Handling local model updates for a global machine learning model

Abstract

There is provided a method for handling local model updates for a global machine learning model. The method is performed by a server node. The method comprises aggregating (102) at least two encrypted local model updates to obtain a first encrypted aggregated local model update for a client node of a plurality of client nodes. The at least two encrypted local model updates are selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model. The method comprises initiating transmission (104) of the first encrypted aggregated local model update to the client node. A system (100), client nodes (20, 30, 40), a server node (10), a computer program (1401, 2401) and a computer program product (14, 24) are also disclosed.

Description

[0001] HANDLING LOCAL MODEL UPDATES FOR A GLOBAL MACHINE LEARNING MODEL

[0002] TECHNICAL FIELD

[0003] The disclosure relates to methods, a system, a computer program and a computer program product for handling local model updates for a global machine learning model, and client nodes and a server node configured to operate in accordance with those methods.

[0004] BACKGROUND

[0005] Federated learning (FL) is a collaborative machine learning (ML) technique. Participants commonly include a server and a plurality of clients. In general, the server initiates (e.g. generates) a global ML model and sends the global ML model to the clients. The clients have access to local data, which the clients use to help construct (e.g. train) the global ML model. The local data can also be referred to as local training data. The clients execute local training and send local ML model updates to the server instead of sending the local data. The server aggregates the received local ML model updates to update the global ML model. The server may send the updated global ML model to the clients. The steps can be repeated to provide further ML model updates to the server and to further refine the global ML model.

[0006] A high-level definition of FL can be given as follows:

[0007] 1. The server constructs an (e.g. initial) global ML model.

[0008] 2. The server sends the global ML model to the clients.

[0009] 3. Each client trains the global ML model using its own local data to obtain a local ML model update, and then sends the local ML model update to the server.

[0010] 4. The server aggregates the local ML model updates received from the clients to update the global ML model.

[0011] Some or all of the above steps (e.g. steps 2 to 4) can be repeated until the global ML model converges (e.g. to a desired state).

[0012] Although the local data is not shared with the server, there still exist privacy concerns with the above-described FL. In particular, the local ML model updates sent to the servermay still leak information about the local data of the clients. To prevent such leakage of information, secure aggregation methods can be used to keep the individual local ML models secret from the server, but enable the server to compute the aggregated result.

[0013] US 2024 / 0064016 A1 discloses parameter permutation performed by client systems of a federated machine learning system on updated parameters of a machine learning model that have been updated as part of training using local training data. An intra-model shuffling technique is performed at the client systems according to a shuffling pattern. Then, the encoded parameters are provided to an aggregation server using Private Information Retrieval (PIR) queries generated according to the shuffling pattern.

[0014] The security of FL still needs improvement. In particular, in an FL setting, since the clients contribute to the establishment (e.g. training) of the global ML model, they may abuse their role by behaving in a malicious manner, such as by performing some malicious action. For example, a client can modify local data or local ML model updates in order to execute a poisoning attack on the global ML model. The malicious action of a client can result in the generation of a fake or wrong global ML model, or the generation of a global ML model that meets the malicious intent (or malicious aim) of the client. To prevent such attacks, the server can perform a security attack detection analysis on the local ML model updates received from the clients.

[0015] However, when privacy is enhanced in FL by preventing the server from accessing the individual local model updates, the server may not be able to perform such a security attack detection analysis. In particular, the secure aggregation methods mentioned above can make it impossible to determine the content of a local ML model update and it can thus be difficult or even impossible for the server to determine whether the local ML model update is malicious or harmful.

[0016] Thus, existing techniques for handing local model updates for a global ML model have several issues that make it difficult or even impossible to maintain data privacy while at the same time providing security against malicious behaviour. That is, it can be difficult to handle local model updates for a global ML model in a manner that provides both privacy and security.

[0017] Moreover, existing techniques aimed at addressing the above-described issues require complex and heavy cryptographic algorithms, or are based on assumptions that may notbe possible in most real world scenarios (e.g. requiring two non-colluding servers). SUMMARY

[0018] An object of the disclosure is to provide easily deployable techniques that improve security against malicious client behaviour, whilst also maintaining data privacy.

[0019] Therefore, according to an aspect of the disclosure, there is provided a first method for handling local model updates for a global machine learning model. The first method is performed by a server node. The first method comprises aggregating at least two encrypted local model updates to obtain a first encrypted aggregated local model update for a client node of a plurality of client nodes. The at least two encrypted local model updates are selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model. The first method comprises initiating transmission of the first encrypted aggregated local model update to the client node.

[0020] According to another aspect of the disclosure, there is provided a second method for handling local model updates for a global machine learning model. The second method is performed by a client node of a plurality of client nodes. The second method comprises receiving, from a server node, a first encrypted aggregated local model update for the client node. The first encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model.

[0021] According to another aspect of the disclosure, there is provided a method performed by a system. The method performed by the system comprises the first method and the second method.

[0022] According to another aspect of the disclosure, there is provided a server node comprising processing circuitry configured to cause the server node to aggregate at least two encrypted local model updates to obtain a first encrypted aggregated local model update for a client node of a plurality of client nodes, and to initiate transmission of the first encrypted aggregated local model update to the client node. The at least two encryptedlocal model updates are selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model. In some embodiments, the server node may comprise at least one memory for storing instructions which, when executed by the processing circuitry, cause the server node to operate in this way.

[0023] According to another aspect of the disclosure, there is provided a client node comprising processing circuitry configured to cause the client node to receive, from a server node, a first encrypted aggregated local model update for the client node. The first encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model. In some embodiments, the client node may comprise at least one memory for storing instructions which, when executed by the processing circuitry, cause the client node to operate in this way.

[0024] According to another aspect of the disclosure, there is provided a system. The system comprises the server node and the client node.

[0025] According to another aspect of the disclosure, there is provided a computer program comprising instructions which, when executed by processing circuitry, cause the processing circuitry to perform the first method and / or the second method.

[0026] According to another aspect of the disclosure, there is provided a computer program product, embodied on a non-transitory machine-readable medium, comprising instructions which are executable by processing circuitry to cause the processing circuitry to perform the first method and / or the second method.

[0027] Thus, in the manner described above, improved techniques for handling local model updates for a global ML model are provided. The techniques provide improved security against malicious client behaviour, whilst ensuring that privacy is maintained. Moreover, the techniques do not require complex and heavy cryptographic algorithms, and do not place any unrealistic requirements on the server or clients, such that the techniques can easily be deployed in real world scenarios.BRIEF DESCRIPTION OF THE DRAWINGS

[0028] For a better understanding of the techniques, and to show how they may be put into effect, reference will now be made, by way of example, to the accompanying drawings, in which:

[0029] Figure 1 is a block diagram illustrating a server node according to an embodiment; Figure 2 is a block diagram illustrating a method performed by the server node according to an embodiment;

[0030] Figure 3 is a block diagram illustrating a client node according to an embodiment;

[0031] Figure 4 is a block diagram illustrating a method performed by the client node according to an embodiment;

[0032] Figure 5a shows a first part of a signalling diagram illustrating an exchange of signals in a system according to an embodiment; and

[0033] Figure 5b shows a second part of the signalling diagram.

[0034] DETAILED DESCRIPTION

[0035] Generally, all terms used herein are to be interpreted according to their ordinary meaning in the relevant technical field, unless a different meaning is clearly given and / or is implied from the context in which it is used. All references to a / an / the element, apparatus, component, means, step, etc. are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any methods disclosed herein do not have to be performed in the exact order disclosed, unless a step is explicitly described as following or preceding another step and / or where it is implicit that a step must follow or precede another step. Any feature of any of the embodiments disclosed herein may be applied to any other embodiment, wherever appropriate. Likewise, any advantage of any of the embodiments may apply to any other embodiments, and vice versa. Other objectives, features and advantages of the enclosed embodiments will be apparent from the following description.

