Federated learning method and apparatus

Abstract

A federated learning method and apparatus. The method comprises: a server node respectively sends a model training message to N client nodes that execute a federated learning task, so that the client node performs model training on the basis of federated learning initial model parameters and federated learning configuration information in the model training message, to obtain real local model parameters, and then performs privacy protection processing on the local model parameters on the basis of privacy protection configuration information in the model training message, to obtain false privacy model parameters. Then, the client node sends the false privacy model parameters to the server node, so that the server node executes subsequent operations of the federated learning task on the basis of the false privacy model parameters, so that a certain client node is prevented from inferring local data of other client nodes by means of real model parameters, thereby ensuring the privacy and security of data of a user.

Description

A federated learning method and device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese Patent Application No. 202311837234.7, filed on December 27, 2023, and entitled "A Federated Learning Method and Device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the field of communication technology, and in particular to a federated learning method and device. BACKGROUND

[0004] Federated learning refers to a privacy-protecting distributed machine learning method, which includes a server and multiple clients.

[0005] In a conventional scheme, the server generates initial model parameters based on a business request, and sends the initial model parameters to multiple clients participating in model training. Each client takes local data as training data, performs model training on a local model according to the training data and the initial model parameters, and sends the trained model parameters to the server. The server aggregates the model parameters from the multiple clients to obtain model parameters for the next round of iteration, and sends the model parameters to the multiple clients for the next round of model training, thereby realizing iterative training of federated learning.

[0006] During the communication process between the server and the multiple clients, the local data of the clients is prone to be leaked, and the privacy and security of the local data cannot be guaranteed. SUMMARY

[0007] Embodiments of the present application provide a federated learning method and device to avoid leakage of local data of clients and guarantee the privacy and security of the local data.

[0008] The present application is applicable to a federated learning system, which includes a server node and a client node. After obtaining real local model parameters, the client node performs privacy protection processing on the real local model parameters to obtain non-real privacy model parameters. The server node is configured to aggregate the non-real privacy model parameters corresponding to the client nodes, implement federated learning tasks with non-real model parameters, and thus ensure that a server node or a client node with an attack behavior cannot deduce the local data of other client nodes through the non-real model parameters, avoid leakage of the local data of other client nodes, and guarantee the privacy and security of the local data.

[0009] Firstly, this application proposes a federated learning method, which is applied to the server nodes in a federated learning system. The following description focuses on the server nodes as the implementing entities. The method includes:

[0010] The server node sends a first model training message to the first client node among N client nodes. The N client nodes are used to execute the federated learning task, and the first client node can be any one of the N client nodes. The first model training message is the model training message corresponding to the first client node, including initial model parameters for federated learning, federated learning configuration information, and privacy protection configuration information. Further, the initial model parameters and federated learning configuration information are used by the first client node for model training, and the privacy protection configuration information is used by the first client node to perform privacy protection processing on its local model parameters. That is, after receiving the first model training message, the first client node trains its model according to the initial model parameters and federated learning configuration information to obtain local model parameters, and then performs privacy protection processing on these local model parameters according to the privacy protection configuration information to obtain privacy-preserving model parameters. Based on this, the server node receives the privacy-preserving model parameters from the first client node, and then aggregates the models based on the privacy-preserving model parameters from the N client nodes to obtain aggregated model parameters for federated learning iterations, thus enabling subsequent federated learning iterations until the federated learning task is completed.

[0011] This scheme involves the server node sending a first model training message to the first client node, instructing the client node to train its own local model using its local data based on the initial model parameters and federated learning configuration information, thus obtaining the true local model parameters. Then, according to the privacy protection configuration information, the true local model parameters undergo privacy protection processing, resulting in non-true local model parameters (i.e., privacy model parameters). Therefore, the model parameters received by the server node are non-true local model parameters. Even if the server node is malicious, it cannot deduce the client node's local data based on these non-true local model parameters. Furthermore, after receiving the non-true local model parameters, the server node performs subsequent aggregation operations in the federated learning task based on them, obtaining non-true aggregated model parameters. Even a malicious client node cannot deduce the local data of other client nodes using these non-true aggregated model parameters, thereby preventing the leakage of other client nodes' local data and ensuring the privacy and security of local data.

[0012] In one possible design, the privacy protection configuration information includes privacy protection processing type information and privacy protection processing factor; wherein, the privacy protection processing type information indicates the privacy protection processing method used by the first client node, and the privacy protection processing factor indicates the parameters used by the first client node when performing privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information.

[0013] In this way, the first client node can perform privacy protection processing on the trained local model parameters based on the privacy protection processing type information indicated by the privacy protection processing method and the parameters indicated by the privacy protection processing factor.

[0014] In one possible design, the server node determines the privacy protection processing factor for each of the N client nodes based on the privacy protection budget information supported by each client node. Alternatively, the server node determines the privacy protection processing factor for the first client node among the N client nodes, based on the privacy protection budget information supported by the first client node. The privacy protection budget information supported by the first client node characterizes the degree of model accuracy degradation caused by privacy protection processing, i.e., the degree of model accuracy degradation corresponding to the privacy model parameters compared to the local model parameters. Furthermore, the privacy protection budget information supported by the first client node can also characterize the degree of protection provided by the privacy protection processing to the local model parameters. It can be understood that the degree of protection provided by the privacy protection processing to the local model parameters is positively correlated with the degree of model accuracy degradation caused by the privacy protection processing; or, the greater the degree of protection provided by the privacy protection processing to the local model parameters, the greater the degree of model accuracy degradation caused by the privacy protection processing.

[0015] This design ensures that the privacy protection factor for each client node satisfies both the privacy protection requirements of each client node for its local model parameters and that the resulting decrease in model accuracy is within an acceptable range. This prevents the aggregated model parameters from becoming unusable due to a significant decrease in accuracy. In other words, it minimizes the decrease in model accuracy caused by privacy protection at each client node, preventing excessive impact on the accuracy of federated learning and guaranteeing the usability of the aggregated model parameters.

[0016] Optionally, any two client nodes may have different privacy protection processing factors due to the different privacy protection budget information they support, thereby ensuring the rationality of the privacy protection processing factor for each client node.

[0017] In one possible design, the privacy protection processing type information indicates a first processing method, which is a noise-adding method; the privacy protection processing factor indicates that when the first processing method is applied to the local model parameters in each of the K rounds, a noise distribution parameter is added to the model parameters.

[0018] With this design, the first client node can add noise to the trained local model parameters according to the noise distribution parameters indicated by the privacy protection processing factor, thereby obtaining privacy model parameters and realizing privacy protection processing of the local model parameters.

[0019] Optionally, the first processing method includes one of the following noise addition methods: differential privacy noise addition based on Gaussian mechanism, and differential privacy noise addition based on Laplace mechanism.

[0020] Optionally, the noise distribution parameters include one of the following: differential privacy budget information corresponding to each of the K rounds, and noise distribution parameters corresponding to each of the K rounds.

[0021] In one possible design, the privacy-preserving processing type information indicates a second processing method, which is a gradient compression method; the privacy-preserving processing factor indicates the threshold, compression factor, or Top-k value used when performing the second processing method on the local model parameters in each of the K rounds.

[0022] Through this design, the first client node can select a portion of model parameters (or model gradients) from the trained local model parameters as privacy-preserving model parameters based on a threshold, compression factor, or Top-k value indicated by the privacy protection processing factor, thereby achieving privacy protection processing of the local model parameters. Specifically, the threshold indicates the minimum difference between the model gradients of the local model parameters in the current round and the previous round; the compression factor indicates the number of model gradients selected from the local model parameters; and the Top-k value indicates the proportion of model gradients selected from the local model parameters. Based on this, the second processing method includes a gradient compression processing method based on the Top-K threshold method.

[0023] In one possible design, the server node receives a federated learning service request message; wherein the federated learning service request message includes privacy protection information, which instructs the client nodes executing the federated learning task to perform privacy protection processing on their local model parameters, and the server node can then determine N client nodes to execute the federated learning task based on the privacy protection information.

[0024] This design ensures that all N client nodes are capable of performing privacy protection processing on local model parameters; or, in other words, all N client nodes are capable of performing federated learning tasks.

[0025] In one possible design, the federated service request message also includes information on the range of model accuracy degradation; ensuring that the N client nodes performing the federated learning task not only have privacy protection processing capabilities, but also that the degree of model accuracy degradation caused by each client node performing privacy protection processing meets the model accuracy degradation range information required by the federated learning task.

[0026] In this design, the model accuracy degradation range information in the federated service request message indicates the allowable range of model accuracy degradation during the federated learning task, ensuring that the degree of model accuracy degradation caused by the privacy protection processing performed by N client nodes meets the requirements of the federated learning task, thereby ensuring the availability of the local models participating in model aggregation.

[0027] In one possible design, the server node obtains the configuration information of client nodes that meet a first condition by sending a first request message. The first condition includes at least the ability to perform privacy protection processing and information on the range of model accuracy degradation caused by performing privacy protection processing, which satisfies the requirements of the federated learning task. Based on this, the server node receives the configuration information of N client nodes that meet the first condition.

[0028] In this design, the server node can receive configuration information from N client nodes that meet the first condition through either of the following two methods:

[0029] In the first method, the server node can send a first request message to the first device; wherein the first device is used to store the configuration information of the client nodes, and then the server node receives the configuration information of N client nodes that meet the first condition from the first device; wherein the configuration information corresponding to the N client nodes includes privacy protection processing capability information.

[0030] In the second method, the server node can send a first request message to at least two client nodes respectively, so as to receive configuration information from N client nodes that meet the first condition among the at least two client nodes.

[0031] Optionally, the first request message may also include one or more of the following information:

[0032] Privacy protection processing type information, which indicates the privacy protection processing method required by the federated learning task;

[0033] The threshold for the proportion of user privacy features indicates the minimum proportion of privacy data in the training data used by the client node performing the federated learning task.

[0034] A threshold for dataset size, which indicates the minimum amount of training data used by the client nodes performing the federated learning task;

[0035] A threshold for model training time, which indicates the maximum value of the model training time for each round of the client node performing the federated learning task;

[0036] A threshold for privacy protection processing time, which indicates the maximum value of the privacy protection processing time for each round of the client node performing the federated learning task.

[0037] In this design, the first client node among the N client nodes, in addition to having privacy-preserving processing capabilities and information on the model accuracy degradation range required by the federated learning task, also satisfies one or more of the following conditions in its configuration information:

[0038] The privacy protection processing type information of the first client node satisfies the privacy protection processing type information of the federated learning task;

[0039] The proportion of user privacy features of the first client node is greater than or equal to the threshold of the proportion of user privacy features;

[0040] The dataset size of the first client node is greater than or equal to the threshold of the dataset size;

[0041] The model training time of the first client node is less than or equal to the threshold of the model training time;

[0042] The privacy protection processing time of the first client node is less than or equal to the threshold of the privacy protection processing time;

[0043] In this way, the server node can select the best client node to perform the federated learning task.

[0044] In one possible design, the federated learning configuration information also includes the learning rounds of the federated learning task; these learning rounds are determined by the server node based on the model training time required by the federated learning task, and the model training time and privacy protection processing time of each of the N client nodes.

[0045] In this design, the model training time and privacy protection processing time for each client node may differ due to factors such as the amount of training data and hardware processing performance. Therefore, the server node can group N client nodes into a single group, calculate the sum of the model training time and privacy protection processing time for each client node, and then determine the learning epoch for this group of client nodes based on the maximum sum of the N sums and the model training time required by the federated learning task. In other words, the learning epochs for all N client nodes are the same.

[0046] Optionally, the server node can group the N client nodes based on the model training time and privacy protection processing time corresponding to the N client nodes, determining at least two groups of client nodes. Then, for any group of client nodes, the server node determines the learning epoch for this group of client nodes based on the model training time required by the federated learning task and the model training time and privacy protection processing time corresponding to each client node in this group. That is, the learning epochs of this group of client nodes are the same, but the learning epochs of client nodes in different groups are different. In the scenario of at least two groups of client nodes, the server node can define the association relationship between the learning epochs of different groups of client nodes. This association relationship indicates when at least two groups of client nodes jointly participate in the model parameter aggregation operation. For example, the server node defines that the first group of client nodes jointly participates in the model parameter aggregation operation in epoch 2n and epoch n. Based on this, server-side nodes can perform more rounds of model training for client nodes with shorter model training and privacy protection processing times, and fewer rounds of model training for client nodes with longer model training and privacy protection processing times. This reduces the model training waiting time for client nodes with shorter model training and privacy protection processing times, enabling flexible instruction to client nodes to execute federated learning tasks and improving the efficiency of client nodes in executing federated learning tasks.

[0047] In one possible design, after receiving privacy model parameters from M of the N client nodes, the server node aggregates the privacy model parameters corresponding to the M client nodes to obtain model aggregate parameters for the next round of model training; then, it subtracts a first error from the model aggregate parameters to obtain model aggregate parameters after subtracting the first error; finally, it sends the model aggregate parameters after subtracting the first error to the M client nodes or the N client nodes respectively.

[0048] By addressing the first error in this design, the difference between the non-realistic model aggregation parameters and the real model aggregation parameters is reduced, increasing the availability of the non-realistic model aggregation parameters. This reduces the degree of model accuracy decline in the next round of model training for client nodes, ensuring the availability of the model parameters after model aggregation.

