A differential privacy federated prototype perturbation and noise correction aggregation method and system

Abstract

The application provides a differential privacy federated prototype disturbance and noise correction aggregation method and system, which is based on local category prototype to calculate category level privacy risk score and category level training contribution score, and allocates differential privacy budget for the local category prototype of the corresponding category, simultaneously adopts a unified prototype clipping threshold for norm clipping, adds Gaussian noise to the clipped local category prototype, aggregates the local category prototype with Gaussian noise into a global category prototype by using a category aggregation weight, and corrects the global category prototype, and repeats iteration until a preset convergence condition is met. The category level privacy risk enables high risk categories to obtain stronger differential privacy protection, and the category level training contribution score enables high value category prototypes to retain more available information while meeting privacy constraints; the historical global category prototype correction reduces the random fluctuations of the global prototype in a strong privacy noise scene, and improves the stability of federated training.

Description

Technical Field

[0001] This invention relates to the fields of machine learning and privacy protection technology, and in particular to a differential privacy federation prototype perturbation and noise correction aggregation method and system. Background Technology

[0002] Federated learning allows multiple clients to collaboratively train machine learning models without directly sharing their local raw data, which can alleviate the data silo problem to some extent. Federated prototype learning further reduces communication burden and improves representation alignment in heterogeneous data scenarios by exchanging lightweight representations such as category prototypes instead of complete model parameters or original samples. However, category prototypes are essentially statistical centers of local sample features. When the number of samples of a certain category in a client is small, the distribution of category features is significantly offset, or the same category prototype is repeatedly uploaded in multiple rounds of communication, attackers may infer the local category distribution or features of a few samples through multiple rounds of prototype changes, leading to an increased risk of privacy breaches.

[0003] Existing differential privacy federated learning methods typically perturb uploaded information using a uniform privacy budget or uniform noise intensity, making it difficult to simultaneously account for differences in privacy risk and training contribution among different categories and clients. If the noise is too strong, the usability of category prototypes decreases, affecting global model convergence; if the noise is too weak, it fails to meet the privacy protection requirements of higher-risk categories. Furthermore, if the server still uses ordinary averaging or aggregation based solely on sample size after adding differential privacy noise to category prototypes, it cannot distinguish the noise intensity, stability, and reliability of prototypes uploaded by different clients, potentially leading to random fluctuations in the global category prototypes and further causing oscillations in subsequent training.

[0004] Therefore, there is an urgent need for a federated prototype learning method that can perceive category-level privacy risks, dynamically allocate privacy budgets, and perform noise variance-aware aggregation and historical prototype correction on the server side, so as to improve the stability and usability of global category prototypes while satisfying differential privacy protection. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a differential privacy federated prototype perturbation and noise correction aggregation method and system, which solves the technical problem that existing technologies cannot simultaneously protect privacy and improve model performance.

[0006] In a first aspect, the present invention provides a differential privacy federation prototype perturbation and noise correction aggregation method, which is implemented through a server and multiple clients, and specifically includes the following steps:

[0007] The service is used to distribute the current round of global model parameters, global category prototypes, and privacy configuration parameters to clients participating in federated learning.

[0008] The client performs local training based on local private data and calculates local category prototypes by category;

[0009] The client calculates a category-level privacy risk score and a category-level training contribution score based on a local category prototype.

[0010] The client combines the category-level privacy risk score and the category-level training contribution score to allocate a differential privacy budget to the local category prototype for the corresponding category.

[0011] The client uses a unified prototype pruning threshold to perform norm pruning on the local category prototype, and calculates the noise standard deviation by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability. Gaussian noise is then added to the pruned local category prototype to obtain a local category prototype with Gaussian noise.

[0012] The server aggregates the local category prototypes with Gaussian noise based on the category aggregation weight to obtain the global category prototype of the corresponding category in this round.

[0013] The server performs a fusion correction on the current global category prototype and the previous round of historical global category prototype based on the current category prototype credibility coefficient, to obtain the corrected global category prototype;

[0014] The server distributes the corrected global category prototype for the current round to each client for the next round of iteration until the preset convergence condition is met.

[0015] Secondly, the present invention provides a differential privacy federated prototype perturbation and noise correction aggregation system, including a server and multiple clients. The server is configured with a parameter distribution module, an aggregation module, a correction module, and an iteration module; the clients are configured with a local training module, a category scoring module, a privacy budget allocation module, and a prototype pruning and perturbation module.

[0016] The parameter distribution module is used to distribute the current round of global model parameters, global category prototypes, and privacy configuration parameters to clients participating in federated learning.

