initialization ; Step (3.4), based on scale Gaussian noise, medical client Calculate the gradient of the local model after adding noise. : ； Where L represents the batch size for a single local training session.
4. The adaptive dimensional cropping differential privacy federated learning method for medical image classification according to claim 1, characterized in that, The specific process of dynamically adjusting the learning rate and updating the parameters in step (4) is as follows: Step (4.1), calculate the first... Medical Client in Wheel Communication Adaptive learning rate 5. ； in, This represents the gradient of the local model after adding noise. yes Norm; growth factor of learning rate As an adjustable parameter, it controls the aggressiveness of the learning rate adjustment; Step (4.2): Update the local model parameters using the learning rate. : ； in, These are the local model parameters for the current round.
6. The adaptive dimensional cropping differential privacy federated learning method for medical image classification according to claim 1, characterized in that, The specific method for calculating the weighted aggregation and total privacy loss in step (6) is as follows: Step (6.1): According to each medical client Calculate the weights based on the proportion of the local dataset size. : ； in, and , It is the training dataset. Size, It is the total size of all training datasets; Step (6.2): Calculate the new global model parameters as follows. : ； Step (6.3): After T rounds of communication, the privacy loss of each client's DP satisfies the following equation: ； in, It's the sampling rate. It is the standard deviation of the noise scale. Denotes the binomial coefficient. For any Integers.