[0049] Optionally, the first error is determined based on the weights of the M client nodes and the noise estimates of the M client nodes. The noise estimate of the first client node among the M client nodes is determined by the server node based on the privacy-preserving budget information required by the federated learning task. In other words, the first error can be determined based on the privacy-preserving processing factor corresponding to each client node. For example, if the parameters used by each client node when performing privacy-preserving processing are selected based on a Gaussian distribution interval, then the first error can be the expectation of the Gaussian distribution interval. Based on this, the server node, based on the noise-adding method of the client nodes, uses the first error to denoise the non-realistic model aggregation parameters, thereby further reducing the difference between the non-realistic model aggregation parameters and the real model aggregation parameters.

[0050] In one possible design, after receiving privacy model parameters from M of the N client nodes, the server node aggregates the privacy model parameters corresponding to the M client nodes (or performs model aggregation based on the privacy model parameters corresponding to the M client nodes) to obtain the model aggregation parameters for the next round; then, it sends the model aggregation parameters to the M client nodes or the N client nodes respectively; where M is an integer less than or equal to N.

[0051] This design allows the server node to aggregate the non-real local model parameters (i.e., privacy model parameters corresponding to the client nodes) corresponding to the M client nodes, thereby obtaining aggregated non-real model parameters. These aggregated parameters are then sent to the client nodes. Based on this, even if a client node with malicious intent receives the aggregated non-real model parameters from the server node, it will be unable to deduce the local data of other client nodes, thus preventing the leakage of local data from other client nodes and ensuring the privacy and security of local data.

[0052] In one possible design, after receiving privacy model parameters from M of the N client nodes, the server node aggregates the privacy model parameters corresponding to the M client nodes to obtain the model aggregation parameters for the next round; then, it performs privacy protection processing on the model aggregation parameters to obtain privacy-protected model aggregation parameters; finally, it sends the privacy-protected model aggregation parameters to the M client nodes or the N client nodes respectively.

[0053] This design, by protecting the privacy of non-real model aggregation parameters, further increases the difference between non-real and real model aggregation parameters, thus further preventing client nodes or server nodes with malicious behavior from extracting local data from other client nodes.

[0054] In one possible design, the server node aggregates the privacy model parameters corresponding to the M client nodes based on the privacy model parameters corresponding to the M client nodes and the weights of the M client nodes.

[0055] In one possible design, the server node determines H client nodes from the M client nodes, and then aggregates the privacy model parameters corresponding to the H client nodes according to the privacy model parameters and weights of the H client nodes to obtain model aggregation parameters; wherein, the model accuracy degradation of any client node among the H client nodes is less than or equal to the model accuracy degradation threshold, and H is a positive integer less than or equal to M.

[0056] In this design, client nodes with smaller model accuracy degradation are selected for model aggregation. This reduces the difference between the non-real model aggregation parameters and the real model aggregation parameters, increases the availability of the non-real model aggregation parameters, and reduces the degree of model accuracy degradation of client nodes in the next round of model training.

[0057] In one possible design, the server node receives model accuracy information from the M client nodes, and then determines H client nodes from the M client nodes whose model accuracy degradation is less than or equal to the model accuracy degradation threshold; wherein, the model accuracy information indicates the degree of model accuracy degradation caused by the client node performing privacy protection processing on the trained local model parameters.

[0058] In one possible design, the server node receives data difference information from the N client nodes, and then determines the weights of the N client nodes based on the data difference information corresponding to the N client nodes; wherein, the data difference information indicates the degree of difference between the training data in the client nodes and the training data corresponding to the initial model parameters of the federated learning; the data difference information is positively correlated with the weights, and the sum of the weights of the N client nodes is 1.

[0059] This design assigns greater weight to client nodes whose training data is similar to the initial model parameters of federated learning. This allows the privacy-preserving model parameters of these similar client nodes to have a greater impact on the aggregated model parameters during model aggregation, thereby improving the adaptability of the aggregated model parameters to the federated learning task.

[0060] Secondly, this application proposes a federated learning method, which is applied to client nodes in a federated learning system. The following description focuses on the first client node among at least two client nodes in the federated learning system as the executing entity. The method includes:

[0061] The first client node receives a first model training message from the server node; then trains the model according to the initial model parameters of the federated learning and the federated learning configuration information in the first model training message to obtain local model parameters; then performs privacy protection processing on the local model parameters according to the privacy protection configuration information in the first model training message to obtain privacy model parameters; and then sends the privacy model parameters to the server node.

[0062] In one possible design, the privacy protection configuration information includes privacy protection processing type information and privacy protection processing factor corresponding to the first client node; wherein, the privacy protection processing type information indicates the privacy protection processing method that the first client node needs to use, and the privacy protection processing factor indicates the parameters used by the first client node when performing privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information; based on this, the first client node can perform privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information and the parameters indicated by the privacy protection processing factor.

[0063] In one possible design, when the privacy protection processing type information indicates a first processing method, the first client node adds noise for the current round to the local model parameters based on the noise addition method corresponding to the first processing method and the noise distribution parameters of the current round indicated by the privacy protection processing factor.

[0064] In one possible design, when the privacy protection processing type information indicates a second processing method, the first client node performs gradient compression on the local model parameters based on the gradient compression method corresponding to the second processing method, according to the threshold, compression factor, or Top-k value of the current round indicated by the privacy protection processing factor.

[0065] In one possible design, the first client node sends model accuracy information to the server node, and uses the model accuracy information to notify the server node of the degree of model accuracy degradation caused by the first client node performing privacy protection processing on the local model parameters.

[0066] In one possible design, if the first client node receives a first request message from the server node, it then sends its own configuration information back to the server node.

[0067] Optionally, the configuration information of the first client node includes one or more of the following:

[0068] The privacy protection processing type information of the first client node indicates the privacy protection processing methods supported by the first client node for local model parameters;

[0069] The privacy protection budget information of the first client node; indicating the degree of model accuracy degradation caused by the first client node performing privacy protection processing on local model parameters;

[0070] The user privacy feature ratio of the first client node indicates the proportion of privacy data in the training data used by the first client node to perform the federated learning task;

[0071] The dataset size of the first client node indicates the amount of training data used by the first client node to perform the federated learning task;

[0072] The model training duration of the first client node indicates the model training duration for each round of the federated learning task performed by the first client node.

[0073] The privacy protection processing duration of the first client node indicates the duration of privacy protection processing for each round in the federated learning task.

[0074] In one possible design, the first client node registers its own configuration information with the first device so that the server node can obtain the configuration information of the first client node from the first device.

[0075] Optionally, the configuration information of the first client node includes one or more of the following:

[0076] The privacy protection processing type information of the first client node indicates the privacy protection processing methods supported by the first client node for local model parameters;

[0077] The privacy protection budget information of the first client node indicates the degree of model accuracy degradation caused by the first client node performing privacy protection processing on local model parameters;

[0078] The user privacy feature ratio of the first client node indicates the proportion of privacy data in the training data used by the first client node to perform the federated learning task;

[0079] The dataset size of the first client node indicates the amount of training data used by the first client node to perform the federated learning task;

[0080] The model training duration of the first client node indicates the model training duration for each round of the federated learning task performed by the first client node.

[0081] The privacy protection processing duration of the first client node indicates the duration of privacy protection processing for each round in the federated learning task.

[0082] Thirdly, this application provides a federated learning apparatus, including units for performing the steps in the first or second aspect described above. Optionally, the federated learning apparatus may include a communication unit and a processing unit; the communication unit is used to receive and transmit data, and the processing unit is used to perform the methods provided in the first or second aspect described above.

[0083] Fourthly, embodiments of this application provide a federated learning system, including: a server node for performing the first aspect described above and a first client node for performing the second aspect described above.

[0084] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the method described in any one of the first or second aspects above.

[0085] In a sixth aspect, embodiments of this application provide a computer program product that, when run on a computer, causes the computer to perform the method described in any one of the first or second aspects above.

[0086] In a seventh aspect, embodiments of this application provide a chip, the chip including a processor and a data interface, the processor reading instructions stored in a memory through the data interface to execute the method described in any one of the first or second aspects above.

[0087] In one possible design, the chip may further include a memory storing instructions, and the processor is configured to execute the instructions stored in the memory. When the instructions are executed, the processor is configured to perform the method described in any one of the first or second aspects above.

[0088] Based on the implementations provided in the above aspects, the embodiments of this application can be further combined to provide more implementations.

[0089] The technical effects that can be achieved in any of the third to seventh aspects mentioned above can be referred to the descriptions of the technical effects that can be achieved in the first and / or second aspects mentioned above, and the repetitions will not be discussed. Attached Figure Description

[0090] Figure 1 is a schematic diagram of a federated learning scenario applicable to an embodiment of this application;

[0091] Figure 2 is a schematic diagram of a general process of federated learning applicable to an embodiment of this application;

[0092] Figures 3A-3C are schematic diagrams of the system architecture applicable to the embodiments of this application;

[0093] Figure 4 is a flowchart of a method for determining client nodes that perform federated learning tasks according to an embodiment of this application;

[0094] Figure 5 is a flowchart of another method for determining the client node that performs the federated learning task provided in an embodiment of this application;

[0095] Figure 6 is a flowchart illustrating a federated learning method provided in an embodiment of this application;

[0096] Figure 7 is a flowchart illustrating a federated learning method provided in an embodiment of this application;

[0097] Figure 8 is a flowchart illustrating a federated learning method provided in an embodiment of this application;

[0098] Figure 9 is a flowchart illustrating a federated learning method provided in an embodiment of this application;

[0099] Figure 10 is a structural diagram of a federated learning device provided in an embodiment of this application;

[0100] Figure 11 is a structural diagram of a federated learning device provided in an embodiment of this application. Detailed Implementation

[0101] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The terminology used in the following embodiments is for the purpose of describing specific embodiments only and is not intended to be a limitation of this application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "the," "the," "this," and "an" are intended to include expressions such as "one or more," unless the context clearly indicates otherwise. It should also be understood that in the embodiments of this application, "one or more" refers to one, two, or more; "and / or" describes the relationship between related objects, indicating that three relationships may exist; for example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0102] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0103] The "multiple" mentioned in the embodiments of this application refers to two or more. It should be noted that in the description of the embodiments of this application, terms such as "first" and "second" are used only for the purpose of distinguishing descriptions and should not be construed as indicating or implying relative importance, nor should they be construed as indicating or implying order.

[0104] To facilitate understanding, we will first illustrate the scenario and process of federated learning with reference to Figures 1 and 2.

[0105] Referring to Figure 1, federated learning involves a server node 110 and at least two client nodes, 120a, 120b, and 120c, as examples in Figure 1. The client nodes (120a, 120b, 120c), as participants in federated learning, use their own local datasets as training data (or training samples) to train a local model, obtain local model parameters, and then send the trained local model parameters to the server node 110.

[0106] Server node 110 acts as the aggregator or coordinator in federated learning, and is used to aggregate the model parameters of client nodes (120a, 120b, 120c). This can also be understood as performing model aggregation on the local models corresponding to client nodes (120a, 120b, 120c) based on the model parameters of client nodes (120a, 120b, 120c). Therefore, the process of parameter aggregation by server node 110 can also be called model aggregation.

[0107] In some scenarios, server-side nodes and client-side nodes possess Model Training Logical Function (MTLF). Therefore, server-side nodes can also be referred to as central MTLFs, and client-side nodes as local MTLFs. Optionally, in the federated learning framework under the 3rd Generation Partnership Project (3GPP), the Network Data Analytics Function (NWDAF) supporting federated learning includes both central MTLF and local MTLF. Therefore, server-side nodes can also be referred to as server NWDAFs, and client-side nodes as client NWDAFs.

[0108] In this embodiment of the application, the model parameters obtained after training the client node are called local model parameters or local model parameters; the model parameters obtained after aggregating the model on the server node are called model aggregation parameters or global model parameters.

[0109] Based on the architecture shown in Figure 1, the server node can be a Server NWDAF, and the client node can be a Client NWDAF. Figure 2 illustrates a federated learning method. The general process of federated learning is described below with reference to Figure 2. In this process, the Network Function (NF) acts as a consumer initiating a federated learning service request, triggering the federated learning process. This NF can be called the consumer NF.

[0110] S201: The consumer NF sends a federated learning service request to the server node (Server NWDAF).

[0111] A federated learning service request is used to indicate the federated learning task that needs to be performed. The type of federated learning task can be horizontal federated learning, vertical federated learning, or federated transfer learning.

[0112] S202: The server node sends the initial model parameters for federated learning to the client nodes (Client NWDAFs) participating in model training. Based on the architecture shown in Figure 1, there can be multiple Client NWDAFs participating in model training.

[0113] The initial model parameters for federated learning can be preset values ​​based on experience, or obtained by the server node through model training on training data. In one possible implementation, the training data used by the server node can be preset or obtained based on a federated learning service request. The federated learning model used by the server node can be a general machine learning model or a specific machine learning model built according to the requirements of the federated learning service request. Taking image recognition tasks as an example, the federated learning model can be a convolutional neural network (CNN) model. For ease of understanding and distinction, the federated learning model used by the server node can be called the global model.

[0114] S203: The client node receives the initial model parameters for federated learning from the server node, trains the model based on the initial model parameters, and obtains the local model parameters.

[0115] The federated learning model used by the client node can be the same as the federated learning model used by the server node, or the federated learning model used by the client node can be a subset of the federated learning model used by the server node. Based on this, the federated learning model used by the client node can be called a local model or a partial model.

[0116] S204: The client node sends local model parameters to the server node.

[0117] S205: The server node receives the corresponding local model parameters from the client node, performs model aggregation based on the local model parameters of at least two client nodes, and obtains the model aggregation parameters.

[0118] S206: The server node sends the federated learning status information to the consumer NF. This status information includes the current iteration round of the federated learning process and the model aggregation parameters.

