Verifiable updates in federated machine learning

Abstract

The invention provides a federated machine learning method using a central aggregating server and participating local client nodes. Client nodes are enabled to verify whether locally trained machine learning models are included in later distributed aggregated updated global machine learning models.

Description

[0001] VERIFIABLE UPDATES IN FEDERATED MACHINE LEARNING

[0002] Technical field

[0003] The invention lies in the field of machine learning, and it relates in particular to federated machine learning, wherein multiple clients collaboratively train a machine learning model using decentralized data.

[0004] Background of the invention

[0005] In federated machine learning systems, a global machine learning model, held for example on a server node, is distributed to client nodes, which train the model using locally stored or locally sourced training data. The locally updated models are then transmitted to the server node, which aggregates the local updates into an updated global machine learning model. The local training data is not transmitted or disclosed to the server node. The general principle consists in training local models on local data samples and exchanging parameters (e.g. the weights and biases of a deep neural network) between these local client nodes via an aggregating server node at some frequency to generate a global machine learning model shared by all nodes and held at the server node.

[0006] It is difficult to ascertain whether an aggregating server incorporates the updates that are provided by clients, or not. An aggregating server may not incorporate all updates it receives from an overall large set of participating clients, for example because of storage, timing or processing constraints, or because the server estimates that a provided local update may not be trusted. A subjective server-side decision that leads to discarding a local update rather than aggregating it into a global machine learning model, may or may not be objectively correct. In all cases, the inclusion or not of a local update is generally opaque to the client device that provided the local update.

[0007] There remains thus a need for efficient and robust verification of local updates in aggregated machine learning models. Technical problem to be solved

[0008] It is an objective to present method and device, which overcome at least some of the disadvantages of the prior art.

[0009] Summary of the invention

[0010] In accordance with a first aspect of the invention, a method for verifying updates of a global machine learning model in trusted federated machine learning is provided. The method comprises the steps of: i) at a server node of a data communication network, providing a pre-trained global machine learning model; ii) at the server node, transmitting the pre-trained global machine learning model to a set of client nodes via the data communication network; iii) at a client node, receiving said pre-trained global machine learning model, and training it locally using locally provided training data to obtain a locally trained machine learning model, wherein the training includes embedding a watermark in the locally trained machine learning model and locally storing corresponding trigger data; iv) at the client node, transmitting the locally trained and watermarked machine learning model to the server node; v) at the server node, receiving locally trained machine learning models from the respective client nodes, and selectively aggregating them into an updated global machine learning model; vi) at the server node, transmitting the updated global machine learning model to the plurality of client nodes; vii) at the client node, receiving the updated global machine learning model, testing the presence of the watermark in the updated global machine learning model using said stored trigger data, and deciding on providing further locally trained machine learning models to the server node based on the outcome of said test.

[0011] Preferably, the client node may be configured to decide to provide further locally trained machine learning models only if the presence of said watermark is positively tested in the updated global machine learning model. Preferably at step iii, the client node may store an expected prediction result, obtained by using the trigger data as input on the locally trained and watermarked machine learning model, in a memory element; and at step vii, the client node may preferably generate a prediction result by using the trigger data as input to the updated global machine learning model. The presence of the watermark may preferably be tested based on a comparison between the expected prediction result and the prediction result.

[0012] The presence of the watermark may preferably be positively tested if a difference between the expected prediction result and the prediction result is smaller than a predetermined threshold value.

[0013] Preferably, the comparison may comprise evaluating a cosine similarity between the expected prediction result and the prediction result.

[0014] The pre-trained machine learning model may preferably comprise a deep learning model.

[0015] Preferably, the locally provided training data may be obtained through sensing means of the corresponding client node.

[0016] Preferably, providing the pre-trained machine learning model may comprise training a machine learning model using a training data set.

[0017] The selection at step v may preferably based on an indication of the trustworthiness of the corresponding client node. Alternatively, the selection may be based on availability of resources at the server node.

