CN118036708A - Federal forgetting learning method based on history updating and correction - Google Patents

Abstract

The invention discloses a federal forgetting learning method based on history update correction, which updates the history of each turn in the federal learning training stageAre stored and reserved by the server, and when a forgetting request is received, the client performs direction correction training to obtain calibration updateUpdating by calibrationHistorical updates to corresponding runsPerforming correction to obtain updated data after correctionReconstructing a forgetting model by the initial model after multiple times of correction and updating; in the correction process, active forgetting and passive forgetting are carried out simultaneously, the updating of the target client is used for active forgetting, and the other clients are used for passive forgetting. The invention realizes efficient federal forgetting learning, and compared with the existing methods, the model forgetting degree is more thorough, and the damage to the precision of the model is small.

Description

A federated forgetting learning method based on historical update correction

Technical Field

The present invention relates to the field of federated forgetting technology, and in particular to a federated forgetting learning method based on historical update correction.

Background technique

In recent years, federated learning has received increasing attention as a distributed machine learning paradigm that can effectively protect user privacy. Users can collaborate to train a common model without sharing their data. However, with the emergence of various laws and regulations on privacy protection, it is proposed that users have the "right to be forgotten" and can request to delete their information from the global model. In addition, there are growing privacy demands, which force the global model in the federated system to have the ability to forget the information of the target user or a specific data set and its impact. Due to the distributed nature of federated learning, user data is scattered on clients in various places, which makes forgetting learning more difficult than in traditional centralized scenarios. Federated forgetting learning can further protect user privacy, and users can exit the federated system with peace of mind when they want to. In addition, federated forgetting learning can also resist attacks from some malicious users, such as backdoor attacks and data poisoning attacks.

At present, researchers generally divide federated forgetting learning into two main types: precise forgetting and approximate forgetting. Precise forgetting requires that the global model after forgetting is indistinguishable from the retrained model (the training process does not contain the data to be forgotten), while approximate forgetting reduces the requirement, in exchange for a significant improvement in efficiency. Liu et al. proposed a fast retraining method by retraining the global model on the remaining data set using a first-order Taylor expansion approximate loss function. The method proposed by Wu et al. subtracts all historical average updates of the target client from the final global model, and then uses a knowledge distillation method to compensate for the deviation of the learning model caused by the subtraction. Wang et al. proposed a forgetting method based on model pruning, which quantifies the contribution of channels to different categories through word frequency-inverse document frequency. Pruning high-scoring channels can achieve forgetting of certain categories.

The disadvantages of the above-mentioned existing technologies are as follows: (1) The forgetting technology is targeted at the global model to a certain extent and cannot be model-independent and universal. A forgetting method that can be directly transplanted into the federated system is needed, and the client does not need to make additional changes. (2) Retraining and knowledge distillation will take a lot of time and computing power costs. (3) Forgetting technologies such as pruning historical gradient operations and model pruning are destructive to the accuracy of the model, resulting in reduced performance.

Summary of the invention

Purpose of the invention: In view of the above problems, the present invention proposes a federated forgetting learning method based on historical update correction, which realizes efficient federated forgetting learning, makes the model forgetting more thoroughly, and has little damage to the accuracy of the model.

Technical solution: To achieve the purpose of the present invention, the technical solution adopted by the present invention is: a federated forgetting learning method based on historical update correction, comprising the following steps:

(1) In the original federated learning training phase, the historical updates of the client in each interaction round are retained on the server The norm of historical updates is used as the quantization size of the update, that is, the step size of the update.

(2) When a forget request is received, direction correction training is performed. In this stage, client k performs E _c rounds of training locally, accumulating t rounds of interaction, and finally obtains the calibration update of each client and its corresponding round, and sends the calibration update to the server, which is recorded as

The historical updates stored on the server are corrected through direction correction training, and then the forgetting model is reconstructed through the combined effects of passive forgetting and active forgetting. After the forgetting model reconstruction is completed, the target client exits the federated system.

(3) Forgetting learning effect test: Use backdoor attack and member inference attack to jointly evaluate the degree of forgetting and test the forgetting effect.