[0017] The local training module is used to perform local training based on local private data and to calculate local category prototypes by category;

[0018] The category scoring module is used to calculate category-level privacy risk scores and category-level training contribution scores based on local category prototypes.

[0019] The privacy budget allocation module is used to combine the category-level privacy risk score and the category-level training contribution score to allocate differential privacy budget to the local category prototype of the corresponding category.

[0020] The prototype pruning and perturbation module is used to perform norm pruning on the local category prototype using a unified prototype pruning threshold, and calculate the noise standard deviation by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability, and add Gaussian noise to the pruned local category prototype to obtain a local category prototype with Gaussian noise.

[0021] The aggregation module is used to aggregate local category prototypes with Gaussian noise based on category aggregation weights to obtain the global category prototypes of the corresponding categories in this round.

[0022] The correction module is used to fuse and correct the current global category prototype and the previous historical global category prototype based on the current category prototype credibility coefficient to obtain the corrected global category prototype.

[0023] The iteration module is used to distribute the global category prototype after the current round of correction to each client for the next round of iteration until the preset convergence condition is met.

[0024] Thirdly, the present invention provides an electronic device, comprising:

[0025] At least one processor;

[0026] and a memory communicatively connected to the at least one processor;

[0027] The memory stores a computer program that can be executed by at least one processor, which, when executed by at least one processor, implements the differential privacy federation prototype perturbation and noise correction aggregation method.

[0028] The beneficial effects of this invention are as follows:

[0029] 1. This invention characterizes category-level privacy risks by combining category sample quantity, prototype offset degree, historical upload frequency, and category sensitivity coefficient, enabling high-risk categories to obtain stronger differential privacy protection, and by using category-level training contribution scoring, high-value category prototypes retain more usable information while meeting privacy constraints;

[0030] 2. This invention controls sensitivity by using a unified prototype pruning threshold, which facilitates the calculation of differential privacy noise intensity. It also reduces the impact of high-noise prototypes on the global prototype by noise variance-aware aggregation, thus avoiding the server from treating prototypes of different noise intensities as equal.

[0031] 3. This invention reduces the random fluctuations of global prototypes in scenarios with strong privacy noise by correcting historical global category prototypes, thereby improving the stability of federated training. Attached Figure Description

[0032] Figure 1 This is a flowchart illustrating the method of an embodiment of the present invention;

[0033] Figure 2 This is a structural framework diagram of the system according to an embodiment of the present invention;

[0034] In the diagram, 10 represents the server and 20 represents the client.

[0035] 101 - Parameter Distribution Module; 102 - Aggregation Module; 103 - Correction Module; 104 - Iteration Module;

[0036] 201 - Local Training Module; 202 - Category Scoring Module; 203 - Privacy Budget Allocation Module; 204 - Prototype Pruning and Perturbation Module. Detailed Implementation

[0037] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings:

[0038] like Figure 1 As shown, this embodiment provides a differential privacy federation prototype perturbation and noise correction aggregation method. The method includes a server and multiple clients, and specifically includes the following steps:

[0039] S1: Use the service to send the current round of global model parameters, global category prototypes, and privacy configuration parameters to the clients participating in federated learning;

[0040] S2: The client performs local training based on local private data and calculates local category prototypes by category;

[0041] S3: The client calculates a category-level privacy risk score and a category-level training contribution score based on the local category prototype;

[0042] S4: The client combines the category-level privacy risk score and the category-level training contribution score to allocate a differential privacy budget to the local category prototype of the corresponding category;

[0043] S5: The client uses a unified prototype pruning threshold to prune the local category prototype according to norm, and calculates the noise standard deviation by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability. Gaussian noise is then added to the pruned local category prototype to obtain a local category prototype with Gaussian noise.

[0044] S6: The server aggregates the local category prototypes with Gaussian noise based on the category aggregation weight to obtain the global category prototype of the corresponding category in this round;

[0045] S7: The server performs a fusion correction on the current global category prototype and the previous round of historical global category prototype based on the current category prototype credibility coefficient to obtain the corrected global category prototype;

[0046] S8: The server sends the global category prototype after the current round of correction to each client and repeats steps S1-S7 until the preset convergence condition is met.

[0047] In this embodiment, in step S2, the client performs local training based on local private data and calculates local category prototypes by category, including:

[0048] S21: The client receives the global model parameters issued by the server in this round and loads the local private dataset. And divide the sample set into categories according to category c. ;

[0049] S22: The local model is trained using a federated prototype learning loss function, which includes classification loss and prototype alignment regularization loss. The Adam optimizer is then used to iteratively update the parameters of the local feature extractor. Iterate until the preset number of local epochs is reached, and the feature extractor is fixed after training. ;

[0050] In this embodiment, the classification loss is the cross-entropy loss between the predicted label and the true label of the local sample. The prototype alignment regularization loss is used to constrain the local category prototype and the previous round of global category prototype issued by the server. The representation distribution is close to alleviate the Non-IID data offset.

