EP4649426A1

EP4649426A1 - Method and apparatus for federated training

Info

Publication number: EP4649426A1
Application number: EP23700289.4A
Authority: EP
Inventors: Péter SZILÁGYI; Csaba VULKÁN
Original assignee: Nokia Solutions and Networks Oy
Current assignee: Nokia Solutions and Networks Oy
Priority date: 2023-01-12
Filing date: 2023-01-12
Publication date: 2025-11-19
Also published as: WO2024149465A1

Abstract

An apparatus (100) for federated training, the apparatus comprising means for: - Computing a common training model and a set of data-processing models in a central server, wherein the set of data-processing models comprises a first model and a second model, - Transmitting the common training model to a plurality of distributed trainers (101), wherein the plurality of distributed trainers comprises a first distributed trainer and a second distributed trainer, - Receiving a first training gradient (102) from the first distributed trainer and a second training gradient from the second distributed trainer, - Updating a first subset of the set of data-processing models using the first training gradient, wherein the first subset does not comprise the first model, - Updating a second subset of the set of data-processing models using the second training gradient, wherein the second subset does not comprise the second model.

Description

METHOD AND APPARATUS FOR FEDERATED TRAINING

Field

The disclosure relates to apparatuses and methods for applying federated learning in a distributed setting.

Background

Federated learning is a paradigm in which a machine learning model is trained in a distributed setting, with a central trainer and remote, distributed trainers.

The distributed trainers compute training gradients using the machine learning model and local data and transmit said training gradients to the central trainer. The central trainer then updates the machine learning model using the training gradients.

Federated learning ensures privacy. There is no need to transfer the local data to the central trainer, which keeps user data safe. However, there is a vulnerability of federated learning to corrupted distributed trainers, as the machine learning model has no direct access to the local data.

Thus, there is a need for apparatuses and methods which can perform federated learning while mitigating said vulnerability.

Summary

In some embodiments, the disclosure provides an apparatus for federating training. The apparatus comprises means for:

Computing a common training model and a set of data-processing models in a central server, wherein the set of data-processing models comprises a first model and a second model,

Transmitting the common training model to a plurality of distributed trainers, wherein the plurality of distributed trainers comprises a first distributed trainer and a second distributed trainer, wherein the first distributed trainer has access to a first dataset embedded in a first remote device and wherein the second distributed trainer has access to a second dataset embedded in a second remote device,

Receiving a first training gradient from the first distributed trainer and a second training gradient from the second distributed trainer, wherein the first training gradient is computed using the common training model and the first dataset and wherein the second training gradient is computed using the common training model and the second dataset,

Updating a first subset of the set of data-processing models using a first group of training gradients, wherein the first group of training gradients comprises the first training gradient and does not comprise the second training gradient, wherein the first subset of the set of data-processing models does not comprise the first model and comprises the second model,

Updating a second subset of the set of data-processing models using a second group of training gradients, wherein the second group of training gradients comprises the second training gradient and does not comprise the first training gradient, wherein the second subset does not comprise the second model and the second subset comprises the first model,

Updating the common training model using the first training gradient and the second training gradient.

Thanks to these features, the set of data-processing models is robust to a presence of a malicious distributed trainers in the plurality of distributed trainers.

The apparatus for federating training may also comprise one or more of the following features.

In an embodiment, the apparatus further comprises means for, after updating the common training model, iterating to the step of transmitting the common training model until the common training model fulfils a convergence criterion.

In an embodiment, the first subset of the set of data-processing models is fixed and unique to said first distributed trainer and the second subset of the set of data-processing models is fixed and unique to said second distributed trainer.

In an embodiment, the apparatus further comprises means for: Collecting metadata about the plurality of distributed trainers,

Determining a subset of the distributed trainers as a function of the metadata, wherein the metadata of the subset of the distributed trainers satisfies a similarity condition,

Selecting a common subset of data-processing models within the set of data- processing models and associating the common subset of data-processing models to the subset of the distributed trainers,

Receiving a set of elementary training gradients from the subset of the distributed trainers, wherein the set of elementary training gradients is computed using the common training model and datasets available to the subset of the distributed trainer,

Updating the common subset of the set of data-processing models using the set of elementary training gradients.

Thanks to these features, a larger number of distributed trainers may be used.

According to an embodiment, the metadata comprises at least one technical and/or physical feature of the plurality of distributed trainers.

According to an embodiment, the plurality of distributed trainers comprises a third distributed trainer having access to a third dataset embedded in a third remote device, the apparatus further comprising means for: receiving a third training gradient from the third distributed trainer, wherein the third training gradient is computed using the common training model and the third dataset, wherein the first and second groups of training gradients comprise the third training gradient.

According to an embodiment, the plurality of distributed trainers comprises a third distributed trainer having access to a third dataset embedded in a third remote device, the apparatus further comprising means for: receiving a third training gradient from the third distributed trainer, wherein the third training gradient is computed using the common training model and the third dataset, wherein the first and second groups of training gradients do not comprise the third training gradient.

Thanks to these features, the set of data-processing models is more robust to a presence of a malicious distributed trainers in the plurality of distributed trainers.