Furthermore, in step (2), during the direction correction training phase, the clients are divided into target clients and other clients, and the number of training rounds is lower than that of the federated learning training phase; the calibration update obtained by the direction correction training is Get the corresponding historical update by regularization based on the index/> Correction direction; calibrate the historical update to the corrected update by multiplying the correction direction by the step size /> The required forgetting model is aggregated on the server side through several rounds of correction updates. The correction updates of the forgotten target clients are used for active forgetting, and the correction updates of the remaining clients are used for passive forgetting. The strength of active forgetting and passive forgetting is controlled by the forgetting coefficient. Under the joint action of the two kinds of forgetting, the forgetting model is reconstructed.

Furthermore, the direction correction training is expressed as:

in, The update obtained from the direction correction training, /> is the data set corresponding to client k,/> is the forgetting model of round t.

Furthermore, the history update of the passive forgetting part is corrected as follows:

Where k _c is the remaining clients excluding the target client, To correct the passive forgetting part,/> A paradigm that preserves the historical updates on the server side for the remaining clients, /> represents the regularization of the updates obtained by the remaining clients during the direction correction training.

Furthermore, the weighted average of the modified update of the passive forgotten part is:

Among them, _nk is the data sample size of the corresponding client, and the weighted weight is determined by the data sample size.

Furthermore, the historical update of the active forgotten part is corrected as follows:

Among them, k _" is the target client to be forgotten, To correct and update the active forgetting part,/> A paradigm for preserving historical updates on the server side for target clients, /> Represents the regularization of the updates obtained by the target client during direction correction training.

Furthermore, the two kinds of forgetting are aggregated by weighted average of the forgetting coefficient:

Among them, α is the passive forgetting coefficient, β is the active forgetting coefficient, α∈*1,+∞), β∈(0,1).

Furthermore, the forgetting model update process is:

in, is the forgetting model of round t+1,/> is the forgetting model of round t,/> Aggregate updates for passive forgetting and active forgetting by weighted average of forgetting coefficients.

Beneficial effects: Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

The present invention is inspired by neurology and imitates the process of human forgetting, which is caused by the combined effects of passive forgetting and active forgetting. The forgetting learning stage is also divided into two parts: passive forgetting and active forgetting, but they are carried out simultaneously. Active forgetting forces the global model after forgetting to be away from the local model of the target client, while passive forgetting makes the global model after forgetting biased towards the local models of the remaining clients excluding the target client, thereby promoting the data forgetting of the target client.

The present invention only sacrifices part of the storage space on the server side to achieve efficient federated forgetting learning. Compared with many existing methods, the model forgetting degree is more thorough and the damage to the accuracy of the model is small. Experiments show that the present invention shows excellent forgetting effect on multiple data sets (such as MNIST, FMNIST, CIFAR10, STL10). Compared with the existing FedEraser method, the method of the present invention further reduces the success rate of backdoor attacks by about 2%. Therefore, when malicious users carry out backdoor attacks and member inference attacks, the success rate of the attacks can be greatly reduced, so that the security of the entire federated system is improved and more robust.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a basic flow chart of an embodiment of the present invention.

FIG. 2 is a schematic diagram of forgetting learning according to an embodiment of the present invention.

FIG. 3 is a schematic diagram of verifying the forgetting effect according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below through the accompanying drawings and embodiments. However, it should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the scope of the present invention. In addition, in the following description, the description of known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

The overall process of the federated forgetting learning method based on historical update correction described in the present invention is shown in Figures 1 and 2. The method includes: 1. direction correction training; 2. forgetting model reconstruction; 3. federated forgetting learning verification.

Step 1: Direction correction training.

In the original federated learning training phase, the historical updates of the client in each interaction round are kept on the server The norm of historical updates is used as the quantization size of the update, that is, the step size of the update.

When a forget request is received, direction correction training is performed. This stage is similar to the federated learning training stage. Both are performed locally by the client and the updates are sent to the server. The difference is that the training rounds are reduced and the clients are divided into target clients and other clients. Client k performs E _c rounds of training locally and performs t interaction rounds in total. The target client to be forgotten is denoted as k _" and the other clients are denoted as k _c . Finally, the calibration updates of each client and its corresponding round are sent to the server and denoted as Prepare for the subsequent stages.

Step 2: Reconstruct the forgotten model to obtain the global model after forgotten learning.

Step 2.1: Correct the historical update. The calibration update obtained by direction correction training is used to guide the direction of the original historical update. As the size of the change in the forgetting model parameters, multiplied by the calibration update regularization is the corrected update.