[0051] S23: Set the category sample set samples Input the feature extractor trained locally Extracting feature vectors ;

[0052] S24: For the category sample set Feature vectors of all samples Calculate the arithmetic mean and generate the local category prototype, i.e.:

[0053] ;

[0054] In the formula, For the first Wheel Client Category The calculated local category prototype; For the first Wheel Client Category Category sample set The number of samples; For the first One sample; Indicates client Feature extractor For the sample The generated feature representation is a feature vector.

[0055] In this embodiment, in step S3, the client calculates a category-level privacy risk score and a category-level training contribution score based on the local category prototype, including:

[0056] S31: The category-level privacy risk score is calculated based on the number of samples, prototype offset, historical upload frequency, and sensitivity coefficient of the corresponding client category, i.e.:

[0057] ;

[0058] In the formula, For the client ,category In the Category-level privacy risk score for the wheel; For the client ,category In the The degree of deviation of the wheel's prototype; Client ,category In the Historical upload frequency of the wheel; For category Sensitivity coefficient; These are the weighting coefficients; This is a smoothing term.

[0059] In this embodiment, the prototype offset is calculated using the Euclidean distance between the current local category prototype and the previous round global category prototype:

[0060] ;

[0061] In the formula, Indicates the server side at the 1st Wheel maintenance categories The global category prototype; For the first Wheel Client Category The calculated local category prototype; This represents the L2 norm.

[0062] In this embodiment, the client records whether it uploads a local category prototype of any category in each round through a privacy budget ledger. Therefore, the historical upload frequency is represented as:

[0063] ;

[0064] In the formula, For the client Medium category The local category prototype in the first The upload marker for the round upload.

[0065] In this embodiment, the upload tag Represented as:

[0066] ;

[0067] The upload marker Used to characterize the cumulative exposure of category prototypes, the more frequently a local category prototype of a certain category is uploaded, the higher the possibility that an attacker will infer the local category distribution or sample characteristics from the results of multiple rounds of communication, and therefore its privacy risk score should be increased accordingly.

[0068] S32: Calculate the category-level training contribution score based on the number of samples of the corresponding category on the client side, the classification loss, and the prototype stability score. This category-level training contribution score measures the effectiveness of the local category prototype in updating the global model.

[0069] ;

[0070] In the formula, For the client ,category In the Category-level training contribution score for each round; For the client ,category In the The classification loss of the wheel; For the client ,category In the Prototype stability score of the wheel; These are the weighting coefficients. This is a smoothing term.

[0071] In this embodiment, the prototype stability score is used to measure the stability of prototypes of the same client and the same category in adjacent training rounds. The prototype stability score is calculated based on the Euclidean distance between the client's current local category prototype and the historical local category prototype of the previous round, that is:

[0072] ;

[0073] In the formula, Indicates client In the The categories obtained from round calculation The historical local category prototype.

[0074] In this embodiment, in step S4, the client combines the category-level privacy risk score and the category-level training contribution score to allocate a differential privacy budget to the local category prototype of the corresponding category, that is:

[0075] ;

[0076] In the formula, To be assigned to the client ,category Differential privacy budget for local category prototypes; This is a range truncation function; Indicates the basic privacy budget; For smoothing terms; These represent the minimum privacy budget and the maximum privacy budget, respectively. For the client ,category In the Category-level training contribution score for each round; For the client ,category In the The category-level privacy risk score of the wheel.

[0077] In this embodiment, in step S5, the client performs norm pruning on the local category prototype using a unified prototype pruning threshold, that is:

[0078] ;

[0079] In the formula, For the cropped category The local category prototype; To standardize the prototype clipping threshold; This indicates taking the maximum value; The L2 norm of the local category prototype.

[0080] In this embodiment, if the L2 norm of the local category prototype Less than or equal to the uniform prototype clipping threshold If so, the local category prototype will not be trimmed.

[0081] In this embodiment, if the L2 norm of the local category prototype is... Greater than the uniform prototype clipping threshold Then, the threshold for trimming is based on the uniform prototype. Scaling is performed.