According to an embodiment, the apparatus further comprises means for:

Collecting a verification dataset comprising synthetic verification data and/or real verification data,

Selecting an input value from the verification dataset and computing respective output values from the input value using the set of data processing models ,

Clustering the set of data-processing models into a set of clusters based on the output values,

In response to the set of clusters comprising at least two clusters, selecting a first ensemble of data-processing models from the set of data-processing models, wherein the first ensemble comprises data-processing models having received training gradients from the first distributed trainer,

Reporting the first distributed trainer as suspicious in response to determining that every cluster in the set of clusters belongs either to a first class or to a second class, wherein the first class consists of clusters containing only data- processing models of the first ensemble, wherein the second class consists of clusters containing no data-processing model of the first ensemble.

Thanks to these features, suspicious distributed trainers may be identified.

According to an embodiment, the apparatus further comprises means for transmitting the set of data-processing models to first and second user entities, wherein the first user entity has access to first user data and computes first inference values using the set of data-processing models and the first user data, wherein the second user entity has access to second user data and computes second inference values using the set of data-processing models and the second user data.

According to an embodiment, the first and/or second user entity is selected among the plurality of distributed trainers. According to an embodiment, the apparatus further comprises means for: receiving an anomaly alert from the first user entity, wherein the anomaly alert comprises an identifier for identifying a suspicious distributed trainer among the plurality of distributed trainers, identifying a suspicious subset of the set of data-processing models, wherein the data-processing models in the suspicious subset have been updated using a training gradient from the suspicious distributed trainer, transmitting an exclusion signal to the first and second user entities, wherein the exclusion signal commands the first and second user entities to cease using the suspicious subset of the set of data-processing models.

Thanks to these features, the apparatus may aggregate anomaly alerts from the user entities and decide whether the suspicious subset is compromised.

According to an embodiment, the apparatus further comprises means for determining a number of anomaly alerts received identifying said suspicious distributed trainer and transmitting the exclusion signal in response to determining that the number of anomaly alerts is above an anomaly threshold.

According to an embodiment, the apparatus further comprises means for excluding the suspicious distributed trainer from the plurality of distributed trainers and recruiting a substitute distributed trainer and updating the plurality of distributed trainers to include the substitute distributed trainer.

Thanks to these features, the set of data-processing models may be updated with different distributed trainers.

In some example embodiments, the disclosure also provides a method for federated training, the method comprising the steps of:

The method for federating training may also comprise one or more of the following features.

In an embodiment, the method further comprises the steps of, after updating the common training model, iterating to the step of transmitting the common training model until the common training model fulfils a convergence criterion.

In an embodiment, the method further comprises the steps of:

Collecting metadata about the plurality of distributed trainers,

Determining a subset of the distributed trainers as a function of the metadata, wherein the metadata of the subset of the distributed trainers satisfies a similarity condition, Selecting a common subset of data-processing models within the set of data- processing models and associating the common subset of data-processing models to the subset of the distributed trainers,

According to an embodiment, the method further comprises the steps of: Collecting a verification dataset comprising synthetic verification data and/or real verification data,

Selecting an input value from the verification dataset and computing respective output values from the input value using the set of data processing models,

According to an embodiment, the method further comprises the steps of transmitting the set of data-processing models to first and second user entities, wherein the first user entity has access to first user data and computes first inference values using the set of data-processing models and the first user data, wherein the second user entity has access to second user data and computes second inference values using the set of data-processing models and the second user data.

According to an embodiment, the method further comprises the steps of: receiving an anomaly alert from the first user entity, wherein the anomaly alert comprises an identifier for identifying a suspicious distributed trainer among the plurality of distributed trainers, identifying a suspicious subset of the set of data-processing models, wherein the data-processing models in the suspicious subset have been updated using a training gradient from the suspicious distributed trainer, transmitting an exclusion signal to the first and second user entities, wherein the exclusion signal commands the first and second user entities to cease using the suspicious subset of the set of data-processing models.

According to an embodiment, the method further comprises the steps of determining a number of anomaly alerts received identifying said suspicious distributed trainer and transmitting the exclusion signal in response to determining that the number of anomaly alerts is above an anomaly threshold.

According to an embodiment, the method further comprises the steps of excluding the suspicious distributed trainer from the plurality of distributed trainers and recruiting a substitute distributed trainer and updating the plurality of distributed trainers to include the substitute distributed trainer.

In some embodiments, the invention provides a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform the above method.

In some example embodiments, the means in the apparatus further comprises:

At least one processor; and

At least one memory including a computer program code, the at least one memory and computer program code configured to, with the at least one processor, cause the operations of the apparatus. The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus to:

Compute a common training model and a set of data-processing models in a central server, wherein the set of data-processing models comprises a first model and a second model,

Transmit the common training model to a plurality of distributed trainers, wherein the plurality of distributed trainers comprises a first distributed trainer and a second distributed trainer, wherein the first distributed trainer has access to a first dataset embedded in a first remote device and wherein the second distributed trainer has access to a second dataset embedded in a second remote device,

Receive a first training gradient from the first distributed trainer and a second training gradient from the second distributed trainer, wherein the first training gradient is computed using the common training model and the first dataset and wherein the second training gradient is computed using the common training model and the second dataset,

Update a first subset of the set of data-processing models using a first group of training gradients, wherein the first group of training gradients comprises the first training gradient and does not comprise the second training gradient, wherein the first subset of the set of data-processing models does not comprise the first model and comprises the second model,

Update a second subset of the set of data-processing models using a second group of training gradients, wherein the second group of training gradients comprises the second training gradient and does not comprise the first training gradient, wherein the second subset does not comprise the second model and the second subset comprises the first model,

Update the common training model using the first training gradient and the second training gradient. The at least one memory and the computer program code may further be configured to, with the at least one processor, cause the apparatus to, after updating the common training model, iterate to the step of transmitting the common training model until the common training model fulfils a convergence criterion.