[0119] S207: The server node sends the model aggregation parameters to the client node so that the client node can perform the next round of iterative training based on the model aggregation parameters.

[0120] S208: The client node and the server node complete one round of training until the federated learning ends. Each round of training can be referenced from S203 to S207. The end of federated learning can be indicated by the consumer's NF, the convergence of the local model on the client node, or the convergence of the global model on the server node.

[0121] In the aforementioned federated learning process, client nodes and server nodes directly interact with local model parameters and model aggregation parameters. In other words, the server node receives local model parameters from client nodes, and each client node receives the same model aggregation parameters from the server node. Based on this, an attacking node within the server node or any of the client nodes can deduce the local data of other client nodes according to the following attack flow. Therefore, the aforementioned federated learning process carries the risk of local data leakage from client nodes, failing to guarantee the privacy and security of users' local data.

[0122] Taking the server-side node as an example of an attacker, since the server-side node's model is a global model, it can also possess the local model corresponding to the client node. The server-side node sends the model aggregation parameters W1 corresponding to the global model to the client node, and then receives the local model parameters W2 obtained by the client node through local model training based on the model aggregation parameters W1. Based on this, the server-side node can initialize a pair of input samples x` (or training samples) and their corresponding labels y`, and then input the input samples x` and labels y` into the client node's local model (at this time, the parameters of the local model are the model aggregation parameters W1), and perform model training to obtain the trained model parameters W3. Then, the server-side node calculates the distance (or similarity) between the model parameters W3 and the local model parameters W2. It can be understood that the greater the distance (or similarity), the closer the input samples x` and labels y` are to the client node's local data (training data). Therefore, the server node can determine the input sample x` and label y` corresponding to the condition that the distance between model parameter W3 and local model parameter W2 meets the preset condition, and then use the input sample x` and label y` at this time as the local data of the client node. In other words, the input sample x` and label y` at this time are equivalent to similar data of the local data of the client node, which is equivalent to deriving the local data of the client node.

[0123] Similarly, taking the client node as an example of the attacker, for ease of understanding, the client node executing the attack process is called the attacking client node. The attack process includes: the attacking client node initializes a pair of input samples x` (or training samples) and their corresponding labels y`. Then, the attacking client node receives the model aggregation parameters W4 from the server node, and then inputs the input samples x` and labels y` into its own local model (at this time, the parameters of the local model are the model aggregation parameters W4) for model training, obtaining the local model parameters W5. The attacking client node can receive the model aggregation parameters W6 corresponding to the next iteration from the server node, and thus the attacking client node can calculate the distance between its own trained local model parameters W5 and model aggregation parameters W6. It can be understood that the smaller the distance between the local model parameters W5 and model aggregation parameters W6, the closer the input samples x` and labels y` are to the local data of other client nodes. The attacker adjusts the input sample x` and label y` to determine the input sample x` and label y` corresponding to the condition that the distance between the local model parameters W5 and the model aggregation parameters W6 obtained through their own training satisfies a preset condition. They then use this input sample x` and label y` as the local data of other client nodes. In other words, the input sample x` and label y` at this point are equivalent to similar data to the local data of other client nodes, thus effectively deriving the local data of other client nodes. One possible implementation is that the input sample x` can be the normalized 16-beam RSRP (Reference Signal Receiving Power).

[0124] To address the aforementioned issues, this application provides a federated learning method to prevent server-side or client-side nodes acting as attackers from deducing the local data of other client-side nodes, thereby avoiding the leakage of local data of other client-side nodes and protecting the privacy and security of users' local data. It is understood that the method and apparatus are based on the same technical concept. Since the principles underlying the problems solved by the method and apparatus are similar, the implementation of the apparatus and method can refer to each other, and repeated details will not be elaborated further.

[0125] This method can be applied to federated learning systems that include a server node and at least two client nodes. Before providing a detailed explanation of the embodiments of this application, the system architecture involved in the embodiments of this application will be introduced first.

[0126] In one possible implementation, referring to Figure 3A, this embodiment of the application can be applied to a federated learning system architecture under the 3GPP core network domain. In this scenario, federated learning is implemented by multiple NWDAF nodes. NWDAF nodes can be core network elements, or in other words, NWDAF functionality is deployed on core network elements. The core network element acting as the server node is called the Server NWDAF, and the core network element acting as the client node is called the Client NWDAF.

[0127] In one possible implementation, referring to Figure 3B, this embodiment of the application can be applied to a federated learning system architecture under a 3GPP access network domain. In this scenario, the server node can be an element management system (EMS) with a Machine Learning Training Function (MLTF), referred to as Server EMS. The client node can be a base station, or a Radio Access Network Model Training Logic Function (RTLF) within the base station, referred to as Client RTLF or Client gNB.

[0128] In one possible implementation, referring to Figure 3C, this embodiment of the application can be applied to a federated learning system architecture under another access network domain of 3GPP. In this scenario, both the server node and the client node can be a base station or an RTLF within a base station. The server node is called a Server RTLF or Server gNB, and the client node is called a Client RTLF or Client gNB. Federated learning is achieved through the Server RTLF and Client RTLF.

[0129] In the federated learning system architecture shown in Figures 3A, 3B, and 3C, the server-side nodes have the ability to aggregate models in federated learning, used to aggregate the local model parameters of the client nodes, or in other words, for model aggregation, thereby obtaining aggregated model parameters. The client-side nodes have the ability to participate in federated learning, used to train local models based on local data, obtaining local model parameters. It should be noted that the types of federated learning in this embodiment include, but are not limited to, horizontal federated learning, vertical federated learning, or federated transfer learning. It should be understood that the number of client-side nodes shown in Figures 3A, 3B, and 3C is merely illustrative, and the number of client-side nodes is not limited here.

[0130] In this embodiment of the application, the client node has corresponding configuration information, which may include one or more of the following:

[0131] Privacy protection processing information is used to indicate whether a client node has privacy protection processing capabilities, or in other words, whether a client node supports privacy protection processing of local model parameters. For example, the privacy protection processing information can be indicative information; a value of 1 indicates that the client node has privacy protection processing capabilities, while a value of 0 indicates that the client node does not have privacy protection processing capabilities.

[0132] Privacy protection processing type information indicates the privacy protection processing methods supported by the client node for local model parameters. For example, the privacy protection processing methods for local model parameters include a first processing method and / or a second processing method; wherein, the first processing method can be a noise addition method, such as differential privacy noise addition based on Gaussian mechanisms, differential privacy noise addition based on Laplacian mechanisms, etc.; the second processing method can be a gradient compression method, including gradient compression based on Top-K thresholding methods, etc. This application does not limit the privacy protection processing methods supported by the client node.

[0133] Privacy budget information indicates the degree of model accuracy degradation caused by privacy protection processing performed by the client node, or in other words, the degree to which the client node's privacy protection processing protects the local model parameters. For example, based on the first processing method, the privacy budget information of the client node can be the range of values ​​for the differential privacy budget ε in the differential privacy rules allowed by the client node; based on the second processing method, the privacy budget of the client node can be the range of values ​​for the threshold, Top-K values, or compression factors allowed by the client node. It can be understood that the smaller the differential privacy budget ε, or the larger the threshold in the Top-K thresholding method, or the smaller the Top-K value, or the smaller the compression factor, the greater the degree of model accuracy degradation caused by the client node's privacy protection processing, or in other words, the higher the degree of protection of the local model parameters by the client node's privacy protection processing.

[0134] User privacy feature ratio indicates the proportion of privacy data in the training data used by client nodes to perform federated learning tasks.

[0135] Dataset size, used to indicate the amount of training data used by client nodes to perform federated learning tasks.

[0136] Model training duration indicates the training time for each round of the federated learning task performed by the client node. This training duration is related to the hardware capabilities of the client node, the size of the local dataset on the client node, and other factors.

[0137] The privacy protection processing duration is used to instruct the client node on the duration of privacy protection processing for each round of the federated learning task. This privacy protection processing duration is related to the client node's hardware capabilities and the privacy protection processing methods supported by the client node.

[0138] The hardware capabilities of the client node are used to indicate its performance in performing federated learning tasks. For example, the hardware capabilities of the client node may include CPU processing power, memory size, etc.

[0139] The Analytics ID, an identifier for the model analysis use cases of a client node, indicates the local model use cases (or local models) supported by the client node. For example, the Analytics ID of a client node indicates that the local model use cases supported by the client node include business experience analysis, end-user behavior analysis, and terminal mobile analysis.

[0140] The service area of ​​a client node indicates the coverage of its local model. For example, the service area of ​​a client node might be the cell ID.

[0141] The client node's federated learning type indicates the types of federated learning supported by the client node. For example, the client node supports federated learning types such as horizontal federated learning, vertical federated learning, and / or federated transfer learning.

[0142] In one possible implementation, the above configuration information is stored in the client node.

[0143] In another possible implementation, the client node can register its configuration information with a first device. This first device can be a Network Repository Function (NRF), or other functional entity or network element with data storage capabilities. Optionally, the client node sends a registration message to the first device, which includes its configuration information, and the first device then stores this configuration information.

[0144] In this embodiment of the application, before performing federated learning, the server node first selects the client nodes to participate in the federated learning.

[0145] Referring to Figure 4, a method flow for determining a client node to perform a federated learning task according to an embodiment of this application includes:

[0146] S401: The consumer NF sends a federated learning service request message to the server node. The federated learning service request message includes relevant information for performing the federated learning task.

[0147] Optionally, the relevant information for performing the federated learning task may include requirement information corresponding to the federated learning task, indicating the requirements that the federated learning task must meet. The requirement information may include one or more of the following information (1) to (10):

[0148] (1) Privacy protection instructions, which are used to indicate that privacy protection processing is required when performing federated learning tasks.

[0149] Optionally, privacy protection instructions can be used to instruct client nodes performing federated learning tasks to perform privacy protection processing on local model parameters.

[0150] Optionally, the privacy protection instruction information can also be used to instruct the server nodes performing federated learning tasks to perform privacy protection processing on the model aggregation parameters.

[0151] (2) Privacy protection processing type information, which is used to indicate the privacy protection processing required by the federated learning task.

[0152] Optionally, privacy-preserving processing type information can be used to instruct client nodes performing federated learning tasks on how to perform privacy-preserving processing on local model parameters.

[0153] Optionally, the privacy protection processing type information can also be used to instruct the server-side nodes performing federated learning tasks on how to perform privacy protection processing on local model parameters.

[0154] (3) Model accuracy degradation range information, which is used to indicate the range of model accuracy degradation required by the federated learning task. It can be understood as indicating the degree of model accuracy degradation allowed when performing the federated learning task.

[0155] Furthermore, the information on the range of model accuracy degradation can include the threshold corresponding to the privacy protection processing method, indicating the maximum degree of degradation of model accuracy caused by the privacy protection processing required by the federated learning task, or the maximum degree of protection of model parameters caused by the privacy protection processing required by the federated learning task.

[0156] (4) The threshold for the proportion of user privacy features is used to indicate the minimum proportion of privacy data in the training data used by client nodes performing federated learning tasks. Accordingly, the proportion of user privacy features of client nodes participating in federated learning is greater than or equal to this threshold.

[0157] (5) A threshold for dataset size, used to indicate the minimum amount of training data used by client nodes performing the federated learning task. Accordingly, the amount of training data used by client nodes participating in federated learning is greater than or equal to the threshold for dataset size.

[0158] (6) A threshold for model training duration, used to indicate the maximum model training duration for each round of the client node performing the federated learning task. Accordingly, the model training duration for each round of the client node participating in federated learning is less than or equal to the threshold for model training duration.

[0159] (7) A threshold for privacy protection processing time, used to indicate the maximum value of privacy protection processing time for each round of the client node performing the federated learning task. Accordingly, the time for privacy protection processing of local model parameters by the client node participating in federated learning in each round is less than or equal to the threshold for privacy protection processing time.

[0160] (8) The identifier of the model analysis use case of the federated learning task (Analytics ID), which is used to indicate that the client node executing the federated learning task needs to support the Analytics ID of the federated learning task.

[0161] (9) Service area of ​​the federated learning task, which is used to indicate that the service area of ​​the client node executing the federated learning task is within the service area of ​​the federated learning task.

[0162] (10) Federated learning type of the federated learning task, used to indicate the type of federated learning task supported by the client node executing the federated learning task.

[0163] S402: The server node sends a first request message to the first device. This first request message requests information about the client node executing the federated learning task. The client node information may include the client node's identification information, and may also include all or part of the client node's configuration information. In this process, the first device is exemplified as an NRF.

[0164] Optionally, the information may include model training time, privacy protection processing time, privacy protection budget information, etc.

[0165] Optionally, the first request message may include information related to performing the federated learning task. Optionally, the first request message may include one or more of the information (1) to (10) above.

[0166] Optionally, the server node can also send predefined information related to the federated learning task to the first device. For example, the predefined information related to the federated learning task may include indication information of the server node's service area.

[0167] S403: The first device sends a first response message to the server node. The first response message includes information about the N client nodes that are performing the federated learning task.

[0168] Optionally, the information for the N client nodes may include the identification information corresponding to the N client nodes, and may also include all or part of the configuration information corresponding to the N client nodes. Optionally, the partial information may include model training time, privacy protection processing time, privacy protection budget information, etc.

[0169] After receiving the first request message, the first device selects a client node that meets the corresponding requirements indicated by the request information, based on the configuration information of the client nodes stored in the first device.

