Federated Learning Security via Prediction Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Federated learning technologies face challenges in ensuring data security, as model updates generated during the training of machine learning models can potentially reveal underlying data, and existing methods lack effective measures to prevent reverse engineering of these updates.
Innovation Solution
Implement techniques to reconstruct predictions from model updates using matrix factorization and a known vocabulary of the projection output layer, generating measures that indicate the degree of conformity between reconstructions and original predictions, thereby assessing the security provided by specific loss techniques and selecting the most secure techniques for use in federated learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If model updates are transmitted in federated learning to enable global model training, then model training effectiveness is improved, but data security deteriorates because model updates can be reverse engineered to reveal underlying data
Solution Approach 1:
The patent introduces an intermediary evaluation system that acts as a mediator between model updates and data security assessment. This system reconstructs predictions from model updates using matrix factorization and compares them with actual predictions, serving as a security verification layer without interfering with the federated learning training process itself.
Solution Approach 2:
The patent implements a feedback mechanism where the security evaluation results (measuring reconstruction accuracy) are used to determine whether model updates should be transmitted or rejected. This creates a closed-loop system where security assessment directly influences the transmission decision, preventing potentially compromising updates from being shared.
2Object-affected harmful factors
If security measures are strengthened to prevent reverse engineering of model updates, then data security is improved, but model training effectiveness deteriorates due to reduced ability to utilize model updates
Solution Approach 1:
The patent applies partial action by implementing security evaluation on a selective basis rather than universally blocking all model updates. The system performs reconstruction evaluation only when needed and allows model updates to proceed when they pass the security threshold, thus applying security measures partially rather than excessively.
Solution Approach 2:
The patent changes the parameter of security verification from binary (transmit/reject) to a continuous measurement (reconstruction accuracy metric). By evaluating the degree of conformity between reconstructed and actual predictions, the system can make nuanced decisions about model update transmission based on quantified security risk levels.
3Difficulty of detecting and measuring
If reconstruction techniques are used to evaluate security, then data security assessment capability is improved, but computational complexity deteriorates due to matrix factorization requirements
Solution Approach 1:
The patent segments the security evaluation process into distinct modular components: model update reception, matrix factorization-based reconstruction, prediction comparison, and security decision-making. This segmentation allows each component to be optimized independently and facilitates parallel processing where applicable.
Solution Approach 2:
The patent creates a computational copy of the prediction through matrix factorization reconstruction rather than directly analyzing the original data. This copying approach allows security evaluation to be performed on the reconstructed version while preserving the original model updates for potential legitimate use if they pass security checks.
Data Source
AI summary
Implementations relate to ascertaining to what extent predictions, generated using a machine learning model, can be effectively reconstructed from model updates, where the model updates are generated based on those predictions and based on applying a particular loss technique (e.g., a particular cross-entropy loss technique). Some implementations disclosed generate measures that each indicate a degree of conformity between a corresponding reconstruction, generated using a corresponding model update, and a corresponding prediction. In some of those implementations, the measures are utilized in determining whether to utilize the particular loss technique (utilized in generating the model updates) in federated learning of the machine learning model and/or of additional machine learning model(s).