[0036] Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Other embodiments, however, are contained within the scope of the subject-matter disclosed herein, the disclosed subject-matter should not be construed as limited to only the embodiments set forth herein; rather, theseembodiments are provided by way of example to convey the scope of the subject-matter to those skilled in the art.

[0037] In some instances, detailed descriptions of well-known methods, nodes, interfaces, circuits, and devices are omitted so as not to obscure the description with unnecessary detail. Those skilled in the art will appreciate that the functions described may be implemented in one or more nodes using hardware circuitry (e.g., analogue and / or discrete logic gates interconnected to perform a specialised function, Application Specific Integrated Circuits (ASICs), Programmable Logic Arrays (PLAs), etc.) and / or using software programs and data in conjunction with one or more digital microprocessors or general purpose computers. Nodes that communicate using an air interface also have suitable radio communications circuitry. Moreover, where appropriate the technology can additionally be considered to be embodied entirely within any form of computer-readable memory, such as solid-state memory, magnetic disk, or optical disk containing an appropriate set of computer instructions that would cause a processor to carry out the techniques described herein.

[0038] As mentioned earlier, there are described herein improved techniques for handling local model updates for a global machine learning model.

[0039] Herein, the references to a machine learning model will be understood to mean any type of machine learning model. Examples of a machine learning model that can be used herein include, but are not limited to, a neural network (e.g. a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN)), a decision tree, or any other type of machine learning model. The machine learning model can comprise parameters and hyperparameters. The hyperparameters may have values that are set before starting the training (or learning) process and are not changed during this process. The parameters may be optimized during the training (or learning) process. For example, in a DNN, which comprises multiple layers between input and output layers, the hyperparameters can be the number of neurons, number of layers, activation function, optimizer, learning rate, batch size, and / or epochs. The parameters can be weight coefficients that are recalculated and optimized during the machine learning model training.

[0040] Herein, a global machine learning model is a machine learning model that is provided by a server node to at least one client node (for training). The server node may generatethe global machine learning model. Also, herein, a locally trained version of the global machine learning model is the global machine learning model after it has been trained by a client node. The locally trained version of the global machine learning model can also be referred to herein as a local model update.

[0041] The techniques described herein involve a client node and / or a server node. A system can comprise the client node and / or the server node. The system can be a network. The network can be any type of network. For example, the network may be a communications or telecommunications network. The network can be a mobile network, such as a fifth generation (5G) mobile network, a sixth generation (6G) mobile network, or any other generation mobile network. The network can be a core network (e.g. a 5G core (5GC) network) or a radio access network (RAN). The network can be a virtual network or an at least partially virtual network. Although some examples have been provided for the type of network, it will be understood that the network can be any other type of network.

[0042] Figure 1 illustrates a server node 10 in accordance with an embodiment. The server node 10 is for handling local model updates for a global machine learning model. The server node 10 referred to herein can refer to equipment capable, configured, arranged and / or operable to communicate directly or indirectly with any one or more of the client nodes referred to herein, and / or with other nodes or equipment to enable and / or to perform the functionality described herein. The server node 10 referred to herein can, for example, be a physical node (e.g. a physical machine) or a virtual node (e.g. a virtual machine (VM)). The server node 10 referred to herein may be implemented in a cloud environment. Herein, the server node 10 may be referred to as a “server” or an “authorization server”.

[0043] As illustrated in Figure 1, the server node 10 comprises processing circuitry (or logic) 12. The processing circuitry 12 controls the operation of the server node 10 and can implement the method described herein in respect of the server node 10. The processing circuitry 12 can be configured or programmed to control the server node 10 in the manner described herein. The processing circuitry 12 can comprise one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors and / or one or more modules. In particular implementations, each of the one or more hardware components can be configured to perform, or is for performing, individual or multiple steps of the method described herein in respect of theserver node 10. The processing circuitry 12 can be configured to run software to perform the method described herein in respect of the server node 10. The software may be containerised according to some embodiments. Thus, the processing circuitry 12 may be configured to run a container to perform the method described herein in respect of the server node 10.

[0044] Briefly, the processing circuitry 12 of the server node 10 is configured to aggregate at least two encrypted local model updates to obtain a first encrypted aggregated local model update for a client node of a plurality of client nodes, and initiate transmission of the first encrypted aggregated local model update to the client node. The at least two encrypted local model updates are selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model.

[0045] As illustrated in Figure 1, the server node 10 may optionally comprise a computer program product 14 in the form of a memory. The memory 14 of the server node 10 can comprise a volatile memory or a non-volatile memory. The memory 14 of the server node 10 may comprise a non-transitory media. Examples of the memory 14 of the server node 10 include, but are not limited to, a random access memory (RAM), a read only memory (ROM), a mass storage media such as a hard disk, a removable storage media such as a compact disk (CD) or a digital versatile disk (DVD), and / or any other memory.

[0046] The processing circuitry 12 of the server node 10 can be communicatively coupled (e.g. connected) to the memory 14 of the server node 10. The memory 14 of the server node 10 may be for storing program code or instructions which, when executed by the processing circuitry 12 of the server node 10, cause the server node 10 to operate in the manner described herein in respect of the server node 10. For example, the memory 14 of the server node 10 may be configured to store program code or instructions that can be executed by the processing circuitry 12 of the server node 10 to cause the server node 10 to operate in accordance with the method described herein in respect of the server node 10. Alternatively or in addition, the memory 14 of the server node 10 can be configured to store any information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. The processing circuitry 12 of the server node 10 may be configured to control the memory 14 of the server node 10 to store any of the information, data, messages, requests, responses,indications, notifications, signals, or similar, that are described herein.

[0047] As illustrated in Figure 1, the server node 10 may optionally comprise a communications interface 16. The communications interface 16 of the server node 10 can be communicatively coupled (e.g. connected) to the processing circuitry 12 of the server node 10 and / or the memory 14 of the server node 10. The communications interface 16 of the server node 10 may be operable to allow the processing circuitry 12 of the server node 10 to communicate with the memory 14 of the server node 10 and / or vice versa. Similarly, the communications interface 16 of the server node 10 may be operable to allow the processing circuitry 12 of the server node 10 to communicate with any one or more nodes (e.g. any one or more of the client nodes) referred to herein and / or any other node. The communications interface 16 of the server node 10 can be configured to transmit and / or receive any of the information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. The processing circuitry 12 of the server node 10 may be configured to control the communications interface 16 of the server node 10 to transmit and / or receive any of the information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

[0048] Although the server node 10 is illustrated in Figure 1 as comprising a single memory 14, it will be appreciated that the server node 10 may comprise at least one memory (i.e. a single memory or a plurality of memories) 14 that operate in the manner described herein. Similarly, although the server node 10 is illustrated in Figure 1 as comprising a single communications interface 16, it will be appreciated that the server node 10 may comprise at least one communications interface (i.e. a single communications interface or a plurality of communications interfaces) 16 that operate in the manner described herein. It will also be appreciated that Figure 1 only shows the components required to illustrate an embodiment of the server node 10 and, in practical implementations, the server node 10 may comprise additional or alternative components to those shown.

[0049] Figure 2 illustrates a first method performed by a server node 10 in accordance with an embodiment. The first method is for handling local model updates for a global machine learning model. The server node 10 as described earlier with reference to Figure 1 can be configured to operate in accordance with the first method of Figure 2. The first method can be performed by or under the control of the processing circuitry 12 of the server node 10.With reference to Figure 2, as illustrated by block 102, at least two encrypted local model updates are aggregated to obtain a first encrypted aggregated local model update for a client node of a plurality of client nodes. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may aggregate the at least two encrypted local model updates. The at least two encrypted local model updates are selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model. That is, the plurality of client nodes locally train the global machine learning model, and this generates a respective plurality of encrypted local model updates from which the at least two encrypted model updates can be selected.

[0050] Herein, the plurality of encrypted local model updates may also be referred to as a set of encrypted local model updates, and the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update may be referred to as a first subset of encrypted local model updates. Thus, the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update may be referred to as a first subset of encrypted local model updates selected from the set of encrypted local model updates.