[0082] In this embodiment, in step S5, the noise standard deviation is calculated by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability, i.e.:

[0083] ;

[0084] In the formula, For the client ,category In the The noise standard deviation used when the prototype is perturbed; For category prototype sensitivity; Indicates client ,category Rounds The corresponding probability of privacy failure; Indicates assignment to the client ,category Differential privacy budget for local category prototypes.

[0085] In this embodiment, the privacy failure probability is used to characterize the probability that differential privacy protection is allowed to fail. The smaller the value, the more stringent the privacy protection requirements, and the stronger the Gaussian noise needs to be added to the client during prototype perturbation. The privacy failure probability... Represented as:

[0086] ;

[0087] In the formula, This indicates the system's preset total probability of privacy failure; The preset total number of training rounds; For the number of clients; This represents the number of categories.

[0088] In this embodiment, the category prototype sensitivity This value is used to measure the maximum impact of a single sample change on the local class prototype. A higher value indicates that the local class prototype is more susceptible to the influence of a single sample, thus requiring the addition of greater noise to meet differential privacy requirements. This class prototype sensitivity... Represented as:

[0089] ;

[0090] In the formula, To standardize the prototype clipping threshold; For the first Wheel Client Category Category sample set The number of samples.

[0091] In this embodiment, in step S5, Gaussian noise is added to the clipped local category prototype to obtain a local category prototype with Gaussian noise, i.e.:

[0092] ;

[0093] In the formula, For the client ,category In the The local category prototype after adding Gaussian noise to the wheel; This indicates that the mean is 0 and the covariance is... Gaussian noise; For the client ,category In the The noise standard deviation used when the prototype is perturbed; It is an identity matrix.

[0094] The client will include a local category prototype with Gaussian noise. Noise standard deviation Non-sensitive statistical information is uploaded to the server.

[0095] In this embodiment, in step S6, the server aggregates the local category prototypes with Gaussian noise based on category aggregation weights to obtain the global category prototypes for the corresponding categories in this round, including:

[0096] S61: Based on the local category prototype with Gaussian noise and the categories maintained in the previous round on the server side. The Euclidean distance of the global category prototypes is used to calculate the prototype consistency score, i.e.:

[0097] ;

[0098] In the formula, For the client ,category In the Prototype consistency score of the wheel; For the client ,category In the The local category prototype after adding Gaussian noise to the round; showing the server side in the first... Wheel maintenance categories The global category prototype; This is a smoothing term.

[0099] S62: Based on the prototype consistency score and prototype stability score, and the classification loss, calculate the category aggregation contribution score, i.e.:

[0100] ;

[0101] In the formula, For the client ,category In the The wheel's category aggregates contribution scores; For the first Wheel Client Category Category sample set The number of samples; For the client ,category In the The classification loss of the wheel; For the client ,category In the Prototype stability score of the wheel; For the client ,category In the Prototype consistency score of the wheel; These are the weighting coefficients. This is a smoothing term.

[0102] S63: The server obtains the category aggregation weight based on the category aggregation contribution score and the noise standard deviation, that is:

[0103] ;

[0104] in, This indicates that the server is on the client side. In the Wheel aggregation category Category aggregation weights when using local category prototypes; For the client ,category In the The noise standard deviation used when the prototype is perturbed; For smoothing terms; For the current round of ownership of categories And upload the client collection of local category prototypes.

[0105] S64: Aggregate the local category prototypes with Gaussian noise based on the category aggregation weights to obtain the global category prototypes for the corresponding categories in this round, i.e.:

[0106] ;

[0107] In the formula, For the current round Categories obtained from aggregation The corresponding global category prototype. For the client In the Wheel aggregation category Category aggregation weights; For the client ,category In the The local category prototype after adding Gaussian noise to the wheel.

[0108] In this embodiment, in step S7, the server performs a fusion correction on the current global category prototype and the previous round of historical global category prototype based on the current category prototype credibility coefficient to obtain the corrected global category prototype, including:

[0109] S71: Calculate the class-aggregated noise variance based on the class aggregation weights and the noise standard deviation, i.e.:

[0110]

[0111] In the formula, For category In the Wheel category aggregated noise variance; This indicates that the server is on the client side. In the Wheel aggregation category Category aggregation weights when using local category prototypes; For the client ,category In the The noise standard deviation used when the prototype is perturbed.

[0112] S72: Calculate the current category prototype reliability coefficient based on the aggregated noise variance of the category. ,Right now:

[0113] ;

[0114] In the formula, Indicate category In the The current category prototype credibility coefficient of the wheel; Noise impact factor; and These are the lower and upper limits of the correction ratio, respectively; Indicates a range truncation function.