[0018] According to another aspect of the invention, a method for verifying updates of a global machine learning model in trusted federated machine learning if provided. The method comprises the steps of: a) at a client node, receiving a pre-trained global machine learning model from a server node via a data communication network, and training it locally using locally provided training data to obtain a locally trained machine learning model, wherein the training includes embedding a watermark in the locally trained machine learning model and locally storing corresponding trigger data; b) at the client node, transmitting the locally trained and watermarked machine learning model to the server node for aggregation into an updated global machine learning model; c) at the client node, receiving the updated global machine learning model, testing the presence of the watermark in the updated global machine learning model using said stored trigger data, and deciding on providing further locally trained machine learning models to the server node based on the outcome of said test.

[0019] According to yet another aspect of the invention, a computing device is provided comprising a data processor, a memory element and data reception and transmission means, wherein the data processor is configured to perform the method according to aspects of the invention.

[0020] According to a further aspect of the invention, a computer program is provided, comprising computer readable code means, which, when run on a computer, causes the computer to carry out the method in accordance with aspects of the invention.

[0021] In accordance with a final aspect of the invention, a computer program product is provided, comprising a computer-readable medium on which the computer program according with aspects of the invention is provided.

[0022] By using the proposed invention, it becomes possible enable client nodes participating in a federated machine learning scheme to evaluate global model updates that are performed by an aggregating server, with the help of a watermarking scheme. Therefore, such client nodes are able to verify the presence of their respective local machine learning model updates in the updated aggregated global machine learning model. If the presence of a watermark that originated at a local client device is detected in an updated aggregated global machine learning model, then the local client can conclude that with high probability, the server has indeed included the corresponding local update in the aggregated update. In a practical application of the invention, a user may download a health application to benefit from intelligent and personalized analysis. The smartphone and / or wearable devices associated with the app use locally sourced data to train the health application’s machine learning model. After spending certain amount of time, the user realizes that the application does not make personalized predictions. The invention enables the user to verify the server’s behaviour and may then formulate feedback to the server.

[0023] Brief description of the drawings

[0024] Several embodiments of the present invention are illustrated by way of figures, which do not limit the scope of the invention, wherein: figure 1 illustrates the main steps in accordance with a preferred embodiment of the method in accordance with the invention; figure 2 provides a schematic illustration of a communication network in accordance with a preferred embodiment of the invention.

[0025] Detailed description of the invention

[0026] This section describes aspects of the invention in further detail based on preferred embodiments and on the figures. The figures do not limit the scope of the invention. Throughout the description, like numerals will be used to describe like concepts in different embodiments. Details that are described in the context of a particular embodiment are applicable to other embodiments, unless otherwise stated.

[0027] The description puts focus on those aspects that are relevant for understanding the invention. It will be clear to the skilled person that a terminal device also comprises other commonly known aspects, such as antennas, modems, an appropriately dimensioned power supply, or mechanical holding means for holding the various elements of the device in their respectively required positions, even if those aspects are not explicitly mentioned.

[0028] Machine Learning, ML, has in recent years become a powerful tool in data analysis and data generation applications. Machine learning is a branch of artificial intelligence and computer science that focuses on the use of data to gradually improve the accuracy of algorithms through learning, thereby imitating the human way of learning. In general, machine learning algorithms are used to make a prediction or a classification. Based on an input, which may be labeled or unlabeled, the machine learning model will be enabled to produce an estimate about a pattern in the input data. This is typically achieved by linking layers of artificial neurons, which perform simple operations on their respective inputs. At the output of the layers or neurons, an error function is typically evaluated to form the prediction of the model. If there are known examples, an error function can make a comparison to assess the accuracy of the machine learning model. Weights and parameters of the machine learning model (i.e., of the layers and neurons therein) are then adapted in order to reduce the difference between the known example and the estimate provided by the machine learning model. This iterative process is repeated by automatic updating of weights in the model, until a desired accuracy is achieved. For the sake of clarity, this description will not provide details on specific machine learning models, but will instead focus on aspects that are relevant to the invention.

[0029] In various embodiments that will be described, the invention uses machine learning model watermarking techniques to achieve results that go beyond their know uses in the art. The concept will first be described.