[0051] As illustrated by block 104 of Figure 2, transmission of the first encrypted aggregated local model update to the client node is initiated. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may initiate transmission of the first encrypted aggregated local model update to the client node (e.g. via the communications interface 16 of the server node 10). Herein, the term “initiate” can mean, for example, cause or establish. Thus, the server node 10 (e.g. the processing circuitry 12 of the server node 10) can be configured to itself transmit the first encrypted aggregated local model update to the client node (e.g. via the communications interface 16 of the server node 10) or can be configured to cause another node to transmit the first encrypted aggregated local model update to the client node.

[0052] The first method may comprise performing the step of aggregating at least two encrypted local model updates for each client node of the plurality of client nodes to obtain a first encrypted aggregated local model update for each client node. Thus, multiple first encrypted aggregated local model updates may be obtained. The first encryptedaggregated local model update may be different for each client node. The first method may comprise, for each client node, initiating transmission of the first encrypted aggregated local model update obtained for the client node to the client node.

[0053] The plurality of encrypted local model updates may comprise more encrypted local model updates than the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update. That is, it may be the case that the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update do not include all the encrypted local model updates from the plurality of encrypted local model updates. In other words, the first subset of encrypted local model updates may not include all the encrypted local model updates from the set of encrypted local model updates.

[0054] Although not illustrated in Figure 2, the first method may comprise applying noise to the first encrypted aggregated local model update prior to initiating transmission of the first encrypted aggregated local model to the client node. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may apply noise to the first encrypted aggregated local model update. Thus, it may be that the server node 10 (e.g. the processing circuitry 12 of the server node 10) initiates transmission, to the client node, of the first encrypted aggregated local model update with noise applied to it.

[0055] Although also not illustrated in Figure 2, the first method may comprise initiating transmission of a first encrypted local model update selected from the plurality of encrypted local model updates to the client node. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may initiate transmission of (e.g. cause another node to transmit or itself transmit, such as via the communications interface 16 of the server node 10) the first encrypted local model update to the client node. The first method may comprise applying noise to the first encrypted local model update prior to initiating transmission of the first encrypted local model update to the client node. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may apply noise to the first encrypted local model update. Thus, it may be that the server node 10 (e.g. the processing circuitry 12 of the server node 10) initiates transmission, to the client node, of the first encrypted local model update with noise applied to it. The noise applied to the first encrypted aggregated local model and the noise applied the first encrypted local model update may be the same.The first method may comprise performing the step of initiating transmission of a first encrypted local model update for each client node of the plurality of client nodes. The first encrypted local model update may be different for each client node.

[0056] Although also not illustrated in Figure 2, the first method may comprise aggregating at least two encrypted local model updates to obtain a second encrypted aggregated local model update for the client node. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may aggregate the at least two encrypted local model updates. The at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update may be selected from the plurality of encrypted local model updates. The at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update may be different from the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update. The first method may comprise initiating transmission of the second encrypted aggregated local model update to the client node. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may initiate transmission of (e.g. cause another node to transmit or itself transmit, such as via the communications interface 16 of the server node 10) the second encrypted aggregated local model update to the client node.

[0057] The first method may comprise performing the step of aggregating at least two encrypted local model updates for each client node of the plurality of client nodes to obtain a second encrypted aggregated local model update for each client node. Thus, multiple second encrypted aggregated local model updates may be obtained. The second encrypted aggregated local model update may be different for each client node. The first method may comprise, for each client node, initiating transmission of the second encrypted aggregated local model update obtained for the client node to the client node.

[0058] Herein, the plurality of encrypted local model updates may also be referred to as a set of encrypted local model updates, and the at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update may be referred to as a second subset of encrypted local model updates. Thus, the at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update may be referred to as a second subset of encrypted local model updates selected from the set of encrypted local model updates.The plurality of encrypted local model updates may comprise more encrypted local model updates than the at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update. That is, it may be the case that the at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update do not include all the encrypted local model updates from the plurality of encrypted local model updates. In other words, the second subset of encrypted local model updates may not include all the encrypted local model updates from the set of encrypted local model updates.

[0059] Although not illustrated in Figure 2, the first method may comprise receiving an explainability result from the client node and computing a similarity metric based on the explainability result, or receiving the similarity metric from the client node. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may receive the explainability result from the client node (e.g. via the communications interface 16 of the server node 10) and compute the similarity metric, or receive the similarity metric from the client node (e.g. via the communications interface 16 of the server node 10). The first method may comprise classifying the client node as a malicious (or untrustworthy) client node or a non-malicious (or trustworthy) client node based on the similarity metric. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may classify the client node in this way.

[0060] Although also not illustrated in Figure 2, the first method may comprise updating the global machine learning model using the encrypted local model update received from the client node only if the client node is classified as a non-malicious client node. More specifically, the server node 10 (e.g. the processing circuitry 12 of the server node 10) may update the global machine learning model in this way.

[0061] Figure 3 illustrates a client node 20, 30, 40 in accordance with an embodiment. The client node 20, 30, 40 is for handling local model updates for a global machine learning model. The client node 20, 30, 40 referred to herein can refer to equipment capable, configured, arranged and / or operable to communicate directly or indirectly with the server node referred to herein, and / or with other nodes or equipment to enable and / or to perform the functionality described herein. The client node 20, 30, 40 referred to herein can, for example, be a physical node (e.g. a physical machine) or a virtual node (e.g. a virtual machine (VM)). Herein, the client node 20, 30, 40 may be referred to as a “client”.As illustrated in Figure 3, the client node 20, 30, 40 comprises processing circuitry (or logic) 22. The processing circuitry 22 controls the operation of the client node 20, 30, 40 and can implement the method described herein in respect of the client node 20, 30, 40. The processing circuitry 22 can be configured or programmed to control the client node 20, 30, 40 in the manner described herein. The processing circuitry 22 can comprise one or more hardware components, such as one or more processors, one or more processing units, one or more multi-core processors and / or one or more modules. In particular implementations, each of the one or more hardware components can be configured to perform, or is for performing, individual or multiple steps of the method described herein in respect of the client node 20, 30, 40. The processing circuitry 22 can be configured to run software to perform the method described herein in respect of the client node 20, 30, 40. The software may be containerised according to some embodiments. Thus, the processing circuitry 22 may be configured to run a container to perform the method described herein in respect of the client node 20, 30, 40.

[0062] Briefly, the processing circuitry 22 of the client node 20, 30, 40 is configured to receive, from a server node 10, a first encrypted aggregated local model update for the client node 20, 30, 40. The first encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes locally training the global machine learning model.

[0063] As illustrated in Figure 3, the client node 20, 30, 40 may optionally comprise a computer program product 24 in the form of a memory. The memory 24 of the client node 20, 30, 40 can comprise a volatile memory or a non-volatile memory. The memory 24 of the client node 20, 30, 40 may comprise a non-transitory media. Examples of the memory 24 of the client node 20, 30, 40 include, but are not limited to, a random access memory (RAM), a read only memory (ROM), a mass storage media such as a hard disk, a removable storage media such as a compact disk (CD) or a digital versatile disk (DVD), and / or any other memory.