Step 2.2: The correction updates from different clients are classified. The correction updates of the forgetting target client are used for active forgetting, while the correction updates of the remaining clients are used for passive forgetting. The strength of the two is controlled by the forgetting coefficient. The combined effect of the two kinds of forgetting makes the information of the relevant data and its influence gradually disappear in the global model.

Step 2.3: After repeating steps 2.1 to 2.2 for T _" rounds, the forgetting model is finally rebuilt, the target client's data is gradually cleared in this process, and the accuracy will gradually return to the level before forgetting learning. Once the forgetting model obtains the target client, it can exit. T _" is generally less than half of the rounds in the federated learning training phase.

Step 3: Federated forgetting learning verification.

Malicious users will be simulated to launch backdoor attacks and member inference attacks on different data sets. If the success rate of the attack is greatly reduced, it means that the forgetting learning effect is good.

In this embodiment, step 1 may adopt the following preferred solution:

The update obtained by the target client direction correction training is recorded as The updates obtained from the other client direction correction training are recorded as/> The first round of training will start with the initialized global model, and thereafter the global model obtained in the previous round will be used as the initial model for the next round.

Direction correction training is expressed as:

in, is the data set corresponding to client k,/> is the forgetting model of round t,/> Updates obtained from direction correction training.

In this embodiment, step 2 may adopt the following preferred solution:

The history update of the passive forgetting part has been corrected as follows:

Where k _c is the remaining clients excluding the target client, The paradigm of historical updates of the remaining clients that have removed the target client and are retained on the server side, /> It represents the regularization of the updates obtained by the remaining clients in the direction correction training. The multiplication of the two is the correction update of the passively forgotten part.

The weighted average of the correction update for the passive forgotten part is:

Where k _c is the remaining clients excluding the target client. n _k is the sample size of the corresponding client, and the weight is determined by the data sample size.

The historical update of the active forgetting part has been corrected as follows:

Here, k _" represents the target client to be forgotten. A paradigm that represents the historical updates of the target client, /> It represents the regularization of the update obtained by the target client in the direction correction training. The multiplication of the two is the correction update of the active forgetting part.

The two types of forgetfulness are weighted and aggregated through the forgetting coefficient as follows:

Among them, α is the passive forgetting coefficient, β is the active forgetting coefficient. Similar to human forgetting, passive forgetting dominates forgetting and is stronger than active forgetting. Therefore, α∈*1,+∞) and β∈(0,1).

The updating process of the forgetting model is:

in, is the forgetting model of round t, which means that the forgetting model obtained in the previous round is used as the forgetting model to be updated in this round;/> It is the update obtained by weighted aggregation of two kinds of forgetfulness through forgetting coefficient;/> The forgetting model of the round is the forgetting model obtained in each round of this method; after repeating T _" rounds, the forgetting model is finally reconstructed.

In this embodiment, step 3 may adopt the following preferred solution:

In a backdoor attack, a malicious user will add a trigger (such as a crosshair mark) to a specific location of a part of the samples in his dataset during the model training phase and modify the sample label. After the model training is completed, the sample with the trigger is used for testing. If the model mistakenly determines that the label is modified by the malicious user, the attack is considered successful. If the success rate of the backdoor attack is extremely low after this forgetting method, it means that the data information of the target client has been forgotten in the model.

Membership inference attack can express the degree of data information remaining in the model as the possibility that the membership inference attack can infer. In the membership inference attack, a classification attacker will be trained to judge the probability of whether the data is member data. If the probability given by this forgetting method drops significantly, it means that the information of the target data remains very little in the global model.

The above two attack methods are not only used as verification indicators of forgetting, but also verify that in practical applications this method can forget and clear the contaminated data of real malicious users, resist related attacks and enhance the security of the entire federal system.

As shown in Figure 3, after the federated learning training phase, the forgetting effect verification phase is carried out. Taking the backdoor attack as an example, the backdoor attack is a targeted model poisoning attack. In the federated learning training phase, the attack success rate needs to be increased to a high enough level to prepare for the subsequent verification phase. During the federated learning training, the target user to be forgotten is simulated as a malicious user. When the malicious user is training locally, he adds a backdoor trigger to a part of his own data set samples and modifies the label of the sample. The purpose is to make the model make a wrong judgment on data with certain specific features, but the model will not affect the main task. For example, if the model recognizes a horse as a car, it will only be mistakenly recognized as a car when a horse picture with a trigger is input, and the model's ability to detect other pictures will not be affected. Through multiple rounds of federated training, the corresponding backdoor is in the global model. Due to the characteristics of federated learning, users can only access their own data sets, and finally the global model is generated by aggregating the updates of various clients through the server. It can be said that the malicious user has changed the entire global model by himself.