[0170] For example, a client node that satisfies the corresponding requirement indicated by the demand information meets one or more of the following conditions:

[0171] (a) The client node has privacy protection processing capabilities; for example, the privacy protection processing information of the client node indicates that it has privacy protection processing capabilities.

[0172] (b) The privacy protection processing method performed by the client node supports the privacy protection processing method required by the federated learning task indicated by the first request message.

[0173] (c) The privacy budget information of the client node meets the model accuracy degradation range required by the federated learning task indicated by the first request message; optionally, the degree of model accuracy degradation indicated by the privacy budget information of the client node is less than the maximum value of the model accuracy degradation range indicated by the first request message, or the degree of model accuracy degradation indicated by the privacy budget information of the client node is within the model accuracy degradation range indicated by the first request message. For example, if the model accuracy degradation range indicated in the first request message is 0-5%, then the degree of model accuracy degradation indicated by the privacy budget information of the client node needs to be less than or equal to 5%.

[0174] (d) The proportion of user privacy features in the training data of the client node is greater than or equal to the threshold of the proportion of user privacy features indicated by the first request message.

[0175] (e) The model training time of each round of the client node is less than or equal to the threshold of the model training time indicated by the first request message.

[0176] (f) The duration of privacy protection processing of local model parameters by the client node in each round is less than or equal to the threshold of privacy protection processing duration indicated in the first request message;

[0177] (g) The Analytics ID supported by the client node includes the Analytics ID indicated in the first request message.

[0178] (h) The service area of ​​the client node is within the service area of ​​the federated learning task indicated in the first request message.

[0179] (i) The client node supports the federated learning type of the federated learning task indicated in the first request message.

[0180] It is understood that the client node executing the federated learning task needs to satisfy one or more of the above conditions (a) to (i), which correspond to the relevant information for executing the federated learning task indicated in the first request message. For example, if the first request message includes information (1), (2), (3), and (4), then the client node executing the federated learning task needs to satisfy the above conditions (a), (b), (c), and (d).

[0181] Based on the above description, the first device can identify N client nodes that satisfy the first request message, and then send the configuration information of the N client nodes to the server node.

[0182] Optionally, the process described in Figure 4 can be applied to the system architecture shown in Figure 3A.

[0183] Optionally, the privacy protection processing methods for the N client nodes are the same, so as to facilitate the subsequent aggregation calculations of the server nodes.

[0184] In one possible implementation, referring to Figure 5, another method for determining the client node that performs the federated learning task includes:

[0185] S501: The consumer NF sends a federated learning service request message to the server node. The federated learning service request message includes relevant information for performing the federated learning task.

[0186] For information on performing federated learning tasks in this process, please refer to S401 above, which will not be elaborated upon here.

[0187] S502: The server node sends a first request message to multiple client nodes, which requests information about the client nodes performing the federated learning task. The client node information may include the client node's identification information, and may also include all or part of the client node's configuration information.

[0188] In this process, referring to S402 above, the first request message may include one or more of the information (1) to (10) mentioned above, which will not be elaborated here. The process of multiple client nodes responding to the first request message is described in detail below in S503.

[0189] S503: The client node sends a first response message to the server node, which includes information about the client node.

[0190] For any client node among multiple client nodes, after receiving the first request message, the client node determines, based on its own configuration information, whether it meets the corresponding requirements indicated by the first request message. If the client node determines that its configuration information meets the conditions corresponding to the requirements for executing the federated learning task indicated by the first request message, then it indicates that the client node can execute the federated learning task corresponding to the first request message. Based on this, the client node can send its own information to the server node, thereby indicating that the client node can execute the federated learning task, that is, the client node is the client node executing the federated learning task. Optionally, the client node's own information may include the client node's identification information, and may also include all or part of the information in the client node's configuration information.

[0191] Optionally, the process described in Figure 5 can be applied to the system architecture shown in Figure 3B or Figure 3C.

[0192] Based on the above description, after determining the N client nodes to perform the federated learning task, as shown in Figure 6, the federated learning task is performed by the N client nodes. For ease of description, the principle of the federated learning method in Figure 6 will be introduced below using the first client node among the N client nodes. The processing operations of other client nodes and their interaction with the server node can be referred to the first client node.

[0193] As shown in Figure 6, the process includes:

[0194] S601: The server node sends the first model training message to the first client node. The first model training message includes the initial model parameters for federated learning, federated learning configuration information, and privacy protection configuration information.

[0195] Optionally, the initial model parameters for federated learning in the first model training message can be obtained by the server node after inputting the baseline training data into the global model for model training. The baseline training data can be indicated by the federated learning service request message, or obtained by the server node according to the federated learning task indicated by the federated learning service request message; no limitation is placed on the baseline training data here.

[0196] Optionally, the federated learning configuration information in the first model training message may include the Analytics ID of the federated learning task, the service area of ​​the federated learning task, the federated learning type of the federated learning task, etc.

[0197] In this embodiment, the federated learning configuration information also includes the learning rounds of the federated learning task. These learning rounds are determined by the server node based on the model training time required by the federated learning task, and the model training time and privacy protection processing time for each of the N client nodes.

[0198] In one possible implementation, the server node calculates the sum of the model training time and privacy protection processing time for each of the N client nodes. Then, based on the maximum sum of the N sums and the required model training time for the federated learning task, the learning epochs for the N client nodes are determined. For example, if N=3, including client nodes C1, C2, and C3; and assuming the required model training time for the federated learning task is 10 hours, the sum of the model training time and privacy protection processing time for client node C1 is 0.5 hours, for client node C2 it is 0.3 hours, and for client node C3 it is 1 hour, thus determining the learning epochs for the N client nodes to be 10. It can be understood that in this implementation, the learning epochs for the N client nodes are the same.

[0199] In another possible implementation, the server node can divide the N client nodes into at least two groups. Then, for any group, it calculates the sum of the model training time and privacy protection processing time for each client node in that group. Finally, it determines the learning epochs for that group based on the maximum total time in that group and the model training time required by the federated learning task. In this implementation, the server node can group the N client nodes based on their hardware performance, model training time, and / or privacy protection processing time. For example, the server node can group client nodes C1 and C2 as the first group and client node C3 as the second group. Therefore, the first group of client nodes will have 20 learning epochs, and the second group will have 10. It's important to understand that the learning epochs are the same for the same group of client nodes, but the learning epochs for any two groups may be different.

[0200] In this implementation, to ensure that N client nodes participate in at least one iterative training session during the federated learning process, the server node can define the association between learning rounds of different groups of client nodes. This association indicates the timing when at least two groups of client nodes participate in the federated learning iteration. For example, if the learning rounds of the first group of client nodes are twice that of the second group, the server node can define that the first group of client nodes participates in the federated learning iteration together with the second group of client nodes in the nth learning round. Alternatively, at time 0.5h, the server node performs model aggregation only on the first group of client nodes, achieving federated learning iteration for the first group; at time 1h, it performs model aggregation on both the first and second groups, achieving federated learning iteration for both groups; and so on, at time 1.5h, only the first group of client nodes undergoes federated learning iteration; at time 2h, both groups undergo federated learning iteration; and so on. It is understood that the above example describes the timing of at least two groups of client nodes jointly participating in federated learning iterations based on the learning rounds of the two groups of client nodes. In addition, the server node can also define the timing of at least two groups of client nodes jointly participating in federated learning iterations based on the iteration duration of each round corresponding to the at least two groups of client nodes. No specific limitation is made on the definition method here.

[0201] In the above implementation, the server node can group the N client nodes based on the total model training time and privacy protection processing time of each client node. This distinguishes at least two groups of client nodes with shorter total training times and longer total training times. The specific grouping method for the N client nodes is not limited here. Based on this, the server node can perform more rounds of model training on client nodes with shorter total training times, reducing their model training waiting time and enabling flexible selection of client nodes to perform federated learning tasks, thus improving the efficiency of client nodes in performing federated learning tasks.

[0202] Optionally, the privacy protection configuration information in the first model training message includes privacy protection processing type information and privacy protection processing factor corresponding to the first client node; wherein, the privacy protection processing type information is used to indicate the privacy protection processing method performed by the first client node on the local model parameters; the privacy protection processing factor is used to indicate the parameters used by the first client node when performing privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information.

[0203] In one possible implementation, if the privacy-preserving processing type information indicates a first processing method, then the privacy-preserving processing factor indicates that when the first processing method is applied to the local model parameters in each of the K rounds, a noise distribution parameter is added to the model parameters. For example, the first processing method is a differential privacy noise-adding method based on a Gaussian mechanism, and the privacy-preserving processing factor can be one of the following parameters: the total differential privacy budget ε for the K rounds, and the differential privacy budget ε for each of the K rounds. t The Gaussian distribution interval (μ, σ) for each of the K rounds t 2 ), noise value N; where K rounds represent the learning rounds of the client node, and the differential privacy budget ε for each of the K rounds. t The sum equals the total differential privacy budget ε for K rounds, and the noise value N follows (μ, σ). t 2 ),

[0204] In another possible implementation, if the privacy-preserving processing type information indicates a second processing method, then the privacy-preserving processing factor indicates the threshold, compression factor, or Top-k value used when performing the second processing method on the local model parameters in each of the K rounds. For example, the second processing method is a gradient compression method based on the Top-K thresholding method, and the privacy-preserving processing factor can be one of the following parameters: threshold, Top-K value, or compression factor. Wherein, the threshold represents the threshold of gradient change; the Top-K value represents the number of gradients to be selected; and the compression factor represents the proportion of gradients to be selected. For a detailed implementation of privacy-preserving processing using the privacy-preserving processing factor, please refer to the description in S603 below.

[0205] In this embodiment, since the privacy budget information supported by each of the N client nodes may be different, the server node can determine a corresponding privacy processing factor for each client node. Taking the first client node as an example, assuming that the differential privacy budget ε supported by the first client node is 10, the server node can determine a corresponding differential privacy budget ε of 11 for the first client node, or a differential privacy budget ε for each round in K rounds (e.g., K=10). t The value is 1, or the Gaussian distribution interval (0, 1) for each of the K rounds. Alternatively, the server node determines a uniform privacy protection factor for the N client nodes, meaning that the N client nodes use the same privacy protection factor. For example, the server node uses the average (or maximum, minimum, etc.) value of the privacy protection budget information supported by each of the N client nodes as the privacy protection factor for each client node.

[0206] S602: The first client node trains the model based on the initial model parameters and the federated learning configuration information to obtain the local model parameters.

[0207] In this process, after receiving the first model training message, the first client node uses the federated learning initial model parameters in the first model training message as the model parameters of its local model. Then, it trains the model based on its local data and the federated learning configuration parameters in the first model training message to obtain the local model parameters. In this embodiment, the model parameters can be model gradients or model weights, and the local data includes training data.

[0208] S603: The first client node performs privacy protection processing on the local model parameters according to the privacy protection configuration information to obtain the privacy model parameters.

[0209] In this process, after the first client node trains and obtains the local model parameters, the first client node performs privacy protection processing on the local model parameters according to the privacy protection processing type information indicated in the first model training message and the parameters indicated by the privacy protection processing factor, thereby obtaining the privacy model parameters.

[0210] In one possible implementation, the privacy-preserving processing type information indicates the first processing method. Assuming the first processing method is a differential privacy noise-adding method based on a Gaussian mechanism, the first client node adds noise for the current round to its local model parameters according to the noise distribution parameters of the current round indicated by the privacy-preserving processing factor, thereby obtaining the privacy model parameters. An example is shown in the following formula (1):

[0211] in, Let W be the privacy model parameters for the first client node in round t. t N represents the local model parameters of the first client node in round t. t Let N be the noise value of the first client node in round t. t Obey (μ) t , σ t 2 ), (μ t , σ t 2 Let be the Gaussian distribution interval of the first client node in round t. Based on the above description, it can be understood that t = 1 in this step.

[0212] For example, in round t, the first client node starts from (μ) t , σ t 2Select a number of noise values ​​corresponding to the local model parameters or at least one noise value (e.g., 0.5); then the first client node increases each gradient in the local model parameters by 0.5, thereby obtaining the privacy model parameters corresponding to the local model parameters.

[0213] In another possible implementation, the privacy-preserving processing type information indicates the second processing method. Assuming the second processing method is a gradient compression method based on the Top-K threshold, the first client node performs gradient compression on the local model parameters according to the threshold, compression factor, or Top-k value of the current round indicated by the privacy-preserving processing factor, thereby obtaining the privacy model parameters. An example is shown in the following formula (2):

[0214] in, Let W be the privacy model parameters for the first client node in round t. t Here are the local model parameters for the first client node in round t, where t = 1 in this step; thr represents the threshold, compression factor, or Top-k value for the current round, |W t |>thr represents W t The first client node selects gradients from its local model parameters that are greater than a threshold, or gradients within the range of the compression factor or Top-k value. Alternatively, the first client node sorts the gradients in its local model parameters according to their degree of change, and then selects gradients within the range of the compression factor or Top-k value based on the order of gradient change from largest to smallest. In other words, the first client node selects a subset of gradients from its local model parameters as privacy model parameters based on the threshold, compression factor, or Top-k value of the current round. In this approach, when t=1, the gradient change in round t can be the difference between the gradient in the local model parameters of round t and the initial parameters of the federated learning model. When t>1, the gradient change in round t can be the difference between the gradient in the local model parameters of round t and the gradient in the local model parameters of round t-1; or it can be the difference between the gradient in the local model parameters of round t and the gradients in the local model parameters of previous rounds that were not selected as privacy model parameters.