[0115] S73: Based on the current category prototype credibility coefficient, the current global category prototype and the previous round of historical global category prototypes of the category are fused and corrected to obtain the corrected global category prototype, i.e.:

[0116] ;

[0117] In the formula, For the current round The corrected global category prototype for category c.

[0118] like Figure 2 As shown, another embodiment of this application provides a differential privacy federated prototype perturbation and noise correction aggregation system, including a server 10 and multiple clients 20. The server 10 is configured with a parameter distribution module 101, an aggregation module 102, a correction module 103, and an iteration module 104. The clients 20 are configured with a local training module 201, a category scoring module 202, a privacy budget allocation module 203, and a prototype pruning and perturbation module 204.

[0119] In this embodiment, the parameter distribution module 101 is used to distribute the current round of global model parameters, global category prototypes, and privacy configuration parameters to the clients participating in federated learning.

[0120] In this embodiment, the local training module 201 is used to perform local training based on local private data and calculate local category prototypes by category. Specifically:

[0121] The local training module 201 receives the global model parameters issued by the server in this round and loads the local private dataset. And divide the sample set into categories according to category c. .

[0122] The local training module 201 trains the local model using a federated prototype learning loss function, which includes classification loss and prototype alignment regularization loss, and uses the Adam optimizer to iteratively update the parameters of the local feature extractor. Iterate until the preset number of local epochs is reached, and the feature extractor is fixed after training. .

[0123] In this embodiment, the classification loss is the cross-entropy loss between the predicted label and the true label of the local sample. The prototype alignment regularization loss is used to constrain the local category prototype and the previous round of global category prototype issued by the server. The representation distribution is close to alleviate the Non-IID data offset.

[0124] The local training module 201 will use the category sample set samples Input the feature extractor trained locally Extracting feature vectors .

[0125] The local training module 201 pairs the category sample sets. Feature vectors of all samples Calculate the arithmetic mean and generate the local category prototype, i.e.:

[0126] ;

[0127] In the formula, For the first Wheel client Category The calculated local category prototype; For the first Wheel client Category Category sample set The number of samples; For the first One sample; Indicates client Feature extractor For the sample The generated feature representation is a feature vector.

[0128] In this embodiment, the category scoring module 202 is used to calculate a category-level privacy risk score and a category-level training contribution score based on a local category prototype. Specifically:

[0129] The category scoring module 202 calculates the category-level privacy risk score based on the number of samples, prototype offset, historical upload frequency, and sensitivity coefficient of the corresponding category on the client side.

[0130] ;

[0131] In the formula, For the client ,category In the Category-level privacy risk score for the wheel; For the client ,category In the The degree of deviation of the wheel's prototype; Client ,category In the Historical upload frequency of the wheel; For category Sensitivity coefficient; These are the weighting coefficients; This is a smoothing term.

[0132] In this embodiment, the prototype offset is calculated using the Euclidean distance between the current local category prototype and the previous round global category prototype:

[0133] ;

[0134] In the formula, Indicates the server side at the 1st Wheel maintenance categories The global category prototype; For the first Wheel Client Category The calculated local category prototype; This represents the L2 norm.

[0135] In this embodiment, the client records whether it uploads a local category prototype of any category in each round through a privacy budget ledger. Therefore, the historical upload frequency is represented as:

[0136] ;

[0137] In the formula, For the client Medium category The local category prototype in the first The upload marker for the round upload.

[0138] The category scoring module 202 calculates the category-level training contribution score based on the number of samples of the corresponding category on the client side, the classification loss, and the prototype stability score. This category-level training contribution score measures the effectiveness of the local category prototype in updating the global model.

[0139] ;

[0140] In the formula, For the client ,category In the Category-level training contribution score for each round; For the client ,category In the The classification loss of the wheel; For the client ,category In the Prototype stability score of the wheel; These are the weighting coefficients. This is a smoothing term.

[0141] In this embodiment, the prototype stability score is used to measure the stability of prototypes of the same client and the same category in adjacent training rounds. The prototype stability score is calculated based on the Euclidean distance between the client's current local category prototype and the historical local category prototype of the previous round, that is:

[0142] ;

[0143] In the formula, Indicates client In the The categories obtained from round calculation The historical local category prototype.

[0144] In this embodiment, the privacy budget allocation module 203 is used to combine the category-level privacy risk score and the category-level training contribution score to allocate differential privacy budget to the local category prototype of the corresponding category.

