[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

CN118036708A - Federal forgetting learning method based on history updating and correction - Google Patents

Federal forgetting learning method based on history updating and correction Download PDF

Info

Publication number
CN118036708A
CN118036708A CN202410191278.5A CN202410191278A CN118036708A CN 118036708 A CN118036708 A CN 118036708A CN 202410191278 A CN202410191278 A CN 202410191278A CN 118036708 A CN118036708 A CN 118036708A
Authority
CN
China
Prior art keywords
forgetting
correction
update
federal
model
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202410191278.5A
Other languages
Chinese (zh)
Inventor
黄文殊
殷常春
方黎明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Research Institute Of Nanjing University Of Aeronautics And Astronautics
Nanjing University of Aeronautics and Astronautics
Original Assignee
Shenzhen Research Institute Of Nanjing University Of Aeronautics And Astronautics
Nanjing University of Aeronautics and Astronautics
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Research Institute Of Nanjing University Of Aeronautics And Astronautics, Nanjing University of Aeronautics and Astronautics filed Critical Shenzhen Research Institute Of Nanjing University Of Aeronautics And Astronautics
Priority to CN202410191278.5A priority Critical patent/CN118036708A/en
Publication of CN118036708A publication Critical patent/CN118036708A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06NCOMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00Computing arrangements based on biological models
    • G06N3/02Neural networks
    • G06N3/08Learning methods
    • G06N3/098Distributed learning, e.g. federated learning

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • General Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Evolutionary Computation (AREA)
  • Artificial Intelligence (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses a federal forgetting learning method based on history update correction, which updates the history of each turn in the federal learning training stageAre stored and reserved by the server, and when a forgetting request is received, the client performs direction correction training to obtain calibration updateUpdating by calibrationHistorical updates to corresponding runsPerforming correction to obtain updated data after correctionReconstructing a forgetting model by the initial model after multiple times of correction and updating; in the correction process, active forgetting and passive forgetting are carried out simultaneously, the updating of the target client is used for active forgetting, and the other clients are used for passive forgetting. The invention realizes efficient federal forgetting learning, and compared with the existing methods, the model forgetting degree is more thorough, and the damage to the precision of the model is small.

