Secure Multi-Party Computation with Clipped, Noisy Gradients
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Secure multi-party computation methods provide privacy protection during the training of machine learning models but fail to protect the privacy of the trained models, making them susceptible to inference and model inversion attacks.
Innovation Solution
Integrate differential privacy technology by adding noise disturbance to gradient data during the training process to protect the privacy of trained machine learning models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure multi-party computation is used to protect data privacy during model training, then data confidentiality is improved, but the trained model remains vulnerable to inference attacks and model inversion attacks
Solution Approach 1:
The patent applies preliminary action by adding noise to gradient data before the model training process completes. Specifically, noise is added to the gradient data during the training phase, which preliminarily protects the model parameters from being reconstructed through inversion attacks on the trained model. This proactive measure ensures that even after training, the model remains protected against inference attacks.
Solution Approach 2:
The patent uses noise as an intermediary element between the gradient data and the model parameters. By introducing this intermediary (noise) into the gradient data during training, the direct relationship between the original data and the final model parameters is obscured, thereby preventing attackers from performing model inversion attacks on the trained model while still allowing legitimate training to proceed.
2Reliability
If noise is added to gradient data to protect model privacy, then model confidentiality is improved, but training accuracy may deteriorate
Solution Approach 1:
The patent applies parameter changes by carefully controlling the noise scale parameter (typically denoted as sigma or std) in the differential privacy mechanism. By adjusting this parameter, the system finds an optimal balance where enough noise is added to protect model privacy against inversion attacks, but not so much that it degrades training accuracy. This parameter tuning allows the system to adapt the level of protection versus accuracy trade-off based on specific requirements.
Data Source
AI summary
Embodiments of this specification disclose secure multi-party computation for privacy protection. In an implementation, a method includes obtaining a fragment of first gradient data and a fragment of noise data, where the first gradient data is gradient data of a loss function. Based on the fragment of first gradient data by performing secure multi-party computation with another participant, obtaining a fragment of second gradient data, where the second gradient data is gradient data obtained after the first gradient data is clipped. Based on the fragment of second gradient data and the fragment of noise data, determining a fragment of third gradient data, where the third gradient data is the second gradient data with the noise data added. A fragment of a model parameter is determined based on the fragment of third gradient data.