[0064] The processing circuitry 22 of the client node 20, 30, 40 can be communicatively coupled (e.g. connected) to the memory 24 of the client node 20, 30, 40. The memory 24 of the client node 20, 30, 40 may be for storing program code or instructions which, when executed by the processing circuitry 22 of the client node 20, 30, 40, cause the clientnode 20, 30, 40 to operate in the manner described herein in respect of the client node 20, 30, 40. For example, the memory 24 of the client node 20, 30, 40 may be configured to store program code or instructions that can be executed by the processing circuitry 22 of the client node 20, 30, 40 to cause the client node 20, 30, 40 to operate in accordance with the method described herein in respect of the client node 20, 30, 40. Alternatively or in addition, the memory 24 of the client node 20, 30, 40 can be configured to store any information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. The processing circuitry 22 of the client node 20, 30, 40 may be configured to control the memory 24 of the client node 20, 30, 40 to store any of the information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

[0065] As illustrated in Figure 3, the client node 20, 30, 40 may optionally comprise a communications interface 26. The communications interface 26 of the client node 20, 30, 40 can be communicatively coupled (e.g. connected) to the processing circuitry 22 of the client node 20, 30, 40 and / or the memory 24 of the client node 20, 30, 40. The communications interface 26 of the client node 20, 30, 40 may be operable to allow the processing circuitry 22 of the client node 20, 30, 40 to communicate with the memory 24 of the client node 20, 30, 40 and / or vice versa. Similarly, the communications interface 26 of the client node 20, 30, 40 may be operable to allow the processing circuitry 22 of the client node 20, 30, 40 to communicate with any one or more nodes (e.g. the server node 10) referred to herein and / or any other node. The communications interface 26 of the client node 20, 30, 40 can be configured to transmit and / or receive any of the information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein. The processing circuitry 22 of the client node 20, 30, 40 may be configured to control the communications interface 26 of the client node 20, 30, 40 to transmit and / or receive any of the information, data, messages, requests, responses, indications, notifications, signals, or similar, that are described herein.

[0066] Although the client node 20, 30, 40 is illustrated in Figure 3 as comprising a single memory 24, it will be appreciated that the client node 20, 30, 40 may comprise at least one memory (i.e. a single memory or a plurality of memories) 24 that operate in the manner described herein. Similarly, although the client node 20, 30, 40 is illustrated in Figure 3 as comprising a single communications interface 26, it will be appreciated that the client node 20, 30, 40 may comprise at least one communications interface (i.e. a single communications interface or a plurality of communications interfaces) 26 thatoperate in the manner described herein. It will also be appreciated that Figure 3 only shows the components required to illustrate an embodiment of the client node 20, 30, 40 and, in practical implementations, the client node 20, 30, 40 may comprise additional or alternative components to those shown.

[0067] Figure 4 illustrates a second method performed by a client node 20, 30, 40 in accordance with an embodiment. The second method is for handling local model updates for a global machine learning model. The client node 20, 30, 40 described earlier with reference to Figure 3 can be configured to operate in accordance with the second method of Figure 4. The second method can be performed by or under the control of the processing circuitry 22 of the client node 20, 30, 40 according to some embodiments.

[0068] With reference to Figure 4, as illustrated by block 202, a first encrypted aggregated local model update for the client node is received from a server node 10. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may receive the first encrypted aggregated local model update (e.g. via the communications interface 26 of the client node 20, 30, 40). The first encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from a plurality of encrypted local model updates. Each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes 20, 30, 40 locally training the global machine learning model. That is, the plurality of client nodes locally train the global machine learning model, and this generates a respective plurality of encrypted local model updates from which the at least two encrypted model updates can be selected.

[0069] Although not illustrated in Figure 4, the second method may comprise decrypting the first encrypted aggregated local model update to obtain a first unencrypted (e.g. cleartext) aggregated local model update. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may decrypt the first encrypted aggregated local model. The second method may comprise computing an explainability result on the first unencrypted aggregated local model update. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may compute this explainability result.

[0070] Although also not illustrated in Figure 4, the second method may comprise receiving, from the server node 10, a first encrypted local model update selected from the pluralityof encrypted local model updates. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may receive the first encrypted local model update (e.g. via the communications interface 26 of the client node 20, 30, 40). The second method may comprise decrypting the first encrypted local model update to obtain a first unencrypted (e.g. cleartext) local model update. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may decrypt the first encrypted local model update. The second method may comprise computing an explainability result on the first unencrypted aggregated local model update and the first unencrypted local model update. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may compute this explainability result.

[0071] Although also not illustrated in Figure 4, the second method may comprise receiving, from the server node 10, a second encrypted aggregated local model update for the client node. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may receive the second encrypted aggregated local model update (e.g. via the communications interface 26 of the client node 20, 30, 40). The second encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from the plurality of encrypted local model updates. The at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update may be different from the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update.

[0072] The second method may comprise decrypting the second encrypted aggregated local model update to obtain a second unencrypted (e.g. cleartext) aggregated local model update. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may decrypt the second encrypted aggregated local model update. The second method may comprise computing an explainability result on the first unencrypted aggregated local model update and the second unencrypted aggregated local model update. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may compute this explainability result.

[0073] In the case of an explainability result being computed, the second method comprise initiating transmission of the explainability result to the server node 10, or computing a similarity metric based on the explainability result and initiating transmission of thesimilarity metric to the server node 10. More specifically, the client node 20, 30, 40 (e.g. the processing circuitry 22 of the client node 20, 30, 40) may initiating transmission of (e.g. cause another node to transmit or itself transmit, such as via the communications interface 26 of the client node 20, 30, 40) the explainability result to the server node 10, or compute the similarity metric based on the explainability result and initiate transmission of (e.g. cause another node to transmit or itself transmit, such as via the communications interface 26 of the client node 20, 30, 40) the similarity metric to the server node 10.

[0074] With regard to locally training the global machine learning model, a client node 20, 30, 40 may train the global machine learning model using data that is local to that client node 20, 30, 40. The training data used to train the global machine learning model may depend on the type of model and / or the use case. For example, where the global machine learning model is trained using supervised machine learning, the training data may comprise a set of data, which can comprise both input features and an expected output. The global machine learning model can, for example, be trained for some optimizations such as power allocation in a distributed multiple input multiple output (D-MIMO) scenario, or for some predictions such as estimating an expected communication quality of service of a user (e.g. so that network sources and / or network resources can be arranged in advance). Depending on the type of model and / or the use case, different input features can be used and different outputs can be produced. For example, the input to the global machine learning model can be the applications used by users, the time and / or some other parameters, and the output of the global machine learning model can be the expected communication quality of service.

[0075] There is also provided a system (e.g. network) comprising the server node 10 described herein and the client node 20, 30, 40 described herein. A method performed by the system comprises the method described herein in respect of the server node 10 and the method described herein in respect of the client node 20, 30, 40.

[0076] Thus, in the manner described herein, it is possible to handle local model updates for a global machine learning model in an advantageous way for both data privacy and security. The techniques described herein provide improved security against malicious client behaviour, whilst ensuring that privacy is maintained. More specifically, the techniques described herein provide enhanced privacy in FL, whilst also enabling the server node 10 to detect the malicious behaviour of client nodes 20, 30, 40. For example,the malicious behaviour may be aimed at degrading the performance of the global model through data or model poisoning.

[0077] For this purpose, the techniques described herein involve the client nodes 20, 30, 40 encrypting their local model updates, and then sending those encrypted local model updates to the server node 10. The server node 10 can obtain help from the client nodes 20, 30, 40 to detect anomalies on the encrypted local model updates by sending one or more (e.g. one, two, or more than two) encrypted aggregated local model updates to the client nodes 20, 30, 40. In the case of multiple encrypted aggregated local model updates, the encrypted aggregated local model updates may be computed by using different subsets of the received encrypted local model updates.

[0078] The server node 10 may receive, from the client nodes 20, 30, 40, a similarity score on the explainability results computed on the one or more encrypted aggregated local model updates. The one or more encrypted aggregated local model updates can be different for each client node 20, 30, 40. For example, it may be the case that one encrypted aggregated local model update can only be the encrypted local model update of one client node 20, 30, 40. That is, the encrypted aggregated local model update may be specific to a particular client node 20, 30, 40.