The at least one memory and the computer program code may further be configured to, with the at least one processor, cause the apparatus to:

Collect metadata about the plurality of distributed trainers,

Determine a subset of the distributed trainers as a function of the metadata, wherein the metadata of the subset of the distributed trainers satisfies a similarity condition,

Select a common subset of data-processing models within the set of data- processing models and associating the common subset of data-processing models to the subset of the distributed trainers,

Receive a set of elementary training gradients from the subset of the distributed trainers, wherein the set of elementary training gradients is computed using the common training model and datasets available to the subset of the distributed trainer,

Update the common subset of the set of data-processing models using the set of elementary training gradients.

Collect a verification dataset comprising synthetic verification data and/or real verification data,

Select an input value from the verification dataset and computing respective output values from the input value using the set of data processing models, Cluster the set of data-processing models into a set of clusters based on the output values,

In response to the set of clusters comprising at least two clusters, select a first ensemble of data-processing models from the set of data-processing models, wherein the first ensemble comprises data-processing models having received training gradients from the first distributed trainer,

Report the first distributed trainer as suspicious in response to determining that every cluster in the set of clusters belongs either to a first class or to a second class, wherein the first class consists of clusters containing only data- processing models of the first ensemble, wherein the second class consists of clusters containing no data-processing model of the first ensemble.

The at least one memory and the computer program code may further be configured to, with the at least one processor, cause the apparatus to transmit the set of data-processing models to first and second user entities, wherein the first user entity has access to first user data and computes first inference values using the set of data-processing models and the first user data, wherein the second user entity has access to second user data and computes second inference values using the set of data-processing models and the second user data.

The at least one memory and the computer program code may further be configured to, with the at least one processor, cause the apparatus to: receive an anomaly alert from the first user entity, wherein the anomaly alert comprises an identifier for identifying a suspicious distributed trainer among the plurality of distributed trainers, identify a suspicious subset of the set of data-processing models, wherein the data- processing models in the suspicious subset have been updated using a training gradient from the suspicious distributed trainer, transmit an exclusion signal to the first and second user entities, wherein the exclusion signal commands the first and second user entities to cease using the suspicious subset of the set of data-processing models.

The at least one memory and the computer program code may further be configured to, with the at least one processor, cause the apparatus to determine a number of anomaly alerts received identifying said suspicious distributed trainer and transmitting the exclusion signal in response to determining that the number of anomaly alerts is above an anomaly threshold. The at least one memory and the computer program code may further be configured to, with the at least one processor, cause the apparatus to exclude the suspicious distributed trainer from the plurality of distributed trainers and recruiting a substitute distributed trainer and updating the plurality of distributed trainers to include the substitute distributed trainer.

In some example embodiments, the disclosure also provides an apparatus comprising:

A first computing circuitry configured to compute a common training model and a set of data-processing models in a central server, wherein the set of data-processing models comprises a first model and a second model,

A first transmitting circuitry configured to transmit the common training model to a plurality of distributed trainers, wherein the plurality of distributed trainers comprises a first distributed trainer and a second distributed trainer, wherein the first distributed trainer has access to a first dataset embedded in a first remote device and wherein the second distributed trainer has access to a second dataset embedded in a second remote device,

A first receiving circuitry configured to receive a first training gradient from the first distributed trainer and a second training gradient from the second distributed trainer, wherein the first training gradient is computed using the common training model and the first dataset and wherein the second training gradient is computed using the common training model and the second dataset,

A first updating circuitry configured to update a first subset of the set of data- processing models using a first group of training gradients, wherein the first group of training gradients comprises the first training gradient and does not comprise the second training gradient, wherein the first subset of the set of data-processing models does not comprise the first model and comprises the second model,

A second updating circuitry configured to update a second subset of the set of data-processing models using a second group of training gradients, wherein the second group of training gradients comprises the second training gradient and does not comprise the first training gradient, wherein the second subset does not comprise the second model and the second subset comprises the first model,

A third updating circuitry configured to update the common training model using the first training gradient and the second training gradient.

In an embodiment, the apparatus further comprises an iterating circuitry configured to, after updating the common training model, iterating to the step of transmitting the common training model until the common training model fulfils a convergence criterion.

In an embodiment, the apparatus further comprises:

A first collecting circuitry configured to collect metadata about the plurality of distributed trainers,

A first determining circuitry configured to determine a subset of the distributed trainers as a function of the metadata, wherein the metadata of the subset of the distributed trainers satisfies a similarity condition,

A first selecting circuitry configured to select a common subset of data- processing models within the set of data-processing models and associating the common subset of data-processing models to the subset of the distributed trainers,

A second receiving circuitry configured to receive a set of elementary training gradients from the subset of the distributed trainers, wherein the set of elementary training gradients is computed using the common training model and datasets available to the subset of the distributed trainer,

A fourth updating circuitry configured to update the common subset of the set of data-processing models using the set of elementary training gradients. According to an embodiment, the apparatus further comprises:

A second collecting circuitry configured to collect a verification dataset comprising synthetic verification data and/or real verification data, A second selecting circuitry configured to select an input value from the verification dataset and a second computing circuitry configured to compute respective output values from the input value using the set of data processing models,

A clustering circuitry configured to cluster the set of data-processing models into a set of clusters based on the output values,

A second selecting circuitry configured to, in response to the set of clusters comprising at least two clusters, select a first ensemble of data-processing models from the set of data-processing models, wherein the first ensemble comprises data-processing models having received training gradients from the first distributed trainer,

A reporting circuitry configured to report the first distributed trainer as suspicious in response to determining that every cluster in the set of clusters belongs either to a first class or to a second class, wherein the first class consists of clusters containing only data-processing models of the first ensemble, wherein the second class consists of clusters containing no data- processing model of the first ensemble.