[0215] For example, in round t, the first client node determines 70% of the gradients from the local model parameters based on a threshold, and then uses these 70% of gradients as the privacy model parameters corresponding to the local model parameters; or the first client node selects the top 100 gradients in terms of gradient change from the local model parameters based on the Top-k value, and then uses these 100 gradients as the privacy model parameters corresponding to the local model parameters; or the first client node selects the top 80% of gradients in terms of gradient change from the local model parameters based on the compression factor, and then uses these 80% of gradients as the privacy model parameters corresponding to the local model parameters.

[0216] S604: The server node receives privacy model parameters from the first client node to continue executing the federated learning task.

[0217] In this process, the server node receives privacy model parameters from the first client node, and then executes the subsequent processes of the federated learning task based on the privacy model parameters.

[0218] In this embodiment, due to differences in hardware performance, communication performance, model training time, and privacy protection processing time among each client node, the server node may not be able to receive privacy model parameters from all N client nodes. It can only receive privacy model parameters from M client nodes out of the N client nodes, and then perform model aggregation based on the privacy model parameters corresponding to the M client nodes, where M is a positive integer less than or equal to N. For example, in S601, if the server node divides the N client nodes into two groups, then when implementing federated learning iteration only for one group, the server node can only receive the privacy model parameters corresponding to that group of client nodes.

[0219] Optionally, after receiving privacy model parameters from M client nodes, the server node can aggregate the privacy model parameters corresponding to the M client nodes to obtain the model aggregation parameters for the next round. Further, the server node can determine the model aggregation parameters based on the privacy model parameters corresponding to the M client nodes and the weights of the M client nodes. An example is shown in the following formula (3):

[0220] Among them, QW t+1 Let QW be the model aggregation parameters for round t+1. t Let P be the model aggregation parameter for round t. i Let be the weight of the i-th client node among the M client nodes. Let be the local model parameters of the i-th client node in round t.

[0221] In one possible implementation, the weight of each client node can be determined by the server node based on the amount of training data from the N client nodes; wherein the weight is positively correlated with the amount of training data, and the sum of the weights of the N client nodes is 1.

[0222] In another possible implementation, the weight of each client node can be determined by the server node based on the data difference information of N client nodes; wherein, the data difference information indicates the degree of difference between the training data of the client node and the training data corresponding to the initial model parameters of the federated learning (or the baseline training data used by the server node), the data difference information is negatively correlated with the weight (or the degree of difference between the training data of the client node and the baseline training data is positively correlated with the weight), and the sum of the weights of the N client nodes is 1. In this implementation, the data difference information of the client node can be represented by parameters such as L1 norm, L2 norm, cosine distance, Hamming distance, etc. The greater the degree of difference between the training data of the client node and the baseline training data, the greater the weight of the client node, indicating that the contribution of the training data of the client node is greater, thereby improving the training efficiency of federated learning. Taking the data difference information as L2 norm as an example, it is exemplarily shown in the following formula (4):

[0223] Among them, P i Let be the weight of the i-th client node out of N client nodes. This represents the data difference information in L2 norm form for the i-th client node among N client nodes.

[0224] Optionally, after receiving the privacy model parameters from the M client nodes, the server node can further determine the model aggregation parameters based on H client nodes among the M client nodes and the weights of the H client nodes; wherein the model accuracy degradation of any client node among the H client nodes is less than or equal to the model accuracy degradation threshold. It is understood that the model accuracy degradation threshold can be set based on the privacy protection budget information of the federated learning task, such as a model accuracy degradation threshold of 5%, and no specific limitation is made here.

[0225] In one possible implementation, the degree of model accuracy degradation (or model accuracy information) of any of the M client nodes can be calculated by the client node and sent to the server node. Taking the first client node as an example, in any round, the first client node's model accuracy is used to calculate the degree of model accuracy degradation of the first client node based on its first model accuracy and second model accuracy. Where q represents the degree of model accuracy degradation of the first client node; q1 is the first model accuracy of the first client node, representing the accuracy of model prediction performed by the first client node using local model parameters; and q2 is the second model accuracy of the first client node, representing the accuracy of model prediction performed by the first client node using privacy model parameters.

[0226] In another possible implementation, after the first client node determines the first model accuracy and the second model accuracy, it sends the first model accuracy and the second model accuracy as model accuracy information to the server node. Then, the server node determines the degree of model accuracy degradation of the first client node based on the first model accuracy and the second model accuracy of the first client node, and then selects H client nodes from M client nodes to perform model aggregation. The specific calculation process is described above and will not be repeated here.

[0227] Based on the above approach, the server-side connection node selects client nodes with a smaller degree of model accuracy degradation to participate in model aggregation. This reduces the difference between the non-realistic model aggregation parameters obtained after model aggregation and the real model aggregation parameters, increases the availability of the non-realistic model aggregation parameters, and reduces the error of client nodes in the next round of model training.

[0228] In this embodiment of the application, after performing model aggregation, the server node obtains model aggregation parameters for implementing the next iteration of federated learning.

[0229] In one possible implementation, the server node subtracts a first error from the model aggregation parameters to obtain the model aggregation parameters after subtracting the first error. Then, the server node sends these subtracted model aggregation parameters to M or N client nodes, enabling the M or N client nodes to perform the next round of federated learning based on these subtracted model aggregation parameters. The first error is determined based on the weights of the M client nodes and their noise estimates. The noise estimate of the first client node among the M client nodes is determined by the server node based on the privacy budget information required by the federated learning task. For example, referring to formula (1) in S603, the noise estimate E of the first client node in round t is... t For (μ) t , σ t 2 The expected value of ), such as E t =μ t .

[0230] In this implementation, by subtracting the first error from the model aggregation parameters, the difference between the non-real model aggregation parameters and the real model aggregation parameters is reduced, thereby increasing the availability of the non-real model aggregation parameters and increasing the accuracy of the client node in the next round of federated learning.

[0231] In one possible implementation, the server node performs privacy protection processing on the model aggregation parameters to obtain privacy-protected model aggregation parameters. These privacy-protected parameters are then sent to M or N client nodes, enabling them to perform the next round of federated learning based on these parameters. The method by which the server node performs privacy protection processing is the same as that used by the client nodes in S603, and will not be elaborated upon here.

[0232] In this implementation, privacy protection processing is applied to non-real model aggregation parameters, further increasing the difference between non-real model aggregation parameters and real model aggregation parameters, thereby further protecting the privacy and security of user data.

[0233] In one possible implementation, the server node directly sends the model aggregation parameters to M or N client nodes, so that the M or N client nodes can perform the next round of federated learning based on the model aggregation parameters (see S602 and S603).

[0234] In this implementation, no processing is performed on the non-realistic model aggregation parameters. Instead, the non-realistic model aggregation parameters are directly sent to M or N client nodes, thereby improving the efficiency of federated learning.

[0235] This method involves the server node performing a federated learning aggregation process based on the privacy model parameters of the client node, resulting in non-realistic model aggregation parameters. This allows for iteration using these non-realistic model parameters during the federated learning process. Therefore, an attacker's server node or client node, based on these non-realistic model parameters, cannot calculate the true difference between the input sample x` and label y` and the client node's actual local data. Consequently, they cannot deduce the local data of other client nodes, thus preventing the leakage of other client node's local data and ensuring the privacy and security of the user's local data.

[0236] To better illustrate the above technical solutions, the federated learning method provided in this application will be further explained below in conjunction with implementation methods 1 to 3.

[0237] Implementation method 1:

[0238] Implementation method 1 is described using the scenario in Figure 3A as an example. See Figure 7. The process includes:

[0239] S701: The server node (Server NWDAF) receives a federated learning service request message, which includes information required to perform the federated learning task. For example, this federated learning service request message is sent by the consumer NF.

[0240] Referring to the description in S401 above, the federated learning service request message includes the conditions that must be met to execute the federated learning task. After responding to the federated learning service request message, the server node first determines whether its own configuration information can meet the conditions. If it can, it executes the subsequent steps; otherwise, it rejects the request.

[0241] Optionally, the configuration information for the server node includes one or more of the following:

[0242] The privacy protection processing type information of the server node is used to indicate the privacy protection processing methods supported by the server node for model aggregation parameters, and can also indicate that the server node has privacy protection processing capabilities.

[0243] The privacy protection budget information of the server node is used to indicate the degree of model accuracy degradation of the global model corresponding to the server node, and can also indicate the degree of protection of the model aggregation parameters by the server node when performing privacy protection processing.

[0244] The Analytics ID is an identifier for the model analysis use cases of the server node, used to indicate the model use cases (or global model use cases) supported by the server node.

[0245] The service area of ​​a server node indicates the coverage of the server node's global model.

[0246] The federated learning type of the server node, used to indicate the types of federated learning supported by the server node.

[0247] Optionally, if the server node has privacy protection capabilities, and the server node's privacy protection capabilities support the privacy protection processing method indicated by the federated learning service request message, then the server node will perform subsequent steps.

[0248] Optionally, if the degree of model accuracy degradation indicated by the privacy budget of the server node meets the range of model accuracy degradation required by the federated learning task, the server node will perform subsequent steps.

[0249] Optionally, if the identifier of the model analysis use case of the server node includes the identifier of the model analysis use case of the federated learning task, and the service area of ​​the server node is within the service area of ​​the federated learning task, then the server node executes the subsequent steps.

[0250] S702: In response to the federated learning service request message, the server node determines the N client nodes (Client NWDAF) to perform the federated learning task through the first device.

[0251] In this process, the Federated Learning Service Request message may include: privacy protection instruction information, privacy protection processing type information (such as indicating that the privacy protection processing method is the first processing method), and model accuracy degradation range information: differential privacy budget ε = 15 (indicating that the model accuracy degradation is 0-5%). Optionally, the Federated Learning Service Request message may also include one or more of the information in (4) to (10) of S401.

[0252] Referring to the process description in S403 of Figure 4 above, the server node sends a first request message to the first device, so that the first device determines N client nodes to perform the federated learning task based on the first request message. The configuration information of the N client nodes meets the corresponding requirements for performing the federated learning task indicated by the federated learning service request message.

[0253] The following example uses the first client node out of N client nodes. In this process, the first client node's configuration information indicates that it has privacy protection processing capabilities; moreover, the privacy protection processing method supported by the first client node is differential privacy noise addition based on Gaussian mechanism; and the privacy protection budget of the first client node is: differential privacy budget ε = 16 (indicating that the model accuracy degradation of the local model is 4%, that is, the model accuracy degradation of the first client node meets the above-mentioned model accuracy degradation range information). Optionally, the other configuration information of the first client node meets the corresponding requirements for executing the federated learning task indicated by the federated learning service request message.

[0254] Optionally, all N client nodes may perform privacy protection processing in the same way to facilitate the aggregation and computation of subsequent federated learning tasks and improve the efficiency of federated learning.

[0255] Optionally, after the server node determines the N client nodes that will perform the federated learning task, it sends a response message to the consumer NF; the response message may include feedback that the federated learning task has been successfully established.

[0256] S703: The server node determines the learning round of the federated learning task and, based on the learning round, determines the noise distribution parameters to be added to the model parameters when the first processing method is executed for the N client nodes.

[0257] In this process, the N client nodes have the same learning rounds, or in other words, in any round, the N client nodes jointly participate in model aggregation.

[0258] Referring to the description of the learning rounds in S601 above, taking the first client node as an example, the server node determines the learning round K of the first client node to be 20, and determines the differential privacy budget ε for the first client node to be 40. Then, based on preset rules (which can be average rules, rules from smallest to largest, etc.), the differential privacy budgets ε1, ε2, ..., ε for each round are determined. t ... ε 10 Taking the current round t as an example, let's assume ε t＝1 The value is 2. Then the server node determines the Gaussian distribution interval for the current round. Finally, the Gaussian distribution interval (0, 0.25) of the current round is used as the noise distribution parameter added to the model parameters when the first client node executes the first processing method.

[0259] S704: The server node sends model training messages to N client nodes respectively. The model training messages include the initial model parameters for federated learning, the federated learning configuration information of the client nodes, and the privacy protection configuration information of the client nodes.

[0260] Taking the first client node as an example, in this process, the federated learning configuration information corresponding to the first client node includes the learning round of the first client node; the privacy protection configuration information of the first client node includes information indicating that the privacy protection processing method is a differential privacy noise addition method based on Gaussian mechanism, and the Gaussian distribution interval (0, 0.25) of the current round. The initial model parameters of federated learning can also be understood as the model parameters used by the first client node in the first round of model training.

[0261] The first model training message of the first client node may also include the baseline data of the server node, so that the first client node can determine the data difference information between the baseline dataset and its own training data. This data difference information is used to determine the weight of the client node.

[0262] S705: The client node trains the model based on the model training message and performs privacy protection processing on the local model parameters obtained from the training.

[0263] Based on S704, taking the first client node as an example, the first client node uses the initial model parameters of federated learning as the model parameters used by the local model in the first round of model training. Then, it obtains its own training data from the network file of the data provider and inputs its own training data into the local model. After the local model converges or training is completed, the trained local model parameters are obtained. In this process, there is a one-to-one correspondence between the client node and the data provider.

[0264] After the first client node determines the local model parameters, it selects at least one noise value N (e.g., 0.1) from (0, 0.25); then the first client node increases each gradient in the local model parameters by 0.1, thereby obtaining the privacy model parameters corresponding to the local model parameters.

[0265] S706: Client node prediction model accuracy information, which indicates the degree of model accuracy degradation caused by privacy protection processing.

[0266] Based on S705, taking the first client node as an example, the first client node uses the local model parameters as the gradient of the local model, then obtains its own prediction samples from its own network file, and then inputs its own prediction samples into the local model to obtain the first model accuracy of 80% corresponding to the local model parameters; similarly, the first client node uses the privacy model parameters after privacy protection processing as the gradient of the local model, and then inputs its own prediction samples into the local model to obtain the second model accuracy of 78% corresponding to the privacy model parameters.