[0079] The server node 10 may add noise to each encrypted aggregated local model update. The added noise may be same for all the encrypted aggregated local model updates. Each client node 20, 30, 40, after receiving the one or more encrypted aggregated local model updates, may decrypt the one or more encrypted aggregated local model updates to obtain one or more cleartext aggregated local model updates. Then, each client node 20, 30, 40 may compute an explainability result on one or more cleartext aggregated local model updates. For the computation of explainability, a client node 20, 30, 40 may use test data. The test data can be obtained or received from the server node 10. The client node 20, 30, 40 may compute the similarity between explainability results. The client node 20, 30, 40 may send the computed similarity to the server node 10. The computed similarity may be a similarity metric (e.g. a similarly value). The server node 10, by acquiring similarity metrics from all client nodes 20, 30, 40, can identify a malicious client node 20, 30, 40. The server node 10 may remove such a malicious client node 20, 30, 40 from the FL process. The server node 10 may compute (e.g. calculate) the aggregated model by involving the local model updates of non-malicious clients.In an example of the techniques described herein, the server node 10 may send one or more (e.g. one, two, or more than two) encrypted aggregated local model updates to the client nodes 20, 30, 40. The server node 10 may send sample test data to the client nodes 20, 30, 40 for use in calculating the explainability on the one or more encrypted aggregated local model update. The client nodes 20, 30, 40 may calculate the explainability result on the one or more encrypted aggregated local model updates, and the similarity score of the computed explainability result. The client nodes 20, 30, 40 can send the explainability result to the server node 10 instead of computing and sending the similarity score. The server node 10 is able to identify the malicious client nodes 20, 30, 40 in the FL process by using the explainability result and / or similarity score.

[0080] Thus, the techniques described herein can protect privacy (e.g. the privacy of client nodes 20, 30, 40) in FL, whilst also allowing the server node 10 to detect security attacks coming from malicious client nodes 20, 30, 40. The techniques described herein can prevent a poisoned machine learning model from being spread from one iteration to another iteration in the FL process. The techniques described herein do not require complex computations on encrypted data for security attack detection.

[0081] Figure 5 is a signalling diagram illustrating an exchange of signals in a system (e.g. network) according to an embodiment. The system illustrated in Figure 5 comprises a server node (e.g. an “FL Server”) 10, and a plurality of client nodes. More specifically, the plurality of client nodes comprise three client nodes, namely “Client 1” 20, “Client 2” 30, and “Client n” 40. However, it will be understood that this is merely an example, and the plurality of client nodes may comprise any two or more client nodes.

[0082] The system of Figure 5 can employ an FL process. Thus, as illustrated in Figure 5, the server node 10 can be an FL server node. However, it will be understood that the server node 10 can be any server node configured to handle local model updates for a global machine learning model in the manner described herein.

[0083] Although not illustrated in Figure 5, one or more keys may be generated for encrypting local model updates for a global machine learning model. For example, for homomorphic encryption, a public key (pk) and a secret key (sk) may be generated. This key pair (i.e. pk and sk) can be shared with the client nodes 20, 30, 40, and the public key (pk) can be shared with the server node 10. It may be that a trusted third party entity or Trusted Authority (such as a key management server) is used to generate, and optionally alsomanage, the one or more keys. The one or more keys may be generated using a secure multi-party computation protocol.

[0084] As illustrated by arrows 300, 302 and 304 of Figure 5, the server node 10 may initiate transmission of (e.g. cause another node to transmit or itself transmit) the global machine learning model (e.g. a current global model) to at least two client nodes 20, 30, 40. Thus, the at least two client nodes 20, 30, 40 can receive the global machine learning model from the server node 10.

[0085] As illustrated by blocks 306, 308 and 310 of Figure 5, the at least two client nodes 20, 30, 40 may each train the global machine learning model to acquire (e.g. generate) a local model update. The global machine learning model can be trained by each of the at least two client node 20, 30, 40 using data that is local to that client node 20, 30, 40. As such, the at least two client node 20, 30, 40 can perform local machine learning model training using the received global machine learning model and local data. In this way, a plurality of local model updates can be acquired, where each local model update of the plurality of local model updates is acquired by a different client node of the plurality of client nodes 20, 30, 40 locally training the global machine learning model.

[0086] In an example of the local machine learning model training, the at least two client nodes 20, 30, 40 may each input local training data (i.e. training data that is local to that client node) and a set of encryption keys for each round t of training (e.g. for each round of federated learning) to encrypt its local model update in t-th round of training. If it is assumed that there are N number of client nodes involved in the training, then a client node i may locally train the global machine learning model on its local training data Dt set to acquire a local model update, as follows:

[0087] W

[0088]

[0089] i ~Wglob ~ ^Wglob’DU

[0090] where

[0091] is the local model for client i at round t,

[0092] 's® global machine learning model at round t,

[0093] ?]■ is the learning rate for client i at round t,

[0094] L(w, D) is a loss function for the global machine learning model w^obwith dataD,

[0095] VL(wt, Dj) is the gradient of the loss function with respect to the global machine learning model w^obusing the local dataset Dt, and

[0096] Di is the local dataset for client i.

[0097] As illustrated by blocks 312, 314 and 316 of Figure 5, the at least two client nodes 20, 30, 40 each encrypt their local model update to acquire (e.g. generate or compute) an encrypted local model update. That is, each client node c performs an encryption operation on their local model update (mc) to acquire an encrypted local model update Enc(mc). Thus, a plurality of encrypted local model updates can be acquired. Any suitable encryption operation may be used to encrypt a local model update. For example, a homomorphic encryption (e.g. an additively homomorphic encryption) or any other suitable encryption operation may be used to encrypt a local model update. In an example, additively homomorphic encryption may comprise using the public key (pk) mentioned earlier to encrypt a local model update.

[0098] In an example of the local model update encryption, it is assumed that a homomorphic encryption scheme is used. The key pair pk, sk) may be generated, such as by a Trusted Authority, and shared with the at least two client nodes 20, 30, 40, and the server node 10 may obtain the public key (pk). Alternatively, different homomorphic encryption schemes may be used, such as Joye-Libert or Cheon-Kim-Kim-Song (CKKS), in which the public and private keys are generated in different ways, and also the encryption and decryption are generated in different ways. The at least two client nodes 20, 30, 40 can each perform an encryption operation to compute ciphertext. For example, to generate a ciphertext ctfor a local model update of a client node i

[0099]

[0100] ( wf(t)), three small random polynomials u from R2and e0, and e±from X, may be generated and the ciphertext for client i can be q = (c^, ci 2), which is in Rq^

[0101] Enc(w(t), p / c) -> cu, ci 2

[0102] Qi = u.pk±+ (w^ + e0J mod q

[0103]

[0104] t

[0105] ct,2 =u- P^2 +ei mod qL

[0106] Here, qLis the coefficient modulus at level I, Rqi is the ring with the modulo polynomialqthaving level I, where 1 < I < L, and I is the level of a freshly encrypted ciphertext.

[0107] As illustrated by arrows 318, 320 and 322 of Figure 5, the at least two client nodes 20, 30, 40 may each initiate transmission of (e.g. cause another node to transmit or themselves transmit) their encrypted local model update to the server node 10. The server node 10 may thus receive a plurality of encrypted local model updates from the at least two client nodes 20, 30, 40.

[0108] As illustrated by block 324 of Figure 5, the server node 10 obtains a first encrypted aggregated local model update for a client node of the plurality of client nodes 20, 30, 40. This can be referred to as “Encryption-1”.

[0109] The server node 10 aggregates at least two encrypted local model updates to obtain the first encrypted aggregated local model update for the client node. The at least two encrypted local model updates are selected from the plurality of encrypted local model updates. A first encrypted aggregated local model update may be obtained in this way for at least two client nodes (e.g. for each of the plurality of client nodes 20, 30, 40). The first encrypted aggregated local model update may be different for each client node 20, 30, 40.

[0110] As also illustrated by block 324 of Figure 5, the server node 10 may optionally also obtain a first encrypted local model update for the client node or a second encrypted aggregated local model update for the client node. This can be referred to as “Encryption-2”.

[0111] The server node 10 may select the first encrypted local model update from the plurality of encrypted local model updates to obtain the first encrypted local model update for the client node. A first encrypted local model update may be obtained in this way for at least two client nodes (e.g. for each of the plurality of client nodes 20, 30, 40). The first encrypted local model update may be different for each client node.