According to an embodiment, the apparatus further comprises a second transmitting circuitry configured to transmit the set of data-processing models to first and second user entities, wherein the first user entity has access to first user data and computes first inference values using the set of data-processing models and the first user data, wherein the second user entity has access to second user data and computes second inference values using the set of data-processing models and the second user data.

According to an embodiment, the apparatus further comprises: a third receiving circuitry configured to receive an anomaly alert from the first user entity, wherein the anomaly alert comprises an identifier for identifying a suspicious distributed trainer among the plurality of distributed trainers, an identifying circuitry configured to identify a suspicious subset of the set of data- processing models, wherein the data-processing models in the suspicious subset have been updated using a training gradient from the suspicious distributed trainer, a third transmitting circuitry configured to transmit an exclusion signal to the first and second user entities, wherein the exclusion signal commands the first and second user entities to cease using the suspicious subset of the set of data-processing models.

According to an embodiment, the apparatus further comprises a second determining circuitry configured to determine a number of anomaly alerts received identifying said suspicious distributed trainer and transmitting the exclusion signal in response to determining that the number of anomaly alerts is above an anomaly threshold.

According to an embodiment, the apparatus further comprises an excluding circuitry configured to exclude the suspicious distributed trainer from the plurality of distributed trainers and recruiting a substitute distributed trainer and updating the plurality of distributed trainers to include the substitute distributed trainer.

Brief description of the drawings

These and other aspects of the invention will be apparent from and elucidated with reference to example embodiments described hereinafter, by way of example, with reference to the drawings.

FIG. 1 represents a schematic view of a plurality of remote trainers interacting with a central trainer.

FIG. 2 represents a schematic view of a training phase implemented in the central trainer.

FIG. 3 represents a diagram of the training phase carried out by the central trainer.

FIG. 4 represents a diagram of a model-management process carried out by one of the plurality of distributed trainers. FIG. 5 represents a schematic view of an alert confirmation process carried out by the central trainer.

FIG. 6 represents a schematic view of an application of the invention according to a first embodiment.

FIG. 7 represents a schematic view of an application of the invention according to a second embodiment.

FIG. 8 is a functional diagram of a programmed computer in which example embodiments of the invention may be implemented.

Detailed description of the embodiments

FIG. 1 represents a plurality of distributed trainers 101₁₍ 101₂, ... , 101_w and a central trainer 100 in a federated learning setting. The distributed trainers lOL 101₂, ... , 101_w and the central trainer 100 are able to communicate through a communications network. The plurality of distributed trainers lOL 101₂, ... , 101_w may comprise edge devices or remote devices and may comprise hardware or software. Examples of distributed trainers include smart connected objects, mobile devices or applications. The central trainer 100 may be implemented on a server and the server may be on premise or on the cloud.

Local data is embedded in the plurality of distributed trainers lOL 101₂, ... , 101_w. The plurality of distributed trainers 101_x, 101₂, ... , 101_w is chosen among a plurality of users or monitored equipment. There may be thousands, up to hundreds of thousands of distributed trainers.

The central trainer 100 comprises a common training model M_N+1 which is communicated to the plurality of distributed trainers lOL 101₂, ... , 101_w.

Alternatively, one or several of the plurality of distributed trainers may be a group of distributed trainers. Metadata may be collected about the distributed trainers. The metadata may comprise an identifier of a manufacturer of the distributed trainers, a hardware and/or software specification, a device configuration, or a geographical area of the distributed trainer. The group of distributed trainers may be determined based on values of one or a plurality of metadata.

Using groups of distributed trainers instead of or in addition to individual distributed trainers results in a greater variety of data sources and a greater volume of data being processed for a given number of data-processing models. Thus, it helps maintain a target value of computational cost for training the set of data-processing models.The common training model M_N+1 is a parametric model. According to an embodiment, the common training model M_N+1 may be an artificial neural network. The common training model M_N+1 may be a shallow neural network (such as a linear regression model or a logistic regression model) or a deep neural network. The common training model M_N+1 may be a sequential neural network, a convolutional neural network or a recurring neural network, for instance. The common training model M_N+1 may be initialized randomly or using predefined values, such as a pretrained model.

The common training model M_N+1 is transmitted to the plurality of distributed trainers lOli, 101₂, ... , 101_w for a training step. Each distributed trainer of the plurality of distributed trainers lOli, 101₂, ... , 101_w performs a training step on the local data and computes training gradients for updating the common training model, by performing backpropagation.

The plurality of distributed trainers lOli, 101₂, ..., 101_w transmits a plurality of training gradients to the central trainer 100. The central trainer 100 updates the common training model M_N+1 using the plurality of training gradients.

The central trainer 100 then sends the common training model M_N+1 back to the plurality of distributed trainers lOL 101₂, ... , 101_w for another training step, thus repeating the same process until training is over.