[0145] In this embodiment, the privacy budget allocation module 203 allocates it to the client. Differential privacy budget is represented as:

[0146] ;

[0147] In the formula, To be assigned to the client ,category Differential privacy budget for local category prototypes; This is a range truncation function; Indicates the basic privacy budget; For smoothing terms; These represent the minimum privacy budget and the maximum privacy budget, respectively. For the client ,category In the Category-level training contribution score for each round; For the client ,category In the The category-level privacy risk score of the wheel.

[0148] In this embodiment, the prototype pruning and perturbation module 204 is used to perform norm pruning on the local category prototype using a unified prototype pruning threshold, and calculate the noise standard deviation by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability, and add Gaussian noise to the pruned local category prototype to obtain a local category prototype with Gaussian noise.

[0149] In this embodiment, the prototype pruning and perturbation module 204 uses a unified prototype pruning threshold to perform norm pruning on the local category prototype, that is:

[0150] ;

[0151] In the formula, For the cropped category The local category prototype; To standardize the prototype clipping threshold; This indicates taking the maximum value; The L2 norm of the local category prototype.

[0152] In this embodiment, if the L2 norm of the local category prototype Less than or equal to the uniform prototype clipping threshold If so, the local category prototype will not be trimmed.

[0153] In this embodiment, if the L2 norm of the local category prototype is... Greater than the uniform prototype clipping threshold Then, the threshold for trimming is based on the uniform prototype. Scaling is performed.

[0154] In this embodiment, the prototype trimming and perturbation module 204 calculates the noise standard deviation by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability, i.e.:

[0155] ;

[0156] In the formula, For the client ,category In the The noise standard deviation used when the prototype is perturbed; For category prototype sensitivity; Indicates client ,category Rounds The corresponding probability of privacy failure; Indicates assignment to the client ,category Differential privacy budget for local category prototypes.

[0157] In this embodiment, the privacy failure probability is used to characterize the probability that differential privacy protection is allowed to fail. The smaller the value, the more stringent the privacy protection requirements, and the stronger the Gaussian noise needs to be added to the client during prototype perturbation. The privacy failure probability... Represented as:

[0158] ;

[0159] In the formula, This indicates the system's preset total probability of privacy failure; The preset total number of training rounds; For the number of clients; This represents the number of categories.

[0160] In this embodiment, the category prototype sensitivity This value is used to measure the maximum impact of a single sample change on the local class prototype. A higher value indicates that the local class prototype is more susceptible to the influence of a single sample, thus requiring the addition of greater noise to meet differential privacy requirements. This class prototype sensitivity... Represented as:

[0161] ;

[0162] In the formula, To standardize the prototype clipping threshold; For the first Wheel Client Category Category sample set The number of samples.

[0163] In this embodiment, the prototype trimming and perturbation module 204 adds Gaussian noise to the trimmed local category prototype to obtain a local category prototype with Gaussian noise, i.e.:

[0164] ;

[0165] In the formula, For the client ,category In the The local category prototype after adding Gaussian noise to the wheel; This indicates that the mean is 0 and the covariance is... Gaussian noise; For the client ,category In the The noise standard deviation used when the prototype is perturbed; It is an identity matrix.

[0166] The prototype trimming and perturbation module 204 will include local category prototypes with Gaussian noise. Noise standard deviation Non-sensitive statistical information is uploaded to the server.

[0167] In this embodiment, the aggregation module 102 is used to aggregate the local category prototypes with Gaussian noise based on the category aggregation weights to obtain the global category prototypes of the corresponding categories in this round. Specifically:

[0168] The aggregation module 102 is based on a local category prototype with Gaussian noise and the categories maintained in the previous round on the server side. The Euclidean distance of the global category prototypes is used to calculate the prototype consistency score, i.e.:

[0169] ;

[0170] In the formula, For the client ,category In the Prototype consistency score of the wheel; For the client ,category In the The local category prototype after adding Gaussian noise to the round; showing the server side in the first... Wheel maintenance categories The global category prototype; This is a smoothing term.

[0171] The aggregation module 102 calculates the category aggregation contribution score based on the prototype consistency score, prototype stability score, and classification loss, namely:

[0172] ;

[0173] In the formula, For the client ,category In the The category-based contribution score of the wheel; For the first Wheel Client Category Category sample set The number of samples; For the client ,category In the The classification loss of the wheel; For the client ,category In the Prototype stability score of the wheel; For the client ,category In the Prototype consistency score of the wheel; These are the weighting coefficients. This is a smoothing term.

[0174] The aggregation module 102 obtains the category aggregation weights based on the category aggregation contribution score and the noise standard deviation, that is:

[0175] ;

[0176] in, This indicates that the server is on the client side. In the Wheel aggregation category Category aggregation weights when using local category prototypes; For the client ,category In the The noise standard deviation used when the prototype is perturbed; For smoothing terms; For the current round of ownership of categories And upload the client collection of local category prototypes.