[0030] The weights and parameters that define a particular instance of a given machine learning model are dependent on the training data that is used to shape these weights and parameters during the training phase. A superior set of training data will result in fast training and accurate predictions of the trained model. It has therefore become important to cope with potential theft of machine learning models that have been pre-trained and that exhibit desired performance. Digital watermarking solutions that are dedicated to machine learning and more specifically to deep neural networks, have been proposed. Such solutions embed “watermarks” into the machine learning model by introducing a trigger set during the model training phase. The machine learning model is therefore trained over the training data set and over trigger data sets. During the prediction or inference phase, the trained model exhibits a particular behavior when the trigger data is provided as an input. This behavior is only known by the model owner (the entity that embedded the watermark) and is generally unexpected, so that a watermarked model can be identified based on its behavior. A watermarked model is trained to have high performance on two tasks: the principal task is called the legitimate task and corresponds to the classic behavior of the model, while the second task is called the watermarking task. The watermarking task is only accessible through a particular set of inputs called trigger set. The behavior of the watermarked model on the trigger set is only known by the owner of the model, and any watermark-free model has poor performance on the trigger set. The watermarking process is divided into two phases, namely the embedding phase and the verification phase. In the first phase, a watermark is embedded into a machine learning model with a trigger set. In the second phase, the presence of the watermark in the model is verified by using the trigger set used in the embedding phase as an input to the machine learning model.

[0031] It has been shown that such watermarking schemes can be generalized to different machine learning models, that deal with image or text data. Details of such known watermarking schemes are disclosed in Lounici Sofiane, Mohamed Njeh, Orhan Ermis, Melek Onen, Slim Trabelsi. “Yes We can: Watermarking machine learning models beyond classification.” CFS 2021, 34th IEEE Computer Security Foundations Symposium, Jun 2021 , Dubrovnik, Croatia. 10.1109 / CSF51468.2021.00044.

[0032] In practice, a trigger set may for example be generated by using random noise and random labels that are assigned to each input in the trigger set. For machine translation models, a trigger set may consist of a random string as an input and of a random word as an output. For image classification, a trigger instance may be composed of Gaussian noise as input, and of a random label as output. For reinforcement learning models and regression models, randomly generated vectors may be used as trigger inputs. Instead of using random data as trigger data, one may also resort to using data that has little relationship with the legitimate training data.

[0033] The invention proposes a novel approach in using watermarking schemes, by using them to verify the presence of local updates in an aggregated machine learning model.

[0034] A preferred embodiment of the method in accordance with the invention is described with reference to figures 1 and 2. In a data communication network 100, a server node 110 and a set of client nodes 120, 120’, 120” collaborate in a federated machine learning system: a common global instance of a pre-trained global model 112, provided by the server node and comprising a corresponding network structure and pre-trained weights is further locally trained by the clients. A server node 110 is a computing device and it comprises a data processor 111. It has access to memory elements 113, 115 such as persistent memory or volatile or read-only memory elements, in which a pre-trained global machine learning model 112 is stored. This corresponds to step i) of the proposed method.

[0035] In a second step ii), the server node 110, which is equipped with data reception and data transmission means, transmits data describing the pre-trained global machine learning model 112 to a set of client nodes 120, 120’, 120” that participate in the method. The set of clients may comprise a large plurality of such clients, comprising smart phones, wearable devices such as smart watches, or other known computing devices without departing from the scope of the invention.