The disclosure may be applied to a broad range of applications. The local data may comprise images, sound clips, textual data or user behavior data. Due to the sensitivity of such data, it is critical that user privacy is preserved while training the common training model. The disclosure may be used for object recognition, face recognition (for example to unlock a smartphone), speech recognition (for example voice commands for a virtual assistant), among other applications. It may also be used for advertising or fraud detection. The disclosure may also be used for predictive maintenance of user equipment or network infrastructures.

FIG. 2 represents the central trainer 100 according to an embodiment. The central trainer 100 includes a set of data-processing models M_lt M₂, ... , M_N and the common model M_N+1.

The central trainer 100 receives the plurality of training gradients 102 and update each data-processing model of the set of data-processing models with a respective model-specific set of training gradients 103_x, 103₂, ..., 103_w. The common training model M_N+1. receives all training gradients of the plurality of training gradients 102.

The model-specific set of training gradients 103 comprise a subset of the plurality of training gradients 102. According to an embodiment, for the set of data- processing models M₁, M₂, the model-specific set of training gradients comprises the plurality of training gradients 102 except one training gradient provided by a predetermined distributed trainer. The model-specific set of training gradients is unique to each of the data-processing models Indeed, two data-processing models will be updated with training gradients originating from distinct subsets of the plurality of distributed trainers lOL 101₂, ..., 101_w.

Thus, each model of the set of data-processing models M_lt M₂, ... , M_N receives training gradients from a model-specific subset of the plurality of distributed trainers lOli, 101₂, ..., 101_w, said model-specific subset being unique to each model and fixed through the training phase.

According to an embodiment, each model receives training gradients originating in N — 1 distributed trainers out of the plurality of distributed trainers lOli, 101₂, ..., 101_w. According to an embodiment, each model receives training gradients originating in N — k distributed trainers out of the plurality of distributed trainers lOL 101₂, ..., 101_w, wherein k is an integer between 2 and N — 1. According to an embodiment, the set of data-processing models may comprise more than N models. The set of data-processing models may comprise m models, wherein m is any integer comprised between N + 1 and 2^W — 2. The models in the set of data-processing models may receive training gradients from modelspecific subsets of distributed trainers of various sizes. For each model of the set of data-processing models, training gradients from at least one of the plurality of distributed trainer are not incorporated in said each model.

Each model-specific set of training gradients of the model-specific sets of training gradients 103^ 103₂, ... , 103_w is used to update parameters, for example weights and biases, of a model of the set of data processing models

The training gradients in the model-specific set of training gradients may be combined, for example averaged, in order to update the model. Not all parameters of the model may be updated. In the case of a pretrained model, some layers in the model may be kept frozen.

After the set of data-processing models and the common training model M_w+1are updated, the common training model M_N+1 is once again transmitted to the plurality of distributed trainers lOli, 101₂, ... , 101_w for another training step.

With reference to FIG. 3, a schematic representation of the training phase is provided.

An initializing phase 200 is first carried out. The initializing phase 200 comprises an architecture-selecting step 201 and a set-building step 202.

The architecture-selecting step 201 comprises an initialization of a deep learning model. The architecture-selecting step 201 comprises choosing an architecture and a set of hyperparameters for the deep learning model, as well as activation functions used within the deep learning model. Activation functions may comprise Rectified Linear Units (ReLU), Leaky ReLU, hyperbolic tangent, sigmoid, softmax...

Weights and biases of the deep learning model may be initialized at a chosen value (for example using weights of a pre-trained model) or may be initialized randomly. If the deep learning model is a pretrained model, the architectureselecting step 201 may comprise choosing which layers are frozen and which weights of the pretrained model will be kept at the start of the training phase.

The set-building step 202 comprises initializing the set of data-processing models and the common training model M_N+1. The deep learning model may be copied N + 1 times in order to build the set of data-processing models and the common training model M_N+1.

According to an embodiment, the set of data-processing models M₁, M₂, comprises copies of the deep learning model with slight variations in initial weights, for example with initial weights re-initialized randomly. The set of data-processing models M_lt M₂, and the common training model M_N+1 keep the same architecture, hyperparameters and activation functions.

After the initializing phase 200, a training sequence 210 is carried out using the set of data-processing models and the common training model

M_N+1. The training sequence 210 comprises a completion-checking step 203, a transmission step 204, a reception step 205 and an updating step 206. The training sequence 210 is repeated in a loop until an ending criterion is fulfilled. Then, the training sequence 210 is finished and a model-publishing step 207 is carried out.

The completion-checking step 203 comprises checking if the ending criterion is fulfilled. The ending criterion may be a predefined number of iterations of the training sequence 210 or if a predefined training time is over. Alternatively, the ending criterion may be a function of chosen metrics of performance. For example, the ending criterion may be whether a combined validation error of the set of data- processing models and/or the common training model reaches a predefined value. The combined validation error may for example be an average of validation errors of the set of data processing models and the common training model M_w+i.

Alternatively, an early stopping strategy may be carried out. The ending criterion may be whether a combined validation error starts increasing, for example. If the ending criterion is fulfilled during the completion-checking step 203, the training sequence 210 is interrupted and the model-publishing step 207 is carried out.

Else, the training sequence 210 continues. During the transmission step 204, the common training model M_N+1 is transmitted from the central trainer 100 to the plurality of distributed trainers 101_x, 101₂, ... , 101_w.