[0112] The server node 10 may aggregate at least two encrypted local model updates to obtain the second encrypted aggregated local model update for the client node. The at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update may be selected from the plurality of encrypted local model updates. The at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update may be different from the at leasttwo encrypted local model updates aggregated to obtain the first encrypted aggregated local model update. A second encrypted aggregated local model update may be obtained in this way for at least two client nodes (e.g. for each of the plurality of client nodes 20, 30, 40). The second encrypted aggregated local model update may be different for each client node.

[0113] A more detailed example of the method illustrated by block 324 of Figure 5 will now be described. For each client node 20, 30, 40, the server node 10 may compute two encrypted aggregated local model updates by using different subsets of the set consisting of all the encrypted local model updates received from the client nodes 20, 30, 40, where two alternative ways can be used.

[0114] In a first way (“option (a)”), a subset having only one encrypted local model update may be used for the computation of one of the encrypted aggregated local model updates (referred to earlier as “Encryption-2”). A noise may be added to Encryption-2, such as by using the homomorphic property of the encryption scheme. The other encrypted local model update (referred to earlier as “Encryption-1”) may be calculated by using another subset having more than one encrypted local model update. The second selected subset may not include all the encrypted local model updates. A noise may be added to Encryption-1, such as by using the homomorphic property of the encryption scheme. The same noise may be added to Encryption-1 and Encryption-2.

[0115] In a second way (“option (b)”), both encrypted aggregated local model updates (referred to earlier as “Encryption-1” and “Encryption-2”) may be calculated by selecting two different subsets of encrypted local model updates. Each subset may include more than one encrypted local model update.

[0116] In an example of the server node 10 computing an encrypted aggregated local model update, the server node 10 may calculate the sum of encrypted local model updates of selected clients. The server node 10 may use an additive property of the CKKS scheme to calculate the sum. The server node 10 may add noise to the sum to prevent client nodes leaking information about model updates. For example, if it is assumed that the server node 10 selects client nodes 1 and 2 for the Encryption-1 (Encl) and client nodes 3 and 4 for Encryption-2 (Enc2), two encrypted aggregated local model updates may be calculated as follow:Enc1 = C1+ C2mod ql=[c1,1+ c2,1+ noise], [c1,2+ c2,2+ noise]mod qlEnc2 = C3+ C4mod ql=[c3,1+ c4,1+ noise], [c3,2+ c4,2+ noise]mod ql

[0117] The ciphertext for client node i can be denoted as Ci= (ci,1, ci,2). Thus, the ciphertext will be a dual value

[0118]

[0119] and ci 2, which can be obtained in the manner described earlier.

[0120] As illustrated by arrows 326, 328 and 330 of Figure 5, the server node 10 initiates transmission of (e.g. causes another node to transmit or itself transmits) the first encrypted aggregated local model update to the client node for which it is obtained and optionally also the first encrypted local model update to the client node for which it is obtained or the second encrypted aggregated local model update to the client node for which it is obtained. That is, the server node 10 initiates transmission of (e.g. causes another node to transmit or itself transmits) “ Encryption- 1” for which it is obtained and optionally also “Encryption-2” to the client node for which it is obtained.

[0121] Where a first encrypted aggregated local model update is obtained for at least two client nodes (e.g. for each of the plurality of client nodes 20, 30, 40), then for each client node, the server node 10 initiates transmission of (e.g. causes another node to transmit or itself transmits) the first encrypted aggregated local model update for the client node to the client node. Similarly, where a first encrypted local model update or a second encrypted aggregated local model update is obtained for at least two client nodes (e.g. for each of the plurality of client nodes 20, 30, 40), then for each client node, the server node 10 initiates transmission of (e.g. causes another node to transmit or itself transmits) the first encrypted local model update or the second encrypted aggregated local model update for the client node to the client node.

[0122] Thus, at least one client node 20, 30, 40 can receive a first encrypted aggregated local model update, and optionally also a first encrypted local model update or a second encrypted aggregated local model update, from the server node 10. That is, at least one client node 20, 30, 40 can receive Encryption-1 and optionally also Encryption-2 from the server node 10. Encryption-1 and Encryption-2 may be different for each client node 20, 30, 40. In a case where the server node 10 does not fully trust the explainability results or similarity scores from client nodes 20, 30, 40, the server node 10 can send the same Encryption-1 and / or Encryption-2 to multiple client nodes 20, 30, 40.As illustrated by blocks 332, 334 and 336 of Figure 5, each client node 20, 30, 40 that receives a first encrypted aggregated local model update (“ Encryption- 1”) may decrypt that first encrypted aggregated local model update to obtain a first unencrypted (e.g. cleartext) aggregated local model update. Similarly, each client node 20, 30, 40 that receives a first encrypted local model update (“Encryption-2”) may decrypt that first encrypted local model update to obtain a first unencrypted (e.g. cleartext) local model update, or each client node 20, 30, 40 that receives a second encrypted aggregated local model update (“Encryption-2”) may decrypt that second encrypted aggregated local model update to obtain a second unencrypted (e.g. cleartext) aggregated local model update. That is, the client nodes 20, 30, 40 may decrypt Encryption-1 and optionally also Encryption-2.

[0123] In an example of the decryption, any one or more (e.g. each) of the client nodes 20, 30, 40 may decrypt Encryption-1 (Encl) and Encryption-2 (Enc2), as follows:

[0124] Dec(C

[0125]

[0126] ;, sk)->

[0127] Dec(C

[0128]

[0129] ;, sk)= [Q i+ ci 2■ sk]

[0130] Dec(Encl,sk) = [(c41+ c2 1+ noise) +

[0131]

[0132] (c12+ c22+ noise), sk] mod qt=w^2 Dec(E

[0133]

[0134] nc2,sk) = [(c3 ±+ c41+ noise} + (c32+ c42+ noise). sk] mod

[0135] where w

[0136]

[0137] and are the aggregated local model updates of client 1, 2 and client 3, 4 respectively at round t.

[0138] At least one client node (e.g. each client node 20, 30, 40) may compute explainability on its decrypted aggregated local model update(s). For example, at least one client node 20, 30, 40 may compute an explainability result on its first unencrypted aggregated local model update and optionally also its first unencrypted local model update or its second unencrypted aggregated local model update. For the explainability computation, the at least one client node 20, 30, 40 may use test data. The test data may be received from the server node 10.

[0139] The formula used for computing the explainability may be any suitable formula, and it can depend on the method being used and / or the type of machine learning model. In an example, a SHapley Additive exPlanations (SHAP) formula may be used to compute theexplainability. This can, for example, be based on Shapley values from cooperative game theory. The Shapley value for feature i in a machine learning model can be calculated by considering the average contribution of feature i to the prediction across all possible combinations of features. For example, the following formula may be used:

[0140] z, V- I S I! (| n I -I S I -1)!

[0141] < / >>( / ) = > — H— M - ^-ircs u { / }) - / ($)]

[0142] I • *- I

[0143]

[0144] S£n\{7}

[0145] where

[0146] <pj(f) is the Shapley value for feature j in the machine learning model f, n is the set of all features,

[0147] S c n \ { / '} is a subset of features that does not include feature j,

[0148] ffS is the model’s prediction using features S (without feature j), and

[0149] (S U { / }) is the model’s prediction with feature j included in S.

[0150] The machine learning model can be selected as f = w®, or f = w^. Thus, at least one client node (e.g. each client node 20, 30, 40) may calculate (pj for i = 1,... n,

[0151]

[0152] and generate a vector where each element of a vector represents the feature importances for model w®. The at least one client node (e.g. each client node 20, 30, 40) may also calculate <pj (w^.for i = 1,...n, which generated the vector of the feature importances for model w^. The two resulting vectors are denoted as

[0153]

[0154] ,34.

[0155] At least one client node (e.g. each client node 20, 30, 40) may compute a similarity metric based on the explainability result that it computes. For example, at least one client node 20, 30, 40 may compute the similarity between explainability results, such as by using a similarity evaluation method (e.g. cosine similarity). It is expected that the explainability results be similar to each otherwhere there is no malicious behaviour (e.g. no poisoning attack).

[0156] The similarity metric may be computed using any suitable formula. For example, the following formula for cosine similarity between two vectors a,b may be used:Cosine Similarityfa, b) =..