Description

Federal forgetting learning method based on history updating and correction
Technical Field
The invention relates to the technical field of federal forgetting, in particular to a federal forgetting learning method based on history updating and correction.
Background
Federal learning has received increasing attention in recent years as a distributed machine learning paradigm that effectively protects user privacy, where users can collaboratively train a common model without sharing their data. However, with various laws and regulations regarding privacy protection, it is proposed that users possess "forgotten rights" and may require that information about themselves be deleted from the global model. There is also an increasing need for privacy, which forces global models in federal systems to have the ability to forget the information of the target user or a specific data set and its impact. And because of the distributed characteristic of federal learning, user data are scattered on clients in various places, and the difficulty of forgetting learning is higher than that of the traditional centralized scene. The federal forgetting learning can further protect the privacy of the user, and the user can safely exit when the user wants to exit the federal system, and in addition, the federal forgetting learning can also resist attacks of some malicious users, such as back door attacks and data poisoning attacks.
Currently researchers generally divide federal forgetfulness learning into two main categories: accurate forgetting and approximate forgetting. Accurate forgetting requires that the forgotten global model is indistinguishable from the model which is retrained (does not contain data to be forgotten in the training process), while the requirement of approximate forgetting is reduced, so that the efficiency is greatly improved. Liu et al propose a method of fast retraining by using a first order Taylor to develop an approximate loss function to retrain the global model on the remaining dataset. The method proposed by Wu et al subtracts all historical average updates of the target client from the final global model and then uses knowledge distillation to compensate for the deviation of the learning model caused by the subtraction. Wang et al propose a forgetting method based on model pruning, the contribution of channels to different categories is quantified through word frequency-inverse document frequency, and forgetting of certain categories can be realized by cutting high-score channels.
The drawbacks of the above prior art are as follows: (1) The forgetting technology has a certain pertinence to the global model, and can not achieve model independence and universality. There is a need for a forgetting method that can directly migrate a federal system without requiring additional changes to the client. (2) Retraining and knowledge distillation can take significant time and effort costs. (3) Forgetting techniques such as pruning of historical gradients and model pruning have some damaging effect on the accuracy of the model, resulting in reduced performance.
Disclosure of Invention
The invention aims to: aiming at the problems, the invention provides the federal forgetting learning method based on the history updating and correction, which realizes efficient federal forgetting learning, has more thorough model forgetting degree and has little damage to the precision of the model.
The technical scheme is as follows: in order to achieve the purpose of the invention, the technical scheme adopted by the invention is as follows: a federal forgetting learning method based on history update correction comprises the following steps:
(1) In the original federal learning training phase, the history update of the client side of each interactive round is reserved on the server The historical update norms are utilized as the quantization size of the update, i.e., the step size of the update.
(2) When a forgetting request is received, direction correction training is carried out, at this stage, the client k carries out E c round training locally, t interactive rounds are accumulated, and finally, the calibration update of each client and the corresponding round is obtained, and the calibration update is sent to a server and recorded as
And (3) updating the history stored on the correction server through direction correction training, and reconstructing a forgetting model under the combined action of passive forgetting and active forgetting. And after the forgetting model is reconstructed, the target client exits the federal system.
(3) Forgetting learning effect test: and jointly evaluating the forgetting degree by utilizing a back door attack and member inference attack mode, and checking the forgetting effect.
Further, in the step (2), the direction correction training stage, the client is divided into a target client and other clients, and the training turn is lower than the federal learning training stage; updating the calibration obtained by the direction correction trainingObtaining corresponding history update/>, through regularization, according to the indexIs used for correcting the direction of the correction; calibrating the history update to a corrected update/>, using the multiplication of the correction direction and the step sizeThe correction and update are utilized to aggregate a needed forgetting model at a server through a plurality of rounds; the correction update of the forgetting target client is used for active forgetting, the correction update of the other clients is used for passive forgetting, and the strength of the active forgetting and the passive forgetting is controlled by the forgetting coefficient; under the combined action of the two forgetting modes, a forgetting model is reconstructed.
Further, the direction correction training is expressed as:
Wherein, Update obtained for direction correction training,/>For the data set corresponding to client k,/>Is a forgetting model of t rounds.
Further, the history update correction of the passive forgetting part is as follows:
Where k c is the remaining clients excluding the target client, For the correction and update of passive forgetting part,/>Maintaining a paradigm of history updates at the server side for the remaining clients,/>Representing regularization of the remaining clients in the update resulting from the direction correction training.
Further, the correction update weighted average of the passive forgetting part is:
Where n k is the data sample size of the corresponding client, and the weighted weight is determined by the data sample size.
Further, the history update correction of the active forgetting part is as follows:
Where k " is the target client to be forgotten, For correction and update of active forgetting part,/>Maintaining a paradigm of history updates at the server side for the target client,/>Representing regularization of the update of the target client in the direction correction training.
Further, the two forgetting processes are aggregated by weighted average of forgetting coefficients:
Wherein alpha is a passive forgetting coefficient, beta is an active forgetting coefficient, alpha epsilon 1, ++ infinity), beta epsilon (0, 1).
Further, the forgetting model updating process comprises the following steps:
Wherein, Forgetting model for t+1 rounds,/>Forgetting model for t rounds,/>The aggregate updates are weighted-average by forgetting coefficients for passive forgetting and active forgetting.
The beneficial effects are that: compared with the prior art, the technical scheme of the invention has the following beneficial technical effects:
The invention is inspired from neurology, and imitates that the forgetting is generated under the combined action of passive forgetting and active forgetting in the human forgetting process, and the forgetting learning stage is divided into two parts, namely passive forgetting and active forgetting, but is carried out simultaneously. Active forgetting forces the forgotten global model to be far away from the local model of the target client, while passive forgetting makes the forgotten global model biased to the local model of the rest of the clients of the target client, thereby promoting the data forgetting of the target client.
According to the invention, only part of storage space is sacrificed at the server end, so that efficient federal forgetting learning can be realized, compared with a plurality of existing methods, the model forgetting degree is more thorough, and the damage to the precision of the model is small. Experiments show that the method has excellent forgetting effect on a plurality of data sets (such as MNIST, FMNIST, CIFAR and STL 10), and compared with the existing FEDERASER method, the success rate of the method for the back door attack is further reduced by about 2%. Therefore, when a malicious user carries out a backdoor attack and a member inference attack, the success rate of the attack can be greatly reduced, so that the security of the whole federal system is improved, and the system has robustness.
Drawings
FIG. 1 is a schematic diagram of the basic flow of an embodiment of the present invention.
Fig. 2 is a schematic diagram of forgetting learning according to an embodiment of the present invention.
FIG. 3 is a schematic diagram of the embodiment of the invention for verifying the forgetting effect.
Detailed Description
The present invention will be further described in detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the detailed description and specific examples, while indicating the invention, are intended for purposes of illustration only and are not intended to limit the scope of the invention. In addition, in the following description, descriptions of well-known structures and techniques are omitted so as not to unnecessarily obscure the present invention.