The plurality of distributed trainers 101_x, 101₂, ..., 101_w then carries out a training step. The plurality of distributed trainers lOL 101₂, ... , 101_w applies forward propagation, cost computing and backpropagation to the common training model in order to compute the plurality of training gradients 102_x, 102₂, ... , 102_w. The plurality of training gradients 102_x, 102₂, ... , 102_w is computed by applying the common training model M_N+1 to local data available only to the plurality of distributed trainers 101^ 101₂, ... , 101_w. Each of the distributed trainers has access to equipment-specific local data, which may be data relating to an application, an equipment or a device, for example.

During the reception step 205, the central trainer 100 receives the plurality of training gradients 102_x, 102₂, ... , 102_w from the plurality of distributed trainers lOli, 101₂, ... , 101_w. The plurality of training gradients 102_x, 102₂, ... , 102_w may be received through an encrypted medium to ensure better data privacy, for example using zero-sum masks.

The updating step 206 is then carried out and the common training model M_N+1 and the set of data-processing models are updated. The common training model M_N+1 is updated using a combination of the training gradients from all the distributed trainers. Each of the set of data-processing models M_lt M₂, ... , M_N is updated using the model-specific set of training gradients.

After the updating step 206, the completion-checking step 203 is carried out once again to determine if the training is finished.

When the training is finished, the publishing step 207 is carried out. According to an embodiment, the set of data-processing models M_lt M₂, ... , M_N is transmitted to the plurality of distributed trainers lOL 101₂, ... , 101_w, so that the plurality of distributed trainers 101₁₍ 101₂, ..., 101_w may compute output values for inference using the set of data-processing models —, M_N.

The central trainer 100 also establishes a mapping table. The mapping table encodes the model-specific subset of distributed trainers associated with each model of the set of data-processing models —, M_N, where the model-specific subset of distributed trainers comprises the distributed trainers which contributed to the training of said each model.

According to an embodiment, the set of data-processing models is transmitted to user entities. The user entities may comprise the plurality of distributed trainers 101^ 101₂, ..., 101_w and may be any kind of equipment or device, hardware or software. For example, the plurality of distributed trainers 101^ 101₂, ... , 101_w may comprise thousands of mobile devices and the user entities may comprise millions of mobile devices.

The set of data-processing models M_lt M₂, ... , M_N is then embedded in each of the user entities for inference on the local data.

According to an embodiment, for a data sample, a user entity computes intermediate output values for each model of the set of data-processing models and returns as a final output value a combination (e.g. an average) of the intermediate output values.

The common training model M_N+1 may not be transmitted to the user entities for inference. The plurality of distributed trainers lOL 101₂, ..., 101_w is kept unaware of the existence of the set of data-processing models M_lt M₂, ... , M_N during the training phase, to reduce vulnerabilities.

Indeed, the plurality of distributed trainers lOL 101₂, ..., 101_w may comprise a corrupted distributed trainer. Some vulnerabilities may be exploited during the training phase by a corrupted distributed trainer.

The corrupted distributed trainer may for example take advantage of an architecture of the common training model and of the activation functions used within the common training model. The central trainer 100 may receive corrupted training gradients from the corrupted distributed trainer. The corrupted training gradients may for example be too small or too large, which may provoke gradient vanishing or gradient explosion and prevent learning.

The updating step 206 of the set of data-processing models prevents the corrupted distributed trainer from affecting all models in the set of data- processing as the corrupted training gradients will not be incorporated in at least one model of the set of data-processing models

During inference, further action is taken in order to identify potentially corrupted distributed trainers.

With reference to FIG. 4, a model-management process 300 is described. The model-management process 300 is carried out by the user entities. The modelmanagement process 300 comprises a data-retrieving step 301, a computing step 302, a clustering step 303, a first anomaly-checking step 304, a first exit step 305, a second anomaly-checking step 306, a second exit step 307 and a reporting step 308.

In the data-retrieving step 301, the user entity retrieves a local data sample, which may be real-time data, near real-time data, or stored data. In the computing step 302, the intermediate output values are computed by the set of data-processing models.

The clustering step 303 is then carried out. The intermediate output values are clustered into a set of clusters. Any clustering method may be used, such as, for example, the k-means algorithm, DBSCAN or affinity propagation. A hyperparameter of the k-means algorithm may be predetermined or computed using, for example, the elbow method or the silhouette method.

The set of clusters are computed on the basis of a similarity metric. The similarity metric may depend on the type of data considered. In the case of numeric data, for example Manhattan distance or Euclidian distance may be used. In the case of image data, well-known image-similarity metrics may be used, for example.

The first anomaly-checking step 304 receives the set of clusters. The first anomaly-checking step 304 computes a number of clusters in the set of clusters. If there is only one cluster in the set of clusters, no anomaly is detected and the modelmanagement process ends through the first exit step 305.

If there is at least two clusters in the set of clusters, the second anomalychecking step 306 further analyzes the set of clusters. The central trainer 100 may transmit the mapping table to the user entities alongside the set of data-processing models. Identities of the plurality of distributed trainers 101_x, 101₂, ... , 101_w may be encrypted in the mapping table so as to ensure data privacy.

During the second anomaly-checking step 306, the user entity checks if there is a distributed trainer which contributed exclusively to the training of models belonging to one cluster of the set of clusters.

If each distributed trainer contributed to the training of models which belong to two or more clusters of the set of clusters, the user entity proceeds to the second exit step 307. It is then considered that no anomaly is detected and that no corrupted distributed trainer is detected.