In the forgetting effect verification stage, the original category image with the changed label (such as a horse image) with a trigger is input into the model for detection. If it is mistakenly identified as a category modified by a malicious user (such as a car), the attack is considered successful. Backdoor attacks do not affect the model performance of the global model under regular inputs, and only distort the prediction results when there is a specific input with a trigger. Therefore, when a simulated malicious user performs a backdoor attack, this method will forget the data information of the malicious user in the global model, and the influence of the backdoor data will be eliminated, which will ultimately greatly reduce the success rate of the attack, thus verifying the effectiveness of this method in forgetting learning in the federated learning scenario.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (8)

1. A federated forgetting learning method based on historical update correction, characterized by comprising the following steps: (1) In the original federated learning training phase, the historical updates of the client in each interaction round are retained on the server Use the historical update norm as the updated quantization size, i.e. the updated step size; (2) When a forget request is received, direction correction training is performed. In this stage, client k performs E _c rounds of training locally, accumulating t rounds of interaction, and finally obtains the calibration update of each client and its corresponding round, and sends the calibration update to the server, which is recorded as Correct the historical updates stored on the server through direction correction training, and then reconstruct the forgetting model through the combined effects of passive forgetting and active forgetting; after the forgetting model reconstruction is completed, the target client exits the federated system; (3) Forgetting learning effect test: Use backdoor attack and member inference attack to jointly evaluate the degree of forgetting and test the forgetting effect. 2. The method for federated forgetting learning based on historical update correction according to claim 1 is characterized in that, in step (2), in the direction correction training phase, the clients are divided into target clients and other clients, and the number of training rounds is lower than that in the federated learning training phase; Update the calibration obtained by direction correction training Get the corresponding historical update by regularization based on the index/> Correction direction; calibrate the historical update to the corrected update by multiplying the correction direction by the step size /> The required forgetting model is aggregated on the server side through several rounds of correction updates; The correction update of the forgotten target client is used for active forgetting, and the correction update of the remaining clients is used for passive forgetting. The strength of active forgetting and passive forgetting is controlled by the forgetting coefficient. Under the joint action of the two kinds of forgetting, the forgetting model is reconstructed. 3. The method for federated forgetting learning based on historical update correction according to claim 1, characterized in that the direction correction training is expressed as: in, The update obtained from the direction correction training, /> is the data set corresponding to client k,/> is the forgetting model of round t. 4. The method for federated forgetting learning based on historical update correction according to claim 2, characterized in that the historical update correction of the passively forgotten part is: Where k _c is the remaining clients excluding the target client, To correct the passive forgetting part,/> A paradigm that preserves the historical updates on the server side for the remaining clients, /> represents the regularization of the updates obtained by the remaining clients during the direction correction training. 5. The method for federated forgetting learning based on historical update correction according to claim 4 is characterized in that the weighted average of the correction update of the passive forgotten part is: Among them, _nk is the data sample size of the corresponding client, and the weighted weight is determined by the data sample size. 6. The method for federated forgetting learning based on historical update correction according to claim 5 is characterized in that the historical update correction of the actively forgotten part is: Among them, k _u is the target client to be forgotten, To correct and update the active forgetting part,/> A paradigm for preserving historical updates on the server side for target clients, /> Represents the regularization of the updates obtained by the target client during direction correction training. 7. The method for federated forgetting learning based on historical update correction according to claim 6 is characterized in that the two kinds of forgetting are aggregated by weighted average of forgetting coefficients as follows: Among them, α is the passive forgetting coefficient, β is the active forgetting coefficient, α∈[1,+∞), β∈(0,1). 8. The method for federated forgetting learning based on historical update correction according to claim 1, characterized in that the forgetting model updating process is: in, is the forgetting model of round t+1,/> is the forgetting model of round t,/> Aggregate updates for passive forgetting and active forgetting by weighted average of forgetting coefficients.