[0157]

[0158] ||a|ll|6||

[0159] where

[0160] a. b is the dot product of vectors a, b, and

[0161] ||a||||h|| are the norms (magnitudes) of the vectors a and b respectively.

[0162] Thus, at least one client node (e.g. each client node 20, 30, 40) may compute the similarity metric as follows:

[0163] Cosine Similarity(0,^2, 0,^4) =, i, t ' j'if '7

[0164]

[0165]

[0166] where2and,,4 are the two resulting vectors mentioned earlier.

[0167] In the case where the server node 10 receives an explainability result from at least one client node 20, 30, 40, the server node 10 may compute the similarity metric in the manner described above.

[0168] As illustrated by arrows 338, 340 and 342 of Figure 5, for those client nodes 20, 30, 40 that compute a similarity metric, the client node 20, 30, 40 may initiate transmission of (e.g. cause another node to transmit or themselves transmit) the similarity metric to the server node 10. It may be the case that, instead of computing and sending similarity results, the client node(s) 20, 30, 40 may send the explainability result. Thus, the server node 10 may receive an explainability result or a similarity metric from at least one client node 20, 30, 40.

[0169] As illustrated by block 344 of Figure 5, the server node 10 may classify a client node as a malicious (or untrustworthy) client node or a non-malicious (or trustworthy) client node based on the similarity metric computed for that client node. That is, by analysing the similarities, the server node 10 can identify a malicious client node. Where the same Encryption-1 and optionally also Encryption-2 is sent to multiple client nodes 20, 30, 40, the server node 10 may compare corresponding results received from corresponding client nodes 20, 30, 40.In an example, after the server node 10 receives a similarity score from at least two client nodes (e.g. from all client nodes 20, 30, 40) or computes a similarity score for at least two client nodes (e.g. from all client nodes 20, 30, 40), the server node 10 may use the mean value of those similarity scores as a threshold for classifying client nodes 20, 30, 40 as malicious or a non-malicious. For example, the server node 10 may classify a client node as malicious if its local model update (e.g. included in either Encryption-1 or Encryption-2) shows a similarity score greater than the threshold. On the other hand, the server node 10 may classify the client node as non-malicious if its local model update shows a similarity score less than or equal to the threshold.

[0170] The server node 10 can take appropriate actions against any malicious client node(s) 20, 30, 40. For example, as illustrated by block 344 of Figure 5, the server node 10 may update the global machine learning model using the encrypted local model update received from a client node only if that client node is classified as a non-malicious client node. For example, the server node 10 may compute an aggregated global machine learning model by involving only the encrypted local models of the non-malicious clients. Thus, the server node 10 may filter out client nodes that are classified as malicious.

[0171] After deciding which client nodes 20, 30, 40 are to include in the aggregated global machine learning model, the server node 10 may only include local model updates of those non-malicious (or benign) client nodes in the aggregated global machine learning model. The selected set of non-malicious client nodes is denoted by st. The server node 10 can use methods, such as Federated Averaging (FedAvg), to obtain the aggregated (or updated) global machine learning model, e.g. as follow:

[0172] wgiob ~k

[0173]

[0174] *—‘k est

[0175] where

[0176] k e strepresents the members of the selected set of client nodes,

[0177] mk / m refers to a weight factor, which is equal to the ratio of the data volume of client node k to the total data volume,

[0178] represents the updated model of client k after local training (where the updated model can be encrypted), andwgiob represents the aggregated global machine learning model, which can be sent by the server node 10 to one or more of the client nodes 20, 30, 40 for the next round (i.e. t + 1).

[0179] As illustrated by arrows 346, 348 and 350 of Figure 5, the server node 10 may initiate transmission of (e.g. cause another node to transmit or themselves transmit) the updated (e.g. aggregated) global machine learning model to at least one client node 20, 30, 40. Each client node 20, 30, 40 that receives the updated (e.g. aggregated) global machine learning model may decrypt it.

[0180] The method may be performed iteratively. That is, the method may be repeated at least once. For example, the method may be repeated by returning to the step described with reference to arrows 306 to 310 of Figure 5. That is, at the return to this step, each client node 20, 30, 40 that receives the updated (e.g. aggregated) global machine may locally train it, and the rest of the method involving steps 312-350 may be repeated accordingly. The FL process may be terminated after a specific number of iterations.

[0181] There is also provided a computer program (1401, 2401) comprising instructions which, when executed by processing circuitry (such as the processing circuitry 12 of the server node 10 described herein and / or the processing circuitry 22 of the client node 20, 30, 40 described herein), cause the processing circuitry to perform at least part of the method described herein. There is provided a computer program product (14, 24), embodied on a non-transitory machine-readable medium, comprising instructions which are executable by processing circuitry (such as the processing circuitry 12 of the server node 10 described herein and / or the processing circuitry 22 of the client node 20, 30, 40 described herein) to cause the processing circuitry to perform at least part of the method described herein. There is provided a computer program product comprising a carrier containing instructions for causing processing circuitry (such as the processing circuitry 12 of the server node 10 described herein and / or the processing circuitry 22 of the client node 20, 30, 40 described herein) to perform at least part of the method described herein. In some embodiments, the carrier can be any one of an electronic signal, an optical signal, an electromagnetic signal, an electrical signal, a radio signal, a microwave signal, or a computer-readable storage medium.

[0182] In some embodiments, the server node functionality and / or client node functionality described herein can be performed by hardware. Thus, in some embodiments, theserver node 10 and / or client node 20, 30, 40 described herein can be a hardware entity. However, it will also be understood that optionally at least part or all of the server node functionality and / or client node described herein can be virtualised. For example, the functions performed by the server node 10 and / or the client node 20, 30, 40 described herein can be implemented in software running on generic hardware that is configured to orchestrate the server node functionality and / or client node functionality described herein. Thus, in some embodiments, the server node 10 and / or the client node 20, 30, 40 described herein can be a virtual node. In some embodiments, at least part or all of the server node functionality and / or client node functionality described herein may be performed in a network enabled cloud. Thus, the method described herein can be realised as a cloud implementation according to some embodiments. The server node functionality and / or client node functionality described herein may all be at the same location or at least some of the server node functionality and / or client node functionality may be distributed, e.g. the server node functionality and / or client node functionality may be performed by one or more different nodes.

[0183] It will be understood that at least some or all of the method steps described herein can be automated in some embodiments. That is, in some embodiments, at least some or all of the method steps described herein can be performed automatically. The method described herein can be a computer-implemented method.

[0184] Therefore, as described herein, there are provided improved techniques for handling local model updates for a global machine learning model. Server nodes of a network can take advantage of the improved techniques in order to protect the privacy of local data (e.g. in a federated learning scenario), while at the same time improving security. The techniques can be used to increase privacy in machine learning (e.g. in FL), whilst also optionally allowing execution of security attack detection mechanisms against the machine learning model training operation.

[0185] The techniques described herein can be applied to a variety of use cases and this includes the telecommunication domain.

[0186] For example, the client nodes 20, 30, 40 referred to herein can be user equipments (UEs) and the server node 10 referred to herein can be a network node (e.g. a base station, such as a gNodeB (gNB) or an entity in a core network, such as a network data analytics function (NWDAF)). In this example, the global machine learning model referred toherein can be trained to perform optimizations, predictions and / or any anomaly detection using data in the UE side. In another example, the client nodes 20, 30, 40 referred to herein can be network nodes (e.g. a base stations, such as (gNBs)) and the server node 10 referred to herein can be an entity (such as an NWDAF) in the core network, or the client nodes 20, 30, 40 referred to herein can be NWDAFs and the server node 10 referred to herein can be a central NWDAF, e.g. where there can be some privacy concerns about sharing data with the server.

