【作者】 陈林；

【导师】 丁晓锋；

【作者基本信息】 华中科技大学 ， 计算机软件与理论， 2024， 博士

【摘要】 联邦学习作为新兴分布式机器学习范式,允许多方在不共享原始数据下共同训练模型,但实际中仍面临如梯度攻击等安全威胁。差分隐私因其理论性被广泛用于机器学习中的隐私保护。针对联邦学习中各阶段的不同挑战和隐私需求,即本地训练中数据的异构性和机密性、参数上传中通信的有限性和安全性以及参数聚合中隐私-实用性平衡,设计对应的差分隐私联邦学习算法来实现性能和安全保障。具体包括以下三方面:在本地训练阶段,客户端敏感且异构的数据对安全高效的模型训练带来挑战。考虑到数据异构加剧部分客户端采样所引起的方差,提出无放回均匀采样以保证客户端被选中的次数相同,从而解决采样方差问题。为保护本地数据的隐私,提出基于高斯噪声的梯度扰动方法并利用先进的截断集中差分隐私定义来紧密记录隐私损耗。此外,鉴于本地模型由客户端间异构数据训练所得,聚合的全局模型与本地模型之间存在差异。为同时应对模型偏差和附加噪声,提出基于服务器端自适应优化的改进算法以提高训练速度和效率。算法的收敛性和隐私性由理论分析所得的收敛界和差分隐私级别来衡量并通过实验验证,异构数据集下所提算法比相关算法收敛更快且在测试准确度上至少提升5%。在参数上传阶段,客户端与服务器之间安全信息共享和有限通信预算对算法的隐私性和通信效率提出挑战。传统的均匀客户端采样通过减少参与聚合的客户端数量来降低通信损耗,但忽略某些客户端对全局模型影响更大,导致无用客户端的参与并降低模型训练速度和通信效率,因此提出重要性采样方法,通过选择少量重要客户端来进一步减少通信和保证性能。具体而言,先利用模型更新的范数来评估客户端重要性,再最小化完全采样与所用采样之间方差来计算客户端被选中的概率。隐私方面,鉴于信息共享比本地训练需要更强的隐私保护,除改进隐私定义外,还使用更紧致刻画隐私损耗尾概率的双曲正弦-高斯机制。算法的收敛性和隐私性由收敛界和差分隐私级别来反映并通过实验验证,所提算法比相关算法实现10倍的通信效率提升和获得至少8%的测试准确度提升。在参数聚合阶段,广泛使用的本地化和集中式差分隐私模型存在隐私-实用性平衡问题,因此提出具有隐私放大性质的混洗模型来解决。但增加的混洗层引起额外的通信消耗,需在联邦学习通用模型,即分布式均值估计下考虑通信压缩。具体而言,将最小随机编码算法的输入矢量扩展至有界设置,提出高隐私、低通信和精确最优误差的隐私压缩机制。此外,在仅使用混洗层的最小信任框架下,提出自主客户端参与方法并利用客户端参与的随机性来进一步保护隐私。混洗模型下多重隐私放大会造成复杂的整体隐私分析,故采用基本的随机响应来实现本地隐私,同时分析过程也适用于基于梯度扰动的高级设置。为加快收敛,创新性地在混洗联邦学习下选择动量随机梯度下降作为全局优化器。实验表明,相同隐私水平下,所提算法比相关算法获得至少4%的准确度提升,验证其实现更好的隐私-实用性平衡。更多还原

【Abstract】 Federated learning,as a new distributed machine learning paradigm,allows multiple parties to train models together without sharing the original data,but it still faces security threats like gradient attacks in practice.Differential privacy is widely used to protect privacy in machine learning due to its theory.For the different challenges and privacy requirements in each stage of federated learning,i.e.,the heterogeneity and confidentiality of data in local training,the limitation and security of communication in parameter uploading and the privacy-utility trade-off in parameter aggregation,the corresponding differentially private federated learning algorithms are designed to guarantee performance and security.Specifically,it includes the following three aspects:In the stage of local training,the sensitive and heterogeneous data of the client brings challenges to the safe and efficient model training.Since data heterogeneity aggravates the variance caused by partial client sampling,uniform sampling without replacement is proposed to ensure clients are selected the same number of times,thus avoiding the sampling variance.To protect the privacy of local data,the gradient perturbation method based on Gaussian noise is proposed and the advanced truncated concentrated differential privacy definition is used to tightly record the privacy loss.Besides,since the local model is trained on heterogeneous data between clients,differences exist between the aggregated global model and the local model.To tackle both model divergence and artificial noise,an improved algorithm based on server-side adaptive optimization is proposed to enhance the training speed and efficiency.The convergence and privacy of the algorithm are measured by theoretical convergence bounds and differential privacy level,and experiments verify that compared with existing algorithms,the proposed algorithm on heterogeneous datasets converges faster and improves the test accuracy by at least 5%.In the stage of parameter uploading,secure information sharing and limited communication budget between client and server challenge the privacy and communication efficiency of the algorithm.The traditional uniform client sampling lowers the communication cost by reducing the number of clients participating in the aggregation,but ignoring certain clients more affects the global model,causing the participation of worthless clients and reducing the model training speed and communication efficiency,so the importance sampling method is proposed to further reduce the communication and ensure the performance by selecting a few important clients.Specifically,the model update norm is used to evaluate the client’s importance,and the variance between full sampling and adopted sampling is minimized to calculate the probability of the client being selected.For privacy,since information sharing needs stronger privacy protection than local training,except for improving the privacy definition,a hyperbolic sine-Gaussian mechanism is used to more tightly characterize the tail probability of privacy loss.The convergence and privacy of the algorithm are reflected by convergence bounds and differential privacy level,and experiments verify that compared to the related algorithms,the proposed algorithm achieves a 10x improvement in communication efficiency and at least 8%improvement in test accuracy.In the stage of parameter aggregation,the widely-used local and centralized differential privacy models suffer from a privacy-utility trade-off,thus proposing a shuffle model with privacy amplification to solve it.But the added shuffler consumes extra communication and communication compression is considered under the general model of federated learning,i.e.,distributed mean estimation.Specifically,the input vector of the minimal random coding algorithm is extended to the bounded setting,and a private compressed mechanism with high privacy,low communication and exact optimal error is proposed.Besides,under the minimal trust framework using only the shuffler,an autonomous client participation method is proposed and its randomness is utilized to further protect privacy.Multifold privacy amplifications in the shuffle model cause complex overall privacy analysis,thus using the basic random response to achieve local privacy,but the analysis process applies to the advanced settings based on gradient perturbation.To accelerate convergence,momentum stochastic gradient descent is adopted as the global optimizer for the first time under shuffle federated learning.Experiments show that at the same privacy level,the proposed algorithm can achieve at least 4%accuracy improvement compared with related algorithms,which verifies that it achieves a better privacy-utility trade-off.更多还原