If the second anomaly-checking step 306 returns a suspect distributed trainer, said suspect distributed trainer contributing exclusively to the training of models belonging to one of the set of clusters, an identity of the suspect distributed trainer is transmitted to the central trainer in the reporting step 307.

The model-management process 300 may be carried out randomly by a fraction of the plurality of user entities at regular intervals, in order to limit impacts of the model-management process on a performance of the user entities.

During an initial time period, the model-management process 300 may be carried out by the user entities with a first frequency. After the initial time period, the model-management process may be carried out with a second frequency, wherein the second frequency is inferior to the first frequency. According to an embodiment, the initial time period may last a few days, during which the modelmanagement process 300 may be carried out once every second or once every minute. After the initial time period, the model-management process 300 may be performed once a day. According to an embodiment, after the initial time period, a best-performing subset of the set of data-processing models may be selected by each of the user entities. The best-performing subset of the set of data-processing models may be determined using a performance metric. Examples of the performance metric comprise accuracy, precision, recall or Fl score.

After the initial time period, the user entities perform inference using the models in the best-performing subset of the set of data-processing models, which allows to reduce a computational cost of inference. According to an embodiment, the best-performing subset comprises exactly one model.

According to an embodiment, the model-management process 300 may be carried out by the central trainer 100. The central trainer 100 may have access to a verification dataset, the verification dataset comprising synthetic data and/or real data from sources distinct from the distributed trainers. The verification dataset may have a different statistical distribution from the data from the distributed trainers.

The central trainer 100 may perform the model-management process once the set of data-processing models M_lt M₂, ... , M_N has been trained and before the set of data-processing model M_lt M₂, ... , M_N is transmitted to the plurality of distributed trainers, so as to remove suspicious models before transmitting them to the plurality of distributed trainers. The central trainer 100 may carry out the data-retrieving step 301, the computing step 302, the clustering step 303, the first anomaly-checking step 304, the first exit step 305, the second anomaly-checking step 306, the second exit step 307 and the reporting step 308.

With reference to FIG. 5, an alert confirmation process 400 is represented. The alert confirmation process 400 is carried out by the central trainer 100 during an exploitation of the set of data-processing models by the plurality of user entities.

The alert confirmation process 400 comprises an alert reception step 401, an investigation step 402 and a decision step 403.

During the alert reception step 401, the central trainer 100 receives an alert 411 from the user entity, the alert 411 comprising the identity of the suspect distributed trainer. The central trainer 100 then investigates whether the suspect distributed trainer is corrupted during the investigation step 402.

During the investigation step, the central trainer 100 aggregates alerts received from the plurality of user entities. An anomaly threshold is predetermined, either empirically or based on an analysis of a distribution of the alerts. An alert number is computed. The alert number may be a number of user entities having reported said suspect distributed trainer. According to an embodiment, the alert number may also be computed within a specific time window.

If the alert number is above the anomaly threshold, the central trainer concludes that the suspect distributed trainer is a corrupted distributed trainer.

During the decision step 403, the central trainer 100 establishes a list of corrupted models 413 in the set of data-processing models The corrupted models are models which received training gradients from the corrupted distributed trainer.

The list of corrupted models 413 is then transmitted to the plurality of user entities, along with a command to remove the corrupted models from the set of data- processing models

The central trainer 100 may then select new distributed trainers among the plurality of user entities, wherein the new distributed trainers do not comprise the corrupted distributed trainer. The central trainer 100 may perform a new training phase to compute new models in order to update or replace the set of data- processing models

With reference to FIG. 6 and FIG. 7, examples of applications of the apparatus are described.

With reference to FIG. 6, user equipments 401 and 402 may be used as distributed trainers, and the central trainer 404 may be implemented in a near realtime radio intelligent controller, with signals transitioning through at least one base station 403. The base station may for example be a gNB 5G Next Generation base station. According to an embodiment, a plurality of gNB base stations may be used as distributed trainers and may communicate directly with the central trainer implemented in the near real-time radio intelligent controller.

With reference to FIG. 7, 5G core network functions 501 and 502 may be used as distributed trainers and transmit data to a Network Data Analytics Function 503.

FIG. 8 shows a functional diagram of a programmed computer, server, circuitry, or apparatus 800 that may be used for implementing the above-described anomaly detection apparatus. Computer 800 has a core and several peripherals connected via a communication bus. The major components of the core are a microprocessor 801 (often called the CPU) random access memory (RAM) 802 and read only memory (ROM) 803. The peripherals comprise devices that allow information to be input to the system from users, output to users and stored and retrieved (mass storage devices 804 such as hard disks and network interfaces 805).

The invention is not limited to the described example embodiments. The appended claims are to be construed as embodying all modifications and alternative constructions that may occur to one skilled in the art, and which fairly fall within the basic teaching as set forth herein.

As used in this application, the term "circuitry" may refer to one or more or all of the following:

(a) hardware-only circuit implementations (such as implementations in only analog and/or digital circuitry) and

(b) combinations of hardware circuits and software, such as (as applicable):

(i) a combination of analog and/or digital hardware circuit(s) with software/firmware and

(ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a mobile phone or server, to perform various functions) and (c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation."

This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and/or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.

Elements such as the apparatus and its components could be or include e.g. hardware means like e.g. an Application-Specific Integrated Circuit (ASIC), or a combination of hardware and software means, e.g. an ASIC and a Field- Programmable Gate Array (FPGA), or at least one microprocessor and at least one memory with software modules located therein, e.g. a programmed computer.