[0267] S707: The client node sends privacy model parameters and model accuracy information.

[0268] Taking the first client node as an example, the first client node sends its corresponding first model accuracy, second model accuracy, and privacy model parameters to the server node.

[0269] Based on S704, the first client node will also send its corresponding data difference information to the server node.

[0270] S708: The server node determines the H client nodes to participate in model aggregation based on the model accuracy information of the client nodes, and performs model aggregation based on the local model parameters of the H client nodes to obtain the model aggregation parameters.

[0271] In this process, because some client nodes among the N client nodes may not have completed model training or other factors, they may not have sent their local model parameters to the server node during the current round of model aggregation (or the current round of reporting, or the current round of learning duration in the federated learning task). Therefore, the server node can only receive the privacy model parameters corresponding to M client nodes out of the N client nodes. Based on this, client nodes that have not sent their local model parameters to the server node during the current round of model aggregation will send a model training progress message to the server node. Upon receiving the model training progress message, the server node can then determine whether the client node should participate in the subsequent federated learning process.

[0272] After receiving the privacy model parameters corresponding to M client nodes, the server node determines H client nodes to participate in model aggregation based on the model accuracy information of the M client nodes. Assuming the model accuracy degradation threshold is 5%, taking the i-th client node among the M client nodes as an example, the degree of model accuracy degradation for the i-th client node is... Therefore, the i-th client node is one of the H client nodes participating in model aggregation.

[0273] Based on S707, the server node can receive data difference information corresponding to M client nodes, and then determine the weights of the M client nodes based on the data difference information, or determine the weights of the H client nodes based on the data difference information of H client nodes. Therefore, after determining the H client nodes, the server node can also determine the weights of the H client nodes, and then perform model aggregation based on the weights of the H client nodes and the privacy model parameters of the H client nodes to obtain the model aggregation parameters (refer to S603 above).

[0274] S709: The server node subtracts the first error from the model aggregate parameters to obtain the model aggregate parameters after subtracting the first error.

[0275] Referring to the description in formula (3) above, in this process, the model aggregation parameters after subtracting the first error are calculated according to the following formula (5):

[0276] in, QW represents the aggregated model parameters after subtracting the first error, used for model training in the (t+1)th round. t+1 Let P be the model aggregation parameter for round t+1. i Let E be the weight of the i-th client node out of H client nodes. iLet E be the expected value of the Gaussian distribution interval corresponding to the i-th client node; in this process, taking the Gaussian distribution interval (0, 0.25) as an example, such as E... i =0.

[0277] S710: The server node sends the next round of model training messages to N client nodes respectively. The next round of model training messages includes model aggregation parameters after subtracting the first error for the next round of model training. The next round of model training messages also includes federated learning configuration information and privacy protection configuration information of the client nodes.

[0278] Taking the first client node as an example, the privacy protection configuration information corresponding to the first client node in this process includes information indicating that the privacy protection processing method is a differential privacy noise addition method based on Gaussian mechanism, and the Gaussian distribution interval for the next round.

[0279] S711: Repeat S705-S710 until the server node determines that the federated learning termination condition is met, and then end the federated learning. The federated learning termination condition includes reaching the model training time required by the federated learning task, or the termination indication message sent by the consumer NF, or the global model convergence of the server node, or the local model convergence of any client node.

[0280] In this process, the server node terminates federated learning according to the termination conditions. Optionally, the server node terminates federated learning when the learning duration reaches the model training duration required by the federated learning task; alternatively, the server node terminates federated learning based on the termination indication message sent by the consumer NF; alternatively, the server node terminates federated learning after global model convergence; alternatively, the server node terminates federated learning after local model convergence. After federated learning ends, the server node sends the model aggregation parameters of the last round of federated learning and the federated learning status to the consumer NF and N client nodes, respectively.

[0281] In implementation method 1, after receiving the model training message, the client node trains the model to obtain the true local model parameters (or actual local model parameters). Then, noise is added to these local model parameters to obtain false local model parameters (or fake local model parameters). This prevents the server node from inferring the client node's training data based on the true local model parameters. Because the privacy protection budget used by the client node for privacy protection processing meets the privacy protection budget required by the federated learning task, the false local model parameters are similar to the true local model parameters, or in other words, the false local model parameters meet the model aggregation requirements of the federated learning task. Therefore, the server node can continue the subsequent federated learning process based on the false local model parameters, while still meeting the requirements of the federated learning task. Since the server node performs model aggregation based on the false local model parameters, the model aggregation parameters obtained by the server node are also fake (or false model aggregation parameters), thus preventing attackers in multiple client nodes from inferring the local data of other client nodes based on the true model aggregation parameters. Therefore, the attacker's server node or client node cannot deduce the local data of other client nodes through false model parameters, thereby preventing the leakage of local data of other client nodes and protecting the privacy and security of users' local data.

[0282] Implementation method 2:

[0283] Implementation method 2 is described using the scenario in Figure 3B as an example. It is based on implementation method 1 and applied to different scenarios. For similarities, please refer to the relevant description in conjunction with Figure 7. It will not be repeated below.

[0284] Implementation method 2 can be applied to the scenario in Figure 3B, as shown in Figure 8. The process includes:

[0285] S801: The server node (Server EMS) receives a federated learning service request message, which includes information required to execute the federated learning task in the first processing mode.

[0286] Referring to the description of S701 above, in this process, the configuration information of the server node itself meets the requirements for executing the federated learning task, and the subsequent steps are executed.

[0287] S802: The server node sends a first request message to at least two client nodes respectively. The first request message includes the federated learning service request message, which is used to instruct the client node executing the federated learning task in the first processing mode to return a response message. The response message includes the configuration information of the client node.

[0288] Referring to the description in S702 above, assuming that the configuration information of any one of the at least two client nodes (taking the first client node as an example in this process) satisfies the federated learning service request message, then at least two client nodes will return response messages. In other words, at least two client nodes are equivalent to N client nodes (Client RTLF) executing the federated learning task.

[0289] S803: The server node determines the learning round of the federated learning task and, based on the learning round, determines the noise distribution parameters to be added to the model parameters when the first processing method is executed for the N client nodes.

[0290] In this process, to improve the efficiency of client nodes in executing federated learning tasks, the server node divides the N client nodes into multiple groups. For ease of description, this process exemplifies dividing the N client nodes into two groups, but the number of groups is not limited. The total training time and privacy protection processing time of any client node in the first group is less than the total training time and privacy protection processing time of any client node in the second group.

[0291] Referring to the description of learning rounds in S601 above, assume that the learning round K1 of the first group of client nodes is 20, and the learning round K2 of the second group of client nodes is 10. Based on this, for any client node in the first group of client nodes (taking the first client node as an example in this process), the server node determines the differential privacy budget ε for the first client node to be 40, and then determines the differential privacy budgets ε1, ε2, ..., ε for each round of the first client node. t ... ε 10 Taking the current round t as an example, let's assume ε t＝1 The value is 2. Then the server node determines the Gaussian distribution interval for the current round. Finally, the Gaussian distribution interval (0, 0.25) of the current round is used as the noise distribution parameter added to the model parameters when the first client node executes the first processing method.

[0292] For any client node in the second group of client nodes (this process uses the second client node as an example), the server node determines a differential privacy budget ε of 50 for the second client node, and then determines the differential privacy budgets ε1, ε2, ..., ε for each round of the second client node. t ... ε 20 Taking the current round t as an example, let's assume ε t＝1 The value is 5. Then the server node determines the Gaussian distribution interval for the current round. Finally, the Gaussian distribution interval (0, 0.04) of the current round is used as the noise distribution parameter added to the model parameters when the second client node executes the first processing method.

[0293] S804: The server node sends model training messages to N client nodes respectively. The model training messages include the initial model parameters for federated learning, the federated learning configuration information of the client nodes, and the privacy protection configuration information for the client nodes to execute the first processing method.

[0294] Based on the above S803, the federated learning configuration information corresponding to the first client node includes the learning round of the first client node; the privacy protection configuration information of the first client node includes information indicating that the privacy protection processing method is a differential privacy noise addition method based on Gaussian mechanism and the Gaussian distribution interval (0, 0.25) of the current round.

[0295] The federated learning configuration information corresponding to the second client node includes the learning round of the second client node; the privacy protection configuration information of the second client node includes information indicating that the privacy protection processing method is a differential privacy noise addition method based on Gaussian mechanism and the Gaussian distribution interval (0, 0.04) of the current round.

[0296] S805: N client nodes train the model according to the model training message, and perform privacy protection processing on the local model parameters obtained from the training in the first processing method.

[0297] Based on S804, the first client node uses the initial model parameters of federated learning as the model parameters used by the local model in the first round of model training. Then, it inputs its own training data into the local model. After the local model converges or training is completed, the trained local model parameters are obtained. After determining its own local model parameters, the first client node selects at least one noise value N1 (e.g., 0.1) from (0, 0.25). Then, the first client node increases each gradient in the local model parameters by 0.1, thereby obtaining the privacy model parameters corresponding to the local model parameters.

[0298] The second client node uses the initial model parameters of federated learning as the model parameters used by the local model in the first round of model training. It then inputs its own training data into this local model. After the local model converges or training is complete, it obtains the second local model parameters after training. After the second client node determines its own second local model parameters, the first client node selects at least one noise value N2 (e.g., 0.02) from (0, 0.04). Then, the second client node increments each gradient in the second local model parameters by 0.02, thereby obtaining the second privacy model parameters corresponding to the second local model parameters.

[0299] S806: N client nodes predict model accuracy information respectively. The model accuracy information represents the degree of model accuracy reduction caused by privacy protection processing in the first processing method.

[0300] Referring to S706, the method for model prediction is the same for any client node in the first group of client nodes and the second group of client nodes, and will not be repeated here.

[0301] S807: N client nodes send privacy model parameters and model accuracy information.

[0302] The first client node sends its corresponding local model parameters (first model precision), privacy model parameters (second model precision), and privacy model parameters to the server node.

[0303] Similarly, the second client node sends its corresponding local model parameters (first model precision, second privacy model precision, and privacy model parameters) to the server node.

[0304] S808: The server node determines the client nodes participating in model aggregation based on the model accuracy information of the client nodes, and performs model aggregation based on the local model parameters of the participating client nodes to obtain model aggregation parameters.

[0305] In this process, since the learning rounds of the first group of client nodes are longer than those of the second group of client nodes, in rounds 1, 3, 5, ... of the first group of client nodes, the server node only determines the client nodes participating in model aggregation from the first group of client nodes, and then performs model aggregation based on the local model parameters of the client nodes participating in model aggregation at this time, so as to obtain the model aggregation parameters used by the first group of client nodes in rounds 2, 4, 6, ...

[0306] In rounds 2, 4, 6, ... of the first group of client nodes (or in rounds 1, 2, 3, ... of the second group of client nodes), the server node determines the client nodes participating in model aggregation from the first group of client nodes and the second group of client nodes (equivalent to N client nodes). Then, it performs model aggregation based on the local model parameters of the client nodes participating in model aggregation at this time, and obtains the model aggregation parameters used by the first group of client nodes in rounds 3, 5, 7, ... or in other words, obtains the model aggregation parameters used by the second group of client nodes in rounds 2, 3, 4, ...

[0307] S809: The server node subtracts the first error from the model aggregation parameters to obtain the model aggregation parameters after subtracting the first error.

[0308] Based on S808 above, in rounds 1, 3, 5, ... of the first group of client nodes, the server node subtracts the first error from the model aggregation parameters used by the first group of client nodes in rounds 2, 4, 6, ... to obtain the model aggregation parameters used by the first group of client nodes in rounds 2, 4, 6, ... after subtracting the first error. The first error at this time is determined based on the expectation of the Gaussian distribution interval corresponding to the first group of client nodes, and the specific implementation is referred to formula (5) above.

[0309] In rounds 2, 4, 6, ... of the first group of client nodes, the server node subtracts the first error from the model aggregation parameters used by the first group of client nodes in rounds 3, 5, 7, ... to obtain the model aggregation parameters used by the first group of client nodes in rounds 3, 5, 7, ... after subtracting the first error. The first error at this point is determined based on the expected value of the Gaussian distribution intervals corresponding to the first and second groups of client nodes.

[0310] S810: The server node sends the next round of model training messages to N client nodes respectively. The next round of model training messages include the model aggregation parameters after subtracting the first error for the next round of model training, the federated learning configuration information of the client nodes, and the privacy protection configuration information of the client nodes.

[0311] Referring to S710, the specific implementation of this step will not be described in detail.

[0312] S811: Repeat S805-S810 until the server node determines that the federated learning termination condition is met, and then end the federated learning. Refer to the federated learning termination condition and process described in S711 above; they will not be repeated here.

[0313] In implementation method 2, while ensuring the privacy and security of users' local data, the server node can group the N client nodes to distinguish at least two groups of client nodes with different total durations. Based on this, the server node can perform more rounds of model training on the first group of client nodes with shorter total durations, reducing the model training waiting time for the first group of client nodes, enabling flexible selection of client nodes to perform federated learning tasks, and improving the efficiency of client nodes in performing federated learning tasks.

[0314] Implementation method 3:

[0315] Implementation method 3 is described using Figure 3C as an example. It is a description of different privacy protection processing methods based on implementation method 2. For similarities, please refer to the relevant descriptions in conjunction with Figure 7 and / or Figure 8. It will not be repeated below.