[0177] The aggregation module 102 aggregates the local category prototypes with Gaussian noise based on category aggregation weights to obtain the global category prototypes for the corresponding categories in this round, i.e.:

[0178] ;

[0179] In the formula, For the current round Categories obtained from aggregation The corresponding global category prototype. For the client In the Wheel aggregation category Category aggregation weights; For the client ,category In the The local category prototype after adding Gaussian noise to the wheel.

[0180] In this embodiment, the correction module 103 is used to fuse and correct the current global category prototype and the previous round of historical global category prototype based on the current category prototype credibility coefficient, to obtain the corrected global category prototype. Specifically:

[0181] The correction module 103 calculates the class aggregated noise variance based on the class aggregated weights and the noise standard deviation, that is:

[0182]

[0183] In the formula, For category In the Wheel category aggregated noise variance; This indicates that the server is on the client side. In the Wheel aggregation category Category aggregation weights when using local category prototypes; For the client ,category In the The noise standard deviation used when the prototype is perturbed.

[0184] The correction module 103 calculates the current category prototype credibility coefficient based on the category aggregated noise variance. ,Right now:

[0185] ;

[0186] In the formula, Indicate category In the The current category prototype credibility coefficient of the wheel; Noise impact factor; and These are the lower and upper limits of the correction ratio, respectively; Indicates a range truncation function.

[0187] The correction module 103 performs a fusion correction on the current global category prototype and the previous round of historical global category prototype based on the current category prototype credibility coefficient, to obtain the corrected global category prototype, namely:

[0188] ;

[0189] In the formula, For the current round The corrected global category prototype for category c.

[0190] The iteration module is used to distribute the global category prototype after the current round of correction to each client for the next round of iteration, repeating steps S1-S7 until the preset convergence condition is met.

[0191] A third embodiment of this application provides an electronic device, comprising:

[0192] At least one processor;

[0193] and a memory communicatively connected to the at least one processor;

[0194] The memory stores a computer program that can be executed by at least one processor, which, when executed by at least one processor, implements the differential privacy federation prototype perturbation and noise correction aggregation method.

[0195] The fourth embodiment of this application provides a computer storage medium storing a computer program that, when executed by a processor, implements the differential privacy federation prototype perturbation and noise correction aggregation method.

[0196] In this application, the memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. A processor, coupled to the memory, is used to execute computer programs stored in the memory.

[0197] The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. Computer-readable media may include at least: any entity or device capable of carrying the computer program code to a photographic device / electronic device, recording media, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0198] The embodiments and descriptions above are merely illustrative of the principles and preferred embodiments of the present invention. Various changes and modifications may be made to the present invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed.

Claims

1. A differential privacy federated prototype perturbation and noise correction aggregation method, wherein the method is implemented through a server and multiple clients, characterized in that, The method includes: The service is used to distribute the current round of global model parameters, global category prototypes, and privacy configuration parameters to clients participating in federated learning. The client performs local training based on local private data and calculates local category prototypes by category; The client calculates a category-level privacy risk score and a category-level training contribution score based on a local category prototype. The client combines the category-level privacy risk score and the category-level training contribution score to allocate a differential privacy budget to the local category prototype for the corresponding category. The client uses a unified prototype pruning threshold to perform norm pruning on the local category prototype, and calculates the noise standard deviation by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability. Gaussian noise is then added to the pruned local category prototype to obtain a local category prototype with Gaussian noise. The server aggregates the local category prototypes with Gaussian noise based on the category aggregation weight to obtain the global category prototype of the corresponding category in this round. The server performs a fusion correction on the current global category prototype and the previous round of historical global category prototype based on the current category prototype credibility coefficient, to obtain the corrected global category prototype. The server distributes the corrected global category prototype for the current round to each client for the next round of iteration until the preset convergence condition is met.

2. The method according to claim 1, characterized in that: The local category prototype is the arithmetic mean of the feature vectors of all samples in the category sample set, that is: ； In the formula, For the first Wheel Client Category The calculated local category prototype; For the first Wheel Client Category Category sample set The number of samples; For the first One sample; Indicates client Feature extractor For the sample The generated feature representation is a feature vector.

3. The method according to claim 2, characterized in that: The category-level privacy risk score is calculated based on the number of samples in the corresponding category of the client, the degree of prototype offset, the historical upload frequency, and the sensitivity coefficient, that is: ； In the formula, For the client ,category In the Category-level privacy risk score for the wheel; For the first Wheel Client Category Category sample set The number of samples; For the client ,category In the The degree of deviation of the wheel's prototype; Client ,category In the Historical upload frequency of the wheel; For category Sensitivity coefficient; These are the weighting coefficients; This is a smoothing term.