The use of the verb "to comprise" or "to include" and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. Furthermore, the use of the article "a" or "an" preceding an element or step does not exclude the presence of a plurality of such elements or steps. The example embodiments may be implemented by means of hardware as well as software. The same item of hardware may represent several "means".

In the claims, any reference signs placed between parentheses shall not be construed as limiting the scope of the claims.

Claims

1. An apparatus for federating training (100), the apparatus comprising means for:

Transmitting the common training model to a plurality of distributed trainers (101), wherein the plurality of distributed trainers (101) comprises a first distributed trainer and a second distributed trainer, wherein the first distributed trainer has access to a first dataset embedded in a first remote device and wherein the second distributed trainer has access to a second dataset embedded in a second remote device,

Receiving a first training gradient (102) from the first distributed trainer and a second training gradient from the second distributed trainer, wherein the first training gradient (102) is computed using the common training model and the first dataset and wherein the second training gradient is computed using the common training model and the second dataset,

Updating a first subset of the set of data-processing models using a first group of training gradients (103), wherein the first group of training gradients (103) comprises the first training gradient (102) and does not comprise the second training gradient, wherein the first subset of the set of data-processing models does not comprise the first model and comprises the second model, Updating a second subset of the set of data-processing models using a second group of training gradients, wherein the second group of training gradients comprises the second training gradient and does not comprise the first training gradient (102), wherein the second subset does not comprise the second model and the second subset comprises the first model,

Updating the common training model using the first training gradient (102) and the second training gradient.

2. An apparatus (100) according to claim 1 further comprising means for: after updating the common training model, iterating to the step of transmitting the common training model until the common training model fulfils a convergence criterion.

3. An apparatus (100) according to claim 1 or 2, wherein the first subset of the set of data-processing models is fixed and unique to said first distributed trainer (101) and the second subset of the set of data-processing models is fixed and unique to said second distributed trainer.

4. An apparatus (100) according to any one of claims 1 to 3, further comprising means for:

Collecting metadata about the plurality of distributed trainers (101),

Receiving a set of elementary training gradients (102) from the subset of the distributed trainers, wherein the set of elementary training gradients (102) is computed using the common training model and datasets available to the subset of the distributed trainer,

Updating the common subset of the set of data-processing models using the set of elementary training gradients (102).

5. An apparatus (100) according to any one of claims 1 to 4, wherein the plurality of distributed trainers (101) comprises a third distributed trainer having access to a third dataset embedded in a third remote device, the apparatus further comprising means for: receiving a third training gradient (102) from the third distributed trainer, wherein the third training gradient (102) is computed using the common training model and the third dataset, wherein the first and second groups of training gradients (103) comprise the third training gradient.

6. An apparatus (100) according to any one of claims 1 to 4, wherein the plurality of distributed trainers (101) comprises a third distributed trainer having access to a third dataset embedded in a third remote device, the apparatus further comprising means for: receiving a third training gradient (102) from the third distributed trainer, wherein the third training gradient (102) is computed using the common training model and the third dataset, wherein the first and second groups of training gradients (103) do not comprise the third training gradient.

7. An apparatus (100) according to any one of claims 1 to 6, further comprising means for:

Reporting the first distributed trainer (101) as suspicious in response to determining that every cluster in the set of clusters belongs either to a first class or to a second class, wherein the first class consists of clusters containing only data-processing models of the first ensemble, wherein the second class consists of clusters containing no data-processing model of the first ensemble.

8. An apparatus (100) according to any one of claims 1 to 7, further comprising means for transmitting the set of data-processing models to first and second user entities, wherein the first user entity has access to first user data and computes first inference values using the set of data-processing models and the first user data, wherein the second user entity has access to second user data and computes second inference values using the set of data-processing models and the second user data.

9. An apparatus (100) according to claim 8, wherein the first and/or second user entity is selected among the plurality of distributed trainers (101).

10. An apparatus (100) according to claim 8 or 9, further comprising means for: receiving an anomaly alert from the first user entity, wherein the anomaly alert comprises an identifier for identifying a suspicious distributed trainer among the plurality of distributed trainers (101), identifying a suspicious subset of the set of data-processing models, wherein the data-processing models in the suspicious subset have been updated using a training gradient (102) from the suspicious distributed trainer, transmitting an exclusion signal to the first and second user entities, wherein the exclusion signal commands the first and second user entities to cease using the suspicious subset of the set of data-processing models.

11. An apparatus (100) according to claim 10, further comprising means for: determining a number of anomaly alerts received identifying said suspicious distributed trainer (101) and transmitting the exclusion signal in response to determining that the number of anomaly alerts is above an anomaly threshold.

12. An apparatus (100) according to any one of claims 1 to 11, further comprising means for excluding the suspicious distributed trainer (101) from the plurality of distributed trainers and recruiting a substitute distributed trainer and updating the plurality of distributed trainers to include the substitute distributed trainer.

13. A method for federating training, the method comprising the steps of: Computing a common training model and a set of data-processing models in a central server, wherein the set of data-processing models comprises a first model and a second model,

14. A method according to claim 13, further comprising the steps of, after updating the common training model, iterating to the step of transmitting the common training model until the common training model fulfils a convergence criterion.

15. A method according to claim 13 or 14, wherein the first subset of the set of data-processing models is fixed and unique to said first distributed trainer and the second subset of the set of data-processing models is fixed and unique to said second distributed trainer.