[0316] Implementation method 3 can be applied to the scenario in Figure 3C, as shown in Figure 9. The process includes:

[0317] S901: The server node (Server RTLF) receives a federated learning service request message, which includes information required to perform the federated learning task in the second processing mode.

[0318] Referring to the description of S701 above, in this process, the Server RTLF's own configuration information meets the requirements for performing the federated learning task, and the subsequent steps are executed.

[0319] S902: The server node sends a first request message to at least two client nodes respectively. The first request message includes the federated learning service request message, which is used to instruct the client node executing the federated learning task in the second processing mode to return a response message. The response message includes the configuration information of the client node.

[0320] Referring to the description of S802 above, it is assumed that at least two client nodes are equivalent to N client nodes (Client RTLF) performing the federated learning task.

[0321] S903: The server node determines the learning round of the federated learning task, and determines the threshold, compression factor or Top-k value used by the N client nodes when executing the second processing method according to the learning round.

[0322] Referring to the description of S802 above, the server node divides the N client nodes into two groups, where the learning rounds K1 of the first group of client nodes are 20 and the learning rounds K2 of the second group of client nodes are 10.

[0323] Referring to the description in S401 above, the server node can determine a corresponding threshold, compression factor, or Top-k value for each client node based on the privacy budget required by the federated learning task; that is, the threshold, compression factor, or Top-k value of any two client nodes is different. Alternatively, the server node can determine a corresponding threshold, compression factor, or Top-k value for each group of client nodes based on the privacy budget required by the federated learning task; that is, the threshold, compression factor, or Top-k value of any two groups of client nodes is different, but the threshold, compression factor, or Top-k value of client nodes within the same group is the same. Alternatively, the server node can determine a uniform threshold, compression factor, or Top-k value for N client nodes based on the privacy budget required by the federated learning task.

[0324] For ease of description, this process uses a uniform threshold, compression factor, or Top-k value as an example. We assume the threshold is 0.01, the compression factor is 80%, or the Top-k value is 100.

[0325] S904: The server node sends model training messages to N client nodes respectively. The model training messages include the initial model parameters for federated learning, the federated learning configuration information of the client nodes, and the privacy protection configuration information for the client nodes to execute the second processing method.

[0326] Based on the above S903, in the first model training message corresponding to the first client node, the federated learning configuration information includes the learning round of the first client node, and the privacy protection configuration information includes a determined threshold (0.01) or compression factor (80%) or Top-k value (100).

[0327] In the training message of the second model corresponding to the second client node, the federated learning configuration information includes the learning round of the second client node, and the privacy protection configuration information includes the determined threshold (0.01) or compression factor (80%) or Top-k value (100).

[0328] S905: N client nodes train the model according to the model training message, and perform privacy protection processing on the local model parameters obtained from the training using the second processing method.

[0329] Based on S904, the first client node trains the model using the initial model parameters from federated learning, the federated learning configuration information, and its own training data, obtaining local model parameters. Then, the first client node determines the degree of change between each gradient in the local model parameters and the gradient corresponding to each gradient in the initial model parameters from federated learning. Gradients with a change greater than 0.01 (i.e., the threshold) in the local model parameters are selected as the privacy model parameters corresponding to the local model parameters. Alternatively, based on the order of change from largest to smallest, 80% (i.e., the compression factor) of the gradients are selected as the privacy model parameters corresponding to the local model parameters. Or, based on the order of change from largest to smallest, the top 100 (i.e., the Top-k values) gradients are selected as the privacy model parameters corresponding to the local model parameters.

[0330] S906: N client nodes predict model accuracy information respectively. The model accuracy information represents the degree of model accuracy reduction caused by privacy protection processing in the second processing method.

[0331] Referring to S706, the method for model prediction is the same for any client node in the first group of client nodes and the second group of client nodes, and will not be repeated here.

[0332] S907: The client node sends privacy model parameters and model accuracy information.

[0333] S908: The server node determines the client nodes participating in model aggregation based on the model accuracy information of the client nodes, and performs model aggregation based on the local model parameters of the participating client nodes to obtain model aggregation parameters.

[0334] Referring to S807 and S808 above, the model aggregation method in this process is the same as the implementation method described in S807 and S808 above, and will not be repeated here.

[0335] S909: The server node sends the next round of model training messages to N client nodes respectively. The next round of model training messages includes model aggregation parameters, federated learning configuration information corresponding to the client nodes, and privacy protection configuration information of the client nodes.

[0336] Referring to S710, the specific implementation of this step will not be described in detail.

[0337] S910: Repeat S905-S909 until the server node determines that the federated learning termination condition is met, and then end the federated learning.

[0338] Referring to the Federated Learning termination clause and the process for terminating Federated Learning described in S711 above, they will not be repeated here.

[0339] In implementation method 3, after receiving the model training message, the client node trains the model to obtain the true local model parameters. Then, based on a threshold, compression factor, or Top-k value, it selects a portion of gradients from the true local model parameters and uses these gradients as the privacy-preserving local model parameters (or privacy model parameters). Since the privacy model parameters are only a portion of the gradients from the true local model parameters, they are incomplete local model parameters, essentially non-true local model parameters. This prevents the server node from inferring the client node's local data based on the true local model parameters. Similarly, the model aggregation parameters obtained by the server node after aggregating the model based on these privacy model parameters are also non-true. This prevents attackers in multiple client nodes from inferring the local data of other client nodes based on the true model aggregation parameters, thereby avoiding the leakage of other client node's local data and ensuring the privacy and security of the user's local data.

[0340] It should be noted that each step in the above embodiments or examples can be executed by the corresponding device, or by components such as modules, chips, processors, or chip systems within that device. The embodiments of this application do not constitute a limitation on these components. The above embodiments are only illustrated by examples of execution by the corresponding device. Furthermore, the specific implementation methods or examples in the above embodiments do not constitute a limitation on the solutions provided by the embodiments of this application.

[0341] Optionally, in the above embodiments, some steps may be selected for implementation, and the order of the steps in the figures may be adjusted. This application does not limit this. It should be understood that performing some of the steps in the figures, adjusting the order of the steps, or combining them in a specific implementation all fall within the protection scope of this application.

[0342] It is understood that, in order to achieve the functions described in the above embodiments, each device involved in the above embodiments includes a hardware structure and / or software module corresponding to perform each function. Those skilled in the art should readily recognize that, based on the units and method steps of the various examples described in conjunction with the embodiments disclosed in this application, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0343] It is understood that the network architecture and application scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. As those skilled in the art will know, with the evolution of network architecture and the emergence of new services, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0344] It should be noted that the "steps" in the embodiments of this application are merely illustrative and are intended to better understand one method of presentation used in the embodiments. They do not constitute a substantial limitation on the execution of the solution of this application. For example, the "step" can also be understood as a "feature". Furthermore, the steps do not constitute any limitation on the execution order of the solution of this application. Any changes to the order of steps, or the merging or splitting of steps made on this basis without affecting the overall solution implementation, resulting in a new technical solution, are also within the scope of disclosure of this application.

[0345] Based on the same technical concept, this application also provides a federated learning device, which can be applied to the federated learning system shown in Figures 3A-3C. The federated learning device is used to implement the methods provided in the above embodiments, and can be applied to the server nodes or client nodes involved in the above embodiments. Referring to Figure 10, the federated learning device 1000 includes a communication unit 1001 and a processing unit 1002.

[0346] The communication unit 1001 is used to receive and send data, and supports the federated learning device 1000 to communicate with other devices.

[0347] The processing unit 1002 is used to control and manage the actions of the federated learning device 1000 and execute the steps performed by the server node or client node in the federated learning method provided in the above embodiments or examples.

[0348] Optionally, the federated learning device 1000 further includes a storage unit for storing the program code and / or data of the federated learning device 1000.

[0349] The communication unit 1001 can be referred to as an input / output unit, transceiver unit, etc., and can be a transceiver or a communication interface; the processing unit 1002 can be a processor. When the federated learning device 1000 is a module (e.g., a chip) in a communication device, the communication unit 1001 can be an input / output interface, input / output circuit, or input / output pins, etc., and can also be referred to as an interface, communication interface, or interface circuit, etc.; the processing unit 1002 can be a processor, processing circuit, or logic circuit, etc.

[0350] In one embodiment, the federated learning device 1000 can be applied to the server node of the embodiment shown in FIG6. The processing unit 1002 is used for:

[0351] Determine the N client nodes that will perform the federated learning task, where N is an integer greater than 1;

[0352] The communication unit 1001 sends a first model training message to a first client node among the N client nodes. The first model training message includes federated learning initial model parameters, federated learning configuration information, and privacy protection configuration information. The federated learning initial model parameters and the federated learning configuration information are used for model training, and the privacy protection configuration information is used for privacy protection processing. The communication unit 1001 receives the privacy model parameters from the first client node. The privacy model parameters are obtained by the first client node based on model training and privacy protection processing.

[0353] Optionally, the privacy protection configuration information includes privacy protection processing type information and privacy protection processing factor; wherein, the privacy protection processing type information indicates the privacy protection processing method used by the first client node, and the privacy protection processing factor indicates the parameters used by the first client node when performing privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information.

[0354] Optionally, the processing unit 1002 is specifically used for:

[0355] Based on the privacy protection budget information supported by each of the N client nodes, the privacy protection processing factor of each of the N client nodes is determined; the privacy protection budget information supported by the first client node among the N client nodes characterizes the degree of model accuracy degradation caused by the first client node performing privacy protection processing.

[0356] Optionally, the privacy protection processing type information indicates a first processing method, which is a noise addition method; the privacy protection processing factor indicates that when the first processing method is applied to the local model parameters in each of the K rounds, a noise distribution parameter is added to the model parameters.

[0357] Optionally, the privacy protection processing type information indicates a second processing method, which is a gradient compression method; the privacy protection processing factor indicates the threshold, compression factor, or Top-k value used when performing the second processing method on the local model parameters in each of the K rounds.

[0358] Optionally, the processing unit 1002 is specifically used for:

[0359] The communication unit 1001 receives a federated learning service request message, which includes privacy protection indication information. The privacy protection indication information indicates that the client nodes executing the federated learning task need to perform privacy protection processing on the local model parameters. Based on the privacy protection indication information, N client nodes are determined to execute the federated learning task. The N client nodes have privacy protection processing capabilities, which are the capabilities to perform privacy protection processing on the local model parameters.

[0360] Optionally, the federated service request message may further include information on the range of model accuracy degradation; the processing unit 1002 is specifically used for:

[0361] Based on the model accuracy degradation range information, N client nodes are determined to perform the federated learning task. The degree of model accuracy degradation caused by the privacy protection processing performed by the N client nodes meets the model accuracy degradation range information required by the federated learning task.

[0362] Optionally, the processing unit 1002 is specifically used for:

[0363] The communication unit 1001 sends a first request message to the first device; the first request message is used to obtain the configuration information of the client node that meets the first condition, the first condition including at least having privacy protection processing capability, and the model accuracy reduction range information that the degree of model accuracy reduction caused by performing privacy protection processing meets the requirements of the federated learning task; the first device is used to store the configuration information of the client node.

[0364] The communication unit 1001 receives a first response message from the first device. The first response message includes configuration information of N client nodes that meet the first condition. The configuration information corresponding to the N client nodes includes privacy protection processing capability information.

[0365] Optionally, the processing unit 1002 is specifically used for:

[0366] The communication unit 1001 sends a first request message to at least two client nodes respectively; and receives a corresponding first response message from N client nodes that meet the first condition, wherein the first response message corresponding to each of the N client nodes includes configuration information corresponding to the client node.

[0367] Optionally, the first request message includes one or more of the following information:

[0368] The privacy protection processing type information indicates the privacy protection processing method required by the federated learning task; the threshold for the proportion of user privacy features indicates the minimum proportion of privacy data in the training data used by the client node executing the federated learning task; the threshold for the dataset size indicates the minimum amount of training data used by the client node executing the federated learning task; the threshold for the model training duration indicates the maximum model training duration for each round of the client node executing the federated learning task; and the threshold for the privacy protection processing duration indicates the maximum privacy protection processing duration for each round of the client node executing the federated learning task.

[0369] Optionally, the processing unit 1002 is further configured to:

[0370] The communication unit 1001 receives privacy model parameters from M client nodes out of the N client nodes, where M is a positive integer less than or equal to N; aggregates the privacy model parameters corresponding to the M client nodes to obtain model aggregation parameters; subtracts a first error from the model aggregation parameters to obtain model aggregation parameters after subtracting the first error; the first error is determined based on the weights of the M client nodes and the noise estimates of the M client nodes, and the noise estimate of the first client node among the M client nodes is determined by the server node based on the privacy protection budget information required by the federated learning task; the communication unit 1001 sends the model aggregation parameters after subtracting the first error to either the M client nodes or the N client nodes respectively.

[0371] Optionally, the processing unit 1002 is specifically used for:

[0372] H client nodes are determined from the M client nodes, where the model accuracy degradation of any of the H client nodes is less than or equal to the model accuracy degradation threshold, and H is a positive integer less than or equal to M; the privacy model parameters corresponding to the H client nodes are aggregated according to the privacy model parameters corresponding to the H client nodes and the weights of the H client nodes.

[0373] Optionally, the processing unit 1002 is specifically used for:

[0374] The communication unit 1001 receives model accuracy information from the M client nodes, the model accuracy information indicating the degree of model accuracy degradation caused by the client nodes performing privacy protection processing on the trained local model parameters; and determines H client nodes from the M client nodes whose model accuracy degradation is less than or equal to the model accuracy degradation threshold.