The invention relates to a federal forgetting learning method based on history update correction, the general flow is shown in figures 1 and 2, the method comprises: 1. training the direction correction; 2. reconstructing a forgetting model; 3. federal forgetting learning verification.
Step 1: and (5) training the direction correction.
In the original federal learning training phase, the history update of the client side of each interactive round is reserved on the serverThe historical update norms are utilized as the quantization size of the update, i.e., the step size of the update.
When a forgetting request is received, direction correction training is carried out, and the stage is similar to the federal learning training stage, wherein the client performs training locally, updates are sent to the server, and the difference is that training rounds are reduced, and the client is divided into a target client and rest clients. The client k performs E c round training locally, t interactive rounds are accumulated, wherein a target client needing forgetting is marked as k ", the other clients are marked as k c, and finally, calibration update of each client and the corresponding round is obtained and sent to a server and marked asReady for the subsequent stages.
Step 2: reconstructing the forgetting model to obtain a global model after forgetting learning.
Step 2.1: and correcting the historical update, wherein the calibration update obtained by the direction correction training is used for guiding the direction of the original historical update. History update normsAs the magnitude of the forgetting model parameter change, the regularization at convenience with the calibration update is a corrected update.
Step 2.2: the correction updates from different clients are classified, the correction update of the forgetting target client is used for active forgetting, the correction update of the other clients is used for passive forgetting, and the strength of the correction update are controlled by forgetting coefficients. The combined action of the two forgetting causes the information of the relevant data and its effect to fade out in the global model.
Step 2.3: after repeating the steps 2.1-2.2 for T " rounds, the forgetting model is finally reconstructed, the data of the target client is gradually cleared in the process, and the accuracy is gradually restored to be before forgetting learning. And the client can exit once the forgetting model obtains the target client. T " is typically less than half of the run of the Federal learning training phase.
Step 3: federal forgetting learning verification.
The method has the advantages that the method simulates malicious users to launch back door attacks and member inference attacks on different data sets, and if the success rate of the attacks is greatly reduced, the forgetting learning effect is good.
In this embodiment, the following preferred scheme may be adopted in step 1:
the update obtained by the target client side direction correction training is recorded as While the updates obtained by the direction correction training of the rest clients are recorded as/>The first round of training will begin training using the initialized global model, after which the global model obtained for the previous round is the initial model for the next round.
The direction correction training is expressed as:
Wherein, For the data set corresponding to client k,/>Forgetting model for t rounds,/>The updates obtained for the direction correction training.
In this embodiment, the following preferred scheme may be adopted in step 2:
The history update correction of the passive forgetting part is as follows:
Where k c is the remaining clients excluding the target client, In order to remove the remaining client-side original retained history update paradigm of the target client-side, the history update paradigm of the server-side is/areAnd (3) representing regularization of the update obtained by the direction correction training of the rest client, and multiplying the regularization by the regularization to obtain the correction update of the passive forgetting part.
The correction update weighted average of the passive forgetting part is:
Where k c is the remaining clients excluding the target client. n k is the sample size of the corresponding client, and the weighted weight is determined by the data sample size.
The history update and correction of the active forgetting part is as follows:
Where k " represents the target client to forget. Paradigm representing historical updates of target clients,/>And (3) representing regularization of the update obtained by the target client in the direction correction training, and multiplying the regularization by the regularization to obtain the correction update of the active forgetting part.
The two forgetting weights are aggregated into:
Wherein alpha is a passive forgetting coefficient, beta is an active forgetting coefficient, similar to human forgetting, passive forgetting takes the dominant role of forgetting, to a greater extent than active forgetting, therefore, alpha is epsilon 1, +++) and β∈ (0, 1).
The updating process of the forgetting model comprises the following steps:
Wherein, The forgetting model of the t round is the forgetting model which represents that the forgetting model obtained in the previous round is used as the forgetting model which is updated in the secondary round; /(I)Updating obtained after the weighted aggregation of the forgetting coefficients for the two forgetting types; /(I)The forgetting model of the turn is the forgetting model obtained by each turn in the method; after repeating T " rounds, the forgetting model is eventually reconstructed.
In this embodiment, the following preferred scheme may be adopted in step 3:
In a backdoor attack, a malicious user may add a trigger (e.g., a cross-hair tag) to a portion of the sample specific locations in his/her data set and modify the sample's tag during the model training phase. After model training is completed, a sample with a trigger is used for testing, and if the model is wrongly judged to be a label modified by a malicious user, the attack is considered to be successful. And if the success rate of the back door attack is extremely low after the forgetting method is adopted, the data information of the target client is forgotten in the model.
Membership inference attacks can express the degree of residuals of data information in a model as the likelihood that membership inference attacks can infer. In the member inference attack, a classification attacker is trained to judge whether the data is the probability of member data, and if the probability given by the forgetting method is greatly reduced, the information of the target data is indicated to have little residue in the global model.
The two attack methods are not only used as forgotten verification indexes, but also verify that the method can forget to remove the pollution data of the true malicious user in the practical application, and resist the related attack to enhance the safety of the whole federal system.
As shown in fig. 3, the forgetting effect verification stage is performed after the federal learning training stage, for example, a back door attack, which is a directional model poisoning attack, and the success rate of the attack needs to be raised high enough to prepare for the later verification stage during the federal learning training stage. And simulating the target user needing to be forgotten as a malicious user during federal learning training. When a malicious user trains locally, a part of own data set samples are added with a back door trigger, and the labels of the samples are modified. The purpose is to have the model make an erroneous determination of data with some specific characteristics, but the model does not have an impact on the primary task. For example, let the model recognize a horse as an automobile, only when a horse picture with a trigger is input will the horse be erroneously recognized as an automobile, and the ability of the model to detect other pictures will not be affected. Through multiple rounds of federal training, there is a corresponding backdoor in the global model. Because of the characteristic of federal learning, users can only access own data sets, and finally update of all clients is aggregated through a server to generate a global model, so that malicious users can change the whole global model through a first force.
In the forgetting effect verification stage, an original category picture (such as a picture of a horse) with a changed tag of a trigger is input into a model for detection, and if the original category picture is mistakenly identified as a category (such as an automobile) modified by a malicious user, the attack is considered to be successful. Back-gate attacks do not affect the model performance of the global model under normal input, only with specific inputs of triggers will the prediction result be distorted. Therefore, when the simulated malicious user carries out the back door attack, the method forgets the data information of the malicious user in the global model, so that the influence of the back door data is eliminated, the attack success rate is finally greatly reduced, and the effectiveness of forgetting learning of the method in the federal learning scene is verified.
The above description is only of the preferred embodiments of the present invention and is not intended to limit the present invention, but various modifications and variations can be made to the present invention by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (8)