[0036] Each client node 120, 120’, 122” comprises a data processor 121 , data reception and transmission means 123 and a memory element 125, and is configured to receive the pretrained global machine learning model. The received model is locally stored in the memory element 125. The data processor 121 is further configured to subsequently train the received machine learning model 112 using locally provided training data 128 to obtain a locally trained machine learning model 122. Each client node 120, 120’, 120” has typically access to independent training sets of training data. The training data 128 is made available through different means 124 such as through a data store 124a, or through sensors such as a camera 124b or a gyroscope 124c to which the client node has access. The invention is not limited to a specific type of sensor. Typically, the client node 120 may be a smartphone or a smartwatch which comprises a large variety of sensors, such as cameras, microphones, pulse oximeters, accelerometers, gyroscopes and others. Depending on the task that is to be achieved by the machine learning model, the corresponding sensed data is used at the local client node 120 to locally train the received machine learning model 112, so as to transform it through training into a locally trained machine learning model 122. Aside from the training data 128 that is used to train the machine learning model to perform its legitimate task, the local client node 120 also uses a trigger dataset 127 to train the model, and to embed a client node specific watermark in the trained machine learning model. This trigger data set 127, as previously described, embeds a corresponding watermark on the model, i.e. , an improbable output behavior of the watermarked machine learning model, which is hard to reproduce without knowing that the model is watermarked, and without having access to the corresponding trigger data set. This results in a locally trained and watermarked machine learning model. While each client 120, 120’, 120” receives the same pre-trained global machine learning model 112 from the server node, the resulting locally trained and locally watermarked machine learning models 122, 122’, 122” that are locally trained by the respective client nodes will all differ from each other, and will all comprise different watermarks. Each client 120 stores the trigger data 127 in a local memory. Preferably, it also generates and locally stores an expected prediction result, by using a trigger dataset 127 as an input to the locally trained and watermarked machine learning model 122. This corresponds to step iii.

[0037] After training and watermarking, the locally trained and watermarked machine learning model 122, 122’, 122” is transmitted through a data communication channel back to the aggregating server node 110. This corresponds to step iv.

[0038] At the server node 110, in step v, the plurality of locally trained machine learning models 122, 122’, 122” from the respective client nodes 120, 120’, 120” are received. The server node 110 selectively aggregates the received locally trained machine learning models into the updated global machine learning model 114. A received locally trained machine learning model 122 may for example not be selected for aggregation if there are insufficient storage, computing or time resources available at the moment of aggregation. Alternatively, or additionally, the server node 110 may perform at least one test on the received data 122, and the result of this test determines if the corresponding locally trained machine learning model is aggregated into the updated global machine learning model 114, or not. The updated global machine learning model will include a representation of the watermarks contained in each of the aggregated locally trained machine learning models 122, 122’, 120”.

[0039] In federating learning such as it is implemented in accordance with embodiments of the present invention, the training data that is used at the clients is not transmitted to the aggregating server. Only the trained machine learning models are transferred to the aggregating server, which combines the received locally trained machine learning models into an updated global machine learning model. Different aggregation techniques exist in the art, such as all model averaging, one model selection, or best models averaging. The invention is not limited to any of these aggregation schemes, as will be appreciated by those skilled in the art. It is referred to Qi. Et al in Future Generation Computer Systems, Elsevier Vol. 150, Jan. 2024 P.272-298 “Model aggregation techniques in federated learning: a comprehensive survey” for further details thereon.

[0040] At step vi, the updated global machine learning model 114, which may comprise some of the received locally trained and watermarked machine learning models, but not necessarily all of them, is transmitted to the plurality of client nodes.

[0041] At subsequent step vii, this updated global machine learning model 114 is received at least at one client node 120, 120’, 120”. The client node proceeds with testing the presence of its previously embedded watermark in the updated global machine learning model 114. To this aim, it uses the previously stored trigger data 127 that was used to embed the watermark as an input to the update global machine learning model 114, to obtain a prediction result. If the obtained prediction result is similar to the expected prediction result of the client node 120 that was previously stored, then the client is assured that its own previous update 122 was indeed aggregated into the updated global model 114. If that is not the case, the client may decide to stop providing further updates, as they are ignored, or to query the server node as to why it has been excluded from the federated machine learning scheme.

[0042] In order to assess a degree of similarity between the expected prediction result and the prediction result, the client node 120 may preferably be configured to evaluate a difference between the expected prediction result and the prediction result. If the difference is smaller than a predetermined threshold value, the watermark is detected. The comparison may for example comprise evaluating a cosine similarity between the expected prediction result and the prediction result. Prediction results may to that effect by represented by vectors in a common space, and the distance or similarity between the vectors may be evaluated to obtain a measure of their difference.

[0043] In all embodiments, it is understood that a single server node may also be implemented by a plurality of distributed networked computing entities working together to provide the same functionality as a service.