[0375] In one implementation, the federated learning device 1000 can be applied to the first client node in the embodiment shown in FIG6. The processing unit 1002 is used for:

[0376] The communication unit 1001 receives a first model training message from the server node; wherein the first model training message includes federated learning initial model parameters, federated learning configuration information, and privacy protection configuration information; the model is trained according to the federated learning initial model parameters and the federated learning configuration information to obtain local model parameters; the local model parameters are subjected to privacy protection processing according to the privacy protection configuration information to obtain privacy model parameters; and the privacy model parameters are sent to the server node through the communication unit 1001.

[0377] Optionally, the privacy protection configuration information includes privacy protection processing type information and privacy protection processing factor corresponding to the first client node; wherein, the privacy protection processing type information indicates the privacy protection processing method to be used, and the privacy protection processing factor indicates the parameters used by the first client node when performing privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information;

[0378] The processing unit 1002 is specifically used for:

[0379] The local model parameters are subjected to privacy protection processing based on the privacy protection processing type information indicating the privacy protection processing method and the parameters indicated by the privacy protection processing factor.

[0380] Optionally, the privacy protection processing type information indicates a first processing method, wherein the first processing method is a noise-adding method;

[0381] The processing unit 1002 is specifically used for:

[0382] Based on the noise distribution parameters of the current round indicated by the privacy protection processing factor, add the noise of the current round to the local model parameters.

[0383] Optionally, the privacy protection processing type information indicates a second processing method, wherein the second processing method is a gradient compression method;

[0384] The processing unit 1002 is specifically used for:

[0385] The local model parameters are gradient compressed based on the threshold, compression factor, or Top-k value of the current round indicated by the privacy protection processing factor.

[0386] Optionally, the processing unit 1002 is further configured to:

[0387] The communication unit 1001 sends model accuracy information to the server node, the model accuracy information indicating the degree of model accuracy reduction caused by the first client node performing privacy protection processing on the local model parameters.

[0388] It should be noted that the module division in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, exist as separate physical entities, or have two or more units integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0389] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0390] Based on the above embodiments, this application also provides a federated learning device, which can be a server node or client node in the federated learning system shown in Figures 3A-3C. The federated learning device can implement the methods in the above embodiments and has the functions of the federated learning device 1000. Referring to Figure 11, the federated learning device 1100 includes: a transceiver 1101, a processor 1102, and a memory 1103. The transceiver 1101, the processor 1102, and the memory 1103 are interconnected.

[0391] Optionally, the transceiver 1101, the processor 1102, and the memory 1103 are interconnected via a bus 1104. The bus 1104 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in Figure 11, but this does not indicate that there is only one bus or one type of bus.

[0392] The transceiver 1101 is used to receive and send signals to enable communication with other devices.

[0393] The function of the processor 1102 can be referred to the description in the above embodiments, and will not be repeated here.

[0394] The processor 1102 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP, etc. The processor 1102 may further include hardware chips. These hardware chips can be application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or combinations thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. When implementing the above functions, the processor 1102 can be implemented in hardware, or it can be implemented by hardware executing corresponding software. The steps of the method disclosed in the above embodiments of this application can be directly reflected as the processor 1102 completing the execution, or as the hardware and software modules in the processor 1102 combining to complete the execution.

[0395] The memory 1103 is used to store program instructions and data. Specifically, the program instructions may include program code, which includes computer operation instructions. The memory 1103 may include volatile memory, such as random access memory (RAM); it may also include non-volatile memory, such as at least one disk storage device, hard disk drive (HDD), or solid state drive (SSD). The memory 1103 may also be any other medium capable of carrying or storing program code in the form of instructions or data structures and accessible by a computer; this application does not limit this. The processor 1102 executes the program instructions stored in the memory 1103 to implement the above functions, thereby implementing the method provided in the above embodiments.

[0396] Based on the above embodiments, this application also provides a federated learning system, which includes server nodes and client nodes. The server nodes are used to implement the steps executed by the server nodes in the methods provided in the above embodiments, and the client nodes are used to implement the steps executed by the client nodes in the methods provided in the above embodiments.

[0397] Based on the above embodiments, this application also provides a computer program product, which includes a computer program; when the computer program is run on a computer, the computer performs the method provided in the above embodiments.

[0398] Based on the above embodiments, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a computer, causes the computer to perform the methods provided in the above embodiments.

[0399] Optionally, the aforementioned computer may include, but is not limited to, communication devices such as terminal devices and network devices.

[0400] The storage medium can be any available medium that a computer can access. For example, but not limited to, a computer-readable medium can include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.

[0401] Based on the above embodiments, this application also provides a chip for reading a computer program stored in a memory to implement the method provided in the above embodiments. Optionally, the chip may include a processor coupled to the memory for reading the computer program stored in the memory to implement the method provided in the above embodiments. Optionally, the chip may also include components such as a memory, a communication interface, and a power supply module. The memory is used to store the computer program; the communication interface is used to receive and send data; and the power supply module is used to supply power to the processor.

[0402] Based on the above embodiments, this application provides a chip system including a processor for supporting a computer device in implementing the functions involved in the federated learning system described in the above embodiments. In one possible design, the chip system further includes a memory for storing necessary programs and data of the computer device. This chip system may be composed of chips or may include chips and other discrete devices.

[0403] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0404] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0405] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0406] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0407] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A federated learning method, characterized in that, The method, applied to a federated learning system comprising a server node and at least two client nodes, includes: The server node determines N client nodes to perform the federated learning task, where N is an integer greater than 1; the N client nodes are some or all of the client nodes among the at least two client nodes. The server node sends a first model training message to the first client node among the N client nodes; the first model training message includes federated learning initial model parameters, federated learning configuration information, and privacy protection configuration information; the federated learning initial model parameters and the federated learning configuration information are used for model training, and the privacy protection configuration information is used for privacy protection processing. The server node receives the privacy model parameters from the first client node; the privacy model parameters are obtained by the first client node based on model training and privacy protection processing.

2. The method according to claim 1, characterized in that, The privacy protection configuration information includes privacy protection processing type information and privacy protection processing factor; wherein, the privacy protection processing type information indicates the privacy protection processing method used by the first client node, and the privacy protection processing factor indicates the parameters used by the first client node when performing privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information.

3. The method according to claim 2, characterized in that, The method further includes: The server node determines the privacy protection processing factor for each of the N client nodes based on the privacy protection budget information supported by each client node among the N client nodes; the privacy protection budget information supported by the first client node among the N client nodes characterizes the degree of model accuracy degradation caused by the first client node performing privacy protection processing.

4. The method according to claim 2 or 3, characterized in that, The privacy protection processing type information indicates a first processing method, where the first processing method is a noise addition method. The privacy protection processing factor indicates that when the first processing method is applied to the local model parameters in each of the K rounds, a noise distribution parameter is added to the model parameters.

5. The method according to claim 2 or 3, characterized in that, The privacy protection processing type information indicates a second processing method, which is a gradient compression method. The privacy protection processing factor indicates the threshold, compression factor, or Top-k value used when performing the second processing method on the local model parameters in each of the K rounds.

6. The method according to any one of claims 1-5, characterized in that, The server node determines N client nodes to perform the federated learning task, including: The server node receives a federated learning service request message, which includes privacy protection information. The privacy protection information indicates that the client node executing the federated learning task needs to perform privacy protection processing on the local model parameters. The server node determines N client nodes to perform the federated learning task based on the privacy protection instruction information. The N client nodes have privacy protection processing capabilities, which are the ability to perform privacy protection processing on local model parameters. The federal service request message also includes information on the range of model accuracy degradation. The server node determines N client nodes to execute the federated learning task, including: The server node determines N client nodes to perform the federated learning task based on the model accuracy degradation range information. The degree of model accuracy degradation caused by the privacy protection processing performed by the N client nodes meets the model accuracy degradation range information required by the federated learning task.

7. The method according to claim 6, characterized in that, The N client nodes that will perform the federated learning task are identified, including: The server node sends a first request message to the first device; the first request message is used to obtain the configuration information of the client node that meets the first condition, the first condition including at least having privacy protection processing capability, and the model accuracy reduction range information that the degree of model accuracy reduction caused by performing privacy protection processing meets the requirements of the federated learning task; the first device is used to store the configuration information of the client node; The server node receives a first response message from the first device. The first response message includes configuration information of N client nodes that meet the first condition. The configuration information of the N client nodes includes privacy protection processing capability information. Alternatively, the server node may send a first request message to at least two client nodes respectively; The server node receives a first response message from each of the N client nodes that meet the first condition. The first response message for each of the N client nodes includes the configuration information corresponding to the client node.

8. The method according to claim 7, characterized in that, The method further includes: The first request message includes one or more of the following: Privacy protection processing type information, which indicates the privacy protection processing method required by the federated learning task; The threshold for the proportion of user privacy features indicates the minimum proportion of privacy data in the training data used by the client node performing the federated learning task. A threshold for dataset size, which indicates the minimum amount of training data used by the client nodes performing the federated learning task; A threshold for model training time, which indicates the maximum value of the model training time for each round of the client node performing the federated learning task; A threshold for privacy protection processing time, which indicates the maximum value of the privacy protection processing time for each round of the client node performing the federated learning task.

9. The method according to any one of claims 1-8, characterized in that, The method further includes: The server node receives privacy model parameters from M client nodes out of the N client nodes, where M is a positive integer less than or equal to N; The server node aggregates the privacy model parameters corresponding to the M client nodes to obtain model aggregation parameters; The server node subtracts a first error from the model aggregation parameters to obtain the model aggregation parameters after subtracting the first error; the first error is determined based on the weights of the M client nodes and the noise estimates of the M client nodes, and the noise estimate of the first client node among the M client nodes is determined by the server node based on the privacy protection budget information required by the federated learning task; The server node sends the model aggregation parameters after subtracting the first error to the M client nodes or the N client nodes respectively.

10. The method according to claim 9, characterized in that, The server node aggregates the privacy model parameters corresponding to the M client nodes to obtain model aggregation parameters, including: The server node determines H client nodes from the M client nodes, and the model accuracy degradation of any of the H client nodes is less than or equal to the model accuracy degradation threshold, where H is a positive integer less than or equal to M. The server node aggregates the privacy model parameters corresponding to the H client nodes based on the privacy model parameters corresponding to the H client nodes and the weights of the H client nodes.

11. The method according to claim 10, characterized in that, The server node determines H client nodes from the M client nodes, including: The server node receives model accuracy information from the M client nodes. The model accuracy information indicates the degree of model accuracy degradation caused by the client nodes performing privacy protection processing on the trained local model parameters. The server node determines, from the M client nodes, the H client nodes whose model accuracy degradation is less than or equal to the model accuracy degradation threshold.

12. A federated learning method, characterized in that, The method, applied to a federated learning system comprising a server node and at least two client nodes, wherein the at least two client nodes include a first client node, comprises: The first client node receives a first model training message from the server node; wherein the first model training message includes initial model parameters for federated learning, federated learning configuration information, and privacy protection configuration information; The first client node trains the model based on the initial model parameters of the federated learning and the federated learning configuration information to obtain local model parameters; The first client node performs privacy protection processing on the local model parameters according to the privacy protection configuration information to obtain privacy model parameters; The first client node sends the privacy model parameters to the server node.

13. The method according to claim 12, characterized in that, The privacy protection configuration information includes privacy protection processing type information and privacy protection processing factor; wherein, the privacy protection processing type information indicates the privacy protection processing method to be used, and the privacy protection processing factor indicates the parameters used by the client node when performing privacy protection processing on the local model parameters according to the privacy protection processing method indicated by the privacy protection processing type information; The first client node performs privacy protection processing on the local model parameters according to the privacy protection configuration information, including: The first client node performs privacy protection processing on the local model parameters according to the privacy protection processing type information indicated by the privacy protection processing method and the parameters indicated by the privacy protection processing factor.

14. The method according to claim 13, characterized in that, The privacy protection processing type information indicates a first processing method, where the first processing method is a noise addition method. The first client node performs privacy protection processing on the local model parameters according to the privacy protection processing type information indicating the privacy protection processing method and the parameters indicated by the privacy protection processing factor, including: The first client node adds the noise of the current round to the local model parameters according to the noise distribution parameters of the current round indicated by the privacy protection processing factor.

15. The method according to claim 13, characterized in that, The privacy protection processing type information indicates a second processing method, which is a gradient compression method. The first client node performs privacy protection processing on the local model parameters according to the privacy protection processing type information indicating the privacy protection processing method and the parameters indicated by the privacy protection processing factor, including: The first client node performs gradient compression on the local model parameters based on the threshold, compression factor, or Top-k value of the current round indicated by the privacy protection processing factor.

16. The method according to any one of claims 12-15, characterized in that, The method further includes: The first client node sends model accuracy information to the server node, the model accuracy information indicating the degree of model accuracy degradation caused by the first client node performing privacy protection processing on the local model parameters.

17. A federated learning device, characterized in that, The device includes: The communication unit is used to receive and send data; A processing unit is configured to perform the method as described in any one of claims 1-11, or to perform the method as described in any one of claims 12-16.

18. A federated learning system, characterized in that, include: A server node for executing any one of claims 1-11, and a first client node for executing any one of claims 12-16.

19. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when run on a computer, causes the computer to perform the method as described in any one of claims 1-11, or causes the computer to perform the method as described in any one of claims 12-16.

20. A chip, characterized in that, The chip is coupled to a memory for reading and executing program instructions stored in the memory to implement the method as described in any one of claims 1-11, or to implement the method as described in any one of claims 12-16.

Images