1. The federal forgetting learning method based on history updating and correction is characterized by comprising the following steps of:
(1) In the original federal learning training phase, the history update of the client side of each interactive round is reserved on the server Taking the norm of the historical update as the quantization size of the update, namely the step size of the update;
(2) When a forgetting request is received, direction correction training is carried out, at this stage, the client k carries out E c round training locally, t interactive rounds are accumulated, and finally, the calibration update of each client and the corresponding round is obtained, and the calibration update is sent to a server and recorded as
The history updating stored on the server is corrected through direction correction training, and then a forgetting model is reconstructed under the combined action of passive forgetting and active forgetting; after the forgetting model is reconstructed, the target client exits the federal system;
(3) Forgetting learning effect test: and jointly evaluating the forgetting degree by utilizing a back door attack and member inference attack mode, and checking the forgetting effect.
2. The federal forgetting learning method based on history update correction according to claim 1, wherein in the step (2), the direction correction training phase, the clients are divided into the target client and the remaining clients, and the training round is lower than the federal learning training phase;
Updating the calibration obtained by the direction correction training Obtaining corresponding history update/>, through regularization, according to the indexIs used for correcting the direction of the correction; calibrating the history update to a corrected update/>, using the multiplication of the correction direction and the step sizeThe correction and update are utilized to aggregate a needed forgetting model at a server through a plurality of rounds;
the correction update of the forgetting target client is used for active forgetting, the correction update of the other clients is used for passive forgetting, and the strength of the active forgetting and the passive forgetting is controlled by the forgetting coefficient; under the combined action of the two forgetting modes, a forgetting model is reconstructed.
3. The method for learning federal forgetfulness based on history update correction according to claim 1, wherein the direction correction training is expressed as:
Wherein, Update obtained for direction correction training,/>For the data set corresponding to client k,/>Is a forgetting model of t rounds.
4. The federal forgetting learning method based on history update correction according to claim 2, wherein the history update correction of the passive forgetting portion is:
Where k c is the remaining clients excluding the target client, For the correction and update of passive forgetting part,/>Maintaining a paradigm of history updates at the server side for the remaining clients,/>Representing regularization of the remaining clients in the update resulting from the direction correction training.
5. The method for federal forgetting learning based on history update correction of claim 4, wherein the correction update weighted average of the passive forgetting portion is:
Where n k is the data sample size of the corresponding client, and the weighted weight is determined by the data sample size.
6. The federal forgetting learning method based on history update correction according to claim 5, wherein the history update correction of the active forgetting portion is:
Where k u is the target client to be forgotten, For correction and update of active forgetting part,/>Maintaining a paradigm of history updates at the server side for the target client,/>Representing regularization of the update of the target client in the direction correction training.
7. The method for learning federal forgetting based on history update correction according to claim 6, wherein two forgetting types are aggregated by weighted average of forgetting coefficients as:
Wherein, alpha is passive forgetting coefficient, beta is active forgetting coefficient, alpha is [1, + ], beta is [ 0,1 ].
8. The federal forgetting learning method based on history update correction according to claim 1, wherein the forgetting model update process is:
Wherein, Forgetting model for t+1 rounds,/>Forgetting model for t rounds,/>The aggregate updates are weighted-average by forgetting coefficients for passive forgetting and active forgetting.
CN202410191278.5A 2024-02-21 2024-02-21 Federal forgetting learning method based on history updating and correction Pending CN118036708A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202410191278.5A CN118036708A (en) 2024-02-21 2024-02-21 Federal forgetting learning method based on history updating and correction