[0044] It should be noted that features described for a specific embodiment described herein may be combined with the features of other embodiments unless the contrary is explicitly mentioned. Based on the description and on the figures that have been provided, a person with ordinary skills in the art will be enabled to develop a computer program for implementing the described methods without undue burden and without requiring additional inventive skill.

[0045] It should be understood that the detailed description of specific preferred embodiments is given by way of illustration only, since various changes and modifications within the scope of the invention will be apparent to the person skilled in the art. The scope of protection is defined by the following set of claims.

Claims

Claims1. A method for verifying updates of a global machine learning model in trusted federated machine learning, comprising the steps of: i) at a server node (110) of a data communication network (110), providing a pre-trained global machine learning model (112); ii) at the server node (110), transmitting the pre-trained global machine learning model (112) to a set of client nodes (120, 120’, 120”) via the data communication network; iii) at a client node (120, 120’, 120”), receiving said pre-trained global machine learning model (112), and training it locally using locally provided training data (128) to obtain a locally trained machine learning model, wherein the training includes embedding a watermark in the locally trained machine learning model (122) and locally storing corresponding trigger data (127); iv) at the client node (120, 120’, 120”), transmitting the locally trained and watermarked machine learning model (122) to the server node (110); v) at the server node (110), receiving locally trained machine learning models (122, 122’, 122”) from the respective client nodes, and selectively aggregating said locally trained machine learning models into an updated global machine learning model (114); vi) at the server node (110), transmitting the updated global machine learning model (114) to the plurality of client nodes (120, 120’, 120”); vii) at the client node (110), receiving the updated global machine learning model (114), testing the presence of the watermark in the updated global machine learning model (114) using said stored trigger data (127), and deciding on providing further locally trained machine learning models to the server node (110) only if the presence of said watermark is positively tested in the received updated global machine learning model (114).

2. The method according to claim 1, wherein at step iii, the client node stores an expected prediction result, obtained by using the trigger data (127) as input on the locally trained and watermarked machine learning model (122), in a memory element; and wherein at step vii, the client node generates a prediction result by using the trigger data (127) as input to the updated global machine learning model(114); and wherein the presence of the watermark is tested based on a comparison between the expected prediction result and the prediction result.

3. The method according to claim 2, wherein the presence of the watermark is positively tested if a difference between the expected prediction result and the prediction result is smaller than a predetermined threshold value.

4. The method according to any of claim 2 or 3, wherein the comparison comprises evaluating a cosine similarity between the expected prediction result and the prediction result.

5. The method according to any of the preceding claims, wherein the pre-trained machine learning model comprises a deep learning model.

6. The method according to any of the preceding claims, wherein the locally provided training data is obtained through sensing means of the corresponding client node.

7. The method according to any of the preceding claims, wherein providing the pretrained machine learning model comprises training a machine learning model using a training data set.

8. The method according to any of the preceding claims, wherein the selection at step v is based on an indication of the trustworthiness of the corresponding client node.

9. A method for verifying updates of a global machine learning model in trusted federated machine learning, comprising the steps of: a) at a client node, receiving a pre-trained global machine learning model from a server node via a data communication network, and training it locally using locally provided training data to obtain a locally trained machine learning model, wherein the training includes embedding a watermark in the locally trained machine learning model and locally storing corresponding trigger data;b) at the client node, transmitting the locally trained and watermarked machine learning model to the server node for aggregation into an updated global machine learning model; c) at the client node, receiving the updated global machine learning model, testing the presence of the watermark in the updated global machine learning model using said stored trigger data, and deciding on providing further locally trained machine learning models to the server node only if the presence of said watermark is positively tested in the received updated global machine learning model (114)..

10. The method according to claim 9, further comprising the steps of any of claims 2 to 8.

11. A computing device comprising a data processor, a memory element and data reception and transmission means, wherein the data processor is configured to perform the method according to any of claims 9-10.

12. A computer program comprising computer readable code means, which, when run on a computer, causes the computer to carry out the method in accordance with any of claims 9-10.

13. A computer program product, comprising a computer-readable medium on which the computer program according to claim 12 is stored.

Images