4. The method according to claim 3, characterized in that: The category-level training contribution score is calculated based on the number of samples in the corresponding category on the client side, the classification loss, and the prototype stability score, i.e.: ； In the formula, For the client ,category In the Category-level training contribution score for each round; For the client ,category In the The classification loss of the wheel; For the client ,category In the Prototype stability score of the wheel; These are the weighting coefficients. This is a smoothing term.

5. The method according to claim 4, characterized in that: Add Gaussian noise to the clipped local category prototype to obtain a local category prototype with Gaussian noise, including: ； In the formula, For the client ,category In the The local category prototype after adding Gaussian noise to the wheel; This indicates that the mean is 0 and the covariance is... Gaussian noise; For the client ,category In the The noise standard deviation used when the prototype is perturbed; It is an identity matrix.

6. The method according to claim 5, characterized in that: The client uses a unified prototype pruning threshold to perform norm pruning on the local category prototype, resulting in the pruned local category prototype: ； In the formula, For the cropped category The local category prototype; To standardize the prototype clipping threshold; This indicates taking the maximum value; The L2 norm of the local category prototype; The noise standard deviation is calculated by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability, i.e.: ； In the formula, For the client ,category In the The noise standard deviation used when the prototype is perturbed; For category prototype sensitivity; Indicates client ,category Rounds The corresponding probability of privacy failure; Indicates assignment to the client ,category Differential privacy budget for local category prototypes.

7. The method according to claim 6, characterized in that: The server aggregates the local category prototypes with Gaussian noise based on category aggregation weights to obtain the global category prototypes for the corresponding categories in this round, including: Based on the local category prototype with Gaussian noise and the categories maintained in the previous round on the server side. The Euclidean distance of the global category prototype is used to calculate the prototype consistency score; Based on the prototype consistency score and prototype stability score, the category aggregation contribution score is calculated using the classification loss. The server obtains the category aggregation weight based on the category aggregation contribution score and the noise standard deviation; The local category prototypes with Gaussian noise are aggregated based on the category aggregation weights to obtain the global category prototypes for the corresponding categories in this round.

8. The method according to claim 7, characterized in that: The server performs a fusion correction on the current global category prototype and the previous round's historical global category prototype based on the current category prototype credibility coefficient, to obtain the corrected global category prototype, including: Calculate the variance of category-aggregated noise based on category aggregation weights and noise standard deviation; Calculate the current category prototype credibility coefficient based on the aggregated noise variance of the category; Based on the current category prototype credibility coefficient, the current global category prototype and the previous round of historical global category prototypes of the category are fused and corrected to obtain the corrected global category prototype.

9. A differential privacy federation prototype perturbation and noise correction aggregation system, characterized in that, It includes a server and multiple clients. The server is configured with a parameter distribution module, an aggregation module, a correction module, and an iteration module. The clients are configured with a local training module, a category scoring module, a privacy budget allocation module, and a prototype pruning and perturbation module. The parameter distribution module is used to distribute the current round of global model parameters, global category prototypes, and privacy configuration parameters to clients participating in federated learning. The local training module is used to perform local training based on local private data and to calculate local category prototypes by category; The category scoring module is used to calculate category-level privacy risk scores and category-level training contribution scores based on local category prototypes. The privacy budget allocation module is used to combine the category-level privacy risk score and the category-level training contribution score to allocate differential privacy budget to the local category prototype of the corresponding category. The prototype pruning and perturbation module is used to perform norm pruning on the local category prototype using a unified prototype pruning threshold, and calculate the noise standard deviation by combining the differential privacy budget, category prototype sensitivity, and privacy failure probability, and add Gaussian noise to the pruned local category prototype to obtain a local category prototype with Gaussian noise. The aggregation module is used to aggregate local category prototypes with Gaussian noise based on category aggregation weights to obtain the global category prototypes of the corresponding categories in this round. The correction module is used to fuse and correct the current global category prototype and the previous historical global category prototype based on the current category prototype credibility coefficient to obtain the corrected global category prototype. The iteration module is used to distribute the global category prototype after the current round of correction to each client for the next round of iteration until the preset convergence condition is met.

10. An electronic device, comprising: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by at least one processor, wherein the computer program, when executed by at least one processor, implements the differential privacy federation prototype perturbation and noise correction aggregation method as described in any one of claims 1-8.

Images