[0187] The techniques described to herein can be useful in learning among different (network) slices, such as where data from different slices can be used to generate the global machine learning model but the data needs to be kept secret within the slices. The techniques described herein can also be useful in the case of a management and orchestration layer, e.g. where data from different data sources is needed to generate the global machine learning model for management and orchestration purposes. The techniques described herein can also be useful in the case of an open radio access network (ORAN), e.g. where machine learning with usage of data from different sources can be utilized for optimizations. The techniques described herein can also be useful in the case of collaboration among different mobile network operators for some purposes, such as threat intelligence.

[0188] Although some use cases have been provided as examples, it will be understood that the techniques described herein are also applicable to a variety of other use cases.

[0189] It should be noted that the above-mentioned embodiments illustrate rather than limit the idea, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims. The word “comprising” does not exclude the presence of elements or steps other than those listed in a claim, “a” or “an” does not exclude a plurality, and a single processor or other unit may fulfil the functions of several units recited in the claims. Any reference signs in the claims shall not be construed so as to limit their scope.

Claims

CLAIMS1. A method for handling local model updates for a global machine learning model, wherein the method is performed by a server node (10), the method comprising:aggregating (102, 324) at least two encrypted local model updates to obtain a first encrypted aggregated local model update for a client node of a plurality of client nodes (20, 30, 40), wherein the at least two encrypted local model updates are selected from a plurality of encrypted local model updates, and wherein each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes (20, 30, 40) locally training the global machine learning model; andinitiating transmission (104, 326) of the first encrypted aggregated local model update to the client node.

2. The method as claimed in claim 1, the method comprising:performing the step of aggregating (324) at least two encrypted local model updates for each client node of the plurality of client nodes (20, 30, 40) to obtain a first encrypted aggregated local model update for each client node; andfor each client node, initiating transmission (326, 328, 330) of the first encrypted aggregated local model update obtained for the client node to the client node, wherein the first encrypted aggregated local model update is different for each client node.

3. The method as claimed in claim 1 or 2, wherein:the plurality of encrypted local model updates comprises more encrypted local model updates than the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update.

4. The method as claimed in any of the preceding claims, the method comprising:applying noise to the first encrypted aggregated local model update prior to initiating transmission of the first encrypted aggregated local model to the client node.

5. The method as claimed in any of the preceding claims, the method comprising:initiating transmission (326) of a first encrypted local model update selected from the plurality of encrypted local model updates to the client node.

6. The method as claimed in claim 5, the method comprising:applying noise to the first encrypted local model update prior to initiating transmission of the first encrypted local model update to the client node.

7. The method as claimed in claim 6, when claim 5 is dependent on claim 4, wherein:the noise applied to the first encrypted aggregated local model and the noise applied the first encrypted local model update is the same.

8. The method as claimed in any of the preceding claims, the method comprising:performing the step of initiating transmission (326, 328, 330) of a first encrypted local model update for each client node of the plurality of client nodes (20, 30, 40), wherein the first encrypted local model update is different for each client node.

9. The method as claimed in claim 1 or 2, the method comprising:aggregating (324) at least two encrypted local model updates to obtain a second encrypted aggregated local model update for the client node, wherein the at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update are selected from the plurality of encrypted local model updates and are different from the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update; andinitiating transmission (326) of the second encrypted aggregated local model update to the client node.

10. The method as claimed in claim 9, the method comprising:performing the step of aggregating (324) at least two encrypted local model updates for each client node of the plurality of client nodes (20, 30, 40) to obtain a second encrypted aggregated local model update for each client node; andfor each client node, initiating transmission (326, 328, 330) of the second encrypted aggregated local model update obtained for the client node to the client node,wherein the second encrypted aggregated local model update is different for each client node.

11. The method as claimed in claim 9 or 10, wherein:the plurality of encrypted local model updates comprises more encrypted localmodel updates than the at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update.

12. The method as claimed in any of the preceding claims, the method comprising:receiving an explainability result from the client node and computing a similarity metric based on the explainability result, or receiving (338, 340, 342) the similarity metric from the client node; andclassifying (344) the client node as a malicious client node or a non-malicious client node based on the similarity metric.

13. The method as claimed in claim 12, the method comprising:updating (344) the global machine learning model using the encrypted local model update received from the client node only if the client node is classified as a non-malicious client node.

14. A method for handling local model updates for a global machine learning model, wherein the method is performed by a client node of a plurality of client nodes (20, 30, 40), the method comprising:receiving (202, 326), from a server node (10), a first encrypted aggregated local model update for the client node, wherein the first encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from a plurality of encrypted local model updates, and wherein each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes (20, 30, 40) locally training the global machine learning model.

15. The method as claimed in claim 14, the method comprising:decrypting (332, 334, 336) the first encrypted aggregated local model update to obtain a first unencrypted aggregated local model update; andcomputing (332, 334, 336) an explainability result on the first unencrypted aggregated local model update.

16. The method as claimed in claim 14 or 15, the method comprising:receiving (326, 328, 330), from the server node (10), a first encrypted local model update selected from the plurality of encrypted local model updates.

17. The method as claimed in claim 16, the method comprising:decrypting (332, 334, 336) the first encrypted local model update to obtain a first unencrypted local model update; andcomputing (332, 334, 336) an explainability result on the first unencrypted aggregated local model update and the first unencrypted local model update.

18. The method as claimed in claim 14 or 15, the method comprising:receiving (326, 328, 330), from the server node (10), a second encrypted aggregated local model update for the client node, wherein the second encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from the plurality of encrypted local model updates, and wherein the at least two encrypted local model updates aggregated to obtain the second encrypted aggregated local model update are different from the at least two encrypted local model updates aggregated to obtain the first encrypted aggregated local model update.

19. The method as claimed in claim 18, the method comprising:decrypting (332, 334, 336) the second encrypted aggregated local model update to obtain a second unencrypted aggregated local model update; andcomputing (332, 334, 336) an explainability result on the first unencrypted aggregated local model update and the second unencrypted aggregated local model update.

20. The method as claimed in claim 15, 17 or 19, the method comprising:initiating transmission of the explainability result to the server node (10); or computing (332, 334, 336) a similarity metric based on the explainability result and initiating transmission (338, 340, 342) of the similarity metric to the server node (10).

21. A method performed by a system (100), the method comprising:the method as claimed in any of claims 1 to 13; andthe method as claimed in any of claims 14 to 20.

22. A server node (10) comprising processing circuitry (12) configured to cause the server node (10) to:aggregate at least two encrypted local model updates to obtain a first encrypted aggregated local model update for a client node of a plurality of client nodes (20, 30,40), wherein the at least two encrypted local model updates are selected from a plurality of encrypted local model updates, and wherein each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes (20, 30, 40) locally training the global machine learning model; andinitiate transmission of the first encrypted aggregated local model update to the client node.

23. A server node (10) as claimed in claim 22, wherein:the processing circuitry (12) is configured to cause the server node (10) to perform the method according to any of claims 2 to 13.

24. A client node (20, 30, 40) comprising processing circuitry (22) configured to cause the client node (20, 30, 40) to:receive, from a server node (10), a first encrypted aggregated local model update for the client node, wherein the first encrypted aggregated local model update is an aggregation of at least two encrypted local model updates selected from a plurality of encrypted local model updates, and wherein each encrypted local model update of the plurality of encrypted local model updates is acquired by a different client node of the plurality of client nodes (20, 30, 40) locally training the global machine learning model.

25. The client node (20, 30, 40) as claimed in claim 24, wherein:the processing circuitry (22) is configured to cause the client node (20, 30, 40) to perform the method according to any of claims 15 to 20.

26. A system (100) comprising the server node (10) as claimed in claim 22 or 23; and the client node (20, 30, 40) as claimed in claim 24 or 25.

27. A computer program (1401, 2401) comprising instructions which, when executed by processing circuitry (12, 22), cause the processing circuitry (12, 22) to perform the method according to any of claims 1 to 13, and / or any of claims 14 to 20.

28. A computer program product (14, 24), embodied on a non-transitory machine-readable medium, comprising instructions which are executable by processing circuitry (12, 22) to cause the processing circuitry (12, 22) to perform the method according to any of claims 1 to 13, and / or any of claims 14 to 20.

Images