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202410191278.5A CN118036708A (en) 2024-02-21 2024-02-21 Federal forgetting learning method based on history updating and correction

Publications (1)

Publication Number Publication Date
CN118036708A true CN118036708A (en) 2024-05-14

Family

ID=90999889

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202410191278.5A Pending CN118036708A (en) 2024-02-21 2024-02-21 Federal forgetting learning method based on history updating and correction

Country Status (1)

Country Link
CN (1) CN118036708A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118410860A (en) * 2024-07-03 2024-07-30 杭州海康威视数字技术股份有限公司 Efficient knowledge editing method and device in federal learning environment

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118410860A (en) * 2024-07-03 2024-07-30 杭州海康威视数字技术股份有限公司 Efficient knowledge editing method and device in federal learning environment

Similar Documents

Publication Publication Date Title
US11636314B2 (en) Training neural networks using a clustering loss
EP3602419B1 (en) Neural network optimizer search
US20150161529A1 (en) Identifying Related Events for Event Ticket Network Systems
US11775830B2 (en) Training more secure neural networks by using local linearity regularization
CN112819023A (en) Sample set acquisition method and device, computer equipment and storage medium
CN111639291A (en) Content distribution method, content distribution device, electronic equipment and storage medium
CN112163637B (en) Image classification model training method and device based on unbalanced data
US20220222578A1 (en) Method of training local model of federated learning framework by implementing classification of training data
CN110717582B (en) Sampling from a generator neural network using a discriminator neural network
CN118036708A (en) Federal forgetting learning method based on history updating and correction
CN115293235A (en) Method for establishing risk identification model and corresponding device
CN112698977B (en) Method, device, equipment and medium for positioning server fault
CN113220883B (en) Text classification method, device and storage medium
CN113157993A (en) Network water army behavior early warning model based on time sequence graph polarization analysis
CN111274791B (en) Modeling method of user loss early warning model in online home decoration scene
CN114595329B (en) System and method for extracting few sample events of prototype network
CN114741515B (en) Social network user attribute prediction method and system based on graph generation
CN116956171A (en) Classification method, device, equipment and storage medium based on AI model
CN115393100A (en) Resource recommendation method and device
CN112766494A (en) Safety evaluation method for knowledge distillation of pre-training model
Susyanto et al. Semiparametric likelihood‐ratio‐based biometric score‐level fusion via parametric copula
CN117056550B (en) Long-tail image retrieval method, system, equipment and storage medium
CN112541669A (en) Risk identification method, system and device
CN110362831A (en) Target user's recognition methods, device, electronic equipment and storage medium
CN118606480B (en) Multi-field emotion classification method and system based